From 653b2a0109c4e181d1589606938c4003d401ee49 Mon Sep 17 00:00:00 2001 From: firewave Date: Wed, 14 Feb 2024 10:20:38 +0100 Subject: [PATCH] fixed fuzzing crash AddressSanitizer:DEADLYSIGNAL ================================================================= ==247108==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000028 (pc 0x55e3348f5ccd bp 0x7ffc2c750a70 sp 0x7ffc2c7508a0 T0) ==247108==The signal is caused by a READ memory access. ==247108==Hint: address points to the zero page. #0 0x55e3348f5ccd in compilePrecedence2(Token*&, (anonymous namespace)::AST_state&) /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/13.2.1/../../../../include/c++/13.2.1/bits/stl_deque.h #1 0x55e3348f1a17 in compilePrecedence3(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1038:5 #2 0x55e3348f13b5 in compilePointerToElem(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1137:5 #3 0x55e3348f13b5 in compileMulDiv(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1147:5 #4 0x55e3348f1095 in compileAddSub(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1166:5 #5 0x55e3348f1095 in compileShift(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1176:5 #6 0x55e3348f0d15 in compileThreewayComp(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1186:5 #7 0x55e3348f0d15 in compileRelComp(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1196:5 #8 0x55e3348f07b5 in compileEqComp(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1206:5 #9 0x55e3348f07b5 in compileAnd(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1216:5 #10 0x55e3348efe9a in compileXor(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1235:5 #11 0x55e3348efe9a in compileOr(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1245:5 #12 0x55e3348efe9a in compileLogicAnd(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1255:5 #13 0x55e3348ee8d9 in compileLogicOr(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1274:5 #14 0x55e3348ee8d9 in compileAssignTernary(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1284:5 #15 0x55e3348eb768 in compileComma(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1325:5 #16 0x55e3348eb768 in compileExpression(Token*&, (anonymous namespace)::AST_state&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1343:9 #17 0x55e3348e0f49 in createAstAtToken(Token*, bool) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1689:9 #18 0x55e3348dd43e in TokenList::createAst() const /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenlist.cpp:1717:15 #19 0x55e334811894 in Tokenizer::simplifyTokens1(std::__cxx11::basic_string, std::allocator> const&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/tokenize.cpp:3363:14 #20 0x55e334354304 in CppCheck::checkFile(std::__cxx11::basic_string, std::allocator> const&, std::__cxx11::basic_string, std::allocator> const&, std::istream*) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/cppcheck.cpp:906:32 #21 0x55e334360521 in CppCheck::check(std::__cxx11::basic_string, std::allocator> const&, std::__cxx11::basic_string, std::allocator> const&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/cppcheck.cpp:558:12 #22 0x55e333d69d03 in LLVMFuzzerTestOneInput /home/user/CLionProjects/cppcheck-rider/oss-fuzz/main.cpp:45:18 #23 0x55e333c10538 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x573538) (BuildId: a183bbe392f62ddef4ec71808dcbc702acf3775d) #24 0x55e333c11210 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool, bool*) (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x574210) (BuildId: a183bbe392f62ddef4ec71808dcbc702acf3775d) #25 0x55e333c122a1 in fuzzer::Fuzzer::MutateAndTestOne() (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x5752a1) (BuildId: a183bbe392f62ddef4ec71808dcbc702acf3775d) #26 0x55e333c130c7 in fuzzer::Fuzzer::Loop(std::vector>&) (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x5760c7) (BuildId: a183bbe392f62ddef4ec71808dcbc702acf3775d) #27 0x55e333bf35b2 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x5565b2) (BuildId: a183bbe392f62ddef4ec71808dcbc702acf3775d) #28 0x55e333b77fa7 in main (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x4dafa7) (BuildId: a183bbe392f62ddef4ec71808dcbc702acf3775d) #29 0x7fcdfb758ccf (/usr/lib/libc.so.6+0x27ccf) (BuildId: 8bfe03f6bf9b6a6e2591babd0bbc266837d8f658) #30 0x7fcdfb758d89 in __libc_start_main (/usr/lib/libc.so.6+0x27d89) (BuildId: 8bfe03f6bf9b6a6e2591babd0bbc266837d8f658) #31 0x55e333bdd354 in _start (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x540354) (BuildId: a183bbe392f62ddef4ec71808dcbc702acf3775d) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/13.2.1/../../../../include/c++/13.2.1/bits/stl_deque.h in compilePrecedence2(Token*&, (anonymous namespace)::AST_state&) ==247108==ABORTING --- lib/tokenlist.cpp | 2 +- .../crash-26edfe9761d3b681c841dfe80398847dee332f83 | Bin 0 -> 18 bytes 2 files changed, 1 insertion(+), 1 deletion(-) create mode 100644 test/cli/fuzz-crash/crash-26edfe9761d3b681c841dfe80398847dee332f83 diff --git a/lib/tokenlist.cpp b/lib/tokenlist.cpp index a0706491dac..b6e312625d9 100644 --- a/lib/tokenlist.cpp +++ b/lib/tokenlist.cpp @@ -960,7 +960,7 @@ static void compilePrecedence2(Token *&tok, AST_state& state) Token* const curlyBracket = squareBracket->link()->next(); squareBracket->astOperand1(curlyBracket); state.op.push(squareBracket); - tok = curlyBracket->link()->next(); + tok = curlyBracket->link() ? curlyBracket->link()->next() : nullptr; continue; } } diff --git a/test/cli/fuzz-crash/crash-26edfe9761d3b681c841dfe80398847dee332f83 b/test/cli/fuzz-crash/crash-26edfe9761d3b681c841dfe80398847dee332f83 new file mode 100644 index 0000000000000000000000000000000000000000..37965deed0be75554c596307860cf4987f3c8b3a GIT binary patch literal 18 Zcma#%W-y3lU{J6rF3C*N%izjW001LL1TX*q literal 0 HcmV?d00001