Skip to content

Commit

Permalink
fixed fuzzing crash
Browse files Browse the repository at this point in the history
AddressSanitizer:DEADLYSIGNAL
=================================================================
==247108==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000028 (pc 0x55e3348f5ccd bp 0x7ffc2c750a70 sp 0x7ffc2c7508a0 T0)
==247108==The signal is caused by a READ memory access.
==247108==Hint: address points to the zero page.
    #0 0x55e3348f5ccd in compilePrecedence2(Token*&, (anonymous namespace)::AST_state&) /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/13.2.1/../../../../include/c++/13.2.1/bits/stl_deque.h
    #1 0x55e3348f1a17 in compilePrecedence3(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1038:5
    #2 0x55e3348f13b5 in compilePointerToElem(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1137:5
    #3 0x55e3348f13b5 in compileMulDiv(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1147:5
    #4 0x55e3348f1095 in compileAddSub(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1166:5
    #5 0x55e3348f1095 in compileShift(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1176:5
    #6 0x55e3348f0d15 in compileThreewayComp(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1186:5
    #7 0x55e3348f0d15 in compileRelComp(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1196:5
    #8 0x55e3348f07b5 in compileEqComp(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1206:5
    #9 0x55e3348f07b5 in compileAnd(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1216:5
    #10 0x55e3348efe9a in compileXor(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1235:5
    #11 0x55e3348efe9a in compileOr(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1245:5
    #12 0x55e3348efe9a in compileLogicAnd(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1255:5
    #13 0x55e3348ee8d9 in compileLogicOr(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1274:5
    #14 0x55e3348ee8d9 in compileAssignTernary(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1284:5
    #15 0x55e3348eb768 in compileComma(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1325:5
    #16 0x55e3348eb768 in compileExpression(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1343:9
    #17 0x55e3348e0f49 in createAstAtToken(Token*, bool) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1689:9
    #18 0x55e3348dd43e in TokenList::createAst() const /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1717:15
    #19 0x55e334811894 in Tokenizer::simplifyTokens1(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenize.cpp:3363:14
    #20 0x55e334354304 in CppCheck::checkFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::istream*) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/cppcheck.cpp:906:32
    #21 0x55e334360521 in CppCheck::check(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/cppcheck.cpp:558:12
    #22 0x55e333d69d03 in LLVMFuzzerTestOneInput /home/user/CLionProjects/cppcheck-rider/oss-fuzz/main.cpp:45:18
    #23 0x55e333c10538 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x573538) (BuildId: a183bbe392f62ddef4ec71808dcbc702acf3775d)
    #24 0x55e333c11210 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool, bool*) (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x574210) (BuildId: a183bbe392f62ddef4ec71808dcbc702acf3775d)
    #25 0x55e333c122a1 in fuzzer::Fuzzer::MutateAndTestOne() (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x5752a1) (BuildId: a183bbe392f62ddef4ec71808dcbc702acf3775d)
    #26 0x55e333c130c7 in fuzzer::Fuzzer::Loop(std::vector<fuzzer::SizedFile, std::allocator<fuzzer::SizedFile>>&) (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x5760c7) (BuildId: a183bbe392f62ddef4ec71808dcbc702acf3775d)
    #27 0x55e333bf35b2 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x5565b2) (BuildId: a183bbe392f62ddef4ec71808dcbc702acf3775d)
    #28 0x55e333b77fa7 in main (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x4dafa7) (BuildId: a183bbe392f62ddef4ec71808dcbc702acf3775d)
    #29 0x7fcdfb758ccf  (/usr/lib/libc.so.6+0x27ccf) (BuildId: 8bfe03f6bf9b6a6e2591babd0bbc266837d8f658)
    #30 0x7fcdfb758d89 in __libc_start_main (/usr/lib/libc.so.6+0x27d89) (BuildId: 8bfe03f6bf9b6a6e2591babd0bbc266837d8f658)
    #31 0x55e333bdd354 in _start (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x540354) (BuildId: a183bbe392f62ddef4ec71808dcbc702acf3775d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/13.2.1/../../../../include/c++/13.2.1/bits/stl_deque.h in compilePrecedence2(Token*&, (anonymous namespace)::AST_state&)
==247108==ABORTING
  • Loading branch information
firewave committed Feb 14, 2024
1 parent c36e172 commit 653b2a0
Show file tree
Hide file tree
Showing 2 changed files with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion lib/tokenlist.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -960,7 +960,7 @@ static void compilePrecedence2(Token *&tok, AST_state& state)
Token* const curlyBracket = squareBracket->link()->next();
squareBracket->astOperand1(curlyBracket);
state.op.push(squareBracket);
tok = curlyBracket->link()->next();
tok = curlyBracket->link() ? curlyBracket->link()->next() : nullptr;
continue;
}
}
Expand Down
Binary file not shown.

0 comments on commit 653b2a0

Please sign in to comment.