Skip to content

Commit

Permalink
fixed fuzzing crash
Browse files Browse the repository at this point in the history
==237109==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000050 (pc 0x559a429ab30d bp 0x7ffdfaee8450 sp 0x7ffdfaee8320 T0)
==237109==The signal is caused by a READ memory access.
==237109==Hint: address points to the zero page.
    #0 0x559a429ab30d in Token::valueType() const /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/token.h:332:16
    #1 0x559a429ab30d in CheckOther::checkIncompleteStatement() /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/checkother.cpp:1941:79
    #2 0x559a42a05e0c in CheckOther::runChecks(Tokenizer const&, ErrorLogger*) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/checkother.h:102:20
    #3 0x559a42b9e824 in CppCheck::checkNormalTokens(Tokenizer const&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/cppcheck.cpp:1103:20
    #4 0x559a42bb2c4d in CppCheck::checkFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::istream*) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/cppcheck.cpp:936:17
    #5 0x559a42bbe511 in CppCheck::check(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/cppcheck.cpp:558:12
    #6 0x559a425c7d03 in LLVMFuzzerTestOneInput /home/user/CLionProjects/cppcheck-rider/oss-fuzz/main.cpp:45:18
    #7 0x559a4246e538 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x573538) (BuildId: fb3fc26fe0a2374418e90abefc930d3bf5ef711a)
    #8 0x559a4246f210 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool, bool*) (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x574210) (BuildId: fb3fc26fe0a2374418e90abefc930d3bf5ef711a)
    #9 0x559a424702a1 in fuzzer::Fuzzer::MutateAndTestOne() (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x5752a1) (BuildId: fb3fc26fe0a2374418e90abefc930d3bf5ef711a)
    #10 0x559a424710c7 in fuzzer::Fuzzer::Loop(std::vector<fuzzer::SizedFile, std::allocator<fuzzer::SizedFile>>&) (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x5760c7) (BuildId: fb3fc26fe0a2374418e90abefc930d3bf5ef711a)
    #11 0x559a424515b2 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x5565b2) (BuildId: fb3fc26fe0a2374418e90abefc930d3bf5ef711a)
    #12 0x559a423d5fa7 in main (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x4dafa7) (BuildId: fb3fc26fe0a2374418e90abefc930d3bf5ef711a)
    #13 0x7f0546b58ccf  (/usr/lib/libc.so.6+0x27ccf) (BuildId: 8bfe03f6bf9b6a6e2591babd0bbc266837d8f658)
    #14 0x7f0546b58d89 in __libc_start_main (/usr/lib/libc.so.6+0x27d89) (BuildId: 8bfe03f6bf9b6a6e2591babd0bbc266837d8f658)
    #15 0x559a4243b354 in _start (/home/user/CLionProjects/cppcheck-rider/oss-fuzz/oss-fuzz-client+0x540354) (BuildId: fb3fc26fe0a2374418e90abefc930d3bf5ef711a)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/user/CLionProjects/cppcheck-rider/oss-fuzz/../lib/token.h:332:16 in Token::valueType() const
==237109==ABORTING
  • Loading branch information
firewave committed Feb 14, 2024
1 parent 4331016 commit fc146ec
Show file tree
Hide file tree
Showing 2 changed files with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion lib/checkother.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -1938,7 +1938,7 @@ void CheckOther::checkIncompleteStatement()
continue;
if (isVoidStmt(tok))
continue;
if (mTokenizer->isCPP() && tok->str() == "&" && !(tok->astOperand1()->valueType() && tok->astOperand1()->valueType()->isIntegral()))
if (mTokenizer->isCPP() && tok->str() == "&" && !(tok->astOperand1() && tok->astOperand1()->valueType() && tok->astOperand1()->valueType()->isIntegral()))
// Possible archive
continue;
const bool inconclusive = tok->isConstOp();
Expand Down
Binary file not shown.

0 comments on commit fc146ec

Please sign in to comment.