diff --git a/Makefile b/Makefile index fd11524dd..e7bd866c4 100644 --- a/Makefile +++ b/Makefile @@ -49,7 +49,7 @@ VENV_ACTIVATE := .venv/bin/activate ${VENV_ACTIVATE}: requirements.txt python3.10 -m venv .venv || python3 -m venv .venv - source ${VENV_ACTIVATE} && python3 -m pip install --upgrade pip setuptools && python3 -m pip install -r requirements.txt + source ${VENV_ACTIVATE} && python3 -m pip install --upgrade pip && python3 -m pip install -r requirements.txt && python3 -m pip install setuptools install-dependencies: ${VENV_ACTIVATE} diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/Dockerfile b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/Dockerfile new file mode 100644 index 000000000..74db36681 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/Dockerfile @@ -0,0 +1,31 @@ +# Use the committed merge container as base for identical build environment. +# This image has the exact same OS packages, library versions, and source tree +# that were used during bug transplant verification. +FROM c-blosc2-merge:79e921d9 + +# The merge container runs as a non-root user (agent). Switch back to root +# so downstream Dockerfiles (AFL++'s builder, benchmark-builder, etc.) can +# install packages and write to system directories. +USER root + +# docker commit can snapshot a broken apt state - fix it so downstream +# Dockerfiles (e.g. AFL++'s builder.Dockerfile) can apt-get install. +RUN rm -rf /var/lib/apt/lists/* && mkdir -p /var/lib/apt/lists/partial && apt-get update + +WORKDIR /src/c-blosc2 + +# Keep ASan stack-use-after-return detection enabled for direct testcase replay. +ENV ASAN_OPTIONS="detect_leaks=0:detect_stack_use_after_return=1" + +# Raise libFuzzer's per-alloc / RSS cap from its 2048MB default. Some transplanted +# bugs (e.g. c-blosc2 OSV-2021-464) trigger a ~2GB malloc en route to the real +# memory-safety error; with the default cap libFuzzer aborts with +# `out-of-memory` and `-ignore_ooms=1` silently drops it. libFuzzer-family +# runners in fuzzbench/fuzzers/*/fuzzer.py splice $ADDITIONAL_ARGS onto the +# target command line, so this propagates automatically. +ENV ADDITIONAL_ARGS="-rss_limit_mb=8192" + +# Bug transplant patches (re-applied by build.sh after checkout_commit.py resets source) +COPY patches/ /src/patches/ +COPY seeds/ /src/benchmark_seeds/ +COPY build.sh $SRC/ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/benchmark.yaml b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/benchmark.yaml new file mode 100644 index 000000000..41e2f053c --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/benchmark.yaml @@ -0,0 +1,5 @@ +project: c-blosc2 +fuzz_target: decompress_frame_fuzzer +commit: 79e921d904d46fc9edc292e02a48f1aa54567a7d +commit_date: 2021-08-24T14:27:56+00:00 +type: bug diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/bug_metadata.json b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/bug_metadata.json new file mode 100644 index 000000000..04ac19c83 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/bug_metadata.json @@ -0,0 +1,211 @@ +{ + "project": "c-blosc2", + "target_commit": "79e921d904d46fc9edc292e02a48f1aa54567a7d", + "dispatch_bytes": 2, + "total_bugs": 29, + "bugs": { + "OSV-2020-2184": { + "dispatch_value": 1, + "triggered": true, + "crash_file": "/src/c-blosc2/blosc/frame.c", + "crash_line": 1366, + "crash_function": "get_vlmeta_from_trailer" + }, + "OSV-2021-21": { + "dispatch_value": 2, + "triggered": true, + "crash_file": "/src/c-blosc2/blosc/blosc2.c", + "crash_line": 685, + "crash_function": "blosc_read_header" + }, + "OSV-2021-22": { + "dispatch_value": 4, + "triggered": true, + "crash_file": "/src/c-blosc2/blosc/frame.c", + "crash_line": 1265, + "crash_function": "get_meta_from_header" + }, + "OSV-2021-213": { + "dispatch_value": 8, + "triggered": true, + "crash_file": "/src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c", + "crash_line": 215, + "crash_function": "ZSTD_freeDDict" + }, + "OSV-2021-221": { + "dispatch_value": 16, + "triggered": true, + "crash_file": "/src/c-blosc2/blosc/blosc-private.h", + "crash_line": 90, + "crash_function": "sw32_" + }, + "OSV-2021-246": { + "dispatch_value": 32, + "triggered": true, + "crash_file": "/src/c-blosc2/blosc/frame.c", + "crash_line": 1455, + "crash_function": "get_vlmeta_from_trailer" + }, + "OSV-2021-247": { + "dispatch_value": 64, + "triggered": true, + "crash_file": "/src/c-blosc2/blosc/blosc2.c", + "crash_line": 685, + "crash_function": "blosc_read_header" + }, + "OSV-2021-274": { + "dispatch_value": 128, + "triggered": true, + "crash_file": "/src/c-blosc2/blosc/frame.c", + "crash_line": 1289, + "crash_function": "get_meta_from_header" + }, + "OSV-2021-369": { + "dispatch_value": 256, + "triggered": true, + "crash_file": "/src/c-blosc2/blosc/blosc2.c", + "crash_line": 685, + "crash_function": "blosc_read_header" + }, + "OSV-2021-404": { + "dispatch_value": 512, + "triggered": true, + "crash_file": "/src/c-blosc2/blosc/blosc2.c", + "crash_line": 685, + "crash_function": "blosc_read_header" + }, + "OSV-2021-429": { + "dispatch_value": 1024, + "triggered": true, + "crash_file": "/src/c-blosc2/blosc/blosc-private.h", + "crash_line": 90, + "crash_function": "sw32_" + }, + "OSV-2021-639": { + "dispatch_value": 2048, + "triggered": true, + "crash_file": "/src/c-blosc2/blosc/blosc2.c", + "crash_line": 2622, + "crash_function": "_blosc_getitem" + }, + "OSV-2022-4": { + "dispatch_value": 4096, + "triggered": true, + "crash_file": "/src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c", + "crash_line": 134, + "crash_function": "ZSTD_initDDict_internal" + }, + "OSV-2022-34": { + "dispatch_value": 8192, + "triggered": true, + "crash_file": "/src/c-blosc2/internal-complibs/lz4-1.9.3/lz4.c", + "crash_line": 469, + "crash_function": "LZ4_wildCopy32" + }, + "OSV-2022-486": { + "dispatch_value": 16384, + "triggered": true, + "crash_file": "/src/c-blosc2/blosc/blosc2.c", + "crash_line": 3404, + "crash_function": "blosc2_get_io_cb" + }, + "OSV-2023-51": { + "dispatch_value": 32768, + "triggered": true, + "crash_file": "/src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c", + "crash_line": 215, + "crash_function": "ZSTD_freeDDict" + }, + "OSV-2021-464": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/c-blosc2/blosc/blosc2.c", + "crash_line": 181, + "crash_function": "my_malloc" + }, + "OSV-2021-481": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c", + "crash_line": 134, + "crash_function": "ZSTD_initDDict_internal" + }, + "OSV-2021-485": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/c-blosc2/blosc/blosc-private.h", + "crash_line": 90, + "crash_function": "sw32_" + }, + "OSV-2021-487": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/c-blosc2/blosc/blosc-private.h", + "crash_line": 90, + "crash_function": "sw32_" + }, + "OSV-2021-496": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/c-blosc2/blosc/blosc-private.h", + "crash_line": 90, + "crash_function": "sw32_" + }, + "OSV-2021-498": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/c-blosc2/blosc/frame.c", + "crash_line": 2107, + "crash_function": "frame_get_lazychunk" + }, + "OSV-2021-526": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/c-blosc2/blosc/blosc-private.h", + "crash_line": 90, + "crash_function": "sw32_" + }, + "OSV-2021-622": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/c-blosc2/blosc/frame.c", + "crash_line": 1455, + "crash_function": "get_vlmeta_from_trailer" + }, + "OSV-2021-997": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c", + "crash_line": 134, + "crash_function": "ZSTD_initDDict_internal" + }, + "OSV-2021-1791": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c", + "crash_line": 134, + "crash_function": "ZSTD_initDDict_internal" + }, + "OSV-2022-511": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c", + "crash_line": 134, + "crash_function": "ZSTD_initDDict_internal" + }, + "OSV-2022-1242": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/c-blosc2/blosc/blosc2.c", + "crash_line": 685, + "crash_function": "blosc_read_header" + }, + "OSV-2021-897": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_decompress.c", + "crash_line": 596, + "crash_function": "ZSTD_copyRawBlock" + } + } +} \ No newline at end of file diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/build.sh b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/build.sh new file mode 100755 index 000000000..152220e77 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/build.sh @@ -0,0 +1,158 @@ +#!/bin/bash -eu +# Generated by fuzzbench_generate.py for bug transplant evaluation + +cd /src/c-blosc2 + +# Drop stale build artifacts from the merge container so `git checkout` +# is not blocked by untracked files that would be overwritten. +git clean -fdx >/dev/null 2>&1 || true +git reset --hard HEAD >/dev/null 2>&1 || true + +# Checkout target commit +git checkout 79e921d904d46fc9edc292e02a48f1aa54567a7d + +# Restore harness sources that live outside the project git repository, +# and compute --exclude flags so harness.diff doesn't re-modify files +# that have already been restored to their post-dispatch state by the +# snapshot copy (which would fail with "does not match index"). +HARNESS_EXCLUDES="" +if [ -f /src/patches/harness_sources/manifest.json ]; then + HARNESS_EXCLUDES=$(python3 - <<'PY' +import json +import shutil +from pathlib import Path + +root = Path("/src/patches/harness_sources") +manifest = json.loads((root / "manifest.json").read_text()) +excludes = [] +for entry in manifest: + source = root / entry["snapshot"] + destination = Path(entry["container_path"]) + destination.parent.mkdir(parents=True, exist_ok=True) + shutil.copy2(source, destination) + # Convert /src// to (git apply paths are repo-relative). + parts = destination.parts + if len(parts) >= 3 and parts[1] == "src": + rel = Path(*parts[3:]) + else: + rel = destination + excludes.append(f"--exclude={rel}") +print(" ".join(excludes)) +PY +) +fi + +# Apply dispatch harness first (modifies build system), then bug patches. +# $HARNESS_EXCLUDES is empty when no snapshots were restored. +if ! git apply --check $HARNESS_EXCLUDES /src/patches/harness.diff 2>/dev/null; then + echo "Trying git apply --3way for harness.diff..." + git apply --3way $HARNESS_EXCLUDES /src/patches/harness.diff +else + git apply $HARNESS_EXCLUDES /src/patches/harness.diff +fi + +if ! git apply --check /src/patches/combined.diff 2>/dev/null; then + echo "Trying git apply --3way for combined.diff..." + git apply --3way /src/patches/combined.diff +else + git apply /src/patches/combined.diff +fi + +# --- Fix library CMakeLists.txt for new source files from combined.diff --- +# combined.diff may create new .c files (e.g., zfp_getcell.c) that need to +# be added to the library's explicit source list. +if [ -d blosc ] && [ -f blosc/CMakeLists.txt ]; then + for newfile in blosc/*.c; do + base=$(basename "$newfile") + if ! grep -q "$base" blosc/CMakeLists.txt 2>/dev/null; then + echo "Adding $base to blosc/CMakeLists.txt" + sed -i "/^set(SOURCES /s/)/ $base)/" blosc/CMakeLists.txt + fi + done +fi + +# --- Original build commands --- +export LDSHARED=lld + +cmake . -DCMAKE_C_FLAGS="$CFLAGS" -DCMAKE_CXX_FLAGS="$CXXFLAGS" -DBUILD_FUZZERS=ON -DBUILD_TESTS=OFF -DBUILD_BENCHMARKS=OFF -DBUILD_EXAMPLES=OFF +make clean +make -j$(nproc) -k 2>&1 || true + +# Package seed corpus +zip -j $OUT/decompress_chunk_fuzzer_seed_corpus.zip compat/*.cdata +zip -j $OUT/decompress_frame_fuzzer_seed_corpus.zip tests/fuzz/corpus/* + +# Copy the fuzzer executables, zip-ed corpora, and dictionary files to $OUT +find . -name '*_fuzzer' -exec cp -v '{}' $OUT ';' +find . -name '*_fuzzer.dict' -exec cp -v '{}' $OUT ';' +find . -name '*_fuzzer_seed_corpus.zip' -exec cp -v '{}' $OUT ';' + + +# --- Seed corpus: expand original seeds and per-bug testcase candidates --- +# FuzzBench uses $OUT/{fuzz_target}_seed_corpus.zip as initial corpus. +# Create one seed variant for the default path plus one for each dispatch bit. +# Per-bug reproducers are used only as source material: exact crashing inputs +# are filtered out before packaging. +seed_zip="$OUT/decompress_frame_fuzzer_seed_corpus.zip" +seed_target="$OUT/decompress_frame_fuzzer" +mkdir -p /tmp/seeds_dispatch /tmp/original_seeds /tmp/benchmark_seed_candidates + +if [ -f "$seed_zip" ]; then + unzip -q -o "$seed_zip" -d /tmp/original_seeds 2>/dev/null || true + for f in /tmp/original_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + for dispatch in '\x00\x00' '\x01\x00' '\x02\x00' '\x04\x00' '\x08\x00' '\x10\x00' '\x20\x00' '\x40\x00' '\x80\x00' '\x00\x01' '\x00\x02' '\x00\x04' '\x00\x08' '\x00\x10' '\x00\x20' '\x00\x40' '\x00\x80'; do + dispatch_name=$(printf '%s' "$dispatch" | tr -d '\x') + printf '%b' "$dispatch" | cat - "$f" > "/tmp/seeds_dispatch/${base}.dispatch_${dispatch_name}" + done + done +fi + +if [ -d /src/benchmark_seeds ]; then + for f in /src/benchmark_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + size=$(wc -c < "$f") + [ "$size" -gt 0 ] || continue + + cp "$f" "/tmp/benchmark_seed_candidates/${base}.exact" + # Zero the dispatch byte (byte 0): deactivates dispatch-gated patches + # while keeping the full APDU conversation and card driver routing intact. + cp "$f" "/tmp/benchmark_seed_candidates/${base}.dispatch_zero" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.dispatch_zero" bs=1 seek=0 conv=notrunc 2>/dev/null || true + for keep in 1 2 8 16 64 256 1024; do + if [ "$size" -gt "$keep" ]; then + head -c "$keep" "$f" > "/tmp/benchmark_seed_candidates/${base}.head_${keep}" + fi + done + if [ "$size" -gt 1 ]; then + head -c "$((size - 1))" "$f" > "/tmp/benchmark_seed_candidates/${base}.trim_1" + cp "$f" "/tmp/benchmark_seed_candidates/${base}.zero_last" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.zero_last" bs=1 seek="$((size - 1))" conv=notrunc 2>/dev/null || true + cp "$f" "/tmp/benchmark_seed_candidates/${base}.ff_last" + printf '\377' | dd of="/tmp/benchmark_seed_candidates/${base}.ff_last" bs=1 seek="$((size - 1))" conv=notrunc 2>/dev/null || true + fi + if [ "$size" -gt 4 ]; then + mid=$((size / 2)) + cp "$f" "/tmp/benchmark_seed_candidates/${base}.zero_mid" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.zero_mid" bs=1 seek="$mid" conv=notrunc 2>/dev/null || true + cp "$f" "/tmp/benchmark_seed_candidates/${base}.ff_mid" + printf '\377' | dd of="/tmp/benchmark_seed_candidates/${base}.ff_mid" bs=1 seek="$mid" conv=notrunc 2>/dev/null || true + fi + done +fi + +if [ -x "$seed_target" ] && ls /tmp/benchmark_seed_candidates/* 1>/dev/null 2>&1; then + for f in /tmp/benchmark_seed_candidates/*; do + [ -f "$f" ] || continue + if timeout 10s env ASAN_OPTIONS="${ASAN_OPTIONS:-detect_leaks=0:detect_stack_use_after_return=1}" "$seed_target" "$f" >/tmp/seed_replay.log 2>&1; then + cp "$f" "/tmp/seeds_dispatch/poc_$(basename "$f")" + fi + done +fi + +if ls /tmp/seeds_dispatch/* 1>/dev/null 2>&1; then + rm -f "$seed_zip" + zip -j -q "$seed_zip" /tmp/seeds_dispatch/* +fi diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2020-2184.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2020-2184.txt new file mode 100644 index 000000000..e43a82c3d --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2020-2184.txt @@ -0,0 +1,25 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1941247198 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x60bf80000180 (pc 0x0000005f0a2a bp 0x7fff0959edf0 sp 0x7fff0959ed00 T0) +==1==The signal is caused by a READ memory access. + #0 0x5f0a2a in get_vlmeta_from_trailer /src/c-blosc2/blosc/frame.c:1366:7 + #1 0x5f0a2a in frame_get_vlmetalayers /src/c-blosc2/blosc/frame.c:1516:9 + #2 0x5f1d3f in frame_to_schunk /src/c-blosc2/blosc/frame.c:1746:8 + #3 0x5e0612 in blosc2_schunk_from_buffer /src/c-blosc2/blosc/schunk.c:446:27 + #4 0x5642ae in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:110:29 + #5 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f0c80084082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #10 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/c-blosc2/blosc/frame.c:1366:7 in get_vlmeta_from_trailer +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-1791.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-1791.txt new file mode 100644 index 000000000..1fb61ee76 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-1791.txt @@ -0,0 +1,68 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1940281382 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62b00000d019 at pc 0x000000529f61 bp 0x7ffc7e088150 sp 0x7ffc7e087918 +READ of size 61951 at 0x62b00000d019 thread T0 + #0 0x529f60 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x92b7b4 in ZSTD_initDDict_internal /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:134:9 + #2 0x92b7b4 in ZSTD_createDDict_advanced /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:155:39 + #3 0x92b7b4 in ZSTD_createDDict /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:173:12 + #4 0x5b6980 in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:1960:27 + #5 0x5b6980 in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2497:8 + #6 0x5b6d4d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2523:12 + #7 0x5fa74b in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2855:23 + #8 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #9 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #10 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #11 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #12 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #13 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f76fdf42082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #15 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +0x62b00000d019 is located 0 bytes to the right of 24089-byte region [0x62b000007200,0x62b00000d019) +allocated by thread T0 here: + #0 0x52ab3d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x43dee7 in operator new(unsigned long) cxa_noexception.cpp + #2 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f76fdf42082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c567fff99b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c567fff99c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c567fff99d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c567fff99e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c567fff99f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c567fff9a00: 00 00 00[01]fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff9a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff9a20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff9a30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff9a40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff9a50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-21.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-21.txt new file mode 100644 index 000000000..983c3a859 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-21.txt @@ -0,0 +1,30 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1941494144 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x00000052a072 bp 0x7ffd9420d770 sp 0x7ffd9420cf28 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x52a072 in AddressIsPoisoned /src/llvm-project/compiler-rt/lib/asan/asan_mapping.h:379:21 + #1 0x52a072 in __asan::QuickCheckForUnpoisonedRegion(unsigned long, unsigned long) /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.h:31:13 + #2 0x529f44 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #3 0x5a9bd7 in blosc_read_header /src/c-blosc2/blosc/blosc2.c:685:3 + #4 0x5bd8d4 in blosc2_cbuffer_sizes /src/c-blosc2/blosc/blosc2.c:3246:12 + #5 0x5f2fff in frame_get_lazychunk /src/c-blosc2/blosc/frame.c:2098:10 + #6 0x5fa558 in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2832:8 + #7 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #8 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #9 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f78324c7082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #14 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/llvm-project/compiler-rt/lib/asan/asan_mapping.h:379:21 in AddressIsPoisoned +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-213.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-213.txt new file mode 100644 index 000000000..cea4f1808 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-213.txt @@ -0,0 +1,86 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1941968620 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x62b000006cc0 at pc 0x000000529f61 bp 0x7ffd470b49f0 sp 0x7ffd470b41b8 +READ of size 24 at 0x62b000006cc0 thread T0 + #0 0x529f60 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x92b371 in ZSTD_freeDDict /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:215:44 + #2 0x5b54c9 in blosc2_free_ctx /src/c-blosc2/blosc/blosc2.c:3548:5 + #3 0x5df9cc in blosc2_schunk_free /src/c-blosc2/blosc/schunk.c:394:5 + #4 0x564477 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c + #5 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f57345b1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #10 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +0x62b000006cc0 is located 27328 bytes inside of 27352-byte region [0x62b000000200,0x62b000006cd8) +freed by thread T0 here: + #0 0x52a8d2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:111:3 + #1 0x6b83df in ZSTD_customFree /src/c-blosc2/internal-complibs/zstd-1.4.8/common/zstd_common.c:81:13 + #2 0x92b42d in ZSTD_freeDDict /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:217:9 + #3 0x5b6dee in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2528:7 + #4 0x5fa74b in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2855:23 + #5 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #6 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #7 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f57345b1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +previously allocated by thread T0 here: + #0 0x52ab3d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x6b803d in ZSTD_customMalloc /src/c-blosc2/internal-complibs/zstd-1.4.8/common/zstd_common.c:60:12 + #2 0x92b6ba in ZSTD_createDDict_advanced /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:152:49 + #3 0x92b6ba in ZSTD_createDDict /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:173:12 + #4 0x5b6980 in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:1960:27 + #5 0x5b6980 in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2497:8 + #6 0x5b6d4d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2523:12 + #7 0x5fa74b in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2855:23 + #8 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #9 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #10 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #11 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #12 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #13 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f57345b1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c567fff8d40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fff8d50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fff8d60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fff8d70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fff8d80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0c567fff8d90: fd fd fd fd fd fd fd fd[fd]fd fd fa fa fa fa fa + 0x0c567fff8da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff8db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff8dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff8dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff8de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-22.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-22.txt new file mode 100644 index 000000000..d42f4721d --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-22.txt @@ -0,0 +1,25 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1941742354 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x60d070000112 (pc 0x0000005efdc7 bp 0x7ffdfc81e9b0 sp 0x7ffdfc81e8c0 T0) +==1==The signal is caused by a READ memory access. + #0 0x5efdc7 in get_meta_from_header /src/c-blosc2/blosc/frame.c:1265:9 + #1 0x5efdc7 in frame_get_metalayers /src/c-blosc2/blosc/frame.c:1337:9 + #2 0x5f1d23 in frame_to_schunk /src/c-blosc2/blosc/frame.c:1739:8 + #3 0x5e0612 in blosc2_schunk_from_buffer /src/c-blosc2/blosc/schunk.c:446:27 + #4 0x5642ae in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:110:29 + #5 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fb8e7d71082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #10 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/c-blosc2/blosc/frame.c:1265:9 in get_meta_from_header +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-221.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-221.txt new file mode 100644 index 000000000..ead303638 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-221.txt @@ -0,0 +1,75 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1942224670 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x608000000079 at pc 0x0000005bb603 bp 0x7ffcc4bd1ef0 sp 0x7ffcc4bd1ee8 +READ of size 4 at 0x608000000079 thread T0 + #0 0x5bb602 in sw32_ /src/c-blosc2/blosc/blosc-private.h:90:13 + #1 0x5bb602 in blosc_d /src/c-blosc2/blosc/blosc2.c:1477:14 + #2 0x5b8565 in _blosc_getitem /src/c-blosc2/blosc/blosc2.c:2736:14 + #3 0x5bbe40 in blosc2_getitem_ctx /src/c-blosc2/blosc/blosc2.c:2806:12 + #4 0x5bc1ea in blosc2_getitem /src/c-blosc2/blosc/blosc2.c:2765:12 + #5 0x5bc1ea in blosc_getitem /src/c-blosc2/blosc/blosc2.c:2777:10 + #6 0x5f470d in get_coffset /src/c-blosc2/blosc/frame.c:1788:10 + #7 0x5f2f48 in frame_get_lazychunk /src/c-blosc2/blosc/frame.c:1983:8 + #8 0x5fa558 in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2832:8 + #9 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #10 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #11 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #12 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #13 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #14 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f8bb4f7e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #16 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +0x608000000079 is located 0 bytes to the right of 89-byte region [0x608000000020,0x608000000079) +allocated by thread T0 here: + #0 0x52ab3d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x5ee363 in get_coffsets /src/c-blosc2/blosc/frame.c:1030:27 + #2 0x5f45fd in get_coffset /src/c-blosc2/blosc/frame.c + #3 0x5f2f48 in frame_get_lazychunk /src/c-blosc2/blosc/frame.c:1983:8 + #4 0x5fa558 in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2832:8 + #5 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #6 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #7 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f8bb4f7e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/c-blosc2/blosc/blosc-private.h:90:13 in sw32_ +Shadow bytes around the buggy address: + 0x0c107fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c107fff8000: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00[01] + 0x0c107fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c107fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c107fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c107fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c107fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-246.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-246.txt new file mode 100644 index 000000000..552abd1e0 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-246.txt @@ -0,0 +1,64 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1942506582 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x612000000771 at pc 0x000000529f61 bp 0x7ffe1534e750 sp 0x7ffe1534df18 +READ of size 1048576 at 0x612000000771 thread T0 + #0 0x529f60 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x5f10ca in get_vlmeta_from_trailer /src/c-blosc2/blosc/frame.c:1455:5 + #2 0x5f10ca in frame_get_vlmetalayers /src/c-blosc2/blosc/frame.c:1516:9 + #3 0x5f1d3f in frame_to_schunk /src/c-blosc2/blosc/frame.c:1746:8 + #4 0x5e0612 in blosc2_schunk_from_buffer /src/c-blosc2/blosc/schunk.c:446:27 + #5 0x5642ae in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:110:29 + #6 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fc278469082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #11 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +0x612000000771 is located 0 bytes to the right of 305-byte region [0x612000000640,0x612000000771) +allocated by thread T0 here: + #0 0x52ab3d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x43dee7 in operator new(unsigned long) cxa_noexception.cpp + #2 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7fc278469082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c247fff8090: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c247fff80a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c247fff80b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 fa + 0x0c247fff80c0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c247fff80d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c247fff80e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[01]fa + 0x0c247fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c247fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c247fff8110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c247fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c247fff8130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-247.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-247.txt new file mode 100644 index 000000000..d720210de --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-247.txt @@ -0,0 +1,67 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1942748352 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60d000000196 at pc 0x000000529f61 bp 0x7fff62fd9ef0 sp 0x7fff62fd96b8 +READ of size 16 at 0x60d000000196 thread T0 + #0 0x529f60 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x5a9bd7 in blosc_read_header /src/c-blosc2/blosc/blosc2.c:685:3 + #2 0x5bd8d4 in blosc2_cbuffer_sizes /src/c-blosc2/blosc/blosc2.c:3246:12 + #3 0x5ee280 in get_coffsets /src/c-blosc2/blosc/frame.c:1046:16 + #4 0x5f45fd in get_coffset /src/c-blosc2/blosc/frame.c + #5 0x5f2f48 in frame_get_lazychunk /src/c-blosc2/blosc/frame.c:1983:8 + #6 0x5fa558 in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2832:8 + #7 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #8 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #9 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f286fed3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #14 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +0x60d000000196 is located 0 bytes to the right of 134-byte region [0x60d000000110,0x60d000000196) +allocated by thread T0 here: + #0 0x52ab3d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x43dee7 in operator new(unsigned long) cxa_noexception.cpp + #2 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f286fed3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c1a7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c1a7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c1a7fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c1a7fff8010: 00 00 00 00 00 00 00 00 06 fa fa fa fa fa fa fa + 0x0c1a7fff8020: fa fa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c1a7fff8030: 00 00[06]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1a7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1a7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1a7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1a7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1a7fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-274.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-274.txt new file mode 100644 index 000000000..a87412181 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-274.txt @@ -0,0 +1,34 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1942990374 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +==1==WARNING: AddressSanitizer failed to allocate 0xffffffffffff20ff bytes +================================================================= +==1==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges [0x000000000000,0xffffffffffff20ff) and [0x60d000000117, 0x60cfffff2216) overlap + #0 0x529e5e in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x5effca in get_meta_from_header /src/c-blosc2/blosc/frame.c:1289:5 + #2 0x5effca in frame_get_metalayers /src/c-blosc2/blosc/frame.c:1337:9 + #3 0x5f1d23 in frame_to_schunk /src/c-blosc2/blosc/frame.c:1739:8 + #4 0x5e0612 in blosc2_schunk_from_buffer /src/c-blosc2/blosc/schunk.c:446:27 + #5 0x5642ae in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:110:29 + #6 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f7d8d7e6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #11 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +Address 0x000000000000 is a wild pointer inside of access range of size 0xffffffffffff20ff. +0x60d000000117 is located 7 bytes inside of 136-byte region [0x60d000000110,0x60d000000198) +allocated by thread T0 here: + #0 0x52ab3d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x43dee7 in operator new(unsigned long) cxa_noexception.cpp + #2 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f7d8d7e6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: memcpy-param-overlap /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-369.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-369.txt new file mode 100644 index 000000000..aa5551184 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-369.txt @@ -0,0 +1,32 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1943234631 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x00000052a072 bp 0x7ffc225d4470 sp 0x7ffc225d3c28 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x52a072 in AddressIsPoisoned /src/llvm-project/compiler-rt/lib/asan/asan_mapping.h:379:21 + #1 0x52a072 in __asan::QuickCheckForUnpoisonedRegion(unsigned long, unsigned long) /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.h:31:13 + #2 0x529f44 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #3 0x5a9bd7 in blosc_read_header /src/c-blosc2/blosc/blosc2.c:685:3 + #4 0x5bd8d4 in blosc2_cbuffer_sizes /src/c-blosc2/blosc/blosc2.c:3246:12 + #5 0x5ee280 in get_coffsets /src/c-blosc2/blosc/frame.c:1046:16 + #6 0x5f45fd in get_coffset /src/c-blosc2/blosc/frame.c + #7 0x5f2f48 in frame_get_lazychunk /src/c-blosc2/blosc/frame.c:1983:8 + #8 0x5fa558 in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2832:8 + #9 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #10 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #11 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #12 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #13 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #14 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7efc60833082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #16 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/llvm-project/compiler-rt/lib/asan/asan_mapping.h:379:21 in AddressIsPoisoned +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-404.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-404.txt new file mode 100644 index 000000000..11e14209e --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-404.txt @@ -0,0 +1,32 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1943493908 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x00000052a072 bp 0x7fff01107150 sp 0x7fff01106908 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x52a072 in AddressIsPoisoned /src/llvm-project/compiler-rt/lib/asan/asan_mapping.h:379:21 + #1 0x52a072 in __asan::QuickCheckForUnpoisonedRegion(unsigned long, unsigned long) /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.h:31:13 + #2 0x529f44 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #3 0x5a9bd7 in blosc_read_header /src/c-blosc2/blosc/blosc2.c:685:3 + #4 0x5bd8d4 in blosc2_cbuffer_sizes /src/c-blosc2/blosc/blosc2.c:3246:12 + #5 0x5ee280 in get_coffsets /src/c-blosc2/blosc/frame.c:1046:16 + #6 0x5f45fd in get_coffset /src/c-blosc2/blosc/frame.c + #7 0x5f2f48 in frame_get_lazychunk /src/c-blosc2/blosc/frame.c:1983:8 + #8 0x5fa558 in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2832:8 + #9 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #10 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #11 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #12 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #13 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #14 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7fe304453082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #16 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/llvm-project/compiler-rt/lib/asan/asan_mapping.h:379:21 in AddressIsPoisoned +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-429.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-429.txt new file mode 100644 index 000000000..d528f42ec --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-429.txt @@ -0,0 +1,31 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1943737160 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x60f0202022b8 (pc 0x0000005ba904 bp 0x7ffc3f153ce0 sp 0x7ffc3f153ba0 T0) +==1==The signal is caused by a READ memory access. + #0 0x5ba904 in sw32_ /src/c-blosc2/blosc/blosc-private.h:90:13 + #1 0x5ba904 in blosc_d /src/c-blosc2/blosc/blosc2.c:1477:14 + #2 0x5b8565 in _blosc_getitem /src/c-blosc2/blosc/blosc2.c:2736:14 + #3 0x5bbe40 in blosc2_getitem_ctx /src/c-blosc2/blosc/blosc2.c:2806:12 + #4 0x5bc1ea in blosc2_getitem /src/c-blosc2/blosc/blosc2.c:2765:12 + #5 0x5bc1ea in blosc_getitem /src/c-blosc2/blosc/blosc2.c:2777:10 + #6 0x5f470d in get_coffset /src/c-blosc2/blosc/frame.c:1788:10 + #7 0x5f2f48 in frame_get_lazychunk /src/c-blosc2/blosc/frame.c:1983:8 + #8 0x5fa558 in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2832:8 + #9 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #10 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #11 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #12 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #13 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #14 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f855f328082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #16 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/c-blosc2/blosc/blosc-private.h:90:13 in sw32_ +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-464.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-464.txt new file mode 100644 index 000000000..b264be32c --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-464.txt @@ -0,0 +1,65 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1808737847 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/tc +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6100000001fa at pc 0x000000529f61 bp 0x7ffeb0e48b90 sp 0x7ffeb0e48358 +READ of size 16 at 0x6100000001fa thread T0 + #0 0x529f60 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x5a9bd7 in blosc_read_header /src/c-blosc2/blosc/blosc2.c:685:3 + #2 0x5bd8d4 in blosc2_cbuffer_sizes /src/c-blosc2/blosc/blosc2.c:3246:12 + #3 0x5f2fff in frame_get_lazychunk /src/c-blosc2/blosc/frame.c:2098:10 + #4 0x5fa558 in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2832:8 + #5 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #6 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #7 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f1e85d79082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #12 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +0x6100000001fa is located 0 bytes to the right of 186-byte region [0x610000000140,0x6100000001fa) +allocated by thread T0 here: + #0 0x52ab3d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x43dee7 in operator new(unsigned long) cxa_noexception.cpp + #2 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f1e85d79082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c207fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c207fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c207fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c207fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 + 0x0c207fff8020: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 +=>0x0c207fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00[02] + 0x0c207fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c207fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c207fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c207fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c207fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-481.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-481.txt new file mode 100644 index 000000000..226a12a3c --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-481.txt @@ -0,0 +1,68 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1938149014 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60f0000001d7 at pc 0x000000529f61 bp 0x7fff94b88410 sp 0x7fff94b87bd8 +READ of size 222 at 0x60f0000001d7 thread T0 + #0 0x529f60 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x92b7b4 in ZSTD_initDDict_internal /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:134:9 + #2 0x92b7b4 in ZSTD_createDDict_advanced /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:155:39 + #3 0x92b7b4 in ZSTD_createDDict /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:173:12 + #4 0x5b6980 in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:1960:27 + #5 0x5b6980 in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2497:8 + #6 0x5b6d4d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2523:12 + #7 0x5fa74b in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2855:23 + #8 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #9 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #10 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #11 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #12 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #13 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f9cdc1d2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #15 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +0x60f0000001d7 is located 0 bytes to the right of 167-byte region [0x60f000000130,0x60f0000001d7) +allocated by thread T0 here: + #0 0x52ab3d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x43dee7 in operator new(unsigned long) cxa_noexception.cpp + #2 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f9cdc1d2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c1e7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c1e7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c1e7fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c1e7fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 07 fa fa fa + 0x0c1e7fff8020: fa fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00 +=>0x0c1e7fff8030: 00 00 00 00 00 00 00 00 00 00[07]fa fa fa fa fa + 0x0c1e7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1e7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1e7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1e7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1e7fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-485.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-485.txt new file mode 100644 index 000000000..b38972261 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-485.txt @@ -0,0 +1,57 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1938443396 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60f000005b0f at pc 0x0000005b6c1c bp 0x7fff59b08350 sp 0x7fff59b08348 +READ of size 4 at 0x60f000005b0f thread T0 + #0 0x5b6c1b in sw32_ /src/c-blosc2/blosc/blosc-private.h:90:13 + #1 0x5b6c1b in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:1948:34 + #2 0x5b6c1b in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2497:8 + #3 0x5b6d4d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2523:12 + #4 0x5fa74b in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2855:23 + #5 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #6 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #7 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f4ca9bf4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #12 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +Address 0x60f000005b0f is a wild pointer inside of access range of size 0x000000000004. +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/c-blosc2/blosc/blosc-private.h:90:13 in sw32_ +Shadow bytes around the buggy address: + 0x0c1e7fff8b10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1e7fff8b20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1e7fff8b30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1e7fff8b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1e7fff8b50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c1e7fff8b60: fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1e7fff8b70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1e7fff8b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1e7fff8b90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1e7fff8ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1e7fff8bb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-487.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-487.txt new file mode 100644 index 000000000..fbfe2a399 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-487.txt @@ -0,0 +1,27 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1938711491 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x6100000404cf (pc 0x0000005b679b bp 0x7ffcc413fe10 sp 0x7ffcc413fd60 T0) +==1==The signal is caused by a READ memory access. + #0 0x5b679b in sw32_ /src/c-blosc2/blosc/blosc-private.h:90:13 + #1 0x5b679b in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:1948:34 + #2 0x5b679b in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2497:8 + #3 0x5b6d4d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2523:12 + #4 0x5fa74b in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2855:23 + #5 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #6 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #7 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f3d3a79a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #12 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/c-blosc2/blosc/blosc-private.h:90:13 in sw32_ +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-496.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-496.txt new file mode 100644 index 000000000..3f5191267 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-496.txt @@ -0,0 +1,67 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1938992990 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61000000026b at pc 0x0000005bb5fb bp 0x7ffc75fbc450 sp 0x7ffc75fbc448 +READ of size 4 at 0x61000000026b thread T0 + #0 0x5bb5fa in sw32_ /src/c-blosc2/blosc/blosc-private.h:90:13 + #1 0x5bb5fa in blosc_d /src/c-blosc2/blosc/blosc2.c:1477:14 + #2 0x5afe5e in serial_blosc /src/c-blosc2/blosc/blosc2.c:1636:16 + #3 0x5afe5e in do_job /src/c-blosc2/blosc/blosc2.c:1794:15 + #4 0x5b6680 in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2503:13 + #5 0x5b6d4d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2523:12 + #6 0x5fa74b in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2855:23 + #7 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #8 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #9 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fa13b132082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #14 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +0x61000000026b is located 111 bytes to the right of 188-byte region [0x610000000140,0x6100000001fc) +allocated by thread T0 here: + #0 0x52ab3d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x43dee7 in operator new(unsigned long) cxa_noexception.cpp + #2 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7fa13b132082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/c-blosc2/blosc/blosc-private.h:90:13 in sw32_ +Shadow bytes around the buggy address: + 0x0c207fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c207fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c207fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 + 0x0c207fff8020: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c207fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 +=>0x0c207fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]fa fa + 0x0c207fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c207fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c207fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c207fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c207fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-498.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-498.txt new file mode 100644 index 000000000..3d0558c34 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-498.txt @@ -0,0 +1,31 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1939268564 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x60d000000170 in thread T0 + #0 0x52a8d2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:111:3 + #1 0x5f34d3 in frame_get_lazychunk /src/c-blosc2/blosc/frame.c:2107:7 + #2 0x5fa558 in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2832:8 + #3 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #4 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #5 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f23a9c31082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #10 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +0x60d000000170 is located 96 bytes inside of 140-byte region [0x60d000000110,0x60d00000019c) +allocated by thread T0 here: + #0 0x52ab3d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x43dee7 in operator new(unsigned long) cxa_noexception.cpp + #2 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f23a9c31082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: bad-free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:111:3 in free +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-526.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-526.txt new file mode 100644 index 000000000..f6292bb31 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-526.txt @@ -0,0 +1,27 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1939529742 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x6100000404cf (pc 0x0000005b679b bp 0x7ffd7ae125f0 sp 0x7ffd7ae12540 T0) +==1==The signal is caused by a READ memory access. + #0 0x5b679b in sw32_ /src/c-blosc2/blosc/blosc-private.h:90:13 + #1 0x5b679b in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:1948:34 + #2 0x5b679b in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2497:8 + #3 0x5b6d4d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2523:12 + #4 0x5fa74b in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2855:23 + #5 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #6 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #7 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f60d1513082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #12 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/c-blosc2/blosc/blosc-private.h:90:13 in sw32_ +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-622.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-622.txt new file mode 100644 index 000000000..bce157eb6 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-622.txt @@ -0,0 +1,64 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1939780759 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61100000038c at pc 0x000000529f61 bp 0x7ffccfa71110 sp 0x7ffccfa708d8 +READ of size 67 at 0x61100000038c thread T0 + #0 0x529f60 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x5f10ca in get_vlmeta_from_trailer /src/c-blosc2/blosc/frame.c:1455:5 + #2 0x5f10ca in frame_get_vlmetalayers /src/c-blosc2/blosc/frame.c:1516:9 + #3 0x5f1d3f in frame_to_schunk /src/c-blosc2/blosc/frame.c:1746:8 + #4 0x5e0612 in blosc2_schunk_from_buffer /src/c-blosc2/blosc/schunk.c:446:27 + #5 0x5642ae in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:110:29 + #6 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f7f0f372082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #11 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +0x61100000038c is located 0 bytes to the right of 204-byte region [0x6110000002c0,0x61100000038c) +allocated by thread T0 here: + #0 0x52ab3d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x43dee7 in operator new(unsigned long) cxa_noexception.cpp + #2 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f7f0f372082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c227fff8020: 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8040: 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa fa + 0x0c227fff8050: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fff8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c227fff8070: 00[04]fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-639.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-639.txt new file mode 100644 index 000000000..5f033a1fe --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-639.txt @@ -0,0 +1,72 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1944019795 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x616000001853 at pc 0x000000529f61 bp 0x7ffeea3f00d0 sp 0x7ffeea3ef898 +READ of size 8 at 0x616000001853 thread T0 + #0 0x529f60 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x5b7add in _blosc_getitem /src/c-blosc2/blosc/blosc2.c:2622:7 + #2 0x5bbe40 in blosc2_getitem_ctx /src/c-blosc2/blosc/blosc2.c:2806:12 + #3 0x5bb7cd in blosc2_getitem /src/c-blosc2/blosc/blosc2.c:2765:12 + #4 0x5f46b0 in get_coffset /src/c-blosc2/blosc/frame.c:1791:10 + #5 0x5f2f48 in frame_get_lazychunk /src/c-blosc2/blosc/frame.c:1983:8 + #6 0x5fa558 in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2832:8 + #7 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #8 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #9 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f64ae125082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #14 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +0x616000001853 is located 1739 bytes to the right of 520-byte region [0x616000000f80,0x616000001188) +allocated by thread T0 here: + #0 0x52b567 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:210:3 + #1 0x5b768b in my_malloc /src/c-blosc2/blosc/blosc2.c:181:9 + #2 0x5b768b in blosc2_create_dctx /src/c-blosc2/blosc/blosc2.c:3520:46 + #3 0x5f19db in frame_to_schunk /src/c-blosc2/blosc/frame.c:1588:18 + #4 0x5e0612 in blosc2_schunk_from_buffer /src/c-blosc2/blosc/schunk.c:446:27 + #5 0x5642ae in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:110:29 + #6 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f64ae125082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c2c7fff82b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff82c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff82d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff82e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff82f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c2c7fff8300: fa fa fa fa fa fa fa fa fa fa[fa]fa fa fa fa fa + 0x0c2c7fff8310: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8330: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8340: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8350: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-897.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-897.txt new file mode 100644 index 000000000..9e75dd4e1 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-897.txt @@ -0,0 +1,72 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1941001713 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x626000005d92 at pc 0x000000529f61 bp 0x7ffca15d9d70 sp 0x7ffca15d9538 +READ of size 37536 at 0x626000005d92 thread T0 + #0 0x529f60 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x9309ab in ZSTD_copyRawBlock /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_decompress.c:596:5 + #2 0x9309ab in ZSTD_decompressFrame /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_decompress.c:662:27 + #3 0x9309ab in ZSTD_decompressMultiFrame /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_decompress.c:769:32 + #4 0x931379 in ZSTD_decompress_usingDDict /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_decompress.c:1273:12 + #5 0x5ceb05 in zstd_wrap_decompress /src/c-blosc2/blosc/blosc2.c:541:12 + #6 0x5baba9 in blosc_d /src/c-blosc2/blosc/blosc2.c:1548:18 + #7 0x5afe5e in serial_blosc /src/c-blosc2/blosc/blosc2.c:1636:16 + #8 0x5afe5e in do_job /src/c-blosc2/blosc/blosc2.c:1794:15 + #9 0x5b6680 in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2503:13 + #10 0x5b6d4d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2523:12 + #11 0x5fa74b in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2855:23 + #12 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #13 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #14 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #15 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #16 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #17 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #18 0x7eff3b253082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #19 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +0x626000005d92 is located 0 bytes to the right of 11410-byte region [0x626000003100,0x626000005d92) +allocated by thread T0 here: + #0 0x52ab3d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x43dee7 in operator new(unsigned long) cxa_noexception.cpp + #2 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7eff3b253082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c4c7fff8b60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4c7fff8b70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4c7fff8b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4c7fff8b90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4c7fff8ba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c4c7fff8bb0: 00 00[02]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4c7fff8bc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4c7fff8bd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4c7fff8be0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4c7fff8bf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4c7fff8c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-997.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-997.txt new file mode 100644 index 000000000..6e04915a8 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2021-997.txt @@ -0,0 +1,68 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1940050324 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62b00000d019 at pc 0x000000529f61 bp 0x7ffdebe1d990 sp 0x7ffdebe1d158 +READ of size 61951 at 0x62b00000d019 thread T0 + #0 0x529f60 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x92b7b4 in ZSTD_initDDict_internal /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:134:9 + #2 0x92b7b4 in ZSTD_createDDict_advanced /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:155:39 + #3 0x92b7b4 in ZSTD_createDDict /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:173:12 + #4 0x5b6980 in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:1960:27 + #5 0x5b6980 in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2497:8 + #6 0x5b6d4d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2523:12 + #7 0x5fa74b in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2855:23 + #8 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #9 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #10 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #11 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #12 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #13 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7fdabc1fd082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #15 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +0x62b00000d019 is located 0 bytes to the right of 24089-byte region [0x62b000007200,0x62b00000d019) +allocated by thread T0 here: + #0 0x52ab3d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x43dee7 in operator new(unsigned long) cxa_noexception.cpp + #2 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7fdabc1fd082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c567fff99b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c567fff99c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c567fff99d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c567fff99e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c567fff99f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c567fff9a00: 00 00 00[01]fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff9a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff9a20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff9a30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff9a40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff9a50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2022-1242.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2022-1242.txt new file mode 100644 index 000000000..420dd371f --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2022-1242.txt @@ -0,0 +1,65 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1940766092 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x626000005df3 at pc 0x000000529f61 bp 0x7ffd48598bf0 sp 0x7ffd485983b8 +READ of size 16 at 0x626000005df3 thread T0 + #0 0x529f60 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x5a9bd7 in blosc_read_header /src/c-blosc2/blosc/blosc2.c:685:3 + #2 0x5bd8d4 in blosc2_cbuffer_sizes /src/c-blosc2/blosc/blosc2.c:3246:12 + #3 0x5f2fff in frame_get_lazychunk /src/c-blosc2/blosc/frame.c:2098:10 + #4 0x5fa558 in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2832:8 + #5 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #6 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #7 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f2cc1ac9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #12 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +0x626000005df3 is located 97 bytes to the right of 11410-byte region [0x626000003100,0x626000005d92) +allocated by thread T0 here: + #0 0x52ab3d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x43dee7 in operator new(unsigned long) cxa_noexception.cpp + #2 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f2cc1ac9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c4c7fff8b60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4c7fff8b70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4c7fff8b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4c7fff8b90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4c7fff8ba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c4c7fff8bb0: 00 00 02 fa fa fa fa fa fa fa fa fa fa fa[fa]fa + 0x0c4c7fff8bc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4c7fff8bd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4c7fff8be0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4c7fff8bf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4c7fff8c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2022-34.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2022-34.txt new file mode 100644 index 000000000..bbe27d96e --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2022-34.txt @@ -0,0 +1,71 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1944546056 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x612000000750 at pc 0x000000529f61 bp 0x7ffdf922bb60 sp 0x7ffdf922b328 +READ of size 16 at 0x612000000750 thread T0 + #0 0x529f60 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x63e154 in LZ4_wildCopy32 /src/c-blosc2/internal-complibs/lz4-1.9.3/lz4.c:469:30 + #2 0x63e154 in LZ4_decompress_generic /src/c-blosc2/internal-complibs/lz4-1.9.3/lz4.c:1819:21 + #3 0x63e154 in LZ4_decompress_safe /src/c-blosc2/internal-complibs/lz4-1.9.3/lz4.c:2173:12 + #4 0x5baa3b in lz4_wrap_decompress /src/c-blosc2/blosc/blosc2.c:432:12 + #5 0x5baa3b in blosc_d /src/c-blosc2/blosc/blosc2.c:1530:18 + #6 0x5afe5e in serial_blosc /src/c-blosc2/blosc/blosc2.c:1636:16 + #7 0x5afe5e in do_job /src/c-blosc2/blosc/blosc2.c:1794:15 + #8 0x5b6680 in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2503:13 + #9 0x5b6d4d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2523:12 + #10 0x5fa74b in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2855:23 + #11 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #12 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #13 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #14 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #15 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #16 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #17 0x7f4a2492d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #18 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +0x612000000750 is located 0 bytes to the right of 272-byte region [0x612000000640,0x612000000750) +allocated by thread T0 here: + #0 0x52ab3d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x43dee7 in operator new(unsigned long) cxa_noexception.cpp + #2 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f4a2492d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c247fff8090: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c247fff80a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c247fff80b0: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa + 0x0c247fff80c0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c247fff80d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c247fff80e0: 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa + 0x0c247fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c247fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c247fff8110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c247fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c247fff8130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2022-4.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2022-4.txt new file mode 100644 index 000000000..1b5c950d2 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2022-4.txt @@ -0,0 +1,55 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1944294700 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges [0x611000000400,0x6110000004fc) and [0x6110000003ab, 0x6110000004a7) overlap + #0 0x529e5e in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x92b7b4 in ZSTD_initDDict_internal /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:134:9 + #2 0x92b7b4 in ZSTD_createDDict_advanced /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:155:39 + #3 0x92b7b4 in ZSTD_createDDict /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:173:12 + #4 0x5b6980 in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:1960:27 + #5 0x5b6980 in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2497:8 + #6 0x5b6d4d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2523:12 + #7 0x5fa74b in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2855:23 + #8 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #9 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #10 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #11 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #12 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #13 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f4747c45082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #15 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +0x611000000400 is located 0 bytes inside of 252-byte region [0x611000000400,0x6110000004fc) +allocated by thread T0 here: + #0 0x52ab3d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x6b803d in ZSTD_customMalloc /src/c-blosc2/internal-complibs/zstd-1.4.8/common/zstd_common.c:60:12 + #2 0x92b749 in ZSTD_initDDict_internal /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:130:38 + #3 0x92b749 in ZSTD_createDDict_advanced /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:155:39 + #4 0x92b749 in ZSTD_createDDict /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:173:12 + #5 0x5b6980 in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:1960:27 + #6 0x5b6980 in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2497:8 + #7 0x5b6d4d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2523:12 + #8 0x5fa74b in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2855:23 + #9 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #10 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #11 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #12 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #13 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #14 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f4747c45082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +0x6110000003b8 is located 0 bytes to the right of 248-byte region [0x6110000002c0,0x6110000003b8) +allocated by thread T0 here: + #0 0x52ab3d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x43dee7 in operator new(unsigned long) cxa_noexception.cpp + #2 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f4747c45082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: memcpy-param-overlap /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2022-486.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2022-486.txt new file mode 100644 index 000000000..a26690f69 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2022-486.txt @@ -0,0 +1,78 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1944794741 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x606000000140 at pc 0x0000005be9af bp 0x7ffee93f55f0 sp 0x7ffee93f55e8 +READ of size 1 at 0x606000000140 thread T0 + #0 0x5be9ae in blosc2_get_io_cb /src/c-blosc2/blosc/blosc2.c:3404:20 + #1 0x5e72cc in get_header_info /src/c-blosc2/blosc/frame.c:374:5 + #2 0x5f1843 in frame_to_schunk /src/c-blosc2/blosc/frame.c:1567:8 + #3 0x5e0612 in blosc2_schunk_from_buffer /src/c-blosc2/blosc/schunk.c:446:27 + #4 0x564323 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:94:7 + #5 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f0ba7313082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #10 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +0x606000000140 is located 0 bytes inside of 64-byte region [0x606000000140,0x606000000180) +freed by thread T0 here: + #0 0x52a8d2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:111:3 + #1 0x564311 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:95:7 + #2 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f0ba7313082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +previously allocated by thread T0 here: + #0 0x52ab3d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x5be8b2 in blosc2_register_io_cb /src/c-blosc2/blosc/blosc2.c:3390:28 + #2 0x5be8b2 in blosc2_get_io_cb /src/c-blosc2/blosc/blosc2.c:3409:7 + #3 0x5e72cc in get_header_info /src/c-blosc2/blosc/frame.c:374:5 + #4 0x5f1843 in frame_to_schunk /src/c-blosc2/blosc/frame.c:1567:8 + #5 0x5e0612 in blosc2_schunk_from_buffer /src/c-blosc2/blosc/schunk.c:446:27 + #6 0x56430c in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:94:7 + #7 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f0ba7313082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/c-blosc2/blosc/blosc2.c:3404:20 in blosc2_get_io_cb +Shadow bytes around the buggy address: + 0x0c0c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c0c7fff8010: 00 00 00 00 00 00 00 07 fa fa fa fa fd fd fd fd +=>0x0c0c7fff8020: fd fd fd fa fa fa fa fa[fd]fd fd fd fd fd fd fd + 0x0c0c7fff8030: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c0c7fff8040: fd fd fd fd fd fd fd fd fa fa fa fa 00 00 00 00 + 0x0c0c7fff8050: 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2022-511.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2022-511.txt new file mode 100644 index 000000000..2011c6de4 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2022-511.txt @@ -0,0 +1,68 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1940531326 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62b00000d019 at pc 0x000000529f61 bp 0x7ffeca914390 sp 0x7ffeca913b58 +READ of size 61951 at 0x62b00000d019 thread T0 + #0 0x529f60 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x92b7b4 in ZSTD_initDDict_internal /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:134:9 + #2 0x92b7b4 in ZSTD_createDDict_advanced /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:155:39 + #3 0x92b7b4 in ZSTD_createDDict /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:173:12 + #4 0x5b6980 in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:1960:27 + #5 0x5b6980 in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2497:8 + #6 0x5b6d4d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2523:12 + #7 0x5fa74b in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2855:23 + #8 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #9 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #10 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #11 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #12 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #13 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7fc9544e5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #15 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +0x62b00000d019 is located 0 bytes to the right of 24089-byte region [0x62b000007200,0x62b00000d019) +allocated by thread T0 here: + #0 0x52ab3d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x43dee7 in operator new(unsigned long) cxa_noexception.cpp + #2 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7fc9544e5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c567fff99b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c567fff99c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c567fff99d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c567fff99e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c567fff99f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c567fff9a00: 00 00 00[01]fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff9a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff9a20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff9a30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff9a40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff9a50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2023-51.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2023-51.txt new file mode 100644 index 000000000..b876dbccd --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes/OSV-2023-51.txt @@ -0,0 +1,88 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1945059260 +INFO: Loaded 1 modules (39110 inline 8-bit counters): 39110 [0xb24640, 0xb2df06), +INFO: Loaded 1 PC tables (39110 PCs): 39110 [0xa34660,0xacd2c0), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x62b00000dcc0 at pc 0x000000529f61 bp 0x7ffd1f7a91d0 sp 0x7ffd1f7a8998 +READ of size 24 at 0x62b00000dcc0 thread T0 + #0 0x529f60 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x92b371 in ZSTD_freeDDict /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:215:44 + #2 0x5b54c9 in blosc2_free_ctx /src/c-blosc2/blosc/blosc2.c:3548:5 + #3 0x5df9cc in blosc2_schunk_free /src/c-blosc2/blosc/schunk.c:394:5 + #4 0x564477 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c + #5 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f1b31d40082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #10 0x42670d in _start (/out/decompress_frame_fuzzer+0x42670d) + +0x62b00000dcc0 is located 27328 bytes inside of 27352-byte region [0x62b000007200,0x62b00000dcd8) +freed by thread T0 here: + #0 0x52a8d2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:111:3 + #1 0x6b83df in ZSTD_customFree /src/c-blosc2/internal-complibs/zstd-1.4.8/common/zstd_common.c:81:13 + #2 0x92b42d in ZSTD_freeDDict /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:217:9 + #3 0x5b66e1 in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:1939:7 + #4 0x5b66e1 in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2497:8 + #5 0x5b6d4d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2523:12 + #6 0x5fa74b in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2855:23 + #7 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #8 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #9 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f1b31d40082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +previously allocated by thread T0 here: + #0 0x52ab3d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x6b803d in ZSTD_customMalloc /src/c-blosc2/internal-complibs/zstd-1.4.8/common/zstd_common.c:60:12 + #2 0x92b6ba in ZSTD_createDDict_advanced /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:152:49 + #3 0x92b6ba in ZSTD_createDDict /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:173:12 + #4 0x5b6980 in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:1960:27 + #5 0x5b6980 in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2497:8 + #6 0x5b6d4d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2523:12 + #7 0x5fa74b in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2855:23 + #8 0x5de036 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #9 0x5643c6 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:125:17 + #10 0x45c253 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #11 0x447ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #12 0x44d72c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #13 0x476322 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f1b31d40082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c567fff9b40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fff9b50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fff9b60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fff9b70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fff9b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0c567fff9b90: fd fd fd fd fd fd fd fd[fd]fd fd fa fa fa fa fa + 0x0c567fff9ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff9bb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff9bc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff9bd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c567fff9be0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/COMMANDS.md b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/COMMANDS.md new file mode 100644 index 000000000..befa13dd9 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/COMMANDS.md @@ -0,0 +1,147 @@ +# Original Crash Collection: c-blosc2 decompress_frame_fuzzer + +Generated: 2026-04-23 UTC + +Benchmark: `c-blosc2_transplant_decompress_frame_fuzzer` +Project: `c-blosc2` +Fuzzer: `decompress_frame_fuzzer` +Sanitizer: `address` + +Default source testcase directory: `/home/user/oss-fuzz-for-select/pocs/tmp` +Transplant crash-log directory: `/home/user/oss-fuzz-build/fuzzbench/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/crashes` +Original crash-log directory: `/home/user/oss-fuzz-build/fuzzbench/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes` +Build CSV used by `collect_crash`: `/home/user/oss-fuzz-build/fuzzbench/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/collect_crash_builds.csv` + +Runner image: `gcr.io/oss-fuzz-base/base-runner@sha256:83dc2104f6325551cf7b2dd928b63a3545bd283d00c3179827dcd963cff7764b` +Runner local image ID: `sha256:47823077f55a0715ce32e3b5caeb8bf051d2e93a1a653843e329096265c253ef` +Runner local image created: `2026-01-03T03:54:18.617978113Z` + +## Commit Mapping + +Local bugs are the `Already triggering` cases and were replayed at target source commit `79e921d904d46fc9edc292e02a48f1aa54567a7d`. +Migration bugs were replayed at their buggy source commits from `/mnt/nas/linke/new_migrate/c-blosc2/decompress_frame_fuzzer/transplant.log`; skipped-but-triggering entries were completed from the local c-blosc2 migration logs. + +`79e921d904d46fc9edc292e02a48f1aa54567a7d` maps to OSS-Fuzz commit `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b`, timestamp `1629815276` (`2021-08-24 14:27:56 +0000`). +`26d05bff` maps to OSS-Fuzz commit `d64b3f05953dfa943b62b81e797034dc91a58e14`. +Source commits not present in `/home/user/log/c-blosc2_builds.csv` were mapped in `collect_crash_builds.csv` to `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` so `collect_crash` can use the historical c-blosc2 OSS-Fuzz integration. + +`OSV-2021-639` uses `/home/user/oss-fuzz-for-select/pocs/tmp/testcase-OSV-2021-639` (SHA1 `9fa91231a3d087984487ca05aae682b2f045cb4c`). It was captured with the prebuilt `77b7dfd41f4b8ae7cc12c8babd547829a84435da` fuzzer and the runner image above; the older helper default runner fails before execution with a `GLIBC_2.29` loader error. +`OSV-2022-486` uses `/home/user/oss-fuzz-for-select/pocs/tmp/testcase-OSV-2022-486` and triggers only when replayed with libFuzzer `-runs=10`; the single-input `collect_crash` path can miss the heap-use-after-free. +`OSV-2021-464` requires libFuzzer `-rss_limit_mb=8192`; under the default 2048MB cap libFuzzer aborts with `out-of-memory (malloc(2155905168))` from `init_thread_context` (`blosc2.c:1560`) before the expected `heap-buffer-overflow READ 16` at `blosc_read_header` (`blosc2.c:677`) can fire. It was captured by running the prebuilt `79e921d9` fuzzer directly against the testcase inside the runner image above (see "Re-run Command (OSV-2021-464)" below). + +| Bug | Kind | Source commit | OSS-Fuzz commit | +| --- | --- | --- | --- | +| OSV-2020-2184 | migration | `3055a0` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2021-21 | migration | `0e8bdfce` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2021-22 | migration | `0e8bdfce` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2021-213 | migration | `0e8bdfce` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2021-221 | migration | `fdfeb753` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2021-246 | migration | `c91ed64c` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2021-247 | migration | `1a42fcd4` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2021-274 | migration | `e362bb0b` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2021-369 | migration | `60b79c4c` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2021-404 | migration | `49357bd0` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2021-429 | migration | `5eff30b8` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2021-464 | local | `79e921d904d46fc9edc292e02a48f1aa54567a7d` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2021-481 | local | `79e921d904d46fc9edc292e02a48f1aa54567a7d` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2021-485 | local | `79e921d904d46fc9edc292e02a48f1aa54567a7d` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2021-487 | local | `79e921d904d46fc9edc292e02a48f1aa54567a7d` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2021-496 | local | `79e921d904d46fc9edc292e02a48f1aa54567a7d` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2021-498 | local | `79e921d904d46fc9edc292e02a48f1aa54567a7d` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2021-526 | local | `79e921d904d46fc9edc292e02a48f1aa54567a7d` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2021-622 | local | `79e921d904d46fc9edc292e02a48f1aa54567a7d` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2021-639 | migration | `77b7dfd4` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2021-997 | local | `79e921d904d46fc9edc292e02a48f1aa54567a7d` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2022-4 | migration | `886d4c9b` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2022-34 | migration | `886d4c9b` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2022-486 | migration | `13fbe91e` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2022-511 | migration | `abb0faba` | `dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b` | +| OSV-2022-1242 | migration | `26d05bff` | `d64b3f05953dfa943b62b81e797034dc91a58e14` | +| OSV-2023-51 | migration | `26d05bff` | `d64b3f05953dfa943b62b81e797034dc91a58e14` | + +## Re-run Command + +Run from `/home/user/oss-fuzz-build/fuzzbench`. + +```bash +RUNNER_IMAGE='gcr.io/oss-fuzz-base/base-runner@sha256:83dc2104f6325551cf7b2dd928b63a3545bd283d00c3179827dcd963cff7764b' +BUILD_CSV='/home/user/oss-fuzz-build/fuzzbench/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/collect_crash_builds.csv' +OUT_DIR='benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes' + +while IFS=$'\t' read -r bug commit prefix testcases; do + [ "$bug" = "bug" ] && continue + /home/user/pyenv/venv/bin/python3 /home/user/oss-fuzz-for-select/script/fuzz_helper.py collect_crash \ + --commit "$commit" \ + --build_csv "$BUILD_CSV" \ + --testcases "$testcases" \ + --test_input "testcase-${bug}" \ + --runner-image "$RUNNER_IMAGE" \ + c-blosc2 \ + decompress_frame_fuzzer + sort -m "/home/user/oss-fuzz-build/data/crash/target_crash-${prefix}-testcase-${bug}.txt" -o "${OUT_DIR}/${bug}.txt" +done <<'JOBS' +bug commit prefix testcases +OSV-2020-2184 3055a0 3055a0 /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2021-21 0e8bdfce 0e8bdf /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2021-22 0e8bdfce 0e8bdf /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2021-213 0e8bdfce 0e8bdf /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2021-221 fdfeb753 fdfeb7 /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2021-246 c91ed64c c91ed6 /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2021-247 1a42fcd4 1a42fc /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2021-274 e362bb0b e362bb /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2021-369 60b79c4c 60b79c /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2021-404 49357bd0 49357b /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2021-429 5eff30b8 5eff30 /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2021-464 79e921d904d46fc9edc292e02a48f1aa54567a7d 79e921 /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2021-481 79e921d904d46fc9edc292e02a48f1aa54567a7d 79e921 /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2021-485 79e921d904d46fc9edc292e02a48f1aa54567a7d 79e921 /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2021-487 79e921d904d46fc9edc292e02a48f1aa54567a7d 79e921 /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2021-496 79e921d904d46fc9edc292e02a48f1aa54567a7d 79e921 /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2021-498 79e921d904d46fc9edc292e02a48f1aa54567a7d 79e921 /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2021-526 79e921d904d46fc9edc292e02a48f1aa54567a7d 79e921 /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2021-622 79e921d904d46fc9edc292e02a48f1aa54567a7d 79e921 /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2021-997 79e921d904d46fc9edc292e02a48f1aa54567a7d 79e921 /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2022-4 886d4c9b 886d4c /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2022-34 886d4c9b 886d4c /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2022-511 abb0faba abb0fa /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2022-1242 26d05bff 26d05b /home/user/oss-fuzz-for-select/pocs/tmp +OSV-2023-51 26d05bff 26d05b /home/user/oss-fuzz-for-select/pocs/tmp +JOBS +``` + +The two non-standard replays are captured with prebuilt fuzzers, because OSV-2021-639 needs the compatible runner image and OSV-2022-486 needs libFuzzer repeat execution: + +```bash +/home/user/pyenv/venv/bin/python3 /home/user/oss-fuzz-for-select/script/fuzz_helper.py reproduce \ + --fuzzer_path /mnt/nas/linke/c-blosc2/c-blosc2-77b7dfd41f4b8ae7cc12c8babd547829a84435da-address \ + --runner-image "$RUNNER_IMAGE" \ + c-blosc2 \ + decompress_frame_fuzzer \ + /home/user/oss-fuzz-for-select/pocs/tmp/testcase-OSV-2021-639 \ + > "${OUT_DIR}/OSV-2021-639.txt" 2>&1 + +/home/user/pyenv/venv/bin/python3 /home/user/oss-fuzz-for-select/script/fuzz_helper.py reproduce \ + --fuzzer_path /mnt/nas/linke/c-blosc2/c-blosc2-13fbe91ec93839e2de76b3df9238d6aec70b9449-address \ + --runner-image "$RUNNER_IMAGE" \ + c-blosc2 \ + decompress_frame_fuzzer \ + /home/user/oss-fuzz-for-select/pocs/tmp/testcase-OSV-2022-486 \ + > "${OUT_DIR}/OSV-2022-486.txt" 2>&1 +``` + +## Re-run Command (OSV-2021-464) + +`OSV-2021-464` needs `-rss_limit_mb=8192` or libFuzzer kills the process with `out-of-memory` before the heap-buffer-overflow fires. The `collect_crash` path does not forward fuzzer flags, so it is captured by running the prebuilt binary directly inside the runner image: + +```bash +TMPD=$(mktemp -d) +cp /home/user/oss-fuzz-for-select/pocs/tmp/testcase-OSV-2021-464 "$TMPD/" +docker run --rm --platform linux/amd64 --shm-size=2g \ + -v /mnt/nas/linke/c-blosc2/c-blosc2-79e921d904d46fc9edc292e02a48f1aa54567a7d-address:/out:ro \ + -v "$TMPD":/corpus:ro \ + -e ASAN_OPTIONS=abort_on_error=1:symbolize=1 \ + "$RUNNER_IMAGE" \ + /out/decompress_frame_fuzzer /corpus/testcase-OSV-2021-464 -rss_limit_mb=8192 \ + > "${OUT_DIR}/OSV-2021-464.txt" 2>&1 +rm -rf "$TMPD" +``` diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2020-2184.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2020-2184.txt new file mode 100644 index 000000000..cddeaa13b --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2020-2184.txt @@ -0,0 +1,29 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4020924044 +INFO: Loaded 1 modules (26193 inline 8-bit counters): 26193 [0x55909a450b60, 0x55909a4571b1), +INFO: Loaded 1 PC tables (26193 PCs): 26193 [0x55909a4571b8,0x55909a4bd6c8), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-2184 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==376==ERROR: AddressSanitizer: SEGV on unknown address 0x7c2b113e20c3 (pc 0x55909a1813e9 bp 0x7fff6db6b590 sp 0x7fff6db6b4e0 T0) +==376==The signal is caused by a READ memory access. + #0 0x55909a1813e9 in frame_get_usermeta /src/c-blosc2/blosc/frame.c:932:5 + #1 0x55909a18280b in blosc2_frame_to_schunk /src/c-blosc2/blosc/frame.c:1267:18 + #2 0x55909a1785a1 in blosc2_schunk_open_sframe /src/c-blosc2/blosc/schunk.c:263:27 + #3 0x55909a126557 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:23:27 + #4 0x559099fc3e5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x559099faebd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x559099fb4aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x559099fe05d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7faaf201e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x559099fa7cbd in _start (/out/decompress_frame_fuzzer+0xe7cbd) + +==376==Register values: +rax = 0x00007c2b113e20c6 rbx = 0x00007fff6db6b4e0 rcx = 0x0000000000000000 rdx = 0x0000000000001578 +rdi = 0x00007c2b113e20c3 rsi = 0x00007baaefef04a0 rbp = 0x00007fff6db6b590 rsp = 0x00007fff6db6b4e0 + r8 = 0x00007beaf11e0098 r9 = 0x00000f7d5e23c013 r10 = 0x00007baaefef0400 r11 = 0x00000f755dfde080 +r12 = 0x00007baaefef0470 r13 = 0x0000000000000000 r14 = 0x00007beaf11e0090 r15 = 0x0000000020202020 +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/c-blosc2/blosc/frame.c:932:5 in frame_get_usermeta +==376==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-1791.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-1791.txt new file mode 100644 index 000000000..2800fdea1 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-1791.txt @@ -0,0 +1,68 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3767854293 +INFO: Loaded 1 modules (23263 inline 8-bit counters): 23263 [0x55f132612160, 0x55f132617c3f), +INFO: Loaded 1 PC tables (23263 PCs): 23263 [0x55f132617c40,0x55f132672a30), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1791 +================================================================= +==372==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7daecc9ed017 at pc 0x55f1322de45b bp 0x7ffe42437a00 sp 0x7ffe424371c0 +READ of size 61951 at 0x7daecc9ed017 thread T0 + #0 0x55f1322de45a in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x55f1324f30e0 in ZSTD_initDDict_internal /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:134:9 + #2 0x55f1324f2ea2 in ZSTD_createDDict_advanced /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:155:39 + #3 0x55f1324f33f3 in ZSTD_createDDict /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:173:12 + #4 0x55f13235cc1d in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:1818:27 + #5 0x55f13235c627 in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2353:8 + #6 0x55f13235cf8d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2379:12 + #7 0x55f13238edfd in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2779:23 + #8 0x55f132379d69 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #9 0x55f132324645 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:38:15 + #10 0x55f1321c1e5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #11 0x55f1321acbd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #12 0x55f1321b2aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #13 0x55f1321de5d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7efecd778082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #15 0x55f1321a5cbd in _start (/out/decompress_frame_fuzzer+0xd1cbd) + +0x7daecc9ed017 is located 0 bytes after 24087-byte region [0x7daecc9e7200,0x7daecc9ed017) +allocated by thread T0 here: + #0 0x55f1322e07b4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55f132585ce3 in operator new(unsigned long) cxa_noexception.cpp + #2 0x55f1321acbd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x55f1321b2aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x55f1321de5d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7efecd778082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:134:9 in ZSTD_initDDict_internal +Shadow bytes around the buggy address: + 0x7daecc9ecd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7daecc9ece00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7daecc9ece80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7daecc9ecf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7daecc9ecf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7daecc9ed000: 00 00[07]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7daecc9ed080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7daecc9ed100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7daecc9ed180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7daecc9ed200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7daecc9ed280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==372==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-21.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-21.txt new file mode 100644 index 000000000..35077698a --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-21.txt @@ -0,0 +1,30 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4032477784 +INFO: Loaded 1 modules (26363 inline 8-bit counters): 26363 [0x56450be31b60, 0x56450be3825b), +INFO: Loaded 1 PC tables (26363 PCs): 26363 [0x56450be38260,0x56450be9f210), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-21 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==384==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x56450bb61a78 bp 0x7ffcf5eada70 sp 0x7ffcf5ead980 T0) +==384==The signal is caused by a READ memory access. +==384==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x56450bb61a78 in frame_get_lazychunk /src/c-blosc2/blosc/frame.c:1691:24 + #1 0x56450bb6562b in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2187:20 + #2 0x56450bb564c5 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:556:17 + #3 0x56450bb02615 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:33:15 + #4 0x56450b99fe5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x56450b98abd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x56450b990aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x56450b9bc5d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fa5ba68a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x56450b983cbd in _start (/out/decompress_frame_fuzzer+0xe3cbd) + +==384==Register values: +rax = 0x00a00fceb733d578 rbx = 0x00007ffcf5ead980 rcx = 0x00007ba5b84ee00b rdx = 0x00000f75370f6080 +rdi = 0x05007e75b99eabc0 rsi = 0x0000000200000000 rbp = 0x00007ffcf5eada70 rsp = 0x00007ffcf5ead980 + r8 = 0x0000000000000002 r9 = 0x00007de5b99e0000 r10 = 0x00007fffffffff01 r11 = 0x0000000000000001 +r12 = 0x0500000000000758 r13 = 0x000000000000005c r14 = 0x00007ba5b85f0240 r15 = 0x00007ba5b87f0400 +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/c-blosc2/blosc/frame.c:1691:24 in frame_get_lazychunk +==384==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-213.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-213.txt new file mode 100644 index 000000000..da44df32d --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-213.txt @@ -0,0 +1,88 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4044041407 +INFO: Loaded 1 modules (26363 inline 8-bit counters): 26363 [0x555980f6ab60, 0x555980f7125b), +INFO: Loaded 1 PC tables (26363 PCs): 26363 [0x555980f71260,0x555980fd8210), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-213 +================================================================= +==384==ERROR: AddressSanitizer: heap-use-after-free on address 0x7e2f941e6a48 at pc 0x555980bf545b bp 0x7fff977ff9c0 sp 0x7fff977ff180 +READ of size 24 at 0x7e2f941e6a48 thread T0 + #0 0x555980bf545a in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x555980e74c8b in ZSTD_freeDDict /src/c-blosc2/internal-complibs/zstd-1.4.5/decompress/zstd_ddict.c:215:44 + #2 0x555980c726fb in blosc2_free_ctx /src/c-blosc2/blosc/blosc2.c:3216:5 + #3 0x555980c8d52b in blosc2_schunk_free /src/c-blosc2/blosc/schunk.c:250:3 + #4 0x555980c3b6cc in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:44:3 + #5 0x555980ad8e5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #6 0x555980ac3bd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #7 0x555980ac9aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #8 0x555980af55d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f7f94ec4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x555980abccbd in _start (/out/decompress_frame_fuzzer+0xe3cbd) + +0x7e2f941e6a48 is located 26696 bytes inside of 26720-byte region [0x7e2f941e0200,0x7e2f941e6a60) +freed by thread T0 here: + #0 0x555980bf7516 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3 + #1 0x555980d8e31a in ZSTD_free /src/c-blosc2/internal-complibs/zstd-1.4.5/common/zstd_common.c:81:13 + #2 0x555980e74cf9 in ZSTD_freeDDict /src/c-blosc2/internal-complibs/zstd-1.4.5/decompress/zstd_ddict.c:217:9 + #3 0x555980c72f53 in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:1690:7 + #4 0x555980c728f9 in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2214:11 + #5 0x555980c7392d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2240:12 + #6 0x555980c9e71e in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2205:23 + #7 0x555980c8f4c5 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:556:17 + #8 0x555980c3b615 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:33:15 + #9 0x555980ad8e5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #10 0x555980ac3bd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #11 0x555980ac9aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #12 0x555980af55d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f7f94ec4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +previously allocated by thread T0 here: + #0 0x555980bf77b4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x555980d8df70 in ZSTD_malloc /src/c-blosc2/internal-complibs/zstd-1.4.5/common/zstd_common.c:60:12 + #2 0x555980e74818 in ZSTD_createDDict_advanced /src/c-blosc2/internal-complibs/zstd-1.4.5/decompress/zstd_ddict.c:152:49 + #3 0x555980e74da3 in ZSTD_createDDict /src/c-blosc2/internal-complibs/zstd-1.4.5/decompress/zstd_ddict.c:173:12 + #4 0x555980c73436 in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:1709:27 + #5 0x555980c728f9 in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2214:11 + #6 0x555980c7392d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2240:12 + #7 0x555980c9e71e in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2205:23 + #8 0x555980c8f4c5 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:556:17 + #9 0x555980c3b615 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:33:15 + #10 0x555980ad8e5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #11 0x555980ac3bd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #12 0x555980ac9aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #13 0x555980af55d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f7f94ec4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/c-blosc2/internal-complibs/zstd-1.4.5/decompress/zstd_ddict.c:215:44 in ZSTD_freeDDict +Shadow bytes around the buggy address: + 0x7e2f941e6780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e2f941e6800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e2f941e6880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e2f941e6900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e2f941e6980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x7e2f941e6a00: fd fd fd fd fd fd fd fd fd[fd]fd fd fa fa fa fa + 0x7e2f941e6a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e2f941e6b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e2f941e6b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e2f941e6c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e2f941e6c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==384==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-22.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-22.txt new file mode 100644 index 000000000..d86abe7d8 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-22.txt @@ -0,0 +1,29 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4055661995 +INFO: Loaded 1 modules (26363 inline 8-bit counters): 26363 [0x55a93c6f1b60, 0x55a93c6f825b), +INFO: Loaded 1 PC tables (26363 PCs): 26363 [0x55a93c6f8260,0x55a93c75f210), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-22 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==384==ERROR: AddressSanitizer: SEGV on unknown address 0x7c4c167ecfde (pc 0x55a93c41f24d bp 0x7ffdc4149db0 sp 0x7ffdc4149cc0 T0) +==384==The signal is caused by a READ memory access. + #0 0x55a93c41f24d in frame_get_metalayers /src/c-blosc2/blosc/frame.c:1226:9 + #1 0x55a93c41facf in blosc2_frame_to_schunk /src/c-blosc2/blosc/frame.c:1433:8 + #2 0x55a93c4149a1 in blosc2_schunk_open_sframe /src/c-blosc2/blosc/schunk.c:290:27 + #3 0x55a93c3c2557 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:23:27 + #4 0x55a93c25fe5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x55a93c24abd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x55a93c250aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x55a93c27c5d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f8c4c54d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x55a93c243cbd in _start (/out/decompress_frame_fuzzer+0xe3cbd) + +==384==Register values: +rax = 0x0000000000000000 rbx = 0x00007ffdc4149cc0 rcx = 0x00007bac4b7e02a0 rdx = 0x0000000000000018 +rdi = 0x00007f8c4c4fe050 rsi = 0x00007f8c4c4fe0d0 rbp = 0x00007ffdc4149db0 rsp = 0x00007ffdc4149cc0 + r8 = 0x0000000000000004 r9 = 0x00007dcc4b7e0000 r10 = 0x00007fffffffff01 r11 = 0x0000000000000001 +r12 = 0x0000000000000077 r13 = 0x00007c4c167ecfde r14 = 0x00007b8c4a4f02c0 r15 = 0x00000f718949e040 +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/c-blosc2/blosc/frame.c:1226:9 in frame_get_metalayers +==384==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-221.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-221.txt new file mode 100644 index 000000000..a7a163676 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-221.txt @@ -0,0 +1,66 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4067397617 +INFO: Loaded 1 modules (26516 inline 8-bit counters): 26516 [0x56012cae6ba0, 0x56012caed334), +INFO: Loaded 1 PC tables (26516 PCs): 26516 [0x56012caed338,0x56012cb54c78), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-221 +================================================================= +==384==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c0c6dde00f9 at pc 0x56012c7f08f0 bp 0x7ffd282facf0 sp 0x7ffd282face8 +READ of size 4 at 0x7c0c6dde00f9 thread T0 + #0 0x56012c7f08ef in blosc_d /src/c-blosc2/blosc/blosc2.c:1116:14 + #1 0x56012c7eeb68 in _blosc_getitem /src/c-blosc2/blosc/blosc2.c:2596:14 + #2 0x56012c7f0bb6 in blosc_getitem /src/c-blosc2/blosc/blosc2.c:2654:12 + #3 0x56012c8151dd in get_coffset /src/c-blosc2/blosc/frame.c:1550:12 + #4 0x56012c815fa0 in frame_get_lazychunk /src/c-blosc2/blosc/frame.c:1710:20 + #5 0x56012c81b1fb in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2504:20 + #6 0x56012c80a7b5 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:615:17 + #7 0x56012c7b4615 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:33:15 + #8 0x56012c651e5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #9 0x56012c63cbd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #10 0x56012c642aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #11 0x56012c66e5d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f8c6eaca082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x56012c635cbd in _start (/out/decompress_frame_fuzzer+0xe4cbd) + +0x7c0c6dde00f9 is located 0 bytes after 89-byte region [0x7c0c6dde00a0,0x7c0c6dde00f9) +allocated by thread T0 here: + #0 0x56012c7707b4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x56012ca5b883 in operator new(unsigned long) cxa_noexception.cpp + #2 0x56012c63cbd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x56012c642aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x56012c66e5d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f8c6eaca082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/c-blosc2/blosc/blosc2.c:1116:14 in blosc_d +Shadow bytes around the buggy address: + 0x7c0c6dddfe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c0c6dddfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c0c6dddff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c0c6dddff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c0c6dde0000: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 01 +=>0x7c0c6dde0080: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00[01] + 0x7c0c6dde0100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c0c6dde0180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c0c6dde0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c0c6dde0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c0c6dde0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==384==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-246.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-246.txt new file mode 100644 index 000000000..6216852e3 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-246.txt @@ -0,0 +1,63 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4079105095 +INFO: Loaded 1 modules (28410 inline 8-bit counters): 28410 [0x560b36e55220, 0x560b36e5c11a), +INFO: Loaded 1 PC tables (28410 PCs): 28410 [0x560b36e5c120,0x560b36ecb0c0), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-246 +================================================================= +==384==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c08963e00f9 at pc 0x560b36a9f45b bp 0x7ffea6acfd30 sp 0x7ffea6acf4f0 +READ of size 538976288 at 0x7c08963e00f9 thread T0 + #0 0x560b36a9f45a in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x560b36b437c6 in frame_get_usermeta /src/c-blosc2/blosc/frame.c:1116:5 + #2 0x560b36b45046 in blosc2_frame_to_schunk /src/c-blosc2/blosc/frame.c:1528:18 + #3 0x560b36b399f1 in blosc2_schunk_open_sframe /src/c-blosc2/blosc/schunk.c:290:27 + #4 0x560b36ae5557 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:23:27 + #5 0x560b36982e5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #6 0x560b3696dbd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #7 0x560b36973aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #8 0x560b3699f5d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f8897121082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x560b36966cbd in _start (/out/decompress_frame_fuzzer+0xefcbd) + +0x7c08963e00f9 is located 0 bytes after 89-byte region [0x7c08963e00a0,0x7c08963e00f9) +allocated by thread T0 here: + #0 0x560b36aa17b4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x560b36dc8653 in operator new(unsigned long) cxa_noexception.cpp + #2 0x560b3696dbd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x560b36973aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x560b3699f5d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f8897121082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/c-blosc2/blosc/frame.c:1116:5 in frame_get_usermeta +Shadow bytes around the buggy address: + 0x7c08963dfe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c08963dfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c08963dff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c08963dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c08963e0000: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 01 +=>0x7c08963e0080: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00[01] + 0x7c08963e0100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c08963e0180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c08963e0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c08963e0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c08963e0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==384==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-247.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-247.txt new file mode 100644 index 000000000..c0cda4418 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-247.txt @@ -0,0 +1,64 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4121204414 +INFO: Loaded 1 modules (28410 inline 8-bit counters): 28410 [0x55a9e0e0d220, 0x55a9e0e1411a), +INFO: Loaded 1 PC tables (28410 PCs): 28410 [0x55a9e0e14120,0x55a9e0e830c0), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-247 +================================================================= +==384==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c4f617e00f9 at pc 0x55a9e0ad9d7f bp 0x7fff73773db0 sp 0x7fff73773da8 +READ of size 1 at 0x7c4f617e00f9 thread T0 + #0 0x55a9e0ad9d7e in blosc_getitem /src/c-blosc2/blosc/blosc2.c:2637:21 + #1 0x55a9e0afe0ed in get_coffset /src/c-blosc2/blosc/frame.c:1516:12 + #2 0x55a9e0afeeb3 in frame_get_lazychunk /src/c-blosc2/blosc/frame.c:1676:20 + #3 0x55a9e0b041bb in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2470:20 + #4 0x55a9e0af3935 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:620:17 + #5 0x55a9e0a9d635 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:38:15 + #6 0x55a9e093ae5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x55a9e0925bd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x55a9e092baa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x55a9e09575d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fcf6259f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x55a9e091ecbd in _start (/out/decompress_frame_fuzzer+0xefcbd) + +0x7c4f617e00f9 is located 0 bytes after 89-byte region [0x7c4f617e00a0,0x7c4f617e00f9) +allocated by thread T0 here: + #0 0x55a9e0a597b4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55a9e0d80333 in operator new(unsigned long) cxa_noexception.cpp + #2 0x55a9e0925bd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x55a9e092baa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x55a9e09575d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7fcf6259f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/c-blosc2/blosc/blosc2.c:2637:21 in blosc_getitem +Shadow bytes around the buggy address: + 0x7c4f617dfe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c4f617dfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c4f617dff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c4f617dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c4f617e0000: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 01 +=>0x7c4f617e0080: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00[01] + 0x7c4f617e0100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c4f617e0180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c4f617e0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c4f617e0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c4f617e0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==384==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-274.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-274.txt new file mode 100644 index 000000000..bfa3204c6 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-274.txt @@ -0,0 +1,23 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4127904168 +INFO: Loaded 1 modules (23114 inline 8-bit counters): 23114 [0x55d5090c6120, 0x55d5090cbb6a), +INFO: Loaded 1 PC tables (23114 PCs): 23114 [0x55d5090cbb70,0x55d509126010), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-274 +================================================================= +==372==ERROR: AddressSanitizer: requested allocation size 0xffffffffff20ffff (0xffffffffff211000 after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000 (thread T0) + #0 0x55d508d977b4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55d508e3b845 in frame_get_metalayers_from_header /src/c-blosc2/blosc/frame.c:1203:21 + #2 0x55d508e3b0d8 in frame_get_metalayers /src/c-blosc2/blosc/frame.c:1253:9 + #3 0x55d508e3c169 in frame_to_schunk /src/c-blosc2/blosc/frame.c:1466:8 + #4 0x55d508e32677 in blosc2_schunk_from_buffer /src/c-blosc2/blosc/schunk.c:439:27 + #5 0x55d508ddb559 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:23:27 + #6 0x55d508c78e5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x55d508c63bd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x55d508c69aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x55d508c955d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fe784601082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +==372==HINT: if you don't care about these errors you may set allocator_may_return_null=1 +SUMMARY: AddressSanitizer: allocation-size-too-big /src/c-blosc2/blosc/frame.c:1203:21 in frame_get_metalayers_from_header +==372==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-369.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-369.txt new file mode 100644 index 000000000..2adb41f44 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-369.txt @@ -0,0 +1,35 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4134696454 +INFO: Loaded 1 modules (23131 inline 8-bit counters): 23131 [0x56392b5ae120, 0x56392b5b3b7b), +INFO: Loaded 1 PC tables (23131 PCs): 23131 [0x56392b5b3b80,0x56392b60e130), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-369 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==372==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x56392b27d17b bp 0x7ffd92451a40 sp 0x7ffd92451200 T0) +==372==The signal is caused by a READ memory access. +==372==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x56392b27d17b in QuickCheckForUnpoisonedRegion /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.h:37:7 + #1 0x56392b27d17b in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #2 0x56392b2f3d1a in blosc_read_header /src/c-blosc2/blosc/blosc2.c:677:3 + #3 0x56392b2feb6e in blosc2_getitem_ctx /src/c-blosc2/blosc/blosc2.c:2587:12 + #4 0x56392b2fea7f in blosc_getitem /src/c-blosc2/blosc/blosc2.c:2572:12 + #5 0x56392b3251d4 in get_coffset /src/c-blosc2/blosc/frame.c:1492:12 + #6 0x56392b3260a5 in frame_get_lazychunk /src/c-blosc2/blosc/frame.c:1662:9 + #7 0x56392b32b40e in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2444:20 + #8 0x56392b2c3645 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:38:15 + #9 0x56392b160e5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #10 0x56392b14bbd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #11 0x56392b151aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #12 0x56392b17d5d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fcdb1163082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #14 0x56392b144cbd in _start (/out/decompress_frame_fuzzer+0xd0cbd) + +==372==Register values: +rax = 0x10000f8a36074013 rbx = 0x10000f8a36074010 rcx = 0x10000f8a36074015 rdx = 0x0000000000000010 +rdi = 0x00007ffd92451aa8 rsi = 0x80007c4db03e0099 rbp = 0x00007ffd92451a40 rsp = 0x00007ffd92451200 + r8 = 0x10000f89b607c013 r9 = 0x80007c4db03e00a8 r10 = 0x10000f89b607c015 r11 = 0x10000f8a36074010 +r12 = 0x3ffffffffffffff8 r13 = 0xffffffffffffffcf r14 = 0x00007bcdaf2f0020 r15 = 0x80007c4db03e0099 +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/c-blosc2/blosc/blosc2.c:677:3 in blosc_read_header +==372==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-404.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-404.txt new file mode 100644 index 000000000..fc66c9c74 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-404.txt @@ -0,0 +1,35 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4141441643 +INFO: Loaded 1 modules (23217 inline 8-bit counters): 23217 [0x559339708160, 0x55933970dc11), +INFO: Loaded 1 PC tables (23217 PCs): 23217 [0x55933970dc18,0x559339768728), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-404 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==372==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x5593393d417b bp 0x7ffd7a748280 sp 0x7ffd7a747a40 T0) +==372==The signal is caused by a READ memory access. +==372==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x5593393d417b in QuickCheckForUnpoisonedRegion /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.h:37:7 + #1 0x5593393d417b in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #2 0x55933944ad1a in blosc_read_header /src/c-blosc2/blosc/blosc2.c:677:3 + #3 0x559339455b6e in blosc2_getitem_ctx /src/c-blosc2/blosc/blosc2.c:2587:12 + #4 0x559339455a7f in blosc_getitem /src/c-blosc2/blosc/blosc2.c:2572:12 + #5 0x55933947de94 in get_coffset /src/c-blosc2/blosc/frame.c:1740:12 + #6 0x55933947ed65 in frame_get_lazychunk /src/c-blosc2/blosc/frame.c:1910:9 + #7 0x5593394840ce in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2692:20 + #8 0x55933941a645 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:38:15 + #9 0x5593392b7e5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #10 0x5593392a2bd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #11 0x5593392a8aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #12 0x5593392d45d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fae05895082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #14 0x55933929bcbd in _start (/out/decompress_frame_fuzzer+0xd1cbd) + +==372==Register values: +rax = 0x10000f8640974011 rbx = 0x10000f8640974010 rcx = 0x10000f8640974013 rdx = 0x0000000000000010 +rdi = 0x00007ffd7a7482e8 rsi = 0x80007c2e04be008a rbp = 0x00007ffd7a748280 rsp = 0x00007ffd7a747a40 + r8 = 0x10000f85c097c011 r9 = 0x80007c2e04be0099 r10 = 0x10000f85c097c013 r11 = 0x10000f8640974010 +r12 = 0x3ffffffffffffff8 r13 = 0xffffffffffffffcf r14 = 0x00007bae03af0020 r15 = 0x80007c2e04be008a +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/c-blosc2/blosc/blosc2.c:677:3 in blosc_read_header +==372==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-429.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-429.txt new file mode 100644 index 000000000..5b09bbfb7 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-429.txt @@ -0,0 +1,33 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4148231712 +INFO: Loaded 1 modules (23234 inline 8-bit counters): 23234 [0x558c8541c160, 0x558c85421c22), +INFO: Loaded 1 PC tables (23234 PCs): 23234 [0x558c85421c28,0x558c8547c848), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-429 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==372==ERROR: AddressSanitizer: SEGV on unknown address 0x7c079afe22b6 (pc 0x558c85169d24 bp 0x7fff31f472c0 sp 0x7fff31f47230 T0) +==372==The signal is caused by a READ memory access. + #0 0x558c85169d24 in blosc_d /src/c-blosc2/blosc/blosc2.c:1344:14 + #1 0x558c85168c88 in _blosc_getitem /src/c-blosc2/blosc/blosc2.c:2538:14 + #2 0x558c8516ac92 in blosc2_getitem_ctx /src/c-blosc2/blosc/blosc2.c:2605:12 + #3 0x558c8516aa7f in blosc_getitem /src/c-blosc2/blosc/blosc2.c:2570:12 + #4 0x558c8519462e in get_coffset /src/c-blosc2/blosc/frame.c:1681:12 + #5 0x558c851930ea in frame_get_lazychunk /src/c-blosc2/blosc/frame.c:1859:9 + #6 0x558c85199356 in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2682:18 + #7 0x558c8512f645 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:38:15 + #8 0x558c84fcce5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #9 0x558c84fb7bd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #10 0x558c84fbdaa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #11 0x558c84fe95d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f177ba94082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x558c84fb0cbd in _start (/out/decompress_frame_fuzzer+0xd1cbd) + +==372==Register values: +rax = 0x0000000000000000 rbx = 0x00007c079afe22b6 rcx = 0x0000000000000021 rdx = 0x0000558c85484800 +rdi = 0x0000000000000fd8 rsi = 0x0000000200000000 rbp = 0x00007fff31f472c0 rsp = 0x00007fff31f47230 + r8 = 0x0000000000200000 r9 = 0x00000000202020ff r10 = 0x00007b1779cf0020 r11 = 0x00007c077ade01b7 +r12 = 0x000000005fdfdefc r13 = 0x0000000000000671 r14 = 0x000000005fdfdf00 r15 = 0x0000000000000020 +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/c-blosc2/blosc/blosc2.c:1344:14 in blosc_d +==372==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-464.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-464.txt new file mode 100644 index 000000000..a9afcbb18 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-464.txt @@ -0,0 +1,69 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3707057386 +INFO: Loaded 1 modules (32872 inline 8-bit counters): 32872 [0x55cc5aa8e9e0, 0x55cc5aa96a48), +INFO: Loaded 1 PC tables (32872 PCs): 32872 [0x55cc5aa96a48,0x55cc5ab170c8), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-464 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5100000001f8 at pc 0x55cc5a63c042 bp 0x7ffd79091a10 sp 0x7ffd790911d0 +READ of size 16 at 0x5100000001f8 thread T0 + #0 0x55cc5a63c041 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x55cc5a6b916a in blosc_read_header /src/c-blosc2/blosc/blosc2.c:677:3 + #2 0x55cc5a6c994e in blosc2_cbuffer_sizes /src/c-blosc2/blosc/blosc2.c:3053:12 + #3 0x55cc5a6f72db in frame_get_lazychunk /src/c-blosc2/blosc/frame.c:2022:10 + #4 0x55cc5a6fd5d3 in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2756:8 + #5 0x55cc5a6e5769 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #6 0x55cc5a67d945 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:38:15 + #7 0x55cc5a532380 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #8 0x55cc5a51d5f5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #9 0x55cc5a52308f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #10 0x55cc5a54e332 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f10d61ff082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x55cc5a5157dd in _start (/out/decompress_frame_fuzzer+0x10d7dd) + +DEDUP_TOKEN: __asan_memcpy--blosc_read_header--blosc2_cbuffer_sizes +0x5100000001f8 is located 0 bytes after 184-byte region [0x510000000140,0x5100000001f8) +allocated by thread T0 here: + #0 0x55cc5a63e14f in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:68:3 + #1 0x55cc5aa09cb3 in operator new(unsigned long) cxa_noexception.cpp + #2 0x55cc5a51d5f5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #3 0x55cc5a52308f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #4 0x55cc5a54e332 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f10d61ff082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--operator new(unsigned long)--fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/c-blosc2/blosc/blosc2.c:677:3 in blosc_read_header +Shadow bytes around the buggy address: + 0x50ffffffff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x50ffffffff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x510000000000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x510000000080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa + 0x510000000100: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 +=>0x510000000180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00[fa] + 0x510000000200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x510000000280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x510000000300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x510000000380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x510000000400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-481.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-481.txt new file mode 100644 index 000000000..e0fad0991 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-481.txt @@ -0,0 +1,68 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3781444395 +INFO: Loaded 1 modules (23263 inline 8-bit counters): 23263 [0x55e6bb4e5160, 0x55e6bb4eac3f), +INFO: Loaded 1 PC tables (23263 PCs): 23263 [0x55e6bb4eac40,0x55e6bb545a30), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-481 +================================================================= +==372==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c7c3b5e01d5 at pc 0x55e6bb1b145b bp 0x7ffca60a07a0 sp 0x7ffca609ff60 +READ of size 222 at 0x7c7c3b5e01d5 thread T0 + #0 0x55e6bb1b145a in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x55e6bb3c60e0 in ZSTD_initDDict_internal /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:134:9 + #2 0x55e6bb3c5ea2 in ZSTD_createDDict_advanced /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:155:39 + #3 0x55e6bb3c63f3 in ZSTD_createDDict /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:173:12 + #4 0x55e6bb22fc1d in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:1818:27 + #5 0x55e6bb22f627 in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2353:8 + #6 0x55e6bb22ff8d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2379:12 + #7 0x55e6bb261dfd in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2779:23 + #8 0x55e6bb24cd69 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #9 0x55e6bb1f7645 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:38:15 + #10 0x55e6bb094e5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #11 0x55e6bb07fbd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #12 0x55e6bb085aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #13 0x55e6bb0b15d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f8c3c2cb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #15 0x55e6bb078cbd in _start (/out/decompress_frame_fuzzer+0xd1cbd) + +0x7c7c3b5e01d5 is located 0 bytes after 165-byte region [0x7c7c3b5e0130,0x7c7c3b5e01d5) +allocated by thread T0 here: + #0 0x55e6bb1b37b4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55e6bb458ce3 in operator new(unsigned long) cxa_noexception.cpp + #2 0x55e6bb07fbd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x55e6bb085aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x55e6bb0b15d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f8c3c2cb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:134:9 in ZSTD_initDDict_internal +Shadow bytes around the buggy address: + 0x7c7c3b5dff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c7c3b5dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c7c3b5e0000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x7c7c3b5e0080: 00 00 00 00 00 00 00 00 00 00 00 00 05 fa fa fa + 0x7c7c3b5e0100: fa fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00 +=>0x7c7c3b5e0180: 00 00 00 00 00 00 00 00 00 00[05]fa fa fa fa fa + 0x7c7c3b5e0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c7c3b5e0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c7c3b5e0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c7c3b5e0380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c7c3b5e0400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==372==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-485.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-485.txt new file mode 100644 index 000000000..805ef9e3c --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-485.txt @@ -0,0 +1,56 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3788196732 +INFO: Loaded 1 modules (23263 inline 8-bit counters): 23263 [0x55cf940a4160, 0x55cf940a9c3f), +INFO: Loaded 1 PC tables (23263 PCs): 23263 [0x55cf940a9c40,0x55cf94104a30), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-485 +================================================================= +==372==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c358a3e5b0d at pc 0x55cf93deee60 bp 0x7ffce5f68220 sp 0x7ffce5f68218 +READ of size 4 at 0x7c358a3e5b0d thread T0 + #0 0x55cf93deee5f in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:1806:34 + #1 0x55cf93dee627 in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2353:8 + #2 0x55cf93deef8d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2379:12 + #3 0x55cf93e20dfd in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2779:23 + #4 0x55cf93e0bd69 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #5 0x55cf93db6645 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:38:15 + #6 0x55cf93c53e5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x55cf93c3ebd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x55cf93c44aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x55cf93c705d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f458b1da082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x55cf93c37cbd in _start (/out/decompress_frame_fuzzer+0xd1cbd) + +Address 0x7c358a3e5b0d is a wild pointer inside of access range of size 0x000000000004. +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/c-blosc2/blosc/blosc2.c:1806:34 in initialize_context_decompression +Shadow bytes around the buggy address: + 0x7c358a3e5880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c358a3e5900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c358a3e5980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c358a3e5a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c358a3e5a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x7c358a3e5b00: fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c358a3e5b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c358a3e5c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c358a3e5c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c358a3e5d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c358a3e5d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==372==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-487.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-487.txt new file mode 100644 index 000000000..52994d5a5 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-487.txt @@ -0,0 +1,31 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3794980164 +INFO: Loaded 1 modules (23263 inline 8-bit counters): 23263 [0x55d6ca5a3160, 0x55d6ca5a8c3f), +INFO: Loaded 1 PC tables (23263 PCs): 23263 [0x55d6ca5a8c40,0x55d6ca603a30), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-487 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==372==ERROR: AddressSanitizer: SEGV on unknown address 0x7c5aa5c204cd (pc 0x55d6ca2eda87 bp 0x7ffc2015b1b0 sp 0x7ffc2015b170 T0) +==372==The signal is caused by a READ memory access. + #0 0x55d6ca2eda87 in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:1806:34 + #1 0x55d6ca2ed627 in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2353:8 + #2 0x55d6ca2edf8d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2379:12 + #3 0x55d6ca31fdfd in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2779:23 + #4 0x55d6ca30ad69 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #5 0x55d6ca2b5645 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:38:15 + #6 0x55d6ca152e5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x55d6ca13dbd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x55d6ca143aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x55d6ca16f5d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f5aa6914082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x55d6ca136cbd in _start (/out/decompress_frame_fuzzer+0xd1cbd) + +==372==Register values: +rax = 0x0000000000000000 rbx = 0x00007cbaa5be0980 rcx = 0x0000000000000021 rdx = 0x000055d6ca60ba00 +rdi = 0x0000000000000318 rsi = 0x0000000200000000 rbp = 0x00007ffc2015b1b0 rsp = 0x00007ffc2015b170 + r8 = 0x0000000000020000 r9 = 0x00007cbaa5be09fc r10 = 0x00000f9754b7c13f r11 = 0x00000f97d4b74138 +r12 = 0x00000f9754b7c13d r13 = 0x00000f9754b7c130 r14 = 0x000000004b07f649 r15 = 0x00007c5aa5c204cd +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/c-blosc2/blosc/blosc2.c:1806:34 in initialize_context_decompression +==372==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-496.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-496.txt new file mode 100644 index 000000000..446d49aff --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-496.txt @@ -0,0 +1,64 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3932516669 +INFO: Loaded 1 modules (23263 inline 8-bit counters): 23263 [0x5601a6bd8160, 0x5601a6bddc3f), +INFO: Loaded 1 PC tables (23263 PCs): 23263 [0x5601a6bddc40,0x5601a6c38a30), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-496 +================================================================= +==372==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c8b897e0269 at pc 0x5601a692588d bp 0x7ffe38a45140 sp 0x7ffe38a45138 +READ of size 4 at 0x7c8b897e0269 thread T0 + #0 0x5601a692588c in blosc_d /src/c-blosc2/blosc/blosc2.c:1349:14 + #1 0x5601a69334bd in serial_blosc /src/c-blosc2/blosc/blosc2.c:1503:16 + #2 0x5601a6922f8d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2379:12 + #3 0x5601a6954dfd in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2779:23 + #4 0x5601a693fd69 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #5 0x5601a68ea645 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:38:15 + #6 0x5601a6787e5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x5601a6772bd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x5601a6778aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x5601a67a45d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f8b8a5fe082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x5601a676bcbd in _start (/out/decompress_frame_fuzzer+0xd1cbd) + +0x7c8b897e0269 is located 111 bytes after 186-byte region [0x7c8b897e0140,0x7c8b897e01fa) +allocated by thread T0 here: + #0 0x5601a68a67b4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x5601a6b4bce3 in operator new(unsigned long) cxa_noexception.cpp + #2 0x5601a6772bd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x5601a6778aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x5601a67a45d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f8b8a5fe082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/c-blosc2/blosc/blosc2.c:1349:14 in blosc_d +Shadow bytes around the buggy address: + 0x7c8b897dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c8b897e0000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x7c8b897e0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 + 0x7c8b897e0100: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x7c8b897e0180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 +=>0x7c8b897e0200: fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]fa fa + 0x7c8b897e0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c8b897e0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c8b897e0380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c8b897e0400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c8b897e0480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==372==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-498.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-498.txt new file mode 100644 index 000000000..303cbd1f8 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-498.txt @@ -0,0 +1,31 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3939419959 +INFO: Loaded 1 modules (23263 inline 8-bit counters): 23263 [0x556dbc59c160, 0x556dbc5a1c3f), +INFO: Loaded 1 PC tables (23263 PCs): 23263 [0x556dbc5a1c40,0x556dbc5fca30), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-498 +================================================================= +==372==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x7c73957e023e in thread T0 + #0 0x556dbc26a516 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3 + #1 0x556dbc313a38 in frame_get_lazychunk /src/c-blosc2/blosc/frame.c:2031:7 + #2 0x556dbc318c83 in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2756:8 + #3 0x556dbc303d69 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #4 0x556dbc2ae645 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:38:15 + #5 0x556dbc14be5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #6 0x556dbc136bd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #7 0x556dbc13caa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #8 0x556dbc1685d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fa3964ec082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x556dbc12fcbd in _start (/out/decompress_frame_fuzzer+0xd1cbd) + +0x7c73957e023e is located 94 bytes inside of 138-byte region [0x7c73957e01e0,0x7c73957e026a) +allocated by thread T0 here: + #0 0x556dbc26a7b4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x556dbc50fce3 in operator new(unsigned long) cxa_noexception.cpp + #2 0x556dbc136bd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x556dbc13caa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x556dbc1685d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7fa3964ec082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: bad-free /src/c-blosc2/blosc/frame.c:2031:7 in frame_get_lazychunk +==372==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-526.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-526.txt new file mode 100644 index 000000000..7f770a22b --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-526.txt @@ -0,0 +1,31 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3946353264 +INFO: Loaded 1 modules (23263 inline 8-bit counters): 23263 [0x55e2a693e160, 0x55e2a6943c3f), +INFO: Loaded 1 PC tables (23263 PCs): 23263 [0x55e2a6943c40,0x55e2a699ea30), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-526 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==372==ERROR: AddressSanitizer: SEGV on unknown address 0x7c4a682204cd (pc 0x55e2a6688a87 bp 0x7ffe64ef6a50 sp 0x7ffe64ef6a10 T0) +==372==The signal is caused by a READ memory access. + #0 0x55e2a6688a87 in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:1806:34 + #1 0x55e2a6688627 in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2353:8 + #2 0x55e2a6688f8d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2379:12 + #3 0x55e2a66badfd in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2779:23 + #4 0x55e2a66a5d69 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #5 0x55e2a6650645 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:38:15 + #6 0x55e2a64ede5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x55e2a64d8bd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x55e2a64deaa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x55e2a650a5d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f4a68ec1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x55e2a64d1cbd in _start (/out/decompress_frame_fuzzer+0xd1cbd) + +==372==Register values: +rax = 0x0000000000000000 rbx = 0x00007caa681e0980 rcx = 0x0000000000000021 rdx = 0x000055e2a69a6a00 +rdi = 0x0000000000000318 rsi = 0x0000000200000000 rbp = 0x00007ffe64ef6a50 rsp = 0x00007ffe64ef6a10 + r8 = 0x0000000000020000 r9 = 0x00007caa681e09fc r10 = 0x00000f954d03c13f r11 = 0x00000f95cd034138 +r12 = 0x00000f954d03c13d r13 = 0x00000f954d03c130 r14 = 0x000000004b07f649 r15 = 0x00007c4a682204cd +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/c-blosc2/blosc/blosc2.c:1806:34 in initialize_context_decompression +==372==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-622.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-622.txt new file mode 100644 index 000000000..6cb0e76df --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-622.txt @@ -0,0 +1,64 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3953342422 +INFO: Loaded 1 modules (23263 inline 8-bit counters): 23263 [0x563c3d496160, 0x563c3d49bc3f), +INFO: Loaded 1 PC tables (23263 PCs): 23263 [0x563c3d49bc40,0x563c3d4f6a30), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-622 +================================================================= +==372==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7d09283e024a at pc 0x563c3d16245b bp 0x7ffd0a06a4d0 sp 0x7ffd0a069c90 +READ of size 67 at 0x7d09283e024a thread T0 + #0 0x563c3d16245a in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x563c3d20ade1 in get_vlmeta_from_trailer /src/c-blosc2/blosc/frame.c:1393:5 + #2 0x563c3d20a62d in frame_get_vlmetalayers /src/c-blosc2/blosc/frame.c:1452:9 + #3 0x563c3d20b77e in frame_to_schunk /src/c-blosc2/blosc/frame.c:1682:8 + #4 0x563c3d1ffeb7 in blosc2_schunk_from_buffer /src/c-blosc2/blosc/schunk.c:446:27 + #5 0x563c3d1a8559 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:23:27 + #6 0x563c3d045e5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x563c3d030bd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x563c3d036aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x563c3d0625d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7ff929224082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x563c3d029cbd in _start (/out/decompress_frame_fuzzer+0xd1cbd) + +0x7d09283e024a is located 0 bytes after 202-byte region [0x7d09283e0180,0x7d09283e024a) +allocated by thread T0 here: + #0 0x563c3d1647b4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x563c3d409ce3 in operator new(unsigned long) cxa_noexception.cpp + #2 0x563c3d030bd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x563c3d036aa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x563c3d0625d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7ff929224082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/c-blosc2/blosc/frame.c:1393:5 in get_vlmeta_from_trailer +Shadow bytes around the buggy address: + 0x7d09283dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d09283e0000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x7d09283e0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d09283e0100: 00 02 fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d09283e0180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7d09283e0200: 00 00 00 00 00 00 00 00 00[02]fa fa fa fa fa fa + 0x7d09283e0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d09283e0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d09283e0380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d09283e0400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d09283e0480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==372==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-639.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-639.txt new file mode 100644 index 000000000..abf113c0b --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-639.txt @@ -0,0 +1,87 @@ +INFO:__main__:Running: docker run --privileged --shm-size=2g --platform linux/amd64 --rm -e HELPER=True -e ARCHITECTURE=x86_64 -v /mnt/nas/linke/c-blosc2/c-blosc2-77b7dfd41f4b8ae7cc12c8babd547829a84435da-address:/out -v /tmp/oss-fuzz-testcase-v95u3ekn/testcase-OSV-2021-639:/testcase -t gcr.io/oss-fuzz-base/base-runner@sha256:83dc2104f6325551cf7b2dd928b63a3545bd283d00c3179827dcd963cff7764b reproduce decompress_frame_fuzzer -runs=10. ++ FUZZER=decompress_frame_fuzzer ++ shift ++ '[' '!' -v TESTCASE ']' ++ TESTCASE=/testcase ++ '[' '!' -f /testcase ']' ++ export RUN_FUZZER_MODE=interactive ++ RUN_FUZZER_MODE=interactive ++ export FUZZING_ENGINE=libfuzzer ++ FUZZING_ENGINE=libfuzzer ++ export SKIP_SEED_CORPUS=1 ++ SKIP_SEED_CORPUS=1 ++ run_fuzzer decompress_frame_fuzzer -runs=10 /testcase +vm.mmap_rnd_bits = 28 +/out/decompress_frame_fuzzer -- -rss_limit_mb=2560 -timeout=25 -runs=10 /testcase < /dev/null +INFO: libFuzzer ignores flags that start with '--' +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2110844987 +INFO: Loaded 1 modules (32514 inline 8-bit counters): 32514 [0x561b37b1bd40, 0x561b37b23c42), +INFO: Loaded 1 PC tables (32514 PCs): 32514 [0x561b37b23c48,0x561b37ba2c68), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /testcase +================================================================= +==14==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50d00000026a at pc 0x561b376c0022 bp 0x7ffeed0ada50 sp 0x7ffeed0ad210 +READ of size 270541055 at 0x50d00000026a thread T0 +SCARINESS: 26 (multi-byte-read-heap-buffer-overflow) + #0 0x561b376c0021 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x561b37711099 in blosc_d /src/c-blosc2/blosc/blosc2.c:1458:9 + #2 0x561b3770fe3b in _blosc_getitem /src/c-blosc2/blosc/blosc2.c:2669:18 + #3 0x561b37712c57 in blosc2_getitem_ctx /src/c-blosc2/blosc/blosc2.c:2738:12 + #4 0x561b377129b7 in blosc2_getitem /src/c-blosc2/blosc/blosc2.c:2697:12 + #5 0x561b3773b112 in get_coffset /src/c-blosc2/blosc/frame.c:1723:12 + #6 0x561b37739806 in frame_get_lazychunk /src/c-blosc2/blosc/frame.c:1929:8 + #7 0x561b377413a3 in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2983:8 + #8 0x561b37727639 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:915:17 + #9 0x561b37701925 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:38:15 + #10 0x561b375b6360 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #11 0x561b375a15d5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #12 0x561b375a706f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #13 0x561b375d2312 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f129a56c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #15 0x561b375997bd in _start (/out/decompress_frame_fuzzer+0x10c7bd) + +DEDUP_TOKEN: __asan_memcpy--blosc_d--_blosc_getitem +0x50d00000026a is located 0 bytes after 138-byte region [0x50d0000001e0,0x50d00000026a) +allocated by thread T0 here: + #0 0x561b376c212f in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:68:3 + #1 0x561b37a921d3 in operator new(unsigned long) cxa_noexception.cpp + #2 0x561b375a15d5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #3 0x561b375a706f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #4 0x561b375d2312 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f129a56c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--operator new(unsigned long)--fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/c-blosc2/blosc/blosc2.c:1458:9 in blosc_d +Shadow bytes around the buggy address: + 0x50cfffffff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x50d000000000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x50d000000080: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa + 0x50d000000100: fa fa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x50d000000180: 00 00 00 02 fa fa fa fa fa fa fa fa 00 00 00 00 +=>0x50d000000200: 00 00 00 00 00 00 00 00 00 00 00 00 00[02]fa fa + 0x50d000000280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x50d000000300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x50d000000380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x50d000000400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x50d000000480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==14==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-897.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-897.txt new file mode 100644 index 000000000..49a80cf95 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-897.txt @@ -0,0 +1,90 @@ +INFO:__main__:Running: docker run --privileged --shm-size=2g --platform linux/amd64 --rm -e HELPER=True -e ARCHITECTURE=x86_64 -v /mnt/nas/linke/c-blosc2/c-blosc2-d1ea514286c47433dabcf47b11cf81d2248ca5bf-address:/out -v /home/user/oss-fuzz-for-select/pocs/tmp/testcase-OSV-2021-897:/testcase -t gcr.io/oss-fuzz-base/base-runner@sha256:83dc2104f6325551cf7b2dd928b63a3545bd283d00c3179827dcd963cff7764b reproduce decompress_frame_fuzzer -runs=10. ++ FUZZER=decompress_frame_fuzzer ++ shift ++ '[' '!' -v TESTCASE ']' ++ TESTCASE=/testcase ++ '[' '!' -f /testcase ']' ++ export RUN_FUZZER_MODE=interactive ++ RUN_FUZZER_MODE=interactive ++ export FUZZING_ENGINE=libfuzzer ++ FUZZING_ENGINE=libfuzzer ++ export SKIP_SEED_CORPUS=1 ++ SKIP_SEED_CORPUS=1 ++ run_fuzzer decompress_frame_fuzzer -runs=10 /testcase +vm.mmap_rnd_bits = 28 +/out/decompress_frame_fuzzer -- -rss_limit_mb=2560 -timeout=25 -runs=10 /testcase < /dev/null +INFO: libFuzzer ignores flags that start with '--' +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1910465779 +INFO: Loaded 1 modules (32411 inline 8-bit counters): 32411 [0x5600d7fbace0, 0x5600d7fc2b7b), +INFO: Loaded 1 PC tables (32411 PCs): 32411 [0x5600d7fc2b80,0x5600d8041530), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /testcase +================================================================= +==14==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x526000005d90 at pc 0x5600d7b62022 bp 0x7fff0656e510 sp 0x7fff0656dcd0 +READ of size 37536 at 0x526000005d90 thread T0 +SCARINESS: 26 (multi-byte-read-heap-buffer-overflow) + #0 0x5600d7b62021 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x5600d7e601b3 in ZSTD_copyRawBlock /src/c-blosc2/internal-complibs/zstd-1.4.9/decompress/zstd_decompress.c:772:5 + #2 0x5600d7e601b3 in ZSTD_decompressFrame /src/c-blosc2/internal-complibs/zstd-1.4.9/decompress/zstd_decompress.c:865:27 + #3 0x5600d7e601b3 in ZSTD_decompressMultiFrame /src/c-blosc2/internal-complibs/zstd-1.4.9/decompress/zstd_decompress.c:972:32 + #4 0x5600d7e60c78 in ZSTD_decompress_usingDDict /src/c-blosc2/internal-complibs/zstd-1.4.9/decompress/zstd_decompress.c:1484:12 + #5 0x5600d7bbbb32 in zstd_wrap_decompress /src/c-blosc2/blosc/blosc2.c:533:12 + #6 0x5600d7bb3c34 in blosc_d /src/c-blosc2/blosc/blosc2.c:1597:18 + #7 0x5600d7baa79d in serial_blosc /src/c-blosc2/blosc/blosc2.c:1685:16 + #8 0x5600d7baa79d in do_job /src/c-blosc2/blosc/blosc2.c:1850:15 + #9 0x5600d7bb05ed in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2493:12 + #10 0x5600d7be126d in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2837:23 + #11 0x5600d7bc8e09 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:822:17 + #12 0x5600d7ba3925 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:38:15 + #13 0x5600d7a58360 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #14 0x5600d7a435d5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #15 0x5600d7a4906f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #16 0x5600d7a74312 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #17 0x7f6b1d06b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #18 0x5600d7a3b7bd in _start (/out/decompress_frame_fuzzer+0x10b7bd) + +DEDUP_TOKEN: __asan_memcpy--ZSTD_copyRawBlock--ZSTD_decompressFrame +0x526000005d90 is located 0 bytes after 11408-byte region [0x526000003100,0x526000005d90) +allocated by thread T0 here: + #0 0x5600d7b6412f in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:68:3 + #1 0x5600d7f31f33 in operator new(unsigned long) cxa_noexception.cpp + #2 0x5600d7a435d5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #3 0x5600d7a4906f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #4 0x5600d7a74312 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f6b1d06b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--operator new(unsigned long)--fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/c-blosc2/internal-complibs/zstd-1.4.9/decompress/zstd_decompress.c:772:5 in ZSTD_copyRawBlock +Shadow bytes around the buggy address: + 0x526000005b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x526000005b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x526000005c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x526000005c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x526000005d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x526000005d80: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x526000005e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x526000005e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x526000005f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x526000005f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x526000006000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==14==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-997.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-997.txt new file mode 100644 index 000000000..263169749 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2021-997.txt @@ -0,0 +1,68 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3960291233 +INFO: Loaded 1 modules (23263 inline 8-bit counters): 23263 [0x55a366a1c160, 0x55a366a21c3f), +INFO: Loaded 1 PC tables (23263 PCs): 23263 [0x55a366a21c40,0x55a366a7ca30), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-997 +================================================================= +==372==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7dd784ded017 at pc 0x55a3666e845b bp 0x7ffedf2bf3c0 sp 0x7ffedf2beb80 +READ of size 61951 at 0x7dd784ded017 thread T0 + #0 0x55a3666e845a in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x55a3668fd0e0 in ZSTD_initDDict_internal /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:134:9 + #2 0x55a3668fcea2 in ZSTD_createDDict_advanced /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:155:39 + #3 0x55a3668fd3f3 in ZSTD_createDDict /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:173:12 + #4 0x55a366766c1d in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:1818:27 + #5 0x55a366766627 in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2353:8 + #6 0x55a366766f8d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2379:12 + #7 0x55a366798dfd in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:2779:23 + #8 0x55a366783d69 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:804:17 + #9 0x55a36672e645 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:38:15 + #10 0x55a3665cbe5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #11 0x55a3665b6bd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #12 0x55a3665bcaa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #13 0x55a3665e85d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f2785be9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #15 0x55a3665afcbd in _start (/out/decompress_frame_fuzzer+0xd1cbd) + +0x7dd784ded017 is located 0 bytes after 24087-byte region [0x7dd784de7200,0x7dd784ded017) +allocated by thread T0 here: + #0 0x55a3666ea7b4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55a36698fce3 in operator new(unsigned long) cxa_noexception.cpp + #2 0x55a3665b6bd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x55a3665bcaa0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x55a3665e85d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f2785be9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/c-blosc2/internal-complibs/zstd-1.4.8/decompress/zstd_ddict.c:134:9 in ZSTD_initDDict_internal +Shadow bytes around the buggy address: + 0x7dd784decd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7dd784dece00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7dd784dece80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7dd784decf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7dd784decf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7dd784ded000: 00 00[07]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7dd784ded080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7dd784ded100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7dd784ded180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7dd784ded200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7dd784ded280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==372==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2022-1242.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2022-1242.txt new file mode 100644 index 000000000..153bbf5cd --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2022-1242.txt @@ -0,0 +1,68 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4198580292 +INFO: Loaded 1 modules (35482 inline 8-bit counters): 35482 [0x56483e5ba390, 0x56483e5c2e2a), +INFO: Loaded 1 PC tables (35482 PCs): 35482 [0x56483e5c2e30,0x56483e64d7d0), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-1242 +================================================================= +==1117==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7da7da3e5d90 at pc 0x56483e0f3b6b bp 0x7ffde6407990 sp 0x7ffde6407150 +READ of size 31268 at 0x7da7da3e5d90 thread T0 + #0 0x56483e0f3b6a in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x56483e3a9dc7 in ZSTD_initDDict_internal /src/c-blosc2/internal-complibs/zstd-1.5.6/decompress/zstd_ddict.c:134:9 + #2 0x56483e3a9b49 in ZSTD_createDDict_advanced /src/c-blosc2/internal-complibs/zstd-1.5.6/decompress/zstd_ddict.c:155:39 + #3 0x56483e3aa073 in ZSTD_createDDict /src/c-blosc2/internal-complibs/zstd-1.5.6/decompress/zstd_ddict.c:173:12 + #4 0x56483e15a229 in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:2360:27 + #5 0x56483e14791f in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2912:8 + #6 0x56483e14775d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2938:12 + #7 0x56483e186f7c in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:3749:24 + #8 0x56483e164288 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:1100:17 + #9 0x56483e139d44 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:34:15 + #10 0x56483dfd756d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #11 0x56483dfc22e2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #12 0x56483dfc81b0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #13 0x56483dff3ce2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f47db183082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #15 0x56483dfbb3cd in _start (/out/decompress_frame_fuzzer+0x1203cd) + +0x7da7da3e5d90 is located 0 bytes after 11408-byte region [0x7da7da3e3100,0x7da7da3e5d90) +allocated by thread T0 here: + #0 0x56483e0f5ec4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x56483e506f33 in operator new(unsigned long) cxa_noexception.cpp + #2 0x56483dfc22e2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x56483dfc81b0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x56483dff3ce2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f47db183082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/c-blosc2/internal-complibs/zstd-1.5.6/decompress/zstd_ddict.c:134:9 in ZSTD_initDDict_internal +Shadow bytes around the buggy address: + 0x7da7da3e5b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7da7da3e5b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7da7da3e5c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7da7da3e5c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7da7da3e5d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7da7da3e5d80: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7da7da3e5e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7da7da3e5e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7da7da3e5f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7da7da3e5f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7da7da3e6000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1117==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2022-34.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2022-34.txt new file mode 100644 index 000000000..ed1c92dd0 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2022-34.txt @@ -0,0 +1,69 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4208215767 +INFO: Loaded 1 modules (30589 inline 8-bit counters): 30589 [0x5575c270a9a0, 0x5575c271211d), +INFO: Loaded 1 PC tables (30589 PCs): 30589 [0x5575c2712120,0x5575c27898f0), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-34 +================================================================= +==1085==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7cb12bde074e at pc 0x5575c22b24fb bp 0x7ffed472c970 sp 0x7ffed472c130 +READ of size 16 at 0x7cb12bde074e thread T0 + #0 0x5575c22b24fa in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x5575c236d525 in LZ4_wildCopy32 /src/c-blosc2/internal-complibs/lz4-1.9.3/lz4.c:469:30 + #2 0x5575c236d525 in LZ4_decompress_generic /src/c-blosc2/internal-complibs/lz4-1.9.3/lz4.c:1819:21 + #3 0x5575c236d525 in LZ4_decompress_safe /src/c-blosc2/internal-complibs/lz4-1.9.3/lz4.c:2173:12 + #4 0x5575c231352c in lz4_wrap_decompress /src/c-blosc2/blosc/blosc2.c:424:12 + #5 0x5575c2307162 in blosc_d /src/c-blosc2/blosc/blosc2.c:1722:18 + #6 0x5575c230f232 in serial_blosc /src/c-blosc2/blosc/blosc2.c:1859:16 + #7 0x5575c230333d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2693:12 + #8 0x5575c233ae52 in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:3423:24 + #9 0x5575c231ce08 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:1001:17 + #10 0x5575c22f86d4 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:34:15 + #11 0x5575c2195efd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #12 0x5575c2180c72 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #13 0x5575c2186b40 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #14 0x5575c21b2672 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f912cb2a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #16 0x5575c2179d5d in _start (/out/decompress_frame_fuzzer+0xfed5d) + +0x7cb12bde074e is located 0 bytes after 270-byte region [0x7cb12bde0640,0x7cb12bde074e) +allocated by thread T0 here: + #0 0x5575c22b4854 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x5575c26624f3 in operator new(unsigned long) cxa_noexception.cpp + #2 0x5575c2180c72 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x5575c2186b40 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x5575c21b2672 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f912cb2a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/c-blosc2/internal-complibs/lz4-1.9.3/lz4.c:469:30 in LZ4_wildCopy32 +Shadow bytes around the buggy address: + 0x7cb12bde0480: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x7cb12bde0500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7cb12bde0580: 00 00 00 00 00 00 00 00 00 06 fa fa fa fa fa fa + 0x7cb12bde0600: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x7cb12bde0680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7cb12bde0700: 00 00 00 00 00 00 00 00 00[06]fa fa fa fa fa fa + 0x7cb12bde0780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb12bde0800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb12bde0880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb12bde0900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb12bde0980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1085==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2022-4.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2022-4.txt new file mode 100644 index 000000000..efd082360 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2022-4.txt @@ -0,0 +1,55 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4217896384 +INFO: Loaded 1 modules (30589 inline 8-bit counters): 30589 [0x558e084919a0, 0x558e0849911d), +INFO: Loaded 1 PC tables (30589 PCs): 30589 [0x558e08499120,0x558e085108f0), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-4 +================================================================= +==1085==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges [0x7cc9481e0400,0x7cc9481e04fc) and [0x7cc9481e03a9, 0x7cc9481e04a5) overlap + #0 0x558e08039379 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x558e0825d2e0 in ZSTD_initDDict_internal /src/c-blosc2/internal-complibs/zstd-1.5.2/decompress/zstd_ddict.c:134:9 + #2 0x558e0825d0a2 in ZSTD_createDDict_advanced /src/c-blosc2/internal-complibs/zstd-1.5.2/decompress/zstd_ddict.c:155:39 + #3 0x558e0825d5f3 in ZSTD_createDDict /src/c-blosc2/internal-complibs/zstd-1.5.2/decompress/zstd_ddict.c:173:12 + #4 0x558e08089edc in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:2204:27 + #5 0x558e080895bf in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2667:8 + #6 0x558e0808a33d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2693:12 + #7 0x558e080c1e52 in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:3423:24 + #8 0x558e080a3e08 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:1001:17 + #9 0x558e0807f6d4 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:34:15 + #10 0x558e07f1cefd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #11 0x558e07f07c72 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #12 0x558e07f0db40 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #13 0x558e07f39672 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7fb948f4a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #15 0x558e07f00d5d in _start (/out/decompress_frame_fuzzer+0xfed5d) + +0x7cc9481e0400 is located 0 bytes inside of 252-byte region [0x7cc9481e0400,0x7cc9481e04fc) +allocated by thread T0 here: + #0 0x558e0803b854 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x558e0815a8c0 in ZSTD_customMalloc /src/c-blosc2/internal-complibs/zstd-1.5.2/common/zstd_common.c:60:12 + #2 0x558e0825d291 in ZSTD_initDDict_internal /src/c-blosc2/internal-complibs/zstd-1.5.2/decompress/zstd_ddict.c:130:38 + #3 0x558e0825d0a2 in ZSTD_createDDict_advanced /src/c-blosc2/internal-complibs/zstd-1.5.2/decompress/zstd_ddict.c:155:39 + #4 0x558e0825d5f3 in ZSTD_createDDict /src/c-blosc2/internal-complibs/zstd-1.5.2/decompress/zstd_ddict.c:173:12 + #5 0x558e08089edc in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:2204:27 + #6 0x558e080895bf in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2667:8 + #7 0x558e0808a33d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2693:12 + #8 0x558e080c1e52 in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:3423:24 + #9 0x558e080a3e08 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:1001:17 + #10 0x558e0807f6d4 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:34:15 + #11 0x558e07f1cefd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #12 0x558e07f07c72 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #13 0x558e07f0db40 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #14 0x558e07f39672 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7fb948f4a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +0x7cc9481e03b6 is located 0 bytes after 246-byte region [0x7cc9481e02c0,0x7cc9481e03b6) +allocated by thread T0 here: + #0 0x558e0803b854 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x558e083e94f3 in operator new(unsigned long) cxa_noexception.cpp + #2 0x558e07f07c72 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x558e07f0db40 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x558e07f39672 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7fb948f4a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: memcpy-param-overlap /src/c-blosc2/internal-complibs/zstd-1.5.2/decompress/zstd_ddict.c:134:9 in ZSTD_initDDict_internal +==1085==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2022-486.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2022-486.txt new file mode 100644 index 000000000..618b351f4 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2022-486.txt @@ -0,0 +1,99 @@ +INFO:__main__:Running: docker run --privileged --shm-size=2g --platform linux/amd64 --rm -e HELPER=True -e ARCHITECTURE=x86_64 -v /mnt/nas/linke/c-blosc2/c-blosc2-13fbe91ec93839e2de76b3df9238d6aec70b9449-address:/out -v /tmp/oss-fuzz-testcase-oy0i4g6s/testcase-OSV-2022-486:/testcase -t gcr.io/oss-fuzz-base/base-runner@sha256:83dc2104f6325551cf7b2dd928b63a3545bd283d00c3179827dcd963cff7764b reproduce decompress_frame_fuzzer -runs=10. ++ FUZZER=decompress_frame_fuzzer ++ shift ++ '[' '!' -v TESTCASE ']' ++ TESTCASE=/testcase ++ '[' '!' -f /testcase ']' ++ export RUN_FUZZER_MODE=interactive ++ RUN_FUZZER_MODE=interactive ++ export FUZZING_ENGINE=libfuzzer ++ FUZZING_ENGINE=libfuzzer ++ export SKIP_SEED_CORPUS=1 ++ SKIP_SEED_CORPUS=1 ++ run_fuzzer decompress_frame_fuzzer -runs=10 /testcase +vm.mmap_rnd_bits = 28 +/out/decompress_frame_fuzzer -- -rss_limit_mb=2560 -timeout=25 -runs=10 /testcase < /dev/null +INFO: libFuzzer ignores flags that start with '--' +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1976996461 +INFO: Loaded 1 modules (32774 inline 8-bit counters): 32774 [0x55daf92f4cc0, 0x55daf92fccc6), +INFO: Loaded 1 PC tables (32774 PCs): 32774 [0x55daf92fccc8,0x55daf937cd28), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /testcase +================================================================= +==14==ERROR: AddressSanitizer: heap-use-after-free on address 0x5060000000e0 at pc 0x55daf8ee952d bp 0x7ffef917f590 sp 0x7ffef917f588 +READ of size 1 at 0x5060000000e0 thread T0 +SCARINESS: 40 (1-byte-read-heap-use-after-free) + #0 0x55daf8ee952c in blosc2_get_io_cb /src/c-blosc2/blosc/blosc2.c:3926:18 + #1 0x55daf8f03c4e in get_header_info /src/c-blosc2/blosc/frame.c:366:25 + #2 0x55daf8f0d713 in frame_to_schunk /src/c-blosc2/blosc/frame.c:1594:8 + #3 0x55daf8efc8c2 in blosc2_schunk_from_buffer /src/c-blosc2/blosc/schunk.c:476:27 + #4 0x55daf8ecf879 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:22:27 + #5 0x55daf8d843a0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #6 0x55daf8d6f615 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #7 0x55daf8d750af in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #8 0x55daf8da0352 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fdc1d2ac082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x55daf8d677fd in _start (/out/decompress_frame_fuzzer+0x10e7fd) + +DEDUP_TOKEN: blosc2_get_io_cb--get_header_info--frame_to_schunk +0x5060000000e0 is located 0 bytes inside of 64-byte region [0x5060000000e0,0x506000000120) +freed by thread T0 here: + #0 0x55daf8e8fed6 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x55daf8ee5e68 in blosc_destroy /src/c-blosc2/blosc/blosc2.c:3419:5 + #2 0x55daf8ecfa19 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c + #3 0x55daf8d843a0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #4 0x55daf8d6f615 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #5 0x55daf8d750af in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #6 0x55daf8da0352 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #7 0x7fdc1d2ac082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_free--blosc_destroy--LLVMFuzzerTestOneInput +previously allocated by thread T0 here: + #0 0x55daf8e9016f in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:68:3 + #1 0x55daf8ee93c4 in _blosc2_register_io_cb /src/c-blosc2/blosc/blosc2.c:3902:26 + #2 0x55daf8ee93c4 in blosc2_get_io_cb /src/c-blosc2/blosc/blosc2.c:3931:9 + #3 0x55daf8f03c4e in get_header_info /src/c-blosc2/blosc/frame.c:366:25 + #4 0x55daf8f0d713 in frame_to_schunk /src/c-blosc2/blosc/frame.c:1594:8 + #5 0x55daf8efc8c2 in blosc2_schunk_from_buffer /src/c-blosc2/blosc/schunk.c:476:27 + #6 0x55daf8ecf879 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:22:27 + #7 0x55daf8d843a0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #8 0x55daf8d6f615 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #9 0x55daf8d750af in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #10 0x55daf8da0352 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fdc1d2ac082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--_blosc2_register_io_cb--blosc2_get_io_cb +SUMMARY: AddressSanitizer: heap-use-after-free /src/c-blosc2/blosc/blosc2.c:3926:18 in blosc2_get_io_cb +Shadow bytes around the buggy address: + 0x505ffffffe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x505ffffffe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x505fffffff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x505fffffff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x506000000000: fa fa fa fa 00 00 00 00 00 00 00 06 fa fa fa fa +=>0x506000000080: fd fd fd fd fd fd fd fd fa fa fa fa[fd]fd fd fd + 0x506000000100: fd fd fd fd fa fa fa fa 00 00 00 00 00 00 00 00 + 0x506000000180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x506000000200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x506000000280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x506000000300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==14==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2022-511.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2022-511.txt new file mode 100644 index 000000000..feaab6ec8 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2022-511.txt @@ -0,0 +1,68 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4259127164 +INFO: Loaded 1 modules (51106 inline 8-bit counters): 51106 [0x55d8924e9940, 0x55d8924f60e2), +INFO: Loaded 1 PC tables (51106 PCs): 51106 [0x55d8924f60e8,0x55d8925bdb08), +/out/decompress_frame_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-511 +================================================================= +==3506==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7e92773ed017 at pc 0x55d891e514fb bp 0x7ffea971be80 sp 0x7ffea971b640 +READ of size 61951 at 0x7e92773ed017 thread T0 + #0 0x55d891e514fa in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x55d892296eba in ZSTD_initDDict_internal /src/c-blosc2/internal-complibs/zstd-1.5.0/decompress/zstd_ddict.c:134:9 + #2 0x55d892296eba in ZSTD_createDDict_advanced /src/c-blosc2/internal-complibs/zstd-1.5.0/decompress/zstd_ddict.c:155:39 + #3 0x55d892296eba in ZSTD_createDDict /src/c-blosc2/internal-complibs/zstd-1.5.0/decompress/zstd_ddict.c:173:12 + #4 0x55d891ea4d9c in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:2177:27 + #5 0x55d891ea5345 in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2657:8 + #6 0x55d891ea5345 in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2683:12 + #7 0x55d891ee2882 in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:3422:24 + #8 0x55d891ec208a in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:1001:17 + #9 0x55d891e976e5 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:37:15 + #10 0x55d891d34efd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #11 0x55d891d1fc72 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #12 0x55d891d25b40 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #13 0x55d891d51672 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7fe27814e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #15 0x55d891d18d5d in _start (/out/decompress_frame_fuzzer+0x174d5d) + +0x7e92773ed017 is located 0 bytes after 24087-byte region [0x7e92773e7200,0x7e92773ed017) +allocated by thread T0 here: + #0 0x55d891e53854 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55d892450a03 in operator new(unsigned long) cxa_noexception.cpp + #2 0x55d891d1fc72 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x55d891d25b40 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x55d891d51672 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7fe27814e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/c-blosc2/internal-complibs/zstd-1.5.0/decompress/zstd_ddict.c:134:9 in ZSTD_initDDict_internal +Shadow bytes around the buggy address: + 0x7e92773ecd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7e92773ece00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7e92773ece80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7e92773ecf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7e92773ecf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7e92773ed000: 00 00[07]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e92773ed080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e92773ed100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e92773ed180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e92773ed200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e92773ed280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==3506==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2023-51.txt b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2023-51.txt new file mode 100644 index 000000000..f1b63ba15 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/OSV-2023-51.txt @@ -0,0 +1,85 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4248572193 +INFO: Loaded 1 modules (35482 inline 8-bit counters): 35482 [0x5620dd7b1390, 0x5620dd7b9e2a), +INFO: Loaded 1 PC tables (35482 PCs): 35482 [0x5620dd7b9e30,0x5620dd8447d0), +/out/decompress_frame_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-51 +================================================================= +==1117==ERROR: AddressSanitizer: heap-use-after-free on address 0x7e83a83edcc8 at pc 0x5620dd5a100c bp 0x7ffcc39f5100 sp 0x7ffcc39f50f8 +READ of size 8 at 0x7e83a83edcc8 thread T0 + #0 0x5620dd5a100b in ZSTD_freeDDict /src/c-blosc2/internal-complibs/zstd-1.5.6/decompress/zstd_ddict.c:215:44 + #1 0x5620dd33e166 in blosc2_free_ctx /src/c-blosc2/blosc/blosc2.c:4182:5 + #2 0x5620dd35ccf4 in blosc2_schunk_free /src/c-blosc2/blosc/schunk.c:496:5 + #3 0x5620dd330de4 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c + #4 0x5620dd1ce56d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x5620dd1b92e2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x5620dd1bf1b0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x5620dd1eace2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fd3a9161082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x5620dd1b23cd in _start (/out/decompress_frame_fuzzer+0x1203cd) + +0x7e83a83edcc8 is located 27336 bytes inside of 27352-byte region [0x7e83a83e7200,0x7e83a83edcd8) +freed by thread T0 here: + #0 0x5620dd2ecc26 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3 + #1 0x5620dd5a0fe5 in ZSTD_freeDDict /src/c-blosc2/internal-complibs/zstd-1.5.6/decompress/zstd_ddict.c:217:9 + #2 0x5620dd350f70 in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:2339:7 + #3 0x5620dd33e91f in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2912:8 + #4 0x5620dd33e75d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2938:12 + #5 0x5620dd37df7c in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:3749:24 + #6 0x5620dd35b288 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:1100:17 + #7 0x5620dd330d44 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:34:15 + #8 0x5620dd1ce56d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #9 0x5620dd1b92e2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #10 0x5620dd1bf1b0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #11 0x5620dd1eace2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7fd3a9161082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +previously allocated by thread T0 here: + #0 0x5620dd2ecec4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x5620dd5a0b13 in ZSTD_createDDict_advanced /src/c-blosc2/internal-complibs/zstd-1.5.6/decompress/zstd_ddict.c:152:49 + #2 0x5620dd5a1073 in ZSTD_createDDict /src/c-blosc2/internal-complibs/zstd-1.5.6/decompress/zstd_ddict.c:173:12 + #3 0x5620dd351229 in initialize_context_decompression /src/c-blosc2/blosc/blosc2.c:2360:27 + #4 0x5620dd33e91f in blosc_run_decompression_with_context /src/c-blosc2/blosc/blosc2.c:2912:8 + #5 0x5620dd33e75d in blosc2_decompress_ctx /src/c-blosc2/blosc/blosc2.c:2938:12 + #6 0x5620dd37df7c in frame_decompress_chunk /src/c-blosc2/blosc/frame.c:3749:24 + #7 0x5620dd35b288 in blosc2_schunk_decompress_chunk /src/c-blosc2/blosc/schunk.c:1100:17 + #8 0x5620dd330d44 in LLVMFuzzerTestOneInput /src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c:34:15 + #9 0x5620dd1ce56d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #10 0x5620dd1b92e2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #11 0x5620dd1bf1b0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #12 0x5620dd1eace2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fd3a9161082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/c-blosc2/internal-complibs/zstd-1.5.6/decompress/zstd_ddict.c:215:44 in ZSTD_freeDDict +Shadow bytes around the buggy address: + 0x7e83a83eda00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e83a83eda80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e83a83edb00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e83a83edb80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e83a83edc00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x7e83a83edc80: fd fd fd fd fd fd fd fd fd[fd]fd fa fa fa fa fa + 0x7e83a83edd00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e83a83edd80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e83a83ede00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e83a83ede80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e83a83edf00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1117==ABORTING diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/collect_crash_builds.csv b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/collect_crash_builds.csv new file mode 100644 index 000000000..efd5b8b74 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/original-crashes/collect_crash_builds.csv @@ -0,0 +1,16 @@ +target,commit_id,oss_fuzz_commit,sanitizer +c-blosc2,79e921d904d46fc9edc292e02a48f1aa54567a7d,dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b,address +c-blosc2,3055a0,dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b,address +c-blosc2,0e8bdfce,dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b,address +c-blosc2,e362bb0b,dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b,address +c-blosc2,60b79c4c,dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b,address +c-blosc2,c91ed64c,dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b,address +c-blosc2,fdfeb753,dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b,address +c-blosc2,49357bd0,dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b,address +c-blosc2,5eff30b8,dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b,address +c-blosc2,1a42fcd4,dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b,address +c-blosc2,77b7dfd4,dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b,address +c-blosc2,886d4c9b,dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b,address +c-blosc2,13fbe91e,dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b,address +c-blosc2,26d05bff,d64b3f05953dfa943b62b81e797034dc91a58e14,address +c-blosc2,abb0faba,dbf359cf9f0795770d391a4a4bf6b4c9bb88ad5b,address diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/patches/combined.diff b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/patches/combined.diff new file mode 100755 index 000000000..a8aadb13e --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/patches/combined.diff @@ -0,0 +1,873 @@ +diff --git a/blosc/CMakeLists.txt b/blosc/CMakeLists.txt +index 21ead9ee..10dc5b8c 100644 +--- a/blosc/CMakeLists.txt ++++ b/blosc/CMakeLists.txt +@@ -52,7 +52,7 @@ include_directories(${BLOSC_INCLUDE_DIRS}) + # library sources + set(SOURCES blosc2.c blosc2-common.h blosclz.c fastcopy.c fastcopy.h schunk.c frame.c btune.c btune.h + context.h delta.c delta.h shuffle-generic.c bitshuffle-generic.c trunc-prec.c trunc-prec.h +- timestamp.c sframe.c directories.c) ++ timestamp.c sframe.c directories.c ${PROJECT_SOURCE_DIR}/__bug_dispatch.c) + if(NOT CMAKE_SYSTEM_PROCESSOR STREQUAL arm64) + if(COMPILER_SUPPORT_SSE2) + message(STATUS "Adding run-time support for SSE2") +diff --git a/blosc/blosc2.c b/blosc/blosc2.c +index b30e9f05..bf129ed5 100644 +--- a/blosc/blosc2.c ++++ b/blosc/blosc2.c +@@ -20,6 +20,7 @@ + #include "blosc-private.h" + #include "blosc2-common.h" + #include "frame.h" ++#include "../__bug_dispatch.h" + + + #if defined(USING_CMAKE) +@@ -92,7 +93,14 @@ static int g_nthreads = 1; + static int32_t g_force_blocksize = 0; + static int g_initlib = 0; + static blosc2_schunk* g_schunk = NULL; /* the pointer to super-chunk */ ++static blosc2_io_cb *g_io[256] = {0}; ++static uint64_t g_nio = 0; + ++extern volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES] __attribute__((weak)); ++ ++static bool bug_dispatch_1_4_enabled(void) { ++ return __bug_dispatch != NULL && (__bug_dispatch[1] & (1 << 4)); ++} + + // Forward declarations + +@@ -684,17 +692,39 @@ int blosc_read_header(const uint8_t* src, int32_t srcsize, bool extended_header, + header->cbytes = bswap32_(header->cbytes); + } + +- if (header->version > BLOSC_VERSION_FORMAT) { +- /* Version from future */ +- return BLOSC2_ERROR_VERSION_SUPPORT; ++ if (__bug_dispatch[1] & (1 << 7)) { ++ if (header->version > BLOSC_VERSION_FORMAT + 1) { ++ /* Version from future */ ++ return BLOSC2_ERROR_VERSION_SUPPORT; ++ } ++ } ++ else { ++ if (header->version > BLOSC_VERSION_FORMAT) { ++ /* Version from future */ ++ return BLOSC2_ERROR_VERSION_SUPPORT; ++ } + } + if (header->cbytes < BLOSC_MIN_HEADER_LENGTH) { + BLOSC_TRACE_ERROR("`cbytes` is too small to read min header."); + return BLOSC2_ERROR_INVALID_HEADER; + } +- if (header->blocksize <= 0 || header->blocksize > header->nbytes) { +- BLOSC_TRACE_ERROR("`blocksize` is zero or greater than uncompressed size"); +- return BLOSC2_ERROR_INVALID_HEADER; ++ if (bug_dispatch_1_4_enabled()) { ++ if (header->blocksize <= 0 || (header->nbytes > 0 && (header->blocksize > header->nbytes))) { ++ BLOSC_TRACE_ERROR("`blocksize` is zero or greater than uncompressed size"); ++ return BLOSC2_ERROR_INVALID_HEADER; ++ } ++ } ++ else if (__bug_dispatch[1] & (1 << 7)) { ++ if (header->blocksize <= 0 || (header->nbytes > 0 && (header->blocksize > header->nbytes))) { ++ BLOSC_TRACE_ERROR("`blocksize` is zero or greater than uncompressed size"); ++ return BLOSC2_ERROR_INVALID_HEADER; ++ } ++ } ++ else { ++ if (header->blocksize <= 0 || header->blocksize > header->nbytes) { ++ BLOSC_TRACE_ERROR("`blocksize` is zero or greater than uncompressed size"); ++ return BLOSC2_ERROR_INVALID_HEADER; ++ } + } + if (header->typesize <= 0 || header->typesize > BLOSC_MAX_TYPESIZE) { + BLOSC_TRACE_ERROR("`typesize` is zero or greater than max allowed."); +@@ -1209,6 +1239,21 @@ static int blosc_d( + int32_t compformat = (context->header_flags & (uint8_t)0xe0) >> 5u; + int dont_split = (context->header_flags & (uint8_t)0x10) >> 4u; + int memcpyed = context->header_flags & (uint8_t)BLOSC_MEMCPYED; ++ int32_t runlen_type; ++ if (__bug_dispatch[1] & (1 << 3)) { ++ runlen_type = (context->blosc2_flags >> 4) & BLOSC2_RUNLEN_MASK; ++ if (runlen_type != 0) { ++ memcpyed = true; ++ } ++ } ++ else { ++ runlen_type = 0; ++ } ++ if (__bug_dispatch[1] & (1 << 7)) { ++ if (!context->do_compress && ((context->blosc2_flags >> 4) & 0x7)) { ++ memcpyed = 1; ++ } ++ } + int32_t chunk_nbytes; + int32_t chunk_cbytes; + int nstreams; +@@ -1238,8 +1283,16 @@ static int blosc_d( + context->src = src; + } + +- bool is_lazy = ((context->header_overhead == BLOSC_EXTENDED_HEADER_LENGTH) && +- (context->blosc2_flags & 0x08u)); ++ bool is_lazy; ++ if (__bug_dispatch[1] & (1 << 7)) { ++ int _special_type = (context->blosc2_flags >> 4) & 0x7; ++ is_lazy = ((context->header_overhead == BLOSC_EXTENDED_HEADER_LENGTH) && ++ (context->blosc2_flags & 0x08u) && !_special_type); ++ } ++ else { ++ is_lazy = ((context->header_overhead == BLOSC_EXTENDED_HEADER_LENGTH) && ++ (context->blosc2_flags & 0x08u)); ++ } + if (is_lazy) { + // The chunk is on disk, so just lazily load the block + if (context->schunk == NULL) { +@@ -1292,19 +1345,94 @@ static int blosc_d( + + // If the chunk is memcpyed, we just have to copy the block to dest and return + if (memcpyed) { +- if (chunk_nbytes + context->header_overhead != chunk_cbytes) { +- return BLOSC2_ERROR_WRITE_BUFFER; +- } +- int bsize_ = leftoverblock ? chunk_nbytes % context->blocksize : bsize; +- if (chunk_cbytes < context->header_overhead + (nblock * context->blocksize) + bsize_) { +- /* Not enough input to copy block */ +- return BLOSC2_ERROR_READ_BUFFER; ++ if (__bug_dispatch[1] & (1 << 7)) { ++ int special_type = (context->blosc2_flags >> 4) & 0x7; ++ int bsize_ = leftoverblock ? chunk_nbytes % context->blocksize : bsize; ++ if (!special_type) { ++ if (__bug_dispatch[1] & (1 << 3)) { ++ if (!bug_dispatch_1_4_enabled()) { ++ if (runlen_type == 0 && chunk_nbytes + context->header_overhead != chunk_cbytes) { ++ return BLOSC2_ERROR_WRITE_BUFFER; ++ } ++ } ++ } ++ else { ++ if (!bug_dispatch_1_4_enabled()) { ++ if (chunk_nbytes + context->header_overhead != chunk_cbytes) { ++ return BLOSC2_ERROR_WRITE_BUFFER; ++ } ++ } ++ } ++ if (__bug_dispatch[1] & (1 << 3)) { ++ if (runlen_type == 0 && ++ chunk_cbytes < context->header_overhead + (nblock * context->blocksize) + bsize_) { ++ /* Not enough input to copy block */ ++ return BLOSC2_ERROR_READ_BUFFER; ++ } ++ } ++ else { ++ if (chunk_cbytes < context->header_overhead + (nblock * context->blocksize) + bsize_) { ++ /* Not enough input to copy block */ ++ return BLOSC2_ERROR_READ_BUFFER; ++ } ++ } ++ if (!is_lazy) { ++ src += context->header_overhead + nblock * context->blocksize; ++ } ++ memcpy(dest + dest_offset, src, bsize_); ++ } ++ else { ++ // Handle special values ++ if (special_type == 3) { ++ // VALUE_RUNLEN: fill with repeated value from header ++ for (int i = 0; i < bsize_; i += context->typesize) { ++ int len = context->typesize; ++ if (len > bsize_ - i) len = bsize_ - i; ++ memcpy(dest + dest_offset + i, context->src + context->header_overhead, len); ++ } ++ } ++ else { ++ // ZERO/NAN/UNINIT: just fill with zeros ++ memset(dest + dest_offset, 0, bsize_); ++ } ++ } ++ return bsize_; + } +- if (!is_lazy) { +- src += context->header_overhead + nblock * context->blocksize; ++ else { ++ if (__bug_dispatch[1] & (1 << 3)) { ++ if (!bug_dispatch_1_4_enabled()) { ++ if (runlen_type == 0 && chunk_nbytes + context->header_overhead != chunk_cbytes) { ++ return BLOSC2_ERROR_WRITE_BUFFER; ++ } ++ } ++ } ++ else { ++ if (!bug_dispatch_1_4_enabled()) { ++ if (chunk_nbytes + context->header_overhead != chunk_cbytes) { ++ return BLOSC2_ERROR_WRITE_BUFFER; ++ } ++ } ++ } ++ int bsize_ = leftoverblock ? chunk_nbytes % context->blocksize : bsize; ++ if (__bug_dispatch[1] & (1 << 3)) { ++ if (runlen_type == 0 && ++ chunk_cbytes < context->header_overhead + (nblock * context->blocksize) + bsize_) { ++ /* Not enough input to copy block */ ++ return BLOSC2_ERROR_READ_BUFFER; ++ } ++ } ++ else { ++ if (chunk_cbytes < context->header_overhead + (nblock * context->blocksize) + bsize_) { ++ /* Not enough input to copy block */ ++ return BLOSC2_ERROR_READ_BUFFER; ++ } ++ } ++ if (!is_lazy) { ++ src += context->header_overhead + nblock * context->blocksize; ++ } ++ memcpy(dest + dest_offset, src, bsize_); ++ return bsize_; + } +- memcpy(dest + dest_offset, src, bsize_); +- return bsize_; + } + + if (!is_lazy && (src_offset <= 0 || src_offset >= srcsize)) { +@@ -1466,6 +1594,11 @@ static int serial_blosc(struct thread_context* thread_context) { + uint8_t* tmp2 = thread_context->tmp2; + int dict_training = context->use_dict && (context->dict_cdict == NULL); + bool memcpyed = context->header_flags & (uint8_t)BLOSC_MEMCPYED; ++ if (__bug_dispatch[1] & (1 << 7)) { ++ if (!context->do_compress && ((context->blosc2_flags >> 4) & 0x7)) { ++ memcpyed = true; ++ } ++ } + + for (j = 0; j < context->nblocks; j++) { + if (context->do_compress && !memcpyed && !dict_training) { +@@ -1775,11 +1908,20 @@ static int initialize_context_decompression(blosc2_context* context, blosc_heade + } + + context->bstarts = (int32_t*)(context->src + context->header_overhead); +- if (context->header_flags & (uint8_t)BLOSC_MEMCPYED) { +- /* If chunk is a memcpy, bstarts does not exist */ ++ if (__bug_dispatch[1] & (1 << 7)) { ++ int special_type = (context->blosc2_flags >> 4) & 0x7; + bstarts_end = context->header_overhead; +- } else { +- bstarts_end = context->header_overhead + (context->nblocks * sizeof(int32_t)); ++ if (!special_type && !(context->header_flags & (uint8_t)BLOSC_MEMCPYED)) { ++ bstarts_end = context->header_overhead + (context->nblocks * sizeof(int32_t)); ++ } ++ } ++ else { ++ if (context->header_flags & (uint8_t)BLOSC_MEMCPYED) { ++ /* If chunk is a memcpy, bstarts does not exist */ ++ bstarts_end = context->header_overhead; ++ } else { ++ bstarts_end = context->header_overhead + (context->nblocks * sizeof(int32_t)); ++ } + } + + if (srcsize < bstarts_end) { +@@ -2345,9 +2487,11 @@ int blosc_run_decompression_with_context(blosc2_context* context, const void* sr + if (rc < 0) { + return rc; + } +- if (rc > 0) { +- // This means that we have found a special value and we are done. +- return rc; ++ if (!(__bug_dispatch[1] & (1 << 7))) { ++ if (rc > 0) { ++ // This means that we have found a special value and we are done. ++ return rc; ++ } + } + + rc = initialize_context_decompression(context, &header, src, srcsize, dest, destsize); +@@ -2378,6 +2522,16 @@ int blosc2_decompress_ctx(blosc2_context* context, const void* src, int32_t srcs + + result = blosc_run_decompression_with_context(context, src, srcsize, dest, destsize); + ++#if defined(HAVE_ZSTD) ++ if (__bug_dispatch[0] & (1 << 3)) { ++ if (result > 0 && context->use_dict && context->dict_ddict != NULL) { ++ ZSTD_freeDDict(context->dict_ddict); ++ } ++ } else { ++ /* Original behavior: leave dict_ddict untouched here. */ ++ } ++#endif ++ + // Reset a possible block_maskout + if (context->block_maskout != NULL) { + free(context->block_maskout); +@@ -2450,6 +2604,7 @@ int _blosc_getitem(blosc2_context* context, blosc_header* header, const void* sr + int32_t cbytes; + int32_t startb, stopb; + int32_t stop = start + nitems; ++ int32_t runlen_type; + int j, rc; + + if (nitems == 0) { +@@ -2461,14 +2616,33 @@ int _blosc_getitem(blosc2_context* context, blosc_header* header, const void* sr + return BLOSC2_ERROR_WRITE_BUFFER; + } + +- // Is that a chunk with a special value (runlen)? +- rc = handle_runlen(header, _src, dest, nitems * header->typesize); +- if (rc < 0) { +- return rc; ++ if (__bug_dispatch[1] & (1 << 3)) { ++ runlen_type = (header->blosc2_flags >> 4) & BLOSC2_RUNLEN_MASK; ++ if (runlen_type != 0) { ++ memcpy(dest, _src + context->header_overhead + 4096, ++ (unsigned int)(nitems * header->typesize)); ++ return nitems * header->typesize; ++ } + } +- if (rc > 0) { +- // This means that we have found a special value and we are done. +- return rc; ++ else { ++ runlen_type = 0; ++ // Is that a chunk with a special value (runlen)? ++ rc = handle_runlen(header, _src, dest, nitems * header->typesize); ++ if (rc < 0) { ++ return rc; ++ } ++ if (rc > 0) { ++ // This means that we have found a special value and we are done. ++ return rc; ++ } ++ } ++ ++ if (__bug_dispatch[1] & (1 << 5)) { ++ if (header->flags & BLOSC_MEMCPYED) { ++ memcpy(dest, _src + context->header_overhead + start * header->typesize, ++ nitems * header->typesize); ++ return nitems * header->typesize; ++ } + } + + context->bstarts = (int32_t*)(_src + context->header_overhead); +@@ -2484,9 +2658,17 @@ int _blosc_getitem(blosc2_context* context, blosc_header* header, const void* sr + return BLOSC2_ERROR_INVALID_PARAM; + } + +- if (_src + srcsize < (uint8_t *)(context->bstarts + context->nblocks)) { +- BLOSC_TRACE_ERROR("`bstarts` out of bounds."); +- return BLOSC2_ERROR_READ_BUFFER; ++ if (__bug_dispatch[1] & (1 << 3)) { ++ if (runlen_type == 0 && _src + srcsize < (uint8_t *)(context->bstarts + context->nblocks)) { ++ BLOSC_TRACE_ERROR("`bstarts` out of bounds."); ++ return BLOSC2_ERROR_READ_BUFFER; ++ } ++ } ++ else { ++ if (_src + srcsize < (uint8_t *)(context->bstarts + context->nblocks)) { ++ BLOSC_TRACE_ERROR("`bstarts` out of bounds."); ++ return BLOSC2_ERROR_READ_BUFFER; ++ } + } + + ebsize = header->blocksize + header->typesize * (signed)sizeof(int32_t); +@@ -2537,8 +2719,19 @@ int _blosc_getitem(blosc2_context* context, blosc_header* header, const void* sr + uint8_t* tmp2 = get_single_block ? dest : scontext->tmp2; + bool memcpyed = header->flags & (uint8_t)BLOSC_MEMCPYED; + // If memcpyed we don't have a bstarts section (because it is not needed) +- int32_t src_offset = memcpyed ? +- context->header_overhead + j * bsize : sw32_(context->bstarts + j); ++ int32_t src_offset; ++ if (__bug_dispatch[1] & (1 << 3)) { ++ src_offset = memcpyed ? ++ context->header_overhead + j * bsize : sw32_(context->bstarts + j); ++ if (runlen_type != 0) { ++ memcpyed = true; ++ src_offset = context->header_overhead + j * bsize; ++ } ++ } ++ else { ++ src_offset = memcpyed ? ++ context->header_overhead + j * bsize : sw32_(context->bstarts + j); ++ } + + cbytes = blosc_d(context->serial_context, bsize, leftoverblock, + src, srcsize, src_offset, j, +@@ -3185,6 +3378,40 @@ void blosc_destroy(void) { + blosc2_free_ctx(g_global_context); + + pthread_mutex_destroy(&global_comp_mutex); ++ ++ if (__bug_dispatch[1] & (1 << 6)) { ++ free(g_io[0]); ++ } ++} ++ ++ ++static int blosc2_register_io_cb(const blosc2_io_cb *io) { ++ if (__bug_dispatch[1] & (1 << 6)) { ++ blosc2_io_cb *io_new = malloc(sizeof(blosc2_io_cb)); ++ memcpy(io_new, io, sizeof(blosc2_io_cb)); ++ g_io[g_nio++] = io_new; ++ } ++ ++ return BLOSC2_ERROR_SUCCESS; ++} ++ ++ ++blosc2_io_cb *blosc2_get_io_cb(uint8_t id) { ++ if (__bug_dispatch[1] & (1 << 6)) { ++ static const blosc2_io_cb default_io = {.id = BLOSC2_IO_FILESYSTEM}; ++ ++ for (int i = 0; i < g_nio; ++i) { ++ if (g_io[i]->id == id) { ++ return g_io[i]; ++ } ++ } ++ if (id == BLOSC2_IO_FILESYSTEM) { ++ blosc2_register_io_cb(&default_io); ++ return blosc2_get_io_cb(id); ++ } ++ } ++ ++ return NULL; + } + + +diff --git a/blosc/blosc2.h b/blosc/blosc2.h +index 889840c6..1a10357e 100644 +--- a/blosc/blosc2.h ++++ b/blosc/blosc2.h +@@ -710,6 +710,28 @@ BLOSC_EXPORT void blosc_cbuffer_versions(const void* cbuffer, int* version, + BLOSC_EXPORT const char* blosc_cbuffer_complib(const void* cbuffer); + + ++/********************************************************************* ++ Structures and functions related with user-defined input/output. ++*********************************************************************/ ++ ++enum { ++ BLOSC2_IO_FILESYSTEM = 0, ++}; ++ ++typedef struct { ++ uint8_t id; ++ void *open; ++ void *close; ++ void *tell; ++ void *seek; ++ void *write; ++ void *read; ++ void *truncate; ++} blosc2_io_cb; ++ ++BLOSC_EXPORT blosc2_io_cb *blosc2_get_io_cb(uint8_t id); ++ ++ + /********************************************************************* + Structures and functions related with contexts. + *********************************************************************/ +diff --git a/blosc/frame.c b/blosc/frame.c +index 3ac33b57..fec5cc49 100644 +--- a/blosc/frame.c ++++ b/blosc/frame.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include "../__bug_dispatch.h" + #include "blosc2.h" + #include "blosc-private.h" + #include "context.h" +@@ -369,6 +370,10 @@ int get_header_info(blosc2_frame_s *frame, int32_t *header_len, int64_t *frame_l + uint8_t* framep = frame->cframe; + uint8_t header[FRAME_HEADER_MINLEN]; + ++ if (__bug_dispatch[1] & (1 << 6)) { ++ blosc2_get_io_cb(BLOSC2_IO_FILESYSTEM); ++ } ++ + if (frame->len <= 0) { + return BLOSC2_ERROR_READ_BUFFER; + } +@@ -967,39 +972,90 @@ uint8_t* get_coffsets(blosc2_frame_s *frame, int32_t header_len, int64_t cbytes, + + if (frame->coffsets != NULL) { + if (off_cbytes != NULL) { +- rc = blosc2_cbuffer_sizes(frame->coffsets, NULL, &chunk_cbytes, NULL); +- if (rc < 0) { +- return NULL; ++ if (__bug_dispatch[1] & (1 << 2)) { ++ *off_cbytes = *(int32_t *) (frame->coffsets + BLOSC2_CHUNK_CBYTES); ++ } ++ else { ++ rc = blosc2_cbuffer_sizes(frame->coffsets, NULL, &chunk_cbytes, NULL); ++ if (rc < 0) { ++ return NULL; ++ } ++ *off_cbytes = (int32_t)chunk_cbytes; + } +- *off_cbytes = (int32_t)chunk_cbytes; + } + return frame->coffsets; + } + if (frame->cframe != NULL) { +- int64_t off_pos = header_len; +- if (cbytes < INT64_MAX - header_len) { +- off_pos += cbytes; +- } +- // Check that there is enough room to read Blosc header +- if (off_pos < 0 || off_pos > INT64_MAX - BLOSC_EXTENDED_HEADER_LENGTH || +- off_pos + BLOSC_EXTENDED_HEADER_LENGTH > frame->len) { +- BLOSC_TRACE_ERROR("Cannot read the offsets outside of frame boundary."); +- return NULL; +- } +- // For in-memory frames, the coffset is just one pointer away +- uint8_t* off_start = frame->cframe + off_pos; +- if (off_cbytes != NULL) { +- rc = blosc2_cbuffer_sizes(off_start, NULL, &chunk_cbytes, NULL); +- if (rc < 0) { ++ int64_t off_pos; ++ if (__bug_dispatch[1] & (1 << 0)) { ++ off_pos = header_len + cbytes; ++ // Check that there is enough room to read Blosc header ++ if (off_pos < 0 || off_pos + BLOSC_EXTENDED_HEADER_LENGTH > frame->len) { ++ BLOSC_TRACE_ERROR("Cannot read the offsets outside of frame boundary."); + return NULL; + } +- *off_cbytes = (int32_t)chunk_cbytes; +- if (*off_cbytes < 0 || *off_cbytes > frame->len) { +- BLOSC_TRACE_ERROR("Cannot read the cbytes outside of frame boundary."); +- return NULL; ++ } ++ else { ++ off_pos = header_len; ++ if (cbytes < INT64_MAX - header_len) { ++ off_pos += cbytes; ++ } ++ // Check that there is enough room to read Blosc header ++ if (__bug_dispatch[1] & (1 << 1)) { ++ if (off_pos < 0 || off_pos + BLOSC_EXTENDED_HEADER_LENGTH < 0 || ++ off_pos + BLOSC_EXTENDED_HEADER_LENGTH > frame->len) { ++ BLOSC_TRACE_ERROR("Cannot read the offsets outside of frame boundary."); ++ return NULL; ++ } ++ } ++ else if (__bug_dispatch[0] & (1 << 6)) { ++ if (off_pos < 0 || off_pos > frame->len) { ++ BLOSC_TRACE_ERROR("Cannot read the offsets outside of frame boundary."); ++ return NULL; ++ } ++ } ++ else { ++ if (off_pos < 0 || off_pos > INT64_MAX - BLOSC_EXTENDED_HEADER_LENGTH || ++ off_pos + BLOSC_EXTENDED_HEADER_LENGTH > frame->len) { ++ BLOSC_TRACE_ERROR("Cannot read the offsets outside of frame boundary."); ++ return NULL; ++ } ++ } ++ } ++ if (__bug_dispatch[0] & (1 << 4)) { ++ // Materialize the in-memory offsets chunk into its own buffer. ++ uint8_t* off_start = frame->cframe + off_pos; ++ if (frame->coffsets == NULL) { ++ chunk_cbytes = *(int32_t*)(off_start + BLOSC2_CHUNK_CBYTES); ++ frame->coffsets = malloc((size_t)chunk_cbytes); ++ memcpy(frame->coffsets, off_start, (size_t)chunk_cbytes); ++ } ++ if (off_cbytes != NULL) { ++ *off_cbytes = *(int32_t*)(frame->coffsets + BLOSC2_CHUNK_CBYTES); + } ++ return frame->coffsets; ++ } ++ else { ++ // For in-memory frames, the coffset is just one pointer away ++ uint8_t* off_start = frame->cframe + off_pos; ++ if (off_cbytes != NULL) { ++ if (__bug_dispatch[1] & (1 << 2)) { ++ *off_cbytes = *(int32_t*) (off_start + BLOSC2_CHUNK_CBYTES); ++ } ++ else { ++ rc = blosc2_cbuffer_sizes(off_start, NULL, &chunk_cbytes, NULL); ++ if (rc < 0) { ++ return NULL; ++ } ++ *off_cbytes = (int32_t)chunk_cbytes; ++ if (*off_cbytes < 0 || *off_cbytes > frame->len) { ++ BLOSC_TRACE_ERROR("Cannot read the cbytes outside of frame boundary."); ++ return NULL; ++ } ++ } ++ } ++ return off_start; + } +- return off_start; + } + + int64_t trailer_offset = get_trailer_offset(frame, header_len, true); +@@ -1198,9 +1254,11 @@ static int get_meta_from_header(blosc2_frame_s* frame, blosc2_schunk* schunk, ui + } + from_big(&offset, idxp, sizeof(offset)); + idxp += 4; +- if (offset < 0 || offset >= header_len) { +- // Offset is less than zero or exceeds header length +- return BLOSC2_ERROR_DATA; ++ if (!(__bug_dispatch[0] & (1 << 2))) { ++ if (offset < 0 || offset >= header_len) { ++ // Offset is less than zero or exceeds header length ++ return BLOSC2_ERROR_DATA; ++ } + } + // Go to offset and see if we have the correct marker + uint8_t* content_marker = header + offset; +@@ -1215,8 +1273,10 @@ static int get_meta_from_header(blosc2_frame_s* frame, blosc2_schunk* schunk, ui + return BLOSC2_ERROR_READ_BUFFER; + } + from_big(&content_len, content_marker + 1, sizeof(content_len)); +- if (content_len < 0) { +- return BLOSC2_ERROR_DATA; ++ if (!(__bug_dispatch[0] & (1u << 7))) { ++ if (content_len < 0) { ++ return BLOSC2_ERROR_DATA; ++ } + } + metalayer->content_len = content_len; + +@@ -1386,8 +1446,10 @@ static int get_vlmeta_from_trailer(blosc2_frame_s* frame, blosc2_schunk* schunk, + + // Finally, read the content + trailer_pos += content_len; +- if (trailer_len < trailer_pos) { +- return BLOSC2_ERROR_READ_BUFFER; ++ if (!(__bug_dispatch[0] & (1 << 5))) { ++ if (trailer_len < trailer_pos) { ++ return BLOSC2_ERROR_READ_BUFFER; ++ } + } + char* content = malloc((size_t)content_len); + memcpy(content, content_marker + 1 + 4, (size_t)content_len); +@@ -1415,9 +1477,11 @@ int frame_get_vlmetalayers(blosc2_frame_s* frame, blosc2_schunk* schunk) { + int64_t trailer_offset = get_trailer_offset(frame, header_len, nbytes > 0); + int32_t trailer_len = frame->trailer_len; + +- if (trailer_offset < BLOSC_EXTENDED_HEADER_LENGTH || trailer_offset + trailer_len > frame->len) { +- BLOSC_TRACE_ERROR("Cannot access the trailer out of the frame."); +- return BLOSC2_ERROR_READ_BUFFER; ++ if (!(__bug_dispatch[0] & (1 << 0))) { ++ if (trailer_offset < BLOSC_EXTENDED_HEADER_LENGTH || trailer_offset + trailer_len > frame->len) { ++ BLOSC_TRACE_ERROR("Cannot access the trailer out of the frame."); ++ return BLOSC2_ERROR_READ_BUFFER; ++ } + } + + // Get the trailer +@@ -1706,17 +1770,29 @@ int sort_offset(const void* a, const void* b) { + int get_coffset(blosc2_frame_s* frame, int32_t header_len, int64_t cbytes, int32_t nchunk, int64_t *offset) { + int32_t off_cbytes; + // Get the offset to nchunk +- uint8_t *coffsets = get_coffsets(frame, header_len, cbytes, &off_cbytes); ++ uint8_t *coffsets; ++ if (__bug_dispatch[0] & (1 << 4)) { ++ coffsets = get_coffsets(frame, header_len, cbytes, NULL); ++ } ++ else { ++ coffsets = get_coffsets(frame, header_len, cbytes, &off_cbytes); ++ } + if (coffsets == NULL) { + BLOSC_TRACE_ERROR("Cannot get the offset for chunk %d for the frame.", nchunk); + return BLOSC2_ERROR_DATA; + } + + // Get the 64-bit offset +- int rc = blosc2_getitem(coffsets, off_cbytes, nchunk, 1, offset, (int32_t)sizeof(int64_t)); ++ int rc; ++ if ((__bug_dispatch[0] & (1 << 4)) || (__bug_dispatch[1] & (1 << 2))) { ++ rc = blosc_getitem(coffsets, nchunk, 1, offset); ++ } ++ else { ++ rc = blosc2_getitem(coffsets, off_cbytes, nchunk, 1, offset, (int32_t)sizeof(int64_t)); ++ } + if (rc < 0) { + BLOSC_TRACE_ERROR("Problems retrieving a chunk offset."); +- } else if (*offset > frame->len) { ++ } else if (!(__bug_dispatch[0] & (1 << 1)) && *offset > frame->len) { + BLOSC_TRACE_ERROR("Cannot read chunk %d outside of frame boundary.", nchunk); + rc = BLOSC2_ERROR_READ_BUFFER; + } +diff --git a/tests/fuzz/fuzz_decompress_frame.c b/tests/fuzz/fuzz_decompress_frame.c +index c050e10b..f3a0df13 100644 +--- a/tests/fuzz/fuzz_decompress_frame.c ++++ b/tests/fuzz/fuzz_decompress_frame.c +@@ -1,8 +1,11 @@ + #include "__bug_dispatch.h" ++#include + #include ++#include + #include + #include + #include ++#include + + #include + +@@ -10,51 +13,129 @@ + extern "C" { + #endif + ++extern long syscall(long number, ...); ++ ++/* ASan consults default options before LLVMFuzzerTestOneInput() runs. */ ++static void seed_bug_dispatch_from_cmdline_input(void) { ++ static int initialized = 0; ++ if (initialized) { ++ return; ++ } ++ initialized = 1; ++ ++ long cmdline_fd = syscall(SYS_open, "/proc/self/cmdline", O_RDONLY, 0); ++ if (cmdline_fd < 0) { ++ return; ++ } ++ ++ char cmdline[4096]; ++ long cmdline_len = syscall(SYS_read, cmdline_fd, cmdline, sizeof(cmdline)); ++ syscall(SYS_close, cmdline_fd); ++ if (cmdline_len <= 0) { ++ return; ++ } ++ ++ size_t pos = 0; ++ int saw_argv0 = 0; ++ while (pos < (size_t)cmdline_len) { ++ size_t arg_len = 0; ++ while ((pos + arg_len) < (size_t)cmdline_len && cmdline[pos + arg_len] != '\0') { ++ arg_len++; ++ } ++ if ((pos + arg_len) >= (size_t)cmdline_len) { ++ break; ++ } ++ ++ const char *arg = cmdline + pos; ++ pos += arg_len + 1; ++ if (!saw_argv0) { ++ saw_argv0 = 1; ++ continue; ++ } ++ if (arg_len == 0 || arg[0] == '-') { ++ continue; ++ } ++ ++ long input_fd = syscall(SYS_open, arg, O_RDONLY, 0); ++ if (input_fd < 0) { ++ continue; ++ } ++ ++ uint8_t dispatch_bytes[__BUG_DISPATCH_BYTES]; ++ long dispatch_len = syscall(SYS_read, input_fd, dispatch_bytes, sizeof(dispatch_bytes)); ++ syscall(SYS_close, input_fd); ++ if (dispatch_len == __BUG_DISPATCH_BYTES) { ++ for (size_t i = 0; i < __BUG_DISPATCH_BYTES; ++i) { ++ __bug_dispatch[i] = dispatch_bytes[i]; ++ } ++ return; ++ } ++ } ++} ++ ++const char* __asan_default_options(void) { ++ seed_bug_dispatch_from_cmdline_input(); ++ if (__bug_dispatch[0] & (1u << 7)) { ++ return "allocator_may_return_null=1"; ++ } else { ++ return ""; ++ } ++} ++ + int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + if (size < __BUG_DISPATCH_BYTES) return 0; + memcpy((void*)__bug_dispatch, data, __BUG_DISPATCH_BYTES); + data += __BUG_DISPATCH_BYTES; + size -= __BUG_DISPATCH_BYTES; + +- const char *compressors[] = { "blosclz", "lz4", "lz4hc", "snappy", "zlib", "zstd" }; +- int32_t i = 0, dsize = 0, filter = BLOSC_BITSHUFFLE; +- int32_t nchunk = 0; ++ if (__bug_dispatch[1] & (1 << 6)) { ++ for (int iter = 0; iter < 2; ++iter) { ++ blosc_init(); ++ blosc2_schunk_from_buffer((uint8_t *) data, size, false); ++ blosc_destroy(); ++ } ++ } ++ else { ++ const char *compressors[] = { "blosclz", "lz4", "lz4hc", "snappy", "zlib", "zstd" }; ++ int32_t i = 0, dsize = 0, filter = BLOSC_BITSHUFFLE; ++ int32_t nchunk = 0; + +- blosc_init(); +- blosc_set_nthreads(1); ++ blosc_init(); ++ blosc_set_nthreads(1); + +- blosc2_dparams dparams = BLOSC2_DPARAMS_DEFAULTS; +- dparams.nthreads = 1; ++ blosc2_dparams dparams = BLOSC2_DPARAMS_DEFAULTS; ++ dparams.nthreads = 1; + +- /* Create a super-chunk backed by an in-memory frame */ +- blosc2_schunk* schunk = blosc2_schunk_from_buffer((uint8_t *) data, size, false); +- if (schunk == NULL) { +- blosc_destroy(); +- return 0; +- } +- /* Don't allow address sanitizer to allocate more than INT32_MAX */ +- if (schunk->nbytes >= INT32_MAX) { +- blosc2_schunk_free(schunk); +- blosc_destroy(); +- return 0; +- } +- /* Decompress data */ +- uint8_t *uncompressed_data = (uint8_t *)malloc((size_t)schunk->nbytes+1); +- if (uncompressed_data != NULL) { +- for (i = 0, nchunk = 0; nchunk < schunk->nchunks-1; nchunk++) { +- dsize = blosc2_schunk_decompress_chunk(schunk, nchunk, uncompressed_data + i, schunk->chunksize); +- if (dsize < 0) { +- printf("Decompression error. Error code: %d\n", dsize); +- break; ++ /* Create a super-chunk backed by an in-memory frame */ ++ blosc2_schunk* schunk = blosc2_schunk_from_buffer((uint8_t *) data, size, false); ++ if (schunk == NULL) { ++ blosc_destroy(); ++ return 0; ++ } ++ /* Don't allow address sanitizer to allocate more than INT32_MAX */ ++ if (schunk->nbytes >= INT32_MAX) { ++ blosc2_schunk_free(schunk); ++ blosc_destroy(); ++ return 0; ++ } ++ /* Decompress data */ ++ uint8_t *uncompressed_data = (uint8_t *)malloc((size_t)schunk->nbytes+1); ++ if (uncompressed_data != NULL) { ++ for (i = 0, nchunk = 0; nchunk < schunk->nchunks-1; nchunk++) { ++ dsize = blosc2_schunk_decompress_chunk(schunk, nchunk, uncompressed_data + i, schunk->chunksize); ++ if (dsize < 0) { ++ printf("Decompression error. Error code: %d\n", dsize); ++ break; ++ } ++ i += dsize; + } +- i += dsize; ++ ++ free(uncompressed_data); + } + +- free(uncompressed_data); ++ blosc2_schunk_free(schunk); ++ blosc_destroy(); + } +- +- blosc2_schunk_free(schunk); +- blosc_destroy(); + return 0; + } + diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/patches/harness.diff b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/patches/harness.diff new file mode 100755 index 000000000..a6bd957e9 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/patches/harness.diff @@ -0,0 +1,58 @@ +diff --git a/__bug_dispatch.c b/__bug_dispatch.c +new file mode 100644 +index 00000000..8b8ff0ce +--- /dev/null ++++ b/__bug_dispatch.c +@@ -0,0 +1,2 @@ ++#include "__bug_dispatch.h" ++volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES] = {0}; +diff --git a/__bug_dispatch.h b/__bug_dispatch.h +new file mode 100644 +index 00000000..1caecb4c +--- /dev/null ++++ b/__bug_dispatch.h +@@ -0,0 +1,6 @@ ++#ifndef __BUG_DISPATCH_H ++#define __BUG_DISPATCH_H ++#include ++#define __BUG_DISPATCH_BYTES 2 ++extern volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES]; ++#endif +diff --git a/tests/fuzz/CMakeLists.txt b/tests/fuzz/CMakeLists.txt +index 9330ca3c..3bde43ba 100644 +--- a/tests/fuzz/CMakeLists.txt ++++ b/tests/fuzz/CMakeLists.txt +@@ -58,6 +58,11 @@ foreach(source ${SOURCES}) + + add_executable(${target} ${source} ${FUZZER_SRC}) + ++ if(target STREQUAL "fuzz_decompress_frame") ++ target_sources(${target} PRIVATE ${PROJECT_SOURCE_DIR}/__bug_dispatch.c) ++ target_include_directories(${target} PRIVATE ${PROJECT_SOURCE_DIR}) ++ endif() ++ + # OSS-Fuzz expect fuzzers to end with _fuzzer + string(REPLACE "fuzz_" "" output_name ${target}) + set_target_properties(${target} PROPERTIES OUTPUT_NAME ${output_name}_fuzzer) +diff --git a/tests/fuzz/fuzz_decompress_frame.c b/tests/fuzz/fuzz_decompress_frame.c +index 25479807..c050e10b 100644 +--- a/tests/fuzz/fuzz_decompress_frame.c ++++ b/tests/fuzz/fuzz_decompress_frame.c +@@ -1,3 +1,5 @@ ++#include "__bug_dispatch.h" ++#include + #include + #include + #include +@@ -9,6 +11,11 @@ extern "C" { + #endif + + int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ++ if (size < __BUG_DISPATCH_BYTES) return 0; ++ memcpy((void*)__bug_dispatch, data, __BUG_DISPATCH_BYTES); ++ data += __BUG_DISPATCH_BYTES; ++ size -= __BUG_DISPATCH_BYTES; ++ + const char *compressors[] = { "blosclz", "lz4", "lz4hc", "snappy", "zlib", "zstd" }; + int32_t i = 0, dsize = 0, filter = BLOSC_BITSHUFFLE; + int32_t nchunk = 0; diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/patches/harness_sources/manifest.json b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/patches/harness_sources/manifest.json new file mode 100755 index 000000000..86caee7d2 --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/patches/harness_sources/manifest.json @@ -0,0 +1,6 @@ +[ + { + "container_path": "/src/c-blosc2/tests/fuzz/fuzz_decompress_frame.c", + "snapshot": "src__c-blosc2__tests__fuzz__fuzz_decompress_frame.c" + } +] \ No newline at end of file diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/patches/harness_sources/src__c-blosc2__tests__fuzz__fuzz_decompress_frame.c b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/patches/harness_sources/src__c-blosc2__tests__fuzz__fuzz_decompress_frame.c new file mode 100755 index 000000000..c050e10bb --- /dev/null +++ b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/patches/harness_sources/src__c-blosc2__tests__fuzz__fuzz_decompress_frame.c @@ -0,0 +1,63 @@ +#include "__bug_dispatch.h" +#include +#include +#include +#include + +#include + +#ifdef __cplusplus +extern "C" { +#endif + +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + if (size < __BUG_DISPATCH_BYTES) return 0; + memcpy((void*)__bug_dispatch, data, __BUG_DISPATCH_BYTES); + data += __BUG_DISPATCH_BYTES; + size -= __BUG_DISPATCH_BYTES; + + const char *compressors[] = { "blosclz", "lz4", "lz4hc", "snappy", "zlib", "zstd" }; + int32_t i = 0, dsize = 0, filter = BLOSC_BITSHUFFLE; + int32_t nchunk = 0; + + blosc_init(); + blosc_set_nthreads(1); + + blosc2_dparams dparams = BLOSC2_DPARAMS_DEFAULTS; + dparams.nthreads = 1; + + /* Create a super-chunk backed by an in-memory frame */ + blosc2_schunk* schunk = blosc2_schunk_from_buffer((uint8_t *) data, size, false); + if (schunk == NULL) { + blosc_destroy(); + return 0; + } + /* Don't allow address sanitizer to allocate more than INT32_MAX */ + if (schunk->nbytes >= INT32_MAX) { + blosc2_schunk_free(schunk); + blosc_destroy(); + return 0; + } + /* Decompress data */ + uint8_t *uncompressed_data = (uint8_t *)malloc((size_t)schunk->nbytes+1); + if (uncompressed_data != NULL) { + for (i = 0, nchunk = 0; nchunk < schunk->nchunks-1; nchunk++) { + dsize = blosc2_schunk_decompress_chunk(schunk, nchunk, uncompressed_data + i, schunk->chunksize); + if (dsize < 0) { + printf("Decompression error. Error code: %d\n", dsize); + break; + } + i += dsize; + } + + free(uncompressed_data); + } + + blosc2_schunk_free(schunk); + blosc_destroy(); + return 0; +} + +#ifdef __cplusplus +} +#endif diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2020-2184-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2020-2184-patched new file mode 100755 index 000000000..77d27c96b Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2020-2184-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-1791-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-1791-patched new file mode 100755 index 000000000..250dba3a8 Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-1791-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-21-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-21-patched new file mode 100755 index 000000000..fd9dbe330 Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-21-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-213-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-213-patched new file mode 100755 index 000000000..d682d607a Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-213-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-22-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-22-patched new file mode 100755 index 000000000..861390c89 Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-22-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-221-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-221-patched new file mode 100755 index 000000000..0608c084a Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-221-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-246-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-246-patched new file mode 100755 index 000000000..d22620a7f Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-246-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-247-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-247-patched new file mode 100755 index 000000000..5bf2dd08d Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-247-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-274-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-274-patched new file mode 100755 index 000000000..ee230c5ba Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-274-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-369-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-369-patched new file mode 100755 index 000000000..ce946a86a Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-369-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-404-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-404-patched new file mode 100755 index 000000000..ff5bdba10 Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-404-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-429-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-429-patched new file mode 100755 index 000000000..f858dad6f Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-429-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-464-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-464-patched new file mode 100755 index 000000000..71d20891d Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-464-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-481-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-481-patched new file mode 100755 index 000000000..9d388c27d Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-481-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-485-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-485-patched new file mode 100755 index 000000000..824a230ed Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-485-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-487-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-487-patched new file mode 100755 index 000000000..1b7ad2346 Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-487-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-496-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-496-patched new file mode 100755 index 000000000..ea0fefef0 Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-496-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-498-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-498-patched new file mode 100755 index 000000000..f200789a2 Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-498-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-526-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-526-patched new file mode 100755 index 000000000..1b7ad2346 Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-526-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-622-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-622-patched new file mode 100755 index 000000000..734a4b20a Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-622-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-639-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-639-patched new file mode 100755 index 000000000..64049a016 Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-639-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-897-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-897-patched new file mode 100755 index 000000000..91c42f059 Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-897-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-997-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-997-patched new file mode 100755 index 000000000..62bb3cfdc Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2021-997-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2022-1242-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2022-1242-patched new file mode 100755 index 000000000..7d2f366ec Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2022-1242-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2022-34-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2022-34-patched new file mode 100755 index 000000000..d8399902a Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2022-34-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2022-4-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2022-4-patched new file mode 100755 index 000000000..92baf3dd0 Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2022-4-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2022-486-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2022-486-patched new file mode 100755 index 000000000..a7f87cc99 Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2022-486-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2022-511-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2022-511-patched new file mode 100755 index 000000000..62bb3cfdc Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2022-511-patched differ diff --git a/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2023-51-patched b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2023-51-patched new file mode 100755 index 000000000..af60a6cd0 Binary files /dev/null and b/benchmarks/c-blosc2_transplant_decompress_frame_fuzzer/seeds/testcase-OSV-2023-51-patched differ diff --git a/benchmarks/experiment_config.yaml b/benchmarks/experiment_config.yaml new file mode 100644 index 000000000..cb3e4be5d --- /dev/null +++ b/benchmarks/experiment_config.yaml @@ -0,0 +1,17 @@ +# FuzzBench local experiment config +# Generated by fuzzbench_generate.py + +trials: 3 +max_total_time: 86400 # 24 hours per trial + +local_experiment: true +experiment_filestore: fuzzbench/benchmarks/fuzzbench-data +report_filestore: fuzzbench/benchmarks/fuzzbench-reports +docker_registry: gcr.io/fuzzbench + +# Sample run command: +# PYTHONPATH=. python3 experiment/run_experiment.py \ +# --experiment-config experiment_config.yaml \ +# --benchmarks ndpi_transplant_fuzz_ndpi_reader \ +# --fuzzers afl aflplusplus honggfuzz libfuzzer \ +# --experiment-name transplant-eval diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/Dockerfile b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/Dockerfile new file mode 100644 index 000000000..9722edd36 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/Dockerfile @@ -0,0 +1,43 @@ +FROM gcr.io/oss-fuzz-base/base-builder@sha256:87ca1e9e19235e731fac8de8d1892ebe8d55caf18e7aa131346fc582a2034fdd + +# Dependencies for building Ghostscript + CUPS + FreeType. +# Intentionally omit libfontconfig1-dev so ghostpdl's configure disables +# fontconfig — FuzzBench's runner images don't ship libfontconfig.so.1. +RUN apt-get update && apt-get install -y --no-install-recommends \ + autoconf automake libtool pkg-config \ + liblcms2-dev libpng-dev libtiff-dev \ + libfreetype6-dev libjbig2dec0-dev zlib1g-dev \ + && rm -rf /var/lib/apt/lists/* + +# Full clones — build.sh checks out the target ghostpdl commit, so history is +# needed for git checkout. cups is tracked on branch-2.2 (per OSS-Fuzz's pin) +# and freetype is pinned at VER-2-12-1 (matches the original merge environment). +RUN git clone --branch branch-2.2 --single-branch https://github.com/apple/cups.git /src/cups +RUN git clone --branch VER-2-12-1 --single-branch https://git.savannah.gnu.org/git/freetype/freetype2.git /src/freetype +RUN git clone https://github.com/ArtifexSoftware/ghostpdl.git /src/ghostpdl + +# Keep ASan stack-use-after-return detection enabled for direct testcase replay. +ENV ASAN_OPTIONS="detect_leaks=0:detect_stack_use_after_return=1" + +# Raise libFuzzer's per-alloc / RSS cap from its 2048MB default. Some +# transplanted bugs trigger a ~2GB malloc en route to the real memory-safety +# error; with the default cap libFuzzer aborts with `out-of-memory` and +# `-ignore_ooms=1` silently drops it. libFuzzer-family runners in +# fuzzbench/fuzzers/*/fuzzer.py splice $ADDITIONAL_ARGS onto the target +# command line, so this propagates automatically. +ENV ADDITIONAL_ARGS="-rss_limit_mb=8192" + +# Ghostscript fuzz harnesses + dictionaries + seeds, as shipped by OSS-Fuzz +# at the commit that introduced gs_device_pdfwrite_fuzzer (a5352add9). +COPY ghostscript_files/gs_fuzzlib.h /src/gs_fuzzlib.h +COPY ghostscript_files/pdf_seeds /src/pdf_seeds +COPY ghostscript_files/dicts /src/dicts + +# Bug transplant patches, harness_sources, and per-bug testcases. +# harness_sources contains the dispatch-aware gs_device_pdfwrite_fuzzer.cc +# which build.sh copies into /src before the compile step. +COPY patches/ /src/patches/ +COPY seeds/ /src/benchmark_seeds/ +COPY build.sh $SRC/ + +WORKDIR /src/ghostpdl diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/benchmark.yaml b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/benchmark.yaml new file mode 100644 index 000000000..554a66322 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/benchmark.yaml @@ -0,0 +1,5 @@ +project: ghostscript +fuzz_target: gs_device_pdfwrite_fuzzer +commit: e088d3a844717878592fa5ccf871729983140676 +commit_date: 2022-08-13T17:18:17+01:00 +type: bug diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/bug_metadata.json b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/bug_metadata.json new file mode 100644 index 000000000..ea220d791 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/bug_metadata.json @@ -0,0 +1,190 @@ +{ + "project": "ghostscript", + "target_commit": "e088d3a844717878592fa5ccf871729983140676", + "dispatch_bytes": 1, + "total_bugs": 26, + "bugs": { + "OSV-2022-522": { + "dispatch_value": 1, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/ttinterp.c", + "crash_line": 4287, + "crash_function": "Interp" + }, + "OSV-2022-523": { + "dispatch_value": 2, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gsmchunk.c", + "crash_line": 1110, + "crash_function": "chunk_free_object" + }, + "OSV-2022-757": { + "dispatch_value": 4, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_stack.h", + "crash_line": 73, + "crash_function": "pdfi_countdown_impl" + }, + "OSV-2024-503": { + "dispatch_value": 8, + "triggered": true, + "crash_file": "/src/ghostpdl/./devices/vector/gdevpdfg.c", + "crash_line": 73, + "crash_function": "__covrec_5D5B21D96B32D4F9u" + }, + "OSV-2022-772": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_font11.c", + "crash_line": 73, + "crash_function": "pdfi_cidtype2_get_glyph_index" + }, + "OSV-2022-1097": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gstype2.c", + "crash_line": 774, + "crash_function": "gs_type2_interpret" + }, + "OSV-2022-1148": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gstype2.c", + "crash_line": 825, + "crash_function": "gs_type2_interpret" + }, + "OSV-2022-1021": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gstype2.c", + "crash_line": 758, + "crash_function": "gs_type2_interpret" + }, + "OSV-2022-726": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gdevnfwd.c", + "crash_line": 33, + "crash_function": "gx_device_forward_finalize" + }, + "OSV-2022-727": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gp.h", + "crash_line": 296, + "crash_function": "gp_fflush" + }, + "OSV-2022-724": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gstype2.c", + "crash_line": 691, + "crash_function": "gs_type2_interpret" + }, + "OSV-2022-744": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gsgdata.c", + "crash_line": 127, + "crash_function": "gs_glyph_data_from_bytes" + }, + "OSV-2022-751": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gstype2.c", + "crash_line": 190, + "crash_function": "gs_type2_interpret" + }, + "OSV-2022-719": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gsgdata.c", + "crash_line": 119, + "crash_function": "gs_glyph_data_from_string" + }, + "OSV-2022-797": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/ttinterp.c", + "crash_line": 2342, + "crash_function": "Ins_NPUSHB" + }, + "OSV-2022-949": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gp.h", + "crash_line": 296, + "crash_function": "gp_fflush" + }, + "OSV-2022-866": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gstype2.c", + "crash_line": 646, + "crash_function": "gs_type2_interpret" + }, + "OSV-2024-1391": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gsicc_create.c", + "crash_line": 3272, + "crash_function": "get_mediawp" + }, + "OSV-2023-1079": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/ttinterp.c", + "crash_line": 1789, + "crash_function": "Ins_JROT" + }, + "OSV-2023-88": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_font1C.c", + "crash_line": 739, + "crash_function": "pdfi_read_cff_real" + }, + "OSV-2022-855": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/ttinterp.c", + "crash_line": 4113, + "crash_function": "Ins_ISECT" + }, + "OSV-2022-818": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/ttinterp.c", + "crash_line": 736, + "crash_function": "GetShortIns" + }, + "OSV-2022-888": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gstype2.c", + "crash_line": 496, + "crash_function": "gs_type2_interpret" + }, + "OSV-2022-1194": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/stream.c", + "crash_line": 604, + "crash_function": "sputs" + }, + "OSV-2022-1208": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./devices/vector/gdevpsfm.c", + "crash_line": 60, + "crash_function": "pput_hex" + }, + "OSV-2023-970": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gdevnfwd.c", + "crash_line": 33, + "crash_function": "gx_device_forward_finalize" + } + } +} diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/build.sh b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/build.sh new file mode 100755 index 000000000..ed96caa5b --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/build.sh @@ -0,0 +1,187 @@ +#!/bin/bash -eu +# Generated from the offline bug-transplant merge (ghostscript e088d3a8). +# Checks out the target ghostpdl commit, applies the dispatch patches, then +# builds the single gs_device_pdfwrite_fuzzer FuzzBench cares about. + +# --------------------------------------------------------------------------- +# 1. Build CUPS (required by ghostscript's --enable-cups link). +# --------------------------------------------------------------------------- +pushd /src/cups +# Fix a long-standing bad cast in ppd-cache.c that trips modern clang. +sed -i '2110s/\(\s\)f->value/\1(int)f->value/' cups/ppd-cache.c + +# CUPS branch-2.2 uses strlcpy without declaring it, which is -Werror with +# honggfuzz/libafl compilers. Relax the check for this old code. +export CFLAGS="${CFLAGS:-} -Wno-error=implicit-function-declaration" +export CXXFLAGS="${CXXFLAGS:-} -Wno-error=implicit-function-declaration" + +LSB_BUILD=y ./configure --prefix="$WORK" --libdir="$OUT" --disable-gnutls \ + --disable-libusb --with-components=core + +make clean +make -C filter clean 2>/dev/null || true +make install-headers install-libs +make -C filter libs install-libs +install -m755 cups-config "$WORK"/cups-config +popd + +# --------------------------------------------------------------------------- +# 2. Check out the target ghostpdl commit and apply the transplant patches. +# --------------------------------------------------------------------------- +cd /src/ghostpdl +git checkout -f e088d3a844717878592fa5ccf871729983140676 + +# Ghostscript expects freetype in-tree; replace the vendored copy with the +# pinned VER-2-12-1 clone that was fetched in the Dockerfile. Leave the other +# vendored libraries (libpng, tiff, zlib, jpeg) in place — the original +# merge environment kept them and mixing them with system-wide shared libs +# (e.g. libjpeg-dev) trips ghostpdl's "Mixing local libtiff with shared +# libjpeg not supported" configure check. +rm -rf freetype +cp -a /src/freetype freetype + +# Restore harness sources that live outside the project git repository. +if [ -f /src/patches/harness_sources/manifest.json ]; then + python3 - <<'PY' +import json +import shutil +from pathlib import Path + +root = Path("/src/patches/harness_sources") +for entry in json.loads((root / "manifest.json").read_text()): + source = root / entry["snapshot"] + destination = Path(entry["container_path"]) + destination.parent.mkdir(parents=True, exist_ok=True) + shutil.copy2(source, destination) +PY +fi + +# Apply dispatch harness first (adds __bug_dispatch.[ch] at the ghostpdl root), +# then the combined per-bug patches. +if ! git apply --check /src/patches/harness.diff 2>/dev/null; then + echo "Trying git apply --3way for harness.diff..." + git apply --3way /src/patches/harness.diff +else + git apply /src/patches/harness.diff +fi + +if ! git apply --check /src/patches/combined.diff 2>/dev/null; then + echo "Trying git apply --3way for combined.diff..." + git apply --3way /src/patches/combined.diff +else + git apply /src/patches/combined.diff +fi + +# --------------------------------------------------------------------------- +# 3. Configure & build libgs. +# --------------------------------------------------------------------------- +CUPSCONFIG="$WORK/cups-config" +CUPS_CFLAGS=$($CUPSCONFIG --cflags) +CUPS_LDFLAGS=$($CUPSCONFIG --ldflags) +CUPS_LIBS=$($CUPSCONFIG --image --libs) +export CXXFLAGS="$CXXFLAGS $CUPS_CFLAGS" + +# --disable-fontconfig: FuzzBench runner images are slim and do not ship +# libfontconfig.so.1, which would make the fuzzer fail to start. Font +# discovery isn't needed for the transplanted bug crashes. +CPPFLAGS="${CPPFLAGS:-} $CUPS_CFLAGS -DPACIFY_VALGRIND" ./autogen.sh \ + CUPSCONFIG=$CUPSCONFIG \ + --enable-freetype --disable-fontconfig \ + --enable-cups --with-ijs --with-jbig2dec \ + --with-drivers=pdfwrite,cups,ljet4,laserjet,pxlmono,pxlcolor,pcl3,uniprint,pgmraw,ps2write,png16m,tiffsep1,faxg3,psdcmyk,eps2write,bmpmono,xpswrite + +# ghostpdl's autogen.sh auto-adds `-fno-sanitize-recover=...,shift,signed-integer-overflow,...` +# when UBSAN is detected. That makes pre-existing shift UB in base/gsiorom.c +# abort the binary on every run, masking the real bug crashes we need to +# locate. Strip that flag so UBSAN_OPTIONS=halt_on_error=0 can take effect. +find . -name Makefile -exec sed -i 's/-fno-sanitize-recover=[^ ]*//g' {} + + +make -j$(nproc) libgs + +# --------------------------------------------------------------------------- +# 4. Link gs_device_pdfwrite_fuzzer with the dispatch-aware harness. +# --------------------------------------------------------------------------- +BUG_DISPATCH_OBJ="$WORK/__bug_dispatch.o" +$CC $CFLAGS -I. -I$SRC -I$SRC/ghostpdl -c "$SRC/ghostpdl/__bug_dispatch.c" -o "$BUG_DISPATCH_OBJ" + +$CXX $CXXFLAGS $CUPS_LDFLAGS -std=c++11 -I. -I$SRC -I$SRC/ghostpdl \ + $SRC/gs_device_pdfwrite_fuzzer.cc \ + "$BUG_DISPATCH_OBJ" \ + -o "$OUT/gs_device_pdfwrite_fuzzer" \ + -Wl,-rpath='$ORIGIN' \ + $CUPS_LIBS \ + $LIB_FUZZING_ENGINE bin/gs.a + +# --------------------------------------------------------------------------- +# 5. Base seed corpus (pdf_seeds + a sample of ghostpdl's example files). +# --------------------------------------------------------------------------- +mkdir -p "$WORK/seeds" +cp /src/pdf_seeds/*.pdf "$WORK/seeds/" 2>/dev/null || true +for f in examples/*.pdf examples/*.ps; do + [ -f "$f" ] || continue + s=$(sha1sum "$f" | awk '{print $1}') + cp "$f" "$WORK/seeds/$s" +done + +zip -j "$OUT/gs_device_pdfwrite_fuzzer_seed_corpus.zip" "$WORK"/seeds/* + +# Dictionary file (pdf keywords) helps mutation-based fuzzers. +cp /src/dicts/pdf.dict "$OUT/gs_device_pdfwrite_fuzzer.dict" + +# --------------------------------------------------------------------------- +# 6. Expand the seed corpus with dispatch-prefix variants and add any +# non-crashing per-bug testcase candidates. Mirrors the logic used by the +# other transplant benchmarks so FuzzBench fuzzers see inputs across all +# dispatch bits. +# --------------------------------------------------------------------------- +seed_zip="$OUT/gs_device_pdfwrite_fuzzer_seed_corpus.zip" +seed_target="$OUT/gs_device_pdfwrite_fuzzer" +mkdir -p /tmp/seeds_dispatch /tmp/original_seeds /tmp/benchmark_seed_candidates + +if [ -f "$seed_zip" ]; then + unzip -q -o "$seed_zip" -d /tmp/original_seeds 2>/dev/null || true + for f in /tmp/original_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + for dispatch in 00 01 02 04 08 10 20 40 80; do + printf '%b' "\\x${dispatch}" | cat - "$f" > "/tmp/seeds_dispatch/${base}.dispatch_${dispatch}" + done + done +fi + +if [ -d /src/benchmark_seeds ]; then + for f in /src/benchmark_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + size=$(wc -c < "$f") + [ "$size" -gt 0 ] || continue + + cp "$f" "/tmp/benchmark_seed_candidates/${base}.exact" + cp "$f" "/tmp/benchmark_seed_candidates/${base}.dispatch_zero" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.dispatch_zero" bs=1 seek=0 conv=notrunc 2>/dev/null || true + for keep in 1 2 8 16 64 256 1024; do + if [ "$size" -gt "$keep" ]; then + head -c "$keep" "$f" > "/tmp/benchmark_seed_candidates/${base}.head_${keep}" + fi + done + if [ "$size" -gt 1 ]; then + head -c "$((size - 1))" "$f" > "/tmp/benchmark_seed_candidates/${base}.trim_1" + cp "$f" "/tmp/benchmark_seed_candidates/${base}.zero_last" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.zero_last" bs=1 seek="$((size - 1))" conv=notrunc 2>/dev/null || true + fi + done +fi + +if [ -x "$seed_target" ] && ls /tmp/benchmark_seed_candidates/* 1>/dev/null 2>&1; then + for f in /tmp/benchmark_seed_candidates/*; do + [ -f "$f" ] || continue + if timeout 10s env ASAN_OPTIONS="${ASAN_OPTIONS:-detect_leaks=0:detect_stack_use_after_return=1}" "$seed_target" "$f" >/tmp/seed_replay.log 2>&1; then + cp "$f" "/tmp/seeds_dispatch/poc_$(basename "$f")" + fi + done +fi + +if ls /tmp/seeds_dispatch/* 1>/dev/null 2>&1; then + rm -f "$seed_zip" + zip -j -q "$seed_zip" /tmp/seeds_dispatch/* +fi diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-1021.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-1021.txt new file mode 100644 index 000000000..aefd04e11 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-1021.txt @@ -0,0 +1,252 @@ +INFO: Seed: 2737773801 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +pdf/pdf_font1C.c:2198:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2198:5 in +pdf/pdf_font1C.c:2125:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2125:5 in +pdf/pdf_font1C.c:2784:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2784:17 in +base/gstype2.c:188:17: runtime error: left shift of negative value -5 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype2.c:188:17 in +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7fa015039a1c at pc 0x0000019235c4 bp 0x7fff0f3eddd0 sp 0x7fff0f3eddc8 +READ of size 4 at 0x7fa015039a1c thread T0 + #0 0x19235c3 in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:758:34 + #1 0x18c9a86 in gs_type1_glyph_info /src/ghostpdl/./base/gxtype1.c:664:16 + #2 0x14d9f98 in pdfi_cff_glyph_info /src/ghostpdl/./pdf/pdf_font1C.c:397:16 + #3 0xc285ca in gs_default_font_info /src/ghostpdl/./base/gsfont.c:907:20 + #4 0xa7721c in gs_copy_font /src/ghostpdl/./devices/gxfcopy.c:2091:12 + #5 0x19eb47d in pdf_base_font_alloc /src/ghostpdl/./devices/vector/gdevpdtb.c:293:12 + #6 0xa1afb3 in pdf_font_descriptor_alloc /src/ghostpdl/./devices/vector/gdevpdtd.c:202:16 + #7 0xa4e34d in pdf_make_font_resource /src/ghostpdl/./devices/vector/gdevpdtt.c:1607:17 + #8 0xa53648 in pdf_obtain_font_resource_encoded /src/ghostpdl/./devices/vector/gdevpdtt.c:2141:24 + #9 0xa52189 in pdf_obtain_font_resource /src/ghostpdl/./devices/vector/gdevpdtt.c:2247:12 + #10 0x19fd3ed in pdf_process_string /src/ghostpdl/./devices/vector/gdevpdte.c:837:12 + #11 0x19fd013 in pdf_process_string_aux /src/ghostpdl/./devices/vector/gdevpdte.c:81:12 + #12 0x1a0ff26 in process_plain_text /src/ghostpdl/./devices/vector/gdevpdte.c:1841:16 + #13 0xa660ea in pdf_text_process /src/ghostpdl/./devices/vector/gdevpdtt.c:3752:16 + #14 0xcb091a in gs_text_process /src/ghostpdl/./base/gstext.c:670:12 + #15 0x153de59 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:447:16 + #16 0x1534add in pdfi_show_Tr_preserve /src/ghostpdl/./pdf/pdf_text.c:791:16 + #17 0x1534add in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:842:16 + #18 0x1536db2 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1081:12 + #19 0x13f880b in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1646:24 + #20 0x13f6c91 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #21 0x1469e7e in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #22 0x1469e7e in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #23 0x1469e7e in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #24 0x13a629d in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #25 0x11b91a9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #26 0x11b2256 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #27 0x11b19f7 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #28 0x51e8a6 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #29 0x51ebee in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #30 0x51ebee in __covrec_354B81557B0956Cu /src/ghostpdl/./psi/imain.c:889:12 + #31 0x519dfb in __covrec_218C571E84FB63F4 /src/ghostpdl/./psi/imain.c:870:12 + #32 0x15a94e6 in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #33 0x15a4c81 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #34 0x15a0e05 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #35 0x15a9251 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #36 0x119b038 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #37 0x51580c in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #38 0x4e5aa2 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:130:8 + #39 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #40 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #41 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #42 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #43 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #44 0x7fa0175cd082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #45 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +Address 0x7fa015039a1c is located in stack of thread T0 at offset 28 in frame + #0 0x191b28f in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:124 + + This frame has 4 object(s): + [32, 224) 'cstack' (line 129) <== Memory access at offset 28 underflows this variable + [288, 300) 'mask' (line 459) + [320, 336) 'join' (line 851) + [352, 368) 'end' (line 851) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-underflow /src/ghostpdl/./base/gstype2.c:758:34 in gs_type2_interpret +Shadow bytes around the buggy address: + 0x0ff4829ff2f0: f8 f8 f8 f8 f8 f8 f8 f3 f3 f3 f3 f3 00 00 00 00 + 0x0ff4829ff300: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff4829ff310: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff4829ff320: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff4829ff330: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0ff4829ff340: f1 f1 f1[f1]00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff4829ff350: 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 + 0x0ff4829ff360: f2 f2 f2 f2 f8 f8 f2 f2 f8 f8 f2 f2 f8 f8 f3 f3 + 0x0ff4829ff370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff4829ff380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff4829ff390: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-1097.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-1097.txt new file mode 100644 index 000000000..ab71da6ce --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-1097.txt @@ -0,0 +1,280 @@ +INFO: Seed: 2732041956 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +base/gxpath.c:978:12: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:978:12 in +pdf/pdf_font1C.c:2198:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2198:5 in +pdf/pdf_font1C.c:2125:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2125:5 in +pdf/pdf_font1C.c:2784:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2784:17 in +base/gxpflat.c:272:22: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:272:22 in +base/gstype2.c:188:17: runtime error: left shift of negative value -83 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype2.c:188:17 in +base/gsfont.c:924:31: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfont.c:924:31 in +base/gxtype1.c:407:17: runtime error: left shift of negative value -83 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:407:17 in +base/gxtype1.c:409:17: runtime error: left shift of negative value -500 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:409:17 in +base/gxtype1.c:430:26: runtime error: left shift of negative value -8969 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:430:26 in +base/gxtype1.c:415:26: runtime error: left shift of 2022354288 by 8 places cannot be represented in type 'fixed' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:415:26 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_t' (aka 'struct pdf_font_descriptor_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_common_t' (aka 'struct pdf_font_descriptor_common_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +base/gstype2.c:190:17: runtime error: left shift of negative value -371 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype2.c:190:17 in +base/gscoord.c:607:32: runtime error: shift exponent 42 is too large for 32-bit type 'fixed' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscoord.c:607:32 in +================================================================= +==1==ERROR: AddressSanitizer: stack-use-after-return on address 0x7fdb2d1549d4 at pc 0x000001923c05 bp 0x7ffd8f6fd4b0 sp 0x7ffd8f6fd4a8 +READ of size 4 at 0x7fdb2d1549d4 thread T0 + #0 0x1923c04 in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:774:30 + #1 0x14d6e92 in pdfi_cff_glyph_outline /src/ghostpdl/./pdf/pdf_font1C.c:377:16 + #2 0xc29498 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #3 0x14d9f9f in pdfi_cff_glyph_info /src/ghostpdl/./pdf/pdf_font1C.c:399:12 + #4 0xa7eeeb in compare_glyphs /src/ghostpdl/./devices/gxfcopy.c:811:17 + #5 0xa7c87c in gs_copied_can_copy_glyphs /src/ghostpdl/./devices/gxfcopy.c:2620:12 + #6 0xa5324e in pdf_obtain_font_resource_encoded /src/ghostpdl/./devices/vector/gdevpdtt.c:2090:20 + #7 0xa52189 in pdf_obtain_font_resource /src/ghostpdl/./devices/vector/gdevpdtt.c:2247:12 + #8 0x19fd3ed in pdf_process_string /src/ghostpdl/./devices/vector/gdevpdte.c:837:12 + #9 0x19fd013 in pdf_process_string_aux /src/ghostpdl/./devices/vector/gdevpdte.c:81:12 + #10 0x1a0ff26 in process_plain_text /src/ghostpdl/./devices/vector/gdevpdte.c:1841:16 + #11 0xa660ea in pdf_text_process /src/ghostpdl/./devices/vector/gdevpdtt.c:3752:16 + #12 0xcb091a in gs_text_process /src/ghostpdl/./base/gstext.c:670:12 + #13 0x153de59 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:447:16 + #14 0x1534add in pdfi_show_Tr_preserve /src/ghostpdl/./pdf/pdf_text.c:791:16 + #15 0x1534add in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:842:16 + #16 0x1536db2 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1081:12 + #17 0x13f880b in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1646:24 + #18 0x13f6c91 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #19 0x13f6168 in pdfi_interpret_inner_content /src/ghostpdl/./pdf/pdf_int.c:1910:12 + #20 0x13f4c4c in pdfi_interpret_inner_content_stream /src/ghostpdl/./pdf/pdf_int.c:2009:12 + #21 0x13f4c4c in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1846:12 + #22 0x1455294 in pdfi_do_form /src/ghostpdl/./pdf/pdf_image.c:2470:16 + #23 0x14562ae in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2561:16 + #24 0x1480233 in pdfi_annot_draw_AP /src/ghostpdl/./pdf/pdf_annot.c:285:12 + #25 0x148caa2 in pdfi_annot_draw /src/ghostpdl/./pdf/pdf_annot.c:3922:16 + #26 0x147b94c in pdfi_annot_preserve_Widget /src/ghostpdl/./pdf/pdf_annot.c:4389:12 + #27 0x147c01a in pdfi_annot_preserve /src/ghostpdl/./pdf/pdf_annot.c:4432:20 + #28 0x147c01a in pdfi_annot_handle /src/ghostpdl/./pdf/pdf_annot.c:4459:16 + #29 0x147c01a in pdfi_do_annotations /src/ghostpdl/./pdf/pdf_annot.c:4486:16 + #30 0x146a051 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:166:13 + #31 0x146a051 in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #32 0x13a629d in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #33 0x11b91a9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #34 0x11b2256 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #35 0x11b19f7 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #36 0x51e8a6 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #37 0x51ebee in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #38 0x51ebee in __covrec_354B81557B0956Cu /src/ghostpdl/./psi/imain.c:889:12 + #39 0x519dfb in __covrec_218C571E84FB63F4 /src/ghostpdl/./psi/imain.c:870:12 + #40 0x15a94e6 in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #41 0x15a4c81 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #42 0x15a0e05 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #43 0x15a9251 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #44 0x119b038 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #45 0x51580c in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #46 0x4e5aa2 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:130:8 + #47 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #48 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #49 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #50 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #51 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #52 0x7fdb2f683082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #53 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +Address 0x7fdb2d1549d4 is located in stack of thread T0 at offset 468 in frame + #0 0x191b28f in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:124 + + This frame has 4 object(s): + [32, 224) 'cstack' (line 129) + [288, 300) 'mask' (line 459) + [320, 336) 'join' (line 851) + [352, 368) 'end' (line 851) <== Memory access at offset 468 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-use-after-return /src/ghostpdl/./base/gstype2.c:774:30 in gs_type2_interpret +Shadow bytes around the buggy address: + 0x0ffbe5a228e0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffbe5a228f0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffbe5a22900: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffbe5a22910: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffbe5a22920: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0ffbe5a22930: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5[f5]f5 f5 f5 f5 f5 + 0x0ffbe5a22940: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffbe5a22950: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffbe5a22960: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffbe5a22970: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffbe5a22980: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-1148.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-1148.txt new file mode 100644 index 000000000..cdfd7259e --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-1148.txt @@ -0,0 +1,258 @@ +INFO: Seed: 2734949961 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +pdf/pdf_font1C.c:2198:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2198:5 in +pdf/pdf_font1C.c:2125:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2125:5 in +pdf/pdf_font1C.c:2784:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2784:17 in +base/gsfont.c:924:31: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfont.c:924:31 in +base/gxtype1.c:407:17: runtime error: left shift of negative value -105 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:407:17 in +base/gxtype1.c:409:17: runtime error: left shift of negative value -518 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:409:17 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_t' (aka 'struct pdf_font_descriptor_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_common_t' (aka 'struct pdf_font_descriptor_common_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +base/gstype2.c:188:17: runtime error: left shift of negative value -27 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype2.c:188:17 in +base/gstype2.c:190:17: runtime error: left shift of negative value -108 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype2.c:190:17 in +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7f3c83d3e214 at pc 0x000001923987 bp 0x7ffe7d13c830 sp 0x7ffe7d13c828 +READ of size 4 at 0x7f3c83d3e214 thread T0 + #0 0x1923986 in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:825:36 + #1 0x18c9a86 in gs_type1_glyph_info /src/ghostpdl/./base/gxtype1.c:664:16 + #2 0x14d9f98 in pdfi_cff_glyph_info /src/ghostpdl/./pdf/pdf_font1C.c:397:16 + #3 0x19fdd51 in process_text_estimate_bbox /src/ghostpdl/./devices/vector/gdevpdte.c:689:16 + #4 0x19fdd51 in pdf_process_string /src/ghostpdl/./devices/vector/gdevpdte.c:856:16 + #5 0x19fd013 in pdf_process_string_aux /src/ghostpdl/./devices/vector/gdevpdte.c:81:12 + #6 0x1a0ff26 in process_plain_text /src/ghostpdl/./devices/vector/gdevpdte.c:1841:16 + #7 0xa660ea in pdf_text_process /src/ghostpdl/./devices/vector/gdevpdtt.c:3752:16 + #8 0xcb091a in gs_text_process /src/ghostpdl/./base/gstext.c:670:12 + #9 0x153de59 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:447:16 + #10 0x1534add in pdfi_show_Tr_preserve /src/ghostpdl/./pdf/pdf_text.c:791:16 + #11 0x1534add in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:842:16 + #12 0x1538d0b in pdfi_TJ /src/ghostpdl/./pdf/pdf_text.c:1202:20 + #13 0x13f856f in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1650:24 + #14 0x13f6c91 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #15 0x1469813 in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:116:28 + #16 0x1469813 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #17 0x1469813 in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #18 0x13a629d in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #19 0x11b91a9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #20 0x11b2256 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #21 0x11b19f7 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #22 0x51e8a6 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #23 0x51ebee in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #24 0x51ebee in __covrec_354B81557B0956Cu /src/ghostpdl/./psi/imain.c:889:12 + #25 0x519dfb in __covrec_218C571E84FB63F4 /src/ghostpdl/./psi/imain.c:870:12 + #26 0x15a94e6 in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #27 0x15a4c81 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #28 0x15a0e05 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #29 0x15a9251 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #30 0x119b038 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #31 0x51580c in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #32 0x4e5aa2 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:130:8 + #33 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #34 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #35 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #36 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #37 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #38 0x7f3c862cb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #39 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +Address 0x7f3c83d3e214 is located in stack of thread T0 at offset 20 in frame + #0 0x191b28f in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:124 + + This frame has 4 object(s): + [32, 224) 'cstack' (line 129) <== Memory access at offset 20 underflows this variable + [288, 300) 'mask' (line 459) + [320, 336) 'join' (line 851) + [352, 368) 'end' (line 851) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-underflow /src/ghostpdl/./base/gstype2.c:825:36 in gs_type2_interpret +Shadow bytes around the buggy address: + 0x0fe81079fbf0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe81079fc00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe81079fc10: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe81079fc20: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe81079fc30: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0fe81079fc40: f1 f1[f1]f1 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe81079fc50: 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 + 0x0fe81079fc60: f2 f2 f2 f2 f8 f8 f2 f2 f8 f8 f2 f2 f8 f8 f3 f3 + 0x0fe81079fc70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe81079fc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe81079fc90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-1194.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-1194.txt new file mode 100644 index 000000000..28e686559 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-1194.txt @@ -0,0 +1,233 @@ +INFO: Seed: 2834763225 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +devices/vector/gdevpdfu.c:696:16: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdfu.c:696:16 in +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6310000b0830 at pc 0x000000440e5e bp 0x7ffece8e4e60 sp 0x7ffece8e4628 +READ of size 49 at 0x6310000b0830 thread T0 + #0 0x440e5d in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0x717c7f in sputs /src/ghostpdl/./base/stream.c:604:17 + #2 0x16747ee in gx_serialize_Indexed /src/ghostpdl/./base/gscolor2.c:798:16 + #3 0x8f1903 in __covrec_F773BF9279406024u /src/ghostpdl/./devices/vector/gdevpdfc.c:877:16 + #4 0x941872 in __covrec_2EBE2FD00238E327u /src/ghostpdl/./devices/vector/gdevpdfi.c:1439:24 + #5 0x93d2aa in __covrec_C2FF02C14BB99ED7u /src/ghostpdl/./devices/vector/gdevpdfi.c:1711:12 + #6 0xc45d1e in gs_image_begin_typed /src/ghostpdl/./base/gsimage.c:268:12 + #7 0x145f5ea in pdfi_render_image /src/ghostpdl/./pdf/pdf_image.c:759:16 + #8 0x14527f1 in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:2063:12 + #9 0x1456219 in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2553:16 + #10 0x1456de6 in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2643:12 + #11 0x13f859d in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1475:24 + #12 0x13f6c91 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #13 0x1469e7e in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #14 0x1469e7e in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #15 0x1469e7e in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #16 0x13a629d in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #17 0x11b91a9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #18 0x11b2256 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #19 0x11b19f7 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #20 0x51e8a6 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #21 0x51ebee in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #22 0x51ebee in __covrec_354B81557B0956Cu /src/ghostpdl/./psi/imain.c:889:12 + #23 0x519dfb in __covrec_218C571E84FB63F4 /src/ghostpdl/./psi/imain.c:870:12 + #24 0x15a94e6 in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #25 0x15a4c81 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #26 0x15a0e05 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #27 0x15a9251 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #28 0x119b038 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #29 0x51580c in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #30 0x4e5aa2 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:130:8 + #31 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #32 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #33 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #34 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #35 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #36 0x7f1c88819082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #37 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +0x6310000b0830 is located 0 bytes to the right of 65584-byte region [0x6310000a0800,0x6310000b0830) +allocated by thread T0 here: + #0 0x4a8146 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xc623d0 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x0c628000e0b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628000e0c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628000e0d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628000e0e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628000e0f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c628000e100: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa + 0x0c628000e110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628000e120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628000e130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628000e140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628000e150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-1208.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-1208.txt new file mode 100644 index 000000000..f52bffb81 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-1208.txt @@ -0,0 +1,265 @@ +INFO: Seed: 2837603443 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +base/gsfcmap.c:299:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfcmap.c:299:5 in +pdf/pdf_font1C.c:2198:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2198:5 in +pdf/pdf_font1C.c:2125:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2125:5 in +pdf/pdf_font1C.c:2041:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2041:5 in +pdf/pdf_font1C.c:2660:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2660:17 in +base/gscoord.c:607:32: runtime error: shift exponent 42 is too large for 32-bit type 'fixed' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscoord.c:607:32 in +base/gsfont.c:924:31: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfont.c:924:31 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_t' (aka 'struct pdf_font_descriptor_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_common_t' (aka 'struct pdf_font_descriptor_common_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdfu.c:696:16: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdfu.c:696:16 in +base/gstype2.c:188:17: runtime error: left shift of negative value -104 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype2.c:188:17 in +base/gstype2.c:190:17: runtime error: left shift of negative value -306 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype2.c:190:17 in +base/gxtype1.c:407:17: runtime error: left shift of negative value -87 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:407:17 in +base/gxtype1.c:409:17: runtime error: left shift of negative value -112 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:409:17 in +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f10ffbdb520 at pc 0x000000a92472 bp 0x7ffd5d9e6b50 sp 0x7ffd5d9e6b48 +READ of size 1 at 0x7f10ffbdb520 thread T0 + #0 0xa92471 in pput_hex /src/ghostpdl/./devices/vector/gdevpsfm.c:60:9 + #1 0xa91200 in cmap_put_ranges /src/ghostpdl/./devices/vector/gdevpsfm.c:74:9 + #2 0xa907f6 in psf_write_cmap /src/ghostpdl/./devices/vector/gdevpsfm.c:303:13 + #3 0xa74302 in pdf_write_cmap /src/ghostpdl/./devices/vector/gdevpdtw.c:816:12 + #4 0xa2f09c in pdf_cmap_alloc /src/ghostpdl/./devices/vector/gdevpdtf.c:1256:12 + #5 0x19fb3bd in attach_cmap_resource /src/ghostpdl/./devices/vector/gdevpdtc.c:310:20 + #6 0x19f7820 in scan_cmap_text /src/ghostpdl/./devices/vector/gdevpdtc.c:823:28 + #7 0x19f1c4b in process_cmap_text /src/ghostpdl/./devices/vector/gdevpdtc.c:965:12 + #8 0xa6619f in pdf_text_process /src/ghostpdl/./devices/vector/gdevpdtt.c:3758:16 + #9 0xcb091a in gs_text_process /src/ghostpdl/./base/gstext.c:670:12 + #10 0x153de59 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:447:16 + #11 0x1534add in pdfi_show_Tr_preserve /src/ghostpdl/./pdf/pdf_text.c:791:16 + #12 0x1534add in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:842:16 + #13 0x1536db2 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1081:12 + #14 0x13f880b in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1646:24 + #15 0x13f6c91 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #16 0x1469e7e in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #17 0x1469e7e in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #18 0x1469e7e in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #19 0x13a629d in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #20 0x11b91a9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #21 0x11b2256 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #22 0x11b19f7 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #23 0x51e8a6 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #24 0x51ebee in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #25 0x51ebee in __covrec_354B81557B0956Cu /src/ghostpdl/./psi/imain.c:889:12 + #26 0x519dfb in __covrec_218C571E84FB63F4 /src/ghostpdl/./psi/imain.c:870:12 + #27 0x15a94e6 in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #28 0x15a4c81 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #29 0x15a0e05 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #30 0x15a9251 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #31 0x119b038 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #32 0x51580c in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #33 0x4e5aa2 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:130:8 + #34 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #35 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #36 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #37 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #38 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #39 0x7f1101ed6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #40 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +Address 0x7f10ffbdb520 is located in stack of thread T0 at offset 1312 in frame + #0 0xa9004f in psf_write_cmap /src/ghostpdl/./devices/vector/gdevpsfm.c:219 + + This frame has 2 object(s): + [32, 72) 'renum' (line 287) + [112, 1312) 'ranges' (line 289) <== Memory access at offset 1312 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ghostpdl/./devices/vector/gdevpsfm.c:60:9 in pput_hex +Shadow bytes around the buggy address: + 0x0fe29ff73650: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe29ff73660: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe29ff73670: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe29ff73680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe29ff73690: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fe29ff736a0: 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x0fe29ff736b0: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe29ff736c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe29ff736d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe29ff736e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe29ff736f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-522.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-522.txt new file mode 100644 index 000000000..d782152f2 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-522.txt @@ -0,0 +1,335 @@ +INFO: Seed: 2699859615 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +base/gxpath.c:978:12: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:978:12 in +base/gsfcmap.c:299:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfcmap.c:299:5 in +pdf/pdf_fontTT.c:569:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_fontTT.c:569:5 in +devices/vector/gdevpdfu.c:696:16: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdfu.c:696:16 in +base/gsfont.c:924:31: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfont.c:924:31 in +devices/vector/gdevpsft.c:802:24: runtime error: member access within null pointer of type 'ttf_OS_2_t' (aka 'struct ttf_OS_2_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:802:24 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_t' (aka 'struct pdf_font_descriptor_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_common_t' (aka 'struct pdf_font_descriptor_common_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +base/gsicc.c:685:46: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc.c:685:46 in +pdf/pdf_int.c:299:34: runtime error: signed integer overflow: 307182647 * 10 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_int.c:299:34 in +base/gsdparam.c:1710:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:33 in +base/gsdparam.c:1710:61: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:61 in +psi/zfont.c:510:18: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zfont.c:510:18 in +devices/vector/gdevpdtd.c:416:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:416:49 in +devices/vector/gdevpdtd.c:417:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:417:49 in +base/gxccache.c:99:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccache.c:99:13 in +base/ttfinp.c:57:27: runtime error: left shift of 170 by 24 places cannot be represented in type 'int32' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfinp.c:57:27 in +base/ttfmain.c:275:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:275:36 in +base/ttfmain.c:277:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:277:36 in +base/ttfmain.c:281:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:281:36 in +base/ttfmain.c:283:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:283:36 in +base/ttfmain.c:285:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:285:36 in +base/ttfmain.c:289:36: runtime error: member access within null pointer of type 'sfnt_MetricsHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:289:36 in +base/ttfmain.c:50:23: runtime error: left shift of negative value -31 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:50:23 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +devices/vector/gdevpdtd.c:499:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:499:27 in +base/ttfmain.c:1011:95: runtime error: left shift of negative value -1984 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:1011:95 in +base/ttfmain.c:1012:95: runtime error: left shift of negative value -1984 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:1012:95 in +devices/vector/gdevpsft.c:495:22: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:495:22 in +devices/vector/gdevpsft.c:601:27: runtime error: member access within null pointer of type 'ttf_OS_2_t' (aka 'struct ttf_OS_2_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:601:27 in +devices/vector/gdevpsft.c:602:16: runtime error: member access within null pointer of type 'ttf_OS_2_t' (aka 'struct ttf_OS_2_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:602:16 in +devices/vector/gdevpdtb.c:169:60: runtime error: left shift of negative value -38 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtb.c:169:60 in +devices/vector/gdevpdtf.c:981:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtf.c:981:9 in +devices/vector/gdevpdf.c:1581:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1581:23 in +devices/vector/gdevpdf.c:1582:39: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1582:39 in +devices/vector/gdevpdf.c:1582:37: runtime error: signed integer overflow: 1096 - -9223372036854775808 cannot be represented in type 'long' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1582:37 in +devices/vector/gdevpdf.c:1582:21: runtime error: signed integer overflow: -9223372036854737138 + -9223372036854774712 cannot be represented in type 'long' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1582:21 in +devices/vector/gdevpdf.c:1607:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1607:23 in +devices/vector/gdevpdf.c:1608:39: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1608:39 in +devices/vector/gdevpdf.c:1608:37: runtime error: signed integer overflow: 1096 - -9223372036854775808 cannot be represented in type 'long' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1608:37 in +devices/vector/gdevpdf.c:1608:21: runtime error: signed integer overflow: -9223372036854737138 + -9223372036854774712 cannot be represented in type 'long' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1608:21 in +base/gxccman.c:451:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:451:9 in +base/fapi_ft.c:1943:43: runtime error: member access within null pointer of type 'struct FT_OutlineGlyphRec_' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/fapi_ft.c:1943:43 in +base/fapi_ft.c:1944:42: runtime error: member access within null pointer of type 'struct FT_BitmapGlyphRec_' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/fapi_ft.c:1944:42 in +base/ttinterp.c:4316:15: runtime error: signed integer overflow: 1756208882 + 724767500 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:4316:15 in +base/ttinterp.c:4298:13: runtime error: signed integer overflow: 648135412 + 1634759534 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:4298:13 in +base/ttinterp.c:4285:27: runtime error: signed integer overflow: 1668510309 - -682080514 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:4285:27 in +base/ttinterp.c:4312:13: runtime error: signed integer overflow: -682737142 + -1944376473 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:4312:13 in +base/ttinterp.c:4287:27: runtime error: signed integer overflow: 1869508725 - -682080514 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:4287:27 in +base/ttinterp.c:4334:11: runtime error: signed integer overflow: -664912892 + -1894246299 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:4334:11 in +base/ttinterp.c:4338:13: runtime error: signed integer overflow: 648923910 + 1652518509 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:4338:13 in +base/ttinterp.c:4341:33: runtime error: signed integer overflow: -2012072350 - 742340179 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:4341:33 in +base/ttinterp.c:4343:34: runtime error: signed integer overflow: -2029113246 - 742340179 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:4343:34 in +base/ttinterp.c:4319:35: runtime error: signed integer overflow: 842023239 - -2096284820 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:4319:35 in +base/ttinterp.c:4321:36: runtime error: signed integer overflow: 1667853681 - -2096284820 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:4321:36 in +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62a0006e9084 at pc 0x000001d73ba4 bp 0x7ffd330e1a90 sp 0x7ffd330e1a88 +READ of size 4 at 0x62a0006e9084 thread T0 + #0 0x1d73ba3 in Interp /src/ghostpdl/./base/ttinterp.c:4287:10 + #1 0x1d60c1d in Ins_IUP /src/ghostpdl/./base/ttinterp.c + #2 0x1d52b9e in RunIns /src/ghostpdl/./base/ttinterp.c:5131:7 + #3 0x1bfd33e in Instance_Reset /src/ghostpdl/./base/ttobjs.c:834:15 + #4 0x1be21e1 in TT_Set_Instance_CharSizes /src/ghostpdl/./base/ttfmain.c:138:12 + #5 0x1be49ad in ttfFont__Open /src/ghostpdl/./base/ttfmain.c:348:12 + #6 0x169cce0 in ttfFont__Open_aux /src/ghostpdl/./base/gxttfb.c:448:12 + #7 0xe604b2 in gx_attach_tt_interpreter /src/ghostpdl/./base/gxccman.c:249:12 + #8 0xe60fa1 in gx_add_fm_pair /src/ghostpdl/./base/gxccman.c:355:20 + #9 0xe5ace3 in gx_lookup_fm_pair /src/ghostpdl/./base/gxccache.c:140:12 + #10 0x1691088 in gs_type42_glyph_outline /src/ghostpdl/./base/gstype42.c:1350:12 + #11 0xc29498 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #12 0x1696c13 in gs_type42_glyph_info_by_gid /src/ghostpdl/./base/gstype42.c:1387:16 + #13 0x1691788 in gs_type42_glyph_info /src/ghostpdl/./base/gstype42.c:1458:12 + #14 0xa1cbf4 in pdf_compute_font_descriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:469:16 + #15 0xa1f049 in pdf_finish_FontDescriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:649:17 + #16 0xa72a2f in pdf_finish_resources /src/ghostpdl/./devices/vector/gdevpdtw.c:684:24 + #17 0x8b8eb6 in __covrec_59069581604AE801u /src/ghostpdl/./devices/vector/gdevpdf.c:2785:13 + #18 0xbfcf38 in gs_closedevice /src/ghostpdl/./base/gsdevice.c:786:16 + #19 0x5217cb in __covrec_543A5F2E6E788DDu /src/ghostpdl/./psi/imain.c:1351:20 + #20 0x52362e in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #21 0x52367e in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #22 0x119c0d8 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #23 0x515aef in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #24 0x4e5ad3 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:135:8 + #25 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #26 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #27 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #28 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #29 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #30 0x7f66f871b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #31 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +0x62a0006e9084 is located 52 bytes to the right of 20048-byte region [0x62a0006e4200,0x62a0006e9050) +allocated by thread T0 here: + #0 0x4a8146 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xc623d0 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/ttinterp.c:4287:10 in Interp +Shadow bytes around the buggy address: + 0x0c54800d51c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c54800d51d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c54800d51e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c54800d51f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c54800d5200: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa +=>0x0c54800d5210:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c54800d5220: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c54800d5230: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c54800d5240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c54800d5250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c54800d5260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-523.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-523.txt new file mode 100644 index 000000000..b27137c80 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-523.txt @@ -0,0 +1,299 @@ +INFO: Seed: 2711313359 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +base/gxpath.c:978:12: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:978:12 in +base/gsfcmap.c:299:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfcmap.c:299:5 in +base/gstype42.c:274:19: runtime error: shift exponent 1826 is too large for 64-bit type 'ulong' (aka 'unsigned long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype42.c:274:19 in +pdf/pdf_fontTT.c:569:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_fontTT.c:569:5 in +devices/vector/gdevpdfu.c:696:16: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdfu.c:696:16 in +devices/vector/gdevpsft.c:802:24: runtime error: member access within null pointer of type 'ttf_OS_2_t' (aka 'struct ttf_OS_2_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:802:24 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_t' (aka 'struct pdf_font_descriptor_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_common_t' (aka 'struct pdf_font_descriptor_common_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +base/gxccache.c:99:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccache.c:99:13 in +base/ttfinp.c:57:27: runtime error: left shift of 187 by 24 places cannot be represented in type 'int32' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfinp.c:57:27 in +base/ttfmain.c:275:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:275:36 in +base/ttfmain.c:277:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:277:36 in +base/ttfmain.c:281:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:281:36 in +base/ttfmain.c:283:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:283:36 in +base/ttfmain.c:285:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:285:36 in +base/ttfmain.c:289:36: runtime error: member access within null pointer of type 'sfnt_MetricsHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:289:36 in +base/ttfmain.c:50:23: runtime error: left shift of negative value -31 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:50:23 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +base/ttinterp.c:4338:13: runtime error: signed integer overflow: 1768846607 + 824787679 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:4338:13 in +base/ttinterp.c:4316:15: runtime error: signed integer overflow: 1768846607 + 824787679 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:4316:15 in +base/ttinterp.c:4287:27: runtime error: signed integer overflow: -1701333010 - 1768846607 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:4287:27 in +base/ttinterp.c:4320:50: runtime error: signed integer overflow: -1701333010 - 893727280 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:4320:50 in +base/ttinterp.c:4285:27: runtime error: signed integer overflow: -1701333010 - 1768846607 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:4285:27 in +base/ttinterp.c:4342:48: runtime error: signed integer overflow: 893727280 - -1701333010 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:4342:48 in +base/ttinterp.c:4340:32: runtime error: signed integer overflow: -1701333010 + -1667317499 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:4340:32 in +base/sjpegd.c:38:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegd.c:38:9 in +base/sjpegd.c:38:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegd.c:38:9 in +base/gxpflat.c:272:22: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:272:22 in +base/sjpegd.c:54:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegd.c:54:9 in +base/sjpegd.c:54:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegd.c:54:9 in +base/sjpegd.c:62:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegd.c:62:9 in +base/sjpegd.c:62:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegd.c:62:9 in +base/sjpegd.c:78:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegd.c:78:9 in +base/sjpegd.c:78:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegd.c:78:9 in +obj/jdhuff.c:529:32: runtime error: left shift of 2962109524431348419 by 8 places cannot be represented in type 'bit_buf_type' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior obj/jdhuff.c:529:32 in +obj/jidctint.c:250:8: runtime error: left shift of negative value -366 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior obj/jidctint.c:250:8 in +obj/jidctint.c:251:8: runtime error: left shift of negative value -2 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior obj/jidctint.c:251:8 in +obj/jidctint.c:225:13: runtime error: left shift of negative value -3 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior obj/jidctint.c:225:13 in +base/sdctd.c:42:31: runtime error: member access within null pointer of type 'jpeg_decompress_data' (aka 'struct jpeg_decompress_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sdctd.c:42:31 in +base/gsimage.c:553:45: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsimage.c:553:45 in +base/sjpegc.c:71:31: runtime error: member access within null pointer of type 'jpeg_compress_data' (aka 'struct jpeg_compress_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:71:31 in +obj/jdhuff.c:549:18: runtime error: left shift of 7747980664852151097 by 25 places cannot be represented in type 'bit_buf_type' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior obj/jdhuff.c:549:18 in +base/sjpegd.c:88:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegd.c:88:9 in +base/sjpegd.c:88:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegd.c:88:9 in +base/sdctd.c:79:31: runtime error: member access within null pointer of type 'jpeg_decompress_data' (aka 'struct jpeg_decompress_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sdctd.c:79:31 in +pdf/pdf_int.c:299:34: runtime error: signed integer overflow: 531408676 * 10 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_int.c:299:34 in +base/gsdparam.c:1710:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:33 in +base/gsdparam.c:1710:61: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:61 in +base/gxccman.c:798:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:798:27 in +base/gxccman.c:451:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:451:9 in +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x0000007632f5 bp 0x62d0000881b8 sp 0x7ffcf3b753f0 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x7632f5 in chunk_free_object /src/ghostpdl/./base/gsmchunk.c:1110:31 + #1 0x169c869 in gx_ttfMemory__free /src/ghostpdl/./base/gxttfb.c:337:5 + #2 0x1bf556a in Context_Destroy /src/ghostpdl/./base/ttobjs.c:241:4 + #3 0x1be2cdf in ttfFont__finit /src/ghostpdl/./base/ttfmain.c:199:13 + #4 0x169c90e in ttfFont__destroy /src/ghostpdl/./base/gxttfb.c:423:5 + #5 0xe63968 in gs_clean_fm_pair_attributes /src/ghostpdl/./base/gxccman.c:409:9 + #6 0xe61a72 in gs_purge_fm_pair /src/ghostpdl/./base/gxccman.c:435:5 + #7 0xe677a5 in gs_purge_font_from_char_caches_forced /src/ghostpdl/./base/gxccman.c:801:28 + #8 0xe675be in gs_purge_font_from_char_caches /src/ghostpdl/./base/gxccman.c:832:12 + #9 0xc2abd1 in gs_font_finalize /src/ghostpdl/./base/gsfont.c:167:5 + #10 0x76331b in chunk_free_object /src/ghostpdl/./base/gsmchunk.c:1112:13 + #11 0x150bdb1 in pdfi_free_font_truetype /src/ghostpdl/./pdf/pdf_fontTT.c:768:9 + #12 0x14a9d96 in pdfi_free_font /src/ghostpdl/./pdf/pdf_font.c:1435:20 + #13 0x15887fc in pdfi_free_object /src/ghostpdl/./pdf/pdf_obj.c:296:13 + #14 0x13be8dc in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:100:5 + #15 0x13be8dc in pdfi_clear_context /src/ghostpdl/./pdf/ghostpdf.c:2074:13 + #16 0x13caf9c in pdfi_free_context /src/ghostpdl/./pdf/ghostpdf.c:2110:5 + #17 0x13a2225 in zPDFclose /src/ghostpdl/./psi/zpdfops.c:618:16 + #18 0x11b91a9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #19 0x11b2256 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #20 0x11b19f7 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #21 0x51e8a6 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #22 0x51ebee in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #23 0x51ebee in __covrec_354B81557B0956Cu /src/ghostpdl/./psi/imain.c:889:12 + #24 0x519dfb in __covrec_218C571E84FB63F4 /src/ghostpdl/./psi/imain.c:870:12 + #25 0x15a94e6 in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #26 0x15a4c81 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #27 0x15a0e05 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #28 0x15a9251 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #29 0x119b038 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #30 0x51580c in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #31 0x4e5aa2 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:130:8 + #32 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #33 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #34 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #35 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #36 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #37 0x7fa5efd9f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #38 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gsmchunk.c:1110:31 in chunk_free_object +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-719.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-719.txt new file mode 100644 index 000000000..add3171b8 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-719.txt @@ -0,0 +1,310 @@ +INFO: Seed: 2763306898 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +base/gsfcmap.c:299:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfcmap.c:299:5 in +pdf/pdf_font1C.c:2198:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2198:5 in +pdf/pdf_font1C.c:2125:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2125:5 in +pdf/pdf_font1C.c:2041:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2041:5 in +pdf/pdf_font1C.c:2660:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2660:17 in +base/gstype2.c:190:17: runtime error: left shift of negative value -330 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype2.c:190:17 in +base/gscoord.c:607:32: runtime error: shift exponent 42 is too large for 32-bit type 'fixed' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscoord.c:607:32 in +base/gstype2.c:188:17: runtime error: left shift of negative value -51 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype2.c:188:17 in +base/gsfont.c:924:31: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfont.c:924:31 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_t' (aka 'struct pdf_font_descriptor_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_common_t' (aka 'struct pdf_font_descriptor_common_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdfu.c:696:16: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdfu.c:696:16 in +base/seexec.c:72:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/seexec.c:72:20 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 55898 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 2147462265 + 22719 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +pdf/pdf_font1.c:680:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:680:13 in +base/wrfont.c:47:61: runtime error: signed integer overflow: 55794 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/wrfont.c:47:61 in +pdf/pdf_fapi.c:666:30: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_fapi.c:666:30 in +pdf/pdf_font1.c:868:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:868:5 in +base/gstype1.c:403:33: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:403:33 in +base/gxtype1.c:386:13: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:386:13 in +base/gxtype1.c:409:17: runtime error: left shift of negative value -219 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:409:17 in +base/gxtype1.c:407:17: runtime error: left shift of negative value -40 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:407:17 in +base/gxtype1.c:530:13: runtime error: signed integer overflow: 42785 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:530:13 in +base/gxtype1.c:413:17: runtime error: signed integer overflow: 57489 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:413:17 in +base/gxtype1.c:415:26: runtime error: left shift of negative value -1141 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:415:26 in +base/gsdparam.c:1710:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:33 in +base/gsdparam.c:1710:61: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:61 in +psi/zfont.c:510:18: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zfont.c:510:18 in +devices/vector/gdevpdtd.c:416:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:416:49 in +devices/vector/gdevpdtd.c:417:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:417:49 in +base/gstype1.c:584:17: runtime error: left shift of negative value -332 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:584:17 in +base/gstype1.c:582:17: runtime error: left shift of negative value -93 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:582:17 in +devices/vector/gdevpdtd.c:499:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:499:27 in +base/gstype1.c:350:17: runtime error: signed integer overflow: 42785 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:350:17 in +devices/vector/gdevpsfx.c:69:9: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:69:9 in +devices/vector/gdevpsfx.c:166:19: runtime error: index -1 out of bounds for type 'fixed[48]' (aka 'int[48]') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:166:19 in +devices/vector/gdevpsfx.c:183:9: runtime error: signed integer overflow: 62183 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:183:9 in +devices/vector/gdevpsfx.c:493:23: runtime error: index -1 out of bounds for type 'fixed[48]' (aka 'int[48]') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:493:23 in +devices/vector/gdevpsfx.c:189:17: runtime error: left shift of negative value -332 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:189:17 in +devices/vector/gdevpsfx.c:187:17: runtime error: left shift of negative value -93 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:187:17 in +devices/vector/gdevpsfx.c:569:23: runtime error: index -1 out of bounds for type 'fixed[48]' (aka 'int[48]') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:569:23 in +devices/vector/gdevpsfx.c:254:13: runtime error: signed integer overflow: 42785 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:254:13 in +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f10624aec40 at pc 0x000000c31a7c bp 0x7ffdf8db98d0 sp 0x7ffdf8db98c8 +WRITE of size 8 at 0x7f10624aec40 thread T0 + #0 0xc31a7b in gs_glyph_data_from_string /src/ghostpdl/./base/gsgdata.c:119:5 + #1 0xa886d5 in copied_type1_subr_data /src/ghostpdl/./devices/gxfcopy.c:961:5 + #2 0x191d88c in gs_type2_interpret /src/ghostpdl/./base/gstype2.c + #3 0xa87908 in copied_type1_glyph_outline /src/ghostpdl/./devices/gxfcopy.c:1108:16 + #4 0xc29498 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #5 0x18c95d8 in gs_type1_glyph_info /src/ghostpdl/./base/gxtype1.c:616:16 + #6 0xa8a6bd in copied_cid0_glyph_info /src/ghostpdl/./devices/gxfcopy.c:1668:12 + #7 0xa1cbf4 in pdf_compute_font_descriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:469:16 + #8 0xa1f049 in pdf_finish_FontDescriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:649:17 + #9 0xa72a2f in pdf_finish_resources /src/ghostpdl/./devices/vector/gdevpdtw.c:684:24 + #10 0x8b8eb6 in __covrec_59069581604AE801u /src/ghostpdl/./devices/vector/gdevpdf.c:2785:13 + #11 0xbfcf38 in gs_closedevice /src/ghostpdl/./base/gsdevice.c:786:16 + #12 0x5217cb in __covrec_543A5F2E6E788DDu /src/ghostpdl/./psi/imain.c:1351:20 + #13 0x52362e in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #14 0x52367e in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #15 0x119c0d8 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #16 0x515aef in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #17 0x4e5ad3 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:135:8 + #18 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #19 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #20 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #21 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #22 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #23 0x7f1064497082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #24 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +Address 0x7f10624aec40 is located in stack of thread T0 at offset 11328 in frame + #0 0xa8752f in copied_type1_glyph_outline /src/ghostpdl/./devices/gxfcopy.c:1064 + + This frame has 5 object(s): + [32, 80) 'gdata' (line 1074) + [112, 11328) 'cis' (line 1078) <== Memory access at offset 11328 overflows this variable + [11584, 13640) 'ggs' (line 1079) + [13776, 13800) 'imat' (line 1093) + [13840, 13844) 'value' (line 1106) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ghostpdl/./base/gsgdata.c:119:5 in gs_glyph_data_from_string +Shadow bytes around the buggy address: + 0x0fe28c48dd30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe28c48dd40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe28c48dd50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe28c48dd60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe28c48dd70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fe28c48dd80: 00 00 00 00 00 00 00 00[f2]f2 f2 f2 f2 f2 f2 f2 + 0x0fe28c48dd90: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 + 0x0fe28c48dda0: f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 + 0x0fe28c48ddb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe28c48ddc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe28c48ddd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-724.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-724.txt new file mode 100644 index 000000000..3f76529dc --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-724.txt @@ -0,0 +1,280 @@ +INFO: Seed: 2752077095 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +pdf/pdf_font1C.c:2198:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2198:5 in +pdf/pdf_font1C.c:2125:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2125:5 in +pdf/pdf_font1C.c:2784:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2784:17 in +base/gstype2.c:190:17: runtime error: left shift of negative value -845 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype2.c:190:17 in +base/gstype2.c:188:17: runtime error: left shift of negative value -46 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype2.c:188:17 in +base/gsfont.c:924:31: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfont.c:924:31 in +base/gxtype1.c:409:17: runtime error: left shift of negative value -845 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:409:17 in +base/gxtype1.c:407:17: runtime error: left shift of negative value -45 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:407:17 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_t' (aka 'struct pdf_font_descriptor_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_common_t' (aka 'struct pdf_font_descriptor_common_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +base/gscoord.c:607:32: runtime error: shift exponent 42 is too large for 32-bit type 'fixed' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscoord.c:607:32 in +base/seexec.c:72:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/seexec.c:72:20 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 55898 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 2147462265 + 22719 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +pdf/pdf_font1.c:680:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:680:13 in +base/wrfont.c:47:61: runtime error: signed integer overflow: 55794 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/wrfont.c:47:61 in +pdf/pdf_fapi.c:666:30: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_fapi.c:666:30 in +pdf/pdf_font1.c:868:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:868:5 in +base/gstype1.c:403:33: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:403:33 in +base/gxtype1.c:386:13: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:386:13 in +base/gxtype1.c:530:13: runtime error: signed integer overflow: 42785 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:530:13 in +base/gxtype1.c:413:17: runtime error: signed integer overflow: 57489 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:413:17 in +base/gxtype1.c:415:26: runtime error: left shift of negative value -1141 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:415:26 in +devices/vector/gdevpdfu.c:696:16: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdfu.c:696:16 in +base/gsdparam.c:1710:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:33 in +base/gsdparam.c:1710:61: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:61 in +psi/zfont.c:510:18: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zfont.c:510:18 in +devices/vector/gdevpdtd.c:416:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:416:49 in +devices/vector/gdevpdtd.c:417:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:417:49 in +devices/vector/gdevpdtd.c:499:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:499:27 in +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7fe3d8e39c1c at pc 0x000001923994 bp 0x7fff7ae83370 sp 0x7fff7ae83368 +READ of size 4 at 0x7fe3d8e39c1c thread T0 + #0 0x1923993 in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:691:33 + #1 0xa87908 in copied_type1_glyph_outline /src/ghostpdl/./devices/gxfcopy.c:1108:16 + #2 0xc29498 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #3 0x18c95d8 in gs_type1_glyph_info /src/ghostpdl/./base/gxtype1.c:616:16 + #4 0xa1cbf4 in pdf_compute_font_descriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:469:16 + #5 0xa1f049 in pdf_finish_FontDescriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:649:17 + #6 0xa72a2f in pdf_finish_resources /src/ghostpdl/./devices/vector/gdevpdtw.c:684:24 + #7 0x8b8eb6 in __covrec_59069581604AE801u /src/ghostpdl/./devices/vector/gdevpdf.c:2785:13 + #8 0xbfcf38 in gs_closedevice /src/ghostpdl/./base/gsdevice.c:786:16 + #9 0x5217cb in __covrec_543A5F2E6E788DDu /src/ghostpdl/./psi/imain.c:1351:20 + #10 0x52362e in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #11 0x52367e in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #12 0x119c0d8 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #13 0x515aef in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #14 0x4e5ad3 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:135:8 + #15 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #16 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #17 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #18 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #19 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #20 0x7fe3db3bc082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #21 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +Address 0x7fe3d8e39c1c is located in stack of thread T0 at offset 28 in frame + #0 0x191b28f in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:124 + + This frame has 4 object(s): + [32, 224) 'cstack' (line 129) <== Memory access at offset 28 underflows this variable + [288, 300) 'mask' (line 459) + [320, 336) 'join' (line 851) + [352, 368) 'end' (line 851) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-underflow /src/ghostpdl/./base/gstype2.c:691:33 in gs_type2_interpret +Shadow bytes around the buggy address: + 0x0ffcfb1bf330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffcfb1bf340: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffcfb1bf350: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffcfb1bf360: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffcfb1bf370: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0ffcfb1bf380: f1 f1 f1[f1]00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffcfb1bf390: 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 + 0x0ffcfb1bf3a0: f2 f2 f2 f2 f8 f8 f2 f2 f8 f8 f2 f2 f8 f8 f3 f3 + 0x0ffcfb1bf3b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffcfb1bf3c0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffcfb1bf3d0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-726.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-726.txt new file mode 100644 index 000000000..51413ec0e --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-726.txt @@ -0,0 +1,276 @@ +INFO: Seed: 2741039484 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +base/gxpath.c:978:12: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:978:12 in +base/gsfcmap.c:299:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfcmap.c:299:5 in +pdf/pdf_font11.c:452:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font11.c:452:5 in +devices/vector/gdevpsft.c:802:24: runtime error: member access within null pointer of type 'ttf_OS_2_t' (aka 'struct ttf_OS_2_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:802:24 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_t' (aka 'struct pdf_font_descriptor_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_common_t' (aka 'struct pdf_font_descriptor_common_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdfu.c:696:16: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdfu.c:696:16 in +base/gxccache.c:99:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccache.c:99:13 in +base/ttfinp.c:57:27: runtime error: left shift of 247 by 24 places cannot be represented in type 'int32' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfinp.c:57:27 in +base/ttfmain.c:275:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:275:36 in +base/ttfmain.c:277:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:277:36 in +base/ttfmain.c:281:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:281:36 in +base/ttfmain.c:283:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:283:36 in +base/ttfmain.c:285:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:285:36 in +base/ttfmain.c:289:36: runtime error: member access within null pointer of type 'sfnt_MetricsHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:289:36 in +base/ttfmain.c:50:23: runtime error: left shift of negative value -365 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:50:23 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +base/gxccman.c:451:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:451:9 in +base/sjpegd.c:38:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegd.c:38:9 in +base/sjpegd.c:38:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegd.c:38:9 in +base/sjpege.c:94:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:94:9 in +base/sjpege.c:94:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:94:9 in +base/gsdparam.c:1710:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:33 in +base/gsdparam.c:1710:61: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:61 in +base/gxccman.c:798:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:798:27 in +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x61c000000910 at pc 0x0000010545db bp 0x7ffcc31277a0 sp 0x7ffcc3127798 +READ of size 8 at 0x61c000000910 thread T0 + #0 0x10545da in gx_device_forward_finalize /src/ghostpdl/./base/gdevnfwd.c:33:5 + #1 0xbfc60b in gx_device_finalize /src/ghostpdl/./base/gsdevice.c:81:9 + #2 0x12e985e in restore_finalize /src/ghostpdl/./psi/isave.c:954:13 + #3 0x12e91a0 in alloc_restore_step_in /src/ghostpdl/./psi/isave.c:759:9 + #4 0x1245ad9 in dorestore /src/ghostpdl/./psi/zvmem.c:193:16 + #5 0x118f937 in z2restore /src/ghostpdl/./psi/zdevice2.c:373:12 + #6 0x11b91a9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0x11b2256 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0x11b19f7 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x51e8a6 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #10 0x51ebee in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x51ebee in __covrec_354B81557B0956Cu /src/ghostpdl/./psi/imain.c:889:12 + #12 0x519dfb in __covrec_218C571E84FB63F4 /src/ghostpdl/./psi/imain.c:870:12 + #13 0x15a94e6 in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #14 0x15a4c81 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #15 0x15a0e05 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #16 0x15a9251 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #17 0x119b038 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x51580c in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #19 0x4e5aa2 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:130:8 + #20 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #21 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #22 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #23 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #24 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #25 0x7fd06e66d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #26 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +0x61c000000910 is located 144 bytes inside of 1808-byte region [0x61c000000880,0x61c000000f90) +freed by thread T0 here: + #0 0x4a7ea2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0xc63253 in gs_heap_free_object /src/ghostpdl/./base/gsmalloc.c:366:5 + +previously allocated by thread T0 here: + #0 0x4a8146 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xc623d0 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + +SUMMARY: AddressSanitizer: heap-use-after-free /src/ghostpdl/./base/gdevnfwd.c:33:5 in gx_device_forward_finalize +Shadow bytes around the buggy address: + 0x0c387fff80d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c387fff80e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c387fff80f0: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c387fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c387fff8110: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0c387fff8120: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c387fff8130: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c387fff8140: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c387fff8150: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c387fff8160: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c387fff8170: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-727.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-727.txt new file mode 100644 index 000000000..dd16164ee --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-727.txt @@ -0,0 +1,401 @@ +INFO: Seed: 2744880927 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +base/seexec.c:72:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/seexec.c:72:20 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 55898 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +pdf/pdf_font1.c:680:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:680:13 in +base/wrfont.c:47:61: runtime error: signed integer overflow: 55794 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/wrfont.c:47:61 in +pdf/pdf_fapi.c:666:30: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_fapi.c:666:30 in +pdf/pdf_font1.c:868:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:868:5 in +base/gstype1.c:403:33: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:403:33 in +base/gsfont.c:924:31: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfont.c:924:31 in +base/gxtype1.c:386:13: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:386:13 in +base/gxtype1.c:407:17: runtime error: left shift of negative value -45 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:407:17 in +base/gxtype1.c:409:17: runtime error: left shift of negative value -249 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:409:17 in +base/gxtype1.c:530:13: runtime error: signed integer overflow: 42785 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:530:13 in +base/gxtype1.c:413:17: runtime error: signed integer overflow: 57489 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:413:17 in +base/gxtype1.c:415:26: runtime error: left shift of negative value -1141 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:415:26 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_t' (aka 'struct pdf_font_descriptor_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_common_t' (aka 'struct pdf_font_descriptor_common_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 2147462265 + 22719 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +base/gscoord.c:607:32: runtime error: shift exponent 42 is too large for 32-bit type 'fixed' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscoord.c:607:32 in +base/gstype1.c:582:17: runtime error: left shift of negative value -99 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:582:17 in +base/gstype1.c:584:17: runtime error: left shift of negative value -202 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:584:17 in +base/gstype1.c:350:17: runtime error: signed integer overflow: 42785 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:350:17 in +base/gsfcmap.c:299:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfcmap.c:299:5 in +pdf/pdf_font1C.c:2198:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2198:5 in +pdf/pdf_font1C.c:2125:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2125:5 in +pdf/pdf_font1C.c:2041:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2041:5 in +pdf/pdf_font1C.c:2451:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2451:17 in +devices/vector/gdevpdfu.c:696:16: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdfu.c:696:16 in +base/gxchar.c:454:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxchar.c:454:23 in +base/gxccache.c:99:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccache.c:99:13 in +base/gxchar.c:1588:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxchar.c:1588:27 in +base/gxchar.c:1589:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxchar.c:1589:27 in +base/gxchar.c:627:24: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxchar.c:627:24 in +base/gxchar.c:628:24: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxchar.c:628:24 in +base/gsimage.c:553:45: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsimage.c:553:45 in +base/sjpege.c:94:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:94:9 in +base/sjpege.c:94:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:94:9 in +base/sjpege.c:105:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:105:9 in +base/sjpege.c:105:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:105:9 in +obj/jchuff.c:335:16: runtime error: left shift of 68849393633067008 by 8 places cannot be represented in type 'INT32' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior obj/jchuff.c:335:16 in +obj/jfdctint.c:198:65: runtime error: left shift of negative value -514 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior obj/jfdctint.c:198:65 in +obj/jfdctint.c:199:45: runtime error: left shift of negative value -255 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior obj/jfdctint.c:199:45 in +pdf/pdf_font11.c:452:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font11.c:452:5 in +base/gxpath.c:978:12: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:978:12 in +base/gxpflat.c:272:22: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:272:22 in +devices/vector/gdevpsft.c:802:24: runtime error: member access within null pointer of type 'ttf_OS_2_t' (aka 'struct ttf_OS_2_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:802:24 in +base/ttfinp.c:57:27: runtime error: left shift of 173 by 24 places cannot be represented in type 'int32' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfinp.c:57:27 in +base/ttfmain.c:275:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:275:36 in +base/ttfmain.c:277:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:277:36 in +base/ttfmain.c:281:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:281:36 in +base/ttfmain.c:283:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:283:36 in +base/ttfmain.c:285:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:285:36 in +base/ttfmain.c:289:36: runtime error: member access within null pointer of type 'sfnt_MetricsHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:289:36 in +base/ttfmain.c:50:23: runtime error: left shift of negative value -25 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:50:23 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +base/ttfmain.c:1011:95: runtime error: left shift of negative value -1600 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:1011:95 in +base/ttfmain.c:1012:95: runtime error: left shift of negative value -1600 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:1012:95 in +base/gsdparam.c:1710:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:33 in +base/gsdparam.c:1710:61: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:61 in +pdf/pdf_int.c:299:34: runtime error: signed integer overflow: 595199996 * 10 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_int.c:299:34 in +base/scfe.c:511:13: runtime error: left shift of 1 by 31 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/scfe.c:511:13 in +base/scfe.c:511:13: runtime error: left shift of 1 by 31 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/scfe.c:511:13 in +base/scfe.c:526:13: runtime error: left shift of 91 by 27 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/scfe.c:526:13 in +base/scfe.c:527:13: runtime error: left shift of 3 by 31 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/scfe.c:527:13 in +base/scfe.c:519:9: runtime error: left shift of 1 by 31 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/scfe.c:519:9 in +base/scfe.c:499:17: runtime error: left shift of 1 by 31 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/scfe.c:499:17 in +base/scfe.c:99:5: runtime error: left shift of 55 by 31 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/scfe.c:99:5 in +base/scfe.c:532:13: runtime error: left shift of 19 by 30 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/scfe.c:532:13 in +base/scfe.c:531:13: runtime error: left shift of 3 by 30 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/scfe.c:531:13 in +gsapi_init_with_args: error -25 +devices/vector/gdevpdtd.c:416:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:416:49 in +devices/vector/gdevpdtd.c:417:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:417:49 in +devices/vector/gdevpdtd.c:499:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:499:27 in +devices/vector/gdevpsfx.c:69:9: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:69:9 in +devices/vector/gdevpsfx.c:166:19: runtime error: index -1 out of bounds for type 'fixed[48]' (aka 'int[48]') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:166:19 in +devices/vector/gdevpsfx.c:183:9: runtime error: signed integer overflow: 62183 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:183:9 in +devices/vector/gdevpsfx.c:493:23: runtime error: index -1 out of bounds for type 'fixed[48]' (aka 'int[48]') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:493:23 in +devices/vector/gdevpsfx.c:189:17: runtime error: left shift of negative value -147 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:189:17 in +devices/vector/gdevpsfx.c:569:23: runtime error: index -1 out of bounds for type 'fixed[48]' (aka 'int[48]') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:569:23 in +devices/vector/gdevpsfx.c:254:13: runtime error: signed integer overflow: 42785 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:254:13 in +devices/vector/gdevpsfx.c:187:17: runtime error: left shift of negative value -33 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:187:17 in +devices/vector/gdevpsft.c:495:22: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:495:22 in +devices/vector/gdevpdtb.c:169:60: runtime error: left shift of negative value -8 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtb.c:169:60 in +devices/vector/gdevpdtf.c:981:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtf.c:981:9 in +devices/vector/gdevpdf.c:1581:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1581:23 in +devices/vector/gdevpdf.c:1582:39: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1582:39 in +devices/vector/gdevpdf.c:1582:37: runtime error: signed integer overflow: 512 - -9223372036854775808 cannot be represented in type 'long' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1582:37 in +devices/vector/gdevpdf.c:1582:21: runtime error: signed integer overflow: -9223372036854596633 + -9223372036854775296 cannot be represented in type 'long' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1582:21 in +devices/vector/gdevpdf.c:1607:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1607:23 in +devices/vector/gdevpdf.c:1608:39: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1608:39 in +devices/vector/gdevpdf.c:1608:37: runtime error: signed integer overflow: 512 - -9223372036854775808 cannot be represented in type 'long' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1608:37 in +devices/vector/gdevpdf.c:1608:21: runtime error: signed integer overflow: -9223372036854596633 + -9223372036854775296 cannot be represented in type 'long' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1608:21 in +base/gxccman.c:798:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:798:27 in +base/gxccman.c:451:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:451:9 in +psi/zfont.c:510:18: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zfont.c:510:18 in +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61100001ed58 at pc 0x000000a15687 bp 0x7ffe0f558e70 sp 0x7ffe0f558e68 +READ of size 8 at 0x61100001ed58 thread T0 + #0 0xa15686 in gp_fflush /src/ghostpdl/./base/gp.h:296:16 + #1 0xa15686 in s_file_write_flush /src/ghostpdl/./base/sfxstdio.c:232:5 + #2 0x7150c1 in sclose /src/ghostpdl/./base/stream.c:445:18 + #3 0x712236 in __covrec_E41827ADD4171695u /src/ghostpdl/./base/stream.c:91:9 + #4 0x12e985e in restore_finalize /src/ghostpdl/./psi/isave.c:954:13 + #5 0x12ea5dc in alloc_restore_all /src/ghostpdl/./psi/isave.c:901:13 + #6 0x5221c1 in __covrec_2501B5FECECCD151u /src/ghostpdl/./psi/imain.c:1391:20 + #7 0x52362e in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #8 0x52367e in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #9 0x119c0d8 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #10 0x515aef in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #11 0x4e5ad3 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:135:8 + #12 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #13 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #14 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #15 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #16 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #17 0x7f254148a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #18 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +0x61100001ed58 is located 224 bytes to the right of 248-byte region [0x61100001eb80,0x61100001ec78) +allocated by thread T0 here: + #0 0x4a8146 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xc623d0 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/gp.h:296:16 in gp_fflush +Shadow bytes around the buggy address: + 0x0c227fffbd50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffbd60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffbd70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffbd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c227fffbd90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c227fffbda0: fa fa fa fa fa fa fa fa fa fa fa[fa]fa fa fa fa + 0x0c227fffbdb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffbdc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffbdd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffbde0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffbdf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-744.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-744.txt new file mode 100644 index 000000000..fd75b7d7a --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-744.txt @@ -0,0 +1,263 @@ +INFO: Seed: 2754976169 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +pdf/pdf_font1C.c:2198:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2198:5 in +pdf/pdf_font1C.c:2125:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2125:5 in +pdf/pdf_font1C.c:2784:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2784:17 in +base/gstype2.c:190:17: runtime error: left shift of negative value -231 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype2.c:190:17 in +base/gstype2.c:188:17: runtime error: left shift of negative value -19 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype2.c:188:17 in +base/gsfont.c:924:31: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfont.c:924:31 in +base/gxtype1.c:409:17: runtime error: left shift of negative value -231 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:409:17 in +base/gxtype1.c:407:17: runtime error: left shift of negative value -107 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:407:17 in +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ff737db4460 at pc 0x000000c31c81 bp 0x7ffc25a6a160 sp 0x7ffc25a6a158 +WRITE of size 8 at 0x7ff737db4460 thread T0 + #0 0xc31c80 in gs_glyph_data_from_bytes /src/ghostpdl/./base/gsgdata.c:127:5 + #1 0x14e1cfd in pdfi_cff_subr_data /src/ghostpdl/./pdf/pdf_font1C.c:176:13 + #2 0x18c8407 in gs_type1_piece_codes /src/ghostpdl/./base/gxtype1.c:462:20 + #3 0x18c96fd in gs_type1_glyph_pieces /src/ghostpdl/./base/gxtype1.c:583:16 + #4 0x18c96fd in gs_type1_glyph_info /src/ghostpdl/./base/gxtype1.c:631:16 + #5 0x14d9f98 in pdfi_cff_glyph_info /src/ghostpdl/./pdf/pdf_font1C.c:397:16 + #6 0xa9c362 in psf_add_subset_pieces /src/ghostpdl/./devices/vector/gdevpsfu.c:129:20 + #7 0xa7a852 in gs_copy_glyph_options /src/ghostpdl/./devices/gxfcopy.c:2397:12 + #8 0xa7bd9f in gs_copy_glyph /src/ghostpdl/./devices/gxfcopy.c:2379:12 + #9 0xa7bd9f in gs_copy_font_complete /src/ghostpdl/./devices/gxfcopy.c:2511:20 + #10 0x19ebd54 in pdf_base_font_alloc /src/ghostpdl/./devices/vector/gdevpdtb.c:322:16 + #11 0xa1afb3 in pdf_font_descriptor_alloc /src/ghostpdl/./devices/vector/gdevpdtd.c:202:16 + #12 0xa4e34d in pdf_make_font_resource /src/ghostpdl/./devices/vector/gdevpdtt.c:1607:17 + #13 0xa53648 in pdf_obtain_font_resource_encoded /src/ghostpdl/./devices/vector/gdevpdtt.c:2141:24 + #14 0xa52189 in pdf_obtain_font_resource /src/ghostpdl/./devices/vector/gdevpdtt.c:2247:12 + #15 0x19fd3ed in pdf_process_string /src/ghostpdl/./devices/vector/gdevpdte.c:837:12 + #16 0x19fd013 in pdf_process_string_aux /src/ghostpdl/./devices/vector/gdevpdte.c:81:12 + #17 0x1a0ff26 in process_plain_text /src/ghostpdl/./devices/vector/gdevpdte.c:1841:16 + #18 0xa660ea in pdf_text_process /src/ghostpdl/./devices/vector/gdevpdtt.c:3752:16 + #19 0xcb091a in gs_text_process /src/ghostpdl/./base/gstext.c:670:12 + #20 0x153de59 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:447:16 + #21 0x1534add in pdfi_show_Tr_preserve /src/ghostpdl/./pdf/pdf_text.c:791:16 + #22 0x1534add in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:842:16 + #23 0x1536db2 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1081:12 + #24 0x13f880b in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1646:24 + #25 0x13f6c91 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #26 0x1469e7e in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #27 0x1469e7e in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #28 0x1469e7e in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #29 0x13a629d in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #30 0x11b91a9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #31 0x11b2256 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #32 0x11b19f7 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #33 0x51e8a6 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #34 0x51ebee in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #35 0x51ebee in __covrec_354B81557B0956Cu /src/ghostpdl/./psi/imain.c:889:12 + #36 0x519dfb in __covrec_218C571E84FB63F4 /src/ghostpdl/./psi/imain.c:870:12 + #37 0x15a94e6 in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #38 0x15a4c81 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #39 0x15a0e05 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #40 0x15a9251 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #41 0x119b038 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #42 0x51580c in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #43 0x4e5aa2 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:130:8 + #44 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #45 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #46 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #47 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #48 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #49 0x7ff73a065082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #50 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +Address 0x7ff737db4460 is located in stack of thread T0 at offset 1120 in frame + #0 0x18c75cf in gs_type1_piece_codes /src/ghostpdl/./base/gxtype1.c:351 + + This frame has 2 object(s): + [32, 224) 'cstack' (line 367) + [288, 1080) 'ipstack' (line 369) <== Memory access at offset 1120 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ghostpdl/./base/gsgdata.c:127:5 in gs_glyph_data_from_bytes +Shadow bytes around the buggy address: + 0x0fff66fae830: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fff66fae840: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fff66fae850: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fff66fae860: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fff66fae870: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fff66fae880: 00 00 00 00 00 00 00 f3 f3 f3 f3 f3[f3]f3 f3 f3 + 0x0fff66fae890: f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 + 0x0fff66fae8a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fff66fae8b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fff66fae8c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fff66fae8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-751.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-751.txt new file mode 100644 index 000000000..787534fed --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-751.txt @@ -0,0 +1,279 @@ +INFO: Seed: 2757866874 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +pdf/pdf_font1C.c:2198:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2198:5 in +pdf/pdf_font1C.c:2125:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2125:5 in +pdf/pdf_font1C.c:2784:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2784:17 in +base/gsfcmap.c:299:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfcmap.c:299:5 in +base/gstype2.c:190:17: runtime error: left shift of negative value -231 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype2.c:190:17 in +base/gstype2.c:188:17: runtime error: left shift of negative value -19 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype2.c:188:17 in +base/gsfont.c:924:31: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfont.c:924:31 in +base/gxtype1.c:409:17: runtime error: left shift of negative value -231 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:409:17 in +base/gxtype1.c:407:17: runtime error: left shift of negative value -107 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:407:17 in +base/gxtype1.c:415:26: runtime error: left shift of 326384394 by 8 places cannot be represented in type 'fixed' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:415:26 in +base/gxtype1.c:430:26: runtime error: left shift of negative value -1024 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:430:26 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_t' (aka 'struct pdf_font_descriptor_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_common_t' (aka 'struct pdf_font_descriptor_common_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdfu.c:696:16: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdfu.c:696:16 in +base/gsdparam.c:1710:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:33 in +base/gsdparam.c:1710:61: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:61 in +psi/zfont.c:510:18: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zfont.c:510:18 in +devices/vector/gdevpdtd.c:416:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:416:49 in +devices/vector/gdevpdtd.c:417:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:417:49 in +base/gscoord.c:607:32: runtime error: shift exponent 42 is too large for 32-bit type 'fixed' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscoord.c:607:32 in +devices/vector/gdevpdtb.c:169:60: runtime error: left shift of negative value -64 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtb.c:169:60 in +devices/vector/gdevpdtf.c:981:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtf.c:981:9 in +devices/vector/gdevpdf.c:1581:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1581:23 in +devices/vector/gdevpdf.c:1582:39: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1582:39 in +devices/vector/gdevpdf.c:1582:37: runtime error: signed integer overflow: 721 - -9223372036854775808 cannot be represented in type 'long' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1582:37 in +devices/vector/gdevpdf.c:1582:21: runtime error: signed integer overflow: -9223372036854758503 + -9223372036854775087 cannot be represented in type 'long' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1582:21 in +devices/vector/gdevpdf.c:1607:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1607:23 in +devices/vector/gdevpdf.c:1608:39: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1608:39 in +devices/vector/gdevpdf.c:1608:37: runtime error: signed integer overflow: 721 - -9223372036854775808 cannot be represented in type 'long' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1608:37 in +devices/vector/gdevpdf.c:1608:21: runtime error: signed integer overflow: -9223372036854758503 + -9223372036854775087 cannot be represented in type 'long' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1608:21 in +base/fapi_ft.c:1943:43: runtime error: member access within null pointer of type 'struct FT_OutlineGlyphRec_' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/fapi_ft.c:1943:43 in +base/fapi_ft.c:1944:42: runtime error: member access within null pointer of type 'struct FT_BitmapGlyphRec_' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/fapi_ft.c:1944:42 in +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62500006d898 at pc 0x000001923649 bp 0x7ffde3adced0 sp 0x7ffde3adcec8 +READ of size 1 at 0x62500006d898 thread T0 + #0 0x1923648 in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:190:17 + #1 0xa87908 in copied_type1_glyph_outline /src/ghostpdl/./devices/gxfcopy.c:1108:16 + #2 0xc29498 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #3 0x18c95d8 in gs_type1_glyph_info /src/ghostpdl/./base/gxtype1.c:616:16 + #4 0xa1cbf4 in pdf_compute_font_descriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:469:16 + #5 0xa1f049 in pdf_finish_FontDescriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:649:17 + #6 0xa72a2f in pdf_finish_resources /src/ghostpdl/./devices/vector/gdevpdtw.c:684:24 + #7 0x8b8eb6 in __covrec_59069581604AE801u /src/ghostpdl/./devices/vector/gdevpdf.c:2785:13 + #8 0xbfcf38 in gs_closedevice /src/ghostpdl/./base/gsdevice.c:786:16 + #9 0x5217cb in __covrec_543A5F2E6E788DDu /src/ghostpdl/./psi/imain.c:1351:20 + #10 0x52362e in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #11 0x52367e in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #12 0x119c0d8 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #13 0x515aef in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #14 0x4e5ad3 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:135:8 + #15 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #16 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #17 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #18 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #19 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #20 0x7f73f0f90082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #21 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +0x62500006d898 is located 0 bytes to the right of 8088-byte region [0x62500006b900,0x62500006d898) +allocated by thread T0 here: + #0 0x4a8146 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xc623d0 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/gstype2.c:190:17 in gs_type2_interpret +Shadow bytes around the buggy address: + 0x0c4a80005ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4a80005ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4a80005ae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4a80005af0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4a80005b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c4a80005b10: 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a80005b20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a80005b30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a80005b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a80005b50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a80005b60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-757.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-757.txt new file mode 100644 index 000000000..db6b002d6 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-757.txt @@ -0,0 +1,252 @@ +INFO: Seed: 2714872588 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +base/seexec.c:72:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/seexec.c:72:20 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 55898 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 2147462265 + 22719 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +pdf/pdf_font1.c:680:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:680:13 in +base/wrfont.c:47:61: runtime error: signed integer overflow: 55794 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/wrfont.c:47:61 in +pdf/pdf_fapi.c:666:30: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_fapi.c:666:30 in +pdf/pdf_font1.c:868:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:868:5 in +base/gstype1.c:403:33: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:403:33 in +base/gsfont.c:924:31: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfont.c:924:31 in +base/gxtype1.c:386:13: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:386:13 in +base/gxtype1.c:409:17: runtime error: left shift of negative value -219 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:409:17 in +base/gxtype1.c:407:17: runtime error: left shift of negative value -40 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:407:17 in +base/gxtype1.c:530:13: runtime error: signed integer overflow: 42785 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:530:13 in +base/gxtype1.c:413:17: runtime error: signed integer overflow: 57489 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:413:17 in +base/gxtype1.c:415:26: runtime error: left shift of negative value -1141 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:415:26 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_t' (aka 'struct pdf_font_descriptor_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_common_t' (aka 'struct pdf_font_descriptor_common_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +base/gscoord.c:607:32: runtime error: shift exponent 42 is too large for 32-bit type 'fixed' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscoord.c:607:32 in +base/gstype1.c:584:17: runtime error: left shift of negative value -524 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:584:17 in +base/gstype1.c:350:17: runtime error: signed integer overflow: 42785 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:350:17 in +base/gstype1.c:582:17: runtime error: left shift of negative value -40 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:582:17 in +devices/vector/gdevpdfu.c:696:16: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdfu.c:696:16 in +base/gsdparam.c:1710:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:33 in +base/gsdparam.c:1710:61: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:61 in +base/gsicc.c:685:46: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc.c:685:46 in +base/gxpath.c:978:12: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:978:12 in +base/gxpflat.c:272:22: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:272:22 in +pdf/pdf_int.c:299:34: runtime error: signed integer overflow: 1298494949 * 10 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_int.c:299:34 in +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000002327548 (pc 0x0000013ce072 bp 0x000000464ea9 sp 0x7ffd012d4ec0 T0) +==1==The signal is caused by a WRITE memory access. + #0 0x13ce072 in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:73:14 + #1 0x13ce072 in pdfi_free_dict /src/ghostpdl/./pdf/pdf_dict.c:45:13 + #2 0x1588779 in pdfi_free_object /src/ghostpdl/./pdf/pdf_obj.c:284:13 + #3 0x13ce0a7 in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:100:5 + #4 0x13ce0a7 in pdfi_free_dict /src/ghostpdl/./pdf/pdf_dict.c:43:13 + #5 0x1588779 in pdfi_free_object /src/ghostpdl/./pdf/pdf_obj.c:284:13 + #6 0x13ce0a7 in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:100:5 + #7 0x13ce0a7 in pdfi_free_dict /src/ghostpdl/./pdf/pdf_dict.c:43:13 + #8 0x1588779 in pdfi_free_object /src/ghostpdl/./pdf/pdf_obj.c:284:13 + #9 0x158906b in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:100:5 + #10 0x158906b in pdfi_free_stream /src/ghostpdl/./pdf/pdf_obj.c:246:5 + #11 0x1588832 in pdfi_free_object /src/ghostpdl/./pdf/pdf_obj.c:287:13 + #12 0x13be8dc in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:100:5 + #13 0x13be8dc in pdfi_clear_context /src/ghostpdl/./pdf/ghostpdf.c:2074:13 + #14 0x13caf9c in pdfi_free_context /src/ghostpdl/./pdf/ghostpdf.c:2110:5 + #15 0x13a2225 in zPDFclose /src/ghostpdl/./psi/zpdfops.c:618:16 + #16 0x11b91a9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0x11b2256 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0x11b19f7 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x51e8a6 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x51ebee in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x51ebee in __covrec_354B81557B0956Cu /src/ghostpdl/./psi/imain.c:889:12 + #22 0x519dfb in __covrec_218C571E84FB63F4 /src/ghostpdl/./psi/imain.c:870:12 + #23 0x15a94e6 in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #24 0x15a4c81 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #25 0x15a0e05 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #26 0x15a9251 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #27 0x119b038 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x51580c in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #29 0x4e5aa2 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:130:8 + #30 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #31 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #32 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #33 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #34 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #35 0x7fc2fedb9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #36 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_stack.h:73:14 in pdfi_countdown_impl +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-772.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-772.txt new file mode 100644 index 000000000..106459a6c --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-772.txt @@ -0,0 +1,338 @@ +INFO: Seed: 2727126686 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +base/gxpath.c:978:12: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:978:12 in +pdf/pdf_int.c:299:34: runtime error: signed integer overflow: 349342849 * 10 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_int.c:299:34 in +base/gsfcmap.c:299:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfcmap.c:299:5 in +base/seexec.c:72:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/seexec.c:72:20 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 55898 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 2147462265 + 22719 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +pdf/pdf_font1.c:680:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:680:13 in +base/wrfont.c:47:61: runtime error: signed integer overflow: 55794 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/wrfont.c:47:61 in +pdf/pdf_fapi.c:666:30: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_fapi.c:666:30 in +pdf/pdf_font1.c:868:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:868:5 in +base/gxpflat.c:272:22: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:272:22 in +base/gstype1.c:403:33: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:403:33 in +base/gsfont.c:924:31: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfont.c:924:31 in +base/gxtype1.c:386:13: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:386:13 in +base/gxtype1.c:409:17: runtime error: left shift of negative value -219 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:409:17 in +base/gxtype1.c:407:17: runtime error: left shift of negative value -40 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:407:17 in +base/gxtype1.c:530:13: runtime error: signed integer overflow: 42785 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:530:13 in +base/gxtype1.c:413:17: runtime error: signed integer overflow: 57489 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:413:17 in +base/gxtype1.c:415:26: runtime error: left shift of negative value -1141 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:415:26 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_t' (aka 'struct pdf_font_descriptor_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_common_t' (aka 'struct pdf_font_descriptor_common_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +pdf/pdf_font11.c:452:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font11.c:452:5 in +devices/vector/gdevpsft.c:802:24: runtime error: member access within null pointer of type 'ttf_OS_2_t' (aka 'struct ttf_OS_2_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:802:24 in +devices/vector/gdevpdfu.c:696:16: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdfu.c:696:16 in +base/gxccache.c:99:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccache.c:99:13 in +base/ttfinp.c:57:27: runtime error: left shift of 166 by 24 places cannot be represented in type 'int32' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfinp.c:57:27 in +base/ttfmain.c:275:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:275:36 in +base/ttfmain.c:277:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:277:36 in +base/ttfmain.c:281:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:281:36 in +base/ttfmain.c:283:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:283:36 in +base/ttfmain.c:285:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:285:36 in +base/ttfmain.c:289:36: runtime error: member access within null pointer of type 'sfnt_MetricsHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:289:36 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +base/ttfmain.c:1011:95: runtime error: left shift of negative value -128 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:1011:95 in +base/ttfmain.c:1012:95: runtime error: left shift of negative value -128 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:1012:95 in +base/gsdparam.c:1710:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:33 in +base/gsdparam.c:1710:61: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:61 in +base/gxccman.c:798:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:798:27 in +base/gxccman.c:451:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:451:9 in +psi/zfont.c:510:18: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zfont.c:510:18 in +devices/vector/gdevpdtd.c:499:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:499:27 in +devices/vector/gdevpsft.c:495:22: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:495:22 in +devices/vector/gdevpdtd.c:416:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:416:49 in +devices/vector/gdevpdtd.c:417:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:417:49 in +base/gscoord.c:607:32: runtime error: shift exponent 42 is too large for 32-bit type 'fixed' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscoord.c:607:32 in +base/gstype1.c:584:17: runtime error: left shift of negative value -524 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:584:17 in +base/gstype1.c:350:17: runtime error: signed integer overflow: 42785 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:350:17 in +base/gstype1.c:582:17: runtime error: left shift of negative value -40 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:582:17 in +devices/vector/gdevpsfx.c:69:9: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:69:9 in +devices/vector/gdevpsfx.c:166:19: runtime error: index -1 out of bounds for type 'fixed[48]' (aka 'int[48]') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:166:19 in +devices/vector/gdevpsfx.c:183:9: runtime error: signed integer overflow: 62183 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:183:9 in +devices/vector/gdevpsfx.c:493:23: runtime error: index -1 out of bounds for type 'fixed[48]' (aka 'int[48]') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:493:23 in +devices/vector/gdevpsfx.c:189:17: runtime error: left shift of negative value -524 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:189:17 in +devices/vector/gdevpsfx.c:254:13: runtime error: signed integer overflow: 42785 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:254:13 in +devices/vector/gdevpsfx.c:187:17: runtime error: left shift of negative value -40 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:187:17 in +devices/vector/gdevpsfx.c:569:23: runtime error: index -1 out of bounds for type 'fixed[48]' (aka 'int[48]') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:569:23 in +devices/vector/gdevpdtb.c:169:60: runtime error: left shift of negative value -19 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtb.c:169:60 in +devices/vector/gdevpdtf.c:981:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtf.c:981:9 in +devices/vector/gdevpdf.c:1581:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1581:23 in +devices/vector/gdevpdf.c:1582:39: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1582:39 in +devices/vector/gdevpdf.c:1582:37: runtime error: signed integer overflow: 989 - -9223372036854775808 cannot be represented in type 'long' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1582:37 in +devices/vector/gdevpdf.c:1582:21: runtime error: signed integer overflow: -9223372036854682926 + -9223372036854774819 cannot be represented in type 'long' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1582:21 in +devices/vector/gdevpdf.c:1607:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1607:23 in +devices/vector/gdevpdf.c:1608:39: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1608:39 in +devices/vector/gdevpdf.c:1608:37: runtime error: signed integer overflow: 989 - -9223372036854775808 cannot be represented in type 'long' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1608:37 in +devices/vector/gdevpdf.c:1608:21: runtime error: signed integer overflow: -9223372036854682926 + -9223372036854774819 cannot be represented in type 'long' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1608:21 in +base/fapi_ft.c:1943:43: runtime error: member access within null pointer of type 'struct FT_OutlineGlyphRec_' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/fapi_ft.c:1943:43 in +base/fapi_ft.c:1944:42: runtime error: member access within null pointer of type 'struct FT_BitmapGlyphRec_' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/fapi_ft.c:1944:42 in +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x63100130bb16 (pc 0x000001514f25 bp 0x63100130bb16 sp 0x7ffe88ad7290 T0) +==1==The signal is caused by a READ memory access. + #0 0x1514f25 in pdfi_cidtype2_get_glyph_index /src/ghostpdl/./pdf/pdf_font11.c:73:23 + #1 0x1691693 in gs_type42_glyph_info /src/ghostpdl/./base/gstype42.c:1446:23 + #2 0x151386b in pdfi_cidtype2_glyph_info /src/ghostpdl/./pdf/pdf_font11.c:90:12 + #3 0xa7eeeb in compare_glyphs /src/ghostpdl/./devices/gxfcopy.c:811:17 + #4 0xa7c87c in gs_copied_can_copy_glyphs /src/ghostpdl/./devices/gxfcopy.c:2620:12 + #5 0xa4cb52 in pdf_obtain_cidfont_resource /src/ghostpdl/./devices/vector/gdevpdtt.c:1342:16 + #6 0x19f3161 in scan_cmap_text /src/ghostpdl/./devices/vector/gdevpdtc.c:502:28 + #7 0x19f1c4b in process_cmap_text /src/ghostpdl/./devices/vector/gdevpdtc.c:965:12 + #8 0xa6619f in pdf_text_process /src/ghostpdl/./devices/vector/gdevpdtt.c:3758:16 + #9 0xcb091a in gs_text_process /src/ghostpdl/./base/gstext.c:670:12 + #10 0x153de59 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:447:16 + #11 0x1534add in pdfi_show_Tr_preserve /src/ghostpdl/./pdf/pdf_text.c:791:16 + #12 0x1534add in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:842:16 + #13 0x1536db2 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1081:12 + #14 0x13f880b in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1646:24 + #15 0x13f6c91 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #16 0x1469813 in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:116:28 + #17 0x1469813 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #18 0x1469813 in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #19 0x13a629d in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #20 0x11b91a9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #21 0x11b2256 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #22 0x11b19f7 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #23 0x51e8a6 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #24 0x51ebee in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #25 0x51ebee in __covrec_354B81557B0956Cu /src/ghostpdl/./psi/imain.c:889:12 + #26 0x519dfb in __covrec_218C571E84FB63F4 /src/ghostpdl/./psi/imain.c:870:12 + #27 0x15a94e6 in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #28 0x15a4c81 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #29 0x15a0e05 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #30 0x15a9251 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #31 0x119b038 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #32 0x51580c in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #33 0x4e5aa2 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:130:8 + #34 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #35 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #36 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #37 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #38 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #39 0x7f078edcc082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #40 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_font11.c:73:23 in pdfi_cidtype2_get_glyph_index +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-797.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-797.txt new file mode 100644 index 000000000..02fc6965d --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-797.txt @@ -0,0 +1,308 @@ +INFO: Seed: 2766147117 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +base/gsfcmap.c:299:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfcmap.c:299:5 in +base/seexec.c:72:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/seexec.c:72:20 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 55898 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 2147462265 + 22719 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +pdf/pdf_font1.c:680:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:680:13 in +base/wrfont.c:47:61: runtime error: signed integer overflow: 55794 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/wrfont.c:47:61 in +pdf/pdf_fapi.c:666:30: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_fapi.c:666:30 in +pdf/pdf_font1.c:868:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:868:5 in +base/gstype1.c:403:33: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:403:33 in +base/gsfont.c:924:31: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfont.c:924:31 in +base/gxtype1.c:386:13: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:386:13 in +base/gxtype1.c:409:17: runtime error: left shift of negative value -219 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:409:17 in +base/gxtype1.c:407:17: runtime error: left shift of negative value -40 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:407:17 in +base/gxtype1.c:530:13: runtime error: signed integer overflow: 42785 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:530:13 in +base/gxtype1.c:413:17: runtime error: signed integer overflow: 57489 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:413:17 in +base/gxtype1.c:415:26: runtime error: left shift of negative value -1141 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:415:26 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_t' (aka 'struct pdf_font_descriptor_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_common_t' (aka 'struct pdf_font_descriptor_common_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +pdf/pdf_fontTT.c:569:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_fontTT.c:569:5 in +devices/vector/gdevpsft.c:802:24: runtime error: member access within null pointer of type 'ttf_OS_2_t' (aka 'struct ttf_OS_2_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:802:24 in +base/gscoord.c:607:32: runtime error: shift exponent 42 is too large for 32-bit type 'fixed' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscoord.c:607:32 in +devices/vector/gdevpdfu.c:696:16: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdfu.c:696:16 in +base/gsdparam.c:1710:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:33 in +base/gsdparam.c:1710:61: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:61 in +psi/zfont.c:510:18: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zfont.c:510:18 in +devices/vector/gdevpdtd.c:416:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:416:49 in +devices/vector/gdevpdtd.c:417:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:417:49 in +devices/vector/gdevpsfx.c:69:9: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:69:9 in +devices/vector/gdevpsfx.c:166:19: runtime error: index -1 out of bounds for type 'fixed[48]' (aka 'int[48]') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:166:19 in +devices/vector/gdevpsfx.c:183:9: runtime error: signed integer overflow: 62183 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:183:9 in +devices/vector/gdevpsfx.c:493:23: runtime error: index -1 out of bounds for type 'fixed[48]' (aka 'int[48]') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:493:23 in +base/gxccache.c:99:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccache.c:99:13 in +base/ttfinp.c:57:27: runtime error: left shift of 223 by 24 places cannot be represented in type 'int32' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfinp.c:57:27 in +base/ttfmain.c:275:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:275:36 in +base/ttfmain.c:277:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:277:36 in +base/ttfmain.c:281:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:281:36 in +base/ttfmain.c:283:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:283:36 in +base/ttfmain.c:285:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:285:36 in +base/ttfmain.c:289:36: runtime error: member access within null pointer of type 'sfnt_MetricsHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:289:36 in +base/ttfmain.c:50:23: runtime error: left shift of negative value -365 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:50:23 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x625000090d68 at pc 0x000001d67040 bp 0x7ffe1da75e90 sp 0x7ffe1da75e88 +READ of size 1 at 0x625000090d68 thread T0 + #0 0x1d6703f in Ins_NPUSHB /src/ghostpdl/./base/ttinterp.c:2342:23 + #1 0x1d52b9e in RunIns /src/ghostpdl/./base/ttinterp.c:5131:7 + #2 0x1bfd33e in Instance_Reset /src/ghostpdl/./base/ttobjs.c:834:15 + #3 0x1be21e1 in TT_Set_Instance_CharSizes /src/ghostpdl/./base/ttfmain.c:138:12 + #4 0x1be49ad in ttfFont__Open /src/ghostpdl/./base/ttfmain.c:348:12 + #5 0x169cce0 in ttfFont__Open_aux /src/ghostpdl/./base/gxttfb.c:448:12 + #6 0xe604b2 in gx_attach_tt_interpreter /src/ghostpdl/./base/gxccman.c:249:12 + #7 0xe60fa1 in gx_add_fm_pair /src/ghostpdl/./base/gxccman.c:355:20 + #8 0xe5ace3 in gx_lookup_fm_pair /src/ghostpdl/./base/gxccache.c:140:12 + #9 0x1691088 in gs_type42_glyph_outline /src/ghostpdl/./base/gstype42.c:1350:12 + #10 0xc29498 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #11 0x1696c13 in gs_type42_glyph_info_by_gid /src/ghostpdl/./base/gstype42.c:1387:16 + #12 0x1691788 in gs_type42_glyph_info /src/ghostpdl/./base/gstype42.c:1458:12 + #13 0xa1cbf4 in pdf_compute_font_descriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:469:16 + #14 0xa1f049 in pdf_finish_FontDescriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:649:17 + #15 0xa72a2f in pdf_finish_resources /src/ghostpdl/./devices/vector/gdevpdtw.c:684:24 + #16 0x8b8eb6 in __covrec_59069581604AE801u /src/ghostpdl/./devices/vector/gdevpdf.c:2785:13 + #17 0xbfcf38 in gs_closedevice /src/ghostpdl/./base/gsdevice.c:786:16 + #18 0x5217cb in __covrec_543A5F2E6E788DDu /src/ghostpdl/./psi/imain.c:1351:20 + #19 0x52362e in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #20 0x52367e in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #21 0x119c0d8 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #22 0x515aef in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #23 0x4e5ad3 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:135:8 + #24 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #25 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #26 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #27 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #28 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #29 0x7f203ea24082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #30 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +0x625000090d68 is located 0 bytes to the right of 9320-byte region [0x62500008e900,0x625000090d68) +allocated by thread T0 here: + #0 0x4a8146 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xc623d0 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/ttinterp.c:2342:23 in Ins_NPUSHB +Shadow bytes around the buggy address: + 0x0c4a8000a150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4a8000a160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4a8000a170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4a8000a180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4a8000a190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c4a8000a1a0: 00 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa fa + 0x0c4a8000a1b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a8000a1c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a8000a1d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a8000a1e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a8000a1f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-818.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-818.txt new file mode 100644 index 000000000..c7b23c409 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-818.txt @@ -0,0 +1,277 @@ +INFO: Seed: 2828804408 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +base/gxpath.c:978:12: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:978:12 in +base/gsfcmap.c:299:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfcmap.c:299:5 in +pdf/pdf_font11.c:452:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font11.c:452:5 in +devices/vector/gdevpsft.c:802:24: runtime error: member access within null pointer of type 'ttf_OS_2_t' (aka 'struct ttf_OS_2_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:802:24 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_t' (aka 'struct pdf_font_descriptor_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_common_t' (aka 'struct pdf_font_descriptor_common_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdfu.c:696:16: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdfu.c:696:16 in +base/gxccache.c:99:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccache.c:99:13 in +base/ttfinp.c:57:27: runtime error: left shift of 241 by 24 places cannot be represented in type 'int32' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfinp.c:57:27 in +base/ttfmain.c:275:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:275:36 in +base/ttfmain.c:277:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:277:36 in +base/ttfmain.c:281:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:281:36 in +base/ttfmain.c:283:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:283:36 in +base/ttfmain.c:285:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:285:36 in +base/ttfmain.c:289:36: runtime error: member access within null pointer of type 'sfnt_MetricsHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:289:36 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000128830 at pc 0x000001d75d1f bp 0x7ffd538b98e0 sp 0x7ffd538b98d8 +READ of size 1 at 0x631000128830 thread T0 + #0 0x1d75d1e in GetShortIns /src/ghostpdl/./base/ttinterp.c:736:14 + #1 0x1d671ae in Ins_NPUSHW /src/ghostpdl/./base/ttinterp.c:2368:19 + #2 0x1d52b9e in RunIns /src/ghostpdl/./base/ttinterp.c:5131:7 + #3 0x1bfd33e in Instance_Reset /src/ghostpdl/./base/ttobjs.c:834:15 + #4 0x1be21e1 in TT_Set_Instance_CharSizes /src/ghostpdl/./base/ttfmain.c:138:12 + #5 0x1be49ad in ttfFont__Open /src/ghostpdl/./base/ttfmain.c:348:12 + #6 0x169cce0 in ttfFont__Open_aux /src/ghostpdl/./base/gxttfb.c:448:12 + #7 0xe604b2 in gx_attach_tt_interpreter /src/ghostpdl/./base/gxccman.c:249:12 + #8 0xe5ff2c in gx_provide_fm_pair_attributes /src/ghostpdl/./base/gxccman.c:276:16 + #9 0x169118f in gs_type42_glyph_outline /src/ghostpdl/./base/gstype42.c:1358:9 + #10 0xc29498 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #11 0x1696c13 in gs_type42_glyph_info_by_gid /src/ghostpdl/./base/gstype42.c:1387:16 + #12 0x1691788 in gs_type42_glyph_info /src/ghostpdl/./base/gstype42.c:1458:12 + #13 0x151386b in pdfi_cidtype2_glyph_info /src/ghostpdl/./pdf/pdf_font11.c:90:12 + #14 0xa5b60b in pdf_glyph_widths /src/ghostpdl/./devices/vector/gdevpdtt.c:2810:16 + #15 0x19f500d in scan_cmap_text /src/ghostpdl/./devices/vector/gdevpdtc.c:730:32 + #16 0x19f1c4b in process_cmap_text /src/ghostpdl/./devices/vector/gdevpdtc.c:965:12 + #17 0xa6619f in pdf_text_process /src/ghostpdl/./devices/vector/gdevpdtt.c:3758:16 + #18 0xcb091a in gs_text_process /src/ghostpdl/./base/gstext.c:670:12 + #19 0x153de59 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:447:16 + #20 0x1534add in pdfi_show_Tr_preserve /src/ghostpdl/./pdf/pdf_text.c:791:16 + #21 0x1534add in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:842:16 + #22 0x1538d0b in pdfi_TJ /src/ghostpdl/./pdf/pdf_text.c:1202:20 + #23 0x13f856f in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1650:24 + #24 0x13f6c91 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #25 0x1469813 in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:116:28 + #26 0x1469813 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #27 0x1469813 in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #28 0x13a629d in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #29 0x11b91a9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #30 0x11b2256 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #31 0x11b19f7 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #32 0x51e8a6 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #33 0x51ebee in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #34 0x51ebee in __covrec_354B81557B0956Cu /src/ghostpdl/./psi/imain.c:889:12 + #35 0x519dfb in __covrec_218C571E84FB63F4 /src/ghostpdl/./psi/imain.c:870:12 + #36 0x15a94e6 in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #37 0x15a4c81 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #38 0x15a0e05 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #39 0x15a9251 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #40 0x119b038 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #41 0x51580c in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #42 0x4e5aa2 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:130:8 + #43 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #44 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #45 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #46 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #47 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #48 0x7f8480db8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #49 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +0x631000128830 is located 0 bytes to the right of 65584-byte region [0x631000118800,0x631000128830) +allocated by thread T0 here: + #0 0x4a8146 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xc623d0 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/ttinterp.c:736:14 in GetShortIns +Shadow bytes around the buggy address: + 0x0c628001d0b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001d0c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001d0d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001d0e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001d0f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c628001d100: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa + 0x0c628001d110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001d120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001d130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001d140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001d150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-855.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-855.txt new file mode 100644 index 000000000..f2ae096e5 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-855.txt @@ -0,0 +1,244 @@ +INFO: Seed: 2825922151 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +pdf/pdf_fontTT.c:569:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_fontTT.c:569:5 in +devices/vector/gdevpdfu.c:696:16: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdfu.c:696:16 in +base/gsicc.c:685:46: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc.c:685:46 in +base/gsfont.c:924:31: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfont.c:924:31 in +devices/vector/gdevpsft.c:802:24: runtime error: member access within null pointer of type 'ttf_OS_2_t' (aka 'struct ttf_OS_2_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:802:24 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_t' (aka 'struct pdf_font_descriptor_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_common_t' (aka 'struct pdf_font_descriptor_common_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +base/gxccache.c:99:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccache.c:99:13 in +base/ttfinp.c:57:27: runtime error: left shift of 163 by 24 places cannot be represented in type 'int32' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfinp.c:57:27 in +base/ttfmain.c:275:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:275:36 in +base/ttfmain.c:277:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:277:36 in +base/ttfmain.c:281:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:281:36 in +base/ttfmain.c:283:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:283:36 in +base/ttfmain.c:285:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:285:36 in +base/ttfmain.c:289:36: runtime error: member access within null pointer of type 'sfnt_MetricsHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:289:36 in +base/ttfmain.c:50:23: runtime error: left shift of negative value -25 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:50:23 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x633000071468 (pc 0x000001d5a001 bp 0x000000000000 sp 0x7fff1ce5d510 T0) +==1==The signal is caused by a WRITE memory access. + #0 0x1d5a001 in Ins_ISECT /src/ghostpdl/./base/ttinterp.c:4113:28 + #1 0x1d52b9e in RunIns /src/ghostpdl/./base/ttinterp.c:5131:7 + #2 0x1bfd33e in Instance_Reset /src/ghostpdl/./base/ttobjs.c:834:15 + #3 0x1be21e1 in TT_Set_Instance_CharSizes /src/ghostpdl/./base/ttfmain.c:138:12 + #4 0x1be49ad in ttfFont__Open /src/ghostpdl/./base/ttfmain.c:348:12 + #5 0x169cce0 in ttfFont__Open_aux /src/ghostpdl/./base/gxttfb.c:448:12 + #6 0xe604b2 in gx_attach_tt_interpreter /src/ghostpdl/./base/gxccman.c:249:12 + #7 0xe5ff2c in gx_provide_fm_pair_attributes /src/ghostpdl/./base/gxccman.c:276:16 + #8 0x169118f in gs_type42_glyph_outline /src/ghostpdl/./base/gstype42.c:1358:9 + #9 0xc29498 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #10 0x1696c13 in gs_type42_glyph_info_by_gid /src/ghostpdl/./base/gstype42.c:1387:16 + #11 0x1691788 in gs_type42_glyph_info /src/ghostpdl/./base/gstype42.c:1458:12 + #12 0x19fdd51 in process_text_estimate_bbox /src/ghostpdl/./devices/vector/gdevpdte.c:689:16 + #13 0x19fdd51 in pdf_process_string /src/ghostpdl/./devices/vector/gdevpdte.c:856:16 + #14 0x19fd013 in pdf_process_string_aux /src/ghostpdl/./devices/vector/gdevpdte.c:81:12 + #15 0x1a0ff26 in process_plain_text /src/ghostpdl/./devices/vector/gdevpdte.c:1841:16 + #16 0xa660ea in pdf_text_process /src/ghostpdl/./devices/vector/gdevpdtt.c:3752:16 + #17 0xcb091a in gs_text_process /src/ghostpdl/./base/gstext.c:670:12 + #18 0x153de59 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:447:16 + #19 0x1534add in pdfi_show_Tr_preserve /src/ghostpdl/./pdf/pdf_text.c:791:16 + #20 0x1534add in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:842:16 + #21 0x1538d0b in pdfi_TJ /src/ghostpdl/./pdf/pdf_text.c:1202:20 + #22 0x13f856f in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1650:24 + #23 0x13f6c91 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #24 0x1469e7e in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #25 0x1469e7e in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #26 0x1469e7e in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #27 0x13a629d in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #28 0x11b91a9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #29 0x11b2256 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #30 0x11b19f7 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #31 0x51e8a6 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #32 0x51ebee in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #33 0x51ebee in __covrec_354B81557B0956Cu /src/ghostpdl/./psi/imain.c:889:12 + #34 0x519dfb in __covrec_218C571E84FB63F4 /src/ghostpdl/./psi/imain.c:870:12 + #35 0x15a94e6 in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #36 0x15a4c81 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #37 0x15a0e05 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #38 0x15a9251 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #39 0x119b038 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #40 0x51580c in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #41 0x4e5aa2 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:130:8 + #42 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #43 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #44 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #45 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #46 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #47 0x7fe1afb9c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #48 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/ttinterp.c:4113:28 in Ins_ISECT +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-866.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-866.txt new file mode 100644 index 000000000..f469c2d37 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-866.txt @@ -0,0 +1,276 @@ +INFO: Seed: 2812977391 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +base/gxpath.c:978:12: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:978:12 in +pdf/pdf_font1C.c:2198:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2198:5 in +pdf/pdf_font1C.c:2125:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2125:5 in +pdf/pdf_font1C.c:2784:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2784:17 in +base/gstype2.c:188:17: runtime error: left shift of negative value -3 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype2.c:188:17 in +base/gstype2.c:190:17: runtime error: left shift of negative value -291 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype2.c:190:17 in +base/gsfont.c:924:31: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfont.c:924:31 in +base/gxtype1.c:407:17: runtime error: left shift of negative value -3 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:407:17 in +base/gxtype1.c:409:17: runtime error: left shift of negative value -500 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:409:17 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_t' (aka 'struct pdf_font_descriptor_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_common_t' (aka 'struct pdf_font_descriptor_common_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +base/gscoord.c:607:32: runtime error: shift exponent 42 is too large for 32-bit type 'fixed' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscoord.c:607:32 in +base/gxpflat.c:272:22: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:272:22 in +base/gxtype1.c:430:26: runtime error: left shift of negative value -8969 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:430:26 in +base/gxtype1.c:415:26: runtime error: left shift of 13598720 by 8 places cannot be represented in type 'fixed' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:415:26 in +base/seexec.c:72:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/seexec.c:72:20 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 55898 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 2147462265 + 22719 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +pdf/pdf_font1.c:680:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:680:13 in +base/wrfont.c:47:61: runtime error: signed integer overflow: 55794 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/wrfont.c:47:61 in +pdf/pdf_fapi.c:666:30: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_fapi.c:666:30 in +pdf/pdf_font1.c:868:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:868:5 in +devices/vector/gdevpdfu.c:696:16: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdfu.c:696:16 in +base/gsdparam.c:1710:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:33 in +base/gsdparam.c:1710:61: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:61 in +psi/zfont.c:510:18: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zfont.c:510:18 in +devices/vector/gdevpdtd.c:416:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:416:49 in +devices/vector/gdevpdtd.c:417:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:417:49 in +devices/vector/gdevpdtd.c:499:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:499:27 in +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7f87434b181c at pc 0x000001923750 bp 0x7ffebcd76b50 sp 0x7ffebcd76b48 +READ of size 4 at 0x7f87434b181c thread T0 + #0 0x192374f in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:646:29 + #1 0xa87908 in copied_type1_glyph_outline /src/ghostpdl/./devices/gxfcopy.c:1108:16 + #2 0xc29498 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #3 0x18c95d8 in gs_type1_glyph_info /src/ghostpdl/./base/gxtype1.c:616:16 + #4 0xa1cbf4 in pdf_compute_font_descriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:469:16 + #5 0xa1f049 in pdf_finish_FontDescriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:649:17 + #6 0xa72a2f in pdf_finish_resources /src/ghostpdl/./devices/vector/gdevpdtw.c:684:24 + #7 0x8b8eb6 in __covrec_59069581604AE801u /src/ghostpdl/./devices/vector/gdevpdf.c:2785:13 + #8 0xbfcf38 in gs_closedevice /src/ghostpdl/./base/gsdevice.c:786:16 + #9 0x5217cb in __covrec_543A5F2E6E788DDu /src/ghostpdl/./psi/imain.c:1351:20 + #10 0x52362e in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #11 0x52367e in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #12 0x119c0d8 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #13 0x515aef in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #14 0x4e5ad3 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:135:8 + #15 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #16 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #17 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #18 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #19 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #20 0x7f87459cc082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #21 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +Address 0x7f87434b181c is located in stack of thread T0 at offset 28 in frame + #0 0x191b28f in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:124 + + This frame has 4 object(s): + [32, 224) 'cstack' (line 129) <== Memory access at offset 28 underflows this variable + [288, 300) 'mask' (line 459) + [320, 336) 'join' (line 851) + [352, 368) 'end' (line 851) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-underflow /src/ghostpdl/./base/gstype2.c:646:29 in gs_type2_interpret +Shadow bytes around the buggy address: + 0x0ff16868e2b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff16868e2c0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff16868e2d0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff16868e2e0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff16868e2f0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0ff16868e300: f1 f1 f1[f1]00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff16868e310: 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 + 0x0ff16868e320: f2 f2 f2 f2 f8 f8 f2 f2 f8 f8 f2 f2 f8 f8 f3 f3 + 0x0ff16868e330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff16868e340: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff16868e350: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-888.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-888.txt new file mode 100644 index 000000000..6a9553c04 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-888.txt @@ -0,0 +1,258 @@ +INFO: Seed: 2831630626 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +pdf/pdf_font1C.c:2198:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2198:5 in +pdf/pdf_font1C.c:2125:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2125:5 in +pdf/pdf_font1C.c:2784:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2784:17 in +base/gstype2.c:188:17: runtime error: left shift of negative value -34 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype2.c:188:17 in +base/gstype2.c:190:17: runtime error: left shift of negative value -317 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype2.c:190:17 in +base/gsfont.c:924:31: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfont.c:924:31 in +base/gxtype1.c:407:17: runtime error: left shift of negative value -24 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:407:17 in +base/gxtype1.c:409:17: runtime error: left shift of negative value -343 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:409:17 in +base/gxtype1.c:430:26: runtime error: left shift of negative value -1898 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:430:26 in +base/gxtype1.c:415:26: runtime error: left shift of 124358029 by 8 places cannot be represented in type 'fixed' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:415:26 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_t' (aka 'struct pdf_font_descriptor_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_common_t' (aka 'struct pdf_font_descriptor_common_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdfu.c:696:16: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdfu.c:696:16 in +base/gsdparam.c:1710:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:33 in +base/gsdparam.c:1710:61: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:61 in +psi/zfont.c:510:18: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zfont.c:510:18 in +devices/vector/gdevpdtd.c:416:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:416:49 in +devices/vector/gdevpdtd.c:417:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:417:49 in +base/gscoord.c:607:32: runtime error: shift exponent 42 is too large for 32-bit type 'fixed' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscoord.c:607:32 in +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f63aa9502e0 at pc 0x000001923c17 bp 0x7ffdadc7c210 sp 0x7ffdadc7c208 +READ of size 4 at 0x7f63aa9502e0 thread T0 + #0 0x1923c16 in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:496:46 + #1 0xa87908 in copied_type1_glyph_outline /src/ghostpdl/./devices/gxfcopy.c:1108:16 + #2 0xc29498 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #3 0x18c95d8 in gs_type1_glyph_info /src/ghostpdl/./base/gxtype1.c:616:16 + #4 0xa1cbf4 in pdf_compute_font_descriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:469:16 + #5 0xa1f049 in pdf_finish_FontDescriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:649:17 + #6 0xa72a2f in pdf_finish_resources /src/ghostpdl/./devices/vector/gdevpdtw.c:684:24 + #7 0x8b8eb6 in __covrec_59069581604AE801u /src/ghostpdl/./devices/vector/gdevpdf.c:2785:13 + #8 0xbfcf38 in gs_closedevice /src/ghostpdl/./base/gsdevice.c:786:16 + #9 0x5217cb in __covrec_543A5F2E6E788DDu /src/ghostpdl/./psi/imain.c:1351:20 + #10 0x52362e in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #11 0x52367e in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #12 0x119c0d8 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #13 0x515aef in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #14 0x4e5ad3 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:135:8 + #15 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #16 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #17 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #18 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #19 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #20 0x7f63aceed082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #21 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +Address 0x7f63aa9502e0 is located in stack of thread T0 at offset 224 in frame + #0 0x191b28f in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:124 + + This frame has 4 object(s): + [32, 224) 'cstack' (line 129) <== Memory access at offset 224 overflows this variable + [288, 300) 'mask' (line 459) + [320, 336) 'join' (line 851) + [352, 368) 'end' (line 851) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ghostpdl/./base/gstype2.c:496:46 in gs_type2_interpret +Shadow bytes around the buggy address: + 0x0fecf5522000: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fecf5522010: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fecf5522020: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fecf5522030: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fecf5522040: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fecf5522050: 00 00 00 00 00 00 00 00 00 00 00 00[f2]f2 f2 f2 + 0x0fecf5522060: f2 f2 f2 f2 f8 f8 f2 f2 f8 f8 f2 f2 f8 f8 f3 f3 + 0x0fecf5522070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fecf5522080: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fecf5522090: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fecf55220a0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-949.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-949.txt new file mode 100644 index 000000000..1dd26f805 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2022-949.txt @@ -0,0 +1,484 @@ +INFO: Seed: 2769189179 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +pdf/pdf_fontTT.c:569:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_fontTT.c:569:5 in +devices/vector/gdevpdfu.c:696:16: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdfu.c:696:16 in +base/gsicc.c:685:46: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc.c:685:46 in +devices/vector/gdevpsft.c:802:24: runtime error: member access within null pointer of type 'ttf_OS_2_t' (aka 'struct ttf_OS_2_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:802:24 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_t' (aka 'struct pdf_font_descriptor_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_common_t' (aka 'struct pdf_font_descriptor_common_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +base/gxccache.c:99:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccache.c:99:13 in +base/ttfinp.c:57:27: runtime error: left shift of 163 by 24 places cannot be represented in type 'int32' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfinp.c:57:27 in +base/ttfmain.c:275:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:275:36 in +base/ttfmain.c:277:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:277:36 in +base/ttfmain.c:281:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:281:36 in +base/ttfmain.c:283:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:283:36 in +base/ttfmain.c:285:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:285:36 in +base/ttfmain.c:289:36: runtime error: member access within null pointer of type 'sfnt_MetricsHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:289:36 in +base/ttfmain.c:50:23: runtime error: left shift of negative value -25 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:50:23 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +base/gxccman.c:451:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:451:9 in +base/gxpath.c:978:12: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:978:12 in +base/gxpflat.c:272:22: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:272:22 in +base/seexec.c:72:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/seexec.c:72:20 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 55898 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 2147462265 + 22719 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +pdf/pdf_font1.c:680:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:680:13 in +base/wrfont.c:47:61: runtime error: signed integer overflow: 55794 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/wrfont.c:47:61 in +pdf/pdf_fapi.c:666:30: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_fapi.c:666:30 in +pdf/pdf_font1.c:868:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:868:5 in +base/gstype1.c:403:33: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:403:33 in +base/gsfont.c:924:31: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfont.c:924:31 in +base/gxtype1.c:386:13: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:386:13 in +base/gxtype1.c:409:17: runtime error: left shift of negative value -219 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:409:17 in +base/gxtype1.c:407:17: runtime error: left shift of negative value -40 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:407:17 in +base/gxtype1.c:530:13: runtime error: signed integer overflow: 42785 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:530:13 in +base/gxtype1.c:413:17: runtime error: signed integer overflow: 57489 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:413:17 in +base/gxtype1.c:415:26: runtime error: left shift of negative value -1141 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:415:26 in +base/gscoord.c:607:32: runtime error: shift exponent 42 is too large for 32-bit type 'fixed' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscoord.c:607:32 in +base/gstype1.c:584:17: runtime error: left shift of negative value -729 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:584:17 in +base/gstype1.c:582:17: runtime error: left shift of negative value -8 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:582:17 in +base/gstype1.c:350:17: runtime error: signed integer overflow: 42785 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:350:17 in +base/gsdparam.c:1710:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:33 in +base/gsdparam.c:1710:61: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:61 in +base/gxccman.c:798:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:798:27 in +pdf/pdf_int.c:299:34: runtime error: signed integer overflow: 480847669 * 10 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_int.c:299:34 in +pdf/pdf_int.c:162:15: runtime error: signed integer overflow: 504516514 * 10 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_int.c:162:15 in +base/gspath.c:88:14: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:88:14 in +base/gspath.c:88:14: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:88:14 in +base/gspath.c:89:14: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:89:14 in +base/gspath.c:89:14: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:89:14 in +base/gspath.c:88:14: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:88:14 in +base/gspath.c:89:14: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:89:14 in +base/gspath.c:88:14: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:88:14 in +base/gspath.c:89:14: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:89:14 in +base/gxpcopy.c:126:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcopy.c:126:43 in +base/gxpflat.c:162:5: runtime error: left shift of negative value -73 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:162:5 in +base/gxpflat.c:162:5: runtime error: left shift of negative value -48 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:162:5 in +base/gxpflat.c:168:10: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:168:10 in +base/gxpflat.c:168:10: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:168:10 in +base/gxpflat.c:168:28: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:168:28 in +base/gxpflat.c:168:28: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:168:28 in +base/gxpflat.c:169:10: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:169:10 in +base/gxpflat.c:169:10: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:169:10 in +base/gxpflat.c:169:28: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:169:28 in +base/gxpflat.c:169:28: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:169:28 in +base/gxpflat.c:170:10: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:170:10 in +base/gxpflat.c:170:10: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:170:10 in +base/gxpflat.c:170:28: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:170:28 in +base/gxpflat.c:170:28: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:170:28 in +base/gxpflat.c:228:20: runtime error: left shift of negative value -39 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:228:20 in +base/gxpflat.c:231:22: runtime error: left shift of negative value -101 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:231:22 in +base/gxpflat.c:231:40: runtime error: left shift of negative value -303 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:231:40 in +base/gxpflat.c:160:5: runtime error: left shift of negative value -5 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:160:5 in +base/gxpflat.c:160:5: runtime error: left shift of negative value -7 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:160:5 in +base/gxpflat.c:229:20: runtime error: left shift of negative value -39 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:229:20 in +base/gxpflat.c:230:22: runtime error: left shift of negative value -17 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:230:22 in +base/gxpflat.c:230:40: runtime error: left shift of negative value -51 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:230:40 in +base/gxpflat.c:71:62: runtime error: signed integer overflow: -2147093958 - 2147010717 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:71:62 in +base/gxpflat.c:76:33: runtime error: signed integer overflow: 33525057 + 2146927537 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:76:33 in +base/gxpflat.c:162:5: runtime error: signed integer overflow: -2146064855 - 2146314578 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:162:5 in +base/gxpflat.c:162:5: runtime error: signed integer overflow: -2454113 - 2146314578 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:162:5 in +base/gxpflat.c:162:5: runtime error: signed integer overflow: 2147093958 + 1073546979 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:162:5 in +base/gxpflat.c:72:58: runtime error: signed integer overflow: -1136598291 - 1149589120 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:72:58 in +base/gxpflat.c:53:24: runtime error: signed integer overflow: -2147227647 - 2147227647 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:53:24 in +base/gxpflat.c:72:36: runtime error: signed integer overflow: -477366 + -2147227647 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:72:36 in +base/gxpflat.c:160:5: runtime error: signed integer overflow: -2147227647 - 2146526708 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:160:5 in +base/gxpflat.c:162:5: runtime error: signed integer overflow: -2097384839 - 89444496 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:162:5 in +base/gxpflat.c:160:5: runtime error: signed integer overflow: -2147026538 + -1073513269 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:160:5 in +base/gxpflat.c:160:5: runtime error: signed integer overflow: -1610166306 - 1074427489 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:160:5 in +base/gxpflat.c:160:5: runtime error: signed integer overflow: -1610170871 - 1074427489 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:160:5 in +base/gxpcopy.c:318:28: runtime error: signed integer overflow: 339237 - -2147227647 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcopy.c:318:28 in +base/gxpflat.c:160:5: runtime error: signed integer overflow: 2147226828 - -2147227647 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:160:5 in +base/gxpflat.c:162:5: runtime error: signed integer overflow: 582609807 - -1944547758 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:162:5 in +base/gxpflat.c:70:57: runtime error: signed integer overflow: -2147227647 - 12881837 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:70:57 in +base/gxpflat.c:71:51: runtime error: signed integer overflow: 770781120 - -2147227647 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:71:51 in +base/gxpflat.c:162:5: runtime error: signed integer overflow: -2147227647 - 770781120 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:162:5 in +base/gxpflat.c:162:5: runtime error: signed integer overflow: 12881837 - -2147227647 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:162:5 in +base/gxpcopy.c:318:45: runtime error: signed integer overflow: -2147227647 - 770781120 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcopy.c:318:45 in +base/gxacpath.c:259:39: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxacpath.c:259:39 in +base/gxacpath.c:260:39: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxacpath.c:260:39 in +base/gxacpath.c:261:47: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxacpath.c:261:47 in +base/gxacpath.c:262:47: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxacpath.c:262:47 in +base/gxfill.c:321:22: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxfill.c:321:22 in +base/gxscanc.c:3393:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxscanc.c:3393:17 in +base/gxscanc.c:3394:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxscanc.c:3394:17 in +base/gxdtfill.h:138:24: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxdtfill.h:138:24 in +base/gxdtfill.h:139:24: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxdtfill.h:139:24 in +base/gxdtfill.h:264:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxdtfill.h:264:13 in +base/gxdtfill.h:264:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxdtfill.h:264:33 in +base/gxdtfill.h:273:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxdtfill.h:273:13 in +base/gxdtfill.h:273:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxdtfill.h:273:33 in +psi/zfont.c:510:18: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zfont.c:510:18 in +devices/vector/gdevpdtd.c:416:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:416:49 in +devices/vector/gdevpdtd.c:417:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:417:49 in +devices/vector/gdevpdtd.c:499:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:499:27 in +devices/vector/gdevpsfx.c:69:9: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:69:9 in +devices/vector/gdevpsfx.c:166:19: runtime error: index -1 out of bounds for type 'fixed[48]' (aka 'int[48]') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:166:19 in +devices/vector/gdevpsfx.c:183:9: runtime error: signed integer overflow: 62183 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:183:9 in +devices/vector/gdevpsfx.c:493:23: runtime error: index -1 out of bounds for type 'fixed[48]' (aka 'int[48]') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:493:23 in +devices/vector/gdevpsfx.c:189:17: runtime error: left shift of negative value -219 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:189:17 in +devices/vector/gdevpsfx.c:569:23: runtime error: index -1 out of bounds for type 'fixed[48]' (aka 'int[48]') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:569:23 in +devices/vector/gdevpsfx.c:254:13: runtime error: signed integer overflow: 42785 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:254:13 in +devices/vector/gdevpsfx.c:187:17: runtime error: left shift of negative value -40 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:187:17 in +devices/vector/gdevpsft.c:495:22: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:495:22 in +devices/vector/gdevpsft.c:601:27: runtime error: member access within null pointer of type 'ttf_OS_2_t' (aka 'struct ttf_OS_2_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:601:27 in +devices/vector/gdevpsft.c:602:16: runtime error: member access within null pointer of type 'ttf_OS_2_t' (aka 'struct ttf_OS_2_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:602:16 in +devices/vector/gdevpdtb.c:169:60: runtime error: left shift of negative value -95 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtb.c:169:60 in +devices/vector/gdevpdtf.c:981:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtf.c:981:9 in +devices/vector/gdevpdf.c:1581:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1581:23 in +devices/vector/gdevpdf.c:1582:39: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1582:39 in +devices/vector/gdevpdf.c:1582:37: runtime error: signed integer overflow: 411 - -9223372036854775808 cannot be represented in type 'long' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1582:37 in +devices/vector/gdevpdf.c:1582:21: runtime error: signed integer overflow: -9223372036854593733 + -9223372036854775397 cannot be represented in type 'long' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1582:21 in +devices/vector/gdevpdf.c:1607:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1607:23 in +devices/vector/gdevpdf.c:1608:39: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1608:39 in +devices/vector/gdevpdf.c:1608:37: runtime error: signed integer overflow: 411 - -9223372036854775808 cannot be represented in type 'long' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1608:37 in +devices/vector/gdevpdf.c:1608:21: runtime error: signed integer overflow: -9223372036854593733 + -9223372036854775397 cannot be represented in type 'long' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:1608:21 in +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100001ed58 at pc 0x000000a15687 bp 0x7ffc6d3c6790 sp 0x7ffc6d3c6788 +READ of size 8 at 0x61100001ed58 thread T0 + #0 0xa15686 in gp_fflush /src/ghostpdl/./base/gp.h:296:16 + #1 0xa15686 in s_file_write_flush /src/ghostpdl/./base/sfxstdio.c:232:5 + #2 0x7150c1 in sclose /src/ghostpdl/./base/stream.c:445:18 + #3 0x712236 in __covrec_E41827ADD4171695u /src/ghostpdl/./base/stream.c:91:9 + #4 0x12e985e in restore_finalize /src/ghostpdl/./psi/isave.c:954:13 + #5 0x12ea5dc in alloc_restore_all /src/ghostpdl/./psi/isave.c:901:13 + #6 0x5221c1 in __covrec_2501B5FECECCD151u /src/ghostpdl/./psi/imain.c:1391:20 + #7 0x52362e in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #8 0x52367e in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #9 0x119c0d8 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #10 0x515aef in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #11 0x4e5ad3 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:135:8 + #12 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #13 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #14 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #15 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #16 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #17 0x7fa53df16082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #18 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +0x61100001ed58 is located 152 bytes inside of 232-byte region [0x61100001ecc0,0x61100001eda8) +freed by thread T0 here: + #0 0x4a7ea2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0xc63253 in gs_heap_free_object /src/ghostpdl/./base/gsmalloc.c:366:5 + +previously allocated by thread T0 here: + #0 0x4a8146 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xc623d0 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + +SUMMARY: AddressSanitizer: heap-use-after-free /src/ghostpdl/./base/gp.h:296:16 in gp_fflush +Shadow bytes around the buggy address: + 0x0c227fffbd50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c227fffbd60: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffbd70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffbd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c227fffbd90: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd +=>0x0c227fffbda0: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd + 0x0c227fffbdb0: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffbdc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c227fffbdd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa + 0x0c227fffbde0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c227fffbdf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2023-1079.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2023-1079.txt new file mode 100644 index 000000000..6e2eac81b --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2023-1079.txt @@ -0,0 +1,428 @@ +INFO: Seed: 2818507958 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +pdf/pdf_fontTT.c:569:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_fontTT.c:569:5 in +devices/vector/gdevpdfu.c:696:16: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdfu.c:696:16 in +base/gsicc.c:685:46: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc.c:685:46 in +devices/vector/gdevpsft.c:802:24: runtime error: member access within null pointer of type 'ttf_OS_2_t' (aka 'struct ttf_OS_2_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:802:24 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_t' (aka 'struct pdf_font_descriptor_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_common_t' (aka 'struct pdf_font_descriptor_common_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +base/gxpath.c:978:12: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:978:12 in +base/gxpflat.c:272:22: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:272:22 in +base/seexec.c:72:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/seexec.c:72:20 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 55898 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 2147462265 + 22719 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +pdf/pdf_font1.c:680:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:680:13 in +base/wrfont.c:47:61: runtime error: signed integer overflow: 55794 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/wrfont.c:47:61 in +pdf/pdf_fapi.c:666:30: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_fapi.c:666:30 in +pdf/pdf_font1.c:868:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:868:5 in +base/gstype1.c:403:33: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:403:33 in +base/gsfont.c:924:31: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfont.c:924:31 in +base/gxtype1.c:386:13: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:386:13 in +base/gxtype1.c:409:17: runtime error: left shift of negative value -219 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:409:17 in +base/gxtype1.c:407:17: runtime error: left shift of negative value -40 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:407:17 in +base/gxtype1.c:530:13: runtime error: signed integer overflow: 42785 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:530:13 in +base/gxtype1.c:413:17: runtime error: signed integer overflow: 57489 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:413:17 in +base/gxtype1.c:415:26: runtime error: left shift of negative value -1141 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:415:26 in +base/gscoord.c:607:32: runtime error: shift exponent 42 is too large for 32-bit type 'fixed' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscoord.c:607:32 in +base/gstype1.c:584:17: runtime error: left shift of negative value -729 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:584:17 in +base/gstype1.c:582:17: runtime error: left shift of negative value -8 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:582:17 in +base/gstype1.c:350:17: runtime error: signed integer overflow: 42785 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:350:17 in +base/gsdparam.c:1710:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:33 in +base/gsdparam.c:1710:61: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:61 in +pdf/pdf_int.c:299:34: runtime error: signed integer overflow: 224617979 * 10 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_int.c:299:34 in +base/gxpcopy.c:126:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcopy.c:126:43 in +base/gxpflat.c:160:5: runtime error: left shift of negative value -9 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:160:5 in +base/gxpflat.c:168:10: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:168:10 in +base/gxpflat.c:168:10: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:168:10 in +base/gxpflat.c:168:28: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:168:28 in +base/gxpflat.c:168:28: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:168:28 in +base/gxpflat.c:169:10: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:169:10 in +base/gxpflat.c:169:10: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:169:10 in +base/gxpflat.c:169:28: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:169:28 in +base/gxpflat.c:169:28: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:169:28 in +base/gxpflat.c:170:10: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:170:10 in +base/gxpflat.c:170:10: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:170:10 in +base/gxpflat.c:170:28: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:170:28 in +base/gxpflat.c:170:28: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:170:28 in +base/gxpflat.c:229:20: runtime error: left shift of negative value -1281 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:229:20 in +base/gxpflat.c:230:22: runtime error: left shift of negative value -522 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:230:22 in +base/gxpflat.c:230:40: runtime error: left shift of negative value -1566 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:230:40 in +base/gxpflat.c:160:5: runtime error: left shift of negative value -15096 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:160:5 in +base/gxpflat.c:162:5: runtime error: left shift of negative value -12971705 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:162:5 in +base/gxpflat.c:162:5: runtime error: left shift of negative value -3193071 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:162:5 in +base/gxpflat.c:231:22: runtime error: left shift of negative value -1696054 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:231:22 in +base/gxpflat.c:231:40: runtime error: left shift of negative value -5088162 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:231:40 in +base/gxpflat.c:228:20: runtime error: left shift of negative value -19199307 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:228:20 in +base/gxpflat.c:71:35: runtime error: signed integer overflow: -1596817252 - 1597004091 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:71:35 in +base/gxpflat.c:160:5: runtime error: signed integer overflow: 1596817252 + 798408626 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:160:5 in +base/gxacpath.c:259:39: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxacpath.c:259:39 in +base/gxacpath.c:260:39: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxacpath.c:260:39 in +base/gxacpath.c:261:47: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxacpath.c:261:47 in +base/gxacpath.c:262:47: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxacpath.c:262:47 in +base/gxfill.c:321:22: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxfill.c:321:22 in +base/gxscanc.c:3393:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxscanc.c:3393:17 in +base/gxscanc.c:3394:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxscanc.c:3394:17 in +base/gxdtfill.h:138:24: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxdtfill.h:138:24 in +base/gxdtfill.h:139:24: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxdtfill.h:139:24 in +base/gxdtfill.h:264:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxdtfill.h:264:13 in +base/gxdtfill.h:264:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxdtfill.h:264:33 in +base/gxdtfill.h:273:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxdtfill.h:273:13 in +base/gxdtfill.h:273:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxdtfill.h:273:33 in +base/gxdtfill.h:270:19: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxdtfill.h:270:19 in +base/gxdtfill.h:302:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxdtfill.h:302:20 in +base/gdevddrw.c:144:15: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gdevddrw.c:144:15 in +base/gdevddrw.c:148:24: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gdevddrw.c:148:24 in +psi/zfont.c:510:18: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zfont.c:510:18 in +devices/vector/gdevpdtd.c:416:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:416:49 in +devices/vector/gdevpdtd.c:417:49: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:417:49 in +devices/vector/gdevpdtd.c:499:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:499:27 in +devices/vector/gdevpsfx.c:69:9: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:69:9 in +devices/vector/gdevpsfx.c:166:19: runtime error: index -1 out of bounds for type 'fixed[48]' (aka 'int[48]') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:166:19 in +devices/vector/gdevpsfx.c:183:9: runtime error: signed integer overflow: 62183 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:183:9 in +devices/vector/gdevpsfx.c:493:23: runtime error: index -1 out of bounds for type 'fixed[48]' (aka 'int[48]') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:493:23 in +devices/vector/gdevpsfx.c:189:17: runtime error: left shift of negative value -524 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:189:17 in +devices/vector/gdevpsfx.c:254:13: runtime error: signed integer overflow: 42785 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:254:13 in +devices/vector/gdevpsfx.c:187:17: runtime error: left shift of negative value -40 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:187:17 in +devices/vector/gdevpsfx.c:569:23: runtime error: index -1 out of bounds for type 'fixed[48]' (aka 'int[48]') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsfx.c:569:23 in +base/gxccache.c:99:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccache.c:99:13 in +base/ttfinp.c:57:27: runtime error: left shift of 163 by 24 places cannot be represented in type 'int32' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfinp.c:57:27 in +base/ttfmain.c:275:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:275:36 in +base/ttfmain.c:277:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:277:36 in +base/ttfmain.c:281:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:281:36 in +base/ttfmain.c:283:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:283:36 in +base/ttfmain.c:285:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:285:36 in +base/ttfmain.c:289:36: runtime error: member access within null pointer of type 'sfnt_MetricsHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:289:36 in +base/ttfmain.c:50:23: runtime error: left shift of negative value -25 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:50:23 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +base/ttfmain.c:1011:95: runtime error: left shift of negative value -1600 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:1011:95 in +base/ttfmain.c:1012:95: runtime error: left shift of negative value -1600 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:1012:95 in +devices/vector/gdevpsft.c:495:22: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:495:22 in +devices/vector/gdevpsft.c:601:27: runtime error: member access within null pointer of type 'ttf_OS_2_t' (aka 'struct ttf_OS_2_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:601:27 in +devices/vector/gdevpsft.c:602:16: runtime error: member access within null pointer of type 'ttf_OS_2_t' (aka 'struct ttf_OS_2_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:602:16 in +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x62a0003dc89a at pc 0x000001d6bc5c bp 0x7ffdf2c582c0 sp 0x7ffdf2c582b8 +READ of size 1 at 0x62a0003dc89a thread T0 + #0 0x1d6bc5b in Ins_JROT /src/ghostpdl/./base/ttinterp.c:1789:11 + #1 0x1d52b9e in RunIns /src/ghostpdl/./base/ttinterp.c:5131:7 + #2 0x1bfd33e in Instance_Reset /src/ghostpdl/./base/ttobjs.c:834:15 + #3 0x1be21e1 in TT_Set_Instance_CharSizes /src/ghostpdl/./base/ttfmain.c:138:12 + #4 0x1be49ad in ttfFont__Open /src/ghostpdl/./base/ttfmain.c:348:12 + #5 0x169cce0 in ttfFont__Open_aux /src/ghostpdl/./base/gxttfb.c:448:12 + #6 0xe604b2 in gx_attach_tt_interpreter /src/ghostpdl/./base/gxccman.c:249:12 + #7 0xe60fa1 in gx_add_fm_pair /src/ghostpdl/./base/gxccman.c:355:20 + #8 0xe5ace3 in gx_lookup_fm_pair /src/ghostpdl/./base/gxccache.c:140:12 + #9 0x1691088 in gs_type42_glyph_outline /src/ghostpdl/./base/gstype42.c:1350:12 + #10 0xc29498 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #11 0x1696c13 in gs_type42_glyph_info_by_gid /src/ghostpdl/./base/gstype42.c:1387:16 + #12 0x1691788 in gs_type42_glyph_info /src/ghostpdl/./base/gstype42.c:1458:12 + #13 0xa1cbf4 in pdf_compute_font_descriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:469:16 + #14 0xa1f049 in pdf_finish_FontDescriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:649:17 + #15 0xa72a2f in pdf_finish_resources /src/ghostpdl/./devices/vector/gdevpdtw.c:684:24 + #16 0x8b8eb6 in __covrec_59069581604AE801u /src/ghostpdl/./devices/vector/gdevpdf.c:2785:13 + #17 0xbfcf38 in gs_closedevice /src/ghostpdl/./base/gsdevice.c:786:16 + #18 0x5217cb in __covrec_543A5F2E6E788DDu /src/ghostpdl/./psi/imain.c:1351:20 + #19 0x52362e in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #20 0x52367e in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #21 0x119c0d8 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #22 0x515aef in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #23 0x4e5ad3 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:135:8 + #24 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #25 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #26 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #27 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #28 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #29 0x7f76f0682082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #30 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +0x62a0003dc89a is located 18074 bytes inside of 20048-byte region [0x62a0003d8200,0x62a0003dd050) +freed by thread T0 here: + #0 0x4a7ea2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0xc63253 in gs_heap_free_object /src/ghostpdl/./base/gsmalloc.c:366:5 + +previously allocated by thread T0 here: + #0 0x4a8146 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xc623d0 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + +SUMMARY: AddressSanitizer: heap-use-after-free /src/ghostpdl/./base/ttinterp.c:1789:11 in Ins_JROT +Shadow bytes around the buggy address: + 0x0c54800738c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c54800738d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c54800738e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c54800738f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c5480073900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0c5480073910: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c5480073920: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c5480073930: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c5480073940: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c5480073950: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c5480073960: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2023-88.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2023-88.txt new file mode 100644 index 000000000..c7bfc6780 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2023-88.txt @@ -0,0 +1,274 @@ +INFO: Seed: 2822598234 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +base/gxpath.c:978:12: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:978:12 in +base/seexec.c:72:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/seexec.c:72:20 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 55898 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 2147462265 + 22719 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +pdf/pdf_font1.c:680:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:680:13 in +base/wrfont.c:47:61: runtime error: signed integer overflow: 55794 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/wrfont.c:47:61 in +pdf/pdf_fapi.c:666:30: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_fapi.c:666:30 in +pdf/pdf_font1.c:868:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:868:5 in +devices/vector/gdevpdfu.c:696:16: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdfu.c:696:16 in +base/gstype1.c:403:33: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gstype1.c:403:33 in +base/gsfont.c:924:31: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfont.c:924:31 in +base/gxtype1.c:386:13: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:386:13 in +base/gxtype1.c:409:17: runtime error: left shift of negative value -219 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:409:17 in +base/gxtype1.c:407:17: runtime error: left shift of negative value -40 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:407:17 in +base/gxtype1.c:530:13: runtime error: signed integer overflow: 42785 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:530:13 in +base/gxtype1.c:413:17: runtime error: signed integer overflow: 57489 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:413:17 in +base/gxtype1.c:415:26: runtime error: left shift of negative value -1141 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxtype1.c:415:26 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_t' (aka 'struct pdf_font_descriptor_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_common_t' (aka 'struct pdf_font_descriptor_common_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +pdf/pdf_font1C.c:2198:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2198:5 in +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f3fe6b81c60 at pc 0x0000014e7890 bp 0x7ffdf647ed50 sp 0x7ffdf647ed48 +WRITE of size 1 at 0x7f3fe6b81c60 thread T0 + #0 0x14e788f in pdfi_read_cff_real /src/ghostpdl/./pdf/pdf_font1C.c:739:10 + #1 0x14e788f in pdfi_read_cff_dict /src/ghostpdl/./pdf/pdf_font1C.c:1129:21 + #2 0x14e752c in pdfi_read_cff_dict /src/ghostpdl/./pdf/pdf_font1C.c:1172:20 + #3 0x14d1e0b in pdfi_read_cff /src/ghostpdl/./pdf/pdf_font1C.c:1680:12 + #4 0x14c67e3 in pdfi_read_cff_font /src/ghostpdl/./pdf/pdf_font1C.c:2285:16 + #5 0x149d324 in pdfi_load_font_buffer /src/ghostpdl/./pdf/pdf_font.c:624:24 + #6 0x149b84a in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:924:24 + #7 0x14a4382 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:1006:20 + #8 0x14a96cf in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:1048:12 + #9 0x14a96cf in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1407:12 + #10 0x13f85cb in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1642:24 + #11 0x13f6c91 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #12 0x1469e7e in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #13 0x1469e7e in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #14 0x1469e7e in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #15 0x13a629d in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #16 0x11b91a9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0x11b2256 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0x11b19f7 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x51e8a6 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x51ebee in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x51ebee in __covrec_354B81557B0956Cu /src/ghostpdl/./psi/imain.c:889:12 + #22 0x519dfb in __covrec_218C571E84FB63F4 /src/ghostpdl/./psi/imain.c:870:12 + #23 0x15a94e6 in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #24 0x15a4c81 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #25 0x15a0e05 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #26 0x15a9251 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #27 0x119b038 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x51580c in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #29 0x4e5aa2 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:130:8 + #30 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #31 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #32 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #33 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #34 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #35 0x7f3fe8f60082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #36 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +Address 0x7f3fe6b81c60 is located in stack of thread T0 at offset 96 in frame + #0 0x14e2e8f in pdfi_read_cff_dict /src/ghostpdl/./pdf/pdf_font1C.c:802 + + This frame has 3 object(s): + [32, 96) 'buf.i' (line 686) <== Memory access at offset 96 overflows this variable + [128, 512) 'args' (line 804) + [576, 584) 'fnamestr' (line 950) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ghostpdl/./pdf/pdf_font1C.c:739:10 in pdfi_read_cff_real +Shadow bytes around the buggy address: + 0x0fe87cd68330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe87cd68340: f2 f2 f2 f2 f2 f2 f2 f2 f8 f3 f3 f3 00 00 00 00 + 0x0fe87cd68350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe87cd68360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe87cd68370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fe87cd68380: f1 f1 f1 f1 00 00 00 00 00 00 00 00[f2]f2 f2 f2 + 0x0fe87cd68390: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe87cd683a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe87cd683b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe87cd683c0: f2 f2 f2 f2 f2 f2 f2 f2 f8 f3 f3 f3 00 00 00 00 + 0x0fe87cd683d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2023-970.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2023-970.txt new file mode 100644 index 000000000..ef1c1e691 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2023-970.txt @@ -0,0 +1,246 @@ +INFO: Seed: 2840368904 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +pdf/pdf_int.c:299:38: runtime error: signed integer overflow: 2147483640 + 55 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_int.c:299:38 in +pdf/pdf_int.c:299:42: runtime error: signed integer overflow: -2147483601 - 48 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_int.c:299:42 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +base/sjpegd.c:38:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegd.c:38:9 in +base/sjpegd.c:38:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegd.c:38:9 in +base/gxipixel.c:217:14: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxipixel.c:217:14 in +base/gxipixel.c:219:19: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxipixel.c:219:19 in +base/gxipixel.c:772:44: runtime error: signed integer overflow: 2147483647 + 15 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxipixel.c:772:44 in +base/gxipixel.c:772:50: runtime error: signed integer overflow: -2147483634 * 3 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxipixel.c:772:50 in +devices/vector/gdevpdfu.c:696:16: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdfu.c:696:16 in +base/gsdparam.c:1710:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:33 in +base/gsdparam.c:1710:61: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:61 in +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x61c000000910 at pc 0x0000010545db bp 0x7ffe18c71320 sp 0x7ffe18c71318 +READ of size 8 at 0x61c000000910 thread T0 + #0 0x10545da in gx_device_forward_finalize /src/ghostpdl/./base/gdevnfwd.c:33:5 + #1 0xbfc60b in gx_device_finalize /src/ghostpdl/./base/gsdevice.c:81:9 + #2 0x12e985e in restore_finalize /src/ghostpdl/./psi/isave.c:954:13 + #3 0x12e91a0 in alloc_restore_step_in /src/ghostpdl/./psi/isave.c:759:9 + #4 0x1245ad9 in dorestore /src/ghostpdl/./psi/zvmem.c:193:16 + #5 0x118f937 in z2restore /src/ghostpdl/./psi/zdevice2.c:373:12 + #6 0x11b91a9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0x11b2256 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0x11b19f7 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x51e8a6 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #10 0x51ebee in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x51ebee in __covrec_354B81557B0956Cu /src/ghostpdl/./psi/imain.c:889:12 + #12 0x519dfb in __covrec_218C571E84FB63F4 /src/ghostpdl/./psi/imain.c:870:12 + #13 0x15a94e6 in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #14 0x15a4c81 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #15 0x15a0e05 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #16 0x15a9251 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #17 0x119b038 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x51580c in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #19 0x4e5aa2 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:130:8 + #20 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #21 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #22 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #23 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #24 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #25 0x7f7e25440082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #26 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +0x61c000000910 is located 144 bytes inside of 1808-byte region [0x61c000000880,0x61c000000f90) +freed by thread T0 here: + #0 0x4a7ea2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0xc63253 in gs_heap_free_object /src/ghostpdl/./base/gsmalloc.c:366:5 + +previously allocated by thread T0 here: + #0 0x4a8146 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xc623d0 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + +SUMMARY: AddressSanitizer: heap-use-after-free /src/ghostpdl/./base/gdevnfwd.c:33:5 in gx_device_forward_finalize +Shadow bytes around the buggy address: + 0x0c387fff80d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c387fff80e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c387fff80f0: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c387fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c387fff8110: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0c387fff8120: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c387fff8130: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c387fff8140: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c387fff8150: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c387fff8160: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c387fff8170: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2024-1391.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2024-1391.txt new file mode 100644 index 000000000..c380aaf06 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2024-1391.txt @@ -0,0 +1,255 @@ +INFO: Seed: 2815841927 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +pdf/pdf_int.c:299:34: runtime error: signed integer overflow: 218610168 * 10 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_int.c:299:34 in +base/gxpath.c:978:12: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:978:12 in +base/gxcpath.c:683:31: runtime error: left shift of negative value -534 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:683:31 in +pdf/pdf_font1C.c:2198:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2198:5 in +pdf/pdf_font1C.c:2125:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2125:5 in +pdf/pdf_font1C.c:2784:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1C.c:2784:17 in +base/gxcpath.c:684:31: runtime error: left shift of negative value -91023 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:684:31 in +base/gsicc.c:685:46: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc.c:685:46 in +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x614000001994 at pc 0x000000440e5e bp 0x7ffd1ffcbb90 sp 0x7ffd1ffcb358 +READ of size 12 at 0x614000001994 thread T0 + #0 0x440e5d in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0x7e6097 in get_mediawp /src/ghostpdl/./base/gsicc_create.c:3272:5 + #2 0x7e6097 in __covrec_7A1E772A61277BD6u /src/ghostpdl/./base/gsicc_create.c:3315:10 + #3 0x7e5480 in gsicc_create_getv2buffer /src/ghostpdl/./base/gsicc_create.c:3409:5 + #4 0x964576 in __covrec_79F336B03D723C20u /src/ghostpdl/./devices/vector/gdevpdfk.c:861:21 + #5 0x8f2601 in __covrec_3528A16296846827u /src/ghostpdl/./devices/vector/gdevpdfc.c:926:16 + #6 0x9a14cf in pdf_make_group_dict /src/ghostpdl/./devices/vector/gdevpdft.c + #7 0x9a14cf in pdf_begin_transparency_group /src/ghostpdl/./devices/vector/gdevpdft.c:181:12 + #8 0x9a0f48 in gdev_pdf_composite /src/ghostpdl/./devices/vector/gdevpdft.c:431:24 + #9 0x5ee1e8 in __covrec_9CC4E46A349536FDu /src/ghostpdl/./base/gdevp14.c:9668:12 + #10 0x5973fd in gs_gstate_update_pdf14trans2 /src/ghostpdl/./base/gstrans.c:142:12 + #11 0x591b16 in gs_gstate_update_pdf14trans /src/ghostpdl/./base/gstrans.c:167:12 + #12 0x591b16 in __covrec_A13A057DD773576Fu /src/ghostpdl/./base/gstrans.c:325:12 + #13 0x154c9e3 in pdfi_gs_begin_transparency_group /src/ghostpdl/./pdf/pdf_trans.c:369:12 + #14 0x154d3dd in pdfi_transparency_group_common /src/ghostpdl/./pdf/pdf_trans.c:424:12 + #15 0x154d8cc in pdfi_trans_begin_form_group /src/ghostpdl/./pdf/pdf_trans.c:538:12 + #16 0x145543c in pdfi_do_form /src/ghostpdl/./pdf/pdf_image.c:2454:16 + #17 0x14562ae in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2561:16 + #18 0x1456de6 in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2643:12 + #19 0x13f859d in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1475:24 + #20 0x13f6c91 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #21 0x1469e7e in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #22 0x1469e7e in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #23 0x1469e7e in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #24 0x13a629d in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #25 0x11b91a9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #26 0x11b2256 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #27 0x11b19f7 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #28 0x51e8a6 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #29 0x51ebee in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #30 0x51ebee in __covrec_354B81557B0956Cu /src/ghostpdl/./psi/imain.c:889:12 + #31 0x519dfb in __covrec_218C571E84FB63F4 /src/ghostpdl/./psi/imain.c:870:12 + #32 0x15a94e6 in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #33 0x15a4c81 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #34 0x15a0e05 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #35 0x15a9251 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #36 0x119b038 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #37 0x51580c in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #38 0x4e5aa2 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:130:8 + #39 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #40 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #41 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #42 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #43 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #44 0x7f5349e3e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #45 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +0x614000001994 is located 970 bytes to the right of 394-byte region [0x614000001440,0x6140000015ca) +allocated by thread T0 here: + #0 0x4a8146 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xc623d0 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x0c287fff82e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c287fff82f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c287fff8300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c287fff8310: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c287fff8320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c287fff8330: fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c287fff8340: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c287fff8350: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c287fff8360: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c287fff8370: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c287fff8380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2024-503.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2024-503.txt new file mode 100644 index 000000000..fd4154698 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/crashes/OSV-2024-503.txt @@ -0,0 +1,422 @@ +INFO: Seed: 2717986027 +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +base/gsiorom.c:94:14: runtime error: left shift of 128 by 24 places cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:94:14 in +psi/imainarg.c:684:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/imainarg.c:684:43 in +base/gxpath.c:114:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:114:23 in +base/gxpath.c:115:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:115:23 in +base/gxpath.c:116:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:116:23 in +base/gxpath.c:117:23: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:117:23 in +base/gxcpath.c:530:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:530:29 in +base/gxcpath.c:531:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:531:29 in +base/gxcpath.c:532:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:532:29 in +base/gxcpath.c:533:29: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxcpath.c:533:29 in +base/gspath.c:604:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:604:17 in +base/gspath.c:605:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:605:17 in +base/gspath.c:606:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:606:17 in +base/gspath.c:607:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:607:17 in +base/gxpcmap.c:839:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcmap.c:839:9 in +base/gxccman.c:139:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:139:9 in +base/gsiorom.c:122:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:122:21 in +base/gsiorom.c:201:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsiorom.c:201:25 in +psi/iscannum.c:103:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:58 in +psi/iscannum.c:103:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:103:73 in +psi/iscannum.c:104:58: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:58 in +psi/iscannum.c:104:73: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:104:73 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1123:13: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1123:13 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'ref' (aka 'struct ref_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/interp.c:1401:21: runtime error: member access within null pointer of type 'struct tas_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/interp.c:1401:21 in +psi/ziodevsc.c:153:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:153:25 in +psi/ziodevsc.c:230:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:230:25 in +psi/ziodevsc.c:301:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ziodevsc.c:301:25 in +psi/iscannum.c:278:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/iscannum.c:278:13 in +psi/zarith.c:415:64: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:415:64 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +psi/zusparam.c:440:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:440:11 in +base/gsalloc.c:1068:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsalloc.c:1068:20 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/zusparam.c:202:11: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zusparam.c:202:11 in +psi/idparam.c:378:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/idparam.c:378:9 in +base/gsicc_manage.c:2166:23: runtime error: member access within null pointer of type 'cmm_profile_t' (aka 'struct cmm_profile_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_manage.c:2166:23 in +base/gsicc_cache.c:465:41: runtime error: left shift of 229 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:465:41 in +base/sfxstdio.c:199:21: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:199:21 in +devices/vector/gdevpdf.c:879:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdf.c:879:36 in +base/gsicc_cache.c:464:39: runtime error: left shift of 184 by 56 places cannot be represented in type 'int64_t' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsicc_cache.c:464:39 in +base/gshtscr.c:353:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:353:48 in +base/gshtscr.c:387:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:387:27 in +base/gshtscr.c:392:57: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gshtscr.c:392:57 in +base/gsht.c:1051:26: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1051:26 in +base/gsht.c:1052:27: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsht.c:1052:27 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:37:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:37:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:52:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:52:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpege.c:72:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:72:9 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +base/sjpegc.c:143:28: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpegc.c:143:28 in +psi/ireclaim.c:110:36: runtime error: member access within null pointer of type 'i_ctx_t' (aka 'struct gs_context_state_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/ireclaim.c:110:36 in +psi/igc.c:268:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:268:9 in +psi/zbfont.c:44:40: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:44:40 in +psi/igc.c:306:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:306:9 in +psi/zbfont.c:49:44: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:49:44 in +psi/isave.c:591:37: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/isave.c:591:37 in +psi/igc.c:1150:9: runtime error: member access within null pointer of type 'clump_head_t' (aka 'struct clump_head_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:1150:9 in +psi/igc.c:430:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:430:5 in +psi/igc.c:451:5: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:451:5 in +psi/zbfont.c:55:33: runtime error: member access within null pointer of type 'font_data' (aka 'struct font_data_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zbfont.c:55:33 in +psi/igc.c:478:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:478:9 in +psi/igc.c:495:9: runtime error: member access within null pointer of type 'struct alloc_save_s' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/igc.c:495:9 in +base/sfxstdio.c:73:48: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:73:48 in +base/sfxstdio.c:167:25: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sfxstdio.c:167:25 in +pdf/pdf_int.c:299:38: runtime error: signed integer overflow: 2147483640 + 55 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_int.c:299:38 in +pdf/pdf_int.c:299:42: runtime error: signed integer overflow: -2147483601 - 48 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_int.c:299:42 in +psi/zmedia2.c:56:34: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:56:34 in +psi/zmedia2.c:240:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zmedia2.c:240:36 in +base/gsdparam.c:2476:36: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:36 in +base/gsdparam.c:2476:68: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:2476:68 in +psi/zarith.c:460:41: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior psi/zarith.c:460:41 in +base/gsfcmap.c:299:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfcmap.c:299:5 in +pdf/pdf_font11.c:452:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font11.c:452:5 in +base/gsfont.c:924:31: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsfont.c:924:31 in +devices/vector/gdevpsft.c:802:24: runtime error: member access within null pointer of type 'ttf_OS_2_t' (aka 'struct ttf_OS_2_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpsft.c:802:24 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_t' (aka 'struct pdf_font_descriptor_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdtd.c:216:27: runtime error: member access within null pointer of type 'pdf_font_descriptor_common_t' (aka 'struct pdf_font_descriptor_common_s') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdtd.c:216:27 in +devices/vector/gdevpdfu.c:696:16: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior devices/vector/gdevpdfu.c:696:16 in +base/gxccache.c:99:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccache.c:99:13 in +base/ttfinp.c:57:27: runtime error: left shift of 242 by 24 places cannot be represented in type 'int32' (aka 'int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfinp.c:57:27 in +base/ttfmain.c:275:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:275:36 in +base/ttfmain.c:277:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:277:36 in +base/ttfmain.c:281:36: runtime error: member access within null pointer of type 'sfnt_FontHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:281:36 in +base/ttfmain.c:283:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:283:36 in +base/ttfmain.c:285:36: runtime error: member access within null pointer of type 'sfnt_maxProfileTable' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:285:36 in +base/ttfmain.c:289:36: runtime error: member access within null pointer of type 'sfnt_MetricsHeader' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:289:36 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +base/ttinterp.c:5076:14: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttinterp.c:5076:14 in +base/ttfmain.c:1011:95: runtime error: left shift of negative value -1856 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:1011:95 in +base/ttfmain.c:1012:95: runtime error: left shift of negative value -1856 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:1012:95 in +base/gxccman.c:451:9: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxccman.c:451:9 in +base/gxpath.c:978:12: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpath.c:978:12 in +base/gxpflat.c:272:22: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:272:22 in +base/gxpcopy.c:126:43: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpcopy.c:126:43 in +base/gxpflat.c:162:5: runtime error: left shift of negative value -683 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:162:5 in +base/gxpflat.c:168:10: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:168:10 in +base/gxpflat.c:168:10: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:168:10 in +base/gxpflat.c:168:28: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:168:28 in +base/gxpflat.c:168:28: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:168:28 in +base/gxpflat.c:169:10: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:169:10 in +base/gxpflat.c:169:10: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:169:10 in +base/gxpflat.c:169:28: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:169:28 in +base/gxpflat.c:169:28: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:169:28 in +base/gxpflat.c:170:10: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:170:10 in +base/gxpflat.c:170:10: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:170:10 in +base/gxpflat.c:170:28: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:170:28 in +base/gxpflat.c:170:28: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:170:28 in +base/gxpflat.c:228:20: runtime error: left shift of negative value -447 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:228:20 in +base/gxpflat.c:229:20: runtime error: left shift of negative value -2049 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:229:20 in +base/gxpflat.c:230:22: runtime error: left shift of negative value -534 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:230:22 in +base/gxpflat.c:230:40: runtime error: left shift of negative value -1602 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:230:40 in +base/gxpflat.c:231:22: runtime error: left shift of negative value -534 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:231:22 in +base/gxpflat.c:231:40: runtime error: left shift of negative value -1602 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:231:40 in +base/gxacpath.c:259:39: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxacpath.c:259:39 in +base/gxacpath.c:260:39: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxacpath.c:260:39 in +base/gxacpath.c:261:47: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxacpath.c:261:47 in +base/gxacpath.c:262:47: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxacpath.c:262:47 in +base/gxfill.c:321:22: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxfill.c:321:22 in +base/gxdtfill.h:138:24: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxdtfill.h:138:24 in +base/gxdtfill.h:139:24: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxdtfill.h:139:24 in +base/gxdtfill.h:264:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxdtfill.h:264:13 in +base/gxdtfill.h:264:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxdtfill.h:264:33 in +base/gxdtfill.h:273:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxdtfill.h:273:13 in +base/gxdtfill.h:273:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxdtfill.h:273:33 in +base/gxscanc.c:3393:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxscanc.c:3393:17 in +base/gxscanc.c:3394:17: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxscanc.c:3394:17 in +base/gspcolor.c:79:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspcolor.c:79:5 in +base/gsimage.c:553:45: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsimage.c:553:45 in +base/sjpege.c:94:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:94:9 in +base/sjpege.c:94:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:94:9 in +base/sjpege.c:105:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:105:9 in +base/sjpege.c:105:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:105:9 in +obj/jfdctint.c:198:65: runtime error: left shift of negative value -1024 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior obj/jfdctint.c:198:65 in +obj/jchuff.c:335:16: runtime error: left shift of 68515142098223104 by 8 places cannot be represented in type 'INT32' (aka 'long') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior obj/jchuff.c:335:16 in +obj/jfdctint.c:199:45: runtime error: left shift of negative value -12 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior obj/jfdctint.c:199:45 in +obj/jfdctint.c:2242:61: runtime error: left shift of negative value -272 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior obj/jfdctint.c:2242:61 in +base/sjpege.c:114:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:114:9 in +base/sjpege.c:114:9: runtime error: member access within null pointer of type 'gsfix_jmp_buf_test' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/sjpege.c:114:9 in +base/ttfmain.c:50:23: runtime error: left shift of negative value -6 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/ttfmain.c:50:23 in +pdf/pdf_int.c:299:34: runtime error: signed integer overflow: 268795355 * 10 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_int.c:299:34 in +base/gxpflat.c:274:22: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:274:22 in +base/gxpflat.c:160:5: runtime error: left shift of negative value -326562027 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:160:5 in +base/gxpflat.c:160:5: runtime error: left shift of negative value -40820265 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:160:5 in +base/gxpflat.c:162:5: runtime error: left shift of negative value -13791 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gxpflat.c:162:5 in +base/seexec.c:72:20: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/seexec.c:72:20 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 55898 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +base/gscrypt1.c:52:9: runtime error: signed integer overflow: 2147462265 + 22719 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gscrypt1.c:52:9 in +pdf/pdf_font1.c:680:13: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:680:13 in +base/wrfont.c:47:61: runtime error: signed integer overflow: 55794 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/wrfont.c:47:61 in +pdf/pdf_fapi.c:666:30: runtime error: signed integer overflow: 49136 * 52845 cannot be represented in type 'int' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_fapi.c:666:30 in +pdf/pdf_font1.c:868:5: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior pdf/pdf_font1.c:868:5 in +base/gspath.c:88:14: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:88:14 in +base/gspath.c:88:14: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:88:14 in +base/gspath.c:89:14: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:89:14 in +base/gspath.c:89:14: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:89:14 in +base/gspath.c:89:14: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:89:14 in +base/gspath.c:89:14: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:89:14 in +base/gspath.c:88:14: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:88:14 in +base/gspath.c:88:14: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gspath.c:88:14 in +base/gsdparam.c:1710:33: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:33 in +base/gsdparam.c:1710:61: runtime error: left shift of negative value -1 +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior base/gsdparam.c:1710:61 in +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62900005ec78 at pc 0x00000091bcaf bp 0x7ffc5350a7c0 sp 0x7ffc5350a7b8 +WRITE of size 8 at 0x62900005ec78 thread T0 + #0 0x91bcae in __covrec_5D5B21D96B32D4F9u /src/ghostpdl/./devices/vector/gdevpdfg.c:73:38 + #1 0x9bc8c5 in stream_to_text /src/ghostpdl/./devices/vector/gdevpdfu.c:1120:12 + #2 0x9adbfa in pdf_open_contents /src/ghostpdl/./devices/vector/gdevpdfu.c:1200:20 + #3 0x9b35ea in pdf_open_page /src/ghostpdl/./devices/vector/gdevpdfu.c:1964:12 + #4 0xa445ec in pdf_append_chars /src/ghostpdl/./devices/vector/gdevpdts.c:647:24 + #5 0x1a08140 in process_text_modify_width /src/ghostpdl/./devices/vector/gdevpdte.c + #6 0x19f6fb0 in scan_cmap_text /src/ghostpdl/./devices/vector/gdevpdtc.c:870:24 + #7 0x19f1c4b in process_cmap_text /src/ghostpdl/./devices/vector/gdevpdtc.c:965:12 + #8 0xa6619f in pdf_text_process /src/ghostpdl/./devices/vector/gdevpdtt.c:3758:16 + #9 0xcb091a in gs_text_process /src/ghostpdl/./base/gstext.c:670:12 + #10 0x153de59 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:447:16 + #11 0x1534c9d in pdfi_show_Tr_preserve /src/ghostpdl/./pdf/pdf_text.c:789:16 + #12 0x1534c9d in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:842:16 + #13 0x1536db2 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1081:12 + #14 0x13f880b in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1646:24 + #15 0x13f6c91 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #16 0x1469e7e in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #17 0x1469e7e in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #18 0x1469e7e in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #19 0x13a629d in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #20 0x11b91a9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #21 0x11b2256 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #22 0x11b19f7 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #23 0x51e8a6 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #24 0x51ebee in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #25 0x51ebee in __covrec_354B81557B0956Cu /src/ghostpdl/./psi/imain.c:889:12 + #26 0x519dfb in __covrec_218C571E84FB63F4 /src/ghostpdl/./psi/imain.c:870:12 + #27 0x15a94e6 in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #28 0x15a4c81 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #29 0x15a0e05 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #30 0x15a9251 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #31 0x119b038 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #32 0x51580c in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #33 0x4e5aa2 in __covrec_673F6603978DF04Bu /src/gs_fuzzlib.h:130:8 + #34 0x4e5e7b in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:26:2 + #35 0x4f432c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #36 0x4e6285 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #37 0x4eaf31 in __covrec_6990238F142DEEC4u /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #38 0x4e5f52 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #39 0x7f88faf11082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #40 0x426d0d in _start (/out/gs_device_pdfwrite_fuzzer+0x426d0d) + +0x62900005ec78 is located 2336 bytes to the right of 16728-byte region [0x62900005a200,0x62900005e358) +freed by thread T0 here: + #0 0x4a7ea2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0xc63253 in gs_heap_free_object /src/ghostpdl/./base/gsmalloc.c:366:5 + +previously allocated by thread T0 here: + #0 0x4a8146 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xc623d0 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./devices/vector/gdevpdfg.c:73:38 in __covrec_5D5B21D96B32D4F9u +Shadow bytes around the buggy address: + 0x0c5280003d30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5280003d40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5280003d50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5280003d60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5280003d70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c5280003d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa] + 0x0c5280003d90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5280003da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5280003db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5280003dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5280003dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/ghostscript_files/dicts/pdf.dict b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/ghostscript_files/dicts/pdf.dict new file mode 100644 index 000000000..a6c48d59e --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/ghostscript_files/dicts/pdf.dict @@ -0,0 +1,1466 @@ +# +# AFL dictionary for PDF +# ---------------------- +# +# This is a pretty big PDF dictionary constructed by Ben by manually reviewing +# the spec and combining that with the data pulled out of a corpus of sample +# PDFs. +# +# Contributed by Ben Nagy +# + +"#" +"%" +"%%" +"%%EOF" +"%FDF-1.7" +"%PDF-1.7" +"(" +"(/xdp:xdp)" +"(\\001)" +"(config)" +"(datasets)" +"(template)" +"(xdp:xdp)" +")" +"-1" +"-1.0" +".." +"/" +"/#23clipboard" +"/.notdef" +"/1" +"/1.0" +"/1.3" +"/3D" +"/3DA" +"/3DAnimationStyle" +"/3DB" +"/3DD" +"/3DI" +"/3DLightingScheme" +"/3DRenderMode" +"/3DV" +"/3DView" +"/90pv-RKSJ-H" +"/A" +"/A0" +"/A85" +"/AA" +"/AAIC" +"/AAPL" +"/ABCDEF+ACaslonPro-Regular" +"/ABCDEF+AJensonPro-LtIt" +"/ABCDEF+AdobeCorpID-MinionRg" +"/ABCDEF+Arial,Bold" +"/ABCDEF+BankGothicMdBT" +"/ABCDEF+Bauhaus-Heavy" +"/ABCDEF+BluesClues" +"/ABCDEF+BodegaSans" +"/ABCDEF+BodoniMTCondensed" +"/ABCDEF+BookAntiqua" +"/ABCDEF+CMBX10" +"/ABCDEF+CaflischScriptPro-Regular" +"/ABCDEF+CityBlueprint" +"/ABCDEF+CourierNewPSMT" +"/ABCDEF+FixedsysExcelsior2.00" +"/ABCDEF+MSTT31854bd45bo188067S00" +"/ABCDEF+MinionPro-BoldCnIt" +"/ABCDEF+MyriadMM-It_400_300_" +"/ABCDEF+Wingdings" +"/ABCDEF+ZapfDingbats" +"/AC" +"/ADBE" +"/ADB_DEVICE_DEFAULT_STYLE" +"/ADB_DefaultStyle" +"/ADB_NO_TRAP_STYLE" +"/AE" +"/AESV2" +"/AGaramond" +"/AH" +"/AI8DstIndex" +"/AI8SrcIndex" +"/AIMetaData" +"/AIPDFPrivateData1" +"/AIS" +"/AL" +"/AN" +"/AP" +"/AS" +"/ASCII85Decode" +"/ASCIIHexDecode" +"/ASomewhatLongerName" +"/AU" +"/Aacute" +"/Acc.#20Prod.#202501#20#2F2#20#20" +"/Accounts#20payable" +"/AccurateScreens" +"/Acircumflex" +"/AcroForm" +"/Action" +"/Actual" +"/Add" +"/Adieresis" +"/Adobe" +"/Adobe#20PDF#20Library" +"/Adobe.PPKLite" +"/AdobeCorpID-Acrobat" +"/AdobeCorpID-MinionRg" +"/AdobePhotoshop" +"/Agrave" +"/All" +"/AllKO" +"/AllOn" +"/Alt" +"/Alternate" +"/AlternatePresentations" +"/Alternates" +"/Amex" +"/And" +"/Angle" +"/Annot" +"/Annots" +"/AntiAlias" +"/AnyOn" +"/Apag_PDFX_Checkup" +"/App" +"/Architecture-Normal" +"/Arial" +"/Aring" +"/Art" +"/ArtBox" +"/Article" +"/Artifact" +"/Artwork" +"/Ascent" +"/Aspect" +"/Assistant" +"/Atilde" +"/AuthEvent" +"/Author" +"/Avenir-Heavy" +"/Avenir-MediumOblique" +"/AvgWidth" +"/BBox" +"/BC" +"/BCL" +"/BDC" +"/BDL" +"/BE" +"/BFSOL" +"/BG" +"/BG2" +"/BM" +"/BMC" +"/BS" +"/BW" +"/Bank" +"/BaseEncoding" +"/BaseFont" +"/BaseState" +"/BaseVersion" +"/Birch" +"/BitsPerComponent" +"/BitsPerCoordinate" +"/BitsPerFlag" +"/BitsPerSample" +"/Bl" +"/BlCDel" +"/BlMiNu" +"/Black" +"/BlackIs1" +"/BlackOP" +"/BlackPoint" +"/BleedBox" +"/Blend" +"/Block" +"/Blue" +"/BluesClues" +"/Bookshelf" +"/Border" +"/Bounds" +"/BoxColorInfo" +"/Btn" +"/BulmerMT-BoldDisplay" +"/ByteRange" +"/C" +"/C0" +"/C0_0" +"/C1" +"/C2W" +"/C3" +"/CALS_AIS" +"/CALS_BM" +"/CALS_HT" +"/CALS_SMASK" +"/CALS_ca" +"/CAM" +"/CB" +"/CC" +"/CCH" +"/CCITTFaxDecode" +"/CD" +"/CDL" +"/CEN" +"/CF" +"/CFM" +"/CI" +"/CIDFontType0" +"/CIDFontType0C" +"/CIDFontType2" +"/CIDInit" +"/CIDSet" +"/CIDSystemInfo" +"/CIDToGIDMap" +"/CMV_LabBar" +"/CMV_LabControl" +"/CMYK" +"/CMYK#20#2880,#208,#2034,#200#29" +"/CMap" +"/CMapName" +"/CMapType" +"/CMapVersion" +"/CO" +"/CP" +"/CS" +"/CS0" +"/CT" +"/CV" +"/CalGray" +"/CalRGB" +"/CapHeight" +"/Caption" +"/Caslon540BT-Roman" +"/CaslonBT-Bold" +"/CaslonBT-BoldItalic" +"/Catalog" +"/Category" +"/Ccedilla" +"/CenturySchoolbookBT-Roman" +"/Ch" +"/Chair" +"/Chap" +"/Chaparral-Display" +"/CharProcs" +"/CharSet" +"/CheckSum" +"/Circle" +"/ClarendonBT-Black" +"/ClassMap" +"/Clearface-Black" +"/Clip" +"/ClippedText" +"/Cn" +"/Collection" +"/CollectionItem" +"/CollectionSchema" +"/CollectionSubitem" +"/Color" +"/ColorBurn" +"/ColorDodge" +"/ColorMatch" +"/ColorSpace" +"/ColorTransform" +"/ColorType" +"/Colorants" +"/Colors" +"/Columns" +"/ComicSansMS,Bold" +"/Comment" +"/Comments" +"/Company" +"/Compatibility" +"/Compatible" +"/Components" +"/CompressArt" +"/Condensed" +"/Configs" +"/Consultant" +"/ContainerVersion" +"/Contents" +"/Coords" +"/Copy" +"/Copy#20center" +"/Cor" +"/Corner#20surface" +"/CosineDot" +"/Count" +"/Cour" +"/Courier" +"/Create" +"/CreationDate" +"/Creator" +"/CreatorInfo" +"/CreatorVersion" +"/CropBox" +"/CropFixed" +"/CropRect" +"/Crypt" +"/CryptFilter" +"/CryptFilterDecodeParms" +"/Cs12" +"/Cs3" +"/Cyan" +"/D" +"/DA" +"/DCTDecode" +"/DIC#202525p*" +"/DIS" +"/DL" +"/DOS" +"/DP" +"/DR" +"/DS" +"/DSz" +"/DV" +"/DW" +"/DamagedRowsBeforeError" +"/Darken" +"/Data" +"/Date" +"/Decode" +"/DecodeParms" +"/DefEmbeddedFile" +"/Default" +"/DefaultCryptFilter" +"/DefaultForPrinting" +"/DefaultRGB" +"/Delete" +"/Delta" +"/DescendantFonts" +"/Descent" +"/Description" +"/Design" +"/Dest" +"/DestOutputProfile" +"/DestOutputProfileRef" +"/Dests" +"/DeviceCMYK" +"/DeviceGray" +"/DeviceN" +"/DeviceRGB" +"/Difference" +"/Differences" +"/DigestLocation" +"/DigestMethod" +"/DigestValue" +"/Dimmed" +"/Direction" +"/DisplayDocTitle" +"/Dissolve" +"/Div" +"/Dm" +"/DocMDP" +"/DocOpen" +"/Document" +"/Documents" +"/Domain" +"/Door" +"/DotGain" +"/Draw" +"/Dt" +"/Dur" +"/Dynamic#20connector" +"/E" +"/EF" +"/EFF" +"/EMC" +"/Eacute" +"/EarlyChange" +"/Ecircumflex" +"/Edieresis" +"/Editable" +"/Egrave" +"/EmbedFonts" +"/EmbedICCProfile" +"/Embedded" +"/EmbeddedFile" +"/EmbeddedFiles" +"/Encode" +"/EncodedByteAlign" +"/Encoding" +"/Encrypt" +"/EncryptMetadata" +"/EndIndent" +"/EndOfBlock" +"/EndOfLine" +"/Euro" +"/Euro.037" +"/Event" +"/ExData" +"/Exchange-Pro" +"/Exclude" +"/Exclusion" +"/Executive" +"/Export" +"/ExportCrispy" +"/ExportState" +"/ExtGState" +"/Extend" +"/Extends" +"/ExtensionLevel" +"/Extensions" +"/F1" +"/F1.0" +"/F12" +"/F13" +"/F3" +"/F5" +"/F6" +"/F7" +"/F8" +"/FB" +"/FD" +"/FDecodeParms" +"/FFilter" +"/FICL" +"/FM" +"/FOV" +"/FRM" +"/FS" +"/FT" +"/Facilities" +"/Fade" +"/False" +"/Feature" +"/FedEx#20Orange" +"/FedEx#20Purple" +"/Field" +"/Fields" +"/Figure" +"/File" +"/Files" +"/Filespec" +"/FillIn" +"/Filter" +"/First" +"/FirstChar" +"/FirstPage" +"/Fit" +"/FitB" +"/FitBH" +"/FitBV" +"/FitH" +"/FitR" +"/FitV" +"/FitWindow" +"/FixedPrint" +"/Flags" +"/FlateDecode" +"/Fm0" +"/Fm4" +"/Fo" +"/Focoltone#201047" +"/Font" +"/FontBBox" +"/FontDescriptor" +"/FontFamily" +"/FontFile" +"/FontFile2" +"/FontMatrix" +"/FontName" +"/FontStretch" +"/FontWeight" +"/Form" +"/FormEx" +"/FormType" +"/FreeText" +"/FreeTextCallout" +"/Frequency" +"/FullSave" +"/FullScreen" +"/Function" +"/FunctionType" +"/Functions" +"/Futura-Bold" +"/Futura-CondensedExtraBold" +"/G" +"/G02" +"/GLGR" +"/GS0" +"/GS1" +"/GS2" +"/GTS" +"/GTS_PDFA1" +"/GTS_PDFX" +"/GTS_PDFXConformance" +"/GTS_PDFXVersion" +"/GWG#20Green" +"/Gamma" +"/Garamond" +"/Georgia,Bold" +"/GoTo" +"/GoTo3DView" +"/GoToE" +"/GoToR" +"/Gold" +"/Goudy" +"/Gray" +"/Green" +"/GreymantleMVB" +"/GrotesqueMT" +"/Group" +"/H" +"/HDAG_Tools" +"/HKana" +"/HT" +"/HT2" +"/Halftone" +"/HalftoneName" +"/HalftoneType" +"/HardLight" +"/HeBo" +"/Head1" +"/Headlamp" +"/Height" +"/HeiseiMin" +"/Helv" +"/Helvetica" +"/Helvetica-Bold" +"/Helvetica-BoldOblique" +"/Helvetica-Condensed" +"/HelveticaNeue-Black" +"/Hide" +"/HonMincho-M" +"/Horizontal" +"/Hue" +"/I" +"/I0" +"/IC" +"/ICCBased" +"/ICCVersion" +"/ID" +"/IDS" +"/IDTree" +"/IEC" +"/IF" +"/IN" +"/ISO32000Registry" +"/ISO_PDFE1" +"/ISO_PDFEVersion" +"/IT" +"/ITO" +"/ITP" +"/IV" +"/IX" +"/Icircumflex" +"/Icon" +"/Identity" +"/Identity-H" +"/IgnEP" +"/Illustrator" +"/Illustrator8.0" +"/Im0" +"/Im1" +"/Im2" +"/Im3" +"/Im4" +"/Image" +"/Image1" +"/ImageB" +"/ImageC" +"/ImageI" +"/ImageMask" +"/ImageResources" +"/ImageType" +"/Import" +"/ImportData" +"/ImpressBT-Regular" +"/Index" +"/Indexed" +"/Info" +"/Information#20services" +"/Ink" +"/InkList" +"/InsertPages" +"/Insignia" +"/IntegerItem" +"/Intent" +"/Interpolate" +"/ItalicAngle" +"/ItcKabel-Ultra" +"/Item1" +"/Item2" +"/JBIG2Decode" +"/JBIG2Globals" +"/JPXDecode" +"/JS" +"/JT" +"/JTC" +"/JTF" +"/JTFile" +"/JTM" +"/JavaScript" +"/JobTicketContents" +"/Justify" +"/Keywords" +"/Kids" +"/L" +"/L1" +"/L1a" +"/L1b" +"/L2R" +"/L50188" +"/LBody" +"/LI" +"/LL" +"/LLE" +"/LLO" +"/LS" +"/LSP" +"/LZW" +"/LZWDecode" +"/Lab" +"/Lang" +"/Last" +"/LastChar" +"/LastItem" +"/LastModified" +"/Lateral#20file" +"/Launch" +"/Layout" +"/Lbl" +"/Leading" +"/Legal" +"/Length" +"/Length1" +"/Length2" +"/Length3" +"/LetterspaceFlags" +"/Lighten" +"/Limits" +"/Line" +"/LineDimension" +"/LineHeight" +"/Linear" +"/Linearized" +"/Link" +"/Locked" +"/LogoGreen" +"/LrTb" +"/Lslash" +"/Luminosity" +"/M" +"/MB" +"/MC" +"/MC0" +"/MCD" +"/MCID" +"/MCR" +"/MD5" +"/MH" +"/MIT" +"/MK" +"/MMType1" +"/MP" +"/MR" +"/MS" +"/MUX#20#2F#20DEMUX" +"/Mac" +"/MacRomanEncoding" +"/Magenta" +"/Manager" +"/MarkInfo" +"/Marked" +"/MarkedPDF" +"/Marker#20board" +"/Markup3D" +"/Mask" +"/Mastercard" +"/Matrix" +"/Max" +"/MaxLen" +"/MaxWidth" +"/Me" +"/Measure" +"/MediaBox" +"/MetaData" +"/Min" +"/MinionMM" +"/MissingWidth" +"/MixedContainer" +"/MixingHints" +"/ModDate" +"/Mode" +"/Modify" +"/Movie" +"/Msg" +"/MurrayHillBT-Bold" +"/MxGeom" +"/MxLaNu" +"/MxPts" +"/MyriadPro-Black" +"/NA" +"/NChannel" +"/ND" +"/NL" +"/NM" +"/NR" +"/Name" +"/Name1" +"/Named" +"/Names" +"/NeedsRendering" +"/NewCenturySchlbk-Italic" +"/NewWindow" +"/Next" +"/NextPage" +"/No" +"/NonEFontNoWarn" +"/NonStruct" +"/None" +"/Normal" +"/Not" +"/NotDefSpecial" +"/NumBlock" +"/Nums" +"/OB" +"/OBJR" +"/OC" +"/OC2" +"/OC3" +"/OC4" +"/OCG" +"/OCGs" +"/OCL" +"/OCMD" +"/OCProperties" +"/OE" +"/OFF" +"/OLN" +"/ON" +"/OOL" +"/OPBG" +"/OPBS" +"/OPI" +"/OPM" +"/OS" +"/OT" +"/Oacute" +"/Obj" +"/ObjStm" +"/Ocircumflex" +"/Odieresis" +"/Ograve" +"/Omega" +"/OneColumn" +"/Online" +"/Open" +"/OpenAction" +"/Operation" +"/Opt" +"/OptionSet" +"/Options" +"/Or" +"/Orange" +"/Order" +"/Ordering" +"/OriginalLayerName" +"/Oslash" +"/Otilde" +"/Outlines" +"/OutputCondition" +"/OutputConditionIdentifier" +"/OutputIntent" +"/OutputIntents" +"/Overlay" +"/P0" +"/P1" +"/P2" +"/P2,#2300ff007900000000,PANTONE#20151#20C" +"/PANTONE" +"/PANTONE#20158-5#20CVS" +"/PANTONE#20221#20CVU" +"/PANTONE#203405#20C" +"/PANTONE#20399#20CVC" +"/PANTONE#20Blue#20072#20C" +"/PANTONE#20Orange#20021#20C" +"/PANTONE#20Orange#20021#20CVC" +"/PANTONE#20Yellow#20C" +"/PC" +"/PDFDocEncoding" +"/PIX" +"/PO" +"/PS" +"/PUBLISHER" +"/PZ" +"/Pa0" +"/Page" +"/PageElement" +"/PageLabels" +"/PageLayout" +"/PageMode" +"/PageRange" +"/Pages" +"/PaintType" +"/Palatino,Bold" +"/Pale#20Brown.c" +"/Panose" +"/Paper#20tray" +"/Para" +"/Params" +"/Parent" +"/ParentTree" +"/ParentTreeNextKey" +"/Part" +"/Pattern" +"/PatternType" +"/PcZ" +"/Perceptual" +"/Perms" +"/Pg" +"/Pgf" +"/PieceInfo" +"/PitStop" +"/Placement" +"/Play" +"/Polygon" +"/PolygonCloud" +"/Popup" +"/Position" +"/PowerUpPDF" +"/PrOut" +"/PrRGBGra" +"/PrRGBIma" +"/Predictor" +"/PresSteps" +"/PreserveRB" +"/Prev" +"/PrevPage" +"/Preview" +"/Print" +"/PrintRecord" +"/PrintScaling" +"/PrintState" +"/PrintStyle" +"/Printed" +"/PrintingOrder" +"/Private" +"/ProcSet" +"/Process" +"/ProcessBlue" +"/ProcessGreen" +"/ProcessRed" +"/Producer" +"/ProfileCS" +"/ProfileName" +"/Prop_Build" +"/Properties" +"/Proportional" +"/PubSec" +"/Q" +"/QuadPoints" +"/R1" +"/RBGroups" +"/RC" +"/RD" +"/REC" +"/REx" +"/RF" +"/RGB" +"/RI" +"/RICMYKGra" +"/RICMYKIma" +"/RICalGra" +"/RICalIma" +"/RIDefault" +"/RIDevNGra" +"/RIDevNIma" +"/RIRGBGra" +"/RIRGBIma" +"/RL" +"/RM" +"/RV" +"/Range" +"/Rect" +"/Red" +"/Redact" +"/Ref" +"/Reference" +"/Registry" +"/RegistryName" +"/RelativeColorimetric" +"/Rendition" +"/Renditions" +"/Requirements" +"/ResetForm" +"/Resolution" +"/Resources" +"/ReversedChars" +"/RoleMap" +"/Root" +"/Rotate" +"/Round" +"/RoundTrip" +"/RoundtripVersion" +"/Router" +"/Rows" +"/RunLengthDecode" +"/Ryumin" +"/SA" +"/SBDraft" +"/SC" +"/SE" +"/SFSSL" +"/SFTWS" +"/SI" +"/SL" +"/SLA" +"/SM" +"/SMask" +"/SMaskInData" +"/SP" +"/SPS" +"/STL" +"/SU" +"/SW" +"/Saturation" +"/SaveAs" +"/SaveContents" +"/SaveResource" +"/SavedBy" +"/Scaron" +"/Schema" +"/Screen" +"/Sect" +"/SemiCondensed" +"/SemiExpanded" +"/Separation" +"/SeparationInfo" +"/SetOCGState" +"/SettingsFileName" +"/Sh0" +"/Sh1" +"/Shading" +"/ShadingType" +"/Shape" +"/Sig" +"/SigFlags" +"/SigRef" +"/Signature" +"/Signed" +"/SinglePage" +"/Size" +"/SlideShow" +"/SoftLight" +"/Solid" +"/Solidities" +"/SomeName" +"/Sort" +"/Sound" +"/Space" +"/SpaceAfter" +"/SpaceBefore" +"/Span" +"/SpawnTemplate" +"/SpdrArt" +"/SpiderInfo" +"/Split" +"/Spot" +"/Spot1" +"/Spot2" +"/SpotFunction" +"/SpotMap" +"/St" +"/Stamp" +"/StandardImageFileData" +"/Star" +"/Start" +"/StartIndent" +"/StartResource" +"/State" +"/StdCF" +"/StemH" +"/StemV" +"/Stm" +"/StmF" +"/Stop" +"/Story" +"/StrF" +"/StrikeOut" +"/StringItem" +"/StructElem" +"/StructParent" +"/StructParents" +"/StructTreeRoot" +"/Style" +"/SubFilter" +"/SubType" +"/Subdictionary" +"/Subform" +"/Subj" +"/Subject" +"/SubmitForm" +"/SubmitStandalone" +"/SubsetFontsBelow" +"/SubsetFontsRatio" +"/Supplement" +"/Swiss721BT-Black" +"/Switch" +"/T" +"/T1" +"/T1_0" +"/TB" +"/TC" +"/TCS" +"/TF" +"/TID" +"/TK" +"/TM" +"/TO" +"/TOC" +"/TOCI" +"/TOYO#200004pc" +"/TP" +"/TR" +"/TR2" +"/TRUMATCH#206-e" +"/TS" +"/TSV" +"/TT" +"/TT0" +"/TTRefMan" +"/TU" +"/TV" +"/TW" +"/TWS" +"/TWY" +"/Tabs" +"/TagSuspect" +"/TargetCS" +"/Technical" +"/Template" +"/TemplateInstantiated" +"/Templates" +"/Text" +"/TextAlign" +"/TextBox" +"/TextIndent" +"/The" +"/This" +"/Thorn" +"/Thread" +"/Threads" +"/Thumb" +"/Thumbnail" +"/Thumbs" +"/Ti" +"/TiBI" +"/TilingType" +"/Times-BoldItalic" +"/Times-Roman" +"/Title" +"/ToUnicode" +"/Toggle" +"/Trans" +"/TransferFunction" +"/TransformMethod" +"/TransformParams" +"/Transparency" +"/TrapInfo" +"/TrapMagicNumber" +"/TrapRegions" +"/TrapSet" +"/Trapped" +"/Trapping" +"/TrappingDetails" +"/TrappingParameters" +"/TrimBox" +"/True" +"/TrueType" +"/TrustedMode" +"/TwoColumnLeft" +"/Tx" +"/Type" +"/Type0" +"/U3D" +"/UA" +"/UCR" +"/UCR2" +"/UIDOffset" +"/UR" +"/UR3" +"/URI" +"/URL" +"/URLs" +"/Uacute" +"/Ucircumflex" +"/Udieresis" +"/Ugrave" +"/Univers-BoldExt" +"/Unix" +"/Unknown" +"/Usage" +"/UseAttachments" +"/UseNone" +"/UseOC" +"/UseOutlines" +"/UseThumbs" +"/UsedCMYK" +"/UserProperties" +"/UserUnit" +"/V2" +"/VA" +"/VE" +"/VP" +"/Verdana,Bold" +"/Version" +"/Vertical" +"/VeryLastItem" +"/View" +"/ViewerPreferences" +"/Visa" +"/Visible" +"/Volume" +"/W2" +"/WAI" +"/WAN" +"/WMode" +"/WP" +"/WarnockPro-BoldIt" +"/Watermark" +"/WebCapture" +"/Which" +"/WhiteBG" +"/WhitePoint" +"/Widget" +"/Width" +"/Widths" +"/Win" +"/WinAnsiEncoding" +"/Window" +"/Windows" +"/Work#20surface" +"/Workbook" +"/Worksheet" +"/WritingMode" +"/X" +"/X1" +"/XFA" +"/XHeight" +"/XML" +"/XN" +"/XObject" +"/XRef" +"/XRefStm" +"/XStep" +"/XUID" +"/XYZ" +"/Y" +"/YStep" +"/Yacute" +"/Ydieresis" +"/Yellow" +"/Z" +"/Z7KNXbN" +"/ZaDb" +"/ZapfDingbats" +"/Zcaron" +"/Zoom" +"/_No_paragraph_style_" +"/a1" +"/acute" +"/adbe.pkcs7.detached" +"/ampersand" +"/apple" +"/approxequal" +"/asciicircum" +"/asciitilde" +"/asterisk" +"/at" +"/audio#2Fmpeg" +"/b" +"/backslash" +"/bar" +"/blank" +"/braceleft" +"/braceright" +"/bracketleft" +"/bracketright" +"/breve" +"/brokenbar" +"/bullet" +"/c108" +"/cCompKind" +"/cCompQuality" +"/cCompression" +"/cRes" +"/cResolution" +"/ca" +"/caron" +"/cedilla" +"/cent" +"/circumflex" +"/colon" +"/comma" +"/copyright" +"/currency" +"/dagger" +"/daggerdbl" +"/degree" +"/deviceNumber" +"/dieresis" +"/divide" +"/dollar" +"/dotaccent" +"/dotlessi" +"/dotlessj" +"/eight" +"/ellipsis" +"/emdash" +"/endash" +"/equal" +"/eth" +"/exclam" +"/exclamdown" +"/f" +"/ff" +"/ffi" +"/ffl" +"/fi" +"/five" +"/fl" +"/florin" +"/four" +"/fraction" +"/gCompKind" +"/gCompQuality" +"/gCompression" +"/gRes" +"/gResolution" +"/germandbls" +"/go1" +"/grave" +"/greater" +"/greaterequal" +"/guillemotleft" +"/guillemotright" +"/guilsinglleft" +"/guilsinglright" +"/hungarumlaut" +"/hyphen" +"/iacute" +"/idieresis" +"/igrave" +"/infinity" +"/integral" +"/j" +"/k" +"/less" +"/lessequal" +"/logicalnot" +"/lozenge" +"/lt#20blue" +"/mCompKind" +"/mCompression" +"/mRes" +"/mResolution" +"/macron" +"/minus" +"/mu" +"/multiply" +"/n" +"/n0" +"/nine" +"/notequal" +"/ntilde" +"/numbersign" +"/o" +"/ogonek" +"/one" +"/onehalf" +"/onequarter" +"/onesuperior" +"/op" +"/ordfeminine" +"/ordmasculine" +"/p" +"/pageH" +"/pageV" +"/paragraph" +"/parenleft" +"/parenright" +"/partialdiff" +"/pdf" +"/pdfx" +"/percent" +"/period" +"/periodcentered" +"/perthousand" +"/pi" +"/plus" +"/plusminus" +"/pms#208400" +"/printX" +"/product" +"/question" +"/questiondown" +"/quotedbl" +"/quotedblbase" +"/quotedblleft" +"/quotedblright" +"/quoteleft" +"/quoteright" +"/quotesinglbase" +"/quotesingle" +"/r" +"/radical" +"/registered" +"/ring" +"/s" +"/s1" +"/sd1" +"/sd2" +"/section" +"/semicolon" +"/seven" +"/six" +"/slash" +"/sterling" +"/summation" +"/thinspace" +"/three" +"/threequarters" +"/threesuperior" +"/tilde" +"/trademark" +"/two" +"/twosuperior" +"/u" +"/underscore" +"/v" +"/w" +"/y1" +"/yen" +"/yes" +"/zero" +"0 R" +"1" +"1.0" +"<" +"<<" +">" +">>" +"Adobe.PPKLite" +"Adobe.PubSec" +"B*" +"BDC" +"BI" +"BMC" +"BT" +"BX" +"CS" +"DP" +"Do" +"EI" +"EMC" +"ET" +"EX" +"Entrust.PPKEF" +"ID" +"MP" +"R" +"T*" +"TJ" +"TL" +"Tc" +"Td" +"Tf" +"Tj" +"Tm" +"Tr" +"Ts" +"Tw" +"W*" +"[" +"[0.0 0.0 0.0 0.0 0.0 0.0]" +"[1 1 1]" +"[1.0 -1.0 1.0 -1.0]" +"[1.0 -1.0]" +"\\" +"]" +"abs" +"adbe.pkcs7.s3" +"adbe.pkcs7.s4" +"adbe.pkcs7.s5" +"add" +"and" +"atan" +"begin" +"beginarrangedfont" +"beginbfchar" +"begincidrange" +"begincmap" +"begincodespacerange" +"beginnotdefchar" +"beginnotdefrange" +"beginusematrix" +"bitshift" +"ceiling" +"cm" +"copy" +"cos" +"cvi" +"cvr" +"d0" +"d1" +"div" +"dup" +"end" +"endarrangedfont" +"endbfchar" +"endcidrange" +"endcmap" +"endcodespacerange" +"endnotdefchar" +"endnotdefrange" +"endobj" +"endstream" +"endusematrix" +"eq" +"exch" +"exp" +"f*" +"false" +"findresource" +"floor" +"ge" +"gs" +"gt" +"idiv" +"if" +"ifelse" +"index" +"le" +"ln" +"log" +"lt" +"mod" +"mul" +"ne" +"neg" +"not" +"null" +"obj" +"or" +"page" +"pop" +"re" +"rg" +"ri" +"roll" +"round" +"sin" +"sqrt" +"startxref" +"stream" +"sub" +"trailer" +"true" +"truncate" +"usecmap" +"usefont" +"xor" +"xref" +"{" +"}" diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/ghostscript_files/gs_fuzzlib.h b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/ghostscript_files/gs_fuzzlib.h new file mode 100644 index 000000000..1ee6078dc --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/ghostscript_files/gs_fuzzlib.h @@ -0,0 +1,144 @@ +/* +# Copyright 2019 The Chromium OS Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ +*/ + +#include +#include + +#include +#include +#include +#include + +static const unsigned char *g_data; +static size_t g_size; + +int fuzz_gs_device( + const unsigned char *buf, + size_t size, + int color_scheme, + const char *device_target, + const char *output_file +); + +#define min(x, y) ((x) < (y) ? (x) : (y)) + +static int gs_stdin(void *inst, char *buf, int len) +{ + size_t to_copy = min(len, g_size); + to_copy = min(INT_MAX, to_copy); + + memcpy(buf, g_data, to_copy); + + g_data += to_copy; + g_size -= to_copy; + + return to_copy; +} + +static int gs_stdnull(void *inst, const char *buf, int len) +{ + /* Just discard everything. */ + return len; +} + +int gs_to_raster_fuzz( + const unsigned char *buf, + size_t size, + int color_scheme +) +{ + return fuzz_gs_device(buf, size, color_scheme, "cups", "/dev/null"); +} + +int fuzz_gs_device( + const unsigned char *buf, + size_t size, + int color_scheme, + const char *device_target, + const char *output_file +) +{ + int ret; + void *gs = NULL; + char color_space[50]; + char gs_device[50]; + char gs_o[100]; + /* + * We are expecting color_scheme to be in the [0:62] interval. + * This corresponds to the color schemes defined here: + * https://github.com/ArtifexSoftware/ghostpdl/blob/8c97d5adce0040ac38a1fb4d7954499c65f582ff/cups/libs/cups/raster.h#L102 + */ + sprintf(color_space, "-dcupsColorSpace=%d", color_scheme); + sprintf(gs_device, "-sDEVICE=%s", device_target); + sprintf(gs_o, "-sOutputFile=%s", output_file); + /* Mostly stolen from cups-filters gstoraster. */ + char *args[] = { + "gs", + "-K1048576", + "-r200x200", + "-sBandListStorage=memory", + "-dMaxBitmap=0", + "-dBufferSpace=450k", + "-dMediaPosition=1", + color_space, + "-dQUIET", + "-dSAFER", + "-dNOPAUSE", + "-dBATCH", + "-dNOINTERPOLATE", + "-dNOMEDIAATTRS", + "-sstdout=%%stderr", + gs_o, + gs_device, + "-_", + }; + int argc = sizeof(args) / sizeof(args[0]); + + /* Stash buffers globally, for gs_stdin(). */ + g_data = buf; + g_size = size; + + ret = gsapi_new_instance(&gs, NULL); + if (ret < 0) { + fprintf(stderr, "gsapi_new_instance: error %d\n", ret); + return ret; + } + + gsapi_set_stdio(gs, gs_stdin, gs_stdnull, gs_stdnull); + ret = gsapi_set_arg_encoding(gs, GS_ARG_ENCODING_UTF8); + if (ret < 0) { + fprintf(stderr, "gsapi_set_arg_encoding: error %d\n", ret); + gsapi_delete_instance(gs); + return ret; + } + + ret = gsapi_init_with_args(gs, argc, args); + if (ret && ret != gs_error_Quit) + /* Just keep going, to cleanup. */ + fprintf(stderr, "gsapi_init_with_args: error %d\n", ret); + + ret = gsapi_exit(gs); + if (ret < 0 && ret != gs_error_Quit) { + fprintf(stderr, "gsapi_exit: error %d\n", ret); + return ret; + } + + gsapi_delete_instance(gs); + + return 0; +} diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/ghostscript_files/pdf_seeds/pdf.pdf b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/ghostscript_files/pdf_seeds/pdf.pdf new file mode 100644 index 000000000..6b3af4c94 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/ghostscript_files/pdf_seeds/pdf.pdf differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/COMMANDS.md b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/COMMANDS.md new file mode 100644 index 000000000..ca7e23f20 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/COMMANDS.md @@ -0,0 +1,135 @@ +# Original Crash Collection: ghostscript gs_device_pdfwrite_fuzzer + +Generated: 2026-04-24 UTC + +Benchmark: `ghostscript_transplant_gs_device_pdfwrite_fuzzer` +Project: `ghostscript` +Fuzzer: `gs_device_pdfwrite_fuzzer` +Sanitizer: `address` + +Target source commit: `e088d3a844717878592fa5ccf871729983140676` (2022-08-13) +Target OSS-Fuzz commit: `e65a914168f13f4cd823e6df9a76ec60896876f4` (from `/home/user/log/ghostscript_builds.csv`) +Target-era base-runner: `gcr.io/oss-fuzz-base/base-runner@sha256:3a190cfbada024425c48aebd06558a0e974e819f69625e886b1fe2b1a138064d` (from `get_base_runner_for_date()`) + +## Semantics + +Each `OSV-*.txt` log is a crash on the pristine, un-transplanted source tree: + +- **Local bugs** (already triggering at the target commit) are replayed against + the `-address` prebuilt binary at target commit `e088d3a8` using the + target-era base-runner. +- **Migration bugs** are replayed at each bug's own buggy source commit during + the migration pipeline (`fuzz_helper.py collect_crash --runner-image auto`), + which picks a per-commit era-matched base-runner. Their logs are copied from + `/mnt/nas/linke/new_migrate/ghostscript/gs_device_pdfwrite_fuzzer/crash/`. + +## Bug → source commit / OSS-Fuzz commit + +| Bug | Kind | Source commit | OSS-Fuzz commit | +| --- | --- | --- | --- | +| OSV-2022-1021 | local | `e088d3a84471` | `e65a914168f1` | +| OSV-2022-1097 | local | `e088d3a84471` | `e65a914168f1` | +| OSV-2022-1148 | local | `e088d3a84471` | `e65a914168f1` | +| OSV-2022-1194 | local | `e088d3a84471` | `e65a914168f1` | +| OSV-2022-1208 | migration | `04c8185f0e80` | `9a3498ed88d3` | +| OSV-2022-522 | migration | `e784b3314b61` | `017cf397caa9` | +| OSV-2022-523 | migration | `e784b3314b61` | `017cf397caa9` | +| OSV-2022-719 | local | `e088d3a84471` | `e65a914168f1` | +| OSV-2022-724 | local | `e088d3a84471` | `e65a914168f1` | +| OSV-2022-726 | local | `e088d3a84471` | `e65a914168f1` | +| OSV-2022-727 | local | `e088d3a84471` | `e65a914168f1` | +| OSV-2022-744 | local | `e088d3a84471` | `e65a914168f1` | +| OSV-2022-751 | local | `e088d3a84471` | `e65a914168f1` | +| OSV-2022-757 | migration | `05efb77627aa` | `2fa71e3c7f87` | +| OSV-2022-772 | local | `e088d3a84471` | `e65a914168f1` | +| OSV-2022-797 | local | `e088d3a84471` | `e65a914168f1` | +| OSV-2022-818 | local | `e088d3a84471` | `e65a914168f1` | +| OSV-2022-855 | local | `e088d3a84471` | `e65a914168f1` | +| OSV-2022-866 | local | `e088d3a84471` | `e65a914168f1` | +| OSV-2022-888 | local | `e088d3a84471` | `e65a914168f1` | +| OSV-2022-949 | local | `e088d3a84471` | `e65a914168f1` | +| OSV-2023-1079 | local | `e088d3a84471` | `e65a914168f1` | +| OSV-2023-88 | local | `e088d3a84471` | `e65a914168f1` | +| OSV-2023-970 | migration | `4cb2e5ff261d` | `876d043e5595` | +| OSV-2024-1391 | local | `e088d3a84471` | `e65a914168f1` | +| OSV-2024-503 | migration | `00264e69ed97` | `4d798330717b` | + +## Re-run command (migration bugs) + +Run from `/home/user/oss-fuzz-for-select`. Uses `--runner-image auto` so +`get_base_runner_for_date()` picks the era-matched runner for each source commit. + +```bash +BUILD_CSV='/home/user/oss-fuzz-build/fuzzbench/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/collect_crash_builds.csv' +OUT_DIR='/home/user/oss-fuzz-build/fuzzbench/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes' + +while IFS=$'\t' read -r bug commit; do + [ "$bug" = "bug" ] && continue + ts=$(git -C /home/user/tasks-git/ghostscript log -1 --format=%ct "$commit") + /home/user/pyenv/venv/bin/python3 /home/user/oss-fuzz-for-select/script/fuzz_helper.py collect_crash \ + --commit "$commit" \ + --build_csv "$BUILD_CSV" \ + --testcases /home/user/oss-fuzz-for-select/pocs/tmp \ + --test_input "testcase-${bug}" \ + --runner-image auto --commit-date "$ts" \ + ghostscript gs_device_pdfwrite_fuzzer + cp "/home/user/oss-fuzz-build/data/crash/target_crash-${commit:0:6}-testcase-${bug}.txt" "${OUT_DIR}/${bug}.txt" +done <<'JOBS' +bug commit +OSV-2022-1208 04c8185f0e8088f01592917af2b7d52ec63114bf +OSV-2022-522 e784b3314b61f8dfb65e21cd04d7b0ff53251ce1 +OSV-2022-523 e784b3314b61f8dfb65e21cd04d7b0ff53251ce1 +OSV-2022-757 05efb77627aa0e05ab59ec1d6cb6988e1eb9710e +OSV-2023-970 4cb2e5ff261d260487913e3e075377b51b075db5 +OSV-2024-503 00264e69ed974afcc9d4790c3e615fcfc2a39833 +JOBS +``` + +## Re-run command (local bugs) + +Local bugs share the target commit, so they are replayed against the prebuilt +`-address` binary at `/mnt/nas/linke/ghostscript/ghostscript-e088d3a844717878592fa5ccf871729983140676-address/` +with the target-era runner. Use `-runs=10` for bugs that need repeat +execution (some crashes only fire on the second run, when libFuzzer's +`TryDetectingAMemoryLeak` double-executes the input). + +```bash +RUNNER_IMAGE='gcr.io/oss-fuzz-base/base-runner@sha256:3a190cfbada024425c48aebd06558a0e974e819f69625e886b1fe2b1a138064d' +BIN_DIR='/mnt/nas/linke/ghostscript/ghostscript-e088d3a844717878592fa5ccf871729983140676-address' +OUT_DIR='/home/user/oss-fuzz-build/fuzzbench/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes' + +for bug in \ + OSV-2022-1021 \ + OSV-2022-1097 \ + OSV-2022-1148 \ + OSV-2022-1194 \ + OSV-2022-719 \ + OSV-2022-724 \ + OSV-2022-726 \ + OSV-2022-727 \ + OSV-2022-744 \ + OSV-2022-751 \ + OSV-2022-772 \ + OSV-2022-797 \ + OSV-2022-818 \ + OSV-2022-855 \ + OSV-2022-866 \ + OSV-2022-888 \ + OSV-2022-949 \ + OSV-2023-1079 \ + OSV-2023-88 \ + OSV-2024-1391 +;do + TMPD=$(mktemp -d) + cp /home/user/oss-fuzz-for-select/pocs/tmp/testcase-${bug} "$TMPD/" + docker run --rm --platform linux/amd64 --shm-size=2g \ + -v "$BIN_DIR":/out:ro \ + -v "$TMPD":/corpus:ro \ + -e ASAN_OPTIONS=abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 \ + "$RUNNER_IMAGE" \ + /out/gs_device_pdfwrite_fuzzer "/corpus/testcase-${bug}" -rss_limit_mb=8192 -runs=10 \ + > "${OUT_DIR}/${bug}.txt" 2>&1 + rm -rf "$TMPD" +done +``` + diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-1021.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-1021.txt new file mode 100644 index 000000000..f04476e5c --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-1021.txt @@ -0,0 +1,104 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3179013777 +INFO: Loaded 3 modules (221252 inline 8-bit counters): 13672 [0x7f79ed2039e0, 0x7f79ed206f48), 959 [0x7f79ed264a40, 0x7f79ed264dff), 206621 [0x37df330, 0x3811a4d), +INFO: Loaded 3 PC tables (221252 PCs): 13672 [0x7f79ed206f48,0x7f79ed23c5c8), 959 [0x7f79ed264e00,0x7f79ed2689f0), 206621 [0x2a52210,0x2d793e0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-1021 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7f79ea643a1c at pc 0x00000143bf92 bp 0x7fffbcd47cb0 sp 0x7fffbcd47ca8 +READ of size 4 at 0x7f79ea643a1c thread T0 + #0 0x143bf91 in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:758:34 + #1 0x140c256 in gs_type1_glyph_info /src/ghostpdl/./base/gxtype1.c:664:16 + #2 0x110fcee in pdfi_cff_glyph_info /src/ghostpdl/./pdf/pdf_font1C.c:397:16 + #3 0xa94c8d in gs_default_font_info /src/ghostpdl/./base/gsfont.c:907:20 + #4 0x95df5c in gs_copy_font /src/ghostpdl/./devices/gxfcopy.c:2091:12 + #5 0x14c8b0a in pdf_base_font_alloc /src/ghostpdl/./devices/vector/gdevpdtb.c:293:12 + #6 0x91f303 in pdf_font_descriptor_alloc /src/ghostpdl/./devices/vector/gdevpdtd.c:202:16 + #7 0x940d0b in pdf_make_font_resource /src/ghostpdl/./devices/vector/gdevpdtt.c:1607:17 + #8 0x944f0b in pdf_obtain_font_resource_encoded /src/ghostpdl/./devices/vector/gdevpdtt.c:2141:24 + #9 0x9430c5 in pdf_obtain_font_resource /src/ghostpdl/./devices/vector/gdevpdtt.c:2247:12 + #10 0x14d56b2 in pdf_process_string /src/ghostpdl/./devices/vector/gdevpdte.c:837:12 + #11 0x14d56b2 in pdf_process_string_aux /src/ghostpdl/./devices/vector/gdevpdte.c:81:12 + #12 0x14e2d5d in process_plain_text /src/ghostpdl/./devices/vector/gdevpdte.c:1841:16 + #13 0x951f77 in pdf_text_process /src/ghostpdl/./devices/vector/gdevpdtt.c:3752:16 + #14 0xaf4e9e in gs_text_process /src/ghostpdl/./base/gstext.c:670:12 + #15 0x1154562 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:445:16 + #16 0x1154562 in pdfi_show_Tr_preserve /src/ghostpdl/./pdf/pdf_text.c:780:12 + #17 0x1154562 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:830:16 + #18 0x1155987 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1069:12 + #19 0x105700a in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1646:24 + #20 0x10550ce in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #21 0x10b71de in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #22 0x10b71de in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #23 0x10b71de in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #24 0x101353f in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #25 0xe845b9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #26 0xe845b9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #27 0xe845b9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #28 0x577123 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #29 0x577123 in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #30 0x577123 in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #31 0x5726b1 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #32 0x11b5f3c in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #33 0x11b2062 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #34 0x11aefae in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #35 0x11b5cc8 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #36 0xe6d0c2 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #37 0x56ebda in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #38 0x56dcd1 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #39 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #40 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #41 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #42 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #43 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #44 0x7f79ecc06082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #45 0x420aed in _start (/out/gs_device_pdfwrite_fuzzer+0x420aed) + +DEDUP_TOKEN: gs_type2_interpret--gs_type1_glyph_info--pdfi_cff_glyph_info +Address 0x7f79ea643a1c is located in stack of thread T0 at offset 28 in frame + #0 0x143596f in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:124 + +DEDUP_TOKEN: gs_type2_interpret + This frame has 4 object(s): + [32, 224) 'cstack' (line 129) <== Memory access at offset 28 underflows this variable + [288, 300) 'mask' (line 459) + [320, 336) 'join' (line 851) + [352, 368) 'end' (line 851) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-underflow /src/ghostpdl/./base/gstype2.c:758:34 in gs_type2_interpret +Shadow bytes around the buggy address: + 0x0fefbd4c06f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fefbd4c0700: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fefbd4c0710: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fefbd4c0720: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fefbd4c0730: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0fefbd4c0740: f1 f1 f1[f1]00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fefbd4c0750: 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 + 0x0fefbd4c0760: f2 f2 f2 f2 f8 f8 f2 f2 f8 f8 f2 f2 f8 f8 f3 f3 + 0x0fefbd4c0770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fefbd4c0780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fefbd4c0790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-1097.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-1097.txt new file mode 100644 index 000000000..aaf0d857f --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-1097.txt @@ -0,0 +1,112 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3179628120 +INFO: Loaded 3 modules (221252 inline 8-bit counters): 13672 [0x7f625015f9e0, 0x7f6250162f48), 959 [0x7f62501c0a40, 0x7f62501c0dff), 206621 [0x37df330, 0x3811a4d), +INFO: Loaded 3 PC tables (221252 PCs): 13672 [0x7f6250162f48,0x7f62501985c8), 959 [0x7f62501c0e00,0x7f62501c49f0), 206621 [0x2a52210,0x2d793e0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-1097 +================================================================= +==1==ERROR: AddressSanitizer: stack-use-after-return on address 0x7f624d4629d4 at pc 0x00000143c053 bp 0x7ffd3bcba630 sp 0x7ffd3bcba628 +READ of size 4 at 0x7f624d4629d4 thread T0 + #0 0x143c052 in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:774:30 + #1 0x110dbd8 in pdfi_cff_glyph_outline /src/ghostpdl/./pdf/pdf_font1C.c:377:16 + #2 0xa958a4 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #3 0x110fd09 in pdfi_cff_glyph_info /src/ghostpdl/./pdf/pdf_font1C.c:399:12 + #4 0x9650db in compare_glyphs /src/ghostpdl/./devices/gxfcopy.c:811:17 + #5 0x962f6f in gs_copied_can_copy_glyphs /src/ghostpdl/./devices/gxfcopy.c:2620:12 + #6 0x94488d in pdf_obtain_font_resource_encoded /src/ghostpdl/./devices/vector/gdevpdtt.c:2090:20 + #7 0x9430c5 in pdf_obtain_font_resource /src/ghostpdl/./devices/vector/gdevpdtt.c:2247:12 + #8 0x14d56b2 in pdf_process_string /src/ghostpdl/./devices/vector/gdevpdte.c:837:12 + #9 0x14d56b2 in pdf_process_string_aux /src/ghostpdl/./devices/vector/gdevpdte.c:81:12 + #10 0x14e2d5d in process_plain_text /src/ghostpdl/./devices/vector/gdevpdte.c:1841:16 + #11 0x951f77 in pdf_text_process /src/ghostpdl/./devices/vector/gdevpdtt.c:3752:16 + #12 0xaf4e9e in gs_text_process /src/ghostpdl/./base/gstext.c:670:12 + #13 0x1154562 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:445:16 + #14 0x1154562 in pdfi_show_Tr_preserve /src/ghostpdl/./pdf/pdf_text.c:780:12 + #15 0x1154562 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:830:16 + #16 0x1155987 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1069:12 + #17 0x105700a in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1646:24 + #18 0x10550ce in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #19 0x10531e8 in pdfi_interpret_inner_content /src/ghostpdl/./pdf/pdf_int.c:1910:12 + #20 0x10531e8 in pdfi_interpret_inner_content_stream /src/ghostpdl/./pdf/pdf_int.c:2009:12 + #21 0x10531e8 in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1846:12 + #22 0x10a6ea6 in pdfi_do_form /src/ghostpdl/./pdf/pdf_image.c:2470:16 + #23 0x10a7a1d in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2561:16 + #24 0x10d6913 in pdfi_annot_draw_AP /src/ghostpdl/./pdf/pdf_annot.c:284:12 + #25 0x10d6913 in pdfi_annot_draw /src/ghostpdl/./pdf/pdf_annot.c:3900:16 + #26 0x10c859f in pdfi_annot_preserve_Widget /src/ghostpdl/./pdf/pdf_annot.c:4367:12 + #27 0x10c8b10 in pdfi_annot_preserve /src/ghostpdl/./pdf/pdf_annot.c:4410:20 + #28 0x10c8b10 in pdfi_annot_handle /src/ghostpdl/./pdf/pdf_annot.c:4437:16 + #29 0x10c8b10 in pdfi_do_annotations /src/ghostpdl/./pdf/pdf_annot.c:4464:16 + #30 0x10b73b5 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:166:13 + #31 0x10b73b5 in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #32 0x101353f in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #33 0xe845b9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #34 0xe845b9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #35 0xe845b9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #36 0x577123 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #37 0x577123 in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #38 0x577123 in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #39 0x5726b1 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #40 0x11b5f3c in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #41 0x11b2062 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #42 0x11aefae in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #43 0x11b5cc8 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #44 0xe6d0c2 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #45 0x56ebda in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #46 0x56dcd1 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #47 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #48 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #49 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #50 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #51 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #52 0x7f624fb62082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #53 0x420aed in _start (/out/gs_device_pdfwrite_fuzzer+0x420aed) + +DEDUP_TOKEN: gs_type2_interpret--pdfi_cff_glyph_outline--gs_default_glyph_info +Address 0x7f624d4629d4 is located in stack of thread T0 at offset 468 in frame + #0 0x143596f in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:124 + +DEDUP_TOKEN: gs_type2_interpret + This frame has 4 object(s): + [32, 224) 'cstack' (line 129) + [288, 300) 'mask' (line 459) + [320, 336) 'join' (line 851) + [352, 368) 'end' (line 851) <== Memory access at offset 468 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-use-after-return /src/ghostpdl/./base/gstype2.c:774:30 in gs_type2_interpret +Shadow bytes around the buggy address: + 0x0fecc9a844e0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fecc9a844f0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fecc9a84500: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fecc9a84510: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fecc9a84520: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0fecc9a84530: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5[f5]f5 f5 f5 f5 f5 + 0x0fecc9a84540: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fecc9a84550: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fecc9a84560: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fecc9a84570: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fecc9a84580: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-1148.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-1148.txt new file mode 100644 index 000000000..6300bc6ed --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-1148.txt @@ -0,0 +1,98 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3180089963 +INFO: Loaded 3 modules (221252 inline 8-bit counters): 13672 [0x7fe50dcfe9e0, 0x7fe50dd01f48), 959 [0x7fe50dd5fa40, 0x7fe50dd5fdff), 206621 [0x37df330, 0x3811a4d), +INFO: Loaded 3 PC tables (221252 PCs): 13672 [0x7fe50dd01f48,0x7fe50dd375c8), 959 [0x7fe50dd5fe00,0x7fe50dd639f0), 206621 [0x2a52210,0x2d793e0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-1148 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7fe50b048014 at pc 0x00000143bf56 bp 0x7fff145e52b0 sp 0x7fff145e52a8 +READ of size 4 at 0x7fe50b048014 thread T0 + #0 0x143bf55 in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:825:36 + #1 0x140c256 in gs_type1_glyph_info /src/ghostpdl/./base/gxtype1.c:664:16 + #2 0x110fcee in pdfi_cff_glyph_info /src/ghostpdl/./pdf/pdf_font1C.c:397:16 + #3 0x14d860e in process_text_estimate_bbox /src/ghostpdl/./devices/vector/gdevpdte.c:689:16 + #4 0x14d860e in pdf_process_string /src/ghostpdl/./devices/vector/gdevpdte.c:856:16 + #5 0x14d860e in pdf_process_string_aux /src/ghostpdl/./devices/vector/gdevpdte.c:81:12 + #6 0x14e2d5d in process_plain_text /src/ghostpdl/./devices/vector/gdevpdte.c:1841:16 + #7 0x951f77 in pdf_text_process /src/ghostpdl/./devices/vector/gdevpdtt.c:3752:16 + #8 0xaf4e9e in gs_text_process /src/ghostpdl/./base/gstext.c:670:12 + #9 0x1154562 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:445:16 + #10 0x1154562 in pdfi_show_Tr_preserve /src/ghostpdl/./pdf/pdf_text.c:780:12 + #11 0x1154562 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:830:16 + #12 0x1156dce in pdfi_TJ /src/ghostpdl/./pdf/pdf_text.c:1190:20 + #13 0x1056da1 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1650:24 + #14 0x10550ce in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #15 0x10b6e78 in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:116:28 + #16 0x10b6e78 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #17 0x10b6e78 in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #18 0x101353f in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #19 0xe845b9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #20 0xe845b9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #21 0xe845b9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #22 0x577123 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #23 0x577123 in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #24 0x577123 in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #25 0x5726b1 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #26 0x11b5f3c in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #27 0x11b2062 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #28 0x11aefae in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #29 0x11b5cc8 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #30 0xe6d0c2 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #31 0x56ebda in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #32 0x56dcd1 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #33 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #34 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #35 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #36 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #37 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #38 0x7fe50d701082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #39 0x420aed in _start (/out/gs_device_pdfwrite_fuzzer+0x420aed) + +DEDUP_TOKEN: gs_type2_interpret--gs_type1_glyph_info--pdfi_cff_glyph_info +Address 0x7fe50b048014 is located in stack of thread T0 at offset 20 in frame + #0 0x143596f in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:124 + +DEDUP_TOKEN: gs_type2_interpret + This frame has 4 object(s): + [32, 224) 'cstack' (line 129) <== Memory access at offset 20 underflows this variable + [288, 300) 'mask' (line 459) + [320, 336) 'join' (line 851) + [352, 368) 'end' (line 851) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-underflow /src/ghostpdl/./base/gstype2.c:825:36 in gs_type2_interpret +Shadow bytes around the buggy address: + 0x0ffd21600fb0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffd21600fc0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffd21600fd0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffd21600fe0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffd21600ff0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0ffd21601000: f1 f1[f1]f1 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffd21601010: 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 + 0x0ffd21601020: f2 f2 f2 f2 f8 f8 f2 f2 f8 f8 f2 f2 f8 f8 f3 f3 + 0x0ffd21601030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffd21601040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffd21601050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-1194.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-1194.txt new file mode 100644 index 000000000..80703f843 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-1194.txt @@ -0,0 +1,115 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3180518431 +INFO: Loaded 3 modules (221252 inline 8-bit counters): 13672 [0x7f56ec6589e0, 0x7f56ec65bf48), 959 [0x7f56ec6b9a40, 0x7f56ec6b9dff), 206621 [0x37df330, 0x3811a4d), +INFO: Loaded 3 PC tables (221252 PCs): 13672 [0x7f56ec65bf48,0x7f56ec6915c8), 959 [0x7f56ec6b9e00,0x7f56ec6bd9f0), 206621 [0x2a52210,0x2d793e0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-1194 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6310000b0830 at pc 0x0000004c906e bp 0x7ffd2d25b840 sp 0x7ffd2d25b008 +READ of size 49 at 0x6310000b0830 thread T0 + #0 0x4c906d in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0x6cd089 in sputs /src/ghostpdl/./base/stream.c:604:17 + #2 0x1248985 in gx_serialize_Indexed /src/ghostpdl/./base/gscolor2.c + #3 0x833d0e in pdf_color_space_named /src/ghostpdl/./devices/vector/gdevpdfc.c:877:16 + #4 0x870781 in pdf_begin_typed_image /src/ghostpdl/./devices/vector/gdevpdfi.c:1438:24 + #5 0x86ce54 in gdev_pdf_begin_typed_image /src/ghostpdl/./devices/vector/gdevpdfi.c:1710:12 + #6 0xaaabc4 in gs_image_begin_typed /src/ghostpdl/./base/gsimage.c:268:12 + #7 0x10aeacc in pdfi_render_image /src/ghostpdl/./pdf/pdf_image.c:759:16 + #8 0x10a465b in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:2063:12 + #9 0x10a7aa0 in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2553:16 + #10 0x10a8439 in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2643:12 + #11 0x1056dcd in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1475:24 + #12 0x10550ce in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #13 0x10b71de in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #14 0x10b71de in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #15 0x10b71de in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #16 0x101353f in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #17 0xe845b9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #18 0xe845b9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #19 0xe845b9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #20 0x577123 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #21 0x577123 in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #22 0x577123 in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #23 0x5726b1 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #24 0x11b5f3c in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #25 0x11b2062 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #26 0x11aefae in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #27 0x11b5cc8 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #28 0xe6d0c2 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #29 0x56ebda in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #30 0x56dcd1 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #31 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #32 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #33 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #34 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #35 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #36 0x7f56ec05b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #37 0x420aed in _start (/out/gs_device_pdfwrite_fuzzer+0x420aed) + +DEDUP_TOKEN: __interceptor_memcpy--sputs--gx_serialize_Indexed +0x6310000b0830 is located 0 bytes to the right of 65584-byte region [0x6310000a0800,0x6310000b0830) +allocated by thread T0 here: + #0 0x530356 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xaba218 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x705c91 in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:928:36 + #3 0x704c57 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:999:12 + #4 0x102c7ea in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1714:27 + #5 0x1013a64 in zPDFInit /src/ghostpdl/./psi/zpdfops.c:1243:11 + #6 0xe845b9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0xe845b9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0xe845b9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x577123 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #10 0x577123 in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x577123 in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #12 0x5726b1 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #13 0x11b5f3c in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #14 0x11b2062 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #15 0x11aefae in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #16 0x11b5cc8 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #17 0xe6d0c2 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x56ebda in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #19 0x56dcd1 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #20 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #21 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #22 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #23 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #24 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7f56ec05b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--chunk_obj_alloc +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x0c628000e0b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628000e0c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628000e0d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628000e0e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628000e0f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c628000e100: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa + 0x0c628000e110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628000e120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628000e130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628000e140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628000e150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-1208.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-1208.txt new file mode 100755 index 000000000..3fff17b0f --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-1208.txt @@ -0,0 +1,86 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1721891318 +INFO: Loaded 3 modules (190845 inline 8-bit counters): 11664 [0x7f27d68c9ec0, 0x7f27d68ccc50), 878 [0x7f27d695f798, 0x7f27d695fb06), 178303 [0x55be6d93c7b0, 0x55be6d96802f), +INFO: Loaded 3 PC tables (190845 PCs): 11664 [0x7f27d68ccc50,0x7f27d68fa550), 878 [0x7f27d695fb08,0x7f27d69631e8), 178303 [0x55be6d968030,0x55be6dc20820), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-1208 +================================================================= +==12656==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7b27d4807520 at pc 0x55be6b288110 bp 0x7ffdd1a54df0 sp 0x7ffdd1a54de8 +READ of size 1 at 0x7b27d4807520 thread T0 + #0 0x55be6b28810f in pput_hex /src/ghostpdl/./devices/vector/gdevpsfm.c:60:9 + #1 0x55be6b287362 in cmap_put_ranges /src/ghostpdl/./devices/vector/gdevpsfm.c:74:9 + #2 0x55be6b286da5 in psf_write_cmap /src/ghostpdl/./devices/vector/gdevpsfm.c:303:13 + #3 0x55be6b272c6f in pdf_write_cmap /src/ghostpdl/./devices/vector/gdevpdtw.c:816:12 + #4 0x55be6bb8869f in attach_cmap_resource /src/ghostpdl/./devices/vector/gdevpdtc.c:310:20 + #5 0x55be6bb87251 in scan_cmap_text /src/ghostpdl/./devices/vector/gdevpdtc.c:823:28 + #6 0x55be6bb83791 in process_cmap_text /src/ghostpdl/./devices/vector/gdevpdtc.c:965:12 + #7 0x55be6b267cc7 in pdf_text_process /src/ghostpdl/./devices/vector/gdevpdtt.c:3761:16 + #8 0x55be6b8d7dc7 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:445:16 + #9 0x55be6b8d637c in pdfi_show_Tr_preserve /src/ghostpdl/./pdf/pdf_text.c:780:12 + #10 0x55be6b8d1493 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:830:16 + #11 0x55be6b8d217e in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1076:12 + #12 0x55be6b82437c in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1672:24 + #13 0x55be6b822e58 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2162:24 + #14 0x55be6b868a59 in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #15 0x55be6b867b64 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #16 0x55be6b86578d in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:1009:12 + #17 0x55be6b7f307a in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #18 0x55be6b6b5038 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #19 0x55be6b6af646 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #20 0x55be6b6aefae in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #21 0x55be6af3247d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #22 0x55be6af3204a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #23 0x55be6b9165af in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #24 0x55be6b913927 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #25 0x55be6b911832 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #26 0x55be6b916384 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #27 0x55be6af2acdc in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*, int) /src/gs_fuzzlib.h:139:8 + #28 0x55be6af2b061 in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #29 0x55be6adc81dd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #30 0x55be6adb2f52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #31 0x55be6adb8e20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #32 0x55be6ade4952 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #33 0x7f27d6327082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #34 0x55be6adac03d in _start (/out/gs_device_pdfwrite_fuzzer+0x67c03d) + +Address 0x7b27d4807520 is located in stack of thread T0 at offset 1312 in frame + #0 0x55be6b2865af in psf_write_cmap /src/ghostpdl/./devices/vector/gdevpsfm.c:219 + + This frame has 2 object(s): + [32, 72) 'renum' (line 287) + [112, 1312) 'ranges' (line 289) <== Memory access at offset 1312 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ghostpdl/./devices/vector/gdevpsfm.c:60:9 in pput_hex +Shadow bytes around the buggy address: + 0x7b27d4807280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b27d4807300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b27d4807380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b27d4807400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b27d4807480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7b27d4807500: 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x7b27d4807580: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x7b27d4807600: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x7b27d4807680: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x7b27d4807700: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x7b27d4807780: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==12656==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-522.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-522.txt new file mode 100755 index 000000000..8562463aa --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-522.txt @@ -0,0 +1,103 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2482709580 +INFO: Loaded 3 modules (189284 inline 8-bit counters): 11664 [0x7f625c151ec0, 0x7f625c154c50), 878 [0x7f625c1e7798, 0x7f625c1e7b06), 176742 [0x561bc4c76650, 0x561bc4ca18b6), +INFO: Loaded 3 PC tables (189284 PCs): 11664 [0x7f625c154c50,0x7f625c182550), 878 [0x7f625c1e7b08,0x7f625c1eb1e8), 176742 [0x561bc4ca18b8,0x561bc4f53f18), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-522 +================================================================= +==12629==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7e025b323058 at pc 0x561bc30df2f4 bp 0x7ffd577da550 sp 0x7ffd577da548 +READ of size 4 at 0x7e025b323058 thread T0 + #0 0x561bc30df2f3 in Interp /src/ghostpdl/./base/ttinterp.c:4274:10 + #1 0x561bc30d401e in Ins_IUP /src/ghostpdl/./base/ttinterp.c:4395:15 + #2 0x561bc30cd3cf in RunIns /src/ghostpdl/./base/ttinterp.c:5057:7 + #3 0x561bc301516b in Instance_Reset /src/ghostpdl/./base/ttobjs.c:828:15 + #4 0x561bc3006bd4 in ttfFont__Open /src/ghostpdl/./base/ttfmain.c:348:12 + #5 0x561bc2cdb668 in ttfFont__Open_aux /src/ghostpdl/./base/gxttfb.c:448:12 + #6 0x561bc282bbbc in gx_attach_tt_interpreter /src/ghostpdl/./base/gxccman.c:249:12 + #7 0x561bc282c322 in gx_add_fm_pair /src/ghostpdl/./base/gxccman.c:355:20 + #8 0x561bc282809e in gx_lookup_fm_pair /src/ghostpdl/./base/gxccache.c:140:12 + #9 0x561bc2cd262b in gs_type42_glyph_outline /src/ghostpdl/./base/gstype42.c:1329:12 + #10 0x561bc26d05db in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #11 0x561bc2cd6826 in gs_type42_glyph_info_by_gid /src/ghostpdl/./base/gstype42.c:1366:16 + #12 0x561bc2599448 in pdf_compute_font_descriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:469:16 + #13 0x561bc259a654 in pdf_finish_FontDescriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:649:17 + #14 0x561bc25cb13f in pdf_finish_resources /src/ghostpdl/./devices/vector/gdevpdtw.c:684:24 + #15 0x561bc24bb162 in pdf_close /src/ghostpdl/./devices/vector/gdevpdf.c:2765:13 + #16 0x561bc26b55d5 in gs_closedevice /src/ghostpdl/./base/gsdevice.c:786:16 + #17 0x561bc228e653 in gs_main_finit /src/ghostpdl/./psi/imain.c:1351:20 + #18 0x561bc29f67ff in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #19 0x561bc2285cbd in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:135:8 + #20 0x561bc2285fce in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #21 0x561bc21231dd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #22 0x561bc210df52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #23 0x561bc2113e20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #24 0x561bc213f952 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7f625bbaf082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #26 0x561bc210703d in _start (/out/gs_device_pdfwrite_fuzzer+0x67203d) + +0x7e025b323058 is located 8 bytes after 20048-byte region [0x7e025b31e200,0x7e025b323050) +allocated by thread T0 here: + #0 0x561bc2241b34 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x561bc26efbc0 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x561bc2f6aede in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2445:13 + #3 0x561bc2f67a2b in alloc_add_clump /src/ghostpdl/./base/gsalloc.c:2395:19 + #4 0x561bc2f6a470 in alloc_obj /src/ghostpdl/./base/gsalloc.c:2004:17 + #5 0x561bc2f64af9 in i_alloc_bytes /src/ghostpdl/./base/gsalloc.c:1162:15 + #6 0x561bc30e0c59 in Load_TrueType_CVT /src/ghostpdl/./base/ttload.c:145:21 + #7 0x561bc301581c in Face_Create /src/ghostpdl/./base/ttobjs.c:912:10 + #8 0x561bc30066a7 in ttfFont__Open /src/ghostpdl/./base/ttfmain.c:313:12 + #9 0x561bc2cdb668 in ttfFont__Open_aux /src/ghostpdl/./base/gxttfb.c:448:12 + #10 0x561bc282bbbc in gx_attach_tt_interpreter /src/ghostpdl/./base/gxccman.c:249:12 + #11 0x561bc282c322 in gx_add_fm_pair /src/ghostpdl/./base/gxccman.c:355:20 + #12 0x561bc282809e in gx_lookup_fm_pair /src/ghostpdl/./base/gxccache.c:140:12 + #13 0x561bc2cd262b in gs_type42_glyph_outline /src/ghostpdl/./base/gstype42.c:1329:12 + #14 0x561bc26d05db in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #15 0x561bc2cd6826 in gs_type42_glyph_info_by_gid /src/ghostpdl/./base/gstype42.c:1366:16 + #16 0x561bc2599448 in pdf_compute_font_descriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:469:16 + #17 0x561bc259a654 in pdf_finish_FontDescriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:649:17 + #18 0x561bc25cb13f in pdf_finish_resources /src/ghostpdl/./devices/vector/gdevpdtw.c:684:24 + #19 0x561bc24bb162 in pdf_close /src/ghostpdl/./devices/vector/gdevpdf.c:2765:13 + #20 0x561bc26b55d5 in gs_closedevice /src/ghostpdl/./base/gsdevice.c:786:16 + #21 0x561bc228e653 in gs_main_finit /src/ghostpdl/./psi/imain.c:1351:20 + #22 0x561bc29f67ff in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #23 0x561bc2285cbd in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:135:8 + #24 0x561bc2285fce in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #25 0x561bc21231dd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #26 0x561bc210df52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #27 0x561bc2113e20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #28 0x561bc213f952 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #29 0x7f625bbaf082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/ttinterp.c:4274:10 in Interp +Shadow bytes around the buggy address: + 0x7e025b322d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7e025b322e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7e025b322e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7e025b322f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7e025b322f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7e025b323000: 00 00 00 00 00 00 00 00 00 00 fa[fa]fa fa fa fa + 0x7e025b323080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e025b323100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e025b323180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e025b323200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e025b323280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==12629==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-523.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-523.txt new file mode 100755 index 000000000..c6db20fec --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-523.txt @@ -0,0 +1,49 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2937662727 +INFO: Loaded 3 modules (189284 inline 8-bit counters): 11664 [0x7fc1ea614ec0, 0x7fc1ea617c50), 878 [0x7fc1ea6aa798, 0x7fc1ea6aab06), 176742 [0x55e1281f7650, 0x55e1282228b6), +INFO: Loaded 3 PC tables (189284 PCs): 11664 [0x7fc1ea617c50,0x7fc1ea645550), 878 [0x7fc1ea6aab08,0x7fc1ea6ae1e8), 176742 [0x55e1282228b8,0x55e1284d4f18), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-523 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==12630==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x55e12595a81a bp 0x7ffdf66b1ff0 sp 0x7ffdf66b1fa0 T0) +==12630==The signal is caused by a READ memory access. +==12630==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x55e12595a81a in chunk_free_object /src/ghostpdl/./base/gsmchunk.c:1110:31 + #1 0x55e12659156a in Context_Destroy /src/ghostpdl/./base/ttobjs.c:240:4 + #2 0x55e1265868b7 in ttfFont__finit /src/ghostpdl/./base/ttfmain.c:199:13 + #3 0x55e12625c487 in ttfFont__destroy /src/ghostpdl/./base/gxttfb.c:423:5 + #4 0x55e125dae5e2 in gs_clean_fm_pair_attributes /src/ghostpdl/./base/gxccman.c:409:9 + #5 0x55e125db058d in gs_purge_font_from_char_caches_forced /src/ghostpdl/./base/gxccman.c:799:17 + #6 0x55e125c5232d in gs_font_finalize /src/ghostpdl/./base/gsfont.c:167:5 + #7 0x55e12595a845 in chunk_free_object /src/ghostpdl/./base/gsmchunk.c:1112:13 + #8 0x55e12618b9c0 in pdfi_free_font_truetype /src/ghostpdl/./pdf/pdf_fontTT.c:656:9 + #9 0x55e1260d9396 in pdfi_clear_context /src/ghostpdl/./pdf/ghostpdf.c:2060:13 + #10 0x55e1260df92f in pdfi_free_context /src/ghostpdl/./pdf/ghostpdf.c:2094:5 + #11 0x55e1260c8c56 in zPDFclose /src/ghostpdl/./psi/zpdfops.c:617:16 + #12 0x55e125f8ce48 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #13 0x55e125f87456 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #14 0x55e125f86dbe in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #15 0x55e12580e3ad in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #16 0x55e12580df7a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #17 0x55e1261e352f in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #18 0x55e1261e08a7 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #19 0x55e1261de7b2 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #20 0x55e1261e3304 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #21 0x55e125806c6b in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #22 0x55e125806fce in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #23 0x55e1256a41dd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #24 0x55e12568ef52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #25 0x55e125694e20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #26 0x55e1256c0952 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #27 0x7fc1ea072082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #28 0x55e12568803d in _start (/out/gs_device_pdfwrite_fuzzer+0x67203d) + +==12630==Register values: +rax = 0x060533170af2d8b0 rbx = 0x00007cf1e93e11f0 rcx = 0x0000000000000000 rdx = 0x000055e128644600 +rdi = 0x302998b85796c587 rsi = 0x0000000000000001 rbp = 0x00007ffdf66b1ff0 rsp = 0x00007ffdf66b1fa0 + r8 = 0x0000000000000001 r9 = 0x0000000000000001 r10 = 0x00000fd23d28d02f r11 = 0x00000fd2bd285028 +r12 = 0x0000000000000000 r13 = 0x00007e91e9468878 r14 = 0x00007e91e9468858 r15 = 0x00007e91e9468878 +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gsmchunk.c:1110:31 in chunk_free_object +==12630==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-719.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-719.txt new file mode 100644 index 000000000..8159019f9 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-719.txt @@ -0,0 +1,84 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3180943772 +INFO: Loaded 3 modules (221252 inline 8-bit counters): 13672 [0x7f3b1cb9f9e0, 0x7f3b1cba2f48), 959 [0x7f3b1cc00a40, 0x7f3b1cc00dff), 206621 [0x37df330, 0x3811a4d), +INFO: Loaded 3 PC tables (221252 PCs): 13672 [0x7f3b1cba2f48,0x7f3b1cbd85c8), 959 [0x7f3b1cc00e00,0x7f3b1cc049f0), 206621 [0x2a52210,0x2d793e0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-719 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f3b1a3aec40 at pc 0x000000a9bef1 bp 0x7fffcef2a930 sp 0x7fffcef2a928 +WRITE of size 8 at 0x7f3b1a3aec40 thread T0 + #0 0xa9bef0 in gs_glyph_data_from_string /src/ghostpdl/./base/gsgdata.c:119:5 + #1 0x96c89f in copied_type1_subr_data /src/ghostpdl/./devices/gxfcopy.c:961:5 + #2 0x1437972 in gs_type2_interpret /src/ghostpdl/./base/gstype2.c + #3 0x96ba40 in copied_type1_glyph_outline /src/ghostpdl/./devices/gxfcopy.c:1108:16 + #4 0xa958a4 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #5 0x140b90c in gs_type1_glyph_info /src/ghostpdl/./base/gxtype1.c:616:16 + #6 0x96e3b8 in copied_cid0_glyph_info /src/ghostpdl/./devices/gxfcopy.c:1668:12 + #7 0x9206ea in pdf_compute_font_descriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:469:16 + #8 0x922714 in pdf_finish_FontDescriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:649:17 + #9 0x95a8d0 in pdf_finish_resources /src/ghostpdl/./devices/vector/gdevpdtw.c:684:24 + #10 0x80e4a7 in pdf_close /src/ghostpdl/./devices/vector/gdevpdf.c:2785:13 + #11 0xa71a54 in gs_closedevice /src/ghostpdl/./base/gsdevice.c:786:16 + #12 0x579663 in gs_main_finit /src/ghostpdl/./psi/imain.c:1351:20 + #13 0x57a9d2 in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #14 0x57a9d2 in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #15 0xe6def3 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #16 0x56ef7a in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #17 0x56dd2c in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:135:8 + #18 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #19 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #20 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #21 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #22 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #23 0x7f3b1c5a2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #24 0x420aed in _start (/out/gs_device_pdfwrite_fuzzer+0x420aed) + +DEDUP_TOKEN: gs_glyph_data_from_string--copied_type1_subr_data--gs_type2_interpret +Address 0x7f3b1a3aec40 is located in stack of thread T0 at offset 11328 in frame + #0 0x96b63f in copied_type1_glyph_outline /src/ghostpdl/./devices/gxfcopy.c:1064 + +DEDUP_TOKEN: copied_type1_glyph_outline + This frame has 5 object(s): + [32, 80) 'gdata' (line 1074) + [112, 11328) 'cis' (line 1078) <== Memory access at offset 11328 overflows this variable + [11584, 13640) 'ggs' (line 1079) + [13776, 13800) 'imat' (line 1093) + [13840, 13844) 'value' (line 1106) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ghostpdl/./base/gsgdata.c:119:5 in gs_glyph_data_from_string +Shadow bytes around the buggy address: + 0x0fe7e346dd30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe7e346dd40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe7e346dd50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe7e346dd60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe7e346dd70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fe7e346dd80: 00 00 00 00 00 00 00 00[f2]f2 f2 f2 f2 f2 f2 f2 + 0x0fe7e346dd90: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 + 0x0fe7e346dda0: f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 + 0x0fe7e346ddb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe7e346ddc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe7e346ddd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-724.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-724.txt new file mode 100644 index 000000000..2a39364b7 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-724.txt @@ -0,0 +1,80 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3181415183 +INFO: Loaded 3 modules (221252 inline 8-bit counters): 13672 [0x7f61ffb089e0, 0x7f61ffb0bf48), 959 [0x7f61ffb69a40, 0x7f61ffb69dff), 206621 [0x37df330, 0x3811a4d), +INFO: Loaded 3 PC tables (221252 PCs): 13672 [0x7f61ffb0bf48,0x7f61ffb415c8), 959 [0x7f61ffb69e00,0x7f61ffb6d9f0), 206621 [0x2a52210,0x2d793e0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-724 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7f61fce0541c at pc 0x00000143c17b bp 0x7fff42d261d0 sp 0x7fff42d261c8 +READ of size 4 at 0x7f61fce0541c thread T0 + #0 0x143c17a in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:691:33 + #1 0x96ba40 in copied_type1_glyph_outline /src/ghostpdl/./devices/gxfcopy.c:1108:16 + #2 0xa958a4 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #3 0x140b90c in gs_type1_glyph_info /src/ghostpdl/./base/gxtype1.c:616:16 + #4 0x9206ea in pdf_compute_font_descriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:469:16 + #5 0x922714 in pdf_finish_FontDescriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:649:17 + #6 0x95a8d0 in pdf_finish_resources /src/ghostpdl/./devices/vector/gdevpdtw.c:684:24 + #7 0x80e4a7 in pdf_close /src/ghostpdl/./devices/vector/gdevpdf.c:2785:13 + #8 0xa71a54 in gs_closedevice /src/ghostpdl/./base/gsdevice.c:786:16 + #9 0x579663 in gs_main_finit /src/ghostpdl/./psi/imain.c:1351:20 + #10 0x57a9d2 in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #11 0x57a9d2 in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #12 0xe6def3 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #13 0x56ef7a in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #14 0x56dd2c in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:135:8 + #15 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #16 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #17 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #18 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #19 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #20 0x7f61ff50b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #21 0x420aed in _start (/out/gs_device_pdfwrite_fuzzer+0x420aed) + +DEDUP_TOKEN: gs_type2_interpret--copied_type1_glyph_outline--gs_default_glyph_info +Address 0x7f61fce0541c is located in stack of thread T0 at offset 28 in frame + #0 0x143596f in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:124 + +DEDUP_TOKEN: gs_type2_interpret + This frame has 4 object(s): + [32, 224) 'cstack' (line 129) <== Memory access at offset 28 underflows this variable + [288, 300) 'mask' (line 459) + [320, 336) 'join' (line 851) + [352, 368) 'end' (line 851) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-underflow /src/ghostpdl/./base/gstype2.c:691:33 in gs_type2_interpret +Shadow bytes around the buggy address: + 0x0fecbf9b8a30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fecbf9b8a40: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fecbf9b8a50: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fecbf9b8a60: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fecbf9b8a70: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0fecbf9b8a80: f1 f1 f1[f1]00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fecbf9b8a90: 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 + 0x0fecbf9b8aa0: f2 f2 f2 f2 f8 f8 f2 f2 f8 f8 f2 f2 f8 f8 f3 f3 + 0x0fecbf9b8ab0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fecbf9b8ac0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fecbf9b8ad0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-726.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-726.txt new file mode 100644 index 000000000..fd4a9998b --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-726.txt @@ -0,0 +1,156 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3181931597 +INFO: Loaded 3 modules (221252 inline 8-bit counters): 13672 [0x7efc84df29e0, 0x7efc84df5f48), 959 [0x7efc84e53a40, 0x7efc84e53dff), 206621 [0x37df330, 0x3811a4d), +INFO: Loaded 3 PC tables (221252 PCs): 13672 [0x7efc84df5f48,0x7efc84e2b5c8), 959 [0x7efc84e53e00,0x7efc84e579f0), 206621 [0x2a52210,0x2d793e0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-726 +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x61c000000910 at pc 0x000000d7dcbe bp 0x7ffe31a389c0 sp 0x7ffe31a389b8 +READ of size 8 at 0x61c000000910 thread T0 + #0 0xd7dcbd in gx_device_forward_finalize /src/ghostpdl/./base/gdevnfwd.c:33:5 + #1 0xa716ef in gx_device_finalize /src/ghostpdl/./base/gsdevice.c:81:9 + #2 0xf7deb4 in restore_finalize /src/ghostpdl/./psi/isave.c:954:13 + #3 0xf7deb4 in alloc_restore_step_in /src/ghostpdl/./psi/isave.c:759:9 + #4 0xef6967 in dorestore /src/ghostpdl/./psi/zvmem.c:193:16 + #5 0xe64bc0 in z2restore /src/ghostpdl/./psi/zdevice2.c:373:12 + #6 0xe845b9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0xe845b9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0xe845b9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x577123 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #10 0x577123 in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x577123 in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #12 0x5726b1 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #13 0x11b5f3c in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #14 0x11b2062 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #15 0x11aefae in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #16 0x11b5cc8 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #17 0xe6d0c2 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x56ebda in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #19 0x56dcd1 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #20 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #21 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #22 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #23 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #24 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7efc847f5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #26 0x420aed in _start (/out/gs_device_pdfwrite_fuzzer+0x420aed) + +DEDUP_TOKEN: gx_device_forward_finalize--gx_device_finalize--restore_finalize +0x61c000000910 is located 144 bytes inside of 1808-byte region [0x61c000000880,0x61c000000f90) +freed by thread T0 here: + #0 0x5300b2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0xaba9cc in gs_heap_free_object /src/ghostpdl/./base/gsmalloc.c:366:5 + #2 0x1588598 in alloc_free_clump /src/ghostpdl/./base/gsalloc.c:2596:9 + #3 0x1588598 in i_free_object /src/ghostpdl/./base/gsalloc.c:1542:17 + #4 0x5cc3e9 in gx_begin_image3x_generic /src/ghostpdl/./base/gximag3x.c:364:9 + #5 0x86d7e8 in pdf_begin_typed_image /src/ghostpdl/./devices/vector/gdevpdfi.c:1142:16 + #6 0x86ce54 in gdev_pdf_begin_typed_image /src/ghostpdl/./devices/vector/gdevpdfi.c:1710:12 + #7 0xaaabc4 in gs_image_begin_typed /src/ghostpdl/./base/gsimage.c:268:12 + #8 0x10aeacc in pdfi_render_image /src/ghostpdl/./pdf/pdf_image.c:759:16 + #9 0x10a465b in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:2063:12 + #10 0x10a7aa0 in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2553:16 + #11 0x10a8439 in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2643:12 + #12 0x1056dcd in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1475:24 + #13 0x10550ce in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #14 0x10b71de in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #15 0x10b71de in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #16 0x10b71de in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #17 0x101353f in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #18 0xe845b9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #19 0xe845b9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #20 0xe845b9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #21 0x577123 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #22 0x577123 in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #23 0x577123 in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #24 0x5726b1 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #25 0x11b5f3c in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #26 0x11b2062 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #27 0x11aefae in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #28 0x11b5cc8 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #29 0xe6d0c2 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #30 0x56ebda in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #31 0x56dcd1 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #32 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #33 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #34 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #35 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #36 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + +DEDUP_TOKEN: free--gs_heap_free_object--alloc_free_clump +previously allocated by thread T0 here: + #0 0x530356 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xaba218 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x1592faf in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2445:13 + #3 0x158ad33 in alloc_obj /src/ghostpdl/./base/gsalloc.c:1910:13 + #4 0x158ad33 in i_alloc_struct_immovable /src/ghostpdl/./base/gsalloc.c:1241:11 + #5 0xa73ba9 in gs_copydevice2 /src/ghostpdl/./base/gsdevice.c:413:15 + #6 0xa74394 in gs_copydevice /src/ghostpdl/./base/gsdevice.c:448:12 + #7 0x8795cb in pdf_make_mxd /src/ghostpdl/./devices/vector/gdevpdfi.c:2054:16 + #8 0x8795cb in pdf_image3x_make_mid /src/ghostpdl/./devices/vector/gdevpdfi.c:2177:16 + #9 0x5cb4a8 in gx_begin_image3x_generic /src/ghostpdl/./base/gximag3x.c:239:16 + #10 0x86d7e8 in pdf_begin_typed_image /src/ghostpdl/./devices/vector/gdevpdfi.c:1142:16 + #11 0x86ce54 in gdev_pdf_begin_typed_image /src/ghostpdl/./devices/vector/gdevpdfi.c:1710:12 + #12 0xaaabc4 in gs_image_begin_typed /src/ghostpdl/./base/gsimage.c:268:12 + #13 0x10aeacc in pdfi_render_image /src/ghostpdl/./pdf/pdf_image.c:759:16 + #14 0x10a465b in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:2063:12 + #15 0x10a7aa0 in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2553:16 + #16 0x10a8439 in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2643:12 + #17 0x1056dcd in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1475:24 + #18 0x10550ce in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #19 0x10b71de in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #20 0x10b71de in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #21 0x10b71de in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #22 0x101353f in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #23 0xe845b9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #24 0xe845b9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #25 0xe845b9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #26 0x577123 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #27 0x577123 in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #28 0x577123 in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #29 0x5726b1 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #30 0x11b5f3c in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #31 0x11b2062 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #32 0x11aefae in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #33 0x11b5cc8 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #34 0xe6d0c2 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #35 0x56ebda in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #36 0x56dcd1 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #37 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--alloc_acquire_clump +SUMMARY: AddressSanitizer: heap-use-after-free /src/ghostpdl/./base/gdevnfwd.c:33:5 in gx_device_forward_finalize +Shadow bytes around the buggy address: + 0x0c387fff80d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c387fff80e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c387fff80f0: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c387fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c387fff8110: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0c387fff8120: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c387fff8130: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c387fff8140: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c387fff8150: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c387fff8160: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c387fff8170: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-727.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-727.txt new file mode 100644 index 000000000..3934f2675 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-727.txt @@ -0,0 +1,104 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3183196355 +INFO: Loaded 3 modules (221252 inline 8-bit counters): 13672 [0x7fc6c64c59e0, 0x7fc6c64c8f48), 959 [0x7fc6c6526a40, 0x7fc6c6526dff), 206621 [0x37df330, 0x3811a4d), +INFO: Loaded 3 PC tables (221252 PCs): 13672 [0x7fc6c64c8f48,0x7fc6c64fe5c8), 959 [0x7fc6c6526e00,0x7fc6c652a9f0), 206621 [0x2a52210,0x2d793e0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-727 +gsapi_init_with_args: error -25 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61100001ed58 at pc 0x00000091af4d bp 0x7ffe701a5180 sp 0x7ffe701a5178 +READ of size 8 at 0x61100001ed58 thread T0 + #0 0x91af4c in gp_fflush /src/ghostpdl/./base/gp.h:296:16 + #1 0x91af4c in s_file_write_flush /src/ghostpdl/./base/sfxstdio.c:232:5 + #2 0x6ca8ba in sclose /src/ghostpdl/./base/stream.c:445:18 + #3 0x6c7fcd in stream_finalize /src/ghostpdl/./base/stream.c:91:9 + #4 0xf7fdf8 in restore_finalize /src/ghostpdl/./psi/isave.c:954:13 + #5 0xf7fdf8 in alloc_restore_all /src/ghostpdl/./psi/isave.c:901:13 + #6 0x579ea4 in gs_main_finit /src/ghostpdl/./psi/imain.c:1391:20 + #7 0x57a9d2 in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #8 0x57a9d2 in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #9 0xe6def3 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #10 0x56ef7a in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #11 0x56dd2c in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:135:8 + #12 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #13 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #14 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #15 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #16 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #17 0x7fc6c5ec8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #18 0x420aed in _start (/out/gs_device_pdfwrite_fuzzer+0x420aed) + +DEDUP_TOKEN: gp_fflush--s_file_write_flush--sclose +0x61100001ed58 is located 224 bytes to the right of 248-byte region [0x61100001eb80,0x61100001ec78) +allocated by thread T0 here: + #0 0x530356 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xaba218 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0xac3945 in gs_raw_alloc_struct_immovable /src/ghostpdl/./base/gsmemory.c:128:12 + #3 0x1592e28 in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2423:10 + #4 0x1591ebc in alloc_add_clump /src/ghostpdl/./base/gsalloc.c:2395:19 + #5 0x1591ebc in alloc_obj /src/ghostpdl/./base/gsalloc.c:2004:17 + #6 0x158a4e9 in i_alloc_bytes /src/ghostpdl/./base/gsalloc.c:1162:15 + #7 0xa7a021 in gx_device_open_output_file /src/ghostpdl/./base/gsdevice.c:1264:28 + #8 0x90eba5 in gdev_vector_open_file_options /src/ghostpdl/./base/gdevvec.c:282:13 + #9 0x80bbd9 in pdf_open /src/ghostpdl/./devices/vector/gdevpdf.c:787:12 + #10 0xa74c2c in gs_opendevice /src/ghostpdl/./base/gsdevice.c:461:20 + #11 0xa74c2c in gs_setdevice_no_erase /src/ghostpdl/./base/gsdevice.c:580:28 + #12 0xf485aa in zsetdevice_no_safer /src/ghostpdl/./psi/zdevice.c:594:12 + #13 0xf485aa in zsetdevice /src/ghostpdl/./psi/zdevice.c:637:12 + #14 0xe845b9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #15 0xe845b9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #16 0xe845b9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #17 0x572363 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #18 0x572363 in gs_run_init_file /src/ghostpdl/./psi/imain.c:861:12 + #19 0x572363 in gs_main_init2aux /src/ghostpdl/./psi/imain.c:305:16 + #20 0x573bf1 in gs_main_init2 /src/ghostpdl/./psi/imain.c:491:12 + #21 0x11b2018 in swproc /src/ghostpdl/./psi/imainarg.c:363:20 + #22 0x11aefae in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #23 0x11b5cc8 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #24 0xe6d0c2 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #25 0x56ebda in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #26 0x56dcd1 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #27 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #28 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #29 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #30 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #31 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #32 0x7fc6c5ec8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--gs_raw_alloc_struct_immovable +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/gp.h:296:16 in gp_fflush +Shadow bytes around the buggy address: + 0x0c227fffbd50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffbd60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffbd70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffbd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c227fffbd90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c227fffbda0: fa fa fa fa fa fa fa fa fa fa fa[fa]fa fa fa fa + 0x0c227fffbdb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffbdc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffbdd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffbde0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffbdf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-744.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-744.txt new file mode 100644 index 000000000..a4d385067 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-744.txt @@ -0,0 +1,107 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3186491162 +INFO: Loaded 3 modules (221252 inline 8-bit counters): 13672 [0x7fc159b4d9e0, 0x7fc159b50f48), 959 [0x7fc159baea40, 0x7fc159baedff), 206621 [0x37df330, 0x3811a4d), +INFO: Loaded 3 PC tables (221252 PCs): 13672 [0x7fc159b50f48,0x7fc159b865c8), 959 [0x7fc159baee00,0x7fc159bb29f0), 206621 [0x2a52210,0x2d793e0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-744 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fc157084460 at pc 0x000000a9bfc2 bp 0x7ffd944bec60 sp 0x7ffd944bec58 +WRITE of size 8 at 0x7fc157084460 thread T0 + #0 0xa9bfc1 in gs_glyph_data_from_bytes /src/ghostpdl/./base/gsgdata.c:127:5 + #1 0x11143f9 in pdfi_cff_subr_data /src/ghostpdl/./pdf/pdf_font1C.c:176:13 + #2 0x140af11 in gs_type1_piece_codes /src/ghostpdl/./base/gxtype1.c:462:20 + #3 0x140ba41 in gs_type1_glyph_pieces /src/ghostpdl/./base/gxtype1.c:583:16 + #4 0x140ba41 in gs_type1_glyph_info /src/ghostpdl/./base/gxtype1.c:631:16 + #5 0x110fcee in pdfi_cff_glyph_info /src/ghostpdl/./pdf/pdf_font1C.c:397:16 + #6 0x97f127 in psf_add_subset_pieces /src/ghostpdl/./devices/vector/gdevpsfu.c:129:20 + #7 0x960f7d in gs_copy_glyph_options /src/ghostpdl/./devices/gxfcopy.c:2397:12 + #8 0x96225e in gs_copy_glyph /src/ghostpdl/./devices/gxfcopy.c:2379:12 + #9 0x96225e in gs_copy_font_complete /src/ghostpdl/./devices/gxfcopy.c:2511:20 + #10 0x14c926a in pdf_base_font_alloc /src/ghostpdl/./devices/vector/gdevpdtb.c:322:16 + #11 0x91f303 in pdf_font_descriptor_alloc /src/ghostpdl/./devices/vector/gdevpdtd.c:202:16 + #12 0x940d0b in pdf_make_font_resource /src/ghostpdl/./devices/vector/gdevpdtt.c:1607:17 + #13 0x944f0b in pdf_obtain_font_resource_encoded /src/ghostpdl/./devices/vector/gdevpdtt.c:2141:24 + #14 0x9430c5 in pdf_obtain_font_resource /src/ghostpdl/./devices/vector/gdevpdtt.c:2247:12 + #15 0x14d56b2 in pdf_process_string /src/ghostpdl/./devices/vector/gdevpdte.c:837:12 + #16 0x14d56b2 in pdf_process_string_aux /src/ghostpdl/./devices/vector/gdevpdte.c:81:12 + #17 0x14e2d5d in process_plain_text /src/ghostpdl/./devices/vector/gdevpdte.c:1841:16 + #18 0x951f77 in pdf_text_process /src/ghostpdl/./devices/vector/gdevpdtt.c:3752:16 + #19 0xaf4e9e in gs_text_process /src/ghostpdl/./base/gstext.c:670:12 + #20 0x1154562 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:445:16 + #21 0x1154562 in pdfi_show_Tr_preserve /src/ghostpdl/./pdf/pdf_text.c:780:12 + #22 0x1154562 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:830:16 + #23 0x1155987 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1069:12 + #24 0x105700a in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1646:24 + #25 0x10550ce in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #26 0x10b71de in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #27 0x10b71de in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #28 0x10b71de in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #29 0x101353f in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #30 0xe845b9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #31 0xe845b9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #32 0xe845b9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #33 0x577123 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #34 0x577123 in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #35 0x577123 in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #36 0x5726b1 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #37 0x11b5f3c in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #38 0x11b2062 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #39 0x11aefae in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #40 0x11b5cc8 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #41 0xe6d0c2 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #42 0x56ebda in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #43 0x56dcd1 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #44 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #45 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #46 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #47 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #48 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #49 0x7fc159550082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #50 0x420aed in _start (/out/gs_device_pdfwrite_fuzzer+0x420aed) + +DEDUP_TOKEN: gs_glyph_data_from_bytes--pdfi_cff_subr_data--gs_type1_piece_codes +Address 0x7fc157084460 is located in stack of thread T0 at offset 1120 in frame + #0 0x140a2ef in gs_type1_piece_codes /src/ghostpdl/./base/gxtype1.c:351 + +DEDUP_TOKEN: gs_type1_piece_codes + This frame has 2 object(s): + [32, 224) 'cstack' (line 367) + [288, 1080) 'ipstack' (line 369) <== Memory access at offset 1120 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ghostpdl/./base/gsgdata.c:127:5 in gs_glyph_data_from_bytes +Shadow bytes around the buggy address: + 0x0ff8aae08830: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff8aae08840: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff8aae08850: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff8aae08860: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff8aae08870: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0ff8aae08880: 00 00 00 00 00 00 00 f3 f3 f3 f3 f3[f3]f3 f3 f3 + 0x0ff8aae08890: f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 + 0x0ff8aae088a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff8aae088b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff8aae088c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff8aae088d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-751.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-751.txt new file mode 100644 index 000000000..39fe8cb5b --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-751.txt @@ -0,0 +1,111 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3230389077 +INFO: Loaded 3 modules (221252 inline 8-bit counters): 13672 [0x7f77d587f9e0, 0x7f77d5882f48), 959 [0x7f77d58e0a40, 0x7f77d58e0dff), 206621 [0x37df330, 0x3811a4d), +INFO: Loaded 3 PC tables (221252 PCs): 13672 [0x7f77d5882f48,0x7f77d58b85c8), 959 [0x7f77d58e0e00,0x7f77d58e49f0), 206621 [0x2a52210,0x2d793e0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-751 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62500006d898 at pc 0x00000143c48f bp 0x7fff9321fd90 sp 0x7fff9321fd88 +READ of size 1 at 0x62500006d898 thread T0 + #0 0x143c48e in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:190:17 + #1 0x96ba40 in copied_type1_glyph_outline /src/ghostpdl/./devices/gxfcopy.c:1108:16 + #2 0xa958a4 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #3 0x140b90c in gs_type1_glyph_info /src/ghostpdl/./base/gxtype1.c:616:16 + #4 0x9206ea in pdf_compute_font_descriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:469:16 + #5 0x922714 in pdf_finish_FontDescriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:649:17 + #6 0x95a8d0 in pdf_finish_resources /src/ghostpdl/./devices/vector/gdevpdtw.c:684:24 + #7 0x80e4a7 in pdf_close /src/ghostpdl/./devices/vector/gdevpdf.c:2785:13 + #8 0xa71a54 in gs_closedevice /src/ghostpdl/./base/gsdevice.c:786:16 + #9 0x579663 in gs_main_finit /src/ghostpdl/./psi/imain.c:1351:20 + #10 0x57a9d2 in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #11 0x57a9d2 in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #12 0xe6def3 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #13 0x56ef7a in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #14 0x56dd2c in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:135:8 + #15 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #16 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #17 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #18 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #19 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #20 0x7f77d5282082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #21 0x420aed in _start (/out/gs_device_pdfwrite_fuzzer+0x420aed) + +DEDUP_TOKEN: gs_type2_interpret--copied_type1_glyph_outline--gs_default_glyph_info +0x62500006d898 is located 0 bytes to the right of 8088-byte region [0x62500006b900,0x62500006d898) +allocated by thread T0 here: + #0 0x530356 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xaba218 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x1592faf in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2445:13 + #3 0x159154c in alloc_obj /src/ghostpdl/./base/gsalloc.c:1910:13 + #4 0x158a4e9 in i_alloc_bytes /src/ghostpdl/./base/gsalloc.c:1162:15 + #5 0x96be78 in copy_subrs /src/ghostpdl/./devices/gxfcopy.c:355:16 + #6 0x96ae8b in copy_font_type1 /src/ghostpdl/./devices/gxfcopy.c:1020:17 + #7 0x95edfd in gs_copy_font /src/ghostpdl/./devices/gxfcopy.c:2212:12 + #8 0x14c8b0a in pdf_base_font_alloc /src/ghostpdl/./devices/vector/gdevpdtb.c:293:12 + #9 0x91f303 in pdf_font_descriptor_alloc /src/ghostpdl/./devices/vector/gdevpdtd.c:202:16 + #10 0x940d0b in pdf_make_font_resource /src/ghostpdl/./devices/vector/gdevpdtt.c:1607:17 + #11 0x944f0b in pdf_obtain_font_resource_encoded /src/ghostpdl/./devices/vector/gdevpdtt.c:2141:24 + #12 0x9430c5 in pdf_obtain_font_resource /src/ghostpdl/./devices/vector/gdevpdtt.c:2247:12 + #13 0x14d56b2 in pdf_process_string /src/ghostpdl/./devices/vector/gdevpdte.c:837:12 + #14 0x14d56b2 in pdf_process_string_aux /src/ghostpdl/./devices/vector/gdevpdte.c:81:12 + #15 0x14e2d5d in process_plain_text /src/ghostpdl/./devices/vector/gdevpdte.c:1841:16 + #16 0x951f77 in pdf_text_process /src/ghostpdl/./devices/vector/gdevpdtt.c:3752:16 + #17 0xaf4e9e in gs_text_process /src/ghostpdl/./base/gstext.c:670:12 + #18 0x1154562 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:445:16 + #19 0x1154562 in pdfi_show_Tr_preserve /src/ghostpdl/./pdf/pdf_text.c:780:12 + #20 0x1154562 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:830:16 + #21 0x1155987 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1069:12 + #22 0x105700a in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1646:24 + #23 0x10550ce in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #24 0x10b71de in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #25 0x10b71de in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #26 0x10b71de in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #27 0x101353f in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #28 0xe845b9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #29 0xe845b9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #30 0xe845b9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #31 0x577123 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #32 0x577123 in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #33 0x577123 in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #34 0x5726b1 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #35 0x11b5f3c in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #36 0x11b2062 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #37 0x11aefae in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #38 0x11b5cc8 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--alloc_acquire_clump +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/gstype2.c:190:17 in gs_type2_interpret +Shadow bytes around the buggy address: + 0x0c4a80005ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4a80005ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4a80005ae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4a80005af0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4a80005b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c4a80005b10: 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a80005b20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a80005b30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a80005b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a80005b50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a80005b60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-757.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-757.txt new file mode 100755 index 000000000..57edf9172 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-757.txt @@ -0,0 +1,54 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2032565563 +INFO: Loaded 3 modules (189758 inline 8-bit counters): 11664 [0x7fd916076ec0, 0x7fd916079c50), 878 [0x7fd91610c798, 0x7fd91610cb06), 177216 [0x55e9cd12b6b0, 0x55e9cd156af0), +INFO: Loaded 3 PC tables (189758 PCs): 11664 [0x7fd916079c50,0x7fd9160a7550), 878 [0x7fd91610cb08,0x7fd9161101e8), 177216 [0x55e9cd156af0,0x55e9cd40aef0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-757 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==12637==ERROR: AddressSanitizer: SEGV on unknown address 0x55e9cc60c268 (pc 0x55e9cb014442 bp 0x7fff83ff40b0 sp 0x7fff83ff40a0 T0) +==12637==The signal is caused by a WRITE memory access. + #0 0x55e9cb014442 in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:73:14 + #1 0x55e9cb0141ee in pdfi_free_array /src/ghostpdl/./pdf/pdf_array.c:35:13 + #2 0x55e9cb05682e in pdfi_pop /src/ghostpdl/./pdf/pdf_stack.c:35:9 + #3 0x55e9cb00e5fb in pdfi_dict_from_stack /src/ghostpdl/./pdf/pdf_dict.c:166:17 + #4 0x55e9cb01ee10 in pdfi_read_token /src/ghostpdl/./pdf/pdf_int.c:1092:24 + #5 0x55e9cb0fa3db in pdfi_read_bare_object /src/ghostpdl/./pdf/pdf_deref.c:458:16 + #6 0x55e9cb0ff673 in pdfi_read_object /src/ghostpdl/./pdf/pdf_deref.c:572:12 + #7 0x55e9cb0fc5a9 in pdfi_dereference_main /src/ghostpdl/./pdf/pdf_deref.c:969:20 + #8 0x55e9cb0fd09c in pdfi_deref_loop_detect /src/ghostpdl/./pdf/pdf_deref.c:1060:12 + #9 0x55e9cb00f680 in pdfi_dict_get_by_key /src/ghostpdl/./pdf/pdf_dict.c:402:16 + #10 0x55e9cb07d105 in pdfi_annot_get_NormAP /src/ghostpdl/./pdf/pdf_annot.c:1574:20 + #11 0x55e9cb07c71a in pdfi_annot_draw /src/ghostpdl/./pdf/pdf_annot.c:3894:12 + #12 0x55e9cb07d4be in pdfi_annot_preserve /src/ghostpdl/./pdf/pdf_annot.c:4431:20 + #13 0x55e9cb070b20 in pdfi_annot_handle /src/ghostpdl/./pdf/pdf_annot.c:4458:16 + #14 0x55e9cb070805 in pdfi_do_annotations /src/ghostpdl/./pdf/pdf_annot.c:4485:16 + #15 0x55e9cb068359 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:166:13 + #16 0x55e9cb066275 in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #17 0x55e9caff643a in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #18 0x55e9caeb8378 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #19 0x55e9caeb2986 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #20 0x55e9caeb22ee in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #21 0x55e9ca7393ad in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #22 0x55e9ca738f7a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #23 0x55e9cb11522f in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #24 0x55e9cb1125a7 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #25 0x55e9cb1104b2 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #26 0x55e9cb115004 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #27 0x55e9ca731c6b in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #28 0x55e9ca731fce in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #29 0x55e9ca5cf1dd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #30 0x55e9ca5b9f52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #31 0x55e9ca5bfe20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #32 0x55e9ca5eb952 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #33 0x7fd915ad4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #34 0x55e9ca5b303d in _start (/out/gs_device_pdfwrite_fuzzer+0x67503d) + +==12637==Register values: +rax = 0x0000000000000000 rbx = 0x000055e9cc60c260 rcx = 0x00000fd522a3fe83 rdx = 0x00007ea9151fedc0 +rdi = 0x000055e9cc60c268 rsi = 0x00000000cb76f19f rbp = 0x00007fff83ff40b0 rsp = 0x00007fff83ff40a0 + r8 = 0x000055e9cd57a200 r9 = 0x0000000000000001 r10 = 0x00000fd522a3fdec r11 = 0x00000fd522a3fdbc +r12 = 0x00000fd522a3fdb8 r13 = 0x0000000000000000 r14 = 0x00000000cb76f1a0 r15 = 0x00000fd522a3fdb9 +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_stack.h:73:14 in pdfi_countdown_impl +==12637==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-772.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-772.txt new file mode 100644 index 000000000..bd1154cb6 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-772.txt @@ -0,0 +1,56 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3232786400 +INFO: Loaded 3 modules (221252 inline 8-bit counters): 13672 [0x7f459f45e9e0, 0x7f459f461f48), 959 [0x7f459f4bfa40, 0x7f459f4bfdff), 206621 [0x37df330, 0x3811a4d), +INFO: Loaded 3 PC tables (221252 PCs): 13672 [0x7f459f461f48,0x7f459f4975c8), 959 [0x7f459f4bfe00,0x7f459f4c39f0), 206621 [0x2a52210,0x2d793e0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-772 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x63100130bb16 (pc 0x00000113b192 bp 0x7ffe5ff58610 sp 0x7ffe5ff585f0 T0) +==1==The signal is caused by a READ memory access. + #0 0x113b192 in pdfi_cidtype2_get_glyph_index /src/ghostpdl/./pdf/pdf_font11.c:73:23 + #1 0x125ca02 in gs_type42_glyph_info /src/ghostpdl/./base/gstype42.c:1437:23 + #2 0x113a435 in pdfi_cidtype2_glyph_info /src/ghostpdl/./pdf/pdf_font11.c:90:12 + #3 0x9650db in compare_glyphs /src/ghostpdl/./devices/gxfcopy.c:811:17 + #4 0x962f6f in gs_copied_can_copy_glyphs /src/ghostpdl/./devices/gxfcopy.c:2620:12 + #5 0x93f980 in pdf_obtain_cidfont_resource /src/ghostpdl/./devices/vector/gdevpdtt.c:1342:16 + #6 0x14ced6d in scan_cmap_text /src/ghostpdl/./devices/vector/gdevpdtc.c:502:28 + #7 0x14ced6d in process_cmap_text /src/ghostpdl/./devices/vector/gdevpdtc.c:965:12 + #8 0x95200b in pdf_text_process /src/ghostpdl/./devices/vector/gdevpdtt.c:3758:16 + #9 0xaf4e9e in gs_text_process /src/ghostpdl/./base/gstext.c:670:12 + #10 0x1154562 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:445:16 + #11 0x1154562 in pdfi_show_Tr_preserve /src/ghostpdl/./pdf/pdf_text.c:780:12 + #12 0x1154562 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:830:16 + #13 0x1155987 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1069:12 + #14 0x105700a in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1646:24 + #15 0x10550ce in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #16 0x10b6e78 in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:116:28 + #17 0x10b6e78 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #18 0x10b6e78 in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #19 0x101353f in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #20 0xe845b9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #21 0xe845b9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #22 0xe845b9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #23 0x577123 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #24 0x577123 in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #25 0x577123 in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #26 0x5726b1 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #27 0x11b5f3c in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #28 0x11b2062 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #29 0x11aefae in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #30 0x11b5cc8 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #31 0xe6d0c2 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #32 0x56ebda in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #33 0x56dcd1 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #34 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #35 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #36 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #37 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #38 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #39 0x7f459ee61082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #40 0x420aed in _start (/out/gs_device_pdfwrite_fuzzer+0x420aed) + +DEDUP_TOKEN: pdfi_cidtype2_get_glyph_index--gs_type42_glyph_info--pdfi_cidtype2_glyph_info +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_font11.c:73:23 in pdfi_cidtype2_get_glyph_index +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-797.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-797.txt new file mode 100644 index 000000000..f449dcf1e --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-797.txt @@ -0,0 +1,113 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3188422830 +INFO: Loaded 3 modules (221252 inline 8-bit counters): 13672 [0x7f5f8af5c9e0, 0x7f5f8af5ff48), 959 [0x7f5f8afbda40, 0x7f5f8afbddff), 206621 [0x37df330, 0x3811a4d), +INFO: Loaded 3 PC tables (221252 PCs): 13672 [0x7f5f8af5ff48,0x7f5f8af955c8), 959 [0x7f5f8afbde00,0x7f5f8afc19f0), 206621 [0x2a52210,0x2d793e0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-797 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x625000090d68 at pc 0x000001738d6f bp 0x7ffe88cb8be0 sp 0x7ffe88cb8bd8 +READ of size 1 at 0x625000090d68 thread T0 + #0 0x1738d6e in Ins_NPUSHB /src/ghostpdl/./base/ttinterp.c:2335:23 + #1 0x172c22f in RunIns /src/ghostpdl/./base/ttinterp.c:5078:7 + #2 0x16634e6 in Instance_Reset /src/ghostpdl/./base/ttobjs.c:831:15 + #3 0x1651377 in TT_Set_Instance_CharSizes /src/ghostpdl/./base/ttfmain.c:138:12 + #4 0x16530ea in ttfFont__Open /src/ghostpdl/./base/ttfmain.c:348:12 + #5 0x1266e5d in ttfFont__Open_aux /src/ghostpdl/./base/gxttfb.c:448:12 + #6 0xc32cd3 in gx_attach_tt_interpreter /src/ghostpdl/./base/gxccman.c:249:12 + #7 0xc33bd0 in gx_add_fm_pair /src/ghostpdl/./base/gxccman.c:355:20 + #8 0xc2ee2a in gx_lookup_fm_pair /src/ghostpdl/./base/gxccache.c:140:12 + #9 0x125c4f8 in gs_type42_glyph_outline /src/ghostpdl/./base/gstype42.c:1341:12 + #10 0xa958a4 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #11 0x1261cae in gs_type42_glyph_info_by_gid /src/ghostpdl/./base/gstype42.c:1378:16 + #12 0x125caf8 in gs_type42_glyph_info /src/ghostpdl/./base/gstype42.c:1449:12 + #13 0x9206ea in pdf_compute_font_descriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:469:16 + #14 0x922714 in pdf_finish_FontDescriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:649:17 + #15 0x95a8d0 in pdf_finish_resources /src/ghostpdl/./devices/vector/gdevpdtw.c:684:24 + #16 0x80e4a7 in pdf_close /src/ghostpdl/./devices/vector/gdevpdf.c:2785:13 + #17 0xa71a54 in gs_closedevice /src/ghostpdl/./base/gsdevice.c:786:16 + #18 0x579663 in gs_main_finit /src/ghostpdl/./psi/imain.c:1351:20 + #19 0x57a9d2 in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #20 0x57a9d2 in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #21 0xe6def3 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #22 0x56ef7a in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #23 0x56dd2c in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:135:8 + #24 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #25 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #26 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #27 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #28 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #29 0x7f5f8a95f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #30 0x420aed in _start (/out/gs_device_pdfwrite_fuzzer+0x420aed) + +DEDUP_TOKEN: Ins_NPUSHB--RunIns--Instance_Reset +0x625000090d68 is located 0 bytes to the right of 9320-byte region [0x62500008e900,0x625000090d68) +allocated by thread T0 here: + #0 0x530356 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xaba218 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x1592faf in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2445:13 + #3 0x159154c in alloc_obj /src/ghostpdl/./base/gsalloc.c:1910:13 + #4 0x158a4e9 in i_alloc_bytes /src/ghostpdl/./base/gsalloc.c:1162:15 + #5 0x1266a4a in gx_ttfMemory__alloc_bytes /src/ghostpdl/./base/gxttfb.c:323:12 + #6 0x1742b4f in Load_TrueType_Programs /src/ghostpdl/./base/ttload.c:216:26 + #7 0x16642f3 in Face_Create /src/ghostpdl/./base/ttobjs.c:917:10 + #8 0x1652b5a in ttfFont__Open /src/ghostpdl/./base/ttfmain.c:313:12 + #9 0x1266e5d in ttfFont__Open_aux /src/ghostpdl/./base/gxttfb.c:448:12 + #10 0xc32cd3 in gx_attach_tt_interpreter /src/ghostpdl/./base/gxccman.c:249:12 + #11 0xc33bd0 in gx_add_fm_pair /src/ghostpdl/./base/gxccman.c:355:20 + #12 0xc2ee2a in gx_lookup_fm_pair /src/ghostpdl/./base/gxccache.c:140:12 + #13 0x125c4f8 in gs_type42_glyph_outline /src/ghostpdl/./base/gstype42.c:1341:12 + #14 0xa958a4 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #15 0x1261cae in gs_type42_glyph_info_by_gid /src/ghostpdl/./base/gstype42.c:1378:16 + #16 0x125caf8 in gs_type42_glyph_info /src/ghostpdl/./base/gstype42.c:1449:12 + #17 0x9206ea in pdf_compute_font_descriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:469:16 + #18 0x922714 in pdf_finish_FontDescriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:649:17 + #19 0x95a8d0 in pdf_finish_resources /src/ghostpdl/./devices/vector/gdevpdtw.c:684:24 + #20 0x80e4a7 in pdf_close /src/ghostpdl/./devices/vector/gdevpdf.c:2785:13 + #21 0xa71a54 in gs_closedevice /src/ghostpdl/./base/gsdevice.c:786:16 + #22 0x579663 in gs_main_finit /src/ghostpdl/./psi/imain.c:1351:20 + #23 0x57a9d2 in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #24 0x57a9d2 in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #25 0xe6def3 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #26 0x56ef7a in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #27 0x56dd2c in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:135:8 + #28 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #29 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #30 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--alloc_acquire_clump +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/ttinterp.c:2335:23 in Ins_NPUSHB +Shadow bytes around the buggy address: + 0x0c4a8000a150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4a8000a160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4a8000a170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4a8000a180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c4a8000a190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c4a8000a1a0: 00 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa fa + 0x0c4a8000a1b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a8000a1c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a8000a1d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a8000a1e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4a8000a1f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-818.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-818.txt new file mode 100644 index 000000000..79358c3bb --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-818.txt @@ -0,0 +1,138 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3188988747 +INFO: Loaded 3 modules (221252 inline 8-bit counters): 13672 [0x7fe7d840f9e0, 0x7fe7d8412f48), 959 [0x7fe7d8470a40, 0x7fe7d8470dff), 206621 [0x37df330, 0x3811a4d), +INFO: Loaded 3 PC tables (221252 PCs): 13672 [0x7fe7d8412f48,0x7fe7d84485c8), 959 [0x7fe7d8470e00,0x7fe7d84749f0), 206621 [0x2a52210,0x2d793e0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-818 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000128830 at pc 0x0000017391d0 bp 0x7ffd919a4310 sp 0x7ffd919a4308 +READ of size 1 at 0x631000128830 thread T0 + #0 0x17391cf in GetShortIns /src/ghostpdl/./base/ttinterp.c:735:14 + #1 0x17391cf in Ins_NPUSHW /src/ghostpdl/./base/ttinterp.c:2361:19 + #2 0x172c22f in RunIns /src/ghostpdl/./base/ttinterp.c:5078:7 + #3 0x16634e6 in Instance_Reset /src/ghostpdl/./base/ttobjs.c:831:15 + #4 0x1651377 in TT_Set_Instance_CharSizes /src/ghostpdl/./base/ttfmain.c:138:12 + #5 0x16530ea in ttfFont__Open /src/ghostpdl/./base/ttfmain.c:348:12 + #6 0x1266e5d in ttfFont__Open_aux /src/ghostpdl/./base/gxttfb.c:448:12 + #7 0xc32cd3 in gx_attach_tt_interpreter /src/ghostpdl/./base/gxccman.c:249:12 + #8 0xc328fc in gx_provide_fm_pair_attributes /src/ghostpdl/./base/gxccman.c:276:16 + #9 0x125c5de in gs_type42_glyph_outline /src/ghostpdl/./base/gstype42.c:1349:9 + #10 0xa958a4 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #11 0x1261cae in gs_type42_glyph_info_by_gid /src/ghostpdl/./base/gstype42.c:1378:16 + #12 0x125caf8 in gs_type42_glyph_info /src/ghostpdl/./base/gstype42.c:1449:12 + #13 0x113a435 in pdfi_cidtype2_glyph_info /src/ghostpdl/./pdf/pdf_font11.c:90:12 + #14 0x94b9f6 in pdf_glyph_widths /src/ghostpdl/./devices/vector/gdevpdtt.c:2810:16 + #15 0x14d0936 in scan_cmap_text /src/ghostpdl/./devices/vector/gdevpdtc.c:730:32 + #16 0x14d0936 in process_cmap_text /src/ghostpdl/./devices/vector/gdevpdtc.c:965:12 + #17 0x95200b in pdf_text_process /src/ghostpdl/./devices/vector/gdevpdtt.c:3758:16 + #18 0xaf4e9e in gs_text_process /src/ghostpdl/./base/gstext.c:670:12 + #19 0x1154562 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:445:16 + #20 0x1154562 in pdfi_show_Tr_preserve /src/ghostpdl/./pdf/pdf_text.c:780:12 + #21 0x1154562 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:830:16 + #22 0x1156dce in pdfi_TJ /src/ghostpdl/./pdf/pdf_text.c:1190:20 + #23 0x1056da1 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1650:24 + #24 0x10550ce in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #25 0x10b6e78 in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:116:28 + #26 0x10b6e78 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #27 0x10b6e78 in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #28 0x101353f in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #29 0xe845b9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #30 0xe845b9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #31 0xe845b9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #32 0x577123 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #33 0x577123 in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #34 0x577123 in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #35 0x5726b1 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #36 0x11b5f3c in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #37 0x11b2062 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #38 0x11aefae in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #39 0x11b5cc8 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #40 0xe6d0c2 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #41 0x56ebda in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #42 0x56dcd1 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #43 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #44 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #45 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #46 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #47 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #48 0x7fe7d7e12082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #49 0x420aed in _start (/out/gs_device_pdfwrite_fuzzer+0x420aed) + +DEDUP_TOKEN: GetShortIns--Ins_NPUSHW--RunIns +0x631000128830 is located 0 bytes to the right of 65584-byte region [0x631000118800,0x631000128830) +allocated by thread T0 here: + #0 0x530356 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xaba218 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x705c91 in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:928:36 + #3 0x704c57 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:999:12 + #4 0x114612b in general_endcidrange_func /src/ghostpdl/./pdf/pdf_cmap.c:219:46 + #5 0x11428be in cmap_endcidrange_func /src/ghostpdl/./pdf/pdf_cmap.c:258:12 + #6 0x111f525 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:362:36 + #7 0x113c5ce in pdfi_read_cmap /src/ghostpdl/./pdf/pdf_cmap.c:865:12 + #8 0x113ee67 in cmap_usecmap_func /src/ghostpdl/./pdf/pdf_cmap.c:59:20 + #9 0x111f525 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:362:36 + #10 0x113c5ce in pdfi_read_cmap /src/ghostpdl/./pdf/pdf_cmap.c:865:12 + #11 0x10f3b26 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:209:16 + #12 0x10e2984 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:868:20 + #13 0x10e9b59 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:1006:20 + #14 0x10ed0d9 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:1048:12 + #15 0x10ed0d9 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1407:12 + #16 0x1056df9 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1642:24 + #17 0x10550ce in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #18 0x10b6e78 in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:116:28 + #19 0x10b6e78 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #20 0x10b6e78 in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #21 0x101353f in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #22 0xe845b9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #23 0xe845b9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #24 0xe845b9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #25 0x577123 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #26 0x577123 in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #27 0x577123 in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #28 0x5726b1 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #29 0x11b5f3c in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #30 0x11b2062 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #31 0x11aefae in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #32 0x11b5cc8 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #33 0xe6d0c2 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #34 0x56ebda in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #35 0x56dcd1 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #36 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--chunk_obj_alloc +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/ttinterp.c:735:14 in GetShortIns +Shadow bytes around the buggy address: + 0x0c628001d0b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001d0c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001d0d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001d0e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001d0f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c628001d100: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa + 0x0c628001d110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001d120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001d130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001d140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001d150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-855.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-855.txt new file mode 100644 index 000000000..2626f908b --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-855.txt @@ -0,0 +1,65 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3189420857 +INFO: Loaded 3 modules (221252 inline 8-bit counters): 13672 [0x7f5698a249e0, 0x7f5698a27f48), 959 [0x7f5698a85a40, 0x7f5698a85dff), 206621 [0x37df330, 0x3811a4d), +INFO: Loaded 3 PC tables (221252 PCs): 13672 [0x7f5698a27f48,0x7f5698a5d5c8), 959 [0x7f5698a85e00,0x7f5698a899f0), 206621 [0x2a52210,0x2d793e0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-855 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x633000071468 (pc 0x00000173054d bp 0x7fff5d4eaa90 sp 0x7fff5d4ea9e0 T0) +==1==The signal is caused by a WRITE memory access. + #0 0x173054d in Ins_ISECT /src/ghostpdl/./base/ttinterp.c:4106:28 + #1 0x172c22f in RunIns /src/ghostpdl/./base/ttinterp.c:5078:7 + #2 0x16634e6 in Instance_Reset /src/ghostpdl/./base/ttobjs.c:831:15 + #3 0x1651377 in TT_Set_Instance_CharSizes /src/ghostpdl/./base/ttfmain.c:138:12 + #4 0x16530ea in ttfFont__Open /src/ghostpdl/./base/ttfmain.c:348:12 + #5 0x1266e5d in ttfFont__Open_aux /src/ghostpdl/./base/gxttfb.c:448:12 + #6 0xc32cd3 in gx_attach_tt_interpreter /src/ghostpdl/./base/gxccman.c:249:12 + #7 0xc328fc in gx_provide_fm_pair_attributes /src/ghostpdl/./base/gxccman.c:276:16 + #8 0x125c5de in gs_type42_glyph_outline /src/ghostpdl/./base/gstype42.c:1349:9 + #9 0xa958a4 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #10 0x1261cae in gs_type42_glyph_info_by_gid /src/ghostpdl/./base/gstype42.c:1378:16 + #11 0x125caf8 in gs_type42_glyph_info /src/ghostpdl/./base/gstype42.c:1449:12 + #12 0x14d860e in process_text_estimate_bbox /src/ghostpdl/./devices/vector/gdevpdte.c:689:16 + #13 0x14d860e in pdf_process_string /src/ghostpdl/./devices/vector/gdevpdte.c:856:16 + #14 0x14d860e in pdf_process_string_aux /src/ghostpdl/./devices/vector/gdevpdte.c:81:12 + #15 0x14e2d5d in process_plain_text /src/ghostpdl/./devices/vector/gdevpdte.c:1841:16 + #16 0x951f77 in pdf_text_process /src/ghostpdl/./devices/vector/gdevpdtt.c:3752:16 + #17 0xaf4e9e in gs_text_process /src/ghostpdl/./base/gstext.c:670:12 + #18 0x1154562 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:445:16 + #19 0x1154562 in pdfi_show_Tr_preserve /src/ghostpdl/./pdf/pdf_text.c:780:12 + #20 0x1154562 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:830:16 + #21 0x1156dce in pdfi_TJ /src/ghostpdl/./pdf/pdf_text.c:1190:20 + #22 0x1056da1 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1650:24 + #23 0x10550ce in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #24 0x10b71de in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #25 0x10b71de in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #26 0x10b71de in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #27 0x101353f in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #28 0xe845b9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #29 0xe845b9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #30 0xe845b9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #31 0x577123 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #32 0x577123 in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #33 0x577123 in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #34 0x5726b1 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #35 0x11b5f3c in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #36 0x11b2062 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #37 0x11aefae in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #38 0x11b5cc8 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #39 0xe6d0c2 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #40 0x56ebda in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #41 0x56dcd1 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #42 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #43 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #44 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #45 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #46 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #47 0x7f5698427082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #48 0x420aed in _start (/out/gs_device_pdfwrite_fuzzer+0x420aed) + +DEDUP_TOKEN: Ins_ISECT--RunIns--Instance_Reset +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/ttinterp.c:4106:28 in Ins_ISECT +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-866.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-866.txt new file mode 100644 index 000000000..b0111fe5e --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-866.txt @@ -0,0 +1,80 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3189884869 +INFO: Loaded 3 modules (221252 inline 8-bit counters): 13672 [0x7fb3999d19e0, 0x7fb3999d4f48), 959 [0x7fb399a32a40, 0x7fb399a32dff), 206621 [0x37df330, 0x3811a4d), +INFO: Loaded 3 PC tables (221252 PCs): 13672 [0x7fb3999d4f48,0x7fb399a0a5c8), 959 [0x7fb399a32e00,0x7fb399a369f0), 206621 [0x2a52210,0x2d793e0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-866 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7fb396ed661c at pc 0x00000143bf07 bp 0x7ffd98905e70 sp 0x7ffd98905e68 +READ of size 4 at 0x7fb396ed661c thread T0 + #0 0x143bf06 in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:646:29 + #1 0x96ba40 in copied_type1_glyph_outline /src/ghostpdl/./devices/gxfcopy.c:1108:16 + #2 0xa958a4 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #3 0x140b90c in gs_type1_glyph_info /src/ghostpdl/./base/gxtype1.c:616:16 + #4 0x9206ea in pdf_compute_font_descriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:469:16 + #5 0x922714 in pdf_finish_FontDescriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:649:17 + #6 0x95a8d0 in pdf_finish_resources /src/ghostpdl/./devices/vector/gdevpdtw.c:684:24 + #7 0x80e4a7 in pdf_close /src/ghostpdl/./devices/vector/gdevpdf.c:2785:13 + #8 0xa71a54 in gs_closedevice /src/ghostpdl/./base/gsdevice.c:786:16 + #9 0x579663 in gs_main_finit /src/ghostpdl/./psi/imain.c:1351:20 + #10 0x57a9d2 in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #11 0x57a9d2 in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #12 0xe6def3 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #13 0x56ef7a in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #14 0x56dd2c in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:135:8 + #15 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #16 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #17 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #18 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #19 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #20 0x7fb3993d4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #21 0x420aed in _start (/out/gs_device_pdfwrite_fuzzer+0x420aed) + +DEDUP_TOKEN: gs_type2_interpret--copied_type1_glyph_outline--gs_default_glyph_info +Address 0x7fb396ed661c is located in stack of thread T0 at offset 28 in frame + #0 0x143596f in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:124 + +DEDUP_TOKEN: gs_type2_interpret + This frame has 4 object(s): + [32, 224) 'cstack' (line 129) <== Memory access at offset 28 underflows this variable + [288, 300) 'mask' (line 459) + [320, 336) 'join' (line 851) + [352, 368) 'end' (line 851) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-underflow /src/ghostpdl/./base/gstype2.c:646:29 in gs_type2_interpret +Shadow bytes around the buggy address: + 0x0ff6f2dd2c70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff6f2dd2c80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff6f2dd2c90: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff6f2dd2ca0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff6f2dd2cb0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0ff6f2dd2cc0: f1 f1 f1[f1]00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff6f2dd2cd0: 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 + 0x0ff6f2dd2ce0: f2 f2 f2 f2 f8 f8 f2 f2 f8 f8 f2 f2 f8 f8 f3 f3 + 0x0ff6f2dd2cf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff6f2dd2d00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff6f2dd2d10: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-888.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-888.txt new file mode 100644 index 000000000..318a62c33 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-888.txt @@ -0,0 +1,80 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3190374933 +INFO: Loaded 3 modules (221252 inline 8-bit counters): 13672 [0x7f87ace6b9e0, 0x7f87ace6ef48), 959 [0x7f87acecca40, 0x7f87aceccdff), 206621 [0x37df330, 0x3811a4d), +INFO: Loaded 3 PC tables (221252 PCs): 13672 [0x7f87ace6ef48,0x7f87acea45c8), 959 [0x7f87acecce00,0x7f87aced09f0), 206621 [0x2a52210,0x2d793e0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-888 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f87aa25c4e0 at pc 0x00000143c12f bp 0x7ffd1b456a30 sp 0x7ffd1b456a28 +READ of size 4 at 0x7f87aa25c4e0 thread T0 + #0 0x143c12e in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:496:46 + #1 0x96ba40 in copied_type1_glyph_outline /src/ghostpdl/./devices/gxfcopy.c:1108:16 + #2 0xa958a4 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #3 0x140b90c in gs_type1_glyph_info /src/ghostpdl/./base/gxtype1.c:616:16 + #4 0x9206ea in pdf_compute_font_descriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:469:16 + #5 0x922714 in pdf_finish_FontDescriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:649:17 + #6 0x95a8d0 in pdf_finish_resources /src/ghostpdl/./devices/vector/gdevpdtw.c:684:24 + #7 0x80e4a7 in pdf_close /src/ghostpdl/./devices/vector/gdevpdf.c:2785:13 + #8 0xa71a54 in gs_closedevice /src/ghostpdl/./base/gsdevice.c:786:16 + #9 0x579663 in gs_main_finit /src/ghostpdl/./psi/imain.c:1351:20 + #10 0x57a9d2 in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #11 0x57a9d2 in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #12 0xe6def3 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #13 0x56ef7a in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #14 0x56dd2c in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:135:8 + #15 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #16 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #17 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #18 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #19 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #20 0x7f87ac86e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #21 0x420aed in _start (/out/gs_device_pdfwrite_fuzzer+0x420aed) + +DEDUP_TOKEN: gs_type2_interpret--copied_type1_glyph_outline--gs_default_glyph_info +Address 0x7f87aa25c4e0 is located in stack of thread T0 at offset 224 in frame + #0 0x143596f in gs_type2_interpret /src/ghostpdl/./base/gstype2.c:124 + +DEDUP_TOKEN: gs_type2_interpret + This frame has 4 object(s): + [32, 224) 'cstack' (line 129) <== Memory access at offset 224 overflows this variable + [288, 300) 'mask' (line 459) + [320, 336) 'join' (line 851) + [352, 368) 'end' (line 851) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ghostpdl/./base/gstype2.c:496:46 in gs_type2_interpret +Shadow bytes around the buggy address: + 0x0ff175443840: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff175443850: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff175443860: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff175443870: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff175443880: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0ff175443890: 00 00 00 00 00 00 00 00 00 00 00 00[f2]f2 f2 f2 + 0x0ff1754438a0: f2 f2 f2 f2 f8 f8 f2 f2 f8 f8 f2 f2 f8 f8 f3 f3 + 0x0ff1754438b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff1754438c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff1754438d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff1754438e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-949.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-949.txt new file mode 100644 index 000000000..226a829c7 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2022-949.txt @@ -0,0 +1,127 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3190820512 +INFO: Loaded 3 modules (221252 inline 8-bit counters): 13672 [0x7fce758579e0, 0x7fce7585af48), 959 [0x7fce758b8a40, 0x7fce758b8dff), 206621 [0x37df330, 0x3811a4d), +INFO: Loaded 3 PC tables (221252 PCs): 13672 [0x7fce7585af48,0x7fce758905c8), 959 [0x7fce758b8e00,0x7fce758bc9f0), 206621 [0x2a52210,0x2d793e0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-949 +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100001ed58 at pc 0x00000091af4d bp 0x7ffe7b1fc060 sp 0x7ffe7b1fc058 +READ of size 8 at 0x61100001ed58 thread T0 + #0 0x91af4c in gp_fflush /src/ghostpdl/./base/gp.h:296:16 + #1 0x91af4c in s_file_write_flush /src/ghostpdl/./base/sfxstdio.c:232:5 + #2 0x6ca8ba in sclose /src/ghostpdl/./base/stream.c:445:18 + #3 0x6c7fcd in stream_finalize /src/ghostpdl/./base/stream.c:91:9 + #4 0xf7fdf8 in restore_finalize /src/ghostpdl/./psi/isave.c:954:13 + #5 0xf7fdf8 in alloc_restore_all /src/ghostpdl/./psi/isave.c:901:13 + #6 0x579ea4 in gs_main_finit /src/ghostpdl/./psi/imain.c:1391:20 + #7 0x57a9d2 in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #8 0x57a9d2 in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #9 0xe6def3 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #10 0x56ef7a in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #11 0x56dd2c in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:135:8 + #12 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #13 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #14 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #15 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #16 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #17 0x7fce7525a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #18 0x420aed in _start (/out/gs_device_pdfwrite_fuzzer+0x420aed) + +DEDUP_TOKEN: gp_fflush--s_file_write_flush--sclose +0x61100001ed58 is located 152 bytes inside of 232-byte region [0x61100001ecc0,0x61100001eda8) +freed by thread T0 here: + #0 0x5300b2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0xaba9cc in gs_heap_free_object /src/ghostpdl/./base/gsmalloc.c:366:5 + #2 0xa49ac8 in gp_file_dealloc /src/ghostpdl/./base/gpmisc.c:464:5 + #3 0x57bd1b in gp_fclose /src/ghostpdl/./base/gp.h:258:5 + #4 0x57bd1b in gp_close_printer /src/ghostpdl/./base/gp_unix.c:237:5 + #5 0xa7af2f in gx_device_close_output_file /src/ghostpdl/./base/gsdevice.c:1368:5 + #6 0x91371e in gdev_vector_close_file /src/ghostpdl/./base/gdevvec.c:860:13 + #7 0x81d112 in pdf_close /src/ghostpdl/./devices/vector/gdevpdf.c:3621:13 + #8 0xa71a54 in gs_closedevice /src/ghostpdl/./base/gsdevice.c:786:16 + #9 0x579663 in gs_main_finit /src/ghostpdl/./psi/imain.c:1351:20 + #10 0x57a9d2 in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #11 0x57a9d2 in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #12 0xe6def3 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #13 0x56ef7a in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #14 0x56dd2c in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:135:8 + #15 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #16 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #17 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #18 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #19 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #20 0x7fce7525a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: free--gs_heap_free_object--gp_file_dealloc +previously allocated by thread T0 here: + #0 0x530356 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xaba218 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0xa4a072 in gp_file_alloc /src/ghostpdl/./base/gpmisc.c:438:32 + #3 0xa4a072 in gp_file_FILE_alloc /src/ghostpdl/./base/gpmisc.c:676:12 + #4 0xac88d8 in fs_file_open_file /src/ghostpdl/./base/gslibctx.c:174:13 + #5 0xa4a774 in gp_fopen /src/ghostpdl/./base/gpmisc.c:731:20 + #6 0xaaf9c4 in iodev_os_gp_fopen /src/ghostpdl/./base/gsiodev.c:289:14 + #7 0xa7a9f5 in gx_device_open_output_file /src/ghostpdl/./base/gsdevice.c:1327:16 + #8 0x90eba5 in gdev_vector_open_file_options /src/ghostpdl/./base/gdevvec.c:282:13 + #9 0x80bbd9 in pdf_open /src/ghostpdl/./devices/vector/gdevpdf.c:787:12 + #10 0xa74c2c in gs_opendevice /src/ghostpdl/./base/gsdevice.c:461:20 + #11 0xa74c2c in gs_setdevice_no_erase /src/ghostpdl/./base/gsdevice.c:580:28 + #12 0xf485aa in zsetdevice_no_safer /src/ghostpdl/./psi/zdevice.c:594:12 + #13 0xf485aa in zsetdevice /src/ghostpdl/./psi/zdevice.c:637:12 + #14 0xe845b9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #15 0xe845b9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #16 0xe845b9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #17 0x572363 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #18 0x572363 in gs_run_init_file /src/ghostpdl/./psi/imain.c:861:12 + #19 0x572363 in gs_main_init2aux /src/ghostpdl/./psi/imain.c:305:16 + #20 0x573bf1 in gs_main_init2 /src/ghostpdl/./psi/imain.c:491:12 + #21 0x11b2018 in swproc /src/ghostpdl/./psi/imainarg.c:363:20 + #22 0x11aefae in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #23 0x11b5cc8 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #24 0xe6d0c2 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #25 0x56ebda in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #26 0x56dcd1 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #27 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #28 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #29 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #30 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #31 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #32 0x7fce7525a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--gp_file_alloc +SUMMARY: AddressSanitizer: heap-use-after-free /src/ghostpdl/./base/gp.h:296:16 in gp_fflush +Shadow bytes around the buggy address: + 0x0c227fffbd50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c227fffbd60: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffbd70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffbd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c227fffbd90: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd +=>0x0c227fffbda0: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd + 0x0c227fffbdb0: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffbdc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c227fffbdd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa + 0x0c227fffbde0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c227fffbdf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2023-1079.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2023-1079.txt new file mode 100644 index 000000000..3feb2e726 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2023-1079.txt @@ -0,0 +1,147 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3209720022 +INFO: Loaded 3 modules (221252 inline 8-bit counters): 13672 [0x7f50029299e0, 0x7f500292cf48), 959 [0x7f500298aa40, 0x7f500298adff), 206621 [0x37df330, 0x3811a4d), +INFO: Loaded 3 PC tables (221252 PCs): 13672 [0x7f500292cf48,0x7f50029625c8), 959 [0x7f500298ae00,0x7f500298e9f0), 206621 [0x2a52210,0x2d793e0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-1079 +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x62a0003dc89a at pc 0x00000173c428 bp 0x7ffe829c8650 sp 0x7ffe829c8648 +READ of size 1 at 0x62a0003dc89a thread T0 + #0 0x173c427 in Ins_JROT /src/ghostpdl/./base/ttinterp.c:1788:11 + #1 0x172c22f in RunIns /src/ghostpdl/./base/ttinterp.c:5078:7 + #2 0x16634e6 in Instance_Reset /src/ghostpdl/./base/ttobjs.c:831:15 + #3 0x1651377 in TT_Set_Instance_CharSizes /src/ghostpdl/./base/ttfmain.c:138:12 + #4 0x16530ea in ttfFont__Open /src/ghostpdl/./base/ttfmain.c:348:12 + #5 0x1266e5d in ttfFont__Open_aux /src/ghostpdl/./base/gxttfb.c:448:12 + #6 0xc32cd3 in gx_attach_tt_interpreter /src/ghostpdl/./base/gxccman.c:249:12 + #7 0xc33bd0 in gx_add_fm_pair /src/ghostpdl/./base/gxccman.c:355:20 + #8 0xc2ee2a in gx_lookup_fm_pair /src/ghostpdl/./base/gxccache.c:140:12 + #9 0x125c4f8 in gs_type42_glyph_outline /src/ghostpdl/./base/gstype42.c:1341:12 + #10 0xa958a4 in gs_default_glyph_info /src/ghostpdl/./base/gsfont.c:1061:12 + #11 0x1261cae in gs_type42_glyph_info_by_gid /src/ghostpdl/./base/gstype42.c:1378:16 + #12 0x125caf8 in gs_type42_glyph_info /src/ghostpdl/./base/gstype42.c:1449:12 + #13 0x9206ea in pdf_compute_font_descriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:469:16 + #14 0x922714 in pdf_finish_FontDescriptor /src/ghostpdl/./devices/vector/gdevpdtd.c:649:17 + #15 0x95a8d0 in pdf_finish_resources /src/ghostpdl/./devices/vector/gdevpdtw.c:684:24 + #16 0x80e4a7 in pdf_close /src/ghostpdl/./devices/vector/gdevpdf.c:2785:13 + #17 0xa71a54 in gs_closedevice /src/ghostpdl/./base/gsdevice.c:786:16 + #18 0x579663 in gs_main_finit /src/ghostpdl/./psi/imain.c:1351:20 + #19 0x57a9d2 in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #20 0x57a9d2 in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #21 0xe6def3 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #22 0x56ef7a in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #23 0x56dd2c in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:135:8 + #24 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #25 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #26 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #27 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #28 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #29 0x7f500232c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #30 0x420aed in _start (/out/gs_device_pdfwrite_fuzzer+0x420aed) + +DEDUP_TOKEN: Ins_JROT--RunIns--Instance_Reset +0x62a0003dc89a is located 18074 bytes inside of 20048-byte region [0x62a0003d8200,0x62a0003dd050) +freed by thread T0 here: + #0 0x5300b2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0xaba9cc in gs_heap_free_object /src/ghostpdl/./base/gsmalloc.c:366:5 + #2 0x158985b in alloc_free_clump /src/ghostpdl/./base/gsalloc.c:2596:9 + #3 0x158985b in free_all_not_allocator /src/ghostpdl/./base/gsalloc.c:979:9 + #4 0x158985b in clump_splay_app /src/ghostpdl/./base/gsalloc.c:592:19 + #5 0x158985b in i_free_all /src/ghostpdl/./base/gsalloc.c:1015:9 + #6 0xf7e3d4 in restore_free /src/ghostpdl/./psi/isave.c:991:5 + #7 0xf7e3d4 in restore_space /src/ghostpdl/./psi/isave.c:847:5 + #8 0xf7e3d4 in alloc_restore_step_in /src/ghostpdl/./psi/isave.c:784:9 + #9 0xef6967 in dorestore /src/ghostpdl/./psi/zvmem.c:193:16 + #10 0xe64bc0 in z2restore /src/ghostpdl/./psi/zdevice2.c:373:12 + #11 0xe845b9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #12 0xe845b9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #13 0xe845b9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #14 0x577123 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #15 0x577123 in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #16 0x577123 in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #17 0x5726b1 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #18 0x11b5f3c in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #19 0x11b2062 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #20 0x11aefae in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #21 0x11b5cc8 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #22 0xe6d0c2 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #23 0x56ebda in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #24 0x56dcd1 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #25 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #26 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #27 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #28 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #29 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #30 0x7f500232c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: free--gs_heap_free_object--alloc_free_clump +previously allocated by thread T0 here: + #0 0x530356 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xaba218 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x1592faf in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2445:13 + #3 0x1591ebc in alloc_add_clump /src/ghostpdl/./base/gsalloc.c:2395:19 + #4 0x1591ebc in alloc_obj /src/ghostpdl/./base/gsalloc.c:2004:17 + #5 0x158b3fa in i_alloc_struct_array /src/ghostpdl/./base/gsalloc.c:1348:11 + #6 0xf66e5c in gs_alloc_ref_array /src/ghostpdl/./psi/ialloc.c:226:15 + #7 0xe70dce in dict_create_unpacked_keys /src/ghostpdl/./psi/idict.c:172:12 + #8 0xe70dce in dict_unpack /src/ghostpdl/./psi/idict.c:256:16 + #9 0xe72ac3 in dict_put /src/ghostpdl/./psi/idict.c:491:28 + #10 0xebc5a2 in zdicttomark /src/ghostpdl/./psi/zdict.c:399:19 + #11 0xe845b9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #12 0xe845b9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #13 0xe845b9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #14 0x577123 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #15 0x577123 in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #16 0x577123 in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #17 0x5726b1 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #18 0x11b5f3c in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #19 0x11b2062 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #20 0x11aefae in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #21 0x11b5cc8 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #22 0xe6d0c2 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #23 0x56ebda in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #24 0x56dcd1 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #25 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #26 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #27 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #28 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #29 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #30 0x7f500232c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--alloc_acquire_clump +SUMMARY: AddressSanitizer: heap-use-after-free /src/ghostpdl/./base/ttinterp.c:1788:11 in Ins_JROT +Shadow bytes around the buggy address: + 0x0c54800738c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c54800738d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c54800738e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c54800738f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c5480073900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0c5480073910: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c5480073920: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c5480073930: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c5480073940: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c5480073950: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c5480073960: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2023-88.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2023-88.txt new file mode 100644 index 000000000..b7d407796 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2023-88.txt @@ -0,0 +1,94 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3210849762 +INFO: Loaded 3 modules (221252 inline 8-bit counters): 13672 [0x7fe9485649e0, 0x7fe948567f48), 959 [0x7fe9485c5a40, 0x7fe9485c5dff), 206621 [0x37df330, 0x3811a4d), +INFO: Loaded 3 PC tables (221252 PCs): 13672 [0x7fe948567f48,0x7fe94859d5c8), 959 [0x7fe9485c5e00,0x7fe9485c99f0), 206621 [0x2a52210,0x2d793e0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-88 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fe945945860 at pc 0x00000111876a bp 0x7ffe97f06b30 sp 0x7ffe97f06b28 +WRITE of size 1 at 0x7fe945945860 thread T0 + #0 0x1118769 in pdfi_read_cff_real /src/ghostpdl/./pdf/pdf_font1C.c:739:10 + #1 0x1118769 in pdfi_read_cff_dict /src/ghostpdl/./pdf/pdf_font1C.c:1129:21 + #2 0x1118588 in pdfi_read_cff_dict /src/ghostpdl/./pdf/pdf_font1C.c:1172:20 + #3 0x11063b3 in pdfi_read_cff /src/ghostpdl/./pdf/pdf_font1C.c:1680:12 + #4 0x11063b3 in pdfi_read_cff_font /src/ghostpdl/./pdf/pdf_font1C.c:2285:16 + #5 0x10e46c7 in pdfi_load_font_buffer /src/ghostpdl/./pdf/pdf_font.c:624:24 + #6 0x10e2ee7 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:924:24 + #7 0x10e9b59 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:1006:20 + #8 0x10ed0d9 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:1048:12 + #9 0x10ed0d9 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1407:12 + #10 0x1056df9 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1642:24 + #11 0x10550ce in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #12 0x10b71de in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #13 0x10b71de in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #14 0x10b71de in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #15 0x101353f in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #16 0xe845b9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xe845b9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xe845b9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x577123 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x577123 in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x577123 in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x5726b1 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x11b5f3c in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #24 0x11b2062 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #25 0x11aefae in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #26 0x11b5cc8 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #27 0xe6d0c2 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x56ebda in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #29 0x56dcd1 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #30 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #31 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7fe947f67082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #36 0x420aed in _start (/out/gs_device_pdfwrite_fuzzer+0x420aed) + +DEDUP_TOKEN: pdfi_read_cff_real--pdfi_read_cff_dict--pdfi_read_cff_dict +Address 0x7fe945945860 is located in stack of thread T0 at offset 96 in frame + #0 0x11153df in pdfi_read_cff_dict /src/ghostpdl/./pdf/pdf_font1C.c:802 + +DEDUP_TOKEN: pdfi_read_cff_dict + This frame has 3 object(s): + [32, 96) 'buf.i' (line 686) <== Memory access at offset 96 overflows this variable + [128, 512) 'args' (line 804) + [576, 584) 'fnamestr' (line 950) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ghostpdl/./pdf/pdf_font1C.c:739:10 in pdfi_read_cff_real +Shadow bytes around the buggy address: + 0x0ffda8b20ab0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffda8b20ac0: f2 f2 f2 f2 f2 f2 f2 f2 f8 f3 f3 f3 00 00 00 00 + 0x0ffda8b20ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffda8b20ae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffda8b20af0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0ffda8b20b00: f1 f1 f1 f1 00 00 00 00 00 00 00 00[f2]f2 f2 f2 + 0x0ffda8b20b10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffda8b20b20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffda8b20b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffda8b20b40: f2 f2 f2 f2 f2 f2 f2 f2 f8 f3 f3 f3 00 00 00 00 + 0x0ffda8b20b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2023-970.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2023-970.txt new file mode 100755 index 000000000..973d468fb --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2023-970.txt @@ -0,0 +1,132 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 105583398 +INFO: Loaded 3 modules (193198 inline 8-bit counters): 11664 [0x7f4404531ec0, 0x7f4404534c50), 878 [0x7f44045c7798, 0x7f44045c7b06), 180656 [0x560dfdda9c40, 0x560dfddd5df0), +INFO: Loaded 3 PC tables (193198 PCs): 11664 [0x7f4404534c50,0x7f4404562550), 878 [0x7f44045c7b08,0x7f44045cb1e8), 180656 [0x560dfddd5df0,0x560dfe0978f0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-970 +================================================================= +==12687==ERROR: AddressSanitizer: heap-use-after-free on address 0x7d04032e0910 at pc 0x560dfba32b5f bp 0x7ffe16c34580 sp 0x7ffe16c34578 +READ of size 8 at 0x7d04032e0910 thread T0 + #0 0x560dfba32b5e in gx_device_forward_finalize /src/ghostpdl/./base/gdevnfwd.c:33:5 + #1 0x560dfb7b3547 in gx_device_finalize /src/ghostpdl/./base/gsdevice.c:81:9 + #2 0x560dfbbd9fc4 in restore_finalize /src/ghostpdl/./psi/isave.c:954:13 + #3 0x560dfbbd9a74 in alloc_restore_step_in /src/ghostpdl/./psi/isave.c:759:9 + #4 0x560dfbb6e546 in dorestore /src/ghostpdl/./psi/zvmem.c:194:16 + #5 0x560dfbaf11cb in z2restore /src/ghostpdl/./psi/zdevice2.c:380:12 + #6 0x560dfbb12a35 in do_call_operator /src/ghostpdl/./psi/interp.c:91:12 + #7 0x560dfbb0f42f in interp /src/ghostpdl/./psi/interp.c:1768:40 + #8 0x560dfbb09859 in gs_call_interp /src/ghostpdl/./psi/interp.c:531:12 + #9 0x560dfbb091ce in gs_interpret /src/ghostpdl/./psi/interp.c:488:12 + #10 0x560dfb37d49d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x560dfb37d06a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #12 0x560dfbd81d5f in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #13 0x560dfbd7f0d7 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #14 0x560dfbd7cfe2 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #15 0x560dfbd81b34 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #16 0x560dfb375cec in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*, int) /src/gs_fuzzlib.h:139:8 + #17 0x560dfb376071 in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #18 0x560dfb2131ed in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #19 0x560dfb1fdf62 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #20 0x560dfb203e30 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #21 0x560dfb22f962 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #22 0x7f4403f8f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #23 0x560dfb1f704d in _start (/out/gs_device_pdfwrite_fuzzer+0x68d04d) + +0x7d04032e0910 is located 144 bytes inside of 1816-byte region [0x7d04032e0880,0x7d04032e0f98) +freed by thread T0 here: + #0 0x560dfb3318a6 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3 + #1 0x560dfc0a1d13 in alloc_free_clump /src/ghostpdl/./base/gsalloc.c:2597:9 + #2 0x560dfc09cc60 in i_free_object /src/ghostpdl/./base/gsalloc.c:1542:17 + #3 0x560dfb385be0 in gx_begin_image3_generic /src/ghostpdl/./base/gximage3.c:481:5 + #4 0x560dfb60a8b9 in setup_type3_image /src/ghostpdl/./devices/vector/gdevpdfi.c:395:12 + #5 0x560dfb600765 in pdf_begin_typed_image /src/ghostpdl/./devices/vector/gdevpdfi.c:1133:16 + #6 0x560dfb5fff00 in gdev_pdf_begin_typed_image /src/ghostpdl/./devices/vector/gdevpdfi.c:1718:12 + #7 0x560dfb7e0118 in gs_image_begin_typed /src/ghostpdl/./base/gsimage.c:275:12 + #8 0x560dfbcc41a1 in pdfi_render_image /src/ghostpdl/./pdf/pdf_image.c:818:16 + #9 0x560dfbcbb3f0 in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:2133:12 + #10 0x560dfbcbcf0c in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2669:16 + #11 0x560dfbcbd8d6 in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2764:12 + #12 0x560dfbc83c43 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1470:24 + #13 0x560dfbc82c6b in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2124:24 + #14 0x560dfbccbabd in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #15 0x560dfbccaa84 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:150:12 + #16 0x560dfbcc8628 in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:1025:12 + #17 0x560dfbc513aa in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:941:24 + #18 0x560dfbb12a35 in do_call_operator /src/ghostpdl/./psi/interp.c:91:12 + #19 0x560dfbb0f42f in interp /src/ghostpdl/./psi/interp.c:1768:40 + #20 0x560dfbb09859 in gs_call_interp /src/ghostpdl/./psi/interp.c:531:12 + #21 0x560dfbb091ce in gs_interpret /src/ghostpdl/./psi/interp.c:488:12 + #22 0x560dfb37d49d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #23 0x560dfb37d06a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #24 0x560dfbd81d5f in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #25 0x560dfbd7f0d7 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #26 0x560dfbd7cfe2 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #27 0x560dfbd81b34 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #28 0x560dfb375cec in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*, int) /src/gs_fuzzlib.h:139:8 + #29 0x560dfb376071 in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + +previously allocated by thread T0 here: + #0 0x560dfb331b44 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x560dfb7eed40 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x560dfc0a3e9e in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2446:13 + #3 0x560dfc0a2ffa in alloc_obj /src/ghostpdl/./base/gsalloc.c:1911:13 + #4 0x560dfb7b525f in gs_copydevice2 /src/ghostpdl/./base/gsdevice.c:413:15 + #5 0x560dfb60ee43 in pdf_make_mxd /src/ghostpdl/./devices/vector/gdevpdfi.c:2078:16 + #6 0x560dfb60e7d1 in pdf_image3_make_mid /src/ghostpdl/./devices/vector/gdevpdfi.c:2126:20 + #7 0x560dfb3853e0 in gx_begin_image3_generic /src/ghostpdl/./base/gximage3.c:386:12 + #8 0x560dfb60a8b9 in setup_type3_image /src/ghostpdl/./devices/vector/gdevpdfi.c:395:12 + #9 0x560dfb600765 in pdf_begin_typed_image /src/ghostpdl/./devices/vector/gdevpdfi.c:1133:16 + #10 0x560dfb5fff00 in gdev_pdf_begin_typed_image /src/ghostpdl/./devices/vector/gdevpdfi.c:1718:12 + #11 0x560dfb7e0118 in gs_image_begin_typed /src/ghostpdl/./base/gsimage.c:275:12 + #12 0x560dfbcc41a1 in pdfi_render_image /src/ghostpdl/./pdf/pdf_image.c:818:16 + #13 0x560dfbcbb3f0 in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:2133:12 + #14 0x560dfbcbcf0c in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2669:16 + #15 0x560dfbcbd8d6 in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2764:12 + #16 0x560dfbc83c43 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1470:24 + #17 0x560dfbc82c6b in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2124:24 + #18 0x560dfbccbabd in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #19 0x560dfbccaa84 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:150:12 + #20 0x560dfbcc8628 in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:1025:12 + #21 0x560dfbc513aa in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:941:24 + #22 0x560dfbb12a35 in do_call_operator /src/ghostpdl/./psi/interp.c:91:12 + #23 0x560dfbb0f42f in interp /src/ghostpdl/./psi/interp.c:1768:40 + #24 0x560dfbb09859 in gs_call_interp /src/ghostpdl/./psi/interp.c:531:12 + #25 0x560dfbb091ce in gs_interpret /src/ghostpdl/./psi/interp.c:488:12 + #26 0x560dfb37d49d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #27 0x560dfb37d06a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #28 0x560dfbd81d5f in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #29 0x560dfbd7f0d7 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + +SUMMARY: AddressSanitizer: heap-use-after-free /src/ghostpdl/./base/gdevnfwd.c:33:5 in gx_device_forward_finalize +Shadow bytes around the buggy address: + 0x7d04032e0680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7d04032e0700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7d04032e0780: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d04032e0800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d04032e0880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x7d04032e0900: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7d04032e0980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7d04032e0a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7d04032e0a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7d04032e0b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7d04032e0b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==12687==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2024-1391.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2024-1391.txt new file mode 100644 index 000000000..56fe9c8e5 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2024-1391.txt @@ -0,0 +1,135 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3211521830 +INFO: Loaded 3 modules (221252 inline 8-bit counters): 13672 [0x7f52928569e0, 0x7f5292859f48), 959 [0x7f52928b7a40, 0x7f52928b7dff), 206621 [0x37df330, 0x3811a4d), +INFO: Loaded 3 PC tables (221252 PCs): 13672 [0x7f5292859f48,0x7f529288f5c8), 959 [0x7f52928b7e00,0x7f52928bb9f0), 206621 [0x2a52210,0x2d793e0), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2024-1391 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x614000001994 at pc 0x0000004c906e bp 0x7ffd33954230 sp 0x7ffd339539f8 +READ of size 12 at 0x614000001994 thread T0 + #0 0x4c906d in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0x76251a in get_mediawp /src/ghostpdl/./base/gsicc_create.c:3272:5 + #2 0x76251a in gsicc_create_v2 /src/ghostpdl/./base/gsicc_create.c:3315:10 + #3 0x76251a in gsicc_create_getv2buffer /src/ghostpdl/./base/gsicc_create.c:3409:5 + #4 0x88644a in pdf_iccbased_color_space /src/ghostpdl/./devices/vector/gdevpdfk.c:861:21 + #5 0x834846 in pdf_color_space_named /src/ghostpdl/./devices/vector/gdevpdfc.c:926:16 + #6 0x8bc766 in pdf_make_group_dict /src/ghostpdl/./devices/vector/gdevpdft.c + #7 0x8bc766 in pdf_begin_transparency_group /src/ghostpdl/./devices/vector/gdevpdft.c:181:12 + #8 0x8bbffb in gdev_pdf_composite /src/ghostpdl/./devices/vector/gdevpdft.c:431:24 + #9 0x604542 in send_pdf14trans /src/ghostpdl/./base/gdevp14.c:9668:12 + #10 0x5c3826 in gs_gstate_update_pdf14trans2 /src/ghostpdl/./base/gstrans.c:142:12 + #11 0x5c3826 in gs_gstate_update_pdf14trans /src/ghostpdl/./base/gstrans.c:167:12 + #12 0x5c3826 in gs_begin_transparency_group /src/ghostpdl/./base/gstrans.c:325:12 + #13 0x1168064 in pdfi_gs_begin_transparency_group /src/ghostpdl/./pdf/pdf_trans.c:369:12 + #14 0x1168064 in pdfi_transparency_group_common /src/ghostpdl/./pdf/pdf_trans.c:424:12 + #15 0x116857b in pdfi_trans_begin_form_group /src/ghostpdl/./pdf/pdf_trans.c:538:12 + #16 0x10a7256 in pdfi_do_form /src/ghostpdl/./pdf/pdf_image.c:2454:16 + #17 0x10a7a1d in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2561:16 + #18 0x10a8439 in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2643:12 + #19 0x1056dcd in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1475:24 + #20 0x10550ce in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #21 0x10b71de in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #22 0x10b71de in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #23 0x10b71de in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #24 0x101353f in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #25 0xe845b9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #26 0xe845b9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #27 0xe845b9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #28 0x577123 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #29 0x577123 in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #30 0x577123 in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #31 0x5726b1 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #32 0x11b5f3c in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #33 0x11b2062 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #34 0x11aefae in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #35 0x11b5cc8 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #36 0xe6d0c2 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #37 0x56ebda in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #38 0x56dcd1 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #39 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #40 0x43f1c3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #41 0x42a922 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #42 0x4301cc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #43 0x459702 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #44 0x7f5292259082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #45 0x420aed in _start (/out/gs_device_pdfwrite_fuzzer+0x420aed) + +DEDUP_TOKEN: __interceptor_memcpy--get_mediawp--gsicc_create_v2 +0x614000001994 is located 970 bytes to the right of 394-byte region [0x614000001440,0x6140000015ca) +allocated by thread T0 here: + #0 0x530356 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xaba218 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x75057c in gs_lcms2_malloc /src/ghostpdl/./base/gsicc_lcms2mt.c:75:11 + #3 0x779256 in _cmsMalloc /src/ghostpdl/./lcms2mt/src/cmserr.c:267:12 + #4 0x77afc3 in cmsOpenIOhandlerFromMem /src/ghostpdl/./lcms2mt/src/cmsio0.c:264:40 + #5 0x780012 in cmsOpenProfileFromMem /src/ghostpdl/./lcms2mt/src/cmsio0.c:1168:26 + #6 0x74d97c in gscms_get_profile_handle_mem /src/ghostpdl/./base/gsicc_lcms2mt.c:319:12 + #7 0x72fc0c in gsicc_get_profile_handle_buffer /src/ghostpdl/./base/gsicc_manage.c:2642:27 + #8 0x1072dc1 in pdfi_create_icc /src/ghostpdl/./pdf/pdf_colour.c:820:13 + #9 0x1083321 in pdfi_create_iccprofile /src/ghostpdl/./pdf/pdf_colour.c:1003:12 + #10 0x1083321 in pdfi_create_iccbased /src/ghostpdl/./pdf/pdf_colour.c:1100:12 + #11 0x10767a9 in pdfi_create_colorspace_by_array /src/ghostpdl/./pdf/pdf_colour.c:2288:16 + #12 0x1074181 in pdfi_create_colorspace /src/ghostpdl/./pdf/pdf_colour.c:2449:16 + #13 0x1074d73 in pdfi_create_colorspace_by_name /src/ghostpdl/./pdf/pdf_colour.c:2376:16 + #14 0x10741a2 in pdfi_create_colorspace /src/ghostpdl/./pdf/pdf_colour.c:2446:16 + #15 0x10771a5 in pdfi_setcolorspace /src/ghostpdl/./pdf/pdf_colour.c:2464:12 + #16 0x10771a5 in pdfi_setfillcolor_space /src/ghostpdl/./pdf/pdf_colour.c:2508:12 + #17 0x105705a in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1459:24 + #18 0x10550ce in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2126:24 + #19 0x10b71de in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #20 0x10b71de in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #21 0x10b71de in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #22 0x101353f in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #23 0xe845b9 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #24 0xe845b9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #25 0xe845b9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #26 0x577123 in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #27 0x577123 in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #28 0x577123 in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #29 0x5726b1 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #30 0x11b5f3c in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #31 0x11b2062 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #32 0x11aefae in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #33 0x11b5cc8 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #34 0xe6d0c2 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #35 0x56ebda in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #36 0x56dcd1 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #37 0x56e0cf in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--gs_lcms2_malloc +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x0c287fff82e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c287fff82f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c287fff8300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c287fff8310: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c287fff8320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c287fff8330: fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c287fff8340: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c287fff8350: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c287fff8360: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c287fff8370: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c287fff8380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2024-503.txt b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2024-503.txt new file mode 100755 index 000000000..9475cdd7f --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/OSV-2024-503.txt @@ -0,0 +1,142 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1759420229 +INFO: Loaded 3 modules (194245 inline 8-bit counters): 11664 [0x7f7b97e8eec0, 0x7f7b97e91c50), 878 [0x7f7b97f24798, 0x7f7b97f24b06), 181703 [0x561ec77ebe20, 0x561ec78183e7), +INFO: Loaded 3 PC tables (194245 PCs): 11664 [0x7f7b97e91c50,0x7f7b97ebf550), 878 [0x7f7b97f24b08,0x7f7b97f281e8), 181703 [0x561ec78183e8,0x561ec7ade058), +/out/gs_device_pdfwrite_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2024-503 +================================================================= +==12699==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7e0b96c39c78 at pc 0x561ec5017bd9 bp 0x7ffeee6a3840 sp 0x7ffeee6a3838 +WRITE of size 8 at 0x7e0b96c39c78 thread T0 + #0 0x561ec5017bd8 in pdf_save_viewer_state /src/ghostpdl/./devices/vector/gdevpdfg.c:75:38 + #1 0x561ec5085fa1 in stream_to_text /src/ghostpdl/./devices/vector/gdevpdfu.c:1171:16 + #2 0x561ec507a00e in pdf_open_contents /src/ghostpdl/./devices/vector/gdevpdfu.c:1281:20 + #3 0x561ec50d9ecc in pdf_append_chars /src/ghostpdl/./devices/vector/gdevpdts.c:647:24 + #4 0x561ec5a47d3c in process_text_modify_width /src/ghostpdl/./devices/vector/gdevpdte.c + #5 0x561ec5a40220 in scan_cmap_text /src/ghostpdl/./devices/vector/gdevpdtc.c:870:24 + #6 0x561ec5a3cda1 in process_cmap_text /src/ghostpdl/./devices/vector/gdevpdtc.c:965:12 + #7 0x561ec50ebb40 in pdf_text_process /src/ghostpdl/./devices/vector/gdevpdtt.c:3820:16 + #8 0x561ec577d557 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:442:16 + #9 0x561ec577b7dd in pdfi_show_Tr_preserve /src/ghostpdl/./pdf/pdf_text.c:808:12 + #10 0x561ec5776414 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:859:16 + #11 0x561ec5777217 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1131:12 + #12 0x561ec56bad29 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1641:24 + #13 0x561ec56b9b4b in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2124:24 + #14 0x561ec57032d6 in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:132:20 + #15 0x561ec5702274 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:156:12 + #16 0x561ec56ffe18 in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:1031:12 + #17 0x561ec5687dda in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:959:24 + #18 0x561ec5548d45 in do_call_operator /src/ghostpdl/./psi/interp.c:91:12 + #19 0x561ec554573f in interp /src/ghostpdl/./psi/interp.c:1768:40 + #20 0x561ec553fb69 in gs_call_interp /src/ghostpdl/./psi/interp.c:531:12 + #21 0x561ec553f4de in gs_interpret /src/ghostpdl/./psi/interp.c:488:12 + #22 0x561ec4da849d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #23 0x561ec4da806a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #24 0x561ec57be94f in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #25 0x561ec57bbc2e in swproc /src/ghostpdl/./psi/imainarg.c:368:20 + #26 0x561ec57b9ae2 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #27 0x561ec57be724 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #28 0x561ec4da0cec in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*, int) /src/gs_fuzzlib.h:139:8 + #29 0x561ec4da1071 in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #30 0x561ec4c3e1ed in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #31 0x561ec4c28f62 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #32 0x561ec4c2ee30 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #33 0x561ec4c5a962 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #34 0x7f7b978ec082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #35 0x561ec4c2204d in _start (/out/gs_device_pdfwrite_fuzzer+0x69404d) + +0x7e0b96c39c78 is located 2336 bytes after 16728-byte region [0x7e0b96c35200,0x7e0b96c39358) +freed by thread T0 here: + #0 0x561ec4d5c8a6 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3 + #1 0x561ec5adf753 in alloc_free_clump /src/ghostpdl/./base/gsalloc.c:2597:9 + #2 0x561ec5ada6a0 in i_free_object /src/ghostpdl/./base/gsalloc.c:1542:17 + #3 0x561ec525f32b in s_block_read_close /src/ghostpdl/./base/gsiorom.c:174:5 + #4 0x561ec4ec9fca in sclose /src/ghostpdl/./base/stream.c:448:18 + #5 0x561ec51c91b4 in sfclose /src/ghostpdl/./base/strmio.c:177:5 + #6 0x561ec4f26cac in gsicc_set_device_profile /src/ghostpdl/./base/gsicc_manage.c:1993:12 + #7 0x561ec4f26a30 in gsicc_init_device_profile_struct /src/ghostpdl/./base/gsicc_manage.c:1841:16 + #8 0x561ec51ea45c in gs_setdevice_no_erase /src/ghostpdl/./base/gsdevice.c:565:33 + #9 0x561ec55e5fe1 in zsetdevice_no_safer /src/ghostpdl/./psi/zdevice.c:620:12 + #10 0x561ec55e64b8 in zsetdevice /src/ghostpdl/./psi/zdevice.c:664:12 + #11 0x561ec5548d45 in do_call_operator /src/ghostpdl/./psi/interp.c:91:12 + #12 0x561ec554573f in interp /src/ghostpdl/./psi/interp.c:1768:40 + #13 0x561ec553fb69 in gs_call_interp /src/ghostpdl/./psi/interp.c:531:12 + #14 0x561ec553f4de in gs_interpret /src/ghostpdl/./psi/interp.c:488:12 + #15 0x561ec4da4fc6 in gs_run_init_file /src/ghostpdl/./psi/imain.c:861:12 + #16 0x561ec4da4b31 in gs_main_init2aux /src/ghostpdl/./psi/imain.c:305:16 + #17 0x561ec4da5cc9 in gs_main_init2 /src/ghostpdl/./psi/imain.c:491:12 + #18 0x561ec57bbbdf in swproc /src/ghostpdl/./psi/imainarg.c:364:20 + #19 0x561ec57b9ae2 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #20 0x561ec57be724 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #21 0x561ec4da0cec in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*, int) /src/gs_fuzzlib.h:139:8 + #22 0x561ec4da1071 in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #23 0x561ec4c3e1ed in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #24 0x561ec4c28f62 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #25 0x561ec4c2ee30 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #26 0x561ec4c5a962 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #27 0x7f7b978ec082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +previously allocated by thread T0 here: + #0 0x561ec4d5cb44 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x561ec5223100 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x561ec5ae18de in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2446:13 + #3 0x561ec5ae0a3a in alloc_obj /src/ghostpdl/./base/gsalloc.c:1911:13 + #4 0x561ec5adb4f9 in i_alloc_bytes /src/ghostpdl/./base/gsalloc.c:1162:15 + #5 0x561ec50bf05e in file_prepare_stream /src/ghostpdl/./base/sfxcommon.c:202:14 + #6 0x561ec525df83 in romfs_open_file /src/ghostpdl/./base/gsiorom.c:305:12 + #7 0x561ec51c8995 in sfopen /src/ghostpdl/./base/strmio.c:65:16 + #8 0x561ec4f1fbaf in gsicc_open_search /src/ghostpdl/./base/gsicc_manage.c:1248:19 + #9 0x561ec4f26c67 in gsicc_set_device_profile /src/ghostpdl/./base/gsicc_manage.c:1983:12 + #10 0x561ec4f26a30 in gsicc_init_device_profile_struct /src/ghostpdl/./base/gsicc_manage.c:1841:16 + #11 0x561ec51ea45c in gs_setdevice_no_erase /src/ghostpdl/./base/gsdevice.c:565:33 + #12 0x561ec55e5fe1 in zsetdevice_no_safer /src/ghostpdl/./psi/zdevice.c:620:12 + #13 0x561ec55e64b8 in zsetdevice /src/ghostpdl/./psi/zdevice.c:664:12 + #14 0x561ec5548d45 in do_call_operator /src/ghostpdl/./psi/interp.c:91:12 + #15 0x561ec554573f in interp /src/ghostpdl/./psi/interp.c:1768:40 + #16 0x561ec553fb69 in gs_call_interp /src/ghostpdl/./psi/interp.c:531:12 + #17 0x561ec553f4de in gs_interpret /src/ghostpdl/./psi/interp.c:488:12 + #18 0x561ec4da4fc6 in gs_run_init_file /src/ghostpdl/./psi/imain.c:861:12 + #19 0x561ec4da4b31 in gs_main_init2aux /src/ghostpdl/./psi/imain.c:305:16 + #20 0x561ec4da5cc9 in gs_main_init2 /src/ghostpdl/./psi/imain.c:491:12 + #21 0x561ec57bbbdf in swproc /src/ghostpdl/./psi/imainarg.c:364:20 + #22 0x561ec57b9ae2 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #23 0x561ec57be724 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #24 0x561ec4da0cec in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*, int) /src/gs_fuzzlib.h:139:8 + #25 0x561ec4da1071 in LLVMFuzzerTestOneInput /src/gs_device_pdfwrite_fuzzer.cc:18:2 + #26 0x561ec4c3e1ed in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #27 0x561ec4c28f62 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #28 0x561ec4c2ee30 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #29 0x561ec4c5a962 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./devices/vector/gdevpdfg.c:75:38 in pdf_save_viewer_state +Shadow bytes around the buggy address: + 0x7e0b96c39980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e0b96c39a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e0b96c39a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e0b96c39b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e0b96c39b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x7e0b96c39c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa] + 0x7e0b96c39c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e0b96c39d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e0b96c39d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e0b96c39e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e0b96c39e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==12699==ABORTING diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/collect_crash_builds.csv b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/collect_crash_builds.csv new file mode 100644 index 000000000..3822e248c --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/original-crashes/collect_crash_builds.csv @@ -0,0 +1,7 @@ +target,commit_id,oss_fuzz_commit,sanitizer +ghostscript,e088d3a844717878592fa5ccf871729983140676,e65a914168f13f4cd823e6df9a76ec60896876f4,address +ghostscript,04c8185f0e8088f01592917af2b7d52ec63114bf,9a3498ed88d34e57ff1db963211a96f5253e67f8,address +ghostscript,e784b3314b61f8dfb65e21cd04d7b0ff53251ce1,017cf397caa9578306748bda8643f35d5a8226f9,address +ghostscript,05efb77627aa0e05ab59ec1d6cb6988e1eb9710e,2fa71e3c7f87497dc31a9b236175c2173756fc99,address +ghostscript,4cb2e5ff261d260487913e3e075377b51b075db5,876d043e5595966bfaca51f39be017d58bb732c5,address +ghostscript,00264e69ed974afcc9d4790c3e615fcfc2a39833,4d798330717b49e6ad0b61e7f82fe1a2e27de071,address diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/patches/combined.diff b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/patches/combined.diff new file mode 100644 index 000000000..dea885f88 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/patches/combined.diff @@ -0,0 +1,412 @@ +diff --git a/base/gstype42.c b/base/gstype42.c +index 579a17a4d..ab9f83801 100644 +--- a/base/gstype42.c ++++ b/base/gstype42.c +@@ -17,6 +17,7 @@ + /* Type 42 (TrueType) font library routines */ + #include /* for qsort */ + ++#include "../__bug_dispatch.h" + #include "memory_.h" + #include "stdint_.h" + #include "gx.h" +@@ -269,11 +270,16 @@ gs_type42_font_init(gs_font_type42 * pfont, int subfontID) + pfont->data.os2_offset = offset; + } + } +- loca_size >>= (pfont->data.indexToLocFormat == 0 ? 1 : 2); ++ if (__bug_dispatch[0] & (1 << 1)) ++ loca_size >>= pfont->data.indexToLocFormat + 1; ++ else ++ loca_size >>= (pfont->data.indexToLocFormat == 0 ? 1 : 2); + pfont->data.numGlyphs = loca_size - 1; +- if (pfont->data.numGlyphs > 65535) { +- pfont->data.numGlyphs = 65535; +- loca_size = (65536 << (pfont->data.indexToLocFormat == 0 ? 1 : 2)); ++ if (!(__bug_dispatch[0] & (1 << 1))) { ++ if (pfont->data.numGlyphs > 65535) { ++ pfont->data.numGlyphs = 65535; ++ loca_size = (65536 << (pfont->data.indexToLocFormat == 0 ? 1 : 2)); ++ } + } + + if (pfont->data.numGlyphs > (int)pfont->data.trueNumGlyphs) { +@@ -409,7 +415,8 @@ gs_type42_font_init(gs_font_type42 * pfont, int subfontID) + while (num_valid_loca_elm > 0 && psortary[num_valid_loca_elm - 1].glyph_offset > glyph_size) + num_valid_loca_elm --; + if (0 == num_valid_loca_elm) { +- gs_free_object(pfont->memory, psortary, "gs_type42_font_init(sort loca)"); ++ if (!(__bug_dispatch[0] & (1 << 1))) ++ gs_free_object(pfont->memory, psortary, "gs_type42_font_init(sort loca)"); + return_error(gs_error_invalidfont); + } + for (i = num_valid_loca_elm; i--;) { +@@ -1292,9 +1299,11 @@ parse_pieces(gs_font_type42 *pfont, gs_glyph glyph, gs_glyph *pieces, + for (i = 0; flags & TT_CG_MORE_COMPONENTS; ++i) { + if (pieces) { + pieces[i] = U16(gdata + 2) + GS_MIN_GLYPH_INDEX; +- if (U16(gdata + 2) > pfont->data.numGlyphs) { +- *pnum_pieces = 0; +- return_error(gs_error_invalidfont); ++ if (!(__bug_dispatch[0] & (1 << 1))) { ++ if (U16(gdata + 2) > pfont->data.numGlyphs) { ++ *pnum_pieces = 0; ++ return_error(gs_error_invalidfont); ++ } + } + } + gs_type42_parse_component(&gdata, &flags, &mat, NULL, pfont, &mat); +diff --git a/base/gxdevsop.h b/base/gxdevsop.h +index 89eed4b3b..cd3c4babd 100644 +--- a/base/gxdevsop.h ++++ b/base/gxdevsop.h +@@ -458,6 +458,8 @@ enum { + */ + gxdso_overprint_op, + ++ gxdso_hilevel_text_clip, ++ + /* Add new gxdso_ keys above this. */ + gxdso_pattern__LAST + }; +diff --git a/base/ttinterp.c b/base/ttinterp.c +index 63846c8d8..418205ff8 100644 +--- a/base/ttinterp.c ++++ b/base/ttinterp.c +@@ -69,6 +69,7 @@ + #include "ttcalc.h" + #include "ttinterp.h" + #include "ttfinp.h" ++#include "../__bug_dispatch.h" + + #ifdef DEBUG + # define DBG_PAINT CUR.current_face->font->DebugRepaint(CUR.current_face->font); +@@ -1825,10 +1826,16 @@ static int nInstrCount=0; + { + if ( args[1] == 0 ) + { +- if ( BOUNDS(CUR.IP + args[0], CUR.codeSize ) ) ++ if ( !(__bug_dispatch[0] & (1 << 0)) ) + { +- CUR.error = TT_Err_Invalid_Reference; +- return; ++ if ( !(__bug_dispatch[0] & (1 << 1)) ) ++ { ++ if ( BOUNDS(CUR.IP + args[0], CUR.codeSize ) ) ++ { ++ CUR.error = TT_Err_Invalid_Reference; ++ return; ++ } ++ } + } + + CUR.IP += (Int)(args[0]); +@@ -4384,13 +4391,35 @@ static int nInstrCount=0; + end_point = CUR.pts.contours[contour]; + first_point = point; + +- while ( point <= end_point && point < CUR.pts.n_points && (CUR.pts.touch[point] & mask) == 0 ) +- point++; ++ if (__bug_dispatch[0] & (1 << 0)) ++ { ++ while ( point <= end_point && (CUR.pts.touch[point] & mask) == 0 ) ++ point++; ++ } ++ else ++ { ++ if ( __bug_dispatch[0] & (1 << 1) ) ++ { ++ while ( point <= end_point && (CUR.pts.touch[point] & mask) == 0 ) ++ point++; ++ } ++ else ++ { ++ while ( point <= end_point && point < CUR.pts.n_points && (CUR.pts.touch[point] & mask) == 0 ) ++ point++; ++ } ++ } + +- if (BOUNDS(point, CUR.pts.n_points )) ++ if ( !(__bug_dispatch[0] & (1 << 0)) ) + { +- CUR.error = TT_Err_Invalid_Reference; +- return; ++ if ( !(__bug_dispatch[0] & (1 << 1)) ) ++ { ++ if (BOUNDS(point, CUR.pts.n_points )) ++ { ++ CUR.error = TT_Err_Invalid_Reference; ++ return; ++ } ++ } + } + + if ( point <= end_point ) +@@ -4404,13 +4433,7 @@ static int nInstrCount=0; + { + if ( (CUR.pts.touch[point] & mask) != 0 ) + { +- if (BOUNDS(cur_touched, CUR.pts.n_points) +- || BOUNDS(point, CUR.pts.n_points)) +- { +- CUR.error = TT_Err_Invalid_Reference; +- return; +- } +- else ++ if (__bug_dispatch[0] & (1 << 0)) + { + Interp( (Int)(cur_touched + 1), + (Int)(point - 1), +@@ -4419,6 +4442,36 @@ static int nInstrCount=0; + &V ); + cur_touched = point; + } ++ else ++ { ++ if ( __bug_dispatch[0] & (1 << 1) ) ++ { ++ Interp( (Int)(cur_touched + 1), ++ (Int)(point - 1), ++ (Int)cur_touched, ++ (Int)point, ++ &V ); ++ cur_touched = point; ++ } ++ else ++ { ++ if (BOUNDS(cur_touched, CUR.pts.n_points) ++ || BOUNDS(point, CUR.pts.n_points)) ++ { ++ CUR.error = TT_Err_Invalid_Reference; ++ return; ++ } ++ else ++ { ++ Interp( (Int)(cur_touched + 1), ++ (Int)(point - 1), ++ (Int)cur_touched, ++ (Int)point, ++ &V ); ++ cur_touched = point; ++ } ++ } ++ } + } + + point++; +diff --git a/base/ttobjs.c b/base/ttobjs.c +index 5fa95a887..6718189c5 100644 +--- a/base/ttobjs.c ++++ b/base/ttobjs.c +@@ -41,6 +41,7 @@ + #include "ttcalc.h" + #include "ttload.h" + #include "ttinterp.h" ++#include "../__bug_dispatch.h" + + /* Add extensions definition */ + #ifdef TT_EXTEND_ENGINE +@@ -303,8 +304,10 @@ static int free_aux(ttfMemory *mem, void *ptr) + if (n_points < 100) + n_points = 100; /* Bug 689907 */ + +- exec->n_contours = exec->n_points = 0; +- exec->twilight.n_points = 0; ++ if (!(__bug_dispatch[0] & (1 << 1))) { ++ exec->n_contours = exec->n_points = 0; ++ exec->twilight.n_points = 0; ++ } + + if ( ALLOC_ARRAY( exec->callStack, exec->callSize, callSize, TCallRecord ) || + /* reserve interpreter call stack */ +diff --git a/devices/vector/gdevpdfi.c b/devices/vector/gdevpdfi.c +index 724e36547..7d5a50b10 100644 +--- a/devices/vector/gdevpdfi.c ++++ b/devices/vector/gdevpdfi.c +@@ -38,6 +38,7 @@ + #include "gsicc_manage.h" + #include "gsform1.h" + #include "gxpath.h" ++#include "../../__bug_dispatch.h" + + /* Forward references */ + static image_enum_proc_plane_data(pdf_image_plane_data); +@@ -2941,6 +2942,32 @@ gdev_pdf_dev_spec_op(gx_device *pdev1, int dev_spec_op, void *data, int size) + break; + case gxdso_in_smask_construction: + return pdev->smask_construction; ++ case gxdso_hilevel_text_clip: ++ if (__bug_dispatch[0] & (1 << 3)) { ++ if (data == 0) { ++ if (pdev->clipped_text_pending) { ++ code = pdf_open_page(pdev, PDF_IN_STREAM); ++ if (code < 0) ++ return code; ++ pdev->clipped_text_pending = 0; ++ code = pdf_restore_viewer_state(pdev, pdev->strm); ++ if (code < 0) ++ return code; ++ pdf_reset_text(pdev); ++ } ++ } else { ++ if (!pdev->clipped_text_pending) { ++ code = pdf_open_page(pdev, PDF_IN_STREAM); ++ if (code < 0) ++ return code; ++ code = pdf_save_viewer_state(pdev, pdev->strm); ++ if (code < 0) ++ return code; ++ pdev->clipped_text_pending = 1; ++ } ++ } ++ } ++ break; + case gxdso_get_dev_param: + { + int code; +diff --git a/devices/vector/gdevpdfx.h b/devices/vector/gdevpdfx.h +index 098fc4fc9..6e163e72e 100644 +--- a/devices/vector/gdevpdfx.h ++++ b/devices/vector/gdevpdfx.h +@@ -957,6 +957,7 @@ struct gx_device_pdf_s { + bool OmitInfoDate; /* If true, do not emit CreationDate and ModDate in the Infor dictionary and XMP Metadata (must not be true for PDF/X support) */ + bool OmitXMP; /* If true, do not emit an XMP /Metadata block and do not reference it from the Catalog (must not be true for PDF/A output) */ + bool OmitID; /* If true, do not emit a /ID array in the trailer dicionary (must not be true for encrypted files or PDF 2.0) */ ++ bool clipped_text_pending; + }; + + #define is_in_page(pdev)\ +diff --git a/pdf/pdf_annot.c b/pdf/pdf_annot.c +index 58210d8a6..777016ea3 100644 +--- a/pdf/pdf_annot.c ++++ b/pdf/pdf_annot.c +@@ -35,6 +35,7 @@ + #include "pdf_mark.h" + #include "pdf_font.h" + #include "pdf_text.h" ++#include "../__bug_dispatch.h" + + #include "gspath2.h" + #include "gxfarith.h" +@@ -3670,10 +3671,31 @@ static int pdfi_annot_draw_Widget(pdf_context *ctx, pdf_dict *annot, pdf_obj *No + break; + } + /* Check for Parent */ +- code = pdfi_dict_knownget_type(ctx, currdict, "Parent", PDF_DICT, (pdf_obj **)&Parent); +- if (code < 0) goto exit; +- if (code == 0) +- break; ++ if (__bug_dispatch[0] & (1 << 2)) { ++ code = pdfi_dict_get_no_store_R(ctx, currdict, "Parent", (pdf_obj **)&Parent); ++ if (code == gs_error_undefined) ++ break; ++ if (code < 0) ++ goto exit; ++ if (pdfi_type_of(Parent) != PDF_DICT) { ++ if (pdfi_type_of(Parent) == PDF_INDIRECT) { ++ pdf_indirect_ref *o = (pdf_indirect_ref *)Parent; ++ ++ code = pdfi_dereference(ctx, o->ref_object_num, o->ref_generation_num, (pdf_obj **)&Parent); ++ pdfi_countdown(o); ++ if (code < 0) ++ break; ++ } else { ++ pdfi_countdown(Parent); ++ break; ++ } ++ } ++ } else { ++ code = pdfi_dict_knownget_type(ctx, currdict, "Parent", PDF_DICT, (pdf_obj **)&Parent); ++ if (code < 0) goto exit; ++ if (code == 0) ++ break; ++ } + pdfi_countdown(currdict); + currdict = Parent; + pdfi_countup(currdict); +diff --git a/pdf/pdf_gstate.c b/pdf/pdf_gstate.c +index 5248bd40f..90bdb8bda 100644 +--- a/pdf/pdf_gstate.c ++++ b/pdf/pdf_gstate.c +@@ -46,6 +46,8 @@ + #include "gscolor3.h" /* For gs_setsmoothness() */ + #include "gzpath.h" + #include "gspenum.h" ++#include "gxdevsop.h" ++#include "../__bug_dispatch.h" + + static const char *blend_mode_names[] = { + GS_BLEND_MODE_NAMES, 0 +@@ -222,7 +224,19 @@ int pdfi_op_Q(pdf_context *ctx) + return code; + } + +- return pdfi_grestore(ctx); ++ if (__bug_dispatch[0] & (1 << 3)) { ++ code = pdfi_grestore(ctx); ++ ++ if (code >= 0 && ctx->device_state.preserve_tr_mode && gs_currenttextrenderingmode(ctx->pgs) < 4) { ++ gx_device *dev = gs_currentdevice_inline(ctx->pgs); ++ ++ dev_proc(dev, dev_spec_op)(dev, gxdso_hilevel_text_clip, (void *)0, 1); ++ } ++ ++ return code; ++ } else { ++ return pdfi_grestore(ctx); ++ } + } + + /* We want pdfi_grestore() so we can track and warn of "too many Qs" +diff --git a/pdf/pdf_text.c b/pdf/pdf_text.c +index dfc352013..165e36d66 100644 +--- a/pdf/pdf_text.c ++++ b/pdf/pdf_text.c +@@ -32,6 +32,8 @@ + #include "gdevbbox.h" + #include "gspaint.h" /* For gs_fill() and friends */ + #include "gscoord.h" /* For gs_setmatrix() */ ++#include "gxdevsop.h" ++#include "../__bug_dispatch.h" + + static int pdfi_set_TL(pdf_context *ctx, double TL); + +@@ -777,18 +779,28 @@ static int pdfi_show_Tr_preserve(pdf_context *ctx, gs_text_params_t *text) + gs_swapcolors_quick(ctx->pgs); + } + +- code = pdfi_show_simple(ctx, text); +- if (code < 0) +- return code; ++ if (__bug_dispatch[0] & (1 << 3)) { ++ if (Trmode >= 4 && current_font->pdfi_font_type != e_pdf_font_type3) { ++ gx_device *dev = gs_currentdevice_inline(ctx->pgs); + +- /* See the comment in pdfi_BT() aboe regarding text rendering modes and clipping. +- * NB regardless of the device, we never apply clipping modes to text in a type 3 font. +- */ +- if (Trmode >= 4 && current_font->pdfi_font_type != e_pdf_font_type3) { +- text->operation &= ~TEXT_DO_DRAW; ++ dev_proc(dev, dev_spec_op)(dev, gxdso_hilevel_text_clip, (void *)1, 1); ++ } + +- gs_moveto(ctx->pgs, initial_point.x, initial_point.y); +- code = pdfi_show_Tr_7(ctx, text); ++ code = pdfi_show_simple(ctx, text); ++ } else { ++ code = pdfi_show_simple(ctx, text); ++ if (code < 0) ++ return code; ++ ++ /* See the comment in pdfi_BT() aboe regarding text rendering modes and clipping. ++ * NB regardless of the device, we never apply clipping modes to text in a type 3 font. ++ */ ++ if (Trmode >= 4 && current_font->pdfi_font_type != e_pdf_font_type3) { ++ text->operation &= ~TEXT_DO_DRAW; ++ ++ gs_moveto(ctx->pgs, initial_point.x, initial_point.y); ++ code = pdfi_show_Tr_7(ctx, text); ++ } + } + return code; + } diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/patches/harness.diff b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/patches/harness.diff new file mode 100644 index 000000000..d1c36a647 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/patches/harness.diff @@ -0,0 +1,20 @@ +diff --git a/__bug_dispatch.c b/__bug_dispatch.c +new file mode 100644 +index 000000000..8b8ff0ce2 +--- /dev/null ++++ b/__bug_dispatch.c +@@ -0,0 +1,2 @@ ++#include "__bug_dispatch.h" ++volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES] = {0}; +diff --git a/__bug_dispatch.h b/__bug_dispatch.h +new file mode 100644 +index 000000000..6450a2593 +--- /dev/null ++++ b/__bug_dispatch.h +@@ -0,0 +1,6 @@ ++#ifndef __BUG_DISPATCH_H ++#define __BUG_DISPATCH_H ++#include ++#define __BUG_DISPATCH_BYTES 1 ++extern volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES]; ++#endif diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/patches/harness_sources/manifest.json b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/patches/harness_sources/manifest.json new file mode 100644 index 000000000..4f09a3307 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/patches/harness_sources/manifest.json @@ -0,0 +1,6 @@ +[ + { + "container_path": "/src/gs_device_pdfwrite_fuzzer.cc", + "snapshot": "src__gs_device_pdfwrite_fuzzer.cc" + } +] \ No newline at end of file diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/patches/harness_sources/src__gs_device_pdfwrite_fuzzer.cc b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/patches/harness_sources/src__gs_device_pdfwrite_fuzzer.cc new file mode 100644 index 000000000..6b8cc9a14 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/patches/harness_sources/src__gs_device_pdfwrite_fuzzer.cc @@ -0,0 +1,28 @@ +/* Copyright 2022 Google LLC + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +#include "__bug_dispatch.h" +#include + +#include "gs_fuzzlib.h" + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + if (size < __BUG_DISPATCH_BYTES) return 0; + memcpy((void*)__bug_dispatch, data, __BUG_DISPATCH_BYTES); + data += __BUG_DISPATCH_BYTES; + size -= __BUG_DISPATCH_BYTES; + + fuzz_gs_device(data, size, 1, "pdfwrite", "/dev/null"); + return 0; +} diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-1021-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-1021-patched new file mode 100644 index 000000000..77c30c472 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-1021-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-1097-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-1097-patched new file mode 100644 index 000000000..22d5e4be2 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-1097-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-1148-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-1148-patched new file mode 100644 index 000000000..9ec73432e Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-1148-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-1194-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-1194-patched new file mode 100644 index 000000000..f2cc776de Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-1194-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-1208-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-1208-patched new file mode 100644 index 000000000..d676a0c6a Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-1208-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-522-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-522-patched new file mode 100644 index 000000000..fa11a2a08 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-522-patched @@ -0,0 +1,599 @@ +%PDF-1.7 % +1 0 obj <>/Metadata 22 0 R/Pages 2 0 R/Type/Catalog>> endobj 22 0 obj <>stream + + + + + uuid:3061f54b-da79-4e4f-8d50-bb8ea880972b + adobe:docid:indd:9ea070bd-7cd6-11e0-b511-cc88c39318f9 + proof:pdf + + + 2011-06-22T10:16:27-07:00 + 2011-06-22T10:16:27-07:00 + 2011-06-22T10:16:27-07:00 + Adobe InDesign CS3 (5.0.4) + + + + JPEG + 256 + 256 + /9j/4AAQSkZJRgABAgEASABIAAD/7QAsUGhvdG9zaG9wIDMuMAA4QklNA+0AAAAAABAASAAAAAEA AQBIAAAAAQAB/+4AE0Fkb2JlAGQAAAAAAQUAAimY/9sAhAAKBwcHBwcKBwcKDgkJCQ4RDAsLDBEU EBAQEBAUEQ8RERERDxERFxoaGhcRHyEhISEfKy0tLSsyMjIyMjIyMjIyAQsJCQ4MDh8XFx8rIh0i KzIrKysrMjIyMjIyMjIyMjIyMjIyMjI+Pj4+PjJAQEBAQEBAQEBAQEBAQEBAQEBAQED/wAARCAEA AMYDAREAAhEBAxEB/8QBogAAAAcBAQEBAQAAAAAAAAAABAUDAgYBAAcICQoLAQACAgMBAQEBAQAA AAAAAAABAAIDBAUGBwgJCgsQAAIBAwMCBAIGBwMEAgYCcwECAxEEAAUhEjFBUQYTYSJxgRQykaEH FbFCI8FS0eEzFmLwJHKC8SVDNFOSorJjc8I1RCeTo7M2F1RkdMPS4ggmgwkKGBmElEVGpLRW01Uo GvLj88TU5PRldYWVpbXF1eX1ZnaGlqa2xtbm9jdHV2d3h5ent8fX5/c4SFhoeIiYqLjI2Oj4KTlJ WWl5iZmpucnZ6fkqOkpaanqKmqq6ytrq+hEAAgIBAgMFBQQFBgQIAwNtAQACEQMEIRIxQQVRE2Ei BnGBkTKhsfAUwdHhI0IVUmJy8TMkNEOCFpJTJaJjssIHc9I14kSDF1STCAkKGBkmNkUaJ2R0VTfy o7PDKCnT4/OElKS0xNTk9GV1hZWltcXV5fVGVmZ2hpamtsbW5vZHV2d3h5ent8fX5/c4SFhoeIiY qLjI2Oj4OUlZaXmJmam5ydnp+So6SlpqeoqaqrrK2ur6/9oADAMBAAIRAxEAPwCbeU/KflW58q6L cXGi6fNNNp9rJJJJaws7u0MbMzM0ZJJJ3OKpt/gzyf8A9WHTf+kOD/qnirv8GeT/APqw6b/0hwf9 U8Vd/gzyf/1YdN/6Q4P+qeKu/wAGeT/+rDpv/SHB/wBU8Vd/gzyf/wBWHTf+kOD/AKp4q7/Bnk// AKsOm/8ASHB/1TxV3+DPJ/8A1YdN/wCkOD/qnirv8GeT/wDqw6b/ANIcH/VPFXf4M8n/APVh03/p Dg/6p4q7/Bnk/wD6sOm/9IcH/VPFXf4M8n/9WHTf+kOD/qnirv8ABnk//qw6b/0hwf8AVPFXf4M8 n/8AVh03/pDg/wCqeKu/wZ5P/wCrDpv/AEhwf9U8Vd/gzyf/ANWHTf8ApDg/6p4q7/Bnk/8A6sOm /wDSHB/1TxV3+DPJ/wD1YdN/6Q4P+qeKu/wZ5P8A+rDpv/SHB/1TxV3+DPJ//Vh03/pDg/6p4q7/ AAZ5P/6sOm/9IcH/AFTxV3+DPJ//AFYdN/6Q4P8Aqnirv8GeT/8Aqw6b/wBIcH/VPFXf4M8n/wDV h03/AKQ4P+qeKpTrPlPyrFqOgJFounok+oSRyqtrCA6Cwv5OLgR7jkimh7gYqm3kz/lD9B/7Ztn/ AMmI8VTrFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FUl13/jqeXP8A tpSf907UsVd5M/5Q/Qf+2bZ/8mI8VTrFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7 FXYq7FXYq7FUl13/AI6nlz/tpSf907UsVd5M/wCUP0H/ALZtn/yYjxVOsVSbzRrV5oGmjUbW0jvQ JoYZEknaCnrypAjKVgnr8cgr02+7FUPH5j1KDU/0PqmmLHeTW013ZizuROk4g4c4uU8VoUerinIc f8rFUw0DV117RrPWEiMC3sQlWNjyKg9ATQYqmOKpVpGtHVLzVLN7V7V9KuRbNzZWMnKNJlkHplgA yuCN6+NDiqn5o1q70DTBqNraR3oE0MMiSTGCnryJAjKVgnr8cgr02+7FVPTPMNzPrF3oOr2iWN7a 26XgaGc3EDwOzJy9R4bdlIZSCCuKtWWv6lqqi/0rTkn0l6mK4luDFPMoLDnDB6DKVNPhLyJXFVC5 8xa4mrWWlWmlW7tqFq95G1zdyQFPS9ESxyItlNRg0wA/hiqP0HXDrMd1HPbmzvNPnNrd25cSKsgV ZAUkUDkpVwQaA+IGKptirsVdirsVdirsVdirsVdirsVdirsVSXXf+Op5c/7aUn/dO1LFXeTP+UP0 H/tm2f8AyYjxVOsVYv8AmGGm8tvZRwXNxJcXFpRLOGaVwsVzBNI1bZGZKIhNdvbfFUotYlt/Ndtq uhW+pvZRWs66tNqcN7IwiA5xJafX0a4aQuu6x1BHUVpiqVW2mTah5Y0DR77SbisOn3ELST2csjQ3 IEYWMQTp6SMwqVmdSBSinc4qjtNtYrqKzTzhpl7eetptgtrMba5kaCeJONyv7lDJbzeqeXqfDUft fDiqHuEmk8x6rd3+l3eoaJJqEPr2EthO/qf6Nb263aVhYSiF4nBUVBB5Cvw1VZJ5+/0jyqbW3t7q c3M9mUitIJ2kVI7iCdyRAnOPjGh603264qgbO0TSbu8057a9ns/McXK11X0Lme5hEi8Pq167q8yc DJyRpOlSGpxxVT064urDyqPKmr2OpW1/Yw/VIJtPjuWSb0/hgmiu7EUQNxHIOy0/a2xVAC0aK98t xa3FrLtZaVKNRuIBqUsgu7gWkhQ3VnydviV9g5UUpttiqfeRLO8sv0tH6M0OkPdCTTPrqMl24dQZ 2m9UCUj1PsmT4qe1MVZbirsVdirsVdirsVdirsVdirsVdirsVSXXf+Op5c/7aUn/AHTtSxV3kz/l D9B/7Ztn/wAmI8VTrFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FUtutXjjYx2yiZhszk0RT8/2 j8vvzE1Guhi2G5ZCNoF7++k+1MVB6qihR9Gxb8cwJ9o5pctmXAFou7tTVZ3B+fL8HDDIDXZh1XhC Ih1e5jIEyidO5Hwv/wA0n8MycXaZ/iCDBNbe5huo/UhbkOhHQg+DA9M2UMkZiwwpVySuxV2KpLrv /HU8uf8AbSk/7p2pYq7yZ/yh+g/9s2z/AOTEeKp1irsVdirsVdirsVdirsVdirsVdirsVdirsVSv VrtlpZxHiWHKVh1CnYKP9an+dcwtfqTjjQ5llEWlYAAAAoBsAM0zY7FXYq7FV8M8lrMLiLcjZ07O v8p/h/t5kaXUnDLyRIWyON0lRZYzyRwGU+IIqM3wNhqXYq7FUl13/jqeXP8AtpSf907UsVd5M/5Q /Qf+2bZ/8mI8VTrFUu1y+lsbNTbkLNcSpbxuRUKZDTlT2GKqNytrpQgaW7u1eSRRyJmnEh5A8Cqh 1Ut2pTFVWPWkmSWWG0uZEhcxMQig8wQOPFnVu/Uig74qpr5htnhWdIJmQz/VXK+kRHJVQOberxoe XUE4qj4bgXEk8QjdBAwQyNx4uSKnhxYnavcDFWLvLMpuLWznujqIvWjtOcszRcE4EqxlYxsAta9W xVOJpZb7WG0z1HhgtoVml9JijyM5oq81owUAdjiqGvZbdINStoLq69a3t2kWNjOpiaNZCHExpUMf FjWmKqMF0EvdMS0mulacf6Qt003puvCp4/WurcunDFWTYq7FXYq7FWOXbF7udz1Lkf8AA/APwXNF rpE5i2R5KWYzJ2KuxV2KuxVOtIYmyCnqjMv0E8h+DZvtFLiwhqlzR2ZCHYqkuu/8dTy5/wBtKT/u nalirvJn/KH6D/2zbP8A5MR4qnWKoa/sYNRtXtLioR6EMpoysDVWU+IOKoRtMvpxbx3l4ssdtKkw Kw8ZHMbcl5v6rL86KMVUxolybS4tpbpGM9x9aqISF5cg7I6GVuSGnSoxVa+nLa2d7azFrhdQdnVI YWBVyirSql1UVQcSaU8cVTKyt2tbSOBm5yKtXc/tO3xOx+bEnFUvTQ5TBcxXFyrvPMbqKWOIo0Mx p8S1leoFOmKqjaTctNFfC6CX8Sek0yxUjkjrXjJEZD38GGKrJdHuplvWkuk9e+iFu7CEhFjAcfCn qk1+PqWxVttHubj6pHe3SSQWTpIkcUJjLNGKIWZpZPwpiqbYq7FXYq7FWPX0ZivZk7MRIvyfr/ww OaXtDHw5b72yB2UMw2TsVdirsVd0xVPdLjMdlHyFGesh8fiNVr/saZ0Glx8GIBqJsovLkOxVJdd/ 46nlz/tpSf8AdO1LFXeTP+UP0H/tm2f/ACYjxVOsVdirsVdirsVdirsVdirsVdirsVdirsVdiqD1 Gy+txhoyFmjqUJ6EHqp9jTKNTpxmhXVINJHuGKOCjpsyNsQffNHkxyxyotgNuyCXYq7FUTYWLXrC Rx/ow3JP+7P8lf8AJ8T9Hy2Gi0ZJ4pcmEpJ/m2YOxV2KpLrv/HU8uf8AbSk/7p2pYq7yZ/yh+g/9 s2z/AOTEeKp1irsVdirsVdirsVdirsVdirsVdirsVdirsVdiqhcWdvdAeunIr9lhUMPkwochkxRy CpBQaQL6Ia/urggf5aBj/wAKyfqzDn2ZA8jTLjK0aLN+1Oo+SE1Hj9sZAdlDrJPGiIdHtUPKas58 H+x/wA6/TXMnFosWPer97EyJR2ZKG8VdirsVSXXf+Op5c/7aUn/dO1LFXeTP+UP0H/tm2f8AyYjx VOsVQuoQxT2zLKobpQkAkVIG3hiqDehKWF6okkjkT0ncA+pGWA79+xxVXGouz8Ybdnjqyq9HAqtR Un0+IFR44q5dRkdYGWIf6RGzrV+hQVofg/HFVtvf3Trbo0KtJPGZA/OikClf2CR18MVXrflroWjx gcy6hlfkQVBPxUWgrTxriq7SgBZgDoHkG+/7bYqjMVdirsVdirsVYrLqeq+XtSf9KsbrT7pyUmA+ x7KO1P5fuyuzE7uzjp8Wpx+jaQ6MmhmiuIlngcSRyDkrLuCDljrZRMTRVMUOxV2KuxV2KuxV2Kux VJdd/wCOp5c/7aUn/dO1LFXeTP8AlD9B/wC2bZ/8mI8VTrFVKeH14/T5tGKgkpSpp2+JWxVqS2jm 9IyVZoWDK+1aj5Dviq2OzSJjwd/TYlvSqOFSa7bV6++KqaaZCnpfvJGEAYRqWAADdvhAxV0WnJC8 TrLIfQUqoJUih7fY9hirl06NGRkkkHpszoKqQpevIbr798VVrW2W1jMSuzipb46VFTU/ZVe+Kq2K uxV2KuxV2KqVzbQXkD21ygkikFGU4kWyhOUJWObE2TUPJ1yZI+V1pMrfEvdCf1H8Dle8Pc7QHHro 0dphlVneW1/brc2riSJ+hHY+BHY5MG3WZMUscqkN1fCwdirsVdirsVdirsVSXXf+Op5c/wC2lJ/3 TtSxV3kz/lD9B/7Ztn/yYjxVOsVULu5FrCZSORJCoo7sdgMVWVv1ClvSbkQCFVvgr3+18X4Yqhvr t6LSS5rFWOX0+PBv5/Tr/ee+KoljeIH/AHsLFULU4MCD2qPVOxocVX2Uks1tHNMVLSKHAQEAAgGm 7NiqlcXrQ3UUIUGNiFlf+UvUJ+IxVu4mulu4oImjCzK5qyFiOFPB161xVuyuZJzNHKF5wPwLJXi2 1dq4qisVdirsVdirsVWSRxzRtFKodHFGVhUEHsQcUxkYmwxO7sb/AMq3DajpdZtPc1nt2JPEf59G +/KyDHcO0x5cesjwT2l0LJNN1O01W2FzaNyXoyn7SnwYZMEF1+fBPDKpIvC1OxV2KuxV2KuxVJdd /wCOp5c/7aUn/dO1LFXeTP8AlD9B/wC2bZ/8mI8VTrFUNf2zXUHGMgSIyyRk9OSnviraTXLgcrcx kbtVlINOy0bv70xVAGC6axltjbNykl5gFo6cS/P+fwGKq/BoxILaxMQkSj0Ma1pUKAFkp+11xVdb Pdw2sMH1V+aKqMS0fGg2JFJK4qovZ3FxbTtJ6kcsrFvSHpEVFOFG36UH7QxVuWO4uJbaS5sy4iRx IpMbDk3Hpyf/ACcVVdPt5YXnYp6ELsDFDUHj/MfhJAr4YqjsVdirsVdirsVdirRAIIIqDsQcVYrq OjXmh3J1jQK+n1ntRuOPU0H8vt27ZWYmO4dng1MNRHw8vwKdaPrVprNv6sB4yrT1YSfiQ/xHgcnG QLh6nSzwSo8u9McLQ7FXYq7FXYqkuu/8dTy5/wBtKT/unalirvJn/KH6D/2zbP8A5MR4qnWKuxV2 KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KsZ1jQJ7a4/TOgn0rlPikhX7LjvxHv3Hf55CUa3Ds dNrIzj4eXl3o/Q9ft9XjMbD0buMUlhO3Tqy17fqwxlbRq9HLAb5x703yTiuxV2KuxVJdd/46nlz/ ALaUn/dO1LFXeTP+UP0H/tm2f/JiPFU6xV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2K sf13y81zINU0pvq+oRHl8OwkI/U36++QlDqHO0mt4BwT3iv0LzEuoMbG+X6vqEVVZDtz49SPfxGM Z2jV6LwvVHeKe5NwnYq7FUl13/jqeXP+2lJ/3TtSxV3kz/lD9B/7Ztn/AMmI8VTrFXYq7FXYq7FX Yq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FUl17y9Fqqi5tz6F9HvHKNuVOgam/yPbIyhbl6TWnDs d49yO0tdQWxiGplWugPjK/hWm1fGmGN1u06g4zkPByRmFqdiqS67/wAdTy5/20pP+6dqWKu8mf8A KH6D/wBs2z/5MR4qnWKuxV5/+Z3njWfJ8unJpUcEgvFmMnrozUMZj48eLp/OcVYSn50ebmO8Nj/y Kk/6rYLRb0Tyv5p1PUNLTVNaaCHnGKW8SESM5kajrWRvh9Pjt1O/tlwwkgOTHSzlW3NE3Hmi8s7r 0riL4ZF5xKY+Dcf5zWZ9q+wOSGKJDbDSRndFM7TWHubUTOoiYRhmZq8STvRR16DInHRYZNMIyod6 Al81fVLhkugPRC/bVTUMOxWpND75H92SBe7b+SjKIo7oC883arETJBFE0Dtxjchu4qoPTc5DUSGA gnkwlp8cOdoKz87eYbq5e2+rxeohqY1jZiE6fFxk2oaZXgnLJOjyYxwQJ8kXZ+cr6S69G8MEcaKz SlVYspFdqc8zpYIAN8tDGtrU9b88XenaTdXtt6crxKnoMUISQsVBPEuGpvlc8cQC15dLGELYOfzk 82dorLf/AIqk/wCq2UW4Fu/5XJ5urQwWW3X91J/1WwWvEmmh/mzrepavYadPFbhbu6ggcqjAhZZF Q0rId98FlAkbevZNm7FXYq7FXYq7FXYq7FUl13/jqeXP+2lJ/wB07UsVd5M/5Q/Qf+2bZ/8AJiPF U6xV2KvIvzyUtPo3hwuf1wYCxk8xsIXF7AhWNi0igLKf3ZqR9s1Hw+O+MTumJ3e5WVjNB6Ka3cW6 SIQF4MPSLBfjAVgvcZm+ITHZ2wyylD0jfrSF8z38KmJ7eZJ5Io29KVyRVgC/FmJ9xvtmNlynFW3N iJSxRJIrySvXNeFze2tharJcRRdHg4iN6cak8eo+Lx+WTOQjkmEzDp9Spd31mbiErAaR0Wb1WqZG rUsK8hhsDet24wMY2Smlzr8Js30yG3/cMv7tyVBqxqQQFOE4ozPqaRpgTxE7scjujbmT0XpJMOMi gsKjanKnXJQxwiPS3jCOak0iVKhByry5U/Xk7vkyB70Hrr3Fx5fKKiIEl4MwJDsGPNQR0NPTOUZp EQtw9eQIbdWHrbtRgoQDsHO+3gcxOIOqUTFKDwB5GvT/AG8PEF5px5ShY+ZNILDdb61anenqpvgE t16vpHLWx2KuxV2KuxV2KuxV2KpLrv8Ax1PLn/bSk/7p2pYq7yZ/yh+g/wDbNs/+TEeKp1irsVeW /nJarczaTzPBUWer9aVMXYZVlnwsJmnmn1CWNi0T8wlSH6VI6Hi2VxzIEmYWWp3N0ipdtzuLelIg 26o29E5V236DM/T5xkDudJqhkj3SRyIl1FLeT2s94kChvRjUEKagAy0X7PAN0wamEZ0e5lqxdWUR cCzdJJbbisFUljjhIRE5pVg0a/tn0/D5ZDjF0C14+GAY9f263lwQz8hAgoAPiAr1NPc5i5854tnC 1ubjybK49S3RZGmaRgCWjYGjAABeJqfH8Mrhq5iV2xw55xN265ne3g+tzKDCSoJSppzHw1zZ48pE fU7TjPDclS0uZVZvTZA0qFSjBWqhG+zVofDbIT1cQNmPiRIvmiAvoxSzXKirQkRQE1C8/h5sAftb nr92UyIyQJPRx9RxZIknor23kqwudG+vRXf+mhS7WoTcOK1UNU7UHhkI4JSx8ThRwSMbrZjN95bn tZCkyyqOvIoVPiKqa+OUGZB5NR2KI8s2IbzHp8kCh447y3Jk2BNJVY/D7EdcYzPEF5F75mY2OxV2 KuxV2KuxV2KuxVJdd/46nlz/ALaUn/dO1LFXeTP+UP0H/tm2f/JiPFU6xV2KvN/zXEguNKkjf0yi zHfvvF2zF1cqIa8jDPRubtBe8KvUjmlR8K7Co+nMOUqYU6O1t7QKXPqXLMQJo2KgKvUVbqSPbDHN MG4lnCcomwn2kazqEFqbW0jiICuHdwP3gJJo5oDX4szMevqFEbuVDVbVLdRltzFEgsomjiSJBdqK 0Epr17dB4ZstLjAgPPdzsUQI78y3LHPaREXCNHI8QYhDuVYch49RletgJY/ixzxiRsdkPJcSI6Is JkWnEhaCn0VHzwjEMQAjFuw4YQGyWapc3thdoXnZrSFXkdDCyhZOJUAhwtd22oad8x84lIUWGcSJ voEDo1le6k09968tImCFndhvQV+EGp6jIwkBMR6uPhI46N2yvQrJRcqt5IHMilUEgDISdgCp26+O Zvg8UdyS5WSETYZYn1/RvRVw3pbIvMFokZioX7BPyHQZj6eEonhlycfFDGY8P9qnqsv6VP76QEwh iAFIQlRz4Oa+HTJarSxnHbowy6aPDt0Y/ppR9bsZbcKGN1AGC0IVfUWoFflmoxn1j3uAZX0esZtG bsVdirsVdirsVdirsVSXXf8AjqeXP+2lJ/3TtSxV3kz/AJQ/Qf8Atm2f/JiPFU6xV2KvPPzRkZJt NVW4h1lDeFKx9cwtd0asrDrfULqC29KCVBCxYNGwqQD1p9K5iVfNgEXbw2jeg0gcuwZnDGiE0+Dv tiGaowRQJEBEcAAcgVBbACSNk8QRWlyxTxXM4uBDcpV4IlavIozMPhNOVVBB2ze6HOckN+jttNml khVe9A319davLDFdSM5tjUtQKQPiNOS0r/bjmnATED3ss2TEJ0AvWNJXdoplKr2che9Nq5kk25Ag QOSnexqdPm5UdiTVWPIUK8egoe/XNZqdYYmo0XC1WvldCkF5dt57GBi09Y5yH47gPx7MO68l6e2S 0+oiZVyXS54mwUyCM9LkAoVIG/8AEZmxyATAc6GSMZcPNPn1e1NpGivznkq7yqWXgzH4l9M0G36s tPeGMuIT/H3rp9ctLaxuLJQkzeiYxNU8md67/tA8dqZRqZiMDv0cbUwHDZNeSTaFX9M6cCiuxuIj yX9n41JqBmjxG5j3upGxevZtWx2KuxV2KuxV2KuxV2KpLrv/AB1PLn/bSk/7p2pYq7yZ/wAofoP/ AGzbP/kxHiqdYq7FXmv5stxuNLBNAUnBNKncxdMxtULphkYJbzxW85MkZmUjanbfMWrDDkjg0T9X MhY1C9ApG3c9Mr4tl4kxhuPqEZd4F+NiarRjGwFAd+QpWhpkI5Fq1S1hNxp/12eeMzBuUnLitTJ8 QoPp7DNxpBwQ4v5xr9DstGTijf8AOUSJVVxbsJJZFYKADQqtG5Hbpt45dlMhXe5OeZ2rmrWel31x FLdI0ZitgJJB8PJRXpxbqMxMo1PA42TLnA36ofUr76pBJPcjd/3aIAByJB8Nhmtx45GThEKGmXS+ m1IecaAM8bEBVYmnJD+yTTtTJ3KJv5IBMd2S6KJbOKa+vLVpLSfaEOPjDUPxB6bU5bbfqzP0nFks z+ZczTxOUeo7pXMUnjIVKLC5HiAxNRVu9RmblMskSIHdzcsiQeA7oZRGQwoWc1UDagbamaTJllkN l1GXNKZsovRp5jrGnq0fpj63CpYCm5kU0xxXxj3tI5vXs2rc7FXYq7FXYq7FXYq7FUl13/jqeXP+ 2lJ/3TtSxV3kz/lD9B/7Ztn/AMmI8VTrFXYq8t/OSZo7jR1qeDCckCnUGGnX55TnjbCYYD9eiENY 4uMitRnZwQR7JmL4dlrRNs9yOE0kbGKTcSEELSu9G6ZTOAivJP4IYXUSQRsBPRqOSfhG56EfjkOE BYy3tdFDKI0gLVL0R4YzU0Ue3fNvoNRIg8X0h2ej1HEDZ2iiY/qtlbxXCSPFcwEbFaKa0/aDH7Pg R3zMjG5XezkgnLI9ygJRN8CXHpTN6lZJPsOGBIU8etaUwzPpO7ZMnhNBB3Oi6leelNfPFO6Bz6UT cxxOxP2ga1zQk8PJ0PGHWUP1Vp4bhCs3FAjEVjfhVSGAp1+H6chM3Fnacpq+oS20djG5SCEcQgAp xah6d+nfNlpdXAxAkPJz9PqYH6huhV53ZLonGOAH4auQR1BNWIqT4YdbqPDPpO5Z6vJ4ZuJ5oPka l/tcjyYDp881MiSXWS3Ka6PIs2s6ezR0YzxESdahZAOnbJ4NpAeaL3esZtmx2KuxV2KuxV2KuxV2 KpLrv/HU8uf9tKT/ALp2pYq7yZ/yh+g/9s2z/wCTEeKp1irsVeW/nLGrvpla1CT0NNtzF3yrL0Yy edR28cihWNPTHFem5O/vlBtAibTnSjqGnTLbxzNFGaPJGvQ9AAytsa18Mqlunwt2VJrlnKfq92r2 N1cfBHMg+BiRsAabHfpTKfCFEtU4GJSW90C4sZv0jYTsswo5laQcSa78i25qN8shkIFHki9kC+vG 6Ej29uzRPLShFaE13J6bkZmR1c4bbObj1+SFDZESWk04iWC8kjkAZ1VgBwkBbvvsKbjMUaiY/Sw8 WRvfmo6frzRyvFqNtEoVlCSBVBjdu4rvxJWu2SlEEWGkUEzmmhbl6IKEEjpQbeFOmYUocO4WQrcK tlKWT1udJakANvUVPSvzy3ibY7qsTvIHjPxq2+3Yj+bwxluN1kLCxuNxB6SM0brQRxiOo5EHpw+X c4Iw3auCVquhi5ttbtFkHAtcwrUUoQZVB+/J4wRkAPey3t63m1ZOxV2KuxV2KuxV2KuxVJdd/wCO p5c/7aUn/dO1LFXeTP8AlD9B/wC2bZ/8mI8VTrFXYqxvzP5a0zzDdWh1KUolukhVFPHlyMdSW9ts fD4mcIWOVqOiaToMqy21nY2r2lsQoLRhmdv5i7qWO3jkpQxgV1b80I4gB/ElXmTStFsYm1CP/RIR xP7o/Yep2WlRRqdMxdVp+EWGjNjnEWktpBb3E0F7PaCOOM/BJPQ8lPE7LSlduv3HMGQNOJZPNfrL NYGRrKETw3vNRIoLejzUlQAgOxr2wQ3BTKFC2JSxxadG+m2zmWW5Zf3XIFWcNQU222bb55YQZUT0 ZdAybTfrJsGup7OG0VV9ISTHc95WaiswauAxA5Ngyx4SCN0hv0s7z1kEchdDWOSKGTbanxc1WgOT x7CwQ1nJY5LNEuIZ4Gt3mS2aFTUyFVLCu+7Uqf6YckDdhJOyb/VeM6xyrI6BlU8QONG25d8q5thA rZXt7A28gDTtxMgShBLfdv8AjkJEC6TCQMbVmv25N9Yb0oKE/AECEKAm4NPtH6cnjlM73s2HJQW6 TfW8+q6ekKCMm+hZS7EtxMiCleJBr2yeIesOOQQeT1zNkzdirsVdirsVdirsVdiqS67/AMdTy5/2 0pP+6dqWKu8mf8ofoP8A2zbP/kxHiqdYq7FULc2UN1JHJNGsnpggBugr7U9snGZiNm3HmljBANJf caTdxsU0r07WE/EQrshZunxBY22+Rw48lE2LbY6kHee5UJNCvpZCJBbTQBQqpJyO4X7R+Dry3yU5 wnCiGU9RjnCiDaEn8r6ncKwdreoBCfGxO/ixhNM1h0sz3Ot8IrJPKF66iksQIiWPhyb0yUJIqDGf HIZNJmO0SGwR9NFi8H5U60Lj67dTWclz9YSU8ZJAhQEs44i3FDWmWnTzqgdkCCd2vlHzLa2Mtiv6 PeJ+SohklVVUg9eNvvufbEaUjqg499ltl5N8zRabDp1xNZLxJWWaJ5CxjO/RoFq3apOP5SjsxOIr YPy1EN5dXRFu/qsjwAk/AVX3iIFWx/L5K5p8MqjeS9dBMsU1qssm0lXcgiv83oj9WA6WZQMcgrTe TNTmn9d3gYuiiRBI6guo2b+6PfI/k5nq2RFRpC3X5eXt9ye4eCNmQLwjduHbb+4HhkoaWURzbIEB qy8gaxaatZXiz2sdtazRSvGhckhGUsAvpKvRcMdNISBZSmC9BzLa3Yq7FXYq7FXYq7FXYqkuu/8A HU8uf9tKT/unalirvJn/ACh+g/8AbNs/+TEeKp1irsVdirsVdirsVdirsVdirsVdirsVdirsVdir sVdirsVdirsVdirsVdiqS67/AMdTy5/20pP+6dqWKu8mf8ofoP8A2zbP/kxHiqdYq7FXYq7FXYq7 FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYqkuu/8dTy5/20pP8AunalirvJn/KH6D/2 zbP/AJMR4qnWKuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KpLrv/HU8 uf8AbSk/7p2pYqlPlPzZ5VtvKui29xrWnwzQ6faxyRyXUKujrDGrKytICCCNxiqbf4z8n/8AV+03 /pMg/wCqmKu/xn5P/wCr9pv/AEmQf9VMVd/jPyf/ANX7Tf8ApMg/6qYq7/Gfk/8A6v2m/wDSZB/1 UxV3+M/J/wD1ftN/6TIP+qmKu/xn5P8A+r9pv/SZB/1UxV3+M/J//V+03/pMg/6qYq7/ABn5P/6v 2m/9JkH/AFUxV3+M/J//AFftN/6TIP8Aqpirv8Z+T/8Aq/ab/wBJkH/VTFXf4z8n/wDV+03/AKTI P+qmKu/xn5P/AOr9pv8A0mQf9VMVd/jPyf8A9X7Tf+kyD/qpirv8Z+T/APq/ab/0mQf9VMVd/jPy f/1ftN/6TIP+qmKu/wAZ+T/+r9pv/SZB/wBVMVd/jPyf/wBX7Tf+kyD/AKqYq7/Gfk//AKv2m/8A SZB/1UxV3+M/J/8A1ftN/wCkyD/qpirv8Z+T/wDq/ab/ANJkH/VTFXf4z8n/APV+03/pMg/6qYq7 /Gfk/wD6v2m/9JkH/VTFXf4z8n/9X7Tf+kyD/qpiqU6z5s8qy6joDxa1p7pBqEkkrLdQkIhsL+Pk 5Emw5Ooqe5GKv//Z + + + + + + application/pdf + + + Adobe PDF Library 8.0 + False + + + + +endstream endobj 2 0 obj <> endobj 7 0 obj <>/ColorSpace<>/Font<>/ProcSet[/PDF/Text/ImageC]/ExtGState<>>>/Type/Page>> endobj 18 0 obj <>stream +q +0 0 612 792 re +W n +BT +0 0 0 rg +/GS0 gs +/TT0 1 Tf +48 0 0 48 62.6667 672.0521 Tm +(Black RGB )Tj +0.502 0.502 0.502 rg +0.028 -1.861 Td +(Gray RGB )Tj +/CS0 cs 74 0 0 sc +0 -2.028 TD +(Neutral )Tj +0 -1.2 TD +(CIELAB)Tj +ET +0.855 0.863 0.439 rg +q 1 0 0 1 451.2545 532.1 cm +0 0 m +41.507 0 75.155 29.252 75.155 65.336 c +75.155 101.421 41.507 130.673 0 130.673 c +-41.507 130.673 -75.155 101.421 -75.155 65.336 c +-75.155 29.252 -41.507 0 0 0 c +f +Q +0 0 0 1 K +4 M +/GS1 gs +q 1 0 0 1 451.2545 532.1 cm +0 0 m +41.507 0 75.155 29.252 75.155 65.336 c +75.155 101.421 41.507 130.673 0 130.673 c +-41.507 130.673 -75.155 101.421 -75.155 65.336 c +-75.155 29.252 -41.507 0 0 0 c +h +S +Q +Q +0.855 0.365 0.439 RG +10 w 4 M +/GS0 gs +q 1 0 0 1 350.1097 513.3745 cm +0 0 m +174.545 -157.091 l +S +Q +q +307.1826477 0 0 230.3869934 85.1999969 108 cm +/Im0 Do +Q + +endstream endobj 10 0 obj <> endobj 17 0 obj <> endobj 14 0 obj <> endobj 15 0 obj <> endobj 21 0 obj <>stream +H\j0EY6Gb14n +^A~#SC- Y; )T ҽDUT~=ـx ጗ީ$ۛZfhH,ӌCQD9aG;q`1_Uzb(KؑK_!Ze~?/[\ 3S]_f}>2f\|r{f=T8r5gm!Pkk|9~@*Wm +endstream endobj 20 0 obj <>stream +HytWǿo7M,!&kAhsZj !$rBQ*%ʖBp""%1j7{3̝{3?X1ДZ<L^iy7gSHbA突ޏԸ=ǧcfqg<I2ƞ1a0:-*5L><+`:F~@הIilhnʣrӦEK+(>abZnƛ@wޤN b3z\kz&1\CQlmHO91/deBQȔ h| ({ z0Duz BM%>,0_3Ę6bH3H4HO mh@"m06';eOL6m+'f`'O!m(0 gD$spCۻcQ|zlA[ҴL=˵bd9 culH^Jm~Tfl=4GbF`"WK +o¶yeEy~I%P"ߜ2$+&׵u~V~Ox>2)|$ǤXF +3(%# i:=(Ƙ+$P&dLE9MNGCr89WG\,W!Aޓ5hll`2ooڣT=5BXbDօ?HEz?E +~1|L+Dn1l@98*zk +X +lrJw/ui_漧}| ?j_о٩}S}>]T*?i_־٣}Wr.u*TFj_Ӿe~˝(9@rX'ڗ9/w>!7Dj /4ZC1_2_2 p!G>+<"yD$wȀGD +="H!߁^Q!"PBeGD="RyDdGD{DdKDFzDd= \"GD6o둑;Fy|dijRa? ,QG*TGJcF*Rtq + ܸF8tBGwZaFW/a:t?YsH.#]v$u`9nUh5>3et貟?~F3gt螟Q~F[teX3Lts OZh9c/J i?VbX/7n0\=bzCW|VPîfgG:Y#Un& 2sNLCT>"v餯N괯꬯꼯.h%hi'󙭦|f?lbvowaŴFkz6!RDr"Dl;m4+ }]+ҽR۵m69vV-%&`+JwPз`+VUhB}` G雪-DZo8EVC|P\^Qu ݢVGב__VC-ܙ9bϵ0+(ߴ㹻-J[Oxo;n*_b&^fo|7A~WSįQ_w]^kD+$}D?1@ 3bx^ ???"SLd K)fb/^ "kQ(߈bX-~+֊u-Q"b%}8$8#.+↸#Ex ٰiGvk7O-v[hw='>v?{3;ΰ'7*lUjbUZV*I%.j~FT5JVcUr.{hʛ-x[ޖ֠oGkݑw]yW|& l>!|.P>G/ "aV//jkZDu|/謪+ yOo3 "D00Hb! a SHB 3"R +E(TVZPk-"E@ TEғW/wɽ~7<97MuD"un]KCݥ$R>y@i4zX}}_ԣzT1=&zROJ~HST?39izYZ"^zMIn&miTJ{#]:'zCDtDd!Ka IBFbtF + Q,(EtDha*Jw\R03`b.JccHbsxNzaI&c,>X˰L˥V`de,9XUjX52kVa#6`7d2۰M;evc 3w;xGF]+xh)GH +q Ǥq\yS|*cqgqV.H).㲔*x ۸--I@LvTp.S]ȅdjtWՑG\]WW]@u.RsQ.JfX+3]3Lw-\ ZV2Ź8]<ڹv:S(s]Ky,]K]K.ե3.ݥBYW9WJ'ܕˢvy>#C VYb0OUVjϬՑeaEZ,([ +kn%ki-ekcmkoe%X:Y'yպZWYe= ː_Zo-k,re Ά0YollB+6ʯu`dMI>Q^􆾠/+J_ IwݯxHֳzh8}!|1fIx oڋ8!8$>)9\\W߹jdq$!*pŮgBn!eu5&Cuf@j#lq6ſk9&4[N iJ]}N_UWW!zRMzT^C/O/եKR}zԐ^Hi(A mM6MSڦmӜiA۴mZ6i8ڦ mO۴C@Gz H:.@2=ЕFtR@*=F@Oz=I},z=M\z`!4$zYLߡ7#2;̎"dv4- d̎!t,9-!i)9-#r:N"r:N##d2]c5N;h%\Wj] ݩ{zP/zB fټl@ L#x + ;m;ǿ y\¿q s>WSDzy[vA@Ng\;>Ky$'$_@oq~EEDw7ˏ=?'#nvϳlvxb+XͫWUOWU gUճ*^U`EJЯ>5ڇN'Z3h@|3#+ڡ=Nt g7|V;j~HlZwG{S뫽6j[jFSwIzIw }^0;Qhxۑ(u2%9ÜXLpvt905s`0%|F܈7d14YFg,0V2c8d5W]\]\]]\\%I6Qg'g+nuk5[ b:[2,dT}`jhJ5ǚ*f'/Sm jhSK}ƭmh]zJT-CqՋ[/=&[St'pKkP(n/sP*n%Y~/*n]{OO鵙AnuLWg/%s7Q+ P8hV8׭8UFYUH_/gI}Pf;A'~| ëԽ*TPէ2r䅏+2*>,X9WPQZ.N. S$ooGo%O'ɓqzy"-F(Ȅ1p`+c2 A8j:sqb\ ЂRɟ\Kp)`).W*\kp-II7f܂_b(6ĭX160 nH0c` Ŧ;q6hC;=E@'}A<a<£X8@2\M(&J4S͠O4O4R͡4S1-ZJ% *eVJZEi u6F`Di }I[m5m }KNEi}A:DrSTc5ՙZ9ةf2s070[̒q:A'3tΑOygIԠ]փf`6D`&hJ 0kAӴP3܌0 Ff3lgfgv7{A@\~I_ѯXihn6 fx@0aҨbx>gUM K+kGRqJӢ\g9q^"..'-V24C۩oi۴aqDP;ͤ骁f.)kE<}8JsigGlc3*=]F&k{tfYb_mB['Eb}>AQ(P֖A2XڥC:K:Ғn*dl/;T.)d'cd')d̑̕eLl,&#b-bIArL9II )%H9Mer\%ur$mrGq\q 9KAԥa">:A>ʁTiPG'Jc`,S>HECi uD̘X2FH"Ei=Cci}ڀ)+9P߇P럊`6TQ_{z+“㭕3W\W+B ЖŰXëR>4c 9mH3Z 8yir6`^ a*>~UVQV` +cCFDFE׋ a|M6KhآeRmڶKi!cZzF̬y]vޣg~}8hÆ(9jO{S~GӦϘ9kΛ`K>Y+>VZŗ__fn7}-[m߱w޳wO.:rcO,.)=.?sy¯tf&kU^pd QFqt2CSI[{(܅ +u"Zj7|V5doj>nPj`ad a1@:A5\I *+MX`?:0›Q8\q80NB;xo;. > >!oG0>O`| +[a#*``. +&BgbPH(\1vTnm\Kp).\+p%ո:\p#܁Spn-?G'6mcb1Q8ĝ ¯X 0[෸%cp(C1pxa8T.r\!WUr\#ur 7MrQS-UJP.V*I%Z֪1՘CY%^+c_s~_/KG+*܏3T[ک:NP]TWՍ'qOlSyOù^tE'Yt]E7]<&z~> Oħb.Ft1R1q3>ćc\ǹOI>ŧ s\yq /p_K|U.W5*\|oMomw3k9h\fiF`0cXfi%-,n)ˡURke9fVs+tflZaVaEZQVh.3 3 3YH$, "%";c.Bd jk)@Y-;&*p_<39s3^Un#u$K}i )I4I i,%ML#*TIJsi!-)%mMIvr{+Ig"]YwNI>WC碌)PzK)R,DK A ,CK*d'#d/(yPFeq<,ȣ<.Ox t=CL=Ks+z;_5G=Oׯ7d.K>v BȽu{O3_)"O2ͯp9 ,wx1/᥼W7po䝼A>>}Q_җMsi떸'w]s]I_u1+lLibځU1۝LgG Ng0c|6jdLf<neۖ XN3W]lW-=m/[h{>Ŷ-m`A83-s8dHDftst[T7jFQ(+jZGQ^-*zGQi48FEnoU{>_P!C +UCЄ6L + ЇaͰVxcx:KJSpmsWr_nv{w^piiv%F m)\ *rPfϹs)b&]PǜrZv>x>ruImEۣTNSZ@T*SD5SR$Z&;u|]_'O }#| |c|f>E/|oK|Ov`'n[>t'n[6zRo[VMo;tJ>>ǠugJ8sNG~(cfT0-fh 7 YͱpG* ?w܊IuxA8]G|͌1~Q*2Ԉ~PM͡nHK:=6S@ 3-TLRm$r$!Gn3!6.]qx +)~uT2n(^F8jR:RLe| 6?,Tqj@襠e0-KGI[Vf[1$Pgx9M9ϼI)S! ٧hy.ǝr|,Gu`?a7v!Q_-,FUf7z+ +1"6v65+ç;TXyItoo1et{Ϋ\8‘4T>a/e:X9xQ|TdjCE4TEG]>*z{PަQ'W_]ZNQʚ \Fj*EFރ@?y3;Ә-~yR)mk*zQmlhQӝQoX\3KHH\QT 0x΀cƨ'at^չ7;r?Syۂǃ?MwyqÉʸ ~{ȢtjB-54= B^ߤX:PN j<Fc T9olJ2;c&#|~]^uu:m^sKNA-~wȷ2n ä =栝i>`2u6v`)z$i2s$qN75a _|^*d3[$W=i)\]=La: +_{Mt,fS? +87nuD{D) ˠS䀐-2h1y\`ar!mHjt˖(>âKc @ϙCq 'L`;I!m{ϋr:)9DVrMdY4c\);6"*qk(l38~Ѿn8jyx~ X^hs6s;pϨ'L< >Hu{Qxi>\ V{ԵGD,Ҋ@C4mDV8hc/QCe }ۓnakyGs*"c ky^8hڠK39uYiLq&>U3dAzK^ߺNim䤞y9\^bF"y:" +^Gf GRJr ӂ[ m4J tAfwagъÎӅlK2LKvgyjel`NFCt.~yE:C٭99g9ԫȢO0i`239hHqCªBFڳ*Y׭MH6N MdVQM-Zl1x.~pB-95-#9G2qZFQe- )7V( ak0vs9zMnE#PrQOEP@vMPxIf{i.ԅao_$]MUy $G^4CPM+2O-! $H!Zv}~;f~ ILpʫzSSJK.,ox[_##>?|挈%uA5B +P*`0TQrsN[fEy\o}G'.+ +zq!%ֆĮ2M.l7хaq{HSiB +LHsI ſ Wūmx+ZZ"JBw<3y˂= ʢ +eA/wOUT*T: w\S\|.W+#V lC{To]+)GYynx爼CV|ceƩ]5M\w޻9g_wM0Vr(4JBa,nj7bC!eSK +***LeTVZ5@chM+(DѴXFU6{ۤ޽}UBΡ7~HW-y٥MOo|"עuTn +~>i"ìh hICOP5 *_?SJ-ő.Z5ݲ;%c`wC0tppn,w<4_ 9'$ECGOt&3r!8DXf@Aomm^>0y=]E*9QpK!]&H1gTQ&:b:F3{^qD3`1ssXɮ4>\fȦPZ`K?v|[qq +(LS$l4A)pPbtS58l(؂/B"QͫYUTwZ(.^wh'sW|3T1 V¬YG6Um2P'xHaYa$vaLvtY:uŸ"3:\qy5mϢ(AT"JEBh +qi:$eH8H)+ni|ťc7>5ң>3ʦ/Zy34ѹN6>~%*OD)-=;OnNzBubG^-h, dRVh'\(^KylqrbVM!3T( gNYGHaSWDs;*<.qK 8 ?4}'kTϜw M3߆4r'd.#DΖioe6azaf:F1*BTDAB!RchXL+H L '@BհU'N "a| +WLEdEKK+k-,]b0`8fCgv$1U'ѭOT_o739!3gʘ3e̙8qAEnË90n6(*BepZ(TPboYhpQ +m +XHP0# $G3F s20hʠm{$M+JcU.1Zgw_j>r#.=}_kѡPֽ! $;GkeCdYT^# iM4(}uF|QFv ;ޑA;;xrGx=gp-j:K5{/fe_;A(xPTפ.0 +cqјt4F6FVL^A';W9!{89SnƗ97F}]7 a1 ep1a?|`NX$B +ytU0d޷t@e8VFE"$݀l.99.NB(pƅ5BA'Vcc2EXp1S6ˌBIeM""dc^BB4A:^<|gl b]ڼmzmo-ߵI ~woRa%i凵wk_1~+#u#H"KcdjS2p$#JYVE)URbܼ,N·zavf{,^v%7ُYe.v7hR3ZM[ KcҴDjR4 %8)B!Dv=&vHy]8/9kT/h}aV'4 .i_(J{`(+|{gc{vw;3c^w?B ndMZ҂ !DpyaM6)$J*j#$~?mmT7p1ޞ{fΝwf=~w#ڡ(!>^z7va4rh`Ct}Ni?.iks𺝭vVb h { w4,1- UTQI.:G@+R?)h\n.In>Isӷ} +1hY<0D/mc%\oZ4;hUVv iط~NxE\6۵}whM  D/(}R MS +(gp %Ba M}|oҏi>PɹuCú!0okF(5ZQ [v՚+vkKQW3- \i׋=WZ5\%+h OЄ=¯n`\" &nvQӰYn@%q)k$ 'W X`DDϰRjT~ T>9 x{^DcHK߭S +@E%oA lbÙg!lcGvb)ޡs3 `%fEmEVۘgs|% #sB=BjnNã`<_:,7Hgyߒ(T6fNTٺ߭^ W7\!;9 $G=m09OzMP4<\2 dvCp)8 ?H~v~?7S2J +* ثt4wdITU W1ŮRaUٴɌ +آB +ըؘx[ wvlGEaZ R9]!Q)v贝Κ< <ѯ_S +6Bk4~T?s巿5̔L,b{dEzHp2.,XSNV6`PZ0{'wZ2!j.5StZl4eI,f`0 +7A9djj@VsHMUBX6(&QK[m2x!BmgB||V[|t̯/ChtjROucy'(d}.6*\z\׆%\?'wY ۻ=T*hQkp5rξFN{N%!& e.ϱ^[ou؅SRԈ ܽ! qqOՖF +tԙ%D*w D"R˒<޽#/K%jiT4KeRWIZcFBCB:tW؅g.'5>y^e)H$[!I&~ w5{ v8"fԜ42|bIL-2o"?25j`]N[-]iiIQEx"fĞ|KD/bfu6b㢼0^XxZlM2`$Tm WlܐTc徶vp9N ͠҈7S⫊V`:-;ssEU4R WFO<1#CS'0>A=3+L oo""gdf+6 ߝUyB +2z,7ne[nn.UfK6!23kڶBb?X2Z` W$AStÏ#ch`tv7:U%מYS}e݁1hh^K N'_MXj캟Bisz/ :kYܧ.._GrqMFz=l᫦[qYK w>kcۘʑXOE5X1TNUߖq8<;OIF@'` #Ш?4N)ӡw] =^ߝϴE9FeH9=MƞD扆G7D#OFam7%kxѧD]әןX*0]bTW}lS=}>=~6ql[;$~4 ڬ@JzilJvS'VL&m0 ib @4:"EZA%cU;eG ιN&{}߽ʋ[ 8pH_梭A]ˌ2F4ikD >J\#qX(:%WJ} QߺPkk o uvZ9j=IȥdQR/! : 3ASyhBJ"Pz14\`Zq)w\zGtfkܐ2}}7&wo[E;;*]D[s\v>+}N$Dנ8MB$)[% +E x]r8x%(zDD + 1r+Wh2A"2U$ʴrMFC&1@H f qѠD4R}_hIM #0-Rņ .V BBBBTHFvH*A.\36_9mQ0? $QHkH#P0XtҼPPPJ=ޑ\dޣ{N̆al Ԃ-/  R5Ѫ]IWuRְtG:Wvf;lGΞ?` q--oR#Nzҟ2liP ;v;R̟LA (B]2Qw}K>(I5)uxuFhcq,\TZ0#psZ^'d \N槂Y̎bթ|~&)-:˷S=Hev(Mg +!J`j f?'EO cuaQ5]ӛޖuꌸP'-lLJ4]jKށ/MHř/pqۭzֻA5 (q_1<2h] O + e n/ܥQNweyѨ#7hPCM(څCt! +~G@l9>LVe YFub+|w&,I<uu|م!;Om͛Wufc.cKaHkLʼPRH҆Kޗ)Z6KAs+KC(fMyJ|Ȗ>H~@0}47%*ScAA38VT@/k>2 @!UdsE,-ϳ P[|09 +a)ʓ&M-d[ōE,nE_o(&NYMk-.݇ ]:ٶg5`Xc֔uܿNIPmc0[%l3{CהNt:SQ}Q'#'ߌCr´ ю6@EcڲTLjz|d6)|= 5H^шk\d[f{4=l=l+`P&z!W؜7` ӢAh~^.ʤ:ή#X}9.ώUAJSvӃn=~ω};?r?.$s $ | d@Z5~ 1VJI6ְ-]U5 6YH/ĤHa:=kV{=K#8p5X(`]3ŷ]m|wZ ɔVA-a3L&r»]$_?嶋$L5E-] A|Ov*#:]EE Y@Sdsf_ +<7۶pf3 A?|(Ѐ&ol.0ana2A!sCin͂EnUy8kf溵mwT^\+NjuIY쑪E#CgHgI𙮈b`3|`i'Qзb +{bk.2F,vA" _j.j0w)i14duQ,K Ѥ8`RQqURyܒKr4VM(} 4^1lR$\TIghK_z}v@?`m M^@xr8F;& N^wX?eK:o + S\6+QQ5TLj"ycJZ4Bޞ4SIbڐń( ښmBi*ïItGvJ/=u瀮bԺ18m\? +]wyJ?@Jj5}U_:dqY@K`%PU!WS{AI:!l?{h=[,~c-MŗxEN/Ɂdʌyz/Ӣ8]-w#/~O7MKavҨgg`p~/Wd" q_$er2{׸E(J\ӏ{T@dArf:\uz) (u0>z|9D~ 7Oh x7ȱ73 "@B֐{A;--Ltȩ%mžc{o n@Vu/Uqs@ !> +/1LcB + D<*DKi3(mE `eԶ!3F`ʄ +<t(mB[ -J[ǀo={$PO39w{Z +|'4wRP?;>w#^ZA hbLȎ4%5!YDZo`&el5Zڃe8ԧ&Ya&%li`p6\|iUJjX#Q6xܕk&X"S(vsDEQ?s*8a5J1ֻъsZz!(lsmIKcHF;UUE*IcgH^ves i>1.9laǖDsO15I9me||'7ts0EysXfOb]yFm[ߗX4ӀxߟE9ʍ^I9}[֗!w-jxE +GD.0bnslSƐ@rJ'JqV/ٻ(d;94~2yE++K)Ҧ\OT|A|``/\s_6 WRq6P!֏*龄"riWxE%ݎ4mr/+8bdcꢎKt5chg^CD|H_Mr@"șF[?"ո5=?P=Yyu5t:WԓuD?GJJ>QO&٫hXkFՈ}2X#o {/Lu sأ`ϐצ-Y}jXgU#/R!+%"w FSF@ s)SНNW>]Vr|Q]+8%`4!:AV[9'@ׇBp9|ݕ4+=RFD.'|@m{:Oa:r: 6ݱNl΄i<wW/]ކX #A`_ y_EnǜK|_lӑ϶P>Ð_62xg63>՜O|_ײ +QSCԖ +q7 q#|?ru+ jbW#^!'Z0Gl7~qcaocpNa H}5YX-9]6vڏy^: հ\#CyۥT%rh9fqXlUr!y8_SL@߳b>?[C{`?dfJuQM?g`7.0VJFXyaP2ƯO z ~T'ztկ+= +GWfA}U +>gA}Uz?wizu߶.Bˇ~+.?(So^u +-&]&1\{[[篩]wʷzzmֿ2}vrA[ +힛%Vg?6vϾΞ~Ww)TKwz8`â~p1܍ro#xT =RKD{\n>Mw3V%.+rV"Tl#~mA\;NYn+{S8/*Q~bc(? i݀B{X1}Hq]40LEM̃~}r;BEW[JU(C+DFaU*){J}/4M }|?@OhThCRK41g_N\|xY9îdr_LO%SʜR#Ώ~H1TOjijBgX+GgL3M[Gy1~yޝ= +{]m L5\S5s >8n+Xw:$*{Q4"yl|s,x:PtpDGsOs c_(9IxKZ!~}^z sUso#F½m׼٤TMo\Zע{vi|Avc$1#W95>g9po=ӑ~Jj Pu;kA @Q> Z6T8}]ƹML3 +pn-򠋜XS. +rY"ip.΀"x@Ov;@5H3"-N+ŰM9 lmz# +]n6yc` bJ=wHxY iqQ{w;zq~LP*u2s`߭i,z'@ ڻբg[)2g AGVvgs?8|G_n G ^Pg޿>e\ +ˉ~{mNQ`L`#Ig{?#A=5gܯ3zr3U߹D=}͐^KbqE]xqL꽻J[pޟg%^E`Z jKbPu#Vr욏8ͯkrJ,1=y֭>5Ǡ%Al{k|5n`짇p?;b'qcn&i"oĢ]Ӆwt<϶`ė :F=2ς:VL*7: eZA {$A= R ԃz-Κ:ރ]i%&9uخ4aޙLgGNpc ߬koĚ}pc+vcĔ;kS γ12s tsw*, <}o8g8g [i y;xy5ejp+G'ʿÍM݅^&zM]"7}kSMgPisשxOЀ(ni'g"xG)X( )O4\f+qzU ? `0 `0 `0 `0 `0 `0 1Q,Myt-"܏C~ߝ˾EEbߦZAFxTHjߧV\1:bUh?N5hI Zg~^#^-hߦU;4ʻCnGCE1Z=8zOPK9flʎg(/O|_!d-?PjPjFʨ9TC9TC9TC"&cXH~w/czϏ+R7,~A$ԽN~Rf"e# )?K +_% +#}eGwyJh8fLijVI%wHjJ62-wK6CK\~݅Nz].I_},A ~Kh0Z_BwiB2$Ҿji45y292d4K˭J^ RK7E'6P"EPtN@&FDQ]l@@*E6 HFwne6wNki^ѵ #Gm#2 *2QcJ &|{kY@ڰ8rTѶ*Yg67}_M!@$’&Ri3YOL$Yƣo 1SSALc[Q'E)]2i땐̞G4JxLbobYz: k SEy]A.$c9…gWAh,UZ^Q:=RϞd{Oy.API+ֈ7Ĕ^iIڅ]~j0Ayŝhܣ9Vƍ2mum]z1 MX=~im/ώe8vf[=P=4[" +^\}Z-tužwF_Սv^]3Nuĭ{rQǷ#V/?䫧P4,W%vQsxZ ;ѡV,'l[ h]q<'FX}nC^ĎV͚sVnJmyf* ŭ:~CfɨS*"湑Dv%lۉs5]+c9@KP+Gª,()8u-;73:+Z]jJF=q$ X"WkAGvnhԈqC%jҡd +v1n%|+bN;"m\sC9F9aکߛ^$+ʑM8eM:[2e^ ?Sޫ1<%'wIyT +R/Im%sj}ͲE6H>C8K>KݲG;b|)_|+i ?O"o(8[9(-9A9sqʣ*|TBeT q.F5\P5q).C-\ڨhHC#4F4E34G \+qZZj5hvh ס3 ]聛胛00Cp BDPd0 Grn8|$|܆܎#q'(܍{0c0p/x! c'v >|53~ 888pq +A2< ɳXey6XX+ +/`U^("^jikR^ZYue>!؈لMٌقWJ^Ŗlּmx ۲۳eGvuyod+;{&d/f7fe? 3f68t8Ù\F2[1N 1sHɻ8w8x?|| > I2Oi:S s|83grgE\y\E\̗K +_ +*:[\ M|]7s CnG۹S~ϹwsrW[~OW~Aa_<ʿy?փЗFc۶ضm6vƶmƼ5_!B #P0pH(hX8x I ɑ) +i Y ّ9 yQQQEQ Q%Q +7ʠ,ʡ<*"*2*:j&j6.>!1)9ZFKBkA[C{t@GtBgtAWtCw@OBoA_C @ ` P pHhXxLDLdLTLt`ga6`.a>`!a1`)a9V`%Va5`-a}6b6c b;+{ppGpp'ppgppppWpp7ppwppO/o_? IC140,1<#0"#120*1:c0&c160.1~H0!110)19S0%S150-1=30cZ23 23s2s3?&? 0(xnJK ˲˳++ +kk [[ ۲۳;; {{srsrsGrGs rs'r's +rsgl\|.B.b.R.rJjZznFnfnVnv]={yyyGyy'yygyyyyWyy7yywyO/o_?GA +( +(B+*+"*"+*+b*b+*/%PB%Rb%QR%SrPJRjQZSzePFeRfeQVeSvPNRnQ^S~PARaQQSqPIRi2*r* +J*jZ:zjFj&jfjjVj6jvjN.n^>~A!aQ1q I)i4K5Gs5O@ HDKL˵B+JFkNAIE[M۵Cjvi?>!1 )9]%]]5] -==#==3= +;}'}}7}/9Ce;P0pH(hX8xￜ ȉIɝ)ʩiəYٝ9˹y]]ȅ]E]]%]ʥ˸˹++kk븮빾[[۸۹;;{{xyxyGxGyxy'x'yxygx,</"//2/ +*:o&oo6o|Ї|G||'|ҧ|g|||ї|W||7|ӷ|w||ЏO/үoџ_?ӿAP@ 6`w۶m۶m۶m۶m۶m+`aQ1q Iɐ)iYِ9yPPEPP%PPePPPPUPP5PPuPP M-m]=}00C00#00c0000S00300s00 K˰+k[۰;{ppGpp'ppgppppWpp7ppwppO/o_?A! )fe8gFd$FfFe4Fg d,fegd!fe1g d)fe9gVd%VfVe5Vg d-fe=g6d#6f6e36g d+fe;gvd'vfve7vgd/fe? 0(8N$NN4N ,<."..2. +*:n&nn6n.>!1 )9^%^^5^ -=>#>>3> +;~'~~7~/?QPSpPHDIV@FaNAIEQMC1KGqO@ HDILɕB)JFiNAIEYMٕC9KGyOU@UHUDEULUB%UJUFeUNUAUIUEUUMUC5UKUGuUO@ HDMLB-JFmNAIE]MC=KG}O5@5H5DC5L5B#5J5Fc5N5A5I5ES5M5C35K5Gs5O@ HDKL˵B+JFkNAIE[M۵C;KG{Ou@uHuDGuLuB'uJuFguNuAuIuEWuMuC7uKuGwuO@HDOLB/JFoNAIE_MC?KGA!ҡ ӲphqXsxGpDGrdGqTGstpLrlq\s|'pB'rb'qR'srpJrjqZszgpFgrfgqVgsvpNrnq^s~pAraqQsqpIriqYsyWpEWreWqUWsupMrmq]s}7pC7rc7qS7sspKrkq[s{wpGwrgwqWwswpOroq_s@`PpHhXxODOdOTOtLl\|/B/b/R/rJjZzoFofoVovNn^~AaQqIiYy_E_e_U_uMm]}?C?c?S?sKk[{GgWwOo_     + op- @ %)Tll0=cZ g,> dCz{{]gy7PA_l~ ` 6&ac6#1 +6c0aˆ #vN)H&4c300s03c K˰+cvvd脍<(`(C]j{b/}/8 Cp(8G(cp,8'$Sp*N8g,sp."\Kp).W*\kp-7&܌[p+nw.܍{p/x!_+|o-?'_+~/g/ְboֱ )þ܀؟r#@nM89C)70n-%GrGs+nm-p,8a1g &99sȝ8Sb9Ml4Ng gp&gq6p.qg.d+waq1p)qW. +FL3C2G+Iy:tY*Y2\ݹ^ܛp_yAS|Y>_K|U[|]?GS~W[~OW_z%$NB#}e'eCH@X6A2XPT6a2\F沅l)#edkF12VqD%&%. I(d{AvdL4HL&ii2]Zd̔Y2[\';|Y Uv6Y$e,e,c H4Qe4m*݊hF µjƪD"O5d0^4̠QE(f] i:L:G8ԤLդLYFA[aqZsgGarzÚ|TTb + d +"Ռ @krreTI<ȓll L3y#0gzFͼ0BdL3Bfd~5Q),);XJE3nיӶ%YŢm^j UlS3nv鰌Y\6 fڳ\檲eئ69\2ſgZiv\-WlEaͨfbDGkNߣz>cڏix\3z)͵:S54Z?Z?Z?Z?Z?Z?~vӝ!n* (P,zJ9#cc(Ye]eqW+d+ZF\P,j?(ULftE^s/#m?Tvf!P*iș/d/c1ܫeF/k%[șTF3/U+1ǛǞǖ\LGJth즜HNi6:S1ؤڛڛj` $Ț֨nшn+X[gNo79x1V]jQUYN-E}cIvf؆zRw,#㚉&'[c}o.եU=(%I,QJFV6U6ڪ6ZVm:{^V[Fzm=w׬~͖S]m~\kRMY%lή3*6-#7;n6UT[2f*uU*dUSٕjKǚj {ܶ0 $6iw,LrHJ'Kp +qF`כ'Yggp<Ra}?M=Yմ|_N^-5^O-nW5ݞ~<@Lt=޿9~syr8-WVn,Lnv/EOOg‹nzW]΋‰bF\}vz߼}g|x0ſol?~pe}\.rW/ΓUboqwt0iSxqoޯWG{??;Mqz4F4mݠڣ>)\up\Lqp\up\WP>Gp +Gx{{{~~ϡ+~+~ |//_ |/#7p#\FnF^ײvy]MuG*hDum-.=n[}Rg^yUWa^y ++̯0?Hߑ#}GOfx3~o-~tvht@E.>4F4 +? pO_oR B./ȚRuAtĹ8OfL '{ H=O>%| +фfA[t2T^~uR:DyɌF*%AAm,p)5kԠ%h5ڼ[y;N5Yg- +v݇r]5pBMir-Y%iW1 {LhG[>_<_S r AMXנ޸P;9Ρv$7Ҥ/Oݥ6]޽~Yv(x8uRMsu>3qkN/5T/~n\fhk\;9ιvnjҦ.mKvnjjѦZmEGX8Ka8l0~@2ؤ$MDou$=}c{4Gc{`\cc{lldg;[r쭛)my!YlyŖs@z{@z{@sѬ?WM:&y +} +OAf +q +q +#-[.''D[myS>S>Sg*d[mym>m>m-D`_000P!q|+Ó|Io+·ۊmEbYSЭk4FIQQ[HAAAAAAAA Q(C!e2D QFTFTFTFTFTFTFTFTFTFTFRFRFRFRFRFRFRFRFRFRFVFVFVFVFVFVFVFVFVFVFF2e4h(QFF2Zeh*UFV2pFN#QH4%FFppppppppppP;S;S;S;Żakvkvk7ϻWo;So;}>]=|9%\ zآX<$K%/C6u_}QwctuwuwuOl&uO}esUUWu/lu/^Խy+<6;Vzn ō:S#R uMGu A;.=[7lz]zѳҳ-.trtrۥ.8v9Fk6mͦٴ5ٴ5flylښM[qM[ik6m5]uvkvmخ ۙNډ];k'v:k'vĮĮصvbvbNډ=={Vwʩ_ʩC B rZN]˩k9uʩk9u-)ԵSSrZNrZN]˩k9 +gh -3C'!:5Z_CkP_Ckh} A} 55PbJ Ca@ {U| T2SePI1-ơ8Ueu1bЯIM5^K^^\\Օ Y7Yt˘ғ#M7;N=QQMsj{Nmϩ927p{x;M5U8|poGet[ȕn趼MVv&aX;;be|܃.8t?1~pCcsC;9Τ55uxD派+oշ׿秧翟ػ.ӗo}_~{^KU}e{0cx![6#G=J(ѣF5|jHK ˏ&_jΚXWZX+kcunVZ ^k5x ^N[.u:x^u:x5 xo7 xMu?O' ?O qَ><=~3*F¨\ raT.ʅQ0*F¨\N>e'8?????????n&֕5z묃un;R~ϏOOϿ,dB& ,dbdbd`d`d`d`d`q 6 Tyyyy8y8'||N+仒J+yJ^+y䵒W7fp3 n7sN ~? ~_/ ~_/,b0,b0,b0,b|`k4Lc04Lc04Lc04<c0<c0<c0 `y 1`y 1`y 1Ɖy 1`y 1`a 1&8 ǿo01o0PC e0PC e0PC e0P_v v v;_]]~[y^]շ5Įwk5>k!v [;C{v v V%VB═ save def % prevent left over effects + +gsave +/Times-Roman findfont 24 scalefont setfont +72 72 translate 0 0 moveto 1 0 0 setrgbcolor (Red) show +72 0 translate 0 0 moveto 0 1 0 setrgbcolor (Green) show +72 0 translate 0 0 moveto 0 0 1 setrgbcolor (Blue) show +72 0 translate 0 0 moveto 1 1 0 setrgbcolor (Yellow) show +72 0 translate 0 0 moveto 1 0 1 setrgbcolor (Pink) soh7w +2 0 translate00 0 moveto 0 1 1 setrgbcolor (Cyan) show +72 0 translate 0 0 moveto 0.9 0.9 0.9 setrgbcolor ('White') show +grestore + +0.0 setlinewidth + +/length 0.1 def +/width 0.02 def +/hsvcircle { +gsave + /h 0.0 def + 0 4 360 { + pop + gsave + 0.5 0.0 translate + + newpath + 0.0 0.0 moveto + length 0.0 lineto + length width lineto + 0.0 width lineto + closepath + h 1.0 1.0 sethsbcolor + fill + + %newpath + %0.0 0.0 moveto + %length 0.0 lineto + %length width lineto + %0.0 width lineto + %closepath + %0.0 setgray + %stroke + + grestore + /h h 4 360 div add def + 4 rotate + } for +grestore +} def + +/graycircle { +gsave + /h -1.0 def + 0 4 360 { + pop + gsave + 0.5 0.0 translate + + newpath + 0.0 0.0 moveto + length 0.0 lineto + length width lineto + 0.0 width lineto + closepath + + h abs setgray + fill + + %newpath + %0.0 0.0 moveto + %length 0.0 lineto + %length width lineto + %0.0 width lineto + %closepath + %0.0 setgray + %stroke + grestore + + /h g-n!v ۝5y&%i```K9%5[ߍX`ޯ!Ր>k!v [ϼk.>c+߱sKk5[Bry v V;"==oo!r;cp_]]}n!Vc```kl}l5Į!v_Y|*TSɧO%J<*yTQ9 +nɳ~N^sɯ_'AAAA8o$I~s$$$$$I|'N's?7;'hΕ        N`YrY$lYV10t 3nm7J֟Nq:ʹЅҍ6gA_v܎qj'ԎqjgԎq;nǵsSjvPTjU;AvP=pkމ7}~y>|o>_y}_֙ЕVFwAOzѠ/3?3?3?3?_ ~/_ ~// / / / ++++W_+~ůW_+~ůoooo7~o 7~o ۭ[onzvۭ=O|U^4'|BK_[wAOzѠțM3-t+t}Qo0PC! 0PC! AOzѠ/z! 0PC! 0oQG!pQGo!,RK!,RK!,RK!,RK!,RK!,RK!,RK!,RK!,RK!,oSO!<SOo!L0TS!L0TSBU8po!d[[!lV[!lV[!lwؚ{_u.Es7ov{?L[KxߛLuro?/l0BJ7N\yywKu\Q} +\u? +V5Y5޺RkҺ&]e&-vnp/Zgl~ ` ,tVܪn,̪kB[T(7իҍz<6{ձcSǦM7ZݗV?#:F7c*'Ue|1Z]13^}Li}ը*lVGT?OOm̔1Z~3}T?VՏ1~gǩ6gxf4F=:Fuo&xamp,6jXF˨lXaUX}կUF먾>Տ9wpO1ק1|jߟƫaoaovӰ4a7 iMnvӰXvo ;S;;;;~w;~w''''_%JT.rtu]8͟g"!e/O,}:F1e42[ec2Z[c422Mc4Qe1cQ}c$e$w双lJ_~x /+tJuTJuTJuTJugZ֤rzAOzQIs4WP5:qqq)UFwAOzYYY͏2(ִִ0}V6 s #1\@p + _ +M#4UAIeZe%Kd +* .IflAӴS-1mheԍ=BZ)&<8=\;z.z.z.z.h|'^kmk)zZy:H]Ճzhˮ],eϑ})#=LFٟ]Fo_/ڗY^{];={>P:].qy]5./usr/openwin/lib/X11/fonts/TrueTyp:9ͺq'$Fx +~&<Ƌ,Xn乑 ^6跢$"fDsEoKb4RaTd-(`h-xj++ e|It1WD<_IJ:VIG* +Gz(///%}Ɋ中OUZV_kE-}ZUWT۸}ۆ[fZnj%[ZZXn]ʬ H- jsGv(3$x 0@l +N;MZ$VLGeLD\L§H3^I``X{ +)H^V+L9xe C:p: I"8+96ցv@wJb~]]IA!$o(k -ɯH>#9,\mV7?kVݬn@ K.]JDm=BJlL"q~=TTTT}T=V~Tۈ*]͒7.ZՈJ/ST' K$ ^qG$:D5C<)t E 1C!6C!2C 1?iY~Gѿ&?D&KC >f_)sI7J5kM7^2_GՋ/l{| >fh H"r{O;i*~ +L~1+* +iB6]ޠi帩ɋ,&\b#䦋Oj.uͫLNa=uqm^ɜ保2-hti'7i^h\^3C|Zq QV~I`9+ޏp¿&._"PL۵mpקiSjזVj57ir+_{G:-z)ظn]0b\zlS)}/$>G_P?}!XM#eJ?HHHK2FhJ4ȩ)r'rކ!njN- t/x8-^myFhWq[w!Ң'}G]zWL&RC:Zq! ECqV\Ԛ'dokuDM)΢DC<;J _/0uW.NG@R6qAE:u:tqk ҥK7W77'/{%W~[k2ItP B؝ڄ 7/C-&¿6X7lZ8=:ƩJU6/„rإfeW5T#5Q%kb! +/b(Fb"V(p?6H| +ǢDa¢QXM@<]q2{~ -)y"RDGu{yN7InU໰ՠ7g3>7(9gy&i CJK%.8MR2 ++{Ƶe +, e^MYBU +endstream endobj 16 0 obj [/Lab<>] endobj 13 0 obj <X. =25;BxlY>gHW826q•UêqS]Hhq\VJ +H¤hG;)j*K,5˗BRos+ 5ݦ ' &<ɎAUɀuIs-+ѽz- f$(ۯ|U /LOOGIowֲt8xzOABw?OK$f/5ur\&JZ֠IHPmQSw*ܪ[^v$kxQdP7)թ˕3ӷ32~)9"c=H2l؆#0u4O!dDPa[I k+R JN &6M{KmrÆͦ="( ^ ~t,cypY?ғ 6/$k +lyv$ֈւE>fOK}ϙB +쑘0,4cSQO ;Ɇ7H6A8b< +y޹Iդ'ϙK 8l6HK#k>=i46jQA]MՕ̒C:2׻n5J+ +F횖@nm|3[Kkkߍ=s%4~#e5`=ON ^TG]f;Y:wq*,BpDјRnƽA)J$R Uspn_rtq檼IY\gFd괯k*ܷWSG֟7ߣ3:5dw0t ؇6ɉM, .bOoo?!u}w!+PKͤlCNY/_2aUE0ç)N$l  9դi(@ښ]YSj;i"|y0`@X㽴acoMiГ7Lգڌœ㦭\'x/-{>JhH5'Aۖwx N=6x^H[=X\E]Ҭ)[@e| ,+Q%C7# VS;}EWã5gۛns+%!edb'N1ïԣuK,T8Y| + +SR`5UQ i#1277z?5iB48; 8H#2H. @qEF%b~:>: +]eH 9-ҭ]5_mr7%&5;| ,qY&exkwp<^mjeՂ8*L͍aH' + +zԌlcphk THU yI2 /w^t+kYRyJ8OE3宷asmfbWL:ȞbKF,jܑTįGP6 cݾNFzw3{(vU rK,O2[NU̕31,m@ =3.9m*A%Cd 7wvn/Fh<͓0lY3Zfc2-X$k卅×}GߢݑEcX{|[f.㴔Iֆ$#xP+mWiB% %> b Ikv7km’`E塀s*bUdTX*7GJa[.Чp8DfZ03EƱvF9!n#85IjD,fʺ\`=(8nnѧYl^c/RʇꋫyYr'öS Qbҫ]iMJԙ[@6m@},.<檂5R$ZB-kԅ50)ͱAP=X|;xp7g 1 ,tZCbpEGgO v&MuSzB:j*L`n[oۊ޾ Tv0p\>KlS Ky6%Gm{8zTR +fkv\L ro#b}9OtˮM8'aV֤oOSQ|bYZSAu x{DueDXa7 +4NsHn5a>Z;nĂUp<՟h9N|5D[wtkAB8*3apB27T(l"Az?Zh νAy )Ә+Uo Dwpw3JD=5>vIv;| f*re\?%2څHJyj8P|Ock|o(_Xmލ{1^?g|R1ܛkS3SPU=U49brt +4]l$AA禊ﲥ7lN z}CЏUsKVv8N[&',DH o~-EP@88LED5噷mm!$AV>I_Q^z /Q&?[ jN],[jxح݈@ Kڼ P'1+踷ۈ`N$qduC_RFuG#<=rح|nd]H>`$}l7f{TVIl3w6>I<aUޓY/Eή:qytx؀/ tbYH:$.2`p*8Ze-Id ن<(?ˑO>p:7(ZK*[x=dz(%̗ 'III8;h]W A3ȑ?󿧬ŏc`TB#dusp[i}a{{O +Aд ('xOCBGID)nRT4[Ȱ s:;\.68HRH o޲qĐTڈR8#υX|y[(aY^p!ty%OD̊ o +ï18ƃOiOiܘ_Xr4xW^&\;+Ldh0*XԐ{-:[WwJe!R&Ni +?QK%F`\;2MB؋OFAa_\Ⱦs\1U muj"xAg΄9?d׷x$M#0sM6y楑U*i#Y\3ݶ +A=kWuNMx-Q(p0neʳ4n a|hjxNWy +&¡}%!Wސ3l qy mCRljOA⃙نd ^aC0YiñJ-PCN7Řlg-U]<梭S`Fw.'%O+vV4Jy3sQxK!j꿗F\؊²Ii!  vyZw)gX3pd4([ns\a.uߢWP1nE%h)&,QebͶ;׷-v襒04OZkq;x;Pن +d7\2Ԭ?xc-1MS RmS_V[]fBݥ#8'lhzoIq ڝ=d!4C٣ _ A)j*WMڝ$F1P9GVLտs߹A* +=(XFyyeIP@<)STfS^?Q0zU̦8B U@X@P)N[ \1E{a564p'ș(t9xH#\U$^_ZYZ"@M 7lm8lc_>u"n朥S =U0a顒O$x͒pAr =*]$5`7])j'n>9ޓ}3^ Gu.LpUc5T0Q"RNv+ijH$'@KS&veY.XnA"''C>7,U( l)@FL P3F1^ao ULۼbfi{ k~ jy-@py…?j6kfu(pz” '!3u'eViA%VNTӕ;}:߁rLST'O/j ~+Q2x}i/}2uGl-27A6jV#9Yky}| ЮχBE ?Xd/Fgckp@<o6(%8\W 0 TUsEb..Q5*,đ'Mkm@$5:"yAv2d]R(RfZ7`xabnXJR"=ԭh:+:3):q&- +{Sy7N\!RI"w,u6[hK?~C|ۼwwhsH?<=TM}A݄PJX{upZrg'7S&Z!géRc m8bqN~X)]_L + /xmF!J p9[)LY;3u 9~>l4eP[Ca`/5z~ϵG%NQ*6$u5݌G$h #  ]edY2Y;A#:gQR?AYESM2a 1Q(鿱n1x$( I 8z]s>%u+*`Ztظs>}ʩ4Ӵ73j$v֖a)if\ bBqNʹjrϫ>UdW|mWDQ_ir,{Yfl:#q<m؞g%[ |>1V1Ëu8b4 +]}MŊ+R#O@æ~ [! $Id}Q}hJgG(ÖiGZ&j6;o+Jc+`ʧq='lۆ%p'd@0z# 2ZI(: +\<ÓsNӥ~CVYrXQCh %6=Გު + e*b USUs&MӞSTwosfoPbmuVs0 [RE `ߔf.(ujPƒOo|P~m6cN1h/[xٞ\{U`]%ypPCudq†.˖N)% +lN"ʔI +N7+og m3)xR斴GM5c x\QN96١E,c@~΀:V`dD[~N`&W.Kվ-KZJkFm x9m$YgIl 6<*s&6é b,N‚T5eIİ\?cX%&-' 2y Fi,:;)t?P:]$Sd|u "/Xj/7-\ˌeJ>M~|&^L3dyH6uX8Sv%;d6PmA`r%DvIuCj'!CdQ WxDzA-QRT,5uTyP1:}x,[ yPvF'6y*,[`|^R3O*1ao)]"AcJ|8gFspmBxlZ彪f V5'F>]D*`L)KyOa_`^w0A $pbwoNjmTz0".l6?!rU bqFd  ܓrG&ƷvᬿuT#mI5}Yt8Cʁ,fMwPKrYOLJYFTJ3eNԼGN}ʽ99635,AIFTYuЂ{EIϭ÷*XXjf^tUe +($(FUHt9a+l͊Rಾ +>P4+m`kqc[D4ƕ'0~f%6.cV&owq\sxw#{h͛#΂jg%:9U10Ms"i`H!͐ңh2%?J0^3\MzOC69SES2lif.̎(ɘLhm$o{Nognfyzb4Uux\` +JZv;FTў~4Msf``Fv +$eeLOu) ~ZSϐԛwm88CwM(5*R.f6Z{VÆi5F%UqK2偬icv6BKu0 -"͑`]W(zzpU3L?D4]$ʶ`\2gqhh U +ݙ 6l&PrWN:1#u=13vZ|YJrL_yݘl"Rw;*K{ +n0^<6CJ{es8+Ӭ?&!BU\ob)$lE$2)6q{ٞnB-X"@:Q_i/\1-H4oz#Q-%WJ:#%&[TD1fX^6R}$Hmq$*1dEyw[,.Pdq4aH]61fj~B^t~\IUNmWZ\>bclnE_ǏeyU(uI$c> Z=e䬷cW\tG;=# ;*9Θ-+遢(Mg.4>; ̓=+Gz>6U=)Jqz%=zWsJ2EO*zj"]d{.@ nnNǷ?3˝*`Efe\ktL 'D ]ºMj: CPs SSCWGQ(䧐ӽ=@0#pTkF8(=5;[QQlPA"im׫~g< =t(ipq%*D]DU1TH%&d2I)#k}o&zʺZd<6]kY3P, 2< ,&}$cJ?tuOx m]v͛( ЄA&825DhG3Nҫ)=/$ F& $$pnޝ1f+X9m-6c˹ :dr'MHx՗ڻ]ݩ*3u' $ni=dTR$p숛RG7G# {g)R"2ؼF*ٶWZVO×2G%J,>86$1Q# + +b [o&[flh>-6&ob9/wjhQxq'Np_}IzuV'P«iJ4ZbvZ tu-[O9-PR\)>%ZO&W؞d9ZKE!@[1V8{E>"7'Y~a+=BWR+2WAPTmA*W9ͲT5;8Hzjv&ݧpTIA:OѬKaúd/3a1yt )*h}ױ#K$D@'hc_^!Q@ p1W^/9c +yjQk#o.2O&G@@7Ur\$ 0)6agcu|)5 #`3׍9GӯOgN:_RaYf +Z&\3$faIzWSb|d )Uw >тN$uq<}[D :~[I%Ğ-~%ovg&ФL`D*EڱaAP10( ȵ2ᨭ ^J +k#Eͮyxh.6SF"ePzcyz\Q3Q_3Tj*@d-.WB-?9Úҝ)%*PGE;λ- J5) LA/ }Msww`b݇|HF"[({x.YeD@(w=2bvZ!8mJ~(:NXqHru5}0,"Fه?[VذJlOISP)v.7$ǡN0LS>LO>{_bbU-+Tl+&`q#=k,sjm3>#ޭmYtJ;ŒGNr.++MEd󎡝 :f$$7֦R? OXfz:)vAnH+؅hq`lkyi+8{ L_7\Ҍ;u53"R%iM$RWTbQ}WB@x*hxOA6SqS$tC#r/N2NKPiq|R:O$+Ec߿ PpTIQNf]_EJ)6H 灾ku*7*iץ:4Fv.j.'h# A j5rVQz"b?1#0V`t[Og[۴ sJ#@(49zbtg͓GTP;Fa۔ݦč٭-84Gn2d @읛DHFKm%oPy5 xJ􉔳G2YMJlO#3cE}o}nf FN$Ltz(a礞ڟ/Ǫ\Սhꊚz*bR.e;yvJej N>wjחRƦ@I8;{g|ќprNO +^8[ճ/QVkZX`8[5zJ/.~+S^2 cѢ3 fLovf 8GY$%FBjM}l#qu tD|*$~ѵ6Q +Bd8qᲆl} gZ(dUZ'5T%, 4!US, H@*~9epL%Cǀƃv{Õ4j+jI|"<Jx2>Exd0fZIRa;x$Yۨ|nAЗa32P3=˃ABRN"J}H2S豜F|? ո ^Cq#I(.=xM(rAɸD:zUdӿnEG(k=moɎ^˟W_ ߎ,jc(m:; tG_*EDE6U}l:'wșf5J` jd3(ooڴqڕu7Ʃ)aT#7K/mƲJ@[_Vs*",ؽCXv ڛ[]G r\`#u'>Z1iUVb~{qIuTLf 0RD3MOB ++D [s¤ ~}UQ&H8 +gbm2(9}3̐#Yc&}6,f,[kH;ݮ/pѧ[bmďPc:AU%s Ĉ{}I;Yl$qُʭr G΃r=)3Ur^ihisZP*)̯S@Y5PiM;kSr;2фSdf`tԢ0GZ8ǝV'*p֒Zi2씢U\7EMϭp_ƍbaNTI#D@. +5K2XHF1ƀvc$wd =~ʏӫtQ4+UOk7/\x{)ǬkwDKًJxҙ"S$ߞel;̘v-'c$23KZJHkؔ& +0|.1)9Ti+ tQI'+.O@W*<E=V""%*VnCy,-rvd靜#9sniV)IҮ6sTu & fM"%Gͥb}~1M\ =!VH.o[΄O=ʯԵZtxR"I2Jn/pͽP82#=TYgl?! Tȏ7zZ x@Zc=hrәP-L 2cc46K3pX`I"zTh8lhzͅ=@H:h!N)GUV!W JcwjE(b.ˋ&2ݪ +2>…jd181÷;k|rCjyU}T|FIfDB\[G!X:$€0DJ3[(?l@^"`0$ICtf/[My$ZFvIѣxIY PM#wE(lL{if\wyRd03=8N\՟9W]Sbm>K. +|.h!cjjH%.Mɿ;%Z6@$Ǖ5Yxu`:II8c$(`KԮoa1th.Fj{l2ܳ6&_0T?*{sSz2^s~W񼽙q VLj+,,]~7nUiᢐ +Q"z= zD}LK +,:}%m )?hjm{/{iԥ@W;jymk.6`pK=*T#0G2ѷ^܂n\LO% vR041 k&bA U"ark[N8m#BR+s7LմhfK;KK dLdNOCjHn;-cQ&/;EQAb&f3+meZ*ÃbK-߷YRaA1E)opJNb2T S<ԻXC۠Ņ;o mDufCYhel]Gu*l*ƚvkQ aB_L0S\3 +O3 au%MTiiXOuMIEf + + rnil FKmiNY#~^mSCQnNeܲ82_K@6DuW<*wP:3M7֡ O3!@_yvB~sۺP.6uPD];Tu7ӥ,INį![ݻǂ0~&^\@2>4ޫzg6GYw)`Td8zw5~hrBpܧQڜ/.4O4u) +- jG{Af%)m+ a4 ˷G0r + 0?JEu*5y?9:Ta'C @v:MD@I,6j5ٙgQef ${N{+ScRQ6ȴ0A gSY_e(ݾH!!@eZɃf2.&-wF{oAyYQ1*k𬙂7NzfA=oNp򐈋Vyr$X؍P66(s‰mrL; +'FȕM9?y'ÞR0GeR* raqu )O8FViq=tc/u9 Pa^p\>D|m$5%Vvd69=ne*HI$&jW]UN~䉜q>`T9MRL2?pDM6't[) +#7fJ\$Dp*Ot8R4u\4,nP f$iȏnЬK;3bQ:HوG葉n6&ܩI$A}ULƱhSRMbPs4]$pV$bIɃ"ܿ4pF& =-}nn[|-Rx =b8>d-%xfiij +"i7\7oԑA׋\ϪIvPx70G\3=v-b2 +1J^ +3]3AI Y5AI;2 ??dyV,ӃSu%c8X1jzÎ[\uj'pq~2'lQMz̹{(v dZVYy&HªsP pWdMd# OžqּJ|7çΊ_ȨWbRkOm Ht2(ڋv"Yz6KI;AeY݄KHp1ej#\GSI_KO;7,Yl no-nRd8$yVH3Y%/B W/f6Wb@#@7߼H%' AjE=--^`**`I(Jy(UHV.s[##i>@L=๴mj HQz}+aO5f%TP_QP4mj\,=5Pzi`:fx'ƣ.}E8F*A%n,s 9{&|6s9C} )).4aS0 .}i 3ѳzQK4481_I , jlHGCL[-O,I8vs,?QV2XeK}P i&gRW(R CGGj,I勒nO' kUn/ę1pJx +w<[=ԵZ{z*3LmpM Y#ՖF:qCV4Xv9]VLP>dmeca`,9 ^f +@<Po]j{rJ@S?^zsYrNURܬL +.y)8U`ʘ+R4BݕVR-n'NJĴR">Ǖ:$}QLަR_SD]GRZ~ĮMwVĒ(Dt]ܭ-`SrBt;:;O^DW"aއX4#u3458k2U4b[Vݬ%&Q€pFb5+̓{ d/'V%v$&5;x_~6^>2I3T~ |*: uPAos8ܛn)(J`:0^,uO$ 8u/:'(źc[UaUQ2S'2Uy_knCnY9tҜ$niFO'6F\&1 +Y!PvCww] {"okvyyjuia0c 7V [AzГQ%zvYqlt<"S&P]l}o{ZWԢJN 二rHZ:cMV{kFD{%30:Yf6I;iC +[~3 +$iΊܐA +.X^;cuw1bφct h GdH)>t΢RZ=H+0w>\`ELJn^!cemO֚&UkVfQ粰?_:N4C'f^9F Չ؜<  xNfu*H*"I&n:UbtX6Ml33b&q*Til$FםֶS& e ic7pHjY\ilc͔-OD󏗞0Pȃp7&Ǥywu)a$AhOzm5RYޮ[t&HωnP5d-b,rt{2in JTV$+L؟ҥ6Y. ++6A=L]V_ ZL+_vZ%RHJgsIu!)J8m'pF o[vͦB@u fF8;!x(_2:zwd[ܵfkbxV;4-=6ob 2䕯BÇ} ^`9Pq\6o%R(XhS4Wt`~Np5FZZI D 1=oNUdy(Pq pROXCL/1JIg9'Y;#p}tnsCbKRH# I'm [͑~In!Ԭ` &6Eޛ:y]3Vr0 8-bTAD,fy`O*<.69m QóP-7I+Ksrphduu"8"5;5R0RcK+f9fDC8 8p6}kfRd*U zH_\.bwubU3E +!qJ3h"ah7odR c5\3(Ɣu6#Y¯<]eNbby[e"E'ggiLa,nX[^&V@ӻLJUc9uY[j23h Ui瑁EΗ$=0ȷQI#]Ɖ͙79a ٖ?ǗB5)R{T P}j2T; >*sc~҂zjt" LSFΈ$7T\更:p4rAZ|ﳻwG^FTYrD3~Ntti4nkw6 g +mY4іq1YE4_5UTC!Oxە,ۈa4RY%mC l ;ik,}qtxm H]#ٯfK N"Y sr&EM4TQ=q ZqM'uxg&c 4Fja+iTI1+:iҧ1Ը%Lr=@05K_*LS-QPdǢpvl{jQ}&,=|^ O*XRZ|Z**| 2O#[)"|8Ets)jyS3|ԬGW͆hu"3j-Nje/H,`Ŷy6ge0~UܿconԷJ@;1Oh"m1RǖF_Ds%%4o +.'if4u+'{#dT]%`SSa#Si{됃 cg5@r5LuV%%*QWSC{ +@u^Evg+PuH N;cw݇\\&A $E.ur {5 < # +L¥wE;^($0>a0*lqt0O$sFm8nfy̩S(P #oX(XC̹dE%_U +e#,ݦpᑅϹA7&1,Q+Ԯ)0gb@p({7k,f +dH; Ԏg3RJ+LB "jzP! +c{{p-,nI~(A(3`y[yvdRENGYG3>k`ab"!7fd]Tp弪l 7momo @UW_C}YtO1*;̑a_/1hJhܖ-`@:lH7<VҌLlW87.RB"Nƫ!eEco<6Xv -G:H* $ A5dln[2ZT8D{DKL%BV I'z+ضG,IZ:g5! FAQF-K0y䠅ĝtAnu]qIr/ӜFC6B,e$۵{(:(E6n9"x <*<Ԓ\m|x]̋v8=Xn"E\> 8)59({nT)j* }dO(gN8fv< bs?σT"+Mmo\xT6SGQ^𼦯1"iK8$؅&IĨl5+G4$ B7nKeҝ"eG3eWq48:fʜV9ХZ=%Ȭvl=0R6nYtæ, +NqiæxmhsJ b[)a~5k14ڔ v~>CMW^ v|p_apWIbM)Cm`Lڳ hsRc;m[XIێ/Z=|$g gV'ͷo}F4ruLr>9MRN#&2.̢Aa.,jJ֛@4bE-$"LM=ױ=qOXХ+ԚRSNk\|5|(*jKl韪\=,䒞"w;PwA1[NM&: !+GOi[夰&$mjZ+#Ȫ : {qi.Hid\^;jnHͳ-)G[AOLcuw^^j%83#[EWUR( qK[JZYN s7YZ MDk[k+e2V@h6L>M(qjzDI"Qw#j0chQ:rVUpjǡ"IcW(jD{F Mׂ3堐*"gU{ĜRG#ʝnXq|7 +# Nb i෰{<2v@%.(NE#CK[|ً $L"MHPf%[XMSCQҩM9n:.|mmy9k.W|y!K͝<*D{O +k'υ(zIrLVCG(9$QԆ_,nvKR,#of=c cI4U̹A&ι,>ʔS: +YGgMv&]eoJS`uy̩Xa6DhF돮Mʹ:T]#[=fim@Eozݸ}~`ڗjܸbA>΅=n6Qh%@2DDaLxf#O6Ś14>fj<":W"XK&H, { lBTD1No(#? + #&7e:تVڊ"Hиа;@#xKx[;ކh#iU{^ 5e<^2TG%3,iYIlX|4kٻڶʓIvBbk{df4ݓ:ggI\:l[y35.[-LXn#^F{x#h# ]qARDQIL۩tX}q0Zֺ11=˰8/3fHڭi*1Bbʯ.?+ҡU=Ejym`bءejd}NF P9V|эK܅EQ'#6cNEsɵlF߉7S<@)P>T8,SNdέSaM]R +ڄ#S}"xW-kU6%[7)&{֓}p+iS/I#,''#'OVC$OT Em9 {&ows8eX. d\)54L"=6Q=E)ӦuX-Zhp +F@VbI$~f&]{R AGJdfhz+YPS^ssN#ōO,Q8 +!A`ěh;.CHeOv49uA߲B@Vd?0PӚu EٛV:X(+K\ ! `@5nEw)Џy~&=#a.)u'rg6z9jqH 55Z +h9$YM;n]ZC2FuyV<^dL1E +5el{|rgi ( w.ryzYVxp4y:Q 8(#4 Y +ɹo +11Y5Yr˵8&zM/arB4Na7g,HᒑMNkƃjkRH]ޠ6S7k>O??>O$ƪjYpde)Ğ$?mST 9KBIH)ֻlJVM%TIƕ~-UUp؁?hیxw+/cKu'630 f |#Onym%F|˲RHP'sZ-o4#L 16dž'%QFx4L)gۊ;Dmcp6ubBxk +KE8unPi~PUvu(VQI/lŧ,Bt BP* ru&+DQp4H.ez骩0 em4,s<-#lԨ+;EJ0' Exj*mLz֐yg0UES遾&V6i5A7$.FFۭ]p;V+x1x_裫]7_/:Z3&xZav&KAEbN'gUB}`kq:'N>}5^2vf9.9Rg|8DHLon[Qkqout<:hі2'g8Ӟc>Z³iflA'xI׸`^S4;q5G +zSW^򗍘|9g39Xe8$L`R컍 \#TcO1 +NJ,H!obp.qTxIϯ+0poP +ϥxdpq>]'S-EGʓVU, |~9P5FR&kս^޺&8bUHŴ=Zt41d!`zPWȟ=Ef6kyw^56aJ,^ +Ĉ#ƪ738;G~H [Z +ŖW..1$u$Y]ֱ毗pTQ'V˔ E4J wpEOAҲQpJJQNCg72z* n3GDTR$:$0{m~#kICzB°"p&,7RKs "5u6XƳl'ZNl[KQK5-V-R bVh)ܠ!]+^W:.R0 g<6c?>ZŎw0|!#06>>>b!6UCb㚖\>ɒ9 + +O{ uk} H_wE; - w <m̅Sۮίubx}we{H>̫,c8nfzˇ +Nb(}'b2hr-a(,g|:Zl!)T:Dzj $I=;  `vn,^;D斝xlW^)ӈ,l2``:7A3q/Z8d(7W*(:MO_IQ(\5i >KQ1MV]yLJ!챣{5n;t/HCfW|bߣٷ}UigN*v= xI2icSbb3aLI>KʼZ8a&PJ@k7;jٕ xL tBJvG aƩYD;i#=Z d8N:1 +ZS`OSSw&QĎcha;}/{^y[y tRn{z/Z^2)w%iRJy2Xܸ"綜Y!լ84JL߅1Of:ĨFI$2n +*>wi=h)$(zmꗥ 2Rﭝ6(M~1UI !]鳹~w3!zOGWa@̮oJGJEEn|k2O1E}N `H7`ŒĶSCoE5X[OT*^d,_&J8#8w'~_ +4)'J`VL. h&6S,M X le!N})}g0@OgkvM!d=arP icR"*)hȷo쌆!zi oSx5bEV &_)p\a~i+k #;w #[i; +SI)le"`EO3K$2ͺ;]ܐws4] fdQG8BNkM.`%8-$p͛% +pPYًYvNo(ʇS[L/"CKXy u:w6mZB69 OjKWoeCjoƚZԑ)>lƱ|Aj c mu169PJtK?CK^@Tzz/j\Յ4u_/([*"pm|xN)-p Ae}Vd&.)gGQlomp3ݧy&$l6 v:?ь,mC9ܸF$ܰkٯ+n +JO5u us(Qlc{;e[ ښO8JU8PYVay/Z=\X׿k —e!ƻƪ-T،ĴOPs5+UR@Jy#J.bTTm%-Usp{G{^bTcIQi{T~S+[~~7G:gQ;*2 G%6[zv"$ל.%AlpnOQNS>,[o4iN4(:i xeV/T n kڵS._JHke84Ӻ̭S%Q8g Xi+ChYN㹕@mi +Tf2M?!qOK2 _d,!IP8az5_-kżaXL "^>Erք9݀H|b%g)(۷~bډ0iD&$~T]@gـ;=*# #m 7G ]ɐ5 'M g[#N8Vkƨ[͒Y=<1kx"8ݒ&h^ xQE_p[$as`:()XH.S( +\ýps%I[|CMu@P]K@X}M^ub2eði#0OJ6%b8`0}jD HHHӮ, :W|1ՋV!x+QYV=,j/,(.}5O鵹BD8qJ/4&қ*MY{mf @?Bֲkګ0RӇfy5rG[NڅFFhB.9|M%ip) tVXֵghNo%mp|46# orR3 =+wbqVFcу3PG.[vE]Z,gDŋUd,'5ii//x1AKz'<q̷ɋeSr/M7X_w\dA"UnL<[~sϛ11UKLT+=$q ̠"#v䇺{/в5c|&{Hkc%T3' ycJ_tvO9g>t#%e9%W-`{1vaQي{ފ*V]p(ĞX>e|<:5aY:[M="f{9i*tP)nUȵf+GIjqIjѰYiWB8x~1>+T. T>q _nKSa)YBZy'h\9X%[Znh)uQHVN2;Mo~}i;c/OnaO|7y t5{t15N9sC.IuZZ| !Аt#7.$m<+i\e4 -?VV=ɥF LV/'9aՄtr UIZnNTG?Qu=9($(%X޺)[xrBAJ򬤶܁39__Z.vũ; Ie% : ׷~]һZK<"||ÏQeM$MwKfuÁf;Y}h.a=ze1ưl#&ɉQWIOF8A +Ԯ8UZCuMigKU" +Ē=7sn5+J"=NzGy*]G8UUB4VAJcY:KҐTѴPK}lPμWz<kWA/N1Nq,.U&cmYUmۼ]J +fmRNjr[pKtb8c&[QK 1x "QUTH¸gf^z6lI(qF8G| "jCǃnϭ݈gŲ08Ѓ%)n 鯤ϬOzm6s, dľ#(|v؝t7>EbxN] >˟ƏF~: qIuK 0Yr<-O,`扶&7+[M5eK$Θ5Z92M}/*L:ĝ6sku7Ǟo1tf &D4F:<ӺeŢ"9 +EV` iQ;7 :|iHpVzERK +:䬿MA*0RGm)WS)Q'CgnZ (g֌aL;i :4PVPx7 +lҎ=GʟS&|ɏ>l Ea^Tmt[W:'\j +qqOTf ++F)0j %(; qC:)0T|%5?/)EmtR_kY6e3N'.9H7@} ? by7RF ^.GpTGi@D4%C׬")B;G +IhŤ)¹U笗u0XX]R偵rʹR)+dcINgJ<,el6:P鹛yKPaC<SK1* +"QS#d(sqx%"5L&kd0,C%I=Q ױ&MXT(˙B8|GpfꞄѡ K9* +{^.]ViSCw=t7cV )Eo6QIM3*:*mn^Z m ;"kġQ%DȞJ.y~"2K| j1VE,`0i!7jӃm1qve5 {)~v=kpD$lNΝ슝:B3\/H05j/oXTlC)1.+Hta9w.Y&e$(R-gG\Te'_!W;[^7:ҷ޿tD$el6̯#]urXK 8l8Sf:1X')X>`zv~L1G_'묞W רJSi%Ms=&V +QRV +#aW#~3 T&*h:p, e5XKӰxe$7Vnun#E>IW{tMR+ Zhc5C"ڝ@{rͭVl~wP{ɧ_HN0b0$`75 P1 RXZou$ o<.:OY=` o>ChEWeYZ0[%J0Ҩ62X (:Ĝ} h+@;1!x?-el^ 1 +Y[%u) %t$nebV'y>je43^Y.PO`fXF it$m>VYR[m8wXF]sYu86*ȊĤN~犵ZaȌF8me(W+E<O1LZ) +KYM =3%`tבXojT6]wPZê&0*~P=0Ǫ>rw>M,1yRYؓ{IƲof6$޺%nn$ +gs sT)K±8FI7Qm |ySb0-^b)gN  bJOZ(iF-ڔl1I OSK_"5.i$=o7yàqKqٍgr969i#d + '{NxܯAV5䲔e4aE̕8P$k_u<[ ׉NPX^yU4"e2ݹRI xq}N[Z:դ(b7]MIQBT+ʇ!fD Kv+#VmN*In>174ލ:]djjp%F5qMP^N$Trx%ɕ۴ztIQFeeJq08'RlW(og 1JtCpavwmmtBJ' ,*lpz?GEAa4c+Q1ڞ Wƪ%UJ0Zxԑd4yfɜ5)JzFI7{rGŶLl pny .ZYRY +P: x3`|uR>񼳅řV6dU_vzX/EA[kTgK/S?'goo;U9y6zQ<0 n?ziMO8w 1FD"S"1[wr7"Z }f'IhócFiA"1, #MBKp3;gOI&w풂?U=Dt/M3ETU玜SUawzE ~Aa܎ֱWv}+LI{O9 (Tv`=ݢYٺ +&PqLRV1_(Bu6I\Uo]#Q(k6eyZO u&F(PR|G"E԰VP+-rO ^óT="%E8C,lK2y @댡  ت+I 1R?ъ\# \>jUb|H akq{S/Z#d%q_"|ne+ηt\%0 L&N)=UbMsLӅŏ`jO>j8d$hd+FRH:JL8b*8 "0;zFg| dD+4;ao9Qq^#3H&D~Rk%oZ,Uj䥌H#y)YXJۉ\ɜmѥ2}օyO,p$LI`F-YA`4cyz1$m7H8l +GFio! +Q'vQ6]A+ct؝# + OD~>nWB㄃Z HnJEz]szϊf< +8 kCI5MDYJ,xvrT. q=5f2*j JM.F>%@&@Ž2lᩎ +=Td2M@᩟3LVZ9 *GΒ<n`-;n:t5l)C> *6\X*U {ZO eKpSFn+AXq,{k0[F +j\oc7yBP a:A"jn+t.-YOIj7 yh6jt81I떈`*ʄO^EwBV ũ 5n! + +MiCyg-J cAl= i4㞘*qaèDfRv,-޴: 7B76(q^{)`)&4J͑@PnOcWU)1yy`*Is…|Jc?Rf̽Ê4P]-K/UIR|x.sF!&xMO$Fi#[!-rmn*TP hG8QsgD6ݻ3o/S>1eW^{i<3C_]AKT|ŏ]#R$ j>'(6Z@$cΚy27DjRpc6C&5`uX GT3oK'n%ocN~h^Bh>q@쓲-8Q VȘ?_uԾf`R +S ҥbJtbwNdF^ X*sƷi +3bóaqjWpČ "_ g:mEzK%(M+ENлu;5|`V$KMw2AVĈѓ m[BbT f.\֖Y}Xdĥ+4m,B,5Macuu`_`6RNIc̥$ #g7c 3oT3`x3 fGaiZx ۬#+P#>Dq֙ܳʊ"T.'A}h7 ve0‘4F]9 9Yfn1 %'Ԏ:*8G(Q +tm +ҟΩo;Jڿ6T'/ i*^"&ۙo¬(9#d‚Z">z 7CR3,Ez\ƿ落(^B W#as#t:e6.Rk&9\DٶP.TI3] -YOhpJH^^:1w% {ɘ%,U2QӴ[&pj#e6IK+5$C.kk @{ Oeԇ[h"b+((W¿5}P̴2xT1X ~Z +2{+(q!OR/Z"K'Kh'3Hds!q]IpG…q &p&H̙36a-Լ_*SAbXV"|R֏+cȱN)t6 '正JI)#cЎ_DؼX5MnszGFPMK*؁mDZY|7+Я=kwyjB׫go&Vu]mPqh1Zh +%b +l1@c@UaAdSb(=m#O;WFx,,J'(4koUP}xyC`,ee2 c/EK +wYYPa!Nb#17`/*nҌVD%\KWxģn} Fwwq][i4]nLLm_Oɧ2˶kg:1Aɍ=3e._U՝YƙLK~*'HeٲG>@ꑆXKP)"cHMf/cATRC6v5}\]oSWwEn;Fߍ9a)=O΄\l胤GJKOtAS]!ItВno[3잺;jˆt114~f CNVh%br1`6dciP>Tt;ɘD\@rL +Hp>*9#B|f])bdD +FZ%CrB8FÚe9>Ymb%E@Nl&zDK⹧&g,C[VQ2J)Ls)L&"wyRVZq:Rv"6b Z)SlVu1)PLcejne5IB0W r`$Ivb>+{1RTH(l_D&J/'#b91P ЬpM~0sWx~l!L=IId73H|6I_Cn#M6?^;;tVWE:ESC-jLJU/ 1mզ*TpўJkXl'a)(u*{Eg ]r461E'eTH ,qkqf_PT[\" K}Gê.%[r2zr# !ܛ~ u[$ Hzi ޔPԘFof_tNOwv+(HA`3Bz{.Qt Aj'[ڠer +z]KP +z|-^_xF1R1` 42 Hֿ8ڸoJAM<ʂAOž8]\|!Xy>_}1+hMQ8V .W@ˤ+ĭx̮M7W8J3L͋ Qb 5>%AWFY%Q}p9u(t3\Vҡҕ8^_/Yap:O KQ#7õ߄-`Ձg^wp3ˆO]:Yi}@d|p +:I6<j19gnQJ dY2.DR0#+ nAzHRHP2fΧ˳`5Y{-"M]>O[UKT<'1]t*i**cP P+a=/BRO΅c(*6!naZi]F({0{es0J ( 0Iŷw +!% i@8‹VJg FG%}#gQTQP"=(oFz7AA1Yz*6ICLX2V[%f~0?S"sN26Om. MS,X~X:uEdb AW{omgj*M^ r'O@./3n&0[(+!Þ;ʸ)%2Y5bF̡/ vg ”13˭4}:KV`U-Dx^$K(+bC2$;՞]!Yh 2T O[zo^YQ):d o3U,ňsOeZjjZX&icx<+.u'ؖUgempN%ARHDLdDnRY諾(3sVUF.aBfz+`yoѨ~طqhVHd`D0G$zbÞ̆ Vel;Z7&\c<[p0!BN + +sS!xk"J4Ro)/r ‚Bk2C ҥ =)і%w&9srZ,4h2Rnh)$۽\[dRBT!@ F1 C1+[ڴF{Wz{ҚLFvXc-%.%66\)~[ GYဇ56A}ꃫ]vG0Ν͂gOM&.Gwi*k*cXYRʬ\ߗ˛E$R8q thƧ#NjTdOy#wdy7# `y/ip9yk|d)Zp(Kz.e˹{/b;?Q@<\:}6tg2t-o<](4"hRG= +ǰG.6%5,r6I u;SmT[1F*;o.:1wܥ:S$ԏT2UfS3q*>ZTZihI5VI"!oAtcr`X|R5$O;,냣 ;5d{)!'FJ1'oHF#ICDŚ5eVRbmn;SIcteޡ7)*ǣ +KNJ#5+˭G_MÎf2'AQ^(xvi(ijyC]bwmͪI> endobj xref +0 23 +0000000003 65535 f +0000000016 00000 n +0000016265 00000 n +0000000004 00001 f +0000000005 00000 f +0000000006 00001 f +0000000008 00001 f +0000016316 00000 n +0000000009 00001 f +0000000011 00001 f +0000017534 00000 n +0000000012 00001 f +0000000000 00001 f +0000064834 00000 n +0000017758 00000 n +0000018156 00000 n +0000064716 00000 n +0000017647 00000 n +0000016666 00000 n +0000133054 00000 n +0000018810 00000 n +0000018423 00000 n +0000000113 00000 n +trailer +<<2F906DFFBCE6D040877907067CF14093>]>> +startxref +133230 +%%EOF diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-523-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-523-patched new file mode 100644 index 000000000..6f1b5c838 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-523-patched @@ -0,0 +1,1506 @@ +%PDF-1.7 % +1 0 obj <>/Metadata 31 0 R/Pages 2 0 R/Type/Catalog>> endobj 31 0 obj <>stream + + + + + uuid:7bb34414-aa43-43e4-b5e0-bda0b2b10220 + adobe:docid:indd:a5afd9b5-ab2e-11e0-8bdb-9544086fefb6 + proof:pdf + + + + ReferenceStream + 180.00 + 180.00 + Inches + + uuid:7CECFCBEBBACE011841685AA9CCA09F5 + uuid:C377191EB9ACE011841685AA9CCA09F5 + + + + + + + 2011-07-12T12:26:34-07:00 + 2011-07-12T12:26:34-07:00 + 2011-07-12T12:26:34-07:00 + Adobe InDesign CS3 (5.0.4) + + + + JPEG + 256 + 256 + /9j/4AAQSkZJRgABAgEASABIAAD/7QAsUGhvdG9zaG9wIDMuMAA4QklNA+0AAAAAABAASAAAAAEA AQBIAAAAAQAB/+4AE0Fkb2JlAGQAAAAAAQUAAgag/9sAhAAKBwcHBwcKBwcKDgkJCQ4RDAsLDBEU EBAQEBAUEQ8RERERDxERFxoaGhcRHyEhISEfKy0tLSsyMjIyMjIyMjIyAQsJCQ4MDh8XFx8rIh0i KzIrKysrMjIyMjIyMjIyMjIyMjIyMjI+Pj4+PjJAQEBAQEBAQEBAQEBAQEBAQEBAQED/wAARCAEA AMYDAREAAhEBAxEB/8QBogAAAAcBAQEBAQAAAAAAAAAABAUDAgYBAAcICQoLAQACAgMBAQEBAQAA AAAAAAABAAIDBAUGBwgJCgsQAAIBAwMCBAIGBwMEAgYCcwECAxEEAAUhEjFBUQYTYSJxgRQykaEH FbFCI8FS0eEzFmLwJHKC8SVDNFOSorJjc8I1RCeTo7M2F1RkdMPS4ggmgwkKGBmElEVGpLRW01Uo GvLj88TU5PRldYWVpbXF1eX1ZnaGlqa2xtbm9jdHV2d3h5ent8fX5/c4SFhoeIiYqLjI2Oj4KTlJ WWl5iZmpucnZ6fkqOkpaanqKmqq6ytrq+hEAAgIBAgMFBQQFBgQIAwNtAQACEQMEIRIxQQVRE2Ei BnGBkTKhsfAUwdHhI0IVUmJy8TMkNEOCFpJTJaJjssIHc9I14kSDF1STCAkKGBkmNkUaJ2R0VTfy o7PDKCnT4/OElKS0xNTk9GV1hZWltcXV5fVGVmZ2hpamtsbW5vZHV2d3h5ent8fX5/c4SFhoeIiY qLjI2Oj4OUlZaXmJmam5ydnp+So6SlpqeoqaqrrK2ur6/9oADAMBAAIRAxEAPwCbeU/KflW58q6L cXGi6fNNNp9rJJJJaws7u0MbMzM0ZJJJ3OKpt/gzyf8A9WHTf+kOD/qnirv8GeT/APqw6b/0hwf9 U8Vd/gzyf/1YdN/6Q4P+qeKu/wAGeT/+rDpv/SHB/wBU8Vd/gzyf/wBWHTf+kOD/AKp4q7/Bnk// AKsOm/8ASHB/1TxV3+DPJ/8A1YdN/wCkOD/qnirv8GeT/wDqw6b/ANIcH/VPFXf4M8n/APVh03/p Dg/6p4q7/Bnk/wD6sOm/9IcH/VPFXf4M8n/9WHTf+kOD/qnirv8ABnk//qw6b/0hwf8AVPFXf4M8 n/8AVh03/pDg/wCqeKu/wZ5P/wCrDpv/AEhwf9U8Vd/gzyf/ANWHTf8ApDg/6p4q7/Bnk/8A6sOm /wDSHB/1TxV3+DPJ/wD1YdN/6Q4P+qeKu/wZ5P8A+rDpv/SHB/1TxV3+DPJ//Vh03/pDg/6p4q7/ AAZ5P/6sOm/9IcH/AFTxV3+DPJ//AFYdN/6Q4P8Aqnirv8GeT/8Aqw6b/wBIcH/VPFXf4M8n/wDV h03/AKQ4P+qeKpTrPlPyrFqOgJFounok+oSRyqtrCA6Cwv5OLgR7jkimh7gYqm3kz/lD9B/7Ztn/ AMmI8VTrFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FUl13/jqeXP8A tpSf907UsVd5M/5Q/Qf+2bZ/8mI8VTrFXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYqpzzxW0 L3E7BIolLOx6ADEolIRFl5X5r/MC7uJntrBmghGwRTxZh4yMN9/5Rl2m0ks+52i62ebJnOx4Y/ex GPX9Qil9ZWAetarUHf8Ayga5lnszFW1sfysRuCbeheT/AD81yyWWqvyVqKsz/bQnpzPdff78wc+G eCVHl3tuHUzxy4Z8uheiZB2DsVdiqS67/wAdTy5/20pP+6dqWKu8mf8AKH6D/wBs2z/5MR4qnWKu xV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxVgn5la4bS2TTom3YerKPHeka/eCThx4vFyCPzcDX TM5DGPeXkbMzsWY1ZjUk9yc3oAAoJAoNYVVLed7aZZU/ZO48R3GV5sQywMSxyQE409z8lax+ldHQ O3OW2pGxPUoRWNj9G30ZowCLB5hu0WUzhR5jZkOFynYqkuu/8dTy5/20pP8AunalirvJn/KH6D/2 zbP/AJMR4qnWKuxV2KsS/MjzPqflPQ4NR0pYXmlu0t2E6ll4NHM5oFdN6xjFSWE+XvzS83azqUNo 8VkkJYGdwjLxjr8VGealfDJY48cqZ4cZySpnt35jvooFubeONoRIsZMlQxqDVio2AqPE5b4QBouV HRxBole/mZ4kWBwrXrKH9KMM60I61Xl37ZE4wE/k4k3/AAqEfmDW7y1e5tIIkEK1YP8At9qqS6+B yGWJjCwN+5hl08IJVF521swPLMLbkshQIiPVgKUZQXG3uTh0+MyFyDZj0cZHdfdefL2HT57pIo/U t4WZuQPEycSV71AqMsniiFyaOEIk2ws/nD5uAqYbID3ik6/8jsx7ddxI3RvzY8z32q2VjPDaenc3 EULsiOCFkdUNKynffBxI4nseSZuxV2KuxV4f5+vjd65cb1USsB8o/wB0v/EczezIWZS+DrInjzTl 8GL5sm12KuxV6N+Vd8wu3tSfhkjZaf5SEOv4E5p9bDhz+8MdOeHUEd4epZQ7B2KpLrv/AB1PLn/b Sk/7p2pYq7yZ/wAofoP/AGzbP/kxHiqdYq7FXYqwD85IWn8s2iJ1F/Gd/wDjDcd8jOQiGMjs8x8r zQ6Pqn1m9skuYnQoAw5BD15o1TQgKd98cWaIO5bNNMRmCTTOr3WbrVLX6o7Rxxxgux4Eqqjc/CtS ajb+mZGohxQ2dplxxEbj1Q1088V3LqP1hpjIpRZA7KKH46xpUqtVPTkcr8SINksISjAXJA22qXwh WKaiojNxKuQF5D4vhqe3XKY6+MTyaMevs7hZJcUZQSwMgJjFOo9qeGZoyirJc45I0F8lrHdwSRkE QyqFeZxXjQBzTqCxpt7ZTkzRnYi0amZnAxCS3flDUYbGK8MaNHPVkIZSw8QwqSMxSZAAnk6kwlVq Xl3TZYtf00lRyW6hLKPiIAkU1PhkRlshD6JzJbHYq7FXYq+fPMjFtVlZjUmp+9mzY9mf3R97q9Py PvKVZnNzsVdirMfy1YjXoKfzt+MUgOavtIfvItY/xiHxez5iOydiqS67/wAdTy5/20pP+6dqWKu8 mf8AKH6D/wBs2z/5MR4qnWKuxV2KsN/M9S/l+3CniReRkEEDpHN45j6s1Ae9hk5POPqHrQx3M0in 1TR0jpzJHYqD4ZgGZB2awmmj3l5p3JrYLbRSfCpdPUoPjHFC1dj3GZGHV5ICubkY88oijuFWGyWR 1iSaG3jUcSrnivJEXkRyp9tunh3zcYQBjDtYQ9HJCPOZKGLiQWP269hxIrSu2U4sMQCQN76owYog k0k+ui7iagnZraZljjYNQJ1DDZFO/wDDK80DdsdVjI3TrT7K30+aIzzPNCpApUlT1Hev45dixgxH Fs2Y8RMapm9vLLp3C3s2E8cwIiCjckbFVDrxp16V/Vhw4eGNS3aPBHBRHJI5bdbbzBaW/p8ZEmic kgFgWYE1Py6ZrM0BDMAOTgZqE6HJ6dmah2KuxV2KvAPNUBg1eZD+y7pv4q7DNh2Wf3ZHm6vBsZDz SbM9udirsVZt+WMBk1qKTshdj8hGw/W2artI3liPJrgL1MfIPYsxXZOxVJdd/wCOp5c/7aUn/dO1 LFXeTP8AlD9B/wC2bZ/8mI8VTrFXYq7FWF/mlJ6egWp8b1AK/wDGKc/wyjVRuDDILDza0uAHDc1W eM/APs1HUEvmCY0GA2TWCcOpa5YiJBTmoJoSdjWvXrlZItNnoq1nl0yNB/cTMZoyeIdWOxHJeNeo rm60hMcYifg7XRyAhRO/6FkKXDN6dtC0iRrypQMACKs5p271yP5mWONAE11Uanw41V+aG1N7UmBJ DQK5ZEcA1FPiqN9q7VzWHNPJIyLgZMkpStNNPht7u4KSs6Q8KvJwP7s12BHTfpXM7TaqWQiP2uZg 1eSdAc2pby6j+FZQV4mIGlAB9nbZafdmVqtUcUbq/NyM+cYt6W2M3qazaPMxkla4hPKm2zIBv7Zq TlOXKJF1GXKckrL17NkydirsVdiryD8zNMa31V7lV+CWkyn2YcX/AOGXMns/Jw5THvdbkHh6g/0m DZtmx2KuxV6t+V2mNDFNfOKcUES1/mciR/uAXNHnyeJmkfgjRDjySn8HoWQc92KpLrv/AB1PLn/b Sk/7p2pYq7yZ/wAofoP/AGzbP/kxHiqdYq7FXYqwP835Hj8tWxU9b6Pl7j0rg/wyvMLDGYsPKReF zEgAhqByYVPXcMevbwGYcsYa6ZXpmm3L23qMkTjcCVJAyU/arxagp75jSABY3RUrWS1lPorKJDaU Lp9n/JPp7Gq7dc2+j1Hoo/B2ek1Vx4epVpdQgjm/eyvCihYw/Jeap8Q6EjkKGmZUssI+m+jlyyRg KJCFn0ppx9c9c3UnHgWeMqNiw4ihanXr9OaOcuF0vETumltfXkSywWr+hFcH40BBoaUCk9xQkZdp NSMd7WHJ0+cQ5iwozRyyxjoObFRGpqqqPcmg6DHWaoSNR+llq84kaHJV0hm/SdpAyqaXEZqT0PME n8Mx8P1hxHrubZsdirsVdiqQecNB/TemERLyuIKtGO7qR8afT298BsEEcw42swHJGx9Q5PDby0ks 5jG4PGvwk9x/XN1ptRHNGxz6uNiyiYUMubEz0LSLnVLyKOGMvyYBVH7Tf0HfMPXarw48I+otOaZP pj9Re76Ppsek6fDYxnkYxV2/mc7s335q4ig7DBiGKAijsLY7FUl13/jqeXP+2lJ/3TtSxV3kz/lD 9B/7Ztn/AMmI8VTrFXYq7FWL+ftDvfMOl2un2LKjm7V3ZzRQoinFT9LDIyjxJEbYtY/lpE1oZUvx LJGSrVj/AHbOOytyYinSpH0ZCel82yWLgNdUDHp0tpcJaWt2YZbdgsnp8mHCu4cbL9BzBlcSRTjZ DvVKHme15lrWIqt5zBDqOIMG9WqKnfiKgdO+DHKt2AiQULokUFx6ywNIYo5C5TgZFK/EBV223O30 YmJO5bYEdSlhki024P1S4UwSSFZERgSKkdAre2WGJlHdiCLTpRPAfUNF9UD4n3BBoa0A965RwgWz gKBKLhR1DLdqVKGv7tgSd+Pv4daYkgc2cQJK9obU6rZNzX1mmiYDcsaug3NAMsgLlHZhMRB2er5s 0uxV2KuxV2Ksc1/yXputlplpbzvuxChkc+LLtv7jALibiaLi5tHGZ4gaLF4/yocTVeaER12IMjH/ AIAgD8cuOr1BFW0/lM5/iDNND8t6doUf+jLzmYUaZwK08FA2UZSBvbk4NLDDy596b4W92KuxVJdd /wCOp5c/7aUn/dO1LFXeTP8AlD9B/wC2bZ/8mI8VTrFXYq7FVG5to7pUWQAhGD0IqKgEe3jkoyMW ePIYXSXSaJLyK2tyLaDcpCsZ4gkdT+8APxb9MlDJw9G6Oqrciz3oSTyoZAw+sxpz3bjBQs/87Uk3 OYufD4k75ONnAyTsbMf13y9orRy6ZNrkdlP8AkDxcyq8U2CmQcagDocqGjIlfFt7mJiCAhdO0XRd KjeG08x2ojdSvB7csKFmbf8A0gVoGpkvyu/NBgCiLLynpWsWp0k6zBfmOIkCG34MDWnqt++atOQG I0oHIo8LdNf8BJGONndpbIv2FW3BAr9qv73euD8rfVfDrq3J5GkkZnN+paQAOWgJ3pRiv78Uqd8H 5IXzZxFUowfl1FbXkF1DfFRDMkzL6VS/AqeJb1O/HwyY01EG2ziFVTNMyGDsVdirsVdirG7rytqN xdTXCa7ewrLIzrEjsFQMSQq/vBsK0xVS/wAIan/1MV//AMG//VXFVay8saha3cNzJrl5cJEwZoZG Yq4H7LVkOKsjxV2KuxVJdd/46nlz/tpSf907UsVd5M/5Q/Qf+2bZ/wDJiPFU6xV2KuxV2KuxV2Kp ddaBo17O1zd2cU00lOTsKk0AUfgMVUv8LeXf+rfD/wADiqIstF0rTpTPY2sdvIylCyChKkg0+8Yq jsVdirsVdirsVdirsVdirsVdirsVdirsVdiqS67/AMdTy5/20pP+6dqWKu8mf8ofoP8A2zbP/kxH iqdYqtdgiM7VIUEniCx28FWpOIFqlSeaNHkErI1wwtyVmK2lyRGw3If9x8JHvl50mQVy38x+tt8C Y/tCY2t3a30C3NnKk8L14yRkEGmx6ZVOEoGiKLXKJiaKhc6vp9rP9WkkZ5wATDBHJPIAdwWSBHYD buMlDDOQvp57feyjjkQuttUsbt3it5ecsa8pIirLIgP88bAMp9iK4J4pRG4RKBHNCR+ZdJmklhiN zJJAQJkW0uiyE7jmBBUV98sOkyAAmt/MfrZnBId3zCMsdSsdTjMtjMsyoeLgVDK38rq1GU+xGV5M UsZqQYSgYndu91C1sBGbkvWZuEaxxySszULUCQo7dB4Y48cp8ljAy5IJPMukySywRm5aWCnrRraX RaPkKrzUQVFR0rlh0mQAHbfzH62ZwTAvb5hubzJpEC27ySShbzj9XIt52DluirxiPxbfZ64x0uSV 1057hAwyN+XmFVNbsXljiIuI2lYIhltbiJSx6DnJCq/jkTp5gXt8x+tBxSA/aFCfzRottefo+aWV bonisP1a4LMf8gCE8ht1GTjpMso8QG3vH62QwTIvp7wib/WbDTJIorxpEa4NIgkMsnJv5QYo3HLb p1yGPBPICR08wxhjlPkpza9psEk0bmYtbgGYx208ix1USfG0cTAfC1cMdNOQB238x+tIxSI/aGoP MOl3Jg9JpuN0QsMjW1wkblvs0keJU3+eMtNkjd1t5j9aywyH9oTPKWt2KuxV2KuxV2KuxVJdd/46 nlz/ALaUn/dO1LFXeTP+UP0H/tm2f/JiPFU6xV2KsNt9aOiza9cvaTTxC/PKVCgjQssa/vKvzA9w hzYSweKMYsD0uScfGIi+iYaNYT+X/L95cM6TzS+tf8Id4lLJyVI/EfDlWfIM+YDptFhkmMkx8l/k qNToEF4W9W4vS89xMd2eQuwPI+1KYNef3xHQbBdT/eEdy6LV7WXzE1gLC6jv1hpJIRDw9DkCrsyz Goqdu+/TBLBIYeLiHDfnz+SnGRjuxSB026nt/M/mH0bOa85Pa19EwjjSI9fXmi6+1ctywEsGOyBz 7+/yDOcQccd65u8tyC48x6veTr9SuphGPqDAiRUQAeq5pxPKv7NcdUOHDADcd6MwrHEDcd7KSiMy uQCyV4nwr1pmDbjse0X/AJS3zJ/0Zf8AJlszNR/i+P8Azvvb8v8AdQ+K3zaBbpophiL8dVgYRpxB YkStRebKu58SMdF6uOz/AAFdPvxf1U0iv7i4u47WfT5raNlaTnOYWHKMoVC+jNLvvXfwyiWMRjYk D7r/AEhrMABdobzRpEOp6cZS/wBXurL9/a3I+1G67023o1OmT0mY4594OxDLBkMJeRUfLN6dYV77 UBx1K0Y20tuRT6uR1op7v1J+jtktXj8I1H6TvfenNDgNDkmeqoi6XflQAXglZiO59MrU/QMpwn1x 97XD6ghfLSJJ5b0xXAYC3hah8VCsp+gjJ6o1nl7yyz/3h96b5Q1uxV2KuxV2KuxV2KpLrv8Ax1PL n/bSk/7p2pYq7yZ/yh+g/wDbNs/+TEeKp1iq1y4RjGAzgHiGNAT2BIDU+7EKkWkaVqcE+pDU4rV7 bU5WmZY5XcryUJwKvAgYEDrUfLMrNmxkR4Sbj+O9uyTiQKvZfo+m6vpLvpzGC50gMRbl3cTxxnf0 2X0mVwOn2v6YM+XHlHFuJ9e5ck4T3/iasdI1HQjJDo7Q3FhI5kS1uWaMwlqlhHKkcvw17FfpxyZ4 Zt52Jd46rLJHJ9XNdZaTfLrk+vXphSSW3FstvCzOoAYOGMrJH4fyY5M0PCEB33aJZBwcI71CwsPM FlqepaiYLOT9JNE3p/WZV9P0lKfa+qGta+AyWTJhnCMbPp8h+tlOeOUQLO3l+1V0/RLz9Ny+YNUe L6w0X1eKC35FI0rWpdwpYn/VGRyZ4+EMceV3uieQcHCE8NaGm57V2zGaUg0rTdatdc1DU7qO19HU /S5rHNIzR+ihQU5W6Bq19sy82XFLFGIu4307/i35JwMABeyp5g07VtRnsDZJb+lY3Md4TNK6M7R8 hwosEgA+LrX6MjpsuPGJXe4r8bowzhEG+opES/4huAsXpWtqjOvqypcSSuI6/GEU20Q5EdDy2yI8 GO9k/D9pY/ux3/j4rfQ1m41RHvI7X9HQktGiSyGTmK8JHBhVWp2Wu3XcgY8WKOPYni/HmtwEdrtB X2ka0nmBdZ0YWsatGIrlJpZB64HTkqQsFK9jU5ZjzYjh4J35eX2s4ZIeHwytNdUi1C502S3tI4TP cRtG4lkZUTmpUkMsTlqE+AynEYRnZug1wMRLdT0C0vrDS4LC/WIPaosSvA7OHCinI8446H23w6mc J5DKPXvTllGUiQmWUtbsVdirsVdirsVdiqS67/x1PLn/AG0pP+6dqWKu8mf8ofoP/bNs/wDkxHiq dYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FXYqkuu/8AHU8uf9tKT/un alirvJn/ACh+g/8AbNs/+TEeKp1irsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdiqFm1PTbd /TuLuCF/5ZJEU/czDBYYSywidyEQkkcqh42DqejKQQfpGFkCCuxS7FXYq7FUl13/AI6nlz/tpSf9 07UsVd5M/wCUP0H/ALZtn/yYjxVOsVdirsVdirsVdirsVdirsVdirsVdirsVdirsVdirznzv55aF n07THKopKPIho0hHUKeyjx7/ACyeDBLPKhy6l12fUSyyMYGgOZebyaneu3L1OPsAKZs4aDDEcmsa bGOideXfN+oaTcqVkorH4lP2H/116fTmNqez+EcUPkohLCeKHyez6TqlvrFil7b7BtnQ7lHHVTmD E2HY4M0csOII3C2OxV2KpLrv/HU8uf8AbSk/7p2pYq7yZ/yh+g/9s2z/AOTEeKp1irsVdirsVeDe YfzI872PmHVLG11L07e2vLiGFPQt24xpK6ItWhJNAO5wWi2aeTvMnmK7sBc6zeG5ubglYIikEaIp 40eQxRBwRQ+OWCGzk49PxRsp1a+YdRjnnjvmj9K1LCRzTlQMPiAULXavQYTAVs2nTQMRXMrJPNV2 Zl+qoZopgRGWXidt+W6rWgO4rgEN0/lIgb80u1bW/NenXMFu90iiUqCwWI/Cep+wwFO9col4hlQG 3ewjjhPkFkfnDVopnW4n9VAKAoiKK/5JZOnzGZfhCnI/JwIDG/Nf5gea7HUIrXTb0wgRAyL6MLVc s2/7yE02GUzAi4WqhGEqikQ/M7z2G31SoHUehbD/AJkZC3G4i9U/LXX9U8x6HcXurSerPHdNCrBV X4BHC42jVR1c4xZRNsvySXYqkvmzVDpWjTSxtxlm/cxnuCwPJvoUHIyutnH1mY48Zrmdng93cNcz tKeh2UeCjpm90+EYsYi4uLHwRpRy1m7FXof5Za48d79QlaqXA9Mg9nUFo2+ndc02tw+Fl25SYaeX hZ66S+96rlDsnYq7FUl13/jqeXP+2lJ/3TtSxV3kz/lD9B/7Ztn/AMmI8VTrFXYq7FXYq+bvNFhM 3mbWWVA3K/uiKH4t5pD9nKjkALC92YeXfMa2enQRWdrFaTQII5mVN3p8POm+5INT+rMnEYzHN2Wk jjywon4K0huLtLpTcCOS74MYo+SPx+NATL4cmrQBq1yuuCRvkylH1nuQU1/e2k1stsT/AKPsAXNV 3p8BLbEmtcjPUQhQY6jVRx0AL72mu5ZhxIPNKnip57V3pXxJyzT6oZG7T6kZOY3U4ZI7hTQs6sBw 478jUDpsfuy2eaAG5bPFA3ULry3Pq98gtQguHUlo3IVVEY4gMWIHI0JIzEyGUpe91eqjKWS65pBd 6Dc20xWWNUANDUgAe9RlRyVs41UXrX5SwNB5cuFYUreOw2pUenCAd/lluKVhlHkznLGTsVedfmre lI4LRT0jZyP+MjcP1Kcs00ePPEfFwNaeLLCPxeWZvFdirsVTPy9dPaalHKnVCHUf5SEOP1Zg9pwv FfcWjU+kCXcX0IrB1DruGAI+RzWu2bxV2KpLrv8Ax1PLn/bSk/7p2pYq7yZ/yh+g/wDbNs/+TEeK p1irsVdirsVeJavbPP5k1ODmqxzXk5PqEcQQ703rUZr8pqRaCd0Klp6Mh9NTLOWI9RSaADqBQ7jx yEcshuDTOE5ROxTue5uNQEf1p4g8NYouEfD0Wd1JpwHSi9PfM/SZjmnuOTsNLPxJbjkh5UFtHCWl jle4P2UPIrxNeL0r233zJ1EI5CAR1b8uMSqwg51uZ7eUW8ohmNfSdDQmpJNfhP68ZwPIU5HhXGhs lelWkl/c3U0szxSQN6YjDmo+0SKCg7ZRigeKvtcTDD1nbZm+gQ27RMsUlLqAmnIMS9amlVVmpRTU ZZkxeoEFnlxkSEiEfqcs+oaeby4j5xWymjUXgW2UigAr9+V6rFEwvq4uoxxgD3pt5BAGkT8RxU3L EClOqR/xynR/R8XFiyjMhLsVeVfmsT+kE/4xR/8AEpMyNB/f/B12o/xkf1Xnmbhk7FXYqitN/wB7 ovmf+InMbX/3EmrU/wB2X0LpxLafasdyYYyT/sRmnHJ2WP6QicLJ2KpLrv8Ax1PLn/bSk/7p2pYq 7yZ/yh+g/wDbNs/+TEeKp1irsVdirsVeFa5cU8wapXiEF7cK9RXb1XU7Zg5I+otBjuq21y6KqwuG jqePUk12NE29qZRIJBCNic/W4IrYsLpKuQQOIZR4NUnkW8cu0YuYIb9NfGFKbkJpLnj+8PxKFpxU k7kDeg3zZZMnKQv9bs8mQCpAkjuVlWWFVeeJomIDRlgAGG9WJ8PfMLWauZ9NU4uq1JmKApL9Pa14 zek1Q5Lcwu53NASoJ9wcqxaiWKTRg1MsRTx0FrbxTQyNFPMhWWNloV2BG5B60r1GbPBkMo2erssU zONy+CClu55I2SST92AFZFG5Cnl0/HNfqNXKdxqnB1OqscIFM6/L8odIuClafWW67f7riyej+hxo cmU5ksnYq8x/Ne2b14rinwtCo+lHav4OMv0UqzjzdfqhWoie8PNc3KXYq7FUbpEbSXyBRUgE0+Y4 /wAcw+0ZVgPm06o/u6730PBH6MEcP++0VfuFM1YdpEUKVMUuxVJdd/46nlz/ALaUn/dO1LFXeTP+ UP0H/tm2f/JiPFU6xV2KuxV2KvnvXbto/M+siRRJS8ud2rsBK4B+GnTMXJGy1SG6/RRcXsy+mY3b kAYXcRk/6taV+jKcgADEik5vkTTDHNdMIAAVQLVn6gioqSBUdcGkyGMxTbp83BIL+cVrA3BqmQf3 iMChRxXwHzrXNxHLCQ4ujtoZhkHF0UXaLUla1S8eOvKN4ECyAgioCsG2H2u2YetmJUQ4etyiVU62 tW09nQKvVCknSnEk8SrfPrmv49x3uLGdFMZrm+vnWW5lDSMeJkLfEgHxHjT3zO/ORMDtRc4aiHBy ooJllif1h05UWtB02G2a+czkO7gzmZSt6B5CIbSJmAC8rljRen2Ix3+WZ2j+j4rFk+ZLJ2KsT/ML TPr2ji4UVNsxDeySDiT9DBcHEYSEh0cLtCB4BIfwl4o6NG7Iwoykgj3GdBGQkLDEEEW1hV2Kst/L 7SmvtYhciqI4kY/5ER5H6C1Bmr7SycUxDu3aq8TNGPduXteYbtHYq7FUl13/AI6nlz/tpSf907Us Vd5M/wCUP0H/ALZtn/yYjxVOsVdirsVdirym78g3N7rt3f390LeK8vbgwRoA8rcpXK9WCjY1ys4b LOOG93al5NTQONw9ykkYBBkYGM1NP2fi3/XmNmxGDGfpF01b288enzSXFwbiFGqFkRiyRU5VXkeZ 6dMx5Gy49XyYrPFDBdtM0hWGWYG0AJ+GJQ1TxUU8Dttltkikx5JjrNlbiGB55fTmLmRHmURnc1AI Zg3YVyOMSB2bJGPeoaZNcX0UkJf1nh+F6GooKKGr/nvjkgIlj9VJkjXD0YcHWMgMK0IFK7k0/lyu m26NIo/VwrJISopzfmSUpt0Cqa9fHGBB6JMIUzPyD6X6In9FgyfWDQj3jiJGZ2kFQ+LCLKMyEuxV TnhjuYZLeZeUcqlHU9wwocUSiJCi8T84eWLnSb5+Kl0O6MB/eJ2Ye4/aGZeh1Qh6JfB1QvTy4Jcu hYvm1b0RZ2c15KEjBpWhanT+3KNRqY4Y2efcwy5RAeb2zyZ5d/Qen85l43NwBVe6IPsr8+5zS2ZE yPMuRo8Bxgyl9RZJhcp2KuxVJdd/46nlz/tpSf8AdO1LFXeTP+UP0H/tm2f/ACYjxVOsVdirsVdi qWz6PDIHeErFcF2kSfiWZS5q1PiHjhJLcM8uR5IOXy3NPT17tZqbj1Yefx1NHq0tajbBkqcSFyZo ziRSQ6pb6Jpl41vqWpGOcorEJbvX7QavJWPXj0zEOkNbH7HGhDhLGp9I8szXz3x108jtGpsZKIvF k47SrX7Va5KOlqNWkQCPkk0mW4huG16NjAjR0bTpDy5Abt++7EbUw/lR3sfCTu08gadOBqtrcq0l 1FHJHM8FdyC3qcea05BumD8se9fD80SPI0oR4v0j+7YDivoUKkHkDUSivfAdHfVMYkFSm/LyO4oZ 7xTxpwCwUUUNRyBmbl0xjpOHq2QPCnflvQT5espbQ3H1r1ZjNy4cONVRONOT/wAnjl2LHwClkbKc ZYh2KuxVA6lBpd9E1nqJiZevF2AZT4g1BBwEAsMmKOQVIMQuvy+0CaX1ItQRFrUiQI7f8EGT9WSj kyRFCRcQ9n19MiAnWjeXfLuisssUsc0y/ZkkdKL/AKiigGRqzZ3Lbh0cMZvme8sgjlimBMTrIB1K kGn3YXJX4q7FXYqkuu/8dTy5/wBtKT/unalirvJn/KH6D/2zbP8A5MR4qnWKuxV2KuxV2KuxVQls bK4f1J7eKV+nJ0VjQe5GKqf6L0z/AJY4P+RSf804q79F6Z/yxwf8ik/5pxVEoixqqIoVVACqBQAD oAMVXYq7FXYq7FXYq7FUn1Hyromq3TXl7A0kzgAsHddlFBsrAYqhf8CeWf8Allb/AJGyf814q7/A nln/AJZW/wCRsn/NeKpnpWjafosTw6fGYklbkwLM1SBT9onFUfirsVdiqS67/wAdTy5/20pP+6dq WKu8mf8AKH6D/wBs2z/5MR4qnWKuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2KuxV2 KuxV2KpLrv8Ax1PLn/bSk/7p2pYq7yZ/yh+g/wDbNs/+TEeKp1irsVSt9Yea8lsNLgF3LbUFxI7+ lDGx/YLhJCW9gpyfBQssuHayuXUrwXa2E9n6c8kUkscgk5QMU4/B6nAPX4t6p9+PAKu14RVqGj+Y DqV7d6bc24tLqzJ+ESeosihijOjcI9gwp0w5MXCAQUyhQtE63qqaLp0t+0ZmZNkiBoXPWlaGlACT 7DBjhxypEI8RpCXus6vZ6WupjTY5xw9WWKO5PJEIDV3txWg6/wAclHHEyq0iMSatFQalJPo41ThC C0RmCiYmLiN/il9IU26/DkTCpUgx3pDS6vq8GkSarcabHEYk9Vrdrk8xGAWav+j05e2SEImVWkRi ZVa9tXvI9FGqyWsYldVeK2E7EuHAKqG9D7ZrQLx+nBwDjq0cI4qRunz31xbiW/tls5G3ESy+qQP8 o8EAPyrkZAA7FEgAdllzc6itz9XsrWOZRGHeWaZolBYsAo4wzEn4cQI1uVAHVLbXXtWvLGa/g06F kgaRGj+tN6jGI8W4j6rTttvkzjiDV/j5szCINWrXGr6lFq6aTFZQuZo3mila4ZQUQ8TyAtmIbfpv 88AhExu0CIq7RUVzq3riK5s4URkZlkinaRea8aI/K3jpWvXfARGtiggJdB5jvv04mh31hHaPIpdJ TcFlkUf76/cLyPsaZM4hwcQLIwHDYKMGpahJqslhb2cctvDx9W69cgJy34FPQPx034g+FSK5Dgjw 3bHhFWhdQ17VNPsTqMunxehzVFU3LCQh24ISv1YgVrX7WSjjjI1aYwBNWj4LrU/ra295ZxRROjMJ oZ2lAZSvwMrQRUqD1yJEa2KCBSPyDF2KuxV2KpLrv/HU8uf9tKT/ALp2pYq7yZ/yh+g/9s2z/wCT EeKp1irsVYv5CqunXkU3+9aXkv1oH7XOi7n7sv1P1Dupszc2TNw5KWpyqeFaVrQ9PoyhrYjqEclk q+Y7YEyadfXAuFHV7aSVhIP9j1GZEDfp7w2x32ROvSJqOk6lfRsHtoLZ4rdh0dnCtJJ9Gyj/AGWR xDhkAiG0gn9kAbG3BFQYkBB/1RlUubA82OaZZNZ67c+XlcHTIwuoxQ03Us1PSr/IH+Knt88unK4C XXk2SNxvqnHmP/jgal/zCy/8QOV4vrDCH1BIrLUZtLltJtfirZPBCtjeJUxQ1jAKyL+y7fzfwrls oCQPDz6szHi5MuR1dQ6EMrAFWBqCD0IOY7UuxVIfJ/8Axy5v+Yu5/wCThy3P9XwZ5Oanqa3Tea7A WkkcUn1Sf4pYzItOSfsrJEfxwwrwzfemNcBTS0W/inlOozxSrII1hMaGJajnyXg8kpr9OVyo8mBr ogfM2njVIoba1+HUoW9e1lBp6XE7sx32PSnc/LaeGfCd+TLHLh9y/wAsX0N5pojEfoXVsxivIWNW WYH42au55HeuDNGpLkjRUPO3/HBf/jNB/wAnUw6f61xfUyDKmDsVdirsVdiqS67/AMdTy5/20pP+ 6dqWKu8mf8ofoP8A2zbP/kxHiqdYq7FUtn0S1kvG1C2klsbtwBJLbso9QDp6iSK6NT3XJjIao7hk JmqREdmUVi08sk7KUFw/AutR1VQgjHj9nfvgMkWoWekJaxXFvLczXkN0XMkdx6ZFZCTJT04oz8Ve nTDKd9EmVrJ9AtZtJTRYppba0RPTYQlOTr4Mzxv1O5pTEZSJcXVRM3aMsrU2dslsZpLgRgKrzcOX ECgH7tEG3yyMjZQTZQKaCE1RtXF/dG4dRGwPo8DGG5enx9Dp8t/fJ+L6apPHtVIrU9PGqWj2Tzyw RSgrJ6PCrKRQqTJHJt8sjCXCbRGVG1H9Co2kPo0l1PJC6el6j+kZBGAF4D9zx6DqVr74fE9V0ni3 t2jaNHosH1WC6uJ4B9iOdkYJvX4SsaH8ccmTjN0spcSOmjeWJo0laBm6SRhSy/L1FdfvGRBpiEDp GipoyPFBdTzxOzOY5zGQHY1ZgUiRt/nTJZMnH0ZSlxKc+g+vqI1T6/dRzorRx8PQ4ojGpUK9u341 OEZKjVKJ0KpVTSXFwtzPf3Nw8SsIhJ6IVGccfUCxwICwBNK1wGe3JeLyXadpX6Pkml+t3F21wQX+ sFGoQKChSND07dMZz4uiylaFj8txRarJrEV9dJcTkeqqmIRuo2CMnobigp4+9cJy3GqT4m1Ur6xo 0etQi2uLmeGEEMY4TGAzKeSkl4nbb2ODHk4DdIjLhRtvE8MSxyTPcMtayyhAx37+miL+GRJsoKrg Q7FXYq7FUl13/jqeXP8AtpSf907UsVd5M/5Q/Qf+2bZ/8mI8VTrFXYq7FXYq7FXYq7FXYq7FXYq7 FXYq7FXYq7FXYq7FXYq7FXYq7FXYq7FUl13/AI6nlz/tpSf907UsVSnyn5s8q23lXRbe41rT4Zod PtY5I5LqFXR1hjVlZWkBBBG4xVNv8Z+T/wDq/ab/ANJkH/VTFXf4z8n/APV+03/pMg/6qYq7/Gfk /wD6v2m/9JkH/VTFXf4z8n/9X7Tf+kyD/qpirv8AGfk//q/ab/0mQf8AVTFXf4z8n/8AV+03/pMg /wCqmKu/xn5P/wCr9pv/AEmQf9VMVd/jPyf/ANX7Tf8ApMg/6qYq7/Gfk/8A6v2m/wDSZB/1UxV3 +M/J/wD1ftN/6TIP+qmKu/xn5P8A+r9pv/SZB/1UxV3+M/J//V+03/pMg/6qYq7/ABn5P/6v2m/9 JkH/AFUxV3+M/J//AFftN/6TIP8Aqpirv8Z+T/8Aq/ab/wBJkH/VTFXf4z8n/wDV+03/AKTIP+qm Ku/xn5P/AOr9pv8A0mQf9VMVd/jPyf8A9X7Tf+kyD/qpirv8Z+T/APq/ab/0mQf9VMVd/jPyf/1f tN/6TIP+qmKu/wAZ+T/+r9pv/SZB/wBVMVd/jPyf/wBX7Tf+kyD/AKqYq7/Gfk//AKv2m/8ASZB/ 1UxVKdZ82eVZdR0B4ta090g1CSSVluoSEQ2F/HyciTYcnUVPcjFX/9k= + + + + + + application/pdf + + + Adobe PDF Library 8.0 + False + + + + +endstream endobj 2 0 obj <> endobj 7 0 obj <>/Font<>/ProcSet[/PDF/Text/ImageC]/ExtGState<>>>/Type/Page>> endobj 27 0 obj <>stream +q +0 0 612 792 re +W n +BT +0 0 0 1 k +/GS0 gs +/TT0 1 Tf +12 0 0 12 180 515.6797 Tm +(RGB Image)Tj +0.083 -28.667 Td +(CMYK Image)Tj +ET +1 0.9 0.1 0 k +/GS1 gs +q 1 0 0 1 463.1364 189.5939 cm +0 0 m +30.451 0 55.136 40.535 55.136 90.536 c +55.136 140.538 30.451 181.073 0 181.073 c +-30.451 181.073 -55.136 140.538 -55.136 90.536 c +-55.136 40.535 -30.451 0 0 0 c +f +Q +0.79 0.12 0.83 0 K +8 w 4 M +q 1 0 0 1 463.1364 189.5939 cm +0 0 m +30.451 0 55.136 40.535 55.136 90.536 c +55.136 140.538 30.451 181.073 0 181.073 c +-30.451 181.073 -55.136 140.538 -55.136 90.536 c +-55.136 40.535 -30.451 0 0 0 c +h +S +Q +BT +0 0 0 1 k +/GS0 gs +/TT0 1 Tf +12 0 0 12 428 166.3464 Tm +(CMYK Graphic)Tj +ET +0.145 0.251 0.561 rg +/GS1 gs +q 1 0 0 1 480.2273 557.8364 cm +0 0 m +30.451 0 55.136 40.534 55.136 90.536 c +55.136 140.538 30.451 181.073 0 181.073 c +-30.451 181.073 -55.136 140.538 -55.136 90.536 c +-55.136 40.534 -30.451 0 0 0 c +f +Q +0.188 0.639 0.38 RG +q 1 0 0 1 480.2273 557.8364 cm +0 0 m +30.451 0 55.136 40.534 55.136 90.536 c +55.136 140.538 30.451 181.073 0 181.073 c +-30.451 181.073 -55.136 140.538 -55.136 90.536 c +-55.136 40.534 -30.451 0 0 0 c +h +S +Q +BT +0 0 0 1 k +/GS0 gs +/TT0 1 Tf +12 0 0 12 449.3333 533.0131 Tm +(RGB Graphic)Tj +0.561 0.137 0.78 rg +/GS1 gs +72 0 0 72 70.6667 428.7448 Tm +[(RGB )18(TEXT)]TJ +0.592 0.859 0 0 k +0.019 -5.037 Td +[(CMYK )18(TEXT)]TJ +ET +Q +q +127 186 204.8 153.599 re +W n +q +/GS1 gs +204.8000031 0 0 153.6000061 127 185.9999695 cm +/Im0 Do +Q +Q +q +/GS1 gs +204.7884369 0 0 153.5913239 115 531.4086761 cm +/Im1 Do +Q + +endstream endobj 11 0 obj <> endobj 22 0 obj <> endobj 20 0 obj <> endobj 21 0 obj <> endobj 30 0 obj <>stream +H\j0 ~ +CI6N ! rR[cdfp3>>KINչr{L Slg)~MxPq=kU|Pr ';\p`1t +Sy= P`%ƿ6=BV|7+9{47b G *ִJ(i +Oe|7A)_^)bF@2gs.3G#YLfƚNxǼ3N:zxAxAf-::ryconν &&>stream +HytWǿooޛ~! " la- Eq)KZKa34XRT(-D HQMKj7>t߽ߙwgg潙50 U?5[ Ҷ}a9@nxv^VQ.phtiߤWVcum7:Q19Y#+W3rpE)\&c +'?~ tz(wBv8`미<%­îp끧ow=;ά@;rgdVAe?V rcrF`\nVxL(g>iHC P~FM$" *D8P9p1;h4nnOP +b'^|^AKx,:[.H_#3vMu3Ha7d8"K FDeL$j +RjnQtW4PR*ZZZ],= ww]u (H"n{0?C&I&7c֠ Q]؇)~qm/^1{2o bV[/^3f|Wn|:7T1n|Roeޛ]R)Ge|mK=ƗyRo/8㋽}Ɨx_7;eBd 9hf;ddX2G-c<=}Ra|hTZ"Y"', ')K%r9kD[",g",jG",˖H%rj|n\D;KK+KkKof\|nX>7-[.X"DCc(' D@DODE"JDQ^@DDvb/U\wUрDQ5}"*! jDTb@DJQun ȨzucTj`Z> -46˥ripD.DZ",H KK!imDZ"H;C%htD:["?2DX"]-nȝvtd2;nK&Òa 6'|> 44Hg^}p?2AV?ׇ*҇uG*GY5qǬ*ǽoUSO61?pqÑ>GG02pH7>Ϫu*uY2:fIѩ0aFgŒ> 3:ft.R00+aF;m6|'Ecs-M-3 yk'Isp::w;G[l;XlԎPNwX=oԾP:`;⠯'lg¨á:b,j I5-L +?&XH E⽰Cue<b98bv8lwϊyF+j_#6 *JD j2ğ&$b O6ܵ)]֋&'MlXL ^//F6D,AT,E*:bqȈ{?WyS+j` սF\QG41-VL&KK"r |^ܙg@dMQIyps{Z:OiԜZQjOIzfl-=Kh-%Him*P9m]A:JǩN"]**V.!{޲/{r̖#r(-#t9CΒsr|NNɅr|A.+*V˗r|M!wr/򘬐')yV^UZtF\j7Mtܺn=7m6s[-n[vut3ܞnonNmmmB:kDTH7u+;.z~Pՙ!=\c8˄א"jѐ4fԒZּ$uNpiMGi:͠Y4 QCs4OEz5h!-DMZL@hjJZDZEPZ$zZ_UVW' "D0Q BBC ""RJ"R +bAE)XK,R B- P'/_f{~gu|o#)uuz#_ˣzPJ}}WߕzDH~cz\KC='$ZO)zZbFzA/yI/I\?z]K3BzCoH 7%ίүV +]UZ#HHGCwtǑLi^%B$ _:b0K' pID>3 +Q(I(Ft$\b*J7T1 $s0GR1$ @ұ %Hc1K,R,X +Bzc%VJVajlZ\:l؈e(؊2۱]bv d0vc 쑡~a8C2=Q||d4N$N?Bs8'E2WpEqeG^<˓2`d !Fbml6V~emfml+/]mm5^o2}I_nmK=i;G#==J?hq 苁(@&`2I\lk5~ڇ8Ļ8p\O)Y\%|/p_|WhJ\G U+tŸzoVZ}kh=nu4a- fl)lB tZZWU*}U +KF/UjK5ZRT^z^C/=B/եKңR}E#=F#5mi&iD4m6MifMsڦmG۴mZ66@[z=8=О@'z L$]聮@7z HR4z Ƞ=Lz'=ЋMd}lz ȥ聾 #<";#2;̎"dv4- cl!9KN8rZLNǓ t"9DNKdr:N%tr:lzYki;M/uҵAtnݺO'=яo=U4/旞͖ (8LL¬ղ5hklmu$Kt˴,˵6؆[ZMr1<&ǎyL$cyBn1V/?UtwX~/38*r?{5%Ѿ?"Wm櫈}Vkc? D(FFtӥ~3aPQ𥧹j_8ݳ= +$v !@&"c G[(X*8,B %d oe%ce.]IJꮙ}{SR=eO;&8Ŏ;GZfjAk`Mm^۩<-V7][OֻzOOgmlt9Η8SΙrSb+j\ ?DZ8S8܈2bVFdt1z# #2rv +x B. S}8}pA8Wm8 +GVŸ&LSu#](Qa4U0c6C&cȀOdhB3Z A8ꐐzsa FhE\.XeXKp).W*\kp-pq 7f Ƹ+ cSj8_Vf_6܎_7-`,[܉-сp7-S)#RZFiUZZG#ͣhmMP}I[+FkvnC{ita:B根\gElKc[,daidZ$ctNI:E %y<]t.JT ?wtO)O| >NBχӼ+R'\^>/ "8g)8R^/ ++l%!5Kt8/ 閭etsm'^}D_O>c[ `k133 #ƙ`1l,5fMX8k"X$,5bX,kZ3ӔfQÅ,Z6,%|Nɛ-$֎gX2:ά {ue?{>6}>blՑ{g0;w-x_@]Q{Enb{&j5j5֨h,%[b/i=7?PrPG +R! Ch@SejP]e@ +^' }"a%Xb5vt]$-tc0`(0 `aFb-hu0b=ac&asl- l I%JC +l0c&c +vTLtLYIUW)+HO]+v='b?p /q00p4d>Y@Ed1YB%s"_/j%_8J y$zAlߋMb3oN :Qj!]JUtjFItE҃ͣ'i>yFz^7]'}L9yA^򊔒 Bh(VN([򎔑HʩFuJ(6@848ZCdHЅ!zC `$ L0U%0V_/ї=x .)]2H֐t`"d[N&PYSp!#e-%;T&eel/dLa6{>_8,r"O +H!9K9RLInKƊtȀLj.Ew )R='R$B{HR<8=P,a!LCh(e,egʔI4+?Ik(Mk:4F^TEb*`E}B}oo7 Tl,E+;,eFci]Z%0G]F/ǫAj[ѯ*UU;;8$fXxDdub֫۠aM6kޢemڶKl!5-=#cV]vݣg/w8hpΐr9jO>?aSN>cs~6o/YlWB[fW_~6~nm߱sݷ>=w/'O>_PxV+:W|K߮~uBM4VMC& ȥcD:Sp-I[ +{<u"jj7lV14`p@NрS偓 \<`oeOg;ۻڻ'wڏًWO%OvD9b qxGKG#1ɱ̱˱ N_g%vF:ltrq1겻B]aW/W 4XeU*[խVcYCtk5Zj}cm[1Uh]M=}9";+#eMx@Ey]q7wgތ +2æ&iL6im&m*'1mCLZ[4&FT4↸,+Ό AP4n3@Iss;~=9zOMM@s+N(J+^"֚t%ierMKL;6Z7L3JGwo =Mq58p::?"7ԑ8hpv3DKur>J.]s} /ƿ嵒 KK{ n%\!M&d+7;kri]Fhr˳??4>)\s^[m)-o.խT( 6wg]zS1Wr٬[P_|>iSgzUx߯sy]P7;;|Gxs}%|bO%"33Tzx$~ÝNpGs\W]\[\\]\tkkkW?W+.lh.}[Yp~Vc鍖ʄzM)MԖiL>ة=a6'i}9-֘QkC~ck}I֌gj1khbMkm=1ô:LF7,;&X042L\ȁBdka\0 + P `%܄a5}^7 !xA8+'8ǡŸ)(|0 -xށ._a `$އ/0>mǐcja;c +4 Cgc!MH(|\ Іq ܆;a1.\+q5z܀q܅Ә9V܆v܁m11PN v8?]/+HX1 +׸1c1>"T A<cI8 ,Óx +v`G) +p OS6dB4hM4fQ>l# +i\Gi-"ZDi -eTL淩VJZEi u6FDJSN;3I.M_З}M{h/t!:LG(TjMf 4a2̆a! 6,UTF'4tS9MCJHUTM2]אj<vF?Z &a ! bWMEV`"BEvv"BD(^D+CkZ{$`O%Hɢ(:*:\[]Su^]*)z1#~%>c1Fdb/2>$&O0|s)2>ɧ4|s9JU\͗2_\>k\|op[-;|}%&AF09`MFn3"#҈,fa!bZŦ5V5j-m,m-Aӈ7\`ZTW>w9sRE]v邈􅅥,@( DAkhAP4l`\! ҋmswo{T*rT;%Yjr#^!)RSjIm㍤JKԓLɒIli %Gr4&TIsi!IKfҥ/i#J[i'tN(%[ywEJtR =R(}2G A2X_/e a 򈌔Qvdq<.Oȓ򔌗 2Q&z+zU_ P/ҋ쮸ϸ2ܭpowJi~?s<_2"ϯr1/,y%ǫx51o;y.|>Χ, /릅ϴtﹿUn.bo[N蘉kf6&7qu;t2y0l?3Sf Xtys$3<iuYYfYjlVwfYo6ͧ/@M)gọ̷kNOρU& %!WV|VؚAi`LhMm#Ķ3=vrd;dQ;5R$QjT-7FQ(+j5G6Qs +hH4<ƺ>ߥC;uXQKRBr&aRX.0 ]>,V+auT ׂv=}qw{>Qv%虶D5u>w[Bӹ$D}K%j܏.>a"u)Us.ЛiK%R3P1hSmHUOj&5Չ5|kھS}O>w]}3}} } |;NVmr/zJo;NK{tZa}DcA[Cׅ)\kqm{a{> 5|tj?7%f+4 f?^Q +^4TFG]> &4;(iمYKkhjfY đZ[RE j>o͌[}͠y +*m 4Wu+&<|Ǣy)q8q:q3IIPYg$1:R &sEͷ>}p~C-| 4Bᩱn1%=\nǭ3o}(A%$N)?:.ewvz5e DF7Uux +.YvE/,.cI+֎N05Q|64j28M&bLNiILI5~ӽ;{=s<@ +"m:=LuҏI2DO07.w94Ji;t+AO8} 6y^a_u|-;) 1+m򝈇3-j?a?o7D?O_m]X^AaDh{+l"י߀``qJ3kmQ0K?n+py愤i#)^ODwaacgw7৴1-hrTA>Dq紉a( A;T#-Pn\ƖP'1'!҇ +b%*PuQB%Dm8;"vx[y3"c psJ̉oqxvc6Gu/"0`tՈoa>3An$b{N?@l0F Q, | @5Iy8 uڌFqB"i8f{+h%ڻ넟G;;" ߨ_Y^{߲pʊ%Ee%\쓊z desf863J 㪤:/M^FA,K(K5L;2#7H"JuPWbm4jK &9),zE?cYH|8A7I:Qѯ&|]j3*G7:CrCrRKLW=)) +,4JwM1@n2-Y ݧ%bM/YIWAnԳZ趨n +Mjiz`f׽.FNm]>ŗϏ&zLVIlI|NqU£–5EN&t4.(04r̔[$=Cn-*[ӡ}oLMCBcJ&m^ӕ%46&S~%&$%d2VQ53X|o%sLLQ)YĒ?)1`]d9PRK^} Ka;=3O^eഛ pYQ?n=$ި[uoaҗ `G +9ܒ䭈7ĵ1e^,0jHetyðw9J_v\j镊ZU3|sc_//^(sr%Mgo^j8UBx"rv{M—v'*<<^Yn咪IAT:I_U!pWZv[VPmy]avI(J/eTZöݽ3{鮲l{={? +)oV|TWIGv'W,y|r +`/ ْⲚEe.W]Rpd8)!%1z4oVx4n=# QrC!qz+ ia'Ն +1V3?p +]⌛BgVN5p"q?T l}Ͼ;Ǿ_bK|>;g;8l$.@SQP kNJG7AE-QJAeb -eCju6U"jMYbfw?=w:F8y<,#G8‡. pPQHrNU]kŒ^,-}M&?.ya8qT"Bo^'U=^h/=|[=\yifЖ /_ τ|{ύh8j&}KŒE@Wzh,dSM"Z#13,@tlg(M8Bba,Ola@s۰qNwGѮ-ږhx Z^,=Jh6x2KPv`9IpʭM0cXpt xJ:t'SSnRu5r8fs} )IDTtѽt΀$ED'%".+!$d?D"^x@J({Ct`Dr|XYP 1%߲|?=]wA -|x)F*L̈́uZ`D=')Y^"xi!IQ4apũ$pk\7N!/`T5Ɗ1EZi N,'"E3}cT;.kSßLׯ? ֦fԷ zg͋e<|+[}4솂e'룋{/_}Q)o@,+/ͪͦjᬩV"TGr"C5")F ԨKjTB)nA'<#1fe{ 0!f C>\d.3$16]Lgg([-IuV% uH]*" KHA[;D^G?yxpLbNÀݏĂlCX74M?MnzB }1seh)q-H(xG AY$=&Y7;vT-/[=KZ9Fy!;ysEj/+DZ6qO5ld #C60np47ƽA.F;h|__"=VKE9:8H9&` X 'YplLd/ŮyU ~Ѫ ujdyDAkyP1rڦ.}k4IxE xǺ0^Q\g>ۻיxwfvgvYw6@ + Vm@RVh +*"*5P5nZGAmU!"JCC"'U^;&!*u={dy{^".-WV-V+YL|ƢN>PZ$Knn&oOu;KT~H +qX&a G`tv.螛qfڹbbK~#y%BSO[V +]dV=#خ<+?.4kEO.璲 ҲZ?ĪqÃ89w!i4[5o ,Q0?G[Om;#&ٵeԖ󖐖bmY "TX]$>~8G;Li/8N~] +po>&pL~nun ~Z{K{[s򋐈FD)o :d-шfH @00BԀs#Eaq9hZ:֡cռ$IHh_6 +P>/"uoeJ.tVd\2GWu6*^'.P] +fTe% ^g}:q:79?s9- L6?|`Y67{jF[ ++g=ϪkSܫMik{;hvaȲo Әj^?G胨 igc"SOMgwHNN,~cߒ%+r;av'v a/r]xz.}{e&zpnckcHFx6H?(uמ|-V~E /9ֶb׽owztlgTK ^NZv^ȸ0X+U w3 +vڝK% +B{P[{!R|C(4uldLOD}= ^J;.Kɱܸz5yU\TzN oS¿c>|f򪺄|XLkͤ,LF侩>ZfE+NzJ啑i/T)T޺5R6J1o({I"t+ $8=0C45Vr|%9_"F|J:R1~4HjW;'@N-a=OPE/Hzww:0%(e= a#s07z$yTxB,XNJ4Q~Q܆/qe0w܆=k5`bG~HU>'SA[ZwI&I +*nP7Mƃ!t M=[[fJ{IAg <~+Bԥ.eB_HPw3[/CCoO9}$nʉ=]|7pjS6tcv}jiDևh${]F\_-Yˣ;0w F]ꭜsU5&\Fgmbv.f>h{+zs+/l!ֹd?yb:(4[dF= ,z Z;3 nyǷҺGKc4R=?լ-7 u6]{g3c;cLbOb16!, 횸T%v$ԇ(n]. Yv"J[Rzj;י{sss.˅!As>v"glI.vԼ">H^M,vMΒfwS&jW;twϱ0N؉I\>ک;E]hwRٌOx#S.,H6'$8MZ&4Ӊ2uJV%gdv&gIv%MHڨjapVoh"梊qkӖ;kl'ő4COT%Co`ͪvF8';+A +a mC}MZ +\%hvoC1ܙ4?T~^4RH ^}00=p;ʱAGo?-'3CU{z?څ8{bwP?Ǝ닩TLzF!yw:Ҥ*m̾bn?.[ӐEXi~/mK^MhbtW{fnE ZAkGPRcCVuGӪQt_)lpVpݑ1O8<5e%a4+?n9XYOSo΋\LHf&D'ss2.s vyyN88t 0tET*nIO0ĜI*9)2侹i NOBt ~hB=fgzL؜^[SQCK%@}8- otHMMu^4UJtzEA$ >n#.C]$D:gFd)jv6Z +I#&A{*R^i5diѴB;YsZ+>T΁Ѵ;4<8p 8 yb(DG[F %rTbW +EӺA5zVuQp@(r:: +`} ?UH Jд7t-iفUgv~kp[~S52jaW_nIgپx=o~aowKzF[jV(kZԌi}!;O^m)0gN9\@u |>.z}>|pfX iʝd\(rMNS +vPz:qD{mS)n/99%'ML.\UПމEӵ`-z2؈^-;}| 3./&.*zxkHObGl&Jr2Ir!\M%דcnPgPc8L~Ȉ D54ZFkH zk6|&L0/aє98S839;7}nmwfh +bժ[{(?c1p~X4<A Eor%ky;_p!p`gG^Ǹ9UxA:{Y+Hɯ8˰/CAaSؓ0 f;pձw?3kǯ*aһK[ 9e!=GʆM~iGNFcG<!A%lۚ`cygןty χ%YFc=d̦fKåqt]q%wL~oxnf⫈oߚVY](J-CB“,~єOf/mvXn +,9 `X8MmΞz#ĆȋTO{ m]W7dV#lVW$6*ߋy%_iKMDNpӔ΍5v@|'Uß(,ٿuLA{fcz#K1ŬrbL{rlPAx"xe|HOxPgD^_k|%Jfͨ1jGh៺ |q+ MEhƋ&8% ڃOt'Z1){;z Wu,k(a^Y|<2o*< QUaAR?{ty0-Wj@xfjp ,=B+7e`iuԨ MB6ɹJ")\.< f$0`&d%f)` +t٫Jd\90>m#@^"DR7IGdw{^Jdw=)G hiZ>b4!nꢕ~z ՞M$HXGw~bH#a}u Y:o4Po ٶO& j䏎 S?6|jWC> 4뺉Zyt'8%5YlG~87ˑ΁aǎ8|O  Ŕ'vŽ^#$\0Mga::W| ^Tp.)&Ddv R1#%(r<шlZR&mԂp Zc ]4"9ø ++;#[`o"DF3u +^{ZJo +՚f\`j z'F]:#u ?>Mր &ZC$q; $PL8i?Z 9"KOvv>omoys<6h%35--v2|__͜$%vg:ͧ~UDp3^.5ļ(P1]66YHEl- 4p8.eFN EK (]KEp:>t\A\fBR__nh<Y^k &Q ~*u! ?ؔ] P.wONE (l {O+5)`og(CE* $)ŠM98cz6j Q |sR7M5M5T_~͔JtB֌`8E t݀>RN_Ϋ5 DZc8N|I8sKsOL.MNhnm줥qlm:Ԗ%iAEVc! L +,~U'S*ÏuS5+D/yvum=^e@#Дz4sj}]|qKZD&ل 35,w&"ftkm2\3X״$#!`ZKOH"wFLOn K-Vd0CMeR@*̩UQ]D!JSBKN jsIjKJ\LO,*\m=SK M{R +=sD!ЯpV}OXh+cLTScH<<՟,[ .kt~$sr655ܟ<,߄- g\l.\e D'q!9+9 :}\ՎhV/{J% +q*B5?\Ζ)KM9;8'9V&Ƚ7GsS" -e} QawT-r84Χ 05PYM)J%ɈMUS?*D#UaQ=LUՋQؘrs-j2KڔՃ;Ɋn%\▏'IM\8i WWorھڛ z-F[ʯYJ:+"2_##'6{a^{%fԜ'/y(lGi 2l9=bg(o8P.1xtA"wm4kFBs2aU}_`v7'ҟt/"ӏt%Qw{}M\as҉g(Ml _f>:ia^&{:n2a;&d:b`73WlFG{mVc +a4>M[a6> *ul#~F9G!7?5*H:w0ߍ7н S{ }`#^s7rnR@~ +$ p 60xxlll?,Άl,3{ٳ@71v,(r{$hm-D]>ɦd>HU$#d$%!". d.H #DA!>)gN:;,ŚIt">cveU˸ cK2R59~ `޳~xL5\ i_ ~رLi3_lr 15-/ˏbSrniSo=1<=m<"'?P`)~8~ҜdL^j=62Qۼ;F滫>1F-3=R"gP<&t״+e\) v?Y{:\;:s&'O*:`]VS)u+dҗ|kKQZ#!mv6V[iNx.RKXQBf`w|:cl~kS?:O4Op}=ސzToTU^11=/摚7>g4uau+uL2EL~>m~T.bc1| {;?a!|reOqN9ms9Ү<Ę R)p|9 CL<'i+UI;2aYK(buhM{Zꚭ؊~:k$}:@f&:YxOߛz}6 I|ȋpW#_AYV{ s@ny*(IjX oEm:gl;Xf'WUmbWjrøX9y%~n pŜjO,k_Pj|X](bnu8?6$Ⱥ;RGʐ_dt.%ݍ&_lQd?NMiI\5WN(EV""q5 qEEsdcN¢`E>s`|#65nj廑Q1a aN'GZy^TBeΈd7DGds'D+Cy8~:eC.]9њ&ɟ5lng8O$s5jk:rWōlߚ8.;\z歳ߓO={FM^sujnQL|k NLSCfh> !7)XQڋݟ9[|DRmJK)TAַ'kq~%\o9Xخ"ws)ͧ>[)? +(mj]܋R9r7Vy~tuR&.ܟ=E +֙{XUc^1y;Oćygx:ʡOl\?х|+&H S]amWU#r;̟X%ka&w3:v,RCU<ߒC0aRUw)e?sՏqJuqK-ٟٱi0kMMER]5s#YvonL1]cC=M=O.ds{^)gVjNQgdi91ғ/FmdWTG1/H +ՊTsBz`eV3؍jd7ۮH3L|~>]?YrWֿӽsO7Nw}]HNř.F\E?_/5NǞ< J/f-? ԿKBPį$vn/]9GA~ ;%8$Ri8 ~wAM]ls,gv㼦d߄f;v1wh^~ڍw>\Fa8ԫL PrDGG[ңqxhk8Gq=qp=š~\\Uޥǐǟꌾm.|0w~KϢ?sLƙko3,p0&Z<_s=VpM;6uG|)l ֳkې*b@JACvŸp }7o$H%~a/W ߇*C}ɼ D=S}UX+ĺYj>}\.~~mtCxQB1 u_|yn/'-75Z?[߭A(mLv*K0nI"EzL^T/પ+7!!"hrA#klᑠഀ $iVcNmq +#SP`)SvZt`qZv:18*V+99$?d~w~o*rަ佉t ?@Ohzh/@S)tuai鶵ֲ"G&>sKќ`7.xH/bg3 u8b 8?Q%㳨_LII&>[?]в@Io:Y㾥mXǵ5L]ꨈ` l#X#ޘO3GQ"f="x T-شe3-0HMD+=هEJϊN ut7vƋM^kcEWWԯJ}o:æuvfqϙ[I,#XVAO HX%g;n ^w_{]B Я7|L<44JdG}>Ԕ+!}-#04- =p^q ~Ojܽ= +5m2k +#XPq ` .R:BME#!ǦGLgR1 `0 `0 `0 `0 `0 `0 r,](F6 i9_E*_!C~ٷHط?=}hHki~ڭRǩ5)?ZopOo+[Tྯ}b}{FxiߧhW8 s}[B4j\m Kz2ſE=Ws|5Ws|7G͡*_͡*_͡?:"ſKܷC_p$gC#WK⏐<ϋm$Oq-/~o?Qw؏GI 4%h2fdHP- APS|]&ɑě* ZQ>Ei-ZnorIM"͒ikP翝65(~E+C퍺 4xP{m ޷P#Z_UbZ}Iެ) Y4nߞ9kɻy1ՠFNlIO2,)IO/i 4co3$ߖGNQjL sMW@n)=TtٶțV6 h^jl,m7{cd  UemP5ym'zEfs&|meWsYꪽ!d鵒}KJ W!ׯڀ2YGfz訪-z> %K-$6d^@2f& + +ޑjCHQ:JiҕTEPo&Zs9{UoϘZUD3KV ۤ;7OfhU5Jk[ǟ`[M=wy!VX\Y&ΐ(WۃOaKsx}El#OFHh-\+yb}rX~i;,OQ)C3c㊶JVᎳ+Z]\~j:mߪRZTgVz ʹL^ ry/5I;RScB1џ跜vRX;.ᕊ {'l"{ggHLEPkkbt.O'3{1T4~Q䠢AU j`:/yrF/)pJSF,Vc!)f4̹1J7" ì0I2Ká.CrJ.-y$3쫀BRXVV̜RBJJ))-eA`)/LdrwT55MwmM]M4Fdf[JZKikF͝L4=d]KzKSe_)`'.N Y$p 2Lސ7em)yWF9F8/dL2E4.3d&l#sV曻EXR@>cGɧ򙬐JVY+sBlI6#|#[dlCv.-wG>/rD19.'ὧ䴜rN숋rI.*?/f^rSnmU~;VsWܗPcy"ȄȂȆȁȅȃȇ(((( Q%Q +QeQ( +JAe +jj# M-m耎D" +] ;^GD/F8pF !.!nx?Ad P x1om(w1a bc&b&c +bcfbfcb},B,b,R|>'XOcVb9k9X 5l6l.Ʒ{ppG=NiYy\ q qW3~5\ -Ư w;xGx' ) be:gfd&fffe6fgd.fe>Y,,,¢,FY%Y=j˲YX eVe5Vg d-fe=g6d#6f)9[%[5۰-1فىd; _cw^>t/c,]c<0饏~&28¡7&sQ|r48N$NN4Nyٜcn8srs ~ȏ1?2~ϸ+k9\ϯ5n6n.{xxG=OiYy^yyW35^ -w;|G|'BAFj:M4f̚Ej6ͮ94ܚGj>ͯZDj1ВZJKk-4Xk4D+kVѪZMk ѺZOkmimʹЖJ[km4\k4B#5J;k?փ$۶m6vc۶m۶m۶m;ﾢXն:VY}k` 5&XSkfͭVX[kguNٺXWfݭ^X_gm A6؆PfmQ6XgmMI6٦TfmFlͱ6[hl-̖ +[il`mͶŶ6v) ~;`#vԎq;a'픝3vy`]+vծua7ݶ;v}{`='Ԟs{a/핽7{`}/վwa??!# !8B"B# "#"""# +"#b"b#"^K !!1 )!9R %R!5 -!=2 c]2# "#r"r#m&? + +0(xqJJ=,ʡ<*"*2*:j&j!:zhFh&hfhhVh6hvhN.n^>~A!aQ1q I)iY9yXEX%XeXXUX5XuX ؈M،-؊m؎؉]؍=؋}؏8C8#8c88S838s8 K+k[;{xGx'xgxxWx7xwxO/o_? A#Hΐ ð Ȍ¨،øLLL¤LLLLôL¬ü,,,¢,,,,ò,ʬª6.>!1)9[%[5۰-۱=;#;3+;{'{7/?p q0p(q8Gp$Gq4p,q<'p"'q2p*q:gp&gq6p.q>p!q1p)q9Wp%Wq5p-q=7p#7q3p+q;wp'wq7p/q? 0(8O$O4,!1)9_%_5-=?#?3+;'7/)+L%B*B+*+"*"+*+b*b+*+*+*+R*R+*+2*2+*+r*r+* + +JJʪʫ**jڪjjjjjjjjꠎꢮꡞꣾ񚠉ɚ隡ٚZZZZZZZZڠڤڢڦڡڥڣڧ::::::::󺠋˺뺡ۺzzzzzzzzovĎ1;n'줝v9;o]vŮ5n7ݲv=o=Ğ3{n/쥽;{o}ž7n??@HBhAX GxD@DDBdDATDCt@LBlA\C|$@B$Bb "#R"R# "#2"2# "#r"r#" +"PEPP%PPePPPPUPP5PPuPP M-m]=}0`8L$LL4L ,<,",,2, +*:l&ll6l.>!1 )9\%\\5\ -=<#<<3< +;|'||7|/?`HbhaX$EgxF`DFbdFaTFct`Lbla\c|&`B&bb0 23S2S3 233233 23s2s32 2XEXX%XXeXXXXUXX5XXuXX ؘؐMؔ؜-ؚؒmؖ؞ؙؑ]ؕ؝=ؓ؛}ؗ؟8¡`8N$NN4N ,<."..2. +*:n&nn6n.>!1 )9^%^^5^ -=>#>>3> +;~'~~7~/?PHRhQX $WxEPDERdEQTEStPLRlQ\S|%PB%Rb(*+R*R+*+2*2+*+r*r+* +*PTXETTT\%TRTZeTVT^TQTYUTUT]5TST[uTWT_ PXMT\-RZmV^QY]U]=S[}W_4P`8M$MM4M ,<-"--2- +*:m&mm6m.>!1 )9]%]]5] -==#==3= +;}'}}7}/?!=0ù9.wOS>/Ko[G~_W~?O2XM H`H0Fc b"VXb55&Xb= !6b3l-%B3ȠEI`[lvDmhG +)NLtLBfc'tczЋчb7GUX:†1a,b='b?p 80#p$88p"N843p&8< p!.Ÿ2\+p%ո:\p#n͸6܎;p'ݸ>܏ =x1<'$x9<"^x57&x=!>3|/%;|#~7?'߼ /M(8 IN11y4oF1o›f9o[Vip O,縕'$ޚmy;ޞw9m\K>6%fI/A'۬wK'[[sBe[=  yhU|gqC6Vb=UjU=+ +5-j^^3vJ-E#)KV ,-;^.ٶ5d~7Z^=+UW>,[C[M*%V)v k[&>,X6^ rSs ,3.V ϨqqVϦUlfsJ/;I1ئ8ӡXP,S9S9S9S9S9S9E* $w0&GFT@dnSҲ7pm]xuI[˦/vI,z"7ԜS󥕄0 "gE?/}h|,L5QEn9I_@V׶Uf=Tf޼ڶڶ).L"_JA3$=ƫbJKm6NH d )ҔGͨI+ƒi KԢfG_Ս!*+]e)eV4!gբoiŀihfY/Iճ֜UE +f%"ץRT*]2aJ"JsRq + +uB{e,WET^ݓ{U*!P=^Ԏ}A+GD ANj5f6$'o!Wօ-IXyqQ^qV+OzsK!j趖hIUWVw%myPF+ k#鄣T>ByQW&;-eDzS]5QNt +P!US:mDt^˿V,kM3Y^\=4fޑ=PlS"EcbH}?b|%ã\`al\n8F$ dߥ$J{qw<[oP$?uqqow +`7یhWv>_??_&C=PA#Ќ#:3~o +up\+S\up\5*\*{{{~~sJ>pJ_ |/E |/_ 7p#_p#7p#/«o|̫1Ƽj̫16̯1ko_/ _]w <6yL\|}m肮tSTЈ&7  6_/ % J CCtĽOfL '{ H=O>%| +фfQڻ?Yz@{V+5QP\|Bz?|5܃҃JP7yԓ}V7,A^/??{e=%]6xi -ZKjzlǸ\mjWS>W)o2a|<ϧA% =p== z;9\~ԡO+k Ųz',^{ac؟>gz:D^Ϝ3/~˽_澚ݡ%ιwνss\z]ZKKwi)s靻EKh-ݢeam-y{?wR˼B | lRHMF&qN։:g(Ih{Dr-l9n϶lf˹ b˹j? WM:&9)LaLaL!p>rb99!hˣ-L{=S +ٖg[m9-i N[?L38`aP!q|oSމޖ{[ήU*vW]bwU +*vW]vU쮊U*؛b)b†uM%!l9o<宼~:8$"+_s7x(h$EFYQQ4RFPFPFPFPFPFPFPFP(C!e2D Q(CQQQQQQQQQQQQQQQQQQQQ; FN#QH4%FE#e8e8e8e8e8e8e8e8e8e8exeϝܩϝܩϝܩϝ?wLJ7^> +S_;S_; O7z^NnUzI_ K۩۩۩۩۩۩۩۝x`7Oϟp_:Hh@ݟXF?Y+ 6u(s6(',{|~SO56^O뿷z7vo?R| ooχ}|zw^.y~ɖ$g[>ٖ7͖7[lJre{pmR L#lΖro˽-<`˃-\H-[.U--O\j.5ۺ|ؼ/y>ﶱ[%$wqq6inW؎ea>g{ss;;sνwˬݙvb4pχox}}}pcccc+;i}yˇ?3z{,/k,WVnU[nE+j\W߾N{s\)wRaV؂؆؁X.=oRpooo;on o›& o›& o›&;q??Nn؄b3`+a;7] c# ~' ~/??==?oVI"D&L$2222222v@a PPvDGɧ}| -[ȷga +y*Uȫ­p+ +­p+ +­S_W~_7 ~7 ~7 ~7 ~,"(,"(,"(,"> +#( (4J#(4J#(4J#(L>#(<#(<#(:_ko| x-|7Bb{m?|:tɣG'>t ``$I'O$$$I~&xF<#ޮgobw"E _~d@tLtLtLtLtLtLtLtLtLtLGtLGtLGtLGtLGtLGt|ǹPn +XflVlvob vǞwp PQepS9S9enPnPnPnPnPp'ܕolۇ/O~w~z}s +~ֿr~&`[ ۱;] c& ~' ~' ~' ~ |/ɹ/ @Ax@ %Uu 0LJXoB + HHs[.wso{r|w|w|=|=|=|=|?????#?#?#?#?O?O?O?O?3 ?3 ?3 ?3 ^az ++WX^aT<ůRJ+ůRI'şRI'ŏ?RH#ŏ?RH#ŏ?RH#ŏ-χ)~G)~G)~G)~G)~G)~?(?(~7(~7(>Ƶ.'(~'(~'(~'(~'(~'(~'(~'hWx^W7(~7(~ex^FoQFoQFo7~_W ~7 ~7 ~7 ~7~w~vnvn;;;+pO <'8s9pw=p9Sx +O(pQ8 +G9n;Ј&ts_K\\S[?}ϞośNQcޜCg958D9Q@uCS=zzzZЊ6:tl2C=Ј&4(RG0$!! aHCBmSцvtH0$!! aHCBoMGB8‘p$#&ބ$%!, aIKBX’$%!, aIKBX’$%!, aIKBX’$%!, aIKBX’$%!, aIKBXoMOBx“$'&ބ0%)!L aJSB”ÛÛÛÛ%-!l aK[B–%-akKs_ +:gڹo羝vaK~O|?V8Ч?{T&~sZ ת/?xٛ3C=Ј&4}n#Zl vEQQpv`yFWhU_ԀҺ6ZFWha-lܩ=.qyO딄{x_O7tO7t@7 +ng~gKtO t@WoqF-&N;_1u$Hԑ#эR[yUoڱɾjXj/ү:ѯ:ӯ3:s__gu_gu_gu_gBƱ3 ? ]~_~_~_W~_W~_W~_W~_7 ~7 ~7 ~7 ~w~w~w~w~?HCm%qTG%qT$|gD_g=YOs%((vo119lzFa9[<#|lK.?}7aqn|N hDQ2] 2] 2] 22m:f @,rN99D|111q|S痾OscNQzt]фfmhGgu2d֙򾴠mS݆bI[g֙;o۾;o۾;oΓ'C!｣tT\F;>gWl +`vS߂r=^>ۏi߸.\yy}}yt9>:ǟ_/ýS^_>wܟ=z;TW/O]wO|{xy~}_j6us'΍7@HCR;JR\',qPR: +rXbuIMQ u,`PCk`C#Mݏiۏecԍ=@+gҮ<={Fcr@tؔK0/(*R\40;E(Y/ +`!) ƁyB`:yͲYs: ,ᇈę]dH}ΐ7i@AC.\' P?W[}rY>ҢHAذYx"z `ΠEJ 葼bL*X SX1,Vn +7F,H>=lQxFŪԳa #`}xX')b:`V'!Z&;ݢ74`/`uBvmEs߈₺wPd"̮+\/E Rp5 +X؀YU\gϑ#+)2R[t9 %^y>gSwv9)a)5Nd܃EӾu3Diۺy52\%հ-ږl˶g.[mv6a9'lv5:bU]].bSI`,X$>ܿ3Fd-.WЎ גf.2]~/{ȯÜJ_}kQCjD յHyޤ &Ӗ +SӖN3Y9miRMMӖ:.XW]7mQT%T+Ӗ[;,ɎTG5eP}@sFwd4I'?(: HiHs!:G:$`E9z+O?y+y dni+7 L c_BpE/xg?% +a\x˿$!Jn}qG+0XX>>iK%Mf ![D#aQM3|f$f0d 2gH =H$ AϤP0tgs潢@&F>˛T%]b"+*XOT1rZLb2 uv9xWv_8uOnf*ƗTns4xUzCMU5p΁ĭpNW,D*ʜ**ՓZr^Qm*oi#H'ەmVQu UVѶ쬲*ǧR1f*ϠUL[ץ;Ma߾׾˾;^k+(v9V9Q{R"=gK!1b1)L o4X`l(f8_' G9JıAyDm_#֝8UuĩDƌqvV9T^eG [,壬8V$~"3vvǯIGTk4%F_qr4FlDmY6Ya6l@kt!ț>m܄0̏U lR%cUI܆uED AXAnYh °li5NE M:>T='<390:@Ʊˌ>;<3؆ wq@>5@Z٧}Dv&Jjd0XkĞ b֌>#jv7XW|A-\<k`6[֨˛#a~BPK< Kϼ<f_|,5i} _Duu]%2]@6Fj + fF;tbЮ~HHo7r6vS@| _/ fe6b6^ +I ڌ@39% XQ`wI680JQ=cq)0( m @ + +endstream endobj 16 0 obj <>stream +Adobed + + + + + + + + + +  + + + + + + + + + + + + + + + + + + +   +  + o!1AQ"aq2 #BR3$bC4% +rS&cD5Ts6'E7F򃓣dU()8GHVe*9:IJWXYZftugvwhijxyzi!1AQa"q2#BR 3br$’Csc%4S5&DTdEU' +()*6789:FGHIJVWXYZefghijtuvwxyz?)%"R<8Ƃbjk"bw +4 nJ: {hP|%O{VXQveۼ:.*ڔTG[rYJ ^[J +ұ4׋ XAg}tȓ.յ?Í9nI&gS%X caap4(x-Os2"1McG k\Zܔ_h,-}~7z\kVLn!iH|? +g>uBEPb iknj'v}\]apgg2}` |#;bkme}@s]uY1z07ziiy$v(>ܭԺn{Ę$)Tp4o!)֭:|Ro'_q鷥TCrVYKWW yTU@l⓫ @33fӨ8}4x^)ytm]XASbttaM6饹v^ + }~dkOwEqfn +0:9(炢Uuaqb#N'ӷE}EOM{ +2^͊U+$HFDwgx]yM-%!$#dѭ͚@0 3 7?SC? I61_M cz b`X7RծMaQT6S)Q&(J,Wj[wr6݇ +)~<5FG }Z|CC҆SY L?ڳjkMUF$$IpP68!f|$SU|yuuiCSHJgH^~~#^:;sOSp< zd!dC1@{q5`y>T(3TX0 "=Ny?%Πc\fɈh3&r{8A=^'>:٘lAsvk =N=jK?HR\O$"YY@0v-8҃ S*p`L<0#hThZ +R(F*׫~z|^ዑΕwHbg1* tKatO;teRkN%^vtq}t:t#b:6lr܇4׳(7c=1# ʹ +WQF>\Rv donVVqB#ҕn7Z*_C: ^7Y/ 0cTPe˪ʃ}9Y"rʻm̳ݭ*N'˦kRt|34PRaʇ4Y?z^yQ v|8Yr(HHIEJQ:0s.jY?:|o0P#ɩP@'/VPzFmS*n ,#oĿDzz/ɗeEU<˭[גK(6/3ÎƢz`{ƌ~3bQc:kzWV2/H|G9V +znh(ǝW[P" +hITBxUd1z& 5O_Su9?6 * )BZ$y8jcm[ђ|\5$ c$PvsK"VII"S?6*E +TV)zKՌ&;}M8_x3mm}yM|-x*bH,!2k٥XO1K:Spl+-6UIL<@4u܇TY +>eJn++ڳ${5Q%RK]Ӭ-D)*b:i}! vEr/JP68*8{+rɔMn0ᴣ0gf1J;4U3 X={߁~77od)AޝAiyAr $3κ(a5š9JȰn^Ufa#Wu3F3fΠd_j5X-tԹC*"mFG2qse~i=Z-k?Ν8*)(D-}ET99We,?p`r PQ2HoTZlkGU^}re$Xfhi)'A &̭ Q!Gfn̓N*$±&`LW +28xG$MU#u䫜emݱbMZ0ꪈyr,s +J_FǷ+rnN([8rR:[SYWw-Px +T)>(!nն,VZ85> R0+RĕfRK%0qKNZuUx5lÙUjXUH5y +׎YeheĤ!3'T-[U(.!6'5°o[EfAkZ'NqR1,I) k+;n-r54 OE*-Zzܥ&p~ w:e|ȝYJ^eČZ$55۰%s%}*w`$f|NR-/b$~FOJu%(ii;mkxj')6 !`.Zl')SDՕ:㧳YFA X֮ncF -_[ԓ{{~<9[!< U):*m+ҽ7oC14 A׳G۶oPP3Y2REy<9)J>ܝO(d V^^UC.ܖ5:pJJRg +V/BJZpI{rm IӜ;6 +Ja4$ 8)k2 6Y) +ԅL8S4X}F{1Ʉ0#٭}t̩玢h p{2nU/ (db '4bPąWFooo hx]/~C*)A)sg@NhDz7P$ +KP(t&7Q ªlJ>c'n֗EzwRm,36^s*3YEٮ_c(n面W"kf vMhE"UVTiq[ߝYClA-{wOiA06Sa\šC[oif2v~!O7)E=(Z:B=t5̝/Z-cGaN^tb[iAH1*3}\Zig֖ZÉ1f؄`B4-*:oLF,<:8%f7 w7Z%W>p}gl{€p|c<=fa =Bv>PbVsv{9ޥӡ;槭VY^1RT Wpgُa@.%aqPIBۺ{%@χ<*YmrxIJ͖ʫ UZSKJ}pO=^*O+>g妞5tybmq5ؓi]6 +lYRZV1<6 r]'(ԏS=OS1OK'e5:>u:}˹7².#T*snliY~FW9kWpmĞQJ-7ZqIL +Dq΋:ibx9bT2 #ܭjNߝc|ɡLW_X>AcűSޞRE#*I=@䂯; +P%P#dPПpPcvq &׸[=su/96/`6:P,cm>$\\_oA:34v0SI)vzyP^e8!J^ &QQ,MkXFDqKDgtˤD$ DN#E?Yݟ[Y LlXvbX6I˓,YOaE3TK@ܨböǜ) 0(<)~4 +qe{ߤR9VKsFN +lEi5MRG)I bK1ۃ;-\@1$mC,Y+% c8ֽLTfߨXnwC2SQǰؔfi6j#N7ٴ l2I&)[w,4I=|ua\Bmңȱq?$N˳L$.=Yhy]L(^MVfBYe%;6^lT)zX,%b"=7@X@(kن&3m0p^{cY#=/:9\ +5PeZ}mٴṉUӉX6L!"<`)h;e +X868қxed1AE24 ! uGBX6 /[]}O}=L)ii'9}<.Y0׽+3IO(ɳ1Tۓ^ebwt],KR@W ƢxePg:LƖ7,qe(*Wb MKŭC kƌHŵrq+u/t4C NƓB +A2"uQk?L'J[1yHRd-@:͘ #9+i)Բ6 :1α# X|QX5$q^ڢVjأ>lE" +'Rzkb͊c86QV +V23I c/Gؤ/$p-n +`} I8.V|WXcK$"IrZ'+=Da=ILJp嬪i<>:wBar ݦ0ӷ} F-ڙI6tmW^IQY:"@xP{ӣbF ˗ksi<ơ +I@(J1i)HZnHJqj|nEQ<\[d:,n+if^YDj(';GEE/2YpP  OOapɖrlkC[SG-+c<5 Ocm.h.Gt;b#N)tϒ#Zz8*ʤ(!1:zV%#!wQb9>s{MҴw%Qa$m +/ufWo:\ 0%O7]r~pȘVhҏr]!TTp{VR dNz{9Ezs̘Pp/c2ufg' tt&ǴcOE.:1R++ 2҈)A8B N=]ޝux +P+ҪHKBUxAh]V_˴ɄQ1;iPGo9Ҟ÷1rgrS<}hWWUubU5Uv!+4n$Y~"T]VG( +(7b⿦fh30x91IQ  wZ"~WdFkp9Bw7miiV(:);kZz{IY($`DŽ=),ehGu*Q5[OKz/c4XTʒv$]P/3 v3S( +dco }{ '_1QIeN6o=[ʒ;m+nԛv^˪6tUfAf{jdciP[BCJ +ni;,UPbNqb1Ve'iCʦ`t TZq}}C4`;~e$wR UD͂`*cdF%̠wgZvqws9$󍛱7txm)=Sdܽ%3&.=MosBU@˷[XZJg'qw!hÝ;M2HGljO-)$HCB:˩HjDVW:LS T9B]O< +GoVuU8Qj'W7f nێ^AAcҪW)&sRȫ$2#R;(0fS0) `rWeRÌSS|ut4H?bEg^bUR0݅fڪT5kߒ R.ֲ puU\M4cuaJ.E[p[QHpu[_ϬWSbxX£c3]W꺺0kI&8vpww!}#if;\ $ 1(q)7on`[&CZpZ%Iбs13*\S=AJOCh!-52,j{t,_ +tun/|S$qյ4OT)%5c܀}_v[7!"!EFS$ɤAwKD +HRrN%͂d*Bi0:ZXi]Ɏ7,TiWQ^+쑘 +˘P\63 KXiqM׳fˆ@2 +/)INJczØTQeeqS +u.OlEY[-3=[hhb0pe4u=6i*JLOMT#ZnZ;Ӛ2@=s3[ui# {U5iKKSU 90AOP8i y!l/ce[JM0I!D`8zN;0pÎ,6I$Npu +9C4E_SՕb4s yto6JmA\`K:ˬ2̥ %%%$lLH=[r"AZ=?d[U]RcyUC) 'mkNgkoPR TQfJKpGL4P?Ѱڡ*|OCrXzyi3I1RoU~H(`F!GptӦٶ2 +(qwJΥRNMd7rwnmGJqH=z*KoI)Q $b5 +֜L-e@0*\&5;ϱ˜iZKw pK &OWYKA[2jJ,]ZZ Eoṕ_&B^TCd?q7ۅ%;b#6 ۀ5YKm[( vo:ϰԒɻ.RG$\#1GoM`\IRAkqK3lZV(,}}>znJ>SJ 4PT=XBom9KaGڔH>zTc[t'O$g©1b-; }=*10ROU59;H6BĹ :o2l2Bq!= CiUj@@mxO^{ẔάԪxA0%ĖrZucbPlApI.Mq@n4/U)Kf4lv(fA4 J=j!+Ѿ[ŪZ2jE;BM +PA @T?V[ú9{vYR7i&T + pƑf;ɝ[-Bu}* d2t*zL>*~z2եhi㺝ݬw9Ξ޾\9Xr[ mIRLMw-V0It<>bT%+N C|\WFDw 7k{.4]ǰ*|RY+%OH**~?c;eJf1UnYjjp VꦎUʯLך3IIN)|a*"R,qjUvv%¶iQa8R1\nL557d"$ NyjJ|0<@ qRkw,eȷqJӆ +DF!aTaq* +*7Y'wiYB="tw/c}JAp|Y;VE5K3%*DK4l͕gxX wDL*&T4 <L=^7ª=E`Y26 )XL5P5O~ ]U%Zbeux +3ajձǔ˥JԂBb}jN# j:BA8D2]%lDT)E\NJ0Ze@Ўy?j' |M]\F܋haے>g6pӮS+QV 6 +;q]<8P\o5t޺:<#̙O*"Q b2_,2J-JxқLA~Weßk1\("9ި`mηː"}JnvX8׸6h22Wϓ0_Y?TUQ~bYL +jn +C aXGIQj5'nز޸'Ç\w/@pf+`xmEJVaؤrIHkiU)ߕZTDaQ:IA)disO$!ʁ}Gqr@.Rdl-b\Di~"k$jU=!ֺ8ȫ^ޜ6PW kn;Hn ']xA +/}K>ug ڱ{ oE]/5{@V'l@[ea)װچ!,Qsnba6F is׮VUяHQ) +2 {np̡`6u(šrTfh*DGhSmo<줒 {<9F1!b"5n2 O쪟iٯ;E@UFnPڵ'QL{+/]W"cyy@\1\X`LqŒAi?QyL1=bsXF-pM~:Œs j) +ǁꦜY0O*( Z̑TORV )*4Gɘ`ñeF&yْXOv` &e)`'eO\'(ZhivKag =rPs,Œ61i&oo~eD;1r ӅV/ +sV@ Mp|u$Ϻʹ% |8w)bfuzEI1nYޤ +^V +LDo/ Ux3rIAWrZz5T"!)͔} e4A &ݸUݐq^ڪIӅDp*iX3rmbL(<%]<*Hh/éЏGKїēLQO4-6 $84r6ߘI)iU](; r Ӕ4浑? `18h\-?7 +v׷뙽xuvSCUGZ<~uu-=\,R_RL&?Qp<0K$бy;㗝VJd'}.E/@8v/|U~zҌ:DŅfl^0w_]dãFHw1^+ :cy-T!F)0,AFԛam} C݆p=pQz̹Vzɟ* OE~YX9+5PӁG< [Lf:hzMη6M%Wa#<8Eh@?G ,j +]vbIsWêZOʠ?t +&l: N@Y +x|MMS'SRw!b; ymn* l +Vڙ>c~,$Oq. ^K-iXÃ(tJXpp7pc.烁T|4k+m'ŀEgEH);N*cǭ#vKťD48n.3W"OcsBVa5dx0`nnRT +@0#pˤ9B)j&Ƽn› +2u.34g$eHT1R=]T LA^>SVSE5|%.:z<5TEMHUbbGy}JonoڲJeC=tLYbջ !}?捜1ƽ/髯sFks+TKObJWICmJzh ]_N,;UݽDzK6iÀv1#GAltlFqlq½Ǥu]+&%܁JBz| GePb{}Ӝw7 +rDbEoL3$ mwm٪lZ@PԴcaӉ̜h_\n 4$ JZI1 H' }-vwqzGdXU$4 5}N'JDǵcw}f3aB#CT$IД0I'(oXq_hF R$J]B/cř·I_˫z McܦXf@wOΞZ{݀0T'G]ensnM\ R:NRx\Ic]F!UVi(|rCɊG&!Oo>XN#tmO +~7oss.7f +=f[lR@1ROY&[P!YsXH#qS8>:vs>?OTpbehx+ %Usl9JﱵbNɾm"H-+QsZ:vIDp WtƪNA2%SX]Վz|3rǰ=򌭅Ni?H;n`;@r;w=7;$;1k]eiP)Q!`6tSQ:f\6< +JJfvĪQbGAW$7$0LI}tTCIP }73[͙oe-)$u L~*Ӱ +B%wi`m%ҙm0WWUQ)w*mn&e(v|rYH'ꮸ.a=J8`bpIPT]oUkr(P5ڗ$0plpZӾFo/" +ĞT>QRc,&r 7tZf7>'P&g1@oUj n+g1(ZUIjhhĀ Tb?>X].^:myPcGM!LdZ,cp&c6vC7m[j#<('{|$0q4`?0 +Τ?4TAd)$ [*YL~ۅ)ރcX~+h:mY⹹34an6JdfxL$lͪ*[/ +a-[ۆƢR)*A]ܫ{$)Ŧ9XPf7?&a#]G*byh*@жűmIۆ%&zt̝o՗zuܟGV{Y1S7(ZPi;"H[4gW-tRԙlKԥH0zn^eYMf_sIAI}AFk;_0U8Qh2axC +A*[<8@rV0ɜdqSMԼ3I*7jɥFQ X؝N~>8qa*҇?846{$gv[JTGGD?M]>sW;"ts4GJ!ɊX$x(*3n"3N4)LUjRj:xWjENEn >rыb1zjmcA8v-t6 lȑ†!O=(Wt!Y?k뉧ih0ژ䊪9dRFep/[Oke,Һ3l.3 pbh1:Yxrѹ9gY}fm?y eI V܍kBG v_V]~z*g*Ob9;M;>}i /4a +m۬s-R˱ˆFӬe$&$f.RiYI6nw*R=-OM{#Ʉ)CGߎ4͊ώ&7W)4WUp1@C8J2En#Yk"眻==F X1ZO>$sݔx0iq~izigTuۨbЕhW1? +A:Þs.dz[ː!w3j^۳@6"*ǚڻ `C]A-z#$=%$C Ld + pL):'K֌G8=}n,  lǰ~Gڍ,R֝Z0 6FvB +LyEu 9{ѶE2>Ԫ\KV:djHdäu|z SXn܇t.7ÅLT&leGpM[>7RXBNzz+lt#|S:Sp:Mk%:9JjjeP’-wB rt$Aܷ#cHQF*=q'ҍ{ e>NvD2T +*juY {x!Нcp +@g_RH3m4 ȻQi&&nKq:En[tJ +]4\]Hӷ87.[,%2I0#.ϻ^sXR.R | 9N1 ێi1͙*NTWqI)o  Iq#z3JUS &R|- VF^$OtvSõ #,$\(n3 Fޚ Gn͹Κ)VjbS 7=mrUTBpOL}]grgV)mRaq}/qn4dq^i?{b|];jy|2t*Q4~el’ʢdnuOu7v'PEZ0F8+djKAIYDl]Ж鄹2K jtl15 A c$oO0uPI3qpۋ)>ca +QYnkPmf< 5>whjjyhI`u 4&J@ >L:x׸!Ǭ+ !2] U♚؝ 54(dL#/gw(IӁ]%do,@ *T7?n IqJ\%cXp2oD= 9W1W㒦 > |&4Ęe%M{udoZ1Z؍FNƣ {|cbf1>UޚYUb*cJEU5iaRvk߱#f5{f,SJyDSF΁س kw7gap3G&t3FJz ~rWL%hGn$\ZP7a֗YoY)+ۣyW̢fQPdRPT=:&wq~ gMEɻ?dK):3I-sloʙBUpDĜfIutE0[7@kDy#;dz?9;`Q.X\-kEm# 9~E~~Rҿ> 㷀lO7ψP1PLT4Ԕ)`, 1sXq _IWGfY^c ^G + e#6nxT}-|nŚTZJ?}`<;0E;O[Oc* j<",+C%ϰgFq;%V+L'jVuq/s7p"ѲR*R DLCg\BH& OI]C]E3K`AG HEDqI<[tІA9#Q/~hYj5d6G5õ{i 艙S YgYAgL=<Rm4_h} ݮzڠϮHƚ;NQQPSb{r='tJnOخfzŎSx-YSeQhT":jM1kFo-[lH*5o3p4Ɣ#]so8&60ZZyJ:׸f%\ΰT2T +AEIռ>snU'N @(Ɯ +uR>vr%&QqF;cmL]RɞM;*cS|ɢTu;cdٓstC(RcEUU {&wv-T(#׻ͯϠ +s~Ҹ@Y|RW^Gt70R35^e7=ҵ0 Z +tO:eT<C?U$|ҕ15R-U($[0T]%#o +LRf#ڎ",IB6yv׹#.d:IOVgqZibXnBc<*|6VzLrK:N5;c/./䎢IbT]E6>ڬw$ }0$:Ytb>V` +-`jłI0*jXH+*duA%(+ +JK-(F*WA(g Y>);"FAۭ";!fι<;9GOKJY/f~SΘVp!5<|9FpKÝߛLn-T +|EDȂuX/8Q!PqD>?G:Tt#,L&(ej dI4*I(N@<.ٻXV35z3U;* (ijJx|v*|wf7f=S緍vm2DT:| +Iv9`›v]臡\`SM_[ps.%=H«Ot@ +$ +>o0R<g@Yr10)5 |O:)meo)Z-p+60RsrQ:[[Î\i{D-; Q}AA|.G5${Ȋ%7:kǒ+2v-M \f a9 + 뛥&6% *wm#C&T[Υ=?im?n(K:ZD*R9}X9LTm|=3'lr^ J51%iru% 1:qՎ$p&)1Y0o +F-oy#+=hlZRdžڽ墀(.D8F1vZ=omOyj6Iw4 6O@\J{.!分5Z@l/s: d*6lvN`) 6f fkEmi!*ѧaZ]Rv\(䫧0A*M6  Al#ۤSSn[3ϕDr]C=DlO ,21iGN 0cp#Rsphi sM*{λX7iTaipaOYnB̬pzbzcc!߱#Zi-ocqK0TH){738Vc71ddE-vOERHӿ˛ljUZVO +8Dk U4tFlM60P F1vs-nUԥ1 Î5Fj2fJ*? ׾y榝w[^6hсJR +GTNP>yňd*^~<:OڀRMKTIoܓۘF{||K._5иYHU6e`A<ʸoMjJȚntg$(q   +7א?i/fyM<6UQ>gM&fŔ0? +dX +d`ڛkk"{uSʸLO$zvϕ OL++ˀff>#b7pIOӝKN"\45 6lӷbO~qHu v-CgᷢlYV,aFݖ7bŁx]Am.vX]rfIQRPX,/`$cHBmaK*w.URaJVҵO:havl?)nRRgZd:+?O(1~+EƳke +,tFJ:;SVFLg@۷ +.tYKCτ 8Q[^sKZ8AQWP5n;mpgo@Ei:ٟrvJE|/ j@c5hH%B^܋7?,]o/l>e%f Ɉ&뤹'kvwٰa!KRL U<37QmZ pa5iZu <.߭{/7 Vq%D6S!CΊ-z*}`lqH$$و$࿷Sտ,n^}Cʸ#jնT͊95X)v23Ñbd{KaiӠmHO٦LaQ&on@Ȉ~خZ"Fp2^Zh!^Y sfem!7NgyE % +A20izLe J)bH葳W( D7 4" j1bg4HCk4 +4Ъn%v_C.-p0Z.ahQ:xӞzJC%#e,OQ +Ia4sȻ?ެvڄ>}WAG + ^_Yemֵ3WrQsۉ'tS/g"C-F&[qy\X.ѿV!Ѥ)!B'¤6[Q7Q~/4%EAbJZ/.Xve u*|xbUcؘ- (uP\{@<.;=96Nʛ9ƍ]p3" > u)F"ţ^eOKkUl-W].%Ca IO )k\vg +R:dgN`H:A=O{v޳^yOC{v 5n3$!B+bs9P +)LC26& ֽүfݜiNjm Jު:x8D;O +MM En6C:v[MO SAqFxˢ4mpDIMH8X}0-2al1/G"5Bymk؈۴7ᛕ5pʉmJlQ'hJvYI ,:*;ٰc{k$`w,{iϘ:L4 r_S ĩi ,f!>2*1F[`5們6HzGx{Ewt#jEm_"v+LfKTJ?SB !ņǍVZ* \VXB' +RfEEYX\'c $aABt_ExL b{ 5qdJpW+6;H=~FͩQh.bėG!31k-~'B5; + FZ0QBpw-a^0tp.cR@?Y, +ƪÎSV1iWkK\[fE{/ٯ zj'4EA˘f&|-},Nq,{㈃zL-¥S.b$ nk^_9Ɛ1@iF}\0KZBua>֤F}*lZMlbGߌWMwDzSGI)їɛcH wЌz&dcĩ*3fRĩ15ê'bIRXFPMw1ކvIVWk.ط{@ZH1ptVxwwbLhpi6yVȑUe6v`*z,O +*ꑣ18鬧|k{-2+& 3(]ݠfW!(B;xzT/V%Sb8."0Q$S2!΀@+ +ޫG8 Kxd2T5f\6ER#4Xjvsk&+Jz F9y.3ޮqIL~=TT+|abDZ>H8VM$ϵZ4.wXFqNzᐫ0T#Clect`;-o۶9H.R(AÇCDh&Fgh8R.S$#㢬&7D"q3JB%guC6te\U&azI1Q%YhQUI4Mܺ}TR:/ԿE]oP6WMp:bE8z3ߚُ$OT:\2wk4ӅRy ȷSZH|Jr;Wt% )RFze`7S  )B&j.]wֲ@x&GKe4y0f^>l5xl44A()Hn nWMy9n>.'jxWŠwsQ\pW JSpc8(/.H 1FUsJIXr5ET`JqݥztEz˧9ΧZ;eX1kyπ?s߼%*<N֢qz.KjQ# + +xc(OzS[r&JjIUY)">~oX7$AT>I*oe_q#PypU tX*(ۓP[*¤d>^6?UsUPp ,BꤍmmIT"1 +i,u-;+P<T+Qrxt*zιWWb+H֕U T;̅}`6~/weDFdtHTo]]-ʂVLCQ"xUf2Z%1 + lMãu[?#IX +Tc6ˌ,$2ȚeOAR|]{};Rb;,bτeE/i.o'^w_vw(y>.p߲-݌r5#}+ 8~)%g9SWrzB]w {{xc}{dv@2Fݨ}5wsq }X\+'`+Ba17]$vp F }P33ӍBOi~]Y*lp.kj_xiG"0`׷4v{٥LzõJ>/iC,vVb1'o>A,XʆK v΃Z)K5;5-F5f. +W{pŝȵvW]4 +3^\yb6IaKyFvޮ5!1 Q"b dz_탡>[7f"pQHC4BDÁVCSQ, I,щ*"LKSC;4i*wZNkrl)m%ZHVEa,2B@m7>? SI*yMŸ$u Urfasóq˘cS=L,4Zp{^MR@&'9vum'QJvp'5/8 ]!GRŐ\`e}6@&'Spc?]cJ&=p49jl4݈Sû`.l 7g= ^@/㸎BFB(کk ? E„>$ҝܵB;:jf=YMWV^~۸{&% Ҍ[1ҫ=.STbyF/*Ư,rZj~iuJiHBNDN=&'(Uґ F:0==YV府ZVL!0 +=爎L76`8jx߿Kb/=nÊgRu@.A LF<*9CvDCV:(^zsեgPKPQ&VψN9U"zV+V|N< +ƭ-up8c5_6q ᬭ 'G>]|q6!B%M!:=&'LQSָn'Os.?,؂yk[{q& 6$'M4"q8VC40 Wwk^ڞ5%J2\~]eaA@® Ȋsm^RF|X 52RS :#o9 HRJGItuqbZmbHb,5z;)U`T)[9Xee8'{9hZ۷[LT*CSFQ@%IQT wӟۜXHA837`/MG9aSם=c5f g˜ L~u5S%cxF!/܀{+Y(_Wapji ROMGdk۸ۧsvvzE5u-V-} ,sVyAk^ @i/qdz} 5 e콁J H/sLނ *>tXJS'eAjã+dQ,̽п{9" +#* {!NaS9r蝕6ʸMOݮOU~3Bڝ5u;@tXײ aR_rn +PCGn:x ({P;ӂ ƒ1ҔP8[wX71..CHyR0R17 +hʡhpn>r V/`̙0@1=v/Uֽ~pi1cUPe +ڟ:,aj" $릀/!פ]6T}8Dij ,b=m|g^IBq-(޼0ڔiBNL (k]7i^NtC1ylV%6+CjƥYT p$C;YlsW# U͆z>е D21C~]d6 :"WGmGezW&LO0vd?/"BX +9`/:Gu.| zu(qh'dtk&i`c'^~32F[k2Py3Cǁ=c/.N.kщ:yꔨƽ1y,# TX[iPt [͝ʺ S*( J'^:9[[ V2:{k(wؾ{!4cB=w;P <|{kPDZ ǖ2]b(d\>֊*)&pu@}#! jTjP3n߆3}7n\.<2cRWS`qj'xJj3AOM]QUϐv+ÝY6đo(N"S:o$Mmc V[ o7*)ZXeV5n57!S(*|ђ3i"EU%bw6_vD`n4=Pcx-UJQUYP{ Zpzw*}dgi>ܧ; mJ+U?h3пI2T4yg 0 :渎JKxx`28rDtAhQSS53Gs`N,"ȳ[-+mISeS#LP^XG(mq|֨rN3|W_ˍWE^IbIGL)Ln. 0°3T|U0+\ۙo厥L]6RRӃ$+ݕ:#G '} oSh$Lآb/*l˾)ZU}5={kfRbcf<LPCsb"R $HkiJ'!-nGmS*mD(82P XEf NTJI `Әћve{홼֦ڔ&o.:PRg)aZ9 x0EϊB x&yC+QE53*!cI,Ž%M;w~M,iPy$)d 7vm{Jg]&*àmBYK&T߂>7|ax8Uj_˩2hUnOĞdv]tŒuD` +CL{;Yˈ +Jd-n3#;X|[O^Ӝq +I*S4o(bmD6Ƒ-s-,,l@HHcH;vյ0đĚܖv7$I>'=.MuVbP;y2J&k_]xt7/qVajAFLo P}k3bx6Pb+K/XDO-?qa 1/C(Dǝx^!LC`BxgJ(Vjrl^E&X yjApDL o@4DF1>qC^g[JPâvm$5[Cc>r4=N!%j Iɷ9dL v>'P)1Xؼ#QrOğVhj[cYeK,X ;H)cHof9n.ęJTAìtufvƒO$*PQDcecS{h[q:px^?q &P~_*l]$۷|yGJPʈ z;g~Y23bK]QfE5:2@@DW:rf$"j)sQ)۹v۹&PRr<ۤ+ 0q-f:QG[JFG>w>g&F;q'@4~w*|ۇ!)IĞJt{:uۨt7Ȕ`|hUC 1?PԎ{,_Œ4yQ"t)~#_˼Uj@RiQ8&chT_nY[) ,Q$ƆcL7L,:jcO @MnY1IFp/O+YS|I tO|IiJ:ncicbnPJ:u%>!"8<;޳Zx3 :ha!+Qb=DuT!G-;G_*!ΞtO-Q`kL5xlMWJZiha}KX@s[[7k4.G嗀S1;vSobLG3 +2.~!9/6gk9jxQ$W PdujbfgWJRs8n7 +LR _t{GVdZϺNxX_x6`OiMYMq\U0 K.F3ѷҊ@tV; 2I-m{rO)1g3N3w•e$ }A>-+Rdkkvsp8F *vNjʹc[Pli_rO2M 4ICf*jHpD)034݅[NÝbtpB MѾXRx><,#{񆚮zZ2?lt<<  Ahѐ͙  bi` u;+H(KoA E[۲tƟ c3ƒhԟ'VX f6pb|i'֏x>tc2rCi\m!eFmG3mGP>t0FӍ'TqE1XY\{~d͑e6p9q[&RSoMaRa44+u,ĂHR?eᇼqX<*eZT 1\Rjl.IS{{/5vݹtĎ#c2UM=eIKZ4V( 5ɖ_m@utRb[x>c/*"I0K_٪}2]jo$` mڞ$Kl`Vh>J +9|}sE[bf:[*cCT",QG,m$UPrFon/./z鸷*A>m qDt$n:3njz|CzcW27Zy2-V5SMWmM4E=Ƅip9 ПL}<}'P),8#Iq8} +;l*L4֥l+w=Rc8[z[^sy5r>e2^YUtu3 0R;-,mH ? E\9*oмeY#%?Q\ HrGnKH9&Uٳ/TΏdJBN N82z}(7Zr  +-}>^]~U=78UK ;bcUyA4 Փe,JԎ}D&z˸^965E@Ddݶԓvk1(* +uq&xi6W=ٝ0J;NRz鋪3$wz1Jlf9AU}JUTIt`PA(q,'wBIy`$)Бa`;`Y\5*! gn22__;qGF#bL>.>Z YRQ7Eᘾ?V*41L#;̦B.NcE[q[ȶYHԥG`'߻7Rjv}6é?/g,{ƫr&Sʔ-uH +j!*c5˽CvXmĖţĶ\8D;ҝBz8+3aD2ӻDF^$n祅ik!D/$v"wbX |xO7Z! }Een1^ðC +`V +zztiINH,ěgq\*a2zb `8 ^"K؎cgm]3*NQk:J + :A_:N zI&_%.|*ID7 n<8xy45ۚŏ,-`O&|PK7xz$2KQ|8±[u<)r;JQQJ2lqQ$^WZW*Jnkw3 +_u?nJWi7e1]%'?G +Hv xQO'J{}8̘gjE41IrU*#\NZQ2p$ڞ^^&d(𐯈hx16 ^rr ZxI)OE`[n{r&l̬6E6 N3{{wEgvE:NxQqyk%Ó O) !1?n_ۋڊpKArX HI9srƁ8ƣ䋕TU.+qLGUqʛQ,Uu/@Llͷـ|`ͫ*Nf0+dSy͵ڃ1ap/-Ob$ Dãz࿙"`M=q̗baS-F?8QcRyyH 6\쭻(i&G: +s,KE)CRcdb}*ȢeFn 'y0ˢ8e_-eirCI,άw1p籍on/ 2 H0TW +# #hr ^?fĪX)YMNlIATr!`;iUMZ(oc&;a؝}X8C +=茊m ܆a8_d\4Pڴ#lGBn]-e3"v UJh0{02ag4妗宯tqU~b܇x6Y.4ؐL&(y7&ޜRB $ & oN|ҼA0jZO[ W Dhw*J}X;8U M, +> +9zz)05 ;ɠjQ|U ?E + Ľi5̳{JGMCn8¬V N$STԒo~ogǝ˙ҪNQ18EМ 5 ='#Q2p [Qb)w${zp}&k1(V:h@}JVh m =$0XXd\i\IƸVoQ% W@p9^J³^09gU*mDGFn޺$J%:\iV#"B]χ/f5 X k&ziB\BIEݍ~æ~Rz3XJP-伡E>Slri,2vlS.[dd|wwQh!汲yjm__ I/ @O۶eA1‡|3,ZlRHZQbĭڪ \)Z ʇi1'ʂL͓pYf:*vF { 08xu,jkI8q zP/?V3>*,륏i!w5w&G)"d՛lj5JFA q{3#$aƧB~n-jO^n;:+Sk䩓k|NjYXeVofc:RMu*xJ"Rvǎ4K[Z2gZHW ApY%Q[S{uyiV<⣚AҔ8bZnt7'[=Z3aMÉaLr>T%{美;71rI"9¬\ZLmERGT>sr{[/Idx+A\8QD$Jl5m@%ZJ mxwLꛦG3E3cKPp# jjh#i]AjfYg-r>ŀWkcj%(RҢ +R%3! +5G;f69q.I; pٶ7O^z̽0Cd.c6 #a sHfyw 'ҿ97OT:fkivJ`mYSN7- ;Qhvy̢!I),X@=tqڟ`;ӗUavP $4S8zɽv62bIUSR#2m <{3ؕqu+u)HXӎdL?qzޅ#^}uW-fS?̊zJrdb$mxmk&,qb +$@$O{6-V^קQRET3SUO"@jINԒ;ږ}k}s^0ꇡ"hNIAFnϴBd&e${l7(cx@E_WQVO 3 +Gʶ +~6woqa8&6&0ToimfDκ}ʁ;Scǃj(EH׹8OJΠ*2RaƫO-JGheHŜYh!@@>0v/ۃmg-A ]@CǛg$C[2uV+QbTE0DK4/3UkU$-<2c 590Zgp!I[S5L0J1ص#Wd疆C"\RƜē( Z;K % cLTv@rZzWΘ 6EA<1-,7G.ЬہG7UsF9VI 1O/nN67"Xm;r&t 8c*b퇵K̪դ'T0vz!7NpbGQb[н$qՇ/A5_G0oLqޠCYQ]_Y,*Uy1x?w, mm^N"CImJ (8`i7c~P`ՌIƥc~dƱ|k ;i+'V +V7vQ4q u[-di谉iY aijH6;Mh2̔ҴBpQR i8ROyS \o#z) U*X)52f.qyFB]¢VYB{'oX Vbu%%DB`{x6^~|Z!Sl̒B$0%ҤQe^Y[ahVpƸqOxo=uvn88-H$)Z\@0wFVa̗~r;;aP(1\ fVi1ZeFYeXD$ 0YlgVOSӣپ^C~${oxwۖTB!e2u}q;ҷmCh$V?a=4)Jc"JVJc WoQ=$~GRGT{4tvs|45:c4G1h4n |\Y2W9eAS4S?qd$!bӰӜˊ rT/ص0tW,lCٗq4>{spF'f= :256vzAK:CpY2/Q +Ě&$J]r2ܩ1\N l&*ՂU773D{$wo38`$aRA`Թp1@ꪞzPN3,1JJW)v*r\tWz0l̓e F T^ +hGwD5)ygKFjJpH%]SZ~7K,+iEM.:uuxsjNZ*'g#V➫LGb8^#{PR3K>=N䣮{up9ojms甴8H +ғ80x8ߵsvƧ1WE":!Ǡ utъ'yUX" (,kܿBZTJ·oRt{#*h:LZpˉ|*FcSˌ X߇dd]8Wٶ?(6xNrOmǷGLM{ǁa9PI6{r-k/ejNHgƎsdMx Ƅqz宪N 71m?O T"! T|/A k+M0˃PSy4ՌiTZ3['#AGLPuy̓ڶMq^5]c)'*9,eX5g]έ2A;G҅oKXp<+Ў=s&|p~☝.NV' -_D71QHRAqضqd$]*H骣xWtHS +Q׮~%f[~c5N'Q+)DB]vSn'{ {6Х$BIpQ1)-y# $E" Nݼkl`HN2cK!O ,5aSGLiDu8])/A:Gk;Xz`8 )ZH:Mw/y~Ă'I ;+rNޔ'T[/לN: +gJ"( 6 'g?T9lcIPsbJԀqƑd!IYۨlp&/D1ڋh,ʬ'Ed$Ǜ[ݩ.!@O "*O& ILJ`8FjToq cz‹sD&BifelIO½''J 2Խ%lU* "X\~z2,BVmn^r}iIԥ`Rp8> O6-׸zt2|V3fl%J\1*TX<}<;cn4Wwkp͐BL蠫&=A0!{Rt +ba#c߄oo͢$[6BzS̘2)DD܍X^700LcК/uWV>]t$)qb~דp|v6ںyzH=TJ9˫0t7f 9B u:]G9}9η8πzUw)}K+fuvO's08̮o5ȝ$N@Z:|2&O5T\o&!yH?T>?i$ba}Ձ9x$8h bYU=0VѬ5G!vl vѝ2=7Sb2&Q>ZF"5P=ߘi> {8,P5Z)JaNo6PXʀ3F +qk9:zx9~w$4KXbzks9<7)o 5 7(Xq6?xtaGGƖ>SDdXkx7h&rdz,cnVd}t5&+O8]mi "o-3AIpcYt4uHwHj`AꉔO䫊h˫wԛvtG% ǿoBPW0TGWgp(ԳYM;}&Ǔ$:fB4 *.I 0,k $ PfQq,U--[Lu)}èCp PV+qSH%|5sqFVƺm^Mxg91=zk%EϕU̲@RM~OZޏe:=N3>LgLCU:UF0I_ fٟ緖NvIAm01F>j?A#a5ZdS`D)v驱DOcv;[ŏ u<ɗq&L_ȔΞtNX +U[K}{2RZx }]f-ں/!aiY#Q-wto?}N>9'S~>PuVU3#]ʕ +Jmcn0*±YlXz'UD1ԃh.nAGXlD8vj\MiKږ'(;/hٖCbũt)A*Tĝnt}Mqy %41FulJbxU/#4ؓ]_j/P&ԹHkdmdz'0T!@v,'M˲bPxO'hk׹P@#A@84H\$n]AÒ껫ajgn'Q£!(6v~Wsr]BѰFI$|ʉ4[9N+$$I>k$(VZJ@?(W^];B+˜q|) <$nO>#18(cTUy%cb챆bs,Ap'N!'&I$ir﵉HԆo -7.6'0JAơl |Fa\:ht=#ȵ)Xg 2 3UT J<@=zdX~eZʺ)s 15T5T5jVFXKF6 k#{7y,>%PBءƁއd%XԐF4}S^I +bIj|&W h<{xpvh@kM?t6e**P%D hFqȝp2eXZ-uhQI&56As6)P=Tbx 4aJIij#>Y+;SU6bCX]L\ϋRcKB4ph#Y^[i\hux&cH*|#WFv٥VA@&cp&&5M rN%zSuS-#a@Q`}*quJ PauWU&Ù}sWZJSaJ ޳RDr-@@UU\np+ίt򠝐25%͔6E >=j]?Ypڼ:J/R(3)SSC,TxR4 +Um&+@x&>wk([3t6 +T6F&1XWg`d$3F_B33)JGOCˈS.h vk["kQ0b^A7o[d^;+knRcR7}.bHiK2fSpǹtP枞'`I$c;K1<>xfJ  %F O54LOI6{۷!{)'ovűčic9E*WfnRHht'[ۯn+. X[k~j|̴aQoΝ -MF1O2b@^ %׵sdB~7È빼dWQ31?::Y*k1swL88uE kwۮ($v%nkx>4RVhf v$60GV#S"myB۹/_w4fwo=hڡM-dI ljGrJI$]bfL/K-OP#N!M +=Fٴ~۷Nft{r&z`]AJYR&AROؕTpy璘='wјe% {JON+!L/ڂPp8l=DfFZj|![a~?b+PpYq%)ަR(`X 3l I}hF +NbAfc`ujE0.8w{x@RL@#I3=em1 ipw Yf֔U+CRӅA+k#y3j^Jv6i5R"d˙lj-o.l}Wy|gEW:@qx׸ÅUf`0 +i`_(42}ػ*^D=ܕq8W Ǫrq|;\O˕"g@24r1aknQw}G]rv:Tqv+'qqs_]d`DcJn <kWSC1p<y߽kχ-ڰAsXJ'pVƜ2S2Qd앇ٙ*pdce gwgԌ,X-p2Y RUA)11H=xw q2lIE&V'= 2;A<1쁚Vi*<ɖ*^gbHg6(Vև╞[E/Kp"9 4dYծ%rm[)HĨr25qx0M.-/!f=lRIX"Ufjt?`|yϏBpXl>(lQoS'{hz8ѓ ~3T*0::DͦXif&3v0St.{]E%\ʦRw#B(}ϡ<‘lv%K@|!B;@'Ҁ~1y,T?m ̑@؉zT Fc<1-uMNfÜ%&3-LA>68-])HeA fə~cMUTυ=n')pȨ>M@*{9IR`LWumq>fjl,D" wUHFm^7Q5Po/u8ۆn0Hٲ#'ZLzA?k}-qxV3)v 7"glG"@Kp+l=>G9HԨ%Nma}9q Dy>UL+n1Yz]>'\ţ M$?e6\Eu9vZ3P6׏=eߚ-,H5E)CcN]> 5:0SR|Ti~1u=C$]sh=6΁F>=:j +&z4R`@?elw%y)Eѵp ՘t*=[Gx`hz7I:>9Rpʌ=ck=#QbQPYfO{vūE A3ʉZ頷?K=ҸO;K!ٷ[u\GX{xSEcʈ jM(boE;DYt[2X2oAaau/zW^ i&MF&z|[%|̰ӕ̎365IWQ}n>]ҥH; l=u]$}*?Ҝf:%4(~9TVhv|x"LOyM g ?as=U|qмϼx;r5 'R/m.z]^.Yb2zF|9ʭѲTp[+q;6ISrp +9?JEMUt&5F`nXe*\}mx$U͢z⟺#LTT=>]6(pHe[-{'R ~Rfܱv_T5xJ5v]ƪ M|Gui)}jxcW51NJɄβSV"6e:jCŹŭTFzi_VD:=B^+ԬcXWTF)ꠣ; ۷n[w75۸A^QEnd¤:fSIV#N Gv^J(zW/ӶY4ˇY1>z(:$JVHnssfYS8qi`DJH8T|鹕kQj>WG _`8++b5$Gs`vD\&4HI̟CPmoI^IHjJ 4$mu&Q6TbźmԱ? +FWNa|&1@%0c I8Ī Swqz>P1OA`@~٬}8J xAΜ0י,.#4Bb4QnVUb4Y9N1d8~l6X,$:xB%,@xݧBKpH;Gij>I-#S*33]e콙SV+0T#4IV1Ti-(Y3&ʡi,bY,kmqk/g܁B%eXc=X0&Ioki5:7fC3Rp<5u˴ؕL[$RY"2w2\Onsw~\n(tu Pv}7omӆaJ`DjVIW B7q{i{p9 OU_ k&weA*yg +@ќ6GSptUJWY59^鄴V $ >u#X+O$_FYupHQgښ|~qTR%Q*"-D6[uG\8E}n_+JT!*(l0Uf:LC l6 ĭOu +MC.f:On:&<>tsU3)Ţ )L{~)!fzYaOk}9ݲZ<?E/C1 Va`uC`3O}v]efˤ(ێ!* A;-엷۝?*պ(%d$ a4W]{8RERƺC\{Uj֪afIᶀlܤ{q πu#4r ^vd,<*wx} w|¥I&b1ٲqNJҹR$Bgt{8c9.L? 2^&j`ly7գ6;k̹I0,T2FU$^QU;C?hj5yn~'2uMjG({\YBH%C3< =fOIz)Ph\UQW4$|3#)Xݶ7#t1I|]򜫉S5 SUEfRЩ$:YJف~ocb +I=BDf< +z[IԪuc+׊S +Q 72U*&(!*Y0 P TbTs̸SR>!UkR6ĭ'z"kGU>_]i1|#:c#3 iO7uӖ8La.mڻut QSeMP<u84&h)L*HLqDɖkcv)Zpcydθ)EjS$L .w6Yz +%GNy\K`4mXRRG3*BsovS:w䜯0| g3+S]UYQU3Kf.THF!@-m9oՎn l V'zj)nrl +YD@=*P$tҗSzǖNt QI{h{^1S^b$U(JW`lL[(Te2ʋ>'Q ġ]QC$krX@v2s\^&YiSJAأv +;}?mfns?j*ؔQ@oOQLHAp#QB|C$~/*3i k@TRuzch&BǙyeQ7'Jv`R_~Qq@cI y$$:Ory>0g .!->E'yhpa䇊 v9' a~nh*V=g +vZY;0⍴X TD4,+mK\,?4KJu{y]m{McM˭H6Պ,c%7h(i]opqUXv+VK^Q:I &YgO7ɂ=ѯ$X c>;CrԖARn$)܍EZa;hz'fi0҂7[+>>pg}aHcʞm=Icc8OJҀI 4Z [s BHҍZ%I8t:K~w8uuTFʖfvݼ04\%`YNf ByefHB/NjwñM-p<3A7=dҲR:}j>f\ř}֥Z2=uu1>[Y Dȳ+4.@aqȇ.3ܐ%}$OQtV[بxZW/33aOYg'!DTx ws/ɝ|CEڊ>V1:-iҺjB LK!‚tHXsxDӖ7 qZ׷i׸zb7X +4~ TRב:J3qm6DF&^fMǦnzyUd +'T^1bFWVNq.y %<:v}(?:Gyʕػ`|omxOE.%T(釙## Q<=5/l$t̍!Ƌ.:YQ_?R)8m[Mer + +$9ᰬ)04kn af֒A"cQiXlD??'K h' i +ʯϨ!HʮVz'ϧ +;2e 1(I]9g7cqL:ZjxyJjK}yiwVN6'T}`@$Kȧ09SFhT<'x#^XOi^ o0c;SLQd#b<{{Nnf+&Ӯ<]=tr^lœt{nOn-?F57ȼFui}qvG9Պ_:vrAqj>5U`XMiFrѰt6R;=d8auN3Eiz^ic[dK"JCKB(:!w.EOZ޴ªk(oA H0\F%%M­mo2E e8;F=TNs<%}TxQ6z5J|I&}`e,q)ΤukcqƩsP3u4u 5,< IIOL~ao[rvGs~2u$|Lu۹ +mŤFxyՏ~}HOʬpڌ=XEUU\ +Mȑ(ۮ8wY]:i_1JizZ$B8+o{xrRêNС8z ,VIVУ1@Ezz6 [ɦ !9uE?Wף K'fM`}@8 +i)rAbBw%Ms6nD`J Rkӊq:(}YuN%(Tvٚq U[\T3a,B"}ɋ;XxH>b=(#0BF2Q3O1|{nks]o9Wsgy>itqas66{N P:$W  +Rln\0%9 frQ{Eg,h EM2[N;9Ndxa+mMY}h0$ +N$y/T k+WE1$s q?$RӤSiH62ỔI=OxӽL6y`LJx໱ [k{gk>eu@IIȲ`qzJt89 M$Y%jʟ"%YT49aGhɝ$2maqwf!D) Ɵly¡3IKqjj:ghXYHƺ,%U§hOb`Gy]-7Ջ[gMJ+;e\ +-$vy2N8-"XP=puu+ +mƤjgʋH=U;e4AhjC]|o=BTzlB3  \6{qm$_[Z4ߝ3Ԥ&vLq uV`fھz/1TTTM,EѢ^G^;t# ~?VuK@+`)ic4R٭Νǽvoy`ݣtHN#m;q #6I΃A.Q3lB:7H:z֒f.,kY\\tҿaJb|ǸxK8˾])%!iP4ywwl; +T H8NT/jܽK *^2Tjwy7'_Eɴ KO\k!p0ɺUpUp-kXfW[Y;9jJpԵ qϱE.\A蠏WOΘFrDmͅFn537uGjH@$,wډ0]CbǨ,bye%YlI̶9-$8 +LL]dtNR + żW fԳ-$۹c:]DZ\T. * c6YsZyT.5<0ݮ뤫.}M@SK$vQ[N|Bv;?K韪8.V+^A8壐#Y)"7$;@pg8eV BbyOx:6f~biR}< &W*rLNi]ޫnYi%B Y8 FzSt`Q޴͒QGV8S_~;s.j*xomA[cR@Ѝ>Ǫ4ˁtY2LpA3%8(ZFWG@4 rtwkTq-n]6uYA(h/%zl2^F}%6|<^c*L=b1xYBlv㜰 9LFaxF/>9=rISV,F`Fj=kY\t$lu ;zw] <@Bc:I.VfTbQd0q R7)_Vb@dž';=p,tZz &b[[K[;sX;+) aRw#N +A1i_^f ݩ! L;"F{&MEUG*Sr  ;t2ÛqW1Qܽ=E%P\A_ jGndjyR6^TKoSkrQ) Դ5Sim!ǃaYwe,i;t'PKS޷ L"8 moMy/"~6m&rKEca8iq,1L:ܑ<Ee@Z*@LT_WK3PX n[^Ӗ%( +˽,:)0LrLu*h#YXex=6Ӱ7eҊRDj`SLJ=e-=q8({0'2_U[gfC2~)Kax>)[φ` a<.7~l'a8OѫM֤:3qc ^d(#2M3Grxŕ JSvv\:*8^ gzsY76J|n(fþjA"M5n#*u,_IJ@y lJE{ u$RxHx\jidl3k_ܙ r,r6[45Gmp>ŏmJll"d7oN%R6!NG5fK6n0|#9O&+uuox\(2\V\'3枝1>d>Jw&v&-6u@#zf.8tLk%湱h,sm T 66%vX, qo 4xF\aP ЩK1Cە|Jwy[|8#-?DtmmK][;)N'%gbRRepWP;_ۙpq#pb C`4ejp,b<挲,!\lSdxh,QC ,Pu#SL2y1Ѝ8}o+n6xl[iI4ӎm:CUXz.wXioŮGd9k\fUp}v\>T4#lzyTᢹ[K]*0(儬=j#fkk4ӝA5c54sc&}c:Z^D +J`D&=Q˺}uߌc+OCQFZ77|zծO?r$PG%RrxV$A𵳕$1cO12m|xKhIBՂ2ɣAqiq]}Zi5Z"+'`RTT*?K3X&-Oq**H(ϗě{=*:IWQ ۏtVg~ƔU4|\~ɒVF_2'}|th*#5"vqRdl3VUJ׿.B U @,8NK˜mt`xVŕ%B׵p"Ĥ[!*`{ed\[,PG 4<GbUYIAUnW"OZ Dv;dwhq5z|R$dTK+=̄nśo6w0S+tiԭ 1);&컹nAPt`a&^9{ȸOOp1QyQSBno%ɘ5LURt<7g-ͬSԤӎôpu3Vh}))$SBة#^ɗLVqd'6"f\ACbu4Hevm,#%SzvWq _+D( X+,/'_k>)X#GbtTa$40G\17g0.t+(Oi{\vI޼.[U۩IEK҈+SIRT:$G#J"%q^8+ +Yc{z_BXǪ?$*̽GrCC<5A&<̩I,Aثkn/|s}q7-ww !D ?swxbY:QÉ 0<,rIL~o7:"G*՛$vbu2Z`]AҷXXN%SGʑځ"[:HP;[ڵyʱt8kLL t4]^XiW{ mNelV !Y'1YH׀w$T>j|o/T)`F*̲6 o7\h.iR w2MBYP*F؊1y_PoJ0zmQN!è(2%WM,I߿Y'gb2ܴĀƆ=ZsH²8GhҼ@ }eV+m +V1W/_WbǍbURyܭ!̪8F匰@>#S5p$Q;I&X\\]YU$4k*^E>Rmb -bH :N.Sb4'x& )}-\&7(DR\[L_ʩUJ2>v m}3Kmָ",˷+8M8*%O-I bAGzaњщzoh.E z̓.>lnӈ)^FdiC(JAǾg,[4`pf|˃`*\!ZdHĖ)溋xs]e %J[H) + yXlfVL*ӎ4nV` ' hخsn~;U~.zRz'yf0%Zp0 L(% tS3#$#v׊,p߇VVЕIZ>G/3G34QRdrSL^͌Lѽn܀.:W1t{.SdBjkC"4f/{3os˥-`NS~}d;porc_F3Q#m/ {6O&p$BFު+ȭ3F.l2^K ~L<~tĿ8ygJ:Pd*CrPl{i¿5^3tA"H DcM5G1 kBJRW#:6VZ:hj$9+_Qzŝ~e:q8U̴&bJۺ8`fۺ .t0 1keYZ$;=04DkG!yj$V R;Zr6 ɅVԫj1XGw{J6w߼Vm36*IW=m AzN7`bbqMaA[3Pi*Ϊ4Yt7e%( #Aڸ2J\ :\pԎ6c}= Sfjjд4xE*{ͦu8)UH#py < ؓ^0WzrJCV!cf?HiB3ΟynxGV.{-s{oUVbt5)ގ5a2J;xȡV5L +l~fZXY$\m( n7#ܩ7f_D$Go |4XoR$mx8~q {{5hGfgW7蔝젵p]Q8Q$T\Ulj"+*=pk ̸q@ڃmhwwDxp”zCDqmj+-H؄ij;w^E{VVӊJ)_n˩'{i[ږNΚKph5m%[VqFVDVHs<|-e%D֙ +KǯR>zGm]Τx"dlW%?#+KnRh\$z +QsՖJn6=>ɔнI<<`HƜeRV,ũ9P!ʀA㌊Zݺݗ5h)ҬG0(L.H d{ +}2TL϶%Wcb*WVFO8yƋ7ݟ +iÄFEk"s.'IlAHmߟڗYp[g//S2:8PҞbV%5Vpiq,J mpokSaș=xOBÇyHeJ; ѳ( RD +[tv s8%!ul@%Q0La>)j(:}T6';o9E@F"(ntXk*e}*Av1c1Sr?e Qcİ~Z9m5b =+ٞ SCˆI GC%!b0 {nu/ߌYr=)~}Kd):^0S//Dj'b.aEhSy$+ 1br8'qJ~_UU&W 5L4h܂ NKŞdY\8$HIJܩJ@cTTU\t|RWWU(bS#1UU$VS|̔)&53=bP)XnƎ?g"Ms/imBTRtbTGca?VY@-N.] qGשٖXcZS5pHiA`X >:pMoԍnʹ.Z|ҴK) yh6sɹ]n֪~. z E k#] z"^tۧ=0)0L69zvHj4̖Wffc݉<7׳;vS +Z3EF7}e޸z^뇨FO7Ys4,"8iKmFnwmF۳nV$tToy{q'GNa0EQ?1>O$B4l-cN {`+#fJ;t2D`~/ez#45e6^-M+<'wTibGArt6^!KcR;&_ ,R5ĦD҈X!OLt51,t'wmG f`ͰU)p<{׹96XdN (%NJ[粢x/<i|hjht:~BwݢfW%jGʈT IYTSbRGäǶLIS絬ܒ)FĦШP 4?oJe1c]VõnJwPP=tko.-!iP!IV H4*zZrI(G"rEe%M-]㣖C+kq"<5iBfJݰ +R}Hkٞf.$<ɞzYO0ေm̰=߿2Hl~N ̐IS X串3wm1[{}]۔׉m$m3 +h~N_Xqac4ַZ3N^(gsp'x"EabT . O$dJW3Z(E2!<H +nn3AMwo kTAԞ4p iDZ> q:Js2( k[OWjz\o䠮fQia*˥k~\ƎW2'<=ɺ37mڌ:AӗJ sVC~̒D@cpq6|e +YLn(ЛnF(Ei0zh+[ sC"E驰LLYTCހ"nfrp6+tBl5볝4Au*9ҔD ־F(oi +]o!KhWIhIdZ ɀ=~C'⹒\S/K<7tۄaG2${1R(`|vTf(ip" +S] akww/-\ )JP4(^Z-R, ( I> +Uٛ +i90 +0BJ> %="HY4TRV8F1{/s0:bDb8*~b1I=CfÔ)>fey)# Rֹ `E'<9dQ5ňRUuXA+kIgӟgw{ӲJzP 8bqEem]dcL1 ^?|K3]&Q% AqexH; @&..ZNHޱ~ >Xg.=Ռ)L4j%3 +XX{Ǒ׭F?#->)ʰ@*Dhn@:ndeHJTi3ܛ4h4HO0GGDxMgUoY_IO˒S3S^bM>a߃m2Ԥ:1|!x.jjg1FH]J>ܗ3E0xE*oWVQX\Fd9%:5 Tگҝ%kĐA 2#ٯ9Y +p<>V!Ȏ6$]7[s@~e;F)ىnE}upV+O=tH\ +V5mQyEd^:zzE}1ޥeo(*::IĨ%)kDzD$oCk,#C[^\m`)Zv(0Rx]s6̶r@ +&p#Hutp )۷q苬:Y=Gd !2eȍ%B LjSScPKNmԶ+{/m%Am,@Qڵϔ'*9.ڠ1 +?X9/9 +{==U-Mn3Eol fcH8bL@5YU _;{7L(a18>U3Cьbq]_Bep :ފ,sQ%Z\SAGQ-UBVFYXnbt}2QV[2RKeӋ(VFP=1SѻzZj:0Hlnus\N$L T`Nؙۿͮn3-dO'κ $q,ϞrEnY]›D,|k%$P{R>}K3\9zE$o]qͷ|P؞ҁN]z{)g,PuB*I+iaf&O[R)2I-i}q^WWn,eWLHf_]^ Zf\_+qP;~na{LԢGGEVNޥH340Jūq +KbhB/bmϚYS$K)= +%yQFUηy+ǢۭL)E- c"in=q=,&C^]6. + >ޝGr +S&1jf=d,70 T4T)k빀˛pIDh(LIJGbYJ*>lQ< |*24Q-@r +UE1f-P/UY+d)p|WTIVJ n%6T NqepEW$aoX'$͸{UvJj_ǙV?GeHU,IRP6VCEQ+(yͯBl&ю?y18*. P +.X IY%-4A8^sf`d>U4.Ǘoz{3Xle$1Ģz(GgrK[_C~>Ur*cO[\RIDPwZ xPWاS(DUj#wT`|Aao/y2a~v'x0hHt+[ÛWfi薛B$!UZ綧o#A)@Isps2HXDŽ몃3C)i2-\fIIV~d7PVaEe,pW]W]yvÍ*YeIjz Tٖw*X>xV~~sSžU]DDےVWJ,nNCQ8jFȷ9TiI'm{ANuo.MX5hgY .n9Yv&D";nocqc"6XXǢC:T3-,!aT$jX{8f*Ho[H !eX}죽 +'GzDӦJ9asCW] aZK'VU!ۯ߄Rӗ*::q㙦+YXY?b4k8zzE˘jTGiA%-KX?_3-Cߗ5N OOGN۽w*ZrDfgnhV#W'{ ,6=B QPy5cYRb0R،*Qf؃Ki +,/̪s$$‰=,fv ,bf +NR1hBg3bgjO%joG=+k}248DǢI1l9z6)R,[Sjm]8)m3 6%bO +[bom~b Gƽu&Z@VeK|PWz[hv =58ƥ xSJCF[ ٯ܎G;&ɬRGI=C79; +S} {SCH0JØqFcZ#[~s̸ת +4aUumE +ӚS@DmFo{UΓqh~Ff=KB Ǚ5k?U9' uu|\[W1 uT?%IO…7_$Ic(b5$I{Ack7!狊G'ʕnhj/ <6uQAo>#b؝VI=$qѯLM(C[zG TU1e.f\4l*蕚I[Y ˓c[B\dئ&@ M09k'V)AUS@Ҙ㪖5"s{mMJjY7, $F3dU܇-"E* 9"x& SBPYm/1ʒX.騪0꼠 nPe$ HogJJ]oahDHwm@SUCD1c[yۀ|mɸDyZXǛ+_zux?4Rmmڭ593^,l~Wbr4W=r#*}YYHOWbCv&Eq\l-?.$>ñv+tSsz囓0߁N1޺^mīzQiRPEM*w kۻxre]Ow`d=o-Tsalɍ*'G?u#JL0=R6au5ֶ":-:u&l8& >sL3OxU3n}pz{CujZ} pIP@)iU7[1eјȘr26^F`)LMmmy3f-URMDJ.Fԏg=otR d|#( S/zR^k!3~-,{i`$E n7ko3b4ض +""3UKOM qt߷F}9-"婵 'Q:?{&y i<$KC(02F=ӠeI,#TQ2U1Lǒagʬ,QyNϵu 0n4ߴHQ0q&}. a%q +' A~5[Vi[ {9KTkmNj羖"LK,>5΂v;y[nhv'F/G&ggIp")])_$8.(V!T,:Us~w,4e <;?U؏eyfm"[ +ճ}ó%nO$X 'K_C(ȝ-7L_尌'˧T8DvY$-\9՝u3ڡM"H6W˹r(HRJS00TYQ%]Sj#?I^bNU3vT6,!r觬G,@9KM=n܋*:`jUlsrX7.L⨩v2`})6%U,f 8/nal76H+\)o\pYZG.[n$GU)E5PCo8ZxSbWHXŤeڤܭm›dEӗ:Nފ1 L7UX>qe,xF"uP6:=DQXw_I먘v7璒0#Cߙ3:\4DBl<vwq5#+.Qc挥S19 $fEQ׉ܿ.U5mq_{ܦIEvw3 ˨-caI:GzU1//+!3KYX=5`o yEVcv sʘ| ~|~z|-8GbHjUy7US4ji =ƇqqŅ25a "vxQ~T]aE 0T3\_P$c0ʨ$GVq=!O:ʊqKSSwL8:hiGIϗ꺤$ƬF'^ j\/.*t:-ۜ; +1Uך*icJ Ă'mN㹂uA1~Xe!^2.04KsETeEo}O)VdBcvT8d(.[+"zYeN]JzZhhT췲=Q9,N!PMWͭPda,0\L:ړٰvk߉V!<-5ӆ .Mfa +&˫9٫dF~$`ѝ:5ݯ~f↚IKo2`7y{K5 + ?wpEVߨ.dn(UbDt)G:paM!Ia5TT&E oxiĢ0EgK@cVs8a=Wc$z,͌UK`%}|w]Bdq~[:ѭ0Lt>~kf_y;F! 91\<η`_og۽;'u'TgF%=DqQ:p6Nqk.QJ]KFܗ} %ES`8Qc^sF0Q85u4YT墧D32Nn8*t 03mQhi!LRd @><- sW!zJVP:y;, ;U^āhfAwhc!j:'hxw:7LR5 5~uf0W:Fʁ jJóq ̷Χ͘Kb->A|ZCˉUIL#i77fe=bd:>&)o8])uE3⒬ґ嶁Rwy rU1:lӄx\l`DljFP(8~&yN@VcO3 +%4j_x =3$ [ɚ7ҖxJ:$nv.԰:N ^ؾ1[QSab$eV6Xi &CkR<'EJvBjR)S nBGl+C8(fe#XX2 /*],8/*f}5=3mCY,SV61d[}p}\QynvBp![a]gPhMZ.RNM2-U2nZ҇ϐHRÈOܳ+M~p,^cf +Y^3d'k xrB^ț߇'%l (41+.j0 dA0chKKX3=Efqi1pJގB0y)bWUԠ =,cluVvNړq;heHr5uݭx,I{4Uy㭑ðxgݘohG-̜&[fVOMf+إ$o;Ms>WuX#OFltL7K{JRUVqwfGN i06<8$Xjș:Ǖ0Xiؾ")Ӱ n&alӰDMytt1\ 8Aݍa(̙iVV[vN@=7LOFB%oHf% u_.!)1Z .\\XX<826#b]V2[pi/)Db{wbg(1\:yrMAA#UE6#mh6L )B~'Vm$¡5Jq ၓVy>lgxTKHo xk̀gcYW'sr<"-Am,$cK+ G4zƲ3ɂhʵ8\QV;EEv6>snB+f 諨j8 J:6\{A^,ݍ𱶺 `U/2Ct:D[d(Ujup^5Lɺ F ] 6eCdD3s|Hť'(9sE:q2|T.2O,LDŒMA; ks` ڤ+{uGv d)Eih 'S%ikz M)SFpk_C/{JgҖ/~Ru Bǽ{oM}ƅ]bO/j0$/X~Qd Շj +?uSUdpI 9"6G'?BogweI@CWIA<*Bުij4EjD ͤR@No6ZORXC`j{xr=9K/70@ C-Q}:՜cvDUʽw1~][,8~3 +T.mCY7dVk6[{8+{b\:f=Hn~$[p1󢿎~%85M|'XV^,.I{X߰`;O2<+ETF9&vO~^ͲWݦO@RԵSJhuoGRz\]BYi੒0+'ho+4.SacmE#ݥIJ`)XeYWW<[c4~}}4tKy<0 l 6ňuw)m DI%*p AZgYnH8Ha sbW^2a: %ʩxm/O{G)gTu+8ZxGۼJp AQ!FNr[ș?T;n-سm{ jy_֙o}fޅiN&\޽b$Btv2݂3SQ,?;:9u@MC4ǼԌMH9R?l9W!FnmXChJnNYA%ۭԅndjf ViuY~M FXaH)feQ{fޒA?T:Ń%Lk5=<lϙǧ:= |>♒TzBQGDqNcӆMq;UN Qoou{F@c֦),UC&v*wH/Xou#xǗ!ji +IBړyn?`Y^N̺K;IѾvokdߌ(gP9#*͝:زclCȎ_Ŋ'KvYc6y`vdH +11JP$0qΘ~pNcv6KRVCea'$]pvє( +A[ GQuշ)nm7(R"B:+Jgne1T(j5>X x:w0RV "vFރwcyqФ a^L=4a9/&bC LW`#+K*(n v +JUJxQ([FցB8T *#t'oLgY>2tÙVz[4J8>@^g3]zPUޡ$c _9"n_p J⮭je{Џnms'zYrEP >WYA׽ 8R(r{9xߊbWbkM9Lʁj, wC]ڶZt/FOtU6"7o-wNjVэ7[ɻ+/:Uu?*7s\UwC NJ,+)` CŌ )PpdSeF?,rHwu>Υ hVCwaQۄ;xnu8$7KQQSy05nAUVDYb5ۋg1:32FJ1P@>˓{f =eN2tĊ fD7ZD# tC̔&nʻ$tײnA\_fSQ,,|V_sf>F"6~xg,^\0뭤 1V,;g z\JΩA1O"MsWk$Ҝsqm}x_\BFf͠(@|_E4/U߸eq-QÍe"u/4w$I6am߃^+ +z.KJAs9QTzK}ۋnOuԹRTsP>-5kX)V4ͧ~驦m%8F ̸ٔд GmebvEZosn/3g`\>d}O p|Iqˣ̝NjZY+ %Tjl|yxP‚R45)i5O| JV'dt*/,rJa u7wO-.\p e"sGO9ex)>Q0 mgBpN3>JVTZ,OߝJ:MA 0J`ߢ,t߽KT"Nhld~Jف$I[~ qÎ9)&6<'wWzoASk `~Gyp:21*Չmee }XĤ4LZ}Br7AUv-R(4 ݞL[YM8?[p8:Ub48uE%3A4jT}P 7h0YQ2Bj6so l87 ܤM ;֗M*1 +|79a5& 5ˤS#wS/zrų[3arR!㪯iLQ.fѦ᳼ka.Jg8McG*wR4Xɍ7rG9ev[orw~PN>0NZ4CE5H$bvNpY1*h{5˔0ڌ` +  [\\=B7QSg$Ubjk$iߠ)^ <[Y GJɏ_p\r5GCh蚭{=yU}'2tQS4U4yYc]ɱßv7Y}ȵ@IZ?mvQNޥRx3AFC}?W=V̞5򞞢 Z:xҖPwFK q%BYh;]mMxctijfߘOj¤1jNF:=uKC5]bgE3[NM+2X_߅6mm7r>~/,[ЕןQr04)2q*#J6^^2$px YNֹVH{y6Tvq} +訝O\ɌR:L\tp#A~}UUtٖL[[MTneJR8h'^ܘwku"-HJ cHtm-O܈:qrĨs<;A!#/s{y>ۊUdc$E"!gEbtJv,Or;YH$8DۻN RxGG]5L$SY"HoUBy:6?p$h̻ݦBϘ\E ;"wurb@$+i;}dϝt׊z:z߃P8NՓl:A7R sZb1"J,7$KF',DTev ;)0@uH5N=j(3~ì:M»wu?xzz)=qCCN-B|aǀD I*c +uy&aD mAw,5a8_Υ j(^;B w_l7L.>*D"i"2=3-~VU 'xR77w1ia}u Kj)q_#W6G 0I Rn:(g5fcX*MHcnx0 xۡ%zO{]M ;l*CT +IpM\='~#]ŽA9 }Tت:j9 WM%4d +;nAK<_ߡFYB ++g=ff}YI&41߻U·;ӖL0jUf~Xk1LBZe b;pen綌û̞ r0R&-C7ܱA.Cd$&q$t!SzS>b}i=[X殫KE*TP8 f.TcaB$X*[;}>v[z?i+r<@}q͗R@tмSHزudԣ0g4~7WjllOyr @ݝ7~>e|JP\{S[G p `]5z~3fP\*4~uM^ ֞R:n܇{M2\(R RITmJ3|F\r@Tq0dbI&}vmE8w:^tQze[Gw IN,PY"hEpoAݖGIQuRJII ;>T GoL-%.*'`#n W7H +8Ӹ<=3b4\3]ɴ"Za*GI$'ۢ)[lY!vyl^h! +t%DÀd9+fIصN-0]Չar[aR`ykU)f!š<;pv^E_QK) Kq)SuIفwi4nԷ t+.O֬ɋM #-mron-/YhN=UoTO2QG+XNYm7\ngiv6 ֢gaUݻ !ٔ!T}Hx$d-1C8X󮱚L + y\BvyKoKv=G33VR&a3XV;j Y$b ]> +/73 {M6iIu@JR:`bO@{yomdZu +lᱨOKBL7-Tx{=~+L1і1wHq6CnTJmt#x^WI2U^0`4xry50OCOEdi +lWJ&Jq.+q8>xp=5-\o +J QUyzyisy=D"(i'MkKnߴ\hlx{r3g._x)cP2TAɠVl^qRx6f=q^-.i'EKEYIUMRY +K#2He7PJH#m#fIu +)%)P"'ORX/0:e*l2Uy _)*#I=w+2<9[k:+`#?2ܦ\jqׁ hG +OVV+m9~l "22"rbUǁ9mg$#d0 Gǎ{?Ot[&[Xԃ;A?*X`SI3o2&1T"x0sYXiKnݷV'XVhf(ہq_̱"%՗Oc--iެ6p\SWΖI)+QPNWi!Š|x. ؜(似3Jg5}\xj97,Le$L7!jc:gwVĝPیqs6zF9$0Poĕ~crqo1QsZp46ޑehCT:M`Fr"kŞk_ܹ԰vMl҅(RQ9*Ij )&VäKg C OMum8l8aGZc΀o[ux "0Te;T6Ua`t*Qf +0VZ1sf:~1}YŦ)3p{ 'Ҋ3Te[.6FOq3NլuԿ ϝꬭLuqֿ s~v5_Xd] tU´Żq5'!znñ$&XnH׍X&'֌-,Vo\Jp:H8ٶYܩ Qlك95>ϖ^TYTفLA`8x]@R! ̑*X[p(z|z 欶EPS-)akRz9jR#ǁˌܫXp q)|ՙ,4juvF1U6"ңEfomn匶fe߶HC/M\/-VƧ6(r5:q&_f?掺DJd_Xf㒑 ޞdjr?>XF <53M^$-WN=%j + ͘ѝ.UX%kBZ\X\ EJ5>*⤭c3;1bNkܓ`8c8.}ULRVnWQ=SgOe}NGZeK$`f)j7 $T<7}@w+r/Fb]+1d9",?7 zѬ +K$ yO괵lvo4}ӊKRNJB4Y*mUm*Ju*Gj7Es^?>BlX`H@r˜G"~z}DɮqD@k1Q1ɇbIY 6Kt#+._R +OH;)㎕L>&"jyM᪔o!=w .VFInIgXr,$-rU"EE晛޸(dgCa{uX[GQATG Tofh(+ O,2dqz^MzvGgfQsk--w\i7ݨ'gP#C aKi 'Iǯp5t5g%(%TVq +?ZISRze3V"C, + +ZjVBc8X8Gvk/om>7+uڀjN|{hhdjm3t-=W0lɈg<$V<5eTUf㦶#5y υ prL>,)V4SݢbI6Rt!iTF2W$@8Kf<_}oJێNj_L58UNfZ?lj>LBpEu]&0š?;Zz³9N9Mޱq<$ JLaԓJtU~f|b0n+Rb4xv%(D3cȘ>[Hic'E7?{"054l,z,UU0$NѬˎ+r9 +4OZc(TΟQ*tc+aX4*⠑* I9ܦ2{?`{!Ed8Km'MٟLs-NgƫበGVb,P{׏Lz*X63ܶ5>SY +̛$܇k9 H)A8}ÇV4(RC Bo޶z|R"=o+sZ2k)-2w!=x\R}),B3aU$ p$sM?'B]LRAح@ ‘q(u:7S*1s͚)em-EYgd'فf|KϚ@ԟ9*7h́ S>c4*ZGV\^$c'+Ѫ́lr%&tkSR*E8\0ʌ7.b0Hq|bx!:1񵸯w{;gu/S|۩O cCT< %'(QzǺd=6f:WqI1\GMR $UW$U*aZXujt&o+޾jղB^ts ៴p+ 72w3q"Tǁ&s1[| )aRώVe1RZFPU4V-r#17ӰrKaH'4ؤB䀚 +?o=пs;;P]KdbR=\LE0hsM2K'/Bji>MKw |kh]].[<>R2Ly4Ͳ =Q^Y@QE06k5qG`Yw/g+a7xs?UFmoH JV Ǒlk-̞lB 5R:-=5,MC1B_hlfX!/WÇUYrZJTzYTT<ͷb!ic6Űq#RT$Odm(b"IQWOM&4CKEM mR+"=ߤa¿ 3/:m4T,5mK&ӷ;.iMlcZS(=|UYٓsF8A˙+YtH⸊#++l%+I2H:eTvpޑMStl)g8zh3]q|6OxOU=\a^ZWv< Dh3I^)A=L_U:wT)R{1a™ieeAWOb8kx2d])ۀ8>4 픨PkHvbŪ*LFiAK=ի)NJ:ɘGz-m1^>*܍Zp.CJn(-&><he졾ÂANI䛵Z?6_Bˍ{硞27p'9k#SȾ\:aܯyuN #lAk"R6`ls ]OjWg3I4d@BZ 96o>^\m)CX'dL +y/ }JA#P{ZR4؆{M 4x.Yg.յQ"IUrNgn[d$ˎ*eS |`ӲZST2xsk:7 L2Y̿{T:ղ4)⑁NRF I  0pJ9=bWez~ (c 5PYKdb@n:p)E؋WRQQчI>el<'p6E1\o7 i!l3V?"{W Hs?87N\$1mS]QP@1±;xvՆTJ[oi|FM(C.N1 +T?js[Ӗ)"31K3}O YS'WSdؙTX`8:ox,;lյ߻O +n6x+$T*XS21T"i}x>lo8Z2<" &[.evXmG[8lUK+%믨Ymc-6o[HX Sg:BIQa<IH; &IQe\[lvDRxk)'4um* `c +"ϸZ|fJ!#n C"۪c_`L eQcc8xrĤl&74y4[P)D\GhʙG2K8.P6V +Rvǭ+vɊ+J򼡷1r}})_IOxéEՀx2㎣E6˵\dWG*[rDضej`8Od"r{VEKWiO+8Exomuke0Mk}\djZ&@'$.E_JIÎ4amun +l{8#eMmn[qSb/(v#k>PM_@l +0לoWjx{?xd]:-rztӶ4pl[hby<گkYVX i/Ff>0CێXeafmosmJș97©̨PlJ(>װ曹+6[u ++h R"@6e\op$u+ Ib;ª2)CS5zDiӴ('l t{űRH + +:ӈTl2 qJ7&Pr6c1I_Y_.XidOT7,$&][^vPFO鶜on#5ArTjZlB_,@^챵:߃OOuoCW)!%#3 Gۋ^Ɣ+$5WVzg]YxC{ee"  v?杮nwV2ڼH*J +Pym5d `M8e Ҿ?O8I˴j<6& aQ;$N=MFXRf&͹űqls:jDH}}< -Q@V'H󣌋tLoF'Ήo+6a"Tyg(`85%OL$N5i]݄Xn7k3| Q"cABM,Id ī>)|~Jね]\GAs)-QHlo\8і[|Lܑ0[ ~oFzpf/1rN c zv~SXo~&7i)hg填d&7*zLG=B"4Fe1 vi݀ĘZ0˷-9);1PA7 s%HWDICƿno"yKOBx'J?$eP8׾p~wm.ob- +I'P$c#V%g²)>Q!"fUFZ27*tpZo+ŧd`X1Coe s1i_Y.γIRR@>N?l?1]x_R QSNhR(],]LERI3u_HB pMxH1Mlcc +luX5JIWQ*̆lobntHIPoյ@j`n6j*y*"Hxkh{F3,8A0o比Ic/C[u)};VWɊya)S=Bg_u F aR[&1U{6}l[SG|,(Ī덠`8+FMKc~kv^_k['zk s'M%I>eAEP5gx/g% HHX Ȧ)5ċq+c/J[Tj@|lG +:d6^GnuG6a^KКjhYH J;xI+{nB=nIYp㮝 +A4/,p^?^~$ޡ2UPo3D:-C7>fVÀpԥσi#::igf_FYsP 5>Kԙ# KXI-$w#ލq>Erh:@a7y[һ{k+PgY/C-!᪦&X{_rʐ+kp J~:<6*U5 +'0CFU"-ڢ{_i*ls:r8è G. :qk}i޼dۭ2`& lrMWNÈ͇ҫLkmna^ڜNM +TE!]=hy**@5:r%MO'}rMל8xbP %8 v fey˚ZQiӎ?^0c Zq8)s]楊i eV&%Ўݪ;û^!W6%A)v LmΜcp%=0z{QYYj˽6icꙨzPVu>Gyn*+[̗Hrr*aVâŧWW>ǎò%.|; +d41Knn{\pro^D^RNmgβaj:?v^\ r|gc%lYn|C|8BX, H,kДHR1O$ainѸ:,.[rYפ@Zb:(Rf1ĮO *K;( a0. WʍVW 5#!dŨo!IjX?qjiXC+}O⠷}b͵Nic==V"=E$'m1Y3NfL1&Olmb{n0u>OԒel4 u9kҘf+RSNϋhj)`Ȧ0=kp|7KD?,  55L,K=_}@jv +HoYxţvSƙ2Tv2Ў:xWo@⻢9k0AT;!6<;em-x&2YE$:W " Sxu" Q͑8m.X^QѻR܌DW),%ɓN}g:|/a0'fIp&a$XG٣EZzaic +e}FDЯM_J`nP犮>Ph xGwV=x{(0m':qRFu%8ѶӋAVaJ&Т -8KhKĠ:d$ m&8A* +ɱHأ$q#UC&_/!pRJ-=oPm7KlrЬM8qV]+H>eò3f X|E4 r +is0cᤐ,'[vy-fAl +l6e 󽝻=iy)fYⰒ3qq_K=|i̸H+Κ/-M< T1=n7rr3FRq$ ~)wY2D O CuFk(,OELQQ[SurV"&gig{NWԾbեp)mp3DVكe%xNRk/aUqPi[T\ěx-9_+̽#Lr + IJ%ewTUw[h _sz>GRJPƕn^Ko +nF*A(S= +H:ޫǛ3ZVc1W泌'v]kۧ]SZQܬl0=({_J`ȎW&%k8iㅛ1L3ZMƮ= A_M\\)`pLi"*Ջ%ʣ<$>}HuՎ3v?=M-4GlDIf ň><oGk۰N}[D471-Jm + I#zSL:1Zsu?*ʅi~JHF*eMŸVvx). otvwyRHmE.' _8$*QR :*=5zW}SUÔ*l ]Fk MNQ4c n$m_x% OQ.@T䞬g|\i$Fً2_ǩ & Aٴ:jQ=ݹ/) ղcm\"Zē AQ8$ߺdmdLS-}_ʽ5PfHᦜ1hlSp$`|*ᖡN~7G˄Lߡi\.[ABN"aS H$l?蕘lTdQL$e]{|_96`u4(WBu &GruIAq8b"xeJ +v%BI=u( 3uwS\^L WA,klX~;;I%0#2h~^殺ҒVNa;Iâ m{xBYA RA*Wڟ!\8c9]X ƱiQM$j7`(U`x7+ .1'N58仸K\J4j|FLc15/O~><`0<<3rZ2̦:܊*.U.BLHP>kvʵˊT'o +S0*HƲ#',أ$5?.deW -w.@$/;K^R,,b#pئ#g>aٯ39<=d;>b5!;v: 2+&.q!@,m+ဩ7rl j|kALrOyZ\71QRwlh( +Umtۛͻ+, lQ+©`fX$Ƒ6 #/[]<8:Aܯ\>t±I)Ol):&1 *5w{z1mi HXHWM1Eqz6MӺ̕J\MpaM^[e,nFGPM1vk%hdfZN*dT7/Y:c .R! %Nns[6V4Zhw[x.Bm G +%aHBF*yAsI nj::((: |xGs:@Q~W1рtN)lellxlESv18#0G̟͐<)}jiQ=ơڇYC <4Z\s RQG8R-@K~*1X`\BaoƐ<(Mi#]>GLK!wr6e9(i᲌kbo s<=ܼShāU)nijqLS2es֦%m9k O4u/c3K)IF=Z,A?[[Դkvps)k pAn)qG^(=cq +&ĤOƍn-ӨltUiCt8]/ +j)# \$qE h%2&v +xbObTQ`-!Uic)6GaƭZ8Ӧo5TC3YInn~IF1yͻ|.}ғX}Jl:槂1 M=<,/!XUX,J |u)ҋC엘yk$H$ck<1 OVvtO1ZʨY(A!Z0Okpli F]^^| 4f +\R#j7r2Xrۮ=`AxVo|SpcqjbT頷N\1"ZyOէsƓ9S] cl +bOms 6v*d~?O .o om0z)=Є (Ép n{p9#=5TqkĮ+З2e #o*{/$]Pc8%P ʼnsEy\vTONK^|{nN]eQO޳l` s eN!IR[x-WCMAMl +}asۉI3k{)p NJNaUlL|IŘہ. =F0E4 3h58W0)e|ѧTG7 /r{=R%J?nZ\(HlC]Tδo*#̰SӨ7O8z5zÊRF;Sa89*1YZ^Ǔf=oEdF`qDnwh9VCi‰mG~3H)Gu:CJ09O(sLcJKCApѴQ&K X?=G7#w-Js&B +ҁ%c'_r,CN9HQ8<ˍtPk +,~d vOÏ=&pT?=[j%NE2QTs3;rQg|Y4 K;pش˵o9[&JL|-]U9GnHMdj&h(V5 ܡ.Tq,g5$jzi..灍yU:L)[Y PPc'`󬔔UQ%emcQE͂$2R*M3$ΑX*-Ɨ'Nc`o^^Jdl PNvuPwn֯s%6:#YN,Ud-eE2O`"*Mō4ϕ8YʓYeaoE,oGm۩1C:F46R(gUog'o]g>f.ژpSEDm oXep,>YWm}-BvΩKԭ@PDDV(_6Vhq!2tP 5CU;'A$ vQ2$g7IN!,oYKUzBS!~/e6N\h=nn٥$e +ɍb|s{l'JI0pIc2'xū0\>DRYp& ++)ć_s'S~E6ho9(B^'쏯nimT#Y.Rzv2R[4u +]ꇬg qXqLj JJop i߹\;N1uzT@1&E$ g3>/`C|B6z/2TńH$cl]u6G :k56|N+ha}D(TI^VΫ,O9bXC`5 & HLa0 Ӆyn*D4I[ ֢FҢ`vE9#R A$# ㊖ȪELZx?d9>X4Y/ERU)ì˰FᑔR,A7fw3TH}u +I$o hQ:f I#QQJ! Ύh$`~W]Ȼ@d7R|FY C@, ۙl6j 8qL{F$)< 7tņYt fdq +D;o6?e^ę hT+32 cA=5f٪) + +UWQ[9vwmI,.~aDZ$NoܳvK%owlVqQ'nDPd:-4 tE eKSsS`LZ6k$eM 0xM~s寮͔pˍRCgIifUnО"r̾Yo)ﵚ6`=+`M׷ԨpeZJ`&}W@piGDŽ 0uf[x+I7=F?6R9Jx X̵.D岁ٝ +{Y?//˵ !B<Ő`Eo״,"VZ.yԑ2S1"].A$a=kܲ3HL3/:Q*&L̮tV߆3RԹ=a\+3ކs2 ^nVée Ⱦ%]XhL*66"4/D[iܞHG`-Uv":H9ʬ +8pWJ|'O2lNɒ)ZzShc&{s~k7WqvpQQICN6ʝ=5vCIT(^ʼnK~T@T5M9H]Dk +.\$/#*C}?>Dݨ>K1IGhf9uj`="G_⥎d|2HHtjJ%h6@6}}'X>鹼_/X.Oފ2LSaUz"CؓQK<$j$i dn.vlf#P L@#;ݼv<4MԐBgP? +n~!0]Hq_48 khZv3YL\`dgbW7hp v*:f*fJQ곕dp[+Jvryaju6Ғ֯Д@Xo,}Vht:Ml@Ia}P*Xs>EܯyvG+qVٱ ,kKf[n7>>U +% U.ƚoU qnc881'p.*P`w;HvgƘ{+IU# XbT=u'ê6I[m`=;@/Z%qoE +o7锦#BL*߽%OE)e3R9 @h$_%[(gZJ,iFD@X{-T W1.$%T?{ܶ).bxE750\F>}dKY3?<Nj4J4=<@|xyvݳ3ǢahjY!exHkqZܔ}᫱pRG214x^Ka6# ̑ƒG9_DV>vǒ7/ @ƳLT)]bR m¡u;%YG-rZ&Ju`EEki^n0 iu*"h1&e05jG*lNFO/TmCIJڂE>eYCE +h6j4=o5C썜 i*u9yPkf{yhG1%0 +Oظi* &oHQ_1c$ROJ1%Y\ {y'p80Ekwlt"TH\2W9]UkaR|^,N"{?gXJһ<_AZj$8s BmlS> ᅕX>Y[H=z)Sk,jpA&@+| B``TyiZb%8vṂMw$#jcC9vB#ANX`*POʓQ . zkXT6h5Naz;rVV2z07]BD*͚6UcjG'fj_rkۭ*ːȑhq9MC5E${_m0IĊTS']!PJFޚlBw]x]_}dtQ |8c8p4RcHlӔh֥:(+#oqibjڑm|;qCYc/JqRS`15\;`5׊,MUMYT&K[ +uAݑH@SvU $3~%JTP { >.q\مEu#c{o l8Knq41m഼تLЊ"悕7۵"zDQF~J ݥ6˭à9q)'h.˹*y#>^?} 6q𷳆?إ:}}8RŖ E=rU=EmuYGhCcm u'[eLM>EB\a`-i\h A7L.`6RSܩE;)LbD2l.{ÿ66J|QkB8W@Vݼ1>e +>WC Tأw-TFk*ͯAB&K$%gV5;d)tx$0Xn q߿ ?F 8YHT;4n^3'"1GL`φWs?6qOHXjtŗds`oGb4z7ْ':Am.g< +U`bJR4gܞhկ4l@'jlOeErAzENZj%f+}|`hI-jMcub,6 Sl fɕ­YZ շZ>a@xHض"]:Ra[+IXH2naŲi ⸡ֵnO:unTm2<)JRH k$SLٲ(qJkű) M~+Q%TzZ.8M~Jttϔj~VZS$ﰛ[dž~ط~e,$SyX9䞎vMq{x.8*]otVֺA`''fDħQ|ꈲ DJ$r,A-'}_;{;Th!*T썠'y|?S4bJkZ>o_?Q񺾡zu7!a6N>c9Gߵ;8.P-<h @@P'RDmD766Z*LB`:Y0PAb8gP)q V=M;Di(7L_5bLJw;ė +lǝ^|Z$w@8P +( c2ncʒLUXZW*TUTt8g"-7+ZQ9ƽKǨiC ˻F)pH/۔-w 9tpD?m2NЭd&Rhq|K GJ ^TK,A +,[IJ'c5.y^>,Ht &O8qԩ17O8zV?<%ρUGȿK {7l/ +X$E ߡjO&|f8Jeǫ6K)U|1ā=/atwCؠ0r %,|5ҳ-̑tM V]A=ۜ{۬iIiIV Gԙ?ĺv7bҾ8:h~)'Ѭϋ͒}R`f#M2dž ɖ9CoPwoےqRbNj(]Ҹ|{( +};¡w 6?:r@P89" '0\!y~JP/y L0{7v_m7$ E).Ffu[șN񬥛4M2Q`Fծђt6Ns1>?A$ʎ' S߽\ZP *ãg޽p) Bx&}gŰ/ +1eX B*1hǷ~c`85۞ o{1HKp6b;=:sOzٗW'#GORҙL˷ݺX-_>SLF* u% CQk46xSnl@6|hbIsVl*㭡DNەٗ"\=:cxv$^8# }1ޒ\-: pپJSLm(u1a` +HoMQ=mEB!' [(ۂ>Y)cxa^ơ eb\djBrͷmx[ljCx57W2UIZqy#i5$1tB>$s'FzI1TOzՙeQNvGNӔasbfK|u`I|úHBUCg_xW0E)q'V4ebW_]ϕYOǎ"dH~3kEJ. +,f@Ri̷lZBc~dΙfc4NּCU%|iu܄8mk}tͽy:5C0ވeLJASQI>"ʖvmxl Be1)]56JRHPc#*F*駉,}Vnnw6&aI +5}vyXq%DX4cx%~_l? +&Kw;=9)Uc=HPJ-VSDrydD}D$!+$"L睺nYiatuYM E2 +aMiZlfhsm: +@QMN _h;`kI@TGQ?sL_t%0:zj!&7"6nϪQffEK-0>'\sҵ3>31-<*eFMq/:^%Nft+QCTEU@ձy=#< d9gC@i0 +oxw`^6^uEOMw`?J"ʻ.oTƕ"IB颭JF\<ֲpY~FQ466"cODoYw1`h 1TS$*Aps mqV%AHP'dBE}:7q` ;D;)dE]hdflLu+ +S2d}!|ּt[QB!Gk nt.AРRHă=:ufeɏPAA6ز! u;efcĚ5űDXˑY |M~ ô^vEG J# }llg +mb{ThŲNMlI, nUE8L[M d'E(}SqܨW/~]o;Wyĥ50V4Ӌ6 s #R<~@LȓHDktrsU4c[i:4b4iWDuu֎p5#.yƷ r'!I l(Tr@:x cOwt 4ÿ0~A.4B *طdž)'laj%VUY*&ǡx@4 圹SMT$ `H$9$73oRЉZGEĐ}I(EKA|lƎ^Mlg5a&hMdxMcSF^3f]~7tW\g}_}b]wlP]ސfPjֵܲ]HJ\ѵsb+*'pr/9zV"3Eq88 *Jz"Iױ7߄vRDOP%rz7mNzē`5L0=(W#%*FjjasqVE"0^+i)CD}7e`Yk*RYʳ5Ζ?EGC哻B.(& T^qwŃDWp[^wDiHOrb _V<+m55CkmZӷc[~ѵXǪq{ԕnRVjs +>bTWɦu.t'[iĞPXڳOq'iϮTLy _\3b+}BUmC +AtPu^ΞMUQI eo2xtWZ|^B<ßḛ,/%;.ww~%=i*tlO)$1Qg6T=6+ґ$?&3ޞR`SB xYu"w䅼9hbQxFٕbR ^aAXQO@A}iU,f ܭ\*7 KruϮ_˫ UELo m='D  !!6 _䣽;*2g=& vciqSoÇ= VoTΕ,!6 +6 yؽ^܄{}swwk4CxBRv#x;㼙6h)^IB^b0gM\E4s-=Ja!_(H66o95w¥N$+J1̭קlRVs^Jk .X3'p;wⷧ9:OSeo3<4a!+m;לnH#[~41gnt[mugM+bP2ռ-zHF+/|R27|ĝ3o(e<&^tTTحl)jZV!#PnvdmITDM$d6L/T,rf<_-[, m ˓螵ڪ8Pw=phLHmvۅ%dt#Lj GFi$bmS~;e]QiK%d]m msNp81hêcjzi#G7!XnI߄67'EuɸZ>Lه UTTeb: {ۘqQ) J(T$&eofGiJMӌQmD:[irTLNy3(AWupgo``m>3a!+%^5TԴQfBK$@T}|_b{.nwօhA8%y@}';~S*'B:>ꊹԸpaOxطE*"T84Q.EĞt:2Y҄%JQ8fCv2ˋI>Bh/7U1IX*icaLF':lb4Ȗ0yv#-vw`jO0lܢjpRRzcʌ9ųsg-_P:hi + 84<eáOZ# [_ⷭY+UmsUqe4PH[ߒd0>$s(wk{j[,Dn@R!#SR~vrck|‹U)aUHbijnfbsw_m'SC}$p=WTQHlJk>G +GW9zz WaP#MUPu_ËMnrE6ܡGb:GܷJNWQ鏝Ar,v0 AS ,Tn)(۹~p3;kdư,=}-&U0:\9fN({)гGfܞ \x[*$@h5Ёm<y!$;D{5qM&vR3,fgY;|boo*|0'bithg18ѰB|<-9rZO#$1ʯ7V壀gd3t;B`Oǐ0 ΰ7=MœɗIE˓nΒfv.E^YYPuI_9\6mOe|fp I=WtNaU^NɔdΛa*:=S/as-^+ATtr6e]4 +XtQMiCtPaaC2RSc%)Ea ߎ}tph"N .a<>lw*D%i:ܮ/A$d<KA5h7KZnovIҵg[ۗ +)M\f9f7 +CeF+ˣUs 1 ʵHIu\?a{An +'JOU كWωܥ9=&hMv3 +%:y%*H=pKڗi9v2ݲH*Yؙ'Mn"ͧUrm850IP#K\6`5tsC%ee1222>nf6˩u Ju$ g%IJH8=lŧVl3CXD^MŤ4Rs1 >s;̶/%$B1x˿CZuj2}6{6Xh+c +$6Ѥ`)tdu*؊ցPUBw>^ٴ+xT0&%(Qteq%,O 7Ol "btjU`oS"*$ilZl-ޗ£NZfzr.١)WU1> |zѼG%ѥ눵kXyW"y͋xDiQ}h:b'K\]U`:+BdW$\0`e4[_x]d^$|ѸɴH4_ (C!A)٨l&MKI1AO}2Ks3d`2D9 &I}E#dQ2$ +Tj`<a{F']*wnpOIoOd/RЪ:yį"4 E:ezS7>s-t0u6f +ޅตUT2CqR3|5"/Vw+9Ѝ-Bȕ C&8zs#_\aiIJL)& M F }ñҎ +|; Q8*jbX(\Kqx;C0tBqK3O +» +$½tBTD۰;tqvtLi Ӌ+z30Mfe1'D`yVi)GW'8cy*-J/m}{q]t* $τK1<4tUKm\_&Oaxf+E\b|m2Un4M*q|cHXLD %m9͍ӼG̫t[=e_p3=]6֒IXU1RRk +eeT:[^m_Tډ| +a rTP@"Hh6,ָ>=f1揥$wXIؠNn _aSJqV-Ωkt0 sr^bYqQ-x?G%sv=C(}@)EݛV ,ɊϑSY=(_ sTH;GkÖ׶p1L{\%6]A"h 25dd@ w$xY%hYH8St +tj"{U⟧xeZ*Dn +>0c>qJ zQ #`]S #yi_V? +%_ 3<$fK<hk`9&Ūdбѵsrp4旔5OTlZuSF1FYUt8 ?VMS%<;۔ޭEs-37XftN3EQ `Z:tɿ* p-oAR|Gq bVjqjIozs1%FRΖ} ٤5[)4U쵀=F!RAde# E-LkY؃@q6SYLdӏH~ž`܂3,|y»0bۖ%2I89p +q =t*NA; 5S30<;qliUJ2پ*Hha +M 'h2jōif M8`{-Y%JUZiᅙz^ ~}Ns-N"}qy1M`CS7Cs6mVP?>mu)Ƭu4GD4ޤjp +B׿!Vh*Cx\ >KsRy8E4+P9(W^J&0 y"f+ntl#_Sןfnw)!Q1jYU^ Vv[vo3UaK6\SVCD(._qݥ@yN'Q#6E4sS d,gGW.zewF0'ðɛ/aYM$ +߿Y@|t߹*Yg™zm^uk%R48f^7 S0 3ۈ) RkQ {dNUʢL֬V< }D'Jz,} V +Q8F~6抪!S䬶V3 O)Y5+Cɡ*{toVY 3;-eN3܃SqIld)XbwcO׬YnyX H 6oh=rI)Rw-)rTxp!}}Iމ`jN#I61ߵطGz:X0J06l0k~3a~ޞLD%J@u`ĕxV]THڐ$;6P7#L9ڞ)ydxcyczȊEGsKWBe+H]oOՕI7,<HII@xҎ,N؞3ObQ榒9$pQBO$ \GG'6`"5y]рLv b^^[[jJDG볯}Inܸx[8y"iKxNX}7)1:|[1J3SMIP <ׁ)S生t**6XJl=$%|8.(ԝ#r;/4eG|ơ_J7bxOYCqiVlVZX)ZY#y~ߺ.NY=@U[^_%u+&i-E9C2sѽnϡ 2H'`fh. v=`:azUjM>(`|͐EW0"*)kys\Tt<2>Ǥ/gRbT mb\vR␒AYZ `( ^b:xtxUN>#妗ފH _n8W3Wtߪ\Z :H#8:"}-n%7/w/Ozޕ4>Q +C4].W>`ܹ;3f:c5Tpb4MFOĿx+EԜ(SX66*}|JevL$w'i +V24p3몟W$yN +.`R%X~3$m1W !9\ CO}O\)˝u;)K-]R*?ӎqVavBWNcf kGYԟNo3:mƦ6I X5w;xHX)Mi}ۂ<I*2J#]F `|S\JMY4=w6#0ji'WM5bY\fІX sm;_.-h(9LtW<>-nR{#~"-sH8SzY|62ld]5)dPu$C-RE-*ֺT=Ey1)UKw}PaACNFA0#م7f~L3 a8}$x1P"24$3,vKۙLF$z.-3nŽկKܞ(R'Vxm6 ^3b9NbjKX)cv✷r .FmQ97aF8lqn̬F*X9,\f,Qb&U{n 'wu{0tr2'SIK-cJPYl*( ;{WYq;)ޥp,gnR?ʷtN3 + $ZD{wƋ?ަ)o]a1*Tml~|VcxȽ2:Czz-,0ާU&,@g +j +pVx#@P`:jk'e$KMZH(0ܻ F D +4Mfk&!+OlIJU7Sw1?V+~{Jܵpuía;J&=h|xKH& +Tq lUb^)k[I\⟣~0=ņf cgZhO y/Q5rX0aDP[l;UĚp`kYB`JH14RE~<3G-4{bha2CW:t4՛a*@ER(>Iܯ׾CWfe^]д>-e8]Ym(H#s ~ս8C6+\pڝ681[w4$bvQ^ox)OPT"U#Tȟe䪞);>b}Dže'm`jFjrZÍotQE.<~ ȒݲUнlM(]f WO4H"[}3eTN_}jއ`EIGñHVbbHX2%#yU\BphXtqLJ\&ZCќ*1[\N=L g<ZP-Oӧ l7_b ԾW`Ce "%OΈ×%Jځ#4Oݚ-mu|:(`8xLPec/^;I'OW;4yL8>ʟ[nl&\ +&6~v]_ǒ +X #qk2fD|망ڜy-'U":^e`^uPm1xIZpZ5'C̛]J?:nΞ+z~8~'QYTU ߰ 3݅_ۏB*E_-ewn+,Ss[l$:>tSZH)TSa25Ƕ%7,:|y7cQ=b AGIGBfދz+zg<G$.ɷعג|ΝQH91GCSXy -xVrwSx..*chǫMZGHZ +S(8TӠ_䘛_vȤ2RF5 z*VW=reN-K +"}w>ߏ&aԣv-¬N8IM_uUgؠZLxRǒE@Ac3̭_mz#:M'@etNS̽;][ '¦I( +7 ~ԧG2zqF=Y8M**Avםwl1RE*wYl@R m?%KVjնc~oLhǩoHKfM~oA*RO@* ݈k,cO 8ažj,CѢnZŚ#fJc֔Z e.$+ +3NXI7#dg 75WeDux$Q`TT)oB-ΚC؛a-!*dm{}|.7z.WYO" +^Uz۽HQ2p=†N~:Zk!|ej]{Q7~ϝpx1ޒ i ̍9HA +yI ZRQp bP`є˘;Rc20 vuǜB<|GovEfE.4J4POžeg SOa$Ab1Z28-N~s@IDzsTP3 @q+鰼xd:qqDٖJ +♉W/ s'Oii;טF#9$rº׎zʰ㴭CXO.֩35/- rcHXWخ*z7:t|{0aRe.U:8JHg W=u4?RT͈_Q1 +jj7) I 8LPQRҤb?52xO K=瞢fǫ3'ǥa{2i$:h;twyϲwx, )G>uk[Ͳ 5HĚ +OH&ɸ-p'i4?amE0_&~UT=HL1=^:IFO'n haDJ*GkK8EͰ&h- ?}~fk8UTM9Wi#qi /Z=5?oT9S +RE#eHEh`#7 ;նKN[cܵ!6N$G*+\3vi@3MiYqQ|gm .6Ig@zatTXG x + {]$y.aYS +åyHc@UYMJP#iY33LMU~ yq*4;HI]7I!YIT4Cv-媂L tQpqt1JON"\*B$csk_\o"Rˍe+RbY]\nfs7 l*(/k߲T%ch?QA ΐUkQ$BP.4i6a²T\ۭ,<>3-BvV F1S2 [\/UHޤcX=&0-즭U*{iɃo,q;>3=00qʅoO6fd6&]h捖ybCe =^Cd,fxQB{yKē$4/&04Q 򟲾bÊ݈Ϗ 駰=p2 ᶐo!XNvF "{t8S`Y (H4DkܝE!`aoNV1ӵK3BƬtKlЍ_adͺN͕fF ^ܽV:3 +iݬ)~y6N۰EÌfmjR +t]#T+]2k +؂\4؝-6GJ(Zi찭 _f(\(7jzF"7OĪ]|3)nB\gxa$pȴJ `t+E5(@(dIatan\u!=י8PX&Gpxyw-Kًiԝ6RU2,rKgs۱5ǒG4ǹbc̻7}*P +IۏE1Jˍ#5/J3J H7"xUYed˔dbM {@$ܓ̫e:s=ؼ2V"Obg"~j\:>i?ՕP:Nu2axDq3& Ҷ3?b0.WY. 1;g:Hz*Yn0oRDt~5'ޔu +ºيb9R +Jg0R71MoˑqXk1)ر>.R *g,mࡱ'8^CWGprfEh4U.Krup.=v5&k)f`ZBPZ +\S J}6X/{to'5z2=J,zWIf 5f@O#ǀMƿchGvqR?1Ī e`bUϴ8b{eMlYcm4!{_eB0OZ+ʔ.ԣ 1Am fRXRQUlJ6[k:z6d@]lne٢!U  Htbk/35i[ŻRiH,% 3OQWI#9\vt 8x.=eİ"u&6ꏧ>|YxIp߲)C}/ۀy3 wTz@G3E˻,<`aBY'KQf ˭^߿1eގe/%.3ْVz@6<&lu$bRv)ginj(GΊ'⯒kSGCf+/&EPT;0 Rl>7&.tj:iK1Qr^->SXE)mX I_ORy${bgD➴F^+-}|>%4XnX7% @_k۹Y;kܨ$$# Rse/eV% HH6FGMq' REvYW+r&w2qu(Raf|-$-m4U9vC Gؿ.3nI%aഐ岠6ڴӄ*QNt;&Fcp$̷Ljޭ۟s\< 2N +e +E0OΙ}}bB_Zf l>,`?>,w(JHI!@|LQ֞t]wAQ?1 Wv;N#ɇbqKO2Jv3#&0Qg.WHJ +*W DHHeʥxP&xIOޛuC=KQV!Bc|$qitҋ.tQUGzh֚Cf'o'=}.A#@ѯwoƲDpJF(ttg;Vt+aR\i =c=;3tk:uTip +?y mHTջ"Džat.%ŠJIH򑶃vٵ:YH٨&>BHu|lε9k +h3fauֵ\jy%}K%]%˅ڲO3mL$>BʽRTLIX/ؕۋ| 0h頪%mַubnzxK-w9Vk + + t>*BW>DJ\bZz3M,yQ2Ż\|ASUICYfI@CaG%<{gRUс$¹4{f`-P|Wfy(i'`уVVFr7wG#1@)Ҽvf&m^&L>F3Dam>tB>SVNu3 j15¾`^e/_ҞVIJS4%ouoŒs[R Hnu`}TSF9k/ +N#&JTee;}:wj^ȫjP}?ħMÁMr 2ءX[]4XұL{:hzGOJΘi1-Aӂi>7 hL jUE䐍6t줋CcѼUm1"ݻp:Nt|QhF﯉Т )5ѐE(2N[5ϘɠD ()̷$2ۯ{ nv-p{x"z6;&0`*Nub:(iv1v< +;8cwvҍDƭ*jX衦AU$AKHuԝonaI[GSVKC]̓Nm\:i7{&%pF zI=طӫ`t +.6VF 8 ++0p梋wEFeZۚ9qMLe\;]n@DŽSv$]6i1q5D$0k&&(5FMkXg6}("s%BOM.Tcᴨ*YR 9Bb$}mK0v~o ?*Kw2\k&&&Zdp;*6KYZC#.I@ija˜^ +t04Ma+Dυ?\c +E<_Jv6=8d [:tEcru^+R#p$=wCqex੤̱bI__+J@w +e ~!_iᑤx"SU1GĊ4x]erȓ(5 ȃ`)F ZRLHC8xV\/'4!beE{w8CN4}Azi)S +>#mM>:!Ln{h;t&iWM7Qc8NPJ_hI]t5~ap;I]յ(4/Jj +Zb͌rBGRew~n댸jpF7T# +MVf@%fUԪ\# U4#k2칲ƍ3IӗM.s޿+ɍ˩. gbٻ̋3*#~˷YR"vD:u6 Gxd+9cT,;!vSo}NnZeCOIFbv lUt=[N6X)!fs}BcIh&1Q-Jԅ \k+Cnxs]<8LSMKq D]@Fڔq 3 מZlLpGWCqOc s%8uPv;*O}6 W$Hef ͌YkX/)UnMespkap7X2{ tQi6$ 'Rr+- QsDl`c0qgK# 561JOn Q٫7vH%>*ɝpclb(9o; M0-,C4hָ*lHnw*\RJ5>bj;P$^ +o.R҈OuIfP  +6#`sQҖ E,QՉF_7V|7U631ijefP*t/Rxf˷*y #Q{*{\ =ZqEbRdL?xetY 4dIo8bf`gƱ$DGkű w~rwmZ;q3VYZ)CΏ>t˧?y f*hEZXˣFvkxۊɳpsLuA g쬥A'ݛSlu!S hӾy +lUC6 xȾdUbOvg͙-ⲷ0_1 +ַ$akwAVJm0K%;dm ߧ.td슔Xi-ULsU0搝X1qq:)lhJ]҄pa%5?ZxzT EWoQ™h:YIՈ(yIGp?> x!'/Ňu& UCZBsnK%.x\8 +T۽d G򢭍Fx(56 fjEYf"dʠ2+)8fzeq.Exn-KM Z HB6n2ZL0iRi)= +wkFPKfF 4<-xPIxIcy^g;[2ԕ4~ŶT2L)&:Yѝ곶b~ +bOJ'Ǎ==(c +`_6'A<9i|R&\݌- ++'V6;.$n&n'ݲ_.rϙpJQc#`>CRz-Žsܝ7+Zӄ zU螾$JsI1YT$WZsc=.=}n>X #xLAPERwy$#F,ᤕ 0ͩ$SX˘n^q54u *,Azf\xSŰT-;t#Mp:V> Rc .e,iI<{Bn%mG oK=gGe7Y%U~˭ ̂?(;дZb5tU\!3DsJ|R<١{I[E>@_n[G6i*P&Á0CcJigjLht5biQckkq[R +Pas)}\NxZև 7vՏ +wxizo}0ib|ޒ0avY5?sLqen; (@sL>eܼ鴘 5Ǵ)aIavt[wXv$\sHBXPqڇe5~X6Vq,;V +ߍ{pRxw+޵\#NG=:E#RJC5|K/՚`G)i-p8yl) +1U JEE-,R%ֺi>Xpu$e,}I=)]yqƳb;N0J~ŁR%iص$8mgnghS)$䧝gW U\__q 1iեDpȥI)q.Sl)xpۗ`츬E-3??!9dA%$;ks;Fֺ86Y|$O^<֜JcepO<1>3Jĕ)Tu=PkkYt_|+Q.Gdӏ;'))i"S[B5AO_64 fM M/ngO N#DYnؑK:\,T{ HD 9_Ov\9Ҷ5؋pIw(c+8&mH%4rizQQG6gGoGKr}1jERY.;n +\˔ HœqPJ4 SI3^ѮAk"nokύd]qD϶@:R3:JBn[&ÀfZQ7+upiKm Y?FT1-kM\!Fo5[Ì4DF{쥞Jhk]4j!Pt$^gV4Zy'Í㏒N\;lcj8}fz [)ECv'CWE&u[N8PbZ6cp>V\ד2.{Ŏ{%OCEMGX7qgg4KGJ,Fm~=oM&dK*+vAT:+1vҤLW-dԤ'}9 +*DS=#Eo_]yJᬊ~kLL1q#ffXq)KT %`ovî8RRj&;_Fovb<׻)[6jf9cx"`\uh\Km_pO2f22MB\CEqp<82ws(r4_ W lVTZY;Pe][,vdjrzGKsIpY0LvJV5Q-J۸ɘN%% $paBi*;6P iu*u*'S:3ns båLr*:^sqFFV!X[^El9vatt ]8y2TľkK-km92ozPq6 ^> k'MgL&>Y0J&/`M'q|pE$~{Kl6-ҝMpu&xPתwQÅ-P˯5N!]L(I"{ h6F9R Ŵ up eS8 JˉӳI+Xȋ :{,0<@o\{VlH} sJ8дp%)Yx5x S4pN>t{<8AgiI%$OlH{58۠6N:Ο֥vQq4D0 ᒳԐ +bffUGJz2>WxWa󔱊:FWi$a“0dq +,Xm<}m]Х)V=(C*%? t*s/L9+EyOr5[<2zjrJ zrU;ܽ:N0nnUipv~~asvN݇΋%NYJdJj) SlUt=u4(WNf_ہN5[N%\coX8Ny)a$TXygp*WR;~x=DƛS( Hh62:M;*|C1:dEѱ]SQ)"GkB .mxJHL|JsZ%EuaΆzį\F죏eL&cfZXojFmo8ޝ= +W.a4Ԕم>d^Q[[H(Bj鿪_R}*10,F<eo GRtSޜ~sTV$BED1fӾ"BooMʔ&NJSXK@Dٯ>ziK w[/TITTΦ *y\{ pUO,ᤔbnI7kvCh=VxpxHcfcGi&WG%j8EvI6uF#ot A'6\B2! +3:>d&8 3Dw'~ +b|ʂ9{xz6՝~l^gڶ%V5'ۖ(cM=׽ W&RxNުLG.+J5x}ZH}wCohà9Nu_ %ELnRoncok@m'K2 ^OEf˓MfhnROiot2Z<ܐ'aGJXȣ[şH[0زN9NXI*>^Ѳ'|,s8oQn@lDSn|T4-/J-KKMYXR+媻76S[Uc3 +ۯk/Nf(zu9ټg`L@>GðBlb S$jmaƨ zث8r`gM)hV38EKC?ӎyV5%jx<' +~-2!Ԕ@R-jT)˲ʒ)ga3FLڦB}7sئ5b&:8@[w>M$pEB\*0`tDUIIp5ߊ yf1;\0N32ܑUx;q/6U?w:FJdy$xg~,CmPqK q5ᪧA! 6! 0lGąE[_?p`SwqiNT!doxA](E0!^趼Qɕip++XZ4GˍN 7 [6)32`\ mevJa2-=,-)kys +*ԑ%GoM4lJ /MQeQj >-sXDYE!;h=oH`ʾP|-}h_Oh&3"X8R.t7{HlQj#8tY!yj7Scb0j:R7p.lořXGȭJ{z0\lA0JzT<|8UèAUD_͸1M_z3u*)li :8F'[_^|AqGaŧO=L4gzjgWH)ȷC|cAԮMt4f_];*%qbhPHoXgm8tc{pQX6= 5! ŭxzCXAjiS_Fe*ZcQcpwN`)atbP^͵c'`N?dl)Sw `Y=͛+.$:SX-$fJQcEx|OyK)*;s8 +f*IHO2$ؓa_KS]dI4R0)ZԕfXQ Y@JYJiڌ? Wȅ r bv/azdqW~A+r!Ew4V9 X_{\i VFV醤` ,Ac/RI۹opPFN=4ԗ|#nBb<8kLf~Xv՜wlt$2TXd|!)c@e_~8}mN.; +困:8PW~å&mcwkŏM9{F +vLζZm#EN!?Pkgp -IJ8D`hVbff.mc{cm-ȌDT_geB4E=uF7 Tu*&T%fPmQ=3S)1 +w QZF[hUb8 +փ3"[Öd+ +52N]?8cH)Slɺu=ņr%V$Ot/ٱ?^+ݦI0A>)VXJ8R/=(&Fwo^ifY1J F"V /h%#qIezv_ZrOOFjD܃w %-RÉ;,ю{_#v)]qڛD!\A W[1|9Wb-qFKk؛UŲӺ#]˾,ol}QjSš +fҥF?HI4=3o+r$#O"cx\{qV~w(X<|(=9(Z #)c&1*O'$pV0b,Wm_.c=?2`Ο kѡoAn\j-Fb Ava4r RUyN$x eUDs|-9I{]먹 +kj20yїZ}u:f +AӇs؍~|cx0zl%>+Fi:"(녻N;ceģn]nv6ӲF-Od8EC,Rm`&h>!*qb1i)']ʹk8g\Z1]iMnAg u7e WNiN 6 8+ 1lN䰪Yq:DQ#Jc`,GURÒ y$($6w[KvZ|O,,_}#ׅIp̭ZZ1Z|SU>}K/Y8H^`rS@OMmJ[SH>}}ۺC{(~t:fϘW&J҆HJw'dҫe43 juh\}h\ lb92U|bzgY$.AbC>4V9İ +۾ڣB+u0떛0c_&z!u;;wH@QQ3b82OQQ)ZaYee$eywZjlA$fJa, +I#j}nDZ; +p.2|2ӊ7Y 'pH7b}ܩ[KOSSOT󢆐46k_^GQ>;1Gf6uKLպ-K$g'%:z6~>ъi\-25WO>Z(Zw_9P +-.AO%$2K+OmQYā;hH!b`RPnp 2IU"'n3 ZO^Q%g~fwzcY$[jllon wOД5"}E-R58~8>|feޣ>giPWo4տ~!;ۉqng*L͇P$6ƹI"R?^7ݾ1_=bznSaYΝjj/%3kNTswV32Hnb"8zuexPBύS'ݴ[?CehW5b+XhA-q,,S(cY09jrA+|6 7!kiJ~퀉f9w| +zLwδhHxX6U`~yÖcdaU.H)'QVpLMvr;Q몘}usҗ]x\[ M31Uk_Gq!S<*8>bZSn$a<;˷U熽>M[8ЫO軪/͎MjET`m{w~zjFP(vwNYmQ[gZH搴b##RPScYrLh)]7k1)$7wwY[8JEf<8y GCNz÷~ԭ̋YO0å i&Œ*eI=h ).΄^TarTo-]qǏVG2֠ Nnn~:`M.,ce':c|c4Q} a\-%S:, ILʸ0U/QkIfAA kOϞE N?<+H+Ҋ!,X#TdeK^wuJ$j-v/l׳=zӷ +ώ+Xa*6 -ʆǶ'l;v`Q3\+`X`/; ^䟣'K]Jʖǿ 8\KONeTD>!O099$Q:UH+~ T˖+F&50E _'}5judjR?>F=C;k|xΞhzoVkFwn"T5=VXAMy7Kvs{ywГ0}ewΕ( ݃)a[JYmk&e +]/6HB ؑruԾz%t)5[(gU4u#]8?8qΏA3AQOGf%g!+d6ofݏn\Q[+pΒP{Npy8%:dQğ>Hng +zV-N~BnP)$a}t%t"cYoSIPs~awkØovg|Z=^@l±|QpYLOq*z1adR"fox>PbWi^6[$ ()mGjnX:O1rI0x cϔx0@~* *~˙Hj$Y,4sBy)"U?b7xűK:ɇ+41v66e5qypTDV R.0WǤUb }¦Ş?U7yzm.(ʭ[ybvՌTR%pZ` @¦Kdžv: 3'lof_ِTaS 6 + O~7D.LjnC+V y ze\ #{>Ҩ[$ +Gf*@Nj-0eGG +ꣿIX;}<W|#!a]r:6䮉†M/G+&/>!ӧ0ՏAP5XÂ(jIb*r$~Ēu 2Tpcm Sҙؐr:bt1.EFϗø M#TH3 2;75t<|}۬Y>a޺c5RDJEZͭ +v)y }欏S'K0ZZ-+s%Ak!Χ>7s)Լ͆u#P  !kk hxf%sp6c)}bUbKaJm5gy;~p$ɹ(JA;<v%r +%Q?*f#ZZ rW}wTQ#C`߾>`^SK~vQŰz*6i2w|5*G7̬ZR |Cԍsh\)x$bG{ o=ez.2Ug ML_m\ҍVr4ޫk:< W~q! DzՂ%$EM˙/R"_7\IW"_ConY/t10s8΅ގ.-; VKܭJ> qSܶ\JdǾ<61̰*r>(&ɐ̱SԕGQv̓%t52͖H_/aMOƋQ6L]V5&d7-J6߰ƾ4u"+A yBBuK4( J#a>fmIVJAdcOOw?ZK[WUu&kSUR⍕Tv\&YٍOmj 56W 03tT ]‹X>CnO&S&P]_g[AiEo$ 2;*jkKT2P +n;jxL +]t쯼t#0&f82g)CM(,) 4}x"|e_" =!Iek  -zp,i!KфWM8P&MͪLնtXSmbQOMU*Eqƕ)܊ "Bc`N&ސɨH߆ + +i! +ZlC\ST+N +a/dÔ3=S2KU6/r3 bn=`2:DmJ3=J2Ҷʩ5dl:zIashjUR#< S3 ]QSM3WaVX悪YIFHlICʽ +i$DM71&!]II#u8}<о4pv=_:AipQS6-[+i۲F';nPA13CGSmH3'|$G"T,a0K`27Eݴkz,9q(TW $/>62}ٻK>#xuRs5&j*T4f`XNQa8&řJЛNıE7W%J4@o] =ż < Ƅ]f?zm >=Rde1YeWH8!xg;_ԙ\Q4J,`'C{+$wݑ-eeJ::#PuySi)XcG 柳Rr=!S*lK!ǂIבfL}QlG}Ǎ$(O5gԟ[py +*1\5PDn8G>4(,8+NW*3ƿ>S܆=G_g!PCo^E2=8;1Fst1Xm4,Cp/sy&eå8NcBf ̯7v.%h1Dr] uB=wwl'&vuRE2%TKl--5=~ r=%U;m7H{NZH!`f={58|h3F!I3VF0Lr \d-On*e,G-a`Qko<j`L!BE + +)Y P.%UJ~DbIȧ7 bنlW*dFdm`{xy;sH.ӈ=Rzr*&v j6T"7hDkkXKhx)/L{Jh +qpO#gͲF8ǯM 7G&jI(%5]ߪ͑r<z%ԧ!&hcݱwOSFZN˸[Edk(!j*&geN$7*V,c ج~u?5t6l^@ 1dJƫCG閝"j2@Iݸݼ$ M[w_t- &}im$՘QWbcv7[36[\pI/$N7MekIhٌ[$*0&nfxm-&S/"R-lTwVF~/=6) {eĂ`tכ]Vj[`Cs/E.#-$MUe,t?0' +LSX!"A1*ja(Ic({o1`]?jM ZKm^q4ՖP Aϙz OW^tb!=ܟύUx]oV$1q2M9jl +N*e(z6Am1t(lr3WL +a%TU25U5VLC,<Cb;kq TS~ڵ[ܩP2S3œ3y ud8DDJUOYTr ڎq Fԓi74h#sv k:܃ഴ9 5dfU䠨QD{:[&u%#hj7]h6]y)UIYpJ3whB3S?8Y6=ҜJ}]ڥ,t{`~N\dbt^y**t] `:],E>ONᰴq^cp\}Ffu8\O1G!ۯ +Mep%Q<ƈp-$8|Vj*z$7,[1d,T +rye?h_ jlx읕-n$:$2aPmn*t79b$,5bK_sR"4֟n\$ϻj!=#ef;d$aתIFfX:J )A^ãʸ4R,c췁r}Ftej9<4n-O4̘} +&UIS`0QYEtXFkp(2W̒Gͩf$bnF߽C©űlPLF + 5r7/13vqLl}z^Z&|)6GSVrΨE|RjzY _Rg;ntۛ?^NaxF'C^{eeoqK؛-k:5)*w(-4&hc~ǮJA#K\2[XPs|\ErZJ + ™h&ʣެb +',gy*&) I Sۣe%X0~ev2jQNdvj 枝E xESɈWSчo%Ÿв=fߧtu[YEMcm8%gPfnx6ce}hbXN\y[%bI{{pngJY3&OW=iHj $CcwνSܷV -y. ,P Qcg7jcYkzc,,lGXCܻӌ&-M ^?Yڐ6c@&A׿sry?nZٱ8qx;ncPqbN @3$iђި +|Oy5skqLA+3nof{V:ԳkіbR,-.g̛^lgjyJnO`=4o+v2g:kf" +$T;I*6?E씘XMo(tlZA .(MTM ]xk.q2a8!ՅϛSm]Z +ozg: q>§ѥY/G ]t.)YfXf6b,, s !;6sJ6m'NbxC<뒣z*1-۸axKGoiq*#gvڭ +D8E- 8I_5 xk$QK)IMj Ow{~<]!$u¢'W{C{zƽ uuf\&cwX^8K؂s|9)?Ne)J3Kpx U:5y:TAo ׍uЫoq,*qZċh z,0=bmtt}.[=4ɏ Ɋabp$ۑ^;MsE0Vx/%ȹFXrv0)m?>u1SN:I58>Y6$GNbd GFKP|Lbu7Q2_ ۹ uUBFT@kv: L͇w*6lNh$iҔ<:  OG`m9)*PXm8̒coM-t pq~ap(\7 K<(9M0+M9E+nZ" .TPW*R"[!< eKQl똤ynMz%M\ ^[ FRHԵ杻} uA0Cm6bONJKN.qoL%B^!gKO#,@1 PHu1HbS4T7,mj4(uW5Gv +V*T@;:h +e_aFEHW4n$}DtCYx1T"Tp`׏Y9de *`aSpӴԽ-G,)vb>$*0zj<%*12&WtJrY[j Ua93EFVmPMgS89S4X*Zo%pԀE~oW5a Rp?-Re^ΈƸ^(I2@-1R\v>Y5=GUDƚyCЧmտ!p)gh;ɼV=rT:+n7jB\ԕcd,[i:hjb+|S>6(]wķ6b +Zd~E4<$쎪JNIՔyáYdv8.W}m~V)6"h'F +,lO7yS-;EQv<+6K\LJ`%uFve +صa~rw՞ɕzѰ2TըgQ&$Ug!u~6:-[o2-i:V5$O3w2pdwIAQr7\;挳+& S E*OV:I $Xf&5&OD 0 >Wy)v1s3t c@Jzɍ#WUe24X**ŌNp +J`qR=i˫% FO# #{E{ʽٿl-aC%M$,ՉE,a*O6XmklskJ8j:pf[V i2p]g:!h6XmKod<2^6of puEC@PpMDo_D蛡uyS)C1u +3T7vYѶ6x@=[~pTez6b _mתj׷6nJulG3G-.$ؾ"?]]t1cO6t05ďu}}]8̽O2 /QbI.꩸B/eSx;zM32pL!亘&0gJ*Y`SQo~?dΤ d'QTgl]<̩xieJ˸l-~1[anNR,^J@ + + (:4Ru?$cGr=v;2#C?I'[qֹL_w,n<-46j_7sN'eMcX1J3O( !]On z;0Պ+[3u(A)z}uCYTTF_x FQ +bfEIdUU3m׷f+0e a2rny!Vͨ-ZTNb>裗} +uS̅NiK"}Gsa kb0[{{|6#^t[` )}S0o8GC-76̙oRW (RHaX!?_9֙]u}Ď3Cŷ{2H"z4:ɝ? ̫wӝf993ai;3 icKW߶O=- +Q5%f WWeor)AjUô\xRKd&|F:EezpF'q%/O,d56*i3k8d+Ht =,%(I楆8f8SC S0I,bطk}|EtתuJ¿&vߑnHlX4RuFkmVN- &殟t,,0ʿDF*㺆 ^J\;$bC  Gv`lVL5وa4%`QhZ@``t+eDzdXE0LyԳcڧeo*(jt┅4l!Az[ X\+]FWt=wDzu޹F`8[b5l +Zh޷_ 4ehmVQhroe=+"B'עޠeDo_j5} Bw+2]V;H> 5_R0jOU6Q$)ONGa]nlt;۶ZpQ: ]=bWm:-Iɂ\^ U45JFH; 4ض%+ĵsS#-5D2Z#kv.e%,@8j:M]<(~^2Xzz0~HiJ* Cۂ OG6UbAT*4QEl6hS>$ȅ+{)z܂ڽ6ѫ7ÚFo˙פbRaX,D/Nά^p`5 'AQŋA +v"2מ;H'R緶7Z@&=zUk|OC%M%Vb=ln5"Y A'}1j66  Db3J1*3D~kqW0uph$#rx셮lӸApNZhL\4_J|$BvPS.il;AEkKּ['T8n-QG#\Yiy:Zjj%m7f4ٺ?(p 1CexcE,zWHI t~`~T=50Z;$i󻧮R0lD2Hm>v3MRCI+3(C&Z[2_IXFRTEb!UfVFD.Mk˕y7#TFZF 8 ~}m +Zx#m{ү"phsPFF_UPYJa#43 5(Xeŭpgk87l=tϹg2q*1BGNnVe,ҕ%ń1!uQX*pyq"ɔk0Ǯ.70 PW1j'C+S$1MEV1~qqEO b >qOhB(}݃X< +Ge)Ri8L7 R||8σtKRH +{÷,-2LbL[nK2NJLꎓ1Pv9.c'\c."7Zzycܮ] m; g=ݗvF*aiS -4dpcpE1JjI3+W R0;~Gƛ.6.o\i(I?&r3!bO``GFbQb7ڹkCg,[%ze&/1jegt^6[NZ7yr< UqCyn +@RAͅy/s6mRV-M[xI1,aٟEodViLL.u m.mν#DB:T*%4dLT!v1pXnpȍ1l⭙umol(chx':\ME( S(aԕqRv3 [ܞۭĶT1Z r2Ga=2uGֿPtc:1␈i)gp$f5krvF0- ,HƌH$dE8cӢ":@A9/7ac5D!Z/3h*TyHxtw쿱t%,w퓊 +uGZp0}Փ6Nh-w͝"c'ˆ)a/M ţQHw}X[wW}SBx`)\Ԥh{. :pq/־tDQkcpz+7z=jT9ǹ'[f)FG({<5|m^8WAߩ|֊3UISY"uj%2,7^/W H p"}vvTApWn@׸<k?$!_3 3#G1XV#L%9K#: +N?aę4l렏FX.K#Ľ\8W9)4U18- +,4-CUØq3Z,B_$SkY^()[X^(+:м_1`9)eV*1*'GoU TE>vͥœlӯmk~e⻔!$F};k͗r%nKl #G)C6V7Ը|`wO5,R6rn>@_djO@Llk˕g<ŀUSaQr4h!Qp ]G"O-xQ #iA8)IFe㎾S% GhU'7<8fT7+`0cUf ut -ɪp|17{nr+ +O=u]d6yU۬]46lyo-Pb[JxT]́> Xzԇcl%aEۿ.n ݲ4+`_-kpNG2>MuQ yE QU>"7$&:۷i1;.a.qI6!-/.yhP_N? +܇˦VnKUU~EVx©:wSMV=F$ÊFHs5]4 >u5e(|,7I{64彮Zކ$2m/hY8P_r_):1:r-F?v{HZjd} G|S2G 3dmkµ26{xudӉ$׷]T@@&M~@n UGCVq0^,p%ȿJGԼG:{H<0;U%F_S mPZq\Aɦj[^]|2zzΦ^eehͧbc)"y7-4/4zKBhq!UFԀ8߅׹'u"ܖ &Rt췿3ݶQUsm18[JH%cw42]><]Y_Xh^Xmd\'E҉#Fjyë*q'JN=)@U4662^A!pL-$u0AK ^;o.xh;ַO#킣j:3Ex\?54ղXy-Nx-ɸ>cؖ#ahFw'k~rW(?L9qs~e%?P(zX$}Cu,řf^ZUì +U|n˗t&SPe?i#Fncf"gvPT9")msda:hz?P<]NL{MVԵL#q__}L 9^#` &*@R2-Tv>XSOd7/N<} R -Ԧ%q{=VLIɒ5X,ov[5׼zUqj3 GogmGד +ԡ$R 2}1\^Ϟy(H hq|^0Pf/-}F'η] +1[]ڈ +3s OHx}fHåZxt<#HIe\kl^*xOKW<]\>&'p4'yn'4u=:c9D6fNhˌet,&ZkubOW(HU!sNeyy"xyQ`pBAh$ʘaY䮡at؎ZƠ|i%Qo;\'/WCi*/tr-{a,;l!+JăJ}Uk`mHyhz8tG)+,Yi7|ŬmE6Y/ #݈#άoN{7AAY$pǮAɎVJj+uwrAJd5|玿 j9F #NwFЗ\:*J]\/-WDm|e(>$G1 ϕU]iS+n{t ̘b 4eņoR1D+Kh8k7jG +&h7ڀ}{HyX5,^JX +a00424e,58gufmدorRE2u_ /~r0Nt۶ RuTROOKd]ǷXrcS6!Ji{pp'\zu˕>eM3.ȲOqߌYVuə*jٚ9Yv["S>T8uJY2N`Ruo<:zjVZmjNmiV0~>ӺѲ)ދe=:<#msDo58ayb2^g2a +9|F_wmx|w\.*bqEK=w~.mζN%'3]rj|y:_hv|Ξds"C9 'MZ]vvyl9{PtSV!=Xڪ#7S:T*}ʌfpC{_=æk >u/+e<͘cCO=KB)!M8ɽG²d^\X1xFD6Ƴ|ݫ- PDWq¯)1\N,u yI2yZۓݟ[I*pLG͙QV Unwk=mC7(Pv K!o_voA-e<<%GCkd 3K IcS-~vRY:Q.%Fw3X)tvѾoۯԓ'pnn+DԴ&c0mBeR>X>j /  ~%UW %RTG{"icn?ZP `q2^N!HW#ž}e,ˊg,b5uY3-Rbh@(V8pID1+lwH}sa 6mYI +|'6M#B',02g)Xy1UT$a<[mSNDհj1V`6bYZl8LOM3kˬ3.1kz4tOM  7 Kv; +q_:IU7A>QVPTLM-l6iQ• X$yq4XHFQ5jb' f:H{K`϶fSXf^iCx$@ +}X:AYS`@H$8; 3 ɼJ ;:8eymP~ё:ԟ8qVp8-{C~>qdKԤ1UͅÂj'EENTH^׽˶ٖral`vt/}ƔƟ}QsJ@q +W*]Ѯ$쭕s4 +5/)񪧒&6sD6ͷo;?9\ev* HB@LLϔtsoohrȤ$F'3RSÜvC:UAaC؝I fYI&4m߀\2M)H2[n(V$LҽMF2Pj/Ra3\9x , $7w;]ޗ;=xcI:e[ֈOЮ^#3`Vis~!/SJӽReJp"Fʠ\*{ɬmw}+aU3k)~(Qh#X8+D9k8c=f-,`eU`iv6q6dKvl蝄H5heY]Ie$8 +}8%uooْygKTIàʼnxh_ٺF /wfDԧJe OAݠm}kxc8"_"&N +a~Hcw)N')3 U^#y ~+*_ӼbȦfЃ8bѴ< + Qfof͡T@5GKTU;L'ZJT1Sy$ +Ī>evӓ'm$C $0Ǯ6Td֎adD 8W?*;'Vb%HXM:pmm%gzyUptϞ8]D~Nh*0,C4t MI԰(a/0߱SYBbppH!%a,N{\v2u}uis=b#cFd ts[ٽQ\)J[KR1RH1XەkgW( (8a嶭G?N=A?8'jGE\||,`s Nӏʽ[,)t.͝j7Tb0CKR,`^EjtFLk:V~Am7uG8/N:*j  y`3Qq6 ~N~(IhTX 20TkٔYqmSK$ +NcĮM3ϫv::i;jy`v+Wh|­mpg /a1PS*K.m8fͲ(L$)>+V1P9,+O;4Lܖff7$$~X~MuaMp{ &~NF?X}EM<Ց=dIDl ۈˎ 1R8]%5.8n>ɵm7iֽ@ZuMJ$X^1:3{Ʒ}5:ٟ:Mp*,r_T19OG#,kO3esB8[kK@GM&:иX;GiU,_]] \>x-.ܾ_$zA?E4/V͇U3<.Q1Sb ip8͙z.[IWiW_*ŪWiGTME9C%ޣI$xTߵdFĎUaԸZL>cu6Y8Q>U<XDysFjpIU XG*kymFkJ 05eWvۄSWOzzS6d'UqzVmc{oq#xE'FGӯ[U=qf^f2D-rJ ]hv=._0˺Vq8Mtg z:>(&CD&>i\(p,, !@IE+q=ڑxV9*T>׾P +tbCq8@tܫU~ bAcɉLijY sE0aFbEx^sS2fΑʓQň.)Ds@6u|8$mU.( }t)}B5P죙@\K/TTeӾɅcbP{T`a9lG7cq_/jB !opMoz*W}^fN)o(To}*t,z{1JyjLBC;%Ou/ཹ +JǦFi" 9~Soc&T{m12NFnzWo QXDTh n6<9~a8&LİQC5U%5iO +[ I<{@FzJB%j1A|'C*IXAQTٓK=L2OQ,U4ҩi_Ptꞗf)I1,Fmdr>7KO17vr3Ey}[G=iskqYoL=ut Qi&ٞXx9%}0fE<8~52HX*1bUumN}w.m.Q'a:"-ڰB: vXgjOIܪ_S5IS HVIvt!g:#$1Hc"5z8\ aa!u){ma_nnpAuVh˦Ҁ@3K }|?$b |ˈN&&H#mn{?9Gxyjq +l,JIqY|x0ˮ[Si`I?*FݹxÏSMOM@:bt eRP\X1Hm9b3fH"sRb,@-#&6잚37r@q;j=Z`Y)]9×2f#6Oy<+ݻĒ8+1oETޡ>Ok(i5og-[]ۨ {hyRZdW*:m p/?! <5F$7,SޙFn).,7V<эnEJ +^f\6Q|VSPP@^xfOH(07Z B:6e-*R: ^~gZ LRFfވuVR1w`,t:M mI]h9(A"Ϲ[ L#9Q @m?G2~Z>#qΤy /ʣ@GMsY8u&*ߜf&@&(d|zTS\pʔs{ ߨ2z=M6?Bpj>1krx5o& .zqƢ|bU}^@Ibý&qÈ "S-d-Fvҫ]~2 oaM]*` ṗi;ˉ[1C$JOposk]IQߐ u^)ŤN'K bS*Ҥutc?x XpuE.+6I8'O,k*Q"ҝBӀ *%2uexm+:OǤP[03 l yqKV$\9K.-f|e48IP = ^kt\J 6u;_̲[gHH HAK!\ 2ekj35rjx4TtXWᅫگXU>,85ާҙ3O : +|V\E^+驰pi.K{;04QS]2&vR><*-C Nցɒ?sDR3-uC +3W1JfpɚwӰ(3:M.MVjmμ0m@aѲΙ47 A8|f1|0 s0o*Y6U` UQ~V(fK?JJ;vג捀 8etCuPɮАO N0v|XN3;+6226x@^$ۂxEdidk/T}A\:G]{Jď% (KEo(Q`ˉ_ʽǬ޴s?ZrN% +ѡy+P5p[Zd7vogݑe9⒢p̽`GE$f]I(=D-l3\%e(N80pF97+:Dc@KY;I&lb,v$[X⎰ ^ j[K幙mXx HJ!C9Vjnަ\-8JH2A8~bԵ!r`nxžf)E +Kp#]n?Pwj +3)BVI%J$W#jpҒ֩INhRgY**ĎU-,BȡA!@6'S + dvs̔uX՟2.hc1sb r_GS衭PEh3H{jI@Z`-׃ RqHPy:yA#3T䝞!.`XWz:q:y lƥPw7g7k )* +T]\F. p#Oއ)r)bxj_l cI%,pA]C0]N~OYw0|F堕&ZȫI"D+@T@vAf_JJ1J:>"KwuHש10?\::GUat3eIlJYFY]"+(XU$[R=Ne*n~'b-WPWи*F+,y4d̬9m^Sy6N\$8>ut@+fȕLaJuC+Ɠ;/##פxM>Y~(jb<"3d +b~A5gz"0?^tpO>uKSVFkpF$xebQJQĻ֦}m̡͔)螹aD䈫x`E{S*VpBsWh` +N-zcۊki +Wx,WX$0 J-nHefU[0b|@VjJVH3=y䳔%!R\QR2%K@$썘喇#'qhx]n! t}a‡Oׁ\Ocmt1Z1_L?7E,t_*`uRO?OZ\2#ŀM?=@`<-nG=vj,)ŧg-TU %=ZFډ_/۞v'ӌdUZ90H$5^yP?Z-w 3W;问'OO[cV冲DuXyIܕ|>9,X&eqj9nZ[ +1OE5p0eBSta//\p< $wK3b{Onl;y0H㷖yNo[q#٧V}2VDTz -b ܲXxmÈ<a˹*LLhgTjq=x˲E5r +P. H6+qu7d-#ȷ L7Z)C2x󦒝 G&U_W-RÃIЯ'ɲBаz0#m'C#В+x7c{}4l#k-R1QST6C\#{})xO/Sja HpaR5phi:\g>O;ySr_R78*ppmt?3gV_iTjj] MҰ,@%oqpxЕhNö4.RS5l?Mt@`g+ގ؟ 6K!7{inu~Ag:mk\"rUcӠP~g~]#h$PbIVnZYtԟvÄ֎oFQ|\BDފKny7`!Jze||\F.H[mܝӀA秌 q6g.f.S(GGGlkv~kf!(DIFʎ.XRj(0;a:/]))\0IL ,ʋXnRr}GEԖԤj[pWviO ?uHV^;Iv0glr@\6Pjϙ+1eɑ. ޗ q/7y(heVZ,$pjoF=G=d>^c`nY4S_08quy/8tma|E,?^`}jA{^=j'[9;PB~nVijPM}683o[P*<88@uI҃M;Ɇ"v* +;jN0ctP[jǁ4$ӄ#֑==5X]dCްOy̓dʼHm[C~ _Q< +HLZQ xS)$ĉ +&v=]T+ucӾQI𷚛6Z"*$<;g +pc`(} +TL6M7#jx~nϓ8DUWGCZC1NrmQf([5ȵ~9ٷiW96`)N.Wԡ.!SW"$2E@ I`91uKPS4T2ٵ:ǘ4)OW e 1O(|6zzWOưT+;Dl.M'j\g +o"x.3Bp׸'C3Z +R1n|nE42^ +Y>fɱD6ރ}՗{ӎ+b4x^p÷J^c =f"@ Mqi +_ËSM3&cvХYx^f|>kfRSM14+r-׃Og NG-mn +cD_?Ghfꘘ)IEC + ̨asڇ Wf̃ vCmIP/ţKJƽv,9hD3 t;TҥL4*7-EYГ2M}0`Zʍ&|-s1IYAKCH+Y'f>Y^M^|m1/E=6H| 1bgPj7]A6\[^ ,[BCI̽L8$[)F8*fZx0J_%/BGc޷A2Qj F_4~ѱ))=>ҩf +;$վa=٪j*S!<`7F ʞזϻ;o1ŚĤA;AT`UV']膧>P5yTm?;K]_*Sqd-r} z˝Ur7`*GnT+wRf!ĆԯH mN\2ضTI0Q=.uү]qld +ƫjke؜uUrKȖ%!?#ˎ(P?묙*z~3nx--=`LM`? }e# +e'zEαl>|Ï*,p`HEQ<'V|Cb<'&`V;PD*+v{ck-KD-<:G}1^*5@d +fe${ xncҺ,b0`S<GrM-߁Y~l Fكu1_A"Xaw +֟?a,2/ÙpcSj(E[h*[íXk1HeGŴht{ѠVW +uƺ?88)NTg0~=(zlW$&hj35Ƿi Ctu +6PK_PT_GDSJԹ&<O0Įˏpޗ3RcrfUA,6I%kp;g )P"˙(+&105Tn` jE*@54p̶a|8~E}fu10jUDj, +D7r5 ȏJa̩q¦\U@j E>% e`}.Xſcxq#c=T'1M]<lj8J֒8`}Z#h50fJu!56!)H%XpA92GewdGW1E#j6uD f< šBeL +o~x+0t n#_^% +coO-መ&7Fx>uZs,>E5 c:Y|Y_8te)(BS۹㹭ґbe9ťy8p>tpL:DBE$x1`מ`1ɦ'I4.Z5]ڶ׀̮_Mof5@)F?uz7đ=m/=hPhx}0[h;mb$xHܛ,0pU[dzQ_]aeIUQ{Q. [)RϑA\p*zchH` pO8ȷx3`D`1;+!2L!iq)d}6澥f\Ն<%zꑑc+G~!n[*&I6M 0HX݉#1RTRSXfi/]%xKQY>rt5VJٯ05d3'6 ޔ35:;zm텱 +$5xwVnݵ?ĚrjJOE̵Xo]_3T3rM=Dž:sϕ);,1*2fa#~.,+&xZqʖabT[R;E`SI )bOv_p撗IMnVPepvT8-f8&\.y]/ OҎӵEEkIB wkrj 莉+/=T(SxqcU$m{l.xcǪ[AN$aW᝞@ ztW'QQQ闬ܥd7"UTfvT Y6{;ȹeVIΤ{8$VR#`P"C%ۆ i>dxrHa22U9S1^4L22U"cNH<𔁴6GHRPz:t +V1pjEXq̡]Ge|$eޣ"$"fDэ\[ v/nS"pRA}KږRد# +o,[Hi棂SuSk>}p 3g5=T*l5ػ+!,tkK8@$*|7k흃PD.y1M5T5pa"֒ $D {O-rаdTƒX/&|0d5"rdWz,&i*!1#oVPTL$q[6&@Í{v-lSUEFWCC(̢8iѝPYUwV Zp0 `ai/S`OKNSfWUt=|EKCrG9bQ%awv6>"cf5SڴJ%gZj:ʕC-Lj]6jhp"pY^Pcd}g7H>O*ty"8϶G}3!Q|o8zRMc|Wi>$ !X㈚fHh⨂c8*GmQ7*+7yC IZ&`c00T0zQfު$Onh>'D/%li 6\[.8ه > l-sRB*$)XLM/y\z.d+&lF4#w6{⃈p&FU%\cI<:]ݽz8}CLJMEd-n8 r:4>`us1bݯe _ʯG(rܸnf4n.'I+PڣА '9rTPp<=h~Xn=<.&{tY7RJi"(Iˌp. +:y'q`x rUzA15G[Qohtbu?PW`ŋ{:|xE t4;ELt *3-r {pХlBOZ`O4<)rt4y^x\C,y^-}Izd:qcD=zCI4$,e#f6gi׹=U)}pe~Id蚧O[qK}p.auud+s5.d&G+ۨl\VJ: η8`[ (};hRRfF\a֌ϗ]6 KaTQfUbn qr[$UQ;qǏ +w  .$%8UjO:㈦HQVKff-nXDuKt8(CQ%f c XsHHHQahzAފ3 +ʌ'2APƛ`=׫ ĦRfcXndI0dK}u +o5@э +gkY~;LdlQNt+ ZDzmw#NpdY(`ƞ _o:{l5㛩{}zR4pR=Z]Ll#ˢUYUĺEA|YQOIK4܀u:ݚz.⍄Vu  "_ˠ"@,GYբ޴~\`zjgYu8u?6J Q&3!F#~Q؏Z>I$-ةp }[n&RucIvƍ-n;;Fo6ZnuXZUu0TLQHદbux ~<\)"(l$`4~NՌFgRh&wc +1<.[ #KM)W< oKgsbP`I<1] +pIXwtM8mM;f1f#߀Z,/וzUUzԾ溜b6x&깞T;_˅DPZë_I(cƠ_ˊeDAKQ(AE&xT?,ae\Cšt GZ'Uʱ&GU4wo"8)O/={VA#֍7wgqu)bNo_so_VanG2e* a%UaXyӳP-i)^ Kթ >%c v]v6[Pݴq3ful ;E7UNeys.),;pFd /QF73<UX@; )_0XSK}DdNacr)gԵ‡ա# T NQA7X:ԎZi'\w etԙjC4(|Od?W1`%$tH@w{p?1,5vC 8> ֍#uKȌP,Au➧^-Cp9 $[]4NFWΖ!204ޟA*X7kmokpya>NrrRA3$`y@|O~9w9-ëui'E=[88&bhF'e.6>,JurL\Vy43IM8դ, {~_3-6L0 #$nTԖDN:yO1tߦOf11ĥk$YV׌[G/bž_(D # 'XI/5 CTAz~ʹb)й]V)vvӹ~%pHQ +(}I-;Je>fN2As1A_CTUC:؞ZÜ}AYbhSJi,x1lJ¶M7x>(C~ RT].LFihins{kPB@>stream +Adobed + + + + + + + + + +  + + + + + + + + + + + + + + + + + + +   +  + o!1AQ"aq2 #BR3$bC4% +rS&cD5Ts6'E7F򃓣dU()8GHVe*9:IJWXYZftugvwhijxyzi!1AQa"q2#BR 3br$’Csc%4S5&DTdEU' +()*6789:FGHIJVWXYZefghijtuvwxyz ?:EeBRiKE3,t"ݹ1[)Ox%]|83*m >o5QpL+8M56PıZJ|FU)eEi(`HVۄ%X6ńOί~'2ZT[ZN˗zfَΩx*a[G##C˹vT⿢fG|g#?WL6q<=~Qz嬉s:MNfdê1Jc4$g])": Cxtwi # +Zev){.'J&F&~QLYoJzzw\qZ:Z(9*?X!*;$"<(qܹT2A# $6\6Pw3 -C +)X (Cnzl׬J<Y3J~tT4Ob#J4vS&ոCdfSJ$d}Tj$Qf8NhAQ8 4=u/T 3U8lKOUrSy^|QҘ5 +ו\j;⤠"D#gU,'K*RYi):I=qIÆto䨷8:nbHT8l(da=d>54=GٯjLG GOUH1.H fX}7vR {A.r_+SN jJDj% Gp|ǡ뫽f]5x#EpI>hbQ4tȈb=ʬGgj:N~D@NN&_Ǧ]<^j)lIdigZLFQORTj1U5BDaI0úOAN׶-ɕ(h-cSI@8s=D(F| ;5[u(ಟ&ٲ^X [*)FDZz-;iO< 4qpuR5 * n 5EZj,=(a:^r*TaS&IX6/`jy +}I;Na mg1#SH$o]z!EjZUZ<.0pG+- `ۃCa^ mPR$`7# +Pߵٖ)&qLp6c wͶCA: +*ʉ1%c!00p +/u =Eβ_Qhp콏VC-?%T췔cF3}*˻NB?} 71ʭڴi(#R %cg q7Һ; Z̯NjFw;8B^rgܙ̊! tǧ +nnQ~C1<ͅe iF#b«X5 ls+~ԃ;v) bz4 Q=IT GMsyp*:Y9dI|˸=`/acz^IQҩ1 ++f+_xPa;=i~z䌷XpƱLjFlO]tq*e}`"̬' +$[P!8? *5p\g.6Y/S%cF5O$3BtF A7}Qn ~s&pBRjE@%cGBVFd+>>%.))2kԸIlb90ԈԂ~S3M-xqƤαYT{/ߚ+D +] +#r"ݾo:+HpTWxF0Hv[K^IR<[%n;֤I1yj̷b -rXTTP:XaĚ8]GnQ*ӌq] SG+804I*п^~#}v͸McrSh, pL:K!jrrŖ}ޛם ï{K쓴k]7lHV:@`q5NR5\tTU )S L~lqmdMBف"wx/I At0v :xjOߍw!)KXV*` lX-^cI\)?#"$IH`TK2Lg֖#SR:xÄTfmU6}!]uDJp'D#Z3&) j|MGbD0I SG\-Gˊ&52p.eOmIK}靈MEӪOP&~Ƀ::E޸azu>ip.eR籊Ǧ +i3ڪљPr8}Ľi[Z\cv-߻\)2F*cvy3NeFfɽ5IǨjq:Y u*cEt cvffC -CXR@N2v"7fy NT'@(N ޱޣuL\.tP)1V:qJ,u6x--A*~nW~{H# 9Y3cl+>z # dpI$cSM6Cb#D-F$Ǘ\|yűޠʵ2B!jaIhdWhLn.Bd2sw::HouSWYK H L'>>T/$RGgpj\^:>j2 J)7N[ek=1"vyKB-c†e*}%LLMq(r.Oʘ}lp32CC3ܱ#bm¶s[lFm"L:xMfie@:Zi2A03Qծu LYJyɈL אg?[S$'ec^kvIyX}h Z)*&IJdٰk9w.csq.-[3x'O&);m:injI\Aaq*Yךb m4 Д0t""QWQG %Mor}JpPHi͕@UR0KJMS{6b{qwsUbi3GqY0ŀ"CIN 0UGii#kmAOK}_4TY¦zɈQ$Au6 8~,Tk\ƴ`1eV9ʞhE4eClXxqelBBoPקyGf4B!W1,Z3~iܡI*(Y i3~ ;?G钾xhaz,Gv=vI<vͦjC:S01 O@C< Ԓ0uPS}!n7;cWQ"TNk -DҟC^ԳP,0"!mOpj"dpRF#T6e1 +W#[da&xD +Gb2̙߮}n9,J qhtk(A5Tı:;j8=n5NPt qvQ܀ +̀vlglI|s@(ez:|Ņ2␕1l*u> G /-Ԃ&N4u'TÍbˉYUqV*58kk(I$Fau͆=X˙ft#lS&Lo#L=3)yBS분߸#o{q1(2ږ*qNY#UaxUkOΏU%B͆XVx1υBV;xaG; ʗT-FK8OXEanV|:UJX .lhۻv{ڋe#p*5$`0ğ>"m7Lۋr +pc F$57㦖eFRXIIVp$Uih{6 e̷x\'֤ y..Ҵ~dp>U\CxuD5 L^#m#̅ r +v(uIH&AQpG4WjHp O:S,nÔ6xv(wKQk. Dh>t'̿1r[lӇ.g\ YnT+EĎ-$ٯe:p=-#2$ONon ԲLTONtNw4l|4i:3:,YZ/sws7 ҋ[+0ppFZVܖAfA I* ..?SoK2tƚ8k坚xhdyIxH`X +aṟl[ۣJ1vhAinAV3JN?\׎yG-u&:JfIG,BAnn9vIA24U@۫sgj7Ũ[QUDRWf +oKXƈQe̞6ZdQ +ʨC:u9 7[ĔcQ[)R GΙpLO}>xu8P'f?{ߚV6-jPPS.c1^@dKғ2 *[e_"};';('>fkIr)ZF_ c,=eR䎋feO5d4b|ӚX$Y(Yrђ.dEQn4ꃭ5ttT 73l%݅ DGfWӫ9{;K3P?l2JX0Ʋ2ڱ]8e7"Wz$!8 ș#`4ik٭A#lDæpetBij K $+b81ہpʖhHJL1i*35tAi +Hg z;"uNb-T.'zEidE FI_9Y!O\ ԡ*8ͳyR +DOI>s3@4^9F$Bj{PP ވ=n-V +$6c^q +]?+1ˇViQ,1 !a)q0!!*3OG?PY+= i$J@3;|Ts5b[oNg̊s3)SCRjA+JœJB;N~ .ɚZsS)10e-qYbs@$Oj `bXl4x0\b ,JXS+v?t,m(V1$Si/j9&XBbT2cc=Qy%ᕙǛ?l&C$" iJ &jHP9og,6T6 1pmL>F٢MIO1y|s &?5HbmX3Onm*%Kn^э} Q9X`58YfI_t& m=Sg-nʬqw$OYAWl:AiyB$썥f_Cx25l1j#Azjnns۽hQw[!]+:-"IO ͙lh "ak;vd'O;\jAl[;c'|UvvòԳ Y]XY.tE?ٲ-qsaۅ(7QQ8B .1,gMo$${nC3RSوAm]eDtS6 dIW8!]%bKX2w)b;|42GLc=]hw7=9R|JL$ ̒G +hQp\9XbgYb$嘒I'_o&K-e(  +G!uxa FـSb37TM5.3*8%j$zjhĸmw K}pYb$HD@θg/L=, ɘf 4[Q*:ƭّkEƣ9J 3qlm@NU}'RʸgĿv +6+u +>~v;Ŵm8% S;m_]Bm8|y}(ĠF92 [k\k0!5Eo,aT, -2GQ +†"eQ +Aи,V\.YphUA${ n}ŭ@b@ᶌ-˟(88X6WEB2=UoN<ƫ2abqaX2͗y"zNX7djIxΑ8F$tm)t!/R!Qhd/Y ].89)T|4јゔJR 6F.<2i쭧nTt$H 1'SݧKnRT`j'U&=ν mRE YY +bd6>SI'RHNɚzϳo38* +#N =rdtQ_ĺ=zVFo6Ml!xz)p$(FH< w|BRF;:|#2w JzhU%/PqڬTCXŘtgZa}!u09m$~ D#3|kaakJR-3`mh p4O~c:(&2VvNJKVeElww  \9Ԃ38R/`;ykeq)P# lnP3I4dc1z80btn{U$H)Tq :yAY#mWN1젮z1,bQI*O=f) +I3BF"N)땃8uvXpŲQ1g9 +yF2/u<73FZJ0# ZֻA5%U^$CIQ㥤 Bb5mt$@;hTVVxj8fS(wS63[9SlڒOMtXEӬjl?*ΘE*Q4ˊ%'K@X)ݶw0 V<aM{]vRS)JN;vTW&+瞣o5Pe|͖a jq,G`jI,I2vb-:2vȒ#i6Rv%<6taKoJsiugf["U#SSVTed$:kـ[۟hXA:6A&gf(7ٖt#a +3"btlo9M48~XpJv"c&U!zD) |tѼ*JL1pZlzʘ1dR(0%J Xmؠ:0> >/n8lH7%۔:\Hf`q Q3_NҪTD*(oam{}ge}OB=*0 /G:w [jzO]g \.xHՍڝ/q/*':WGLWg]!=D/3u'7Xz]_ uIWX {ɥ$=p ]&6HnmB Ə$qiּ*Ϋjq#x,JM#)E$Ilm\XJR $xq>Uv#xlHlF3C7<|W!aW(1qS]3IOS ŷ>QDwiwqo* 8@ݍⶻH*&v:N#h\+3/&d Y0S)i慦A "ʱ Wӿ[UA'`S|~[9sn:k)0%8SFfS*Ú)eDb?,Toi^̆RiKeSb@g5=Kh2jO8luU)WOSd& 7h-v]=r̥$8 T}_>eeܿiR4)h vsK=2eH6A tצ^q>&|g0Xn%@VV50UIc)X#Z]Վ +?lđDPYբiXQ:“Nā N&]Sĝ}ÀQVk ]ѤY"b!U\P¾@\7,n$*"6 N[Pq$a4P/N^El۬tlbZ[^F(EEK_f:8*bh(H,>u1`XUIG&LBij/.t$3aku+Sr`1,w۩e@6'^2/~aXl֧©䮂)hi$1mwħk`n\.]nS$#`ݔ BQLLvz +?P=6zԚq8^JxdIvE+V|t~Zǖ1Sa c'IQ Yc!!HJR1*&bc E?;|#H +/5dM@U7y?2ˀ(n徢?ZzDjQ>l#nV11ƮstZQƋ.-P*1zjjqyZRCxI߉EʛJ̉#-\Ib'M*GXEqN]*Y2H`x `zk7Bq/T4nIw){m, -]+CPR8ԾRSfΣ,sjWbVUuLpbx{ `+K<_Rcy0 ``'9s-CgF +TzR7u(cb +QW-4sɰDZ3 ܓ½^bt&'8GR :ziǦC3R6|:"r)(q +HjvgLLehl yemuѫݏL;<E@Cg͙,_լ[GObZλg) PftbM[OeYUAAXJAIh'm] Jchd7z1N~btV`Ү|ÚId8UpP̥`˿L~Qh^I#aU$IS7ӅxMPQO E`C޷u&Pbn*bjg_>Rҗ +,aj}* vp2ɥ"c p<8F=企׎XWuKOnc'Ul` w9-Զ%A H>%*DNdP(h(TD@(YnU`TkK% u=,T!d)PuSmtӒoeYH/Y#@t p{u3x `p&I}-vX̔4ق & \"&s6o+>jN;f(uKAaRT184_쑎Id?.G\z$O!%Mz2RcSZ'ɜp Jv{>t6B9+:@ALeO˹,QcUIGE$uf((Ro)+z.wH@)Lly |Z\Pa`,>ܛ+6*]堒amw |As` +_tn9X5 `Jvlp6o): /rFrRj<ѓ3ds5qVHEZFp#\>gޡJJAN0c}e!hQJfAT.e2dɇSaoO +@Zd1!.O}oX<:N)$Tjܸ zM,90L:,E}zdC%<.xj< O-_4r%cUJP#߰q$~RH&A$hE˻Z0l 4x§zCt<:n"V H֎:ɿtR#WA;F;(yBV 0&'nM8s5]:ԉj: j/.34IU]~H. +F'y«gGTƲ5(tL ޠsOS36Zk0QPFii𧊨X]䐒i%sam߫<ˁ :N8aYdZZ`GNINu[9uk4Éi'4 +X./%FfBܷi7ё4Νn% tN$P^oi╤l 8:O[ ap@ RL0JH'}Ō~**~ե'0=2NC*#;Lc}w{G[H ax:UM8NsHjjh$1+_g;xveV u +;~ +4f,",;mMkTo/R}Cb*Xf #l&4+blb*ܶ\,+.Z|BD0լecsB59#̕8 f;JeA9kZs<^C rX6iuJ O{;h*G0Q= +1HLj"U]]bުP{y$9jث#L3fÊ*! j?q<">whR-5WK XOF#A[܍V3}ynҌA +PfBpHǦ{oyiuG +:Z('VGtԨ`0HR;G}H}դtjG QϼYsʶu(HLJ2AIƛ[3-%mD4qf +CK8ekE f0nMt+B$dHD$Hʯx٤.(DĎ=c ++ԞdL[K`0-YS!G-t F[=pRI'JFh!gD> ᇳ|?Pz[AOݘR_6!V/n-Pˆ#笫Urxt8Dq/V*deO/Ao<emaZDABGtUom?hTuΟ%怢Wa5PHVH,onmR.JTy)2ּF .X.e w2`I@,HIb-vN >ݎ3lQ@:&8ўG7(ZPcTI#MzzWc/a/V3sIGp襅$,B9R^m \*|0m:Q;OA;([ŧ:mK?0D>gW7k&LӖQWkd*j9 +p'Y(jy%id!З[Nnz۶IgG9Նy "AAҙ#3FCvgͱlvTLaNnfѻ{w҆@$vXh29EUEOGIDs1oI$Oh^H`_r8oi=fDDq3y<#Ej̴;Vkx/y`.X(_vǃl5sp-X +W`mO*)i4jQ Xn|G›24É?*fX9#6,uFk*=Kxݖ턉^am/:wFR騯Yc/ZMJ36< +gZ5 +NH +moS1oGF(N"g-JQOnݥo +BN8)erKi}Z*|0 Bnv^g:^Ґ:iv^)=O$O bbUH pMeH?- P r-^#zZ^ _ͫɨ߲:x̄Y xGn2D$ @=FNTRl(xLBj#Z5y0A0 % 2EEĊh5J*5 +nf~;PE I0ن1Sndy.=:@!:vlÀhT %29MP֣1",k pF  q6h +]aeiLOH0vwٕrku] ^A vm͙.ayg##|.9kX +zѬB;{ܧ5j\YP; +Nٜ0۲vg 76) 8C={z)OԟJG+# 8]3:ަZHbhj +bE +_|Npܠ ' 0O=1A=c9HqWBS (_ViFcU +**9"E( j$DږV[*YH;| ˯CJv{It.#I $GEaм}E]|[.abԡ|M$xLɑʂubIo5d֨hCJ$v'@{˹nJ1(1zr3bi)h͞u@]6F/ Ɖ+¦Bb>#_`Z͚kjP!݈i6V-Elf`|RfJ>x)U-6S\V@4ga!(,H@{4bROM,rѥY)qPrNKkMa FW +LVʢ~a5'0vI{wn{պu, lQkAzCxW y"&8梕iڜ7Y+E$Ns"G/-20 Dn4,_.`R0V8)fbs?Px;*8| M3S0CKubdШq% a,ڤ"$V;6q'cV"ͧ,P"dN1A?M{89MwKfjÇ-YkZfGIK1W[vlk$)V&f@"^omP;`iI0NمExN%U+2=0qeI8j$XvYiaR}e9JMPIJq6l"hȱ2 +Uq x5bDbY6VgRWv=s}l%C6SSgJp,M̕)tWAH-S']ceir(ҹ06o4%)hm5 B<)<2s\5jLؼ1qf>:yY[\wzc==[z?\:V9k01VʿXʅ*.lđg[ZtT4%t*VEQYf].\wUݔJ6Rיּ$^ +,O+f;6cp2=N'n ;vN\` r &[M x~Y]T$mnxkzEic=,O]Ծ0zJsQ?: a|]l KQU;U1[G"M8$ܼw3ݨwB#Ta1hfoymբ{H$=a90a̦P°:4$gZIV1*ߠF$@ٯośmn)D  ¥= +x3Smn߆5JpcLN*34t2b/V<4 䒦K".kkr66̭]^?r-03 P?J8_9f1t=T=<<|U14ny167Z9Jh "\C亡 +t8G0ndjsKlBgdo1¢r6*H9zBAF b'u :I\0]*:9'jJ2a4nk4ǍZ`'a7r'2&Uϔ(OJY:icZV*4DJJN +]#T tp.9 -.(%1I{[嗍 +p'3я>tc}-l6*6QCXO $ƪeeA`5i麏%%$&AԜt*Y݇72Z)+ Noty6/ tX?NW9+-%|zBj0@!H G>_nCJK3Ƥg*v+e &|gE"z}<札S9fLg,CW|. +6|cGJ~7}/f_꼷pj * &8`6mYݽK% ԰ qyPq\-18F;]_ EY,o`$G[/`jm--+jH-Dj5&#:55N  DZF* `4"U݆*3هƕY^hk1ߚjV950k׉`;M2(I)wYACY X==2{;V A0L9kwZ)IA%5&\D6-/9uk߾6VȤ|?zڪ.S-n!u,$ A veL8 M F+SL]#ꬬhE:Ob?by_W:VRo=]ʮ  +Q[*GMȱbu *$"rX<s2ĤX!~Õά;zz95F`sC%#_L6L~/piiq2|R5EZ=PpgLcP2:C(gTO-eCC-t-c4*Vhx@p䔵q8a]GG@h}br5ulP5DP%%{C!ݹPH׶--LzĞҼݔOpK~Lsī2_( ?H6ơ}@7$Z]jodӪϔgJO$Ԯu'_J'4IG \2jϲѐX! G&]̴M $qQ '*S^-m}TH æUϹ:x"NBþZԬ3aVXX`)]]*$[Ž0A&:(R2/Is~mRTx%!mدT3LP&}P#k 8 $ٳxǶ6)zzPVm2PefDZ +hqX]P˸˰(Jnv]u>5岧P›0 *sE3`>ytglR1ic@B.TM]tIӉ9%PXq2m93\C _ *i+10bdIrV@XC^Mpwطi3/iԨH I0hw&2}˄YIQuLoS_ iăB&sI08g{ }Z-Ză#A:xPҬʝ_xqd1M-B圧|U4Y t OI%I6Mk1?"EAW70S~èd<~RTR^.l yP?5{pPd5 +ŰbMp9TIu]u}b5q]ӥƖMkV[hߒڡknߴx)>|*d(k\* ҵTȪԁpEm9)P } L&Q:\Wz:ez+kɽň\h IZPKgU2u0͚4Ɂbs \")!wbH׈YtZEViv{j4YR|36-dKOO-4fk$oqn: >ߝ^/t`hq_~o/ncy(syM%MX$D Ń/Bv$t~4wz]/X@}^KwMGR弅8j%UE:HNYqy9t3j* K$ͭjLH#g xoEh/>IxkN8DAW٥KSugRIBVDeOZ=ҋHRV?Pb(QA@Ky>^/R( JcR+4I5:Qij"j441Ȓ&:Nv6JVթ) +d$kew֨$ }"D6i[ Qn3aN#^%4pc(RHXX4( QvkdMҀ>/gGQwiB~`='g1>l\δ$舕4MDPxlȫ"B%G܇o D|RG_N޺+2TPL{o%(:c8& gصTY~\q?)')ՙUGFlv8,R>#(rƩ{MUdJ3CIttm"EپZ>WDCMb|#AʂA>̱ {{-xWDǮ= m$GTuc0h*\P%: pt;}]Ҵc k&x$>*naMZ0l1fɎ]w~E ):T26ZۗB)`n K[JFǢK "E*B^+ĩXT w4MEO 0*$yh@.xҽ@6 +T3a" ltB{d$=T|ǜ1_e[rq#oÜ?}VUsiX!:)3R*n nrZ},菸] \P0C̠^wŞA%ĝ5S "j +&ik)&!(2RfA {Ưr\(ґǧ]ӄ/tG9|Avv:zU%I,.Z b8lńtxR͖,I'XSՖ=AbYAQr 31ׅ"dd@Pفd\{=GOrSfh>c[Ibn~%l,xLG—[0$JR>Xun]pX\a-lm )7QN#l5AMݣƟ!!nIIypiяS:E281j%G WNcޡ7QoyOkigI* >)-eihƠu=s @̘[ELJKAI$44뽘SɲU*۷܀4juUk8qFθ#ҫy3&71qZj$< Z̕#zq0}۷լJDa zRecʘ/Ӟu.V̙G!os +5ʂ +W@Y,bs-ԣ +0<07)B$ Fƕ~rșOQW%=~WiUez40.vnb +1$(p IцXLF̩O"RӊDJXo_((l(Ԩ1)՟KU)R͇YHqjYbqWBMBXCkVAĩ'pEumT%h;v6Q9ȝ7T_-OO_0&MŁ0hM9]ݞ!FFގ4N!&N`̙gX.9`S^lJMd)$ ڕJsB| +"cOOfOCz.%5N9[aXҒzFVPl-F2Y$;0*S*Z ku$ĩ>JJzzfO-Xa{ _{R g;ugcM.9v%F=n#eŪb ;6;6~[^ hAwzH*8VaΙC8Npjh1EIHFh$2C85yM3X.w\;ähN!#HaaD7AdݺTDA8O;)Wr-\KMRXZ; ͙@Pl~ߞw.tEyT':3q޴1S+Ru0Ix5XSU5-4QЬDv̞4BXV&zV +pAAj8z/q:L\]d:/uǫ)iJ%Z%[1[߂]2=ހBj $@Wv$=tO9ZDBļI,pO u~ZV TDmYB1X5R4 t2X@|-ۉ Z{K:/o:Z'I:<0̹J\2&4hW0M^M۳٢DcGf]^HrnEWa gr[j 1hI^*Җxke6&0 &`dcGX[%@R)I'HO4vO9Pt?,t.eG:gĿѤ|M%'}A=>rdĥH'fOonixmpmp/5XzWİVbp^k@Y 9眧|ˊ5>c`FZ:4󂪋"t#ȭeXo}.-\ c@ӝ|qRQҬ_Ec-ÀŘpD!)҂y C0yZFQ3n[fC:W M4)\Hf4uI}st:IWTju"L.(,lAWuoW>Np0pU' O,[ʬ;]|aU ො,$VTWIPm̀']N]L)̮H Ÿz8/IVEyv6tz3~_ǪG$IgpHM.{,3zAM#Δ666`Ia=]rQ4F45h +i*Ү&Ze x(̬.[R1i EӜ_uNQ⧛2AʵQ?ӗ]{j>skGQ1h2k/ILI ?Yš,^dlbmmxtW+Ypm)7\Ș^a8QR1KlUА$eߛi*N=CtĬH*bTY۸%r! Y5R3Mt}mn1u&R äQ{@:^A)8 a5XS sSr4.b>x " + luS}Vz(@A' +6JIDD7&u]FR̙7hpW?iG|Mݡ*g0˷J\A +>#ÌINi#gn{ne-ĒP$m pzjW=sg]f'#4f9Sc0#9C8Qk LEuR=sqݕ)b0=nlƞ pTVPDi% l+TIAeX\WOv#CFӉ=+ÄWaatra3;0UY2boVw1o޴poǪripqzLyzpv}7R_IYUSlB2M8bYc󠫍\\k&\hk>bz0܂v gA&Uɸ69~2u q̵QyyeR70Tbey\cHw\$c m[7:1<֌M[)Ӽ^t:A5Ԣ"TOQWHFw1Ce뫂"d^ği~vq ؎+Ҿ`VfELQUF3]S=:1c{<ʑZ!ht$)>ڢ/{;t>s4?ρf;-T5Va2aXP$n}mr@7 qܞ%MpAƷ%fWzN4׬ u8o pZ 9{̋䭀 \iOaFY},ĺ +0:7Nby=UzMJn;պȇ"R?D3R<)9K0ܛ}4lv5c&&-RPyr>Ha8k"ABgcؕm*')UbEipƒ:(+p0YVh CPYA6k7imP ±JmK0N@3fU+AP%cPqx +u4Mė/~KjwiΊXn.\:Ie ?f,6Is5gT 2=- df%K) ٶ Iq +Jڒ)}`*Ap;+ "W ƓҶ'ʬ2l"CͶ;m/ +hi36ˆWqQή#މ23; vy+āJC xΫk/r_,Fdbk$[N)* cnðHJwzj(1c'$q+N" {lp >睠\Ď$|fئ@pz~?hz+՘/\pr,=E|J M$MYɲji#a#H豰v"OUan.]I$=92@b@ ++~tLEuxT P +X4XΉQrBT? +jwMDɌ18_15pKj$NqƉwG}uW7f10 ®UF 1Y6;B7n2>)( +f=M&&$O"W9TR,LxC ,sF'bT(\gVJ +=tWr4mN8u~\&?538bRjBw@Đw (;[\@1 +WGx + #nuKǥKMA6W ux3hUFTj0{ӹ֛u(G +Hdt!_0\C4t"xQ6kfih ƋKN5c{\p Y5 |@a-ZDt3uiz PGOb)yhJׄQEXX܅:f9AmPv N4eupMPzF\!d69@0 -ɴZVH"vkYA@g:*P.(Hn^P c L ?SИlI0CRVB, __g)f/?;|4O +{V^źO56*(G,M4A 1TiEk=ӏ~e}h2o@=U+n_:u?+Dح\Э J)qSTA#osIo0I FAt{VW5 8YF#(՜VB`5V:I1$S;4s*)bX 5bhR۷'*ɛ@lbAi [@*p쉇>::e_\krZҷd-2-A)|-A\ll~f){_h ꣬*p:GU(:`}̹_Uy@wF;)P7 RҟyA#T ?r:N'@uCIqABݐc#m9: wSFodžy@ovQ#u@;$x/V$?_1k;؟oڝu=q&oWΞ#G_̷O"y=z9G|%O+IQC_>G QᷝKϯa3OǵWux__b|eaCGYs?u_q۲G:%o׫$&nuOig}˨?$?n_*_ëOǞ'Ϳccԡſت:xdq)帓 ¶l㷇9~߹>_iE?FZw?/(~5u4ɿ]Q{;O&}&O: +3?Mq}=mwMJgۋX禷cq)#X'A1>&sMh6+OI~*{?տV}i/n?oHWok-⭻>QN>^S:Vi[v&}_=]%~lKL1W/%ex<[+o?>e۰ԧǁs_价o~7Yo{s'n+ޜ'?ַ.;wM/>stream + + + + + + 8 + 8 + 8 + 8 + + + + + + + + +endstream endobj 28 0 obj <> endobj xref +0 32 +0000000003 65535 f +0000000016 00000 n +0000020455 00000 n +0000000004 00001 f +0000000005 00000 f +0000000006 00001 f +0000000008 00001 f +0000020506 00000 n +0000000009 00001 f +0000000010 00001 f +0000000012 00001 f +0000022389 00000 n +0000000013 00001 f +0000000014 00001 f +0000000015 00001 f +0000000018 00001 f +0000071751 00000 n +0000345787 00000 n +0000000023 00001 f +0000309929 00000 n +0000022613 00000 n +0000023001 00000 n +0000022500 00000 n +0000000024 00001 f +0000000025 00001 f +0000000026 00001 f +0000000000 00001 f +0000020841 00000 n +0000349167 00000 n +0000023665 00000 n +0000023268 00000 n +0000000113 00000 n +trailer +<<2B6CDDA818AEA84A83B63AD5CEB212EC>]>> +startxref +349343 +%%EOF diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-719-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-719-patched new file mode 100644 index 000000000..3158e78e6 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-719-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-724-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-724-patched new file mode 100644 index 000000000..591704376 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-724-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-726-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-726-patched new file mode 100644 index 000000000..ae9769017 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-726-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-727-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-727-patched new file mode 100644 index 000000000..0189882c3 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-727-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-744-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-744-patched new file mode 100644 index 000000000..877d2bf4b Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-744-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-751-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-751-patched new file mode 100644 index 000000000..b5f5fb825 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-751-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-757-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-757-patched new file mode 100644 index 000000000..80e70fc28 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-757-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-772-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-772-patched new file mode 100644 index 000000000..ee381cba1 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-772-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-797-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-797-patched new file mode 100644 index 000000000..0d30fff4f Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-797-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-818-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-818-patched new file mode 100644 index 000000000..277ea1afd Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-818-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-855-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-855-patched new file mode 100644 index 000000000..b393c4d0f Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-855-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-866-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-866-patched new file mode 100644 index 000000000..561d8d43e Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-866-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-888-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-888-patched new file mode 100644 index 000000000..4d7826f56 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-888-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-949-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-949-patched new file mode 100644 index 000000000..af6aa5351 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2022-949-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2023-1079-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2023-1079-patched new file mode 100644 index 000000000..c8a1766b3 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2023-1079-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2023-88-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2023-88-patched new file mode 100644 index 000000000..d9a09a2ca Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2023-88-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2023-970-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2023-970-patched new file mode 100644 index 000000000..3fee7f73f Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2023-970-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2024-1391-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2024-1391-patched new file mode 100644 index 000000000..ae60adee4 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2024-1391-patched differ diff --git a/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2024-503-patched b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2024-503-patched new file mode 100644 index 000000000..a242309f7 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gs_device_pdfwrite_fuzzer/seeds/testcase-OSV-2024-503-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/Dockerfile b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/Dockerfile new file mode 100644 index 000000000..39fbf3f44 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/Dockerfile @@ -0,0 +1,50 @@ +FROM gcr.io/oss-fuzz-base/base-builder@sha256:87ca1e9e19235e731fac8de8d1892ebe8d55caf18e7aa131346fc582a2034fdd + +# Build-time deps for ghostpdl + cups + freetype. +# Intentionally omit libfontconfig1-dev so ghostpdl's configure disables +# fontconfig — FuzzBench's runner images don't ship libfontconfig.so.1. +RUN apt-get update && apt-get install -y --no-install-recommends \ + autoconf automake libtool pkg-config \ + zlibc liblcms2-dev libpng-dev \ + && rm -rf /var/lib/apt/lists/* + +# Full clones so build.sh can `git checkout ` on ghostpdl. +RUN git clone --branch branch-2.2 --single-branch --depth 1 \ + https://github.com/apple/cups.git /src/cups +RUN git clone --branch VER-2-11-1 --single-branch --depth 1 \ + https://git.savannah.gnu.org/git/freetype/freetype2.git /src/freetype +RUN git clone https://git.ghostscript.com/ghostpdl.git /src/ghostpdl \ + && mkdir /src/ghostpdl/fuzz + +# OSS-Fuzz harness seed corpora, dictionaries, and the .cc sources the build +# compiles as fuzz targets. Kept in-benchmark so the rebase is self-contained. +COPY pdf_seeds /src/pdf_seeds +COPY dicts /src/dicts +COPY gs_fuzzlib.h /src/gs_fuzzlib.h +COPY gstoraster_fuzzer.cc /src/gstoraster_fuzzer.cc + +WORKDIR /src/ghostpdl + +# Keep ASan stack-use-after-return detection enabled for direct testcase replay. +ENV ASAN_OPTIONS="detect_leaks=0:detect_stack_use_after_return=1" + +# Raise libFuzzer's per-alloc / RSS cap from its 2048MB default. Some +# transplanted bugs trigger a ~2GB malloc en route to the real memory-safety +# error; with the default cap libFuzzer aborts with `out-of-memory` and +# `-ignore_ooms=1` silently drops it. libFuzzer-family runners in +# fuzzbench/fuzzers/*/fuzzer.py splice $ADDITIONAL_ARGS onto the target +# command line, so this propagates automatically. +ENV ADDITIONAL_ARGS="-rss_limit_mb=8192" +# ghostpdl's startup path fires recoverable UBSAN "left shift of negative +# value" in base/gsiorom.c, base/gxpath.c, base/gspath.c, psi/imainarg.c, etc. +# on every run. Without halt_on_error=0 and exitcode=0, afl++ sees exit=1 +# and rejects every seed during calibration ("We need at least one valid +# input seed that does not crash!"). AFL_SKIP_CRASHES is belt-and-braces +# so afl++ tolerates any remaining UBSAN abort instead of aborting itself. +ENV UBSAN_OPTIONS="halt_on_error=0:print_stacktrace=0:exitcode=0" +ENV AFL_SKIP_CRASHES=1 + +# Bug transplant patches (re-applied by build.sh after checkout resets source). +COPY patches/ /src/patches/ +COPY seeds/ /src/benchmark_seeds/ +COPY build.sh $SRC/ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/benchmark.yaml b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/benchmark.yaml new file mode 100644 index 000000000..806577226 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/benchmark.yaml @@ -0,0 +1,5 @@ +project: ghostscript +fuzz_target: gstoraster_fuzzer +commit: 2be8b436910cfc8b013a13df000c3c854cf3c5c5 +commit_date: 2022-01-13T14:13:08-05:00 +type: bug diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/bug_metadata.json b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/bug_metadata.json new file mode 100644 index 000000000..34f41729e --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/bug_metadata.json @@ -0,0 +1,631 @@ +{ + "project": "ghostscript", + "target_commit": "2be8b436910cfc8b013a13df000c3c854cf3c5c5", + "dispatch_bytes": 3, + "total_bugs": 89, + "bugs": { + "OSV-2020-1875": { + "dispatch_value": 1, + "triggered": true, + "crash_file": "/src/ghostpdl/./psi/idict.c", + "crash_line": 427, + "crash_function": "dict_find_string" + }, + "OSV-2021-237": { + "dispatch_value": 2, + "triggered": true, + "crash_file": "/src/ghostpdl/./psi/zfsample.c", + "crash_line": 465, + "crash_function": "sampled_data_sample" + }, + "OSV-2021-337": { + "dispatch_value": 4, + "triggered": true, + "crash_file": "/src/ghostpdl/./psi/zfsample.c", + "crash_line": 620, + "crash_function": "sampled_data_finish" + }, + "OSV-2021-668": { + "dispatch_value": 8, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gdevp14.c", + "crash_line": 6202, + "crash_function": "pdf14_initialize_device" + }, + "OSV-2021-717": { + "dispatch_value": 16, + "triggered": true, + "crash_file": "/src/ghostpdl/./psi/iutil.c", + "crash_line": 860, + "crash_function": "real_param" + }, + "OSV-2021-803": { + "dispatch_value": 32, + "triggered": true, + "crash_file": "/src/ghostpdl/./psi/zfsample.c", + "crash_line": 620, + "crash_function": "sampled_data_finish" + }, + "OSV-2021-1683": { + "dispatch_value": 64, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/ghostpdf.c", + "crash_line": 1313, + "crash_function": "pdfi_set_input_stream" + }, + "OSV-2021-1690": { + "dispatch_value": 128, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_int.c", + "crash_line": 1193, + "crash_function": "search_table_1" + }, + "OSV-2021-1741": { + "dispatch_value": 256, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gxstroke.c", + "crash_line": 2439, + "crash_function": "line_join_points" + }, + "OSV-2022-53": { + "dispatch_value": 512, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gdevm24.c", + "crash_line": 281, + "crash_function": "mem_true24_fill_rectangle" + }, + "OSV-2022-54": { + "dispatch_value": 1024, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/sstring.c", + "crash_line": 400, + "crash_function": "s_hex_process" + }, + "OSV-2022-81": { + "dispatch_value": 2048, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_colour.c", + "crash_line": 857, + "crash_function": "pdfi_setcolorN" + }, + "OSV-2022-85": { + "dispatch_value": 4096, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_colour.c", + "crash_line": 857, + "crash_function": "pdfi_setcolorN" + }, + "OSV-2022-121": { + "dispatch_value": 8192, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/sstring.c", + "crash_line": 445, + "crash_function": "s_hex_process" + }, + "OSV-2022-229": { + "dispatch_value": 16384, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/stream.c", + "crash_line": 999, + "crash_function": "stream_move" + }, + "OSV-2022-271": { + "dispatch_value": 32768, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gdevp14.c", + "crash_line": 1175, + "crash_function": "pdf14_buf_free" + }, + "OSV-2022-301": { + "dispatch_value": 65536, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gxblend.c", + "crash_line": 2984, + "crash_function": "template_compose_group" + }, + "OSV-2022-422": { + "dispatch_value": 131072, + "triggered": true, + "crash_file": "/src/ghostpdl/./psi/igc.c", + "crash_line": 1091, + "crash_function": "ptr_struct_mark" + }, + "OSV-2022-429": { + "dispatch_value": 262144, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_dict.c", + "crash_line": 364, + "crash_function": "pdfi_dict_find_key" + }, + "OSV-2022-449": { + "dispatch_value": 524288, + "triggered": true, + "crash_file": "/src/ghostpdl/./psi/isave.c", + "crash_line": 854, + "crash_function": "restore_space" + }, + "OSV-2022-456": { + "dispatch_value": 1048576, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/fapi_ft.c", + "crash_line": 685, + "crash_function": "load_glyph" + }, + "OSV-2022-684": { + "dispatch_value": 2097152, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_font.c", + "crash_line": 111, + "crash_function": "pdfi_font_match_glyph_widths" + }, + "OSV-2021-1681": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_stack.h", + "crash_line": 36, + "crash_function": "pdfi_countup_impl" + }, + "OSV-2021-1682": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_repair.c", + "crash_line": 439, + "crash_function": "pdfi_repair_file" + }, + "OSV-2021-1684": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_file.c", + "crash_line": 1278, + "crash_function": "pdfi_open_memory_stream_from_filtered_stream" + }, + "OSV-2021-1685": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_deref.c", + "crash_line": 560, + "crash_function": "pdfi_deref_compressed" + }, + "OSV-2021-1686": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gsmchunk.c", + "crash_line": 654, + "crash_function": "insert_free" + }, + "OSV-2021-1687": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gsicc.c", + "crash_line": 243, + "crash_function": "gx_num_components_ICC" + }, + "OSV-2021-1688": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_annot.c", + "crash_line": 3882, + "crash_function": "pdfi_annot_draw" + }, + "OSV-2021-1689": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_xref.c", + "crash_line": 761, + "crash_function": "read_xref_section" + }, + "OSV-2021-1692": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gsmchunk.c", + "crash_line": 1092, + "crash_function": "chunk_free_object" + }, + "OSV-2021-1693": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_fapi.c", + "crash_line": 1187, + "crash_function": "pdfi_fapi_get_glyph" + }, + "OSV-2021-1694": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_font1C.c", + "crash_line": 765, + "crash_function": "pdfi_read_cff_integer" + }, + "OSV-2021-1697": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/stream.c", + "crash_line": 415, + "crash_function": "stell" + }, + "OSV-2021-1698": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gsmchunk.c", + "crash_line": 857, + "crash_function": "chunk_obj_alloc" + }, + "OSV-2021-1703": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_array.c", + "crash_line": 138, + "crash_function": "pdfi_array_fetch" + }, + "OSV-2021-1704": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_colour.c", + "crash_line": 1152, + "crash_function": "pdfi_create_iccbased" + }, + "OSV-2021-1706": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gspcolor.c", + "crash_line": 307, + "crash_function": "gx_adjust_color_Pattern" + }, + "OSV-2021-1707": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_cmap.c", + "crash_line": 205, + "crash_function": "general_endcidrange_func" + }, + "OSV-2021-1709": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_image.c", + "crash_line": 1431, + "crash_function": "pdfi_image_get_color" + }, + "OSV-2021-1711": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_cmap.c", + "crash_line": 120, + "crash_function": "cmap_endcodespacerange_func" + }, + "OSV-2021-1715": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/stream.c", + "crash_line": 1009, + "crash_function": "stream_compact" + }, + "OSV-2021-1717": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_font1C.c", + "crash_line": 1643, + "crash_function": "pdfi_read_cff" + }, + "OSV-2021-1719": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gsmchunk.c", + "crash_line": 654, + "crash_function": "insert_free" + }, + "OSV-2021-1723": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_fontps.c", + "crash_line": 696, + "crash_function": "ps_font_def_func" + }, + "OSV-2021-1724": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_cmap.c", + "crash_line": 120, + "crash_function": "cmap_endcodespacerange_func" + }, + "OSV-2021-1731": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gxfapi.c", + "crash_line": 297, + "crash_function": "recreate_multiple_master" + }, + "OSV-2021-1740": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_annot.c", + "crash_line": 1449, + "crash_function": "pdfi_annot_draw_LE_one" + }, + "OSV-2021-1743": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_cmap.c", + "crash_line": 642, + "crash_function": "pdf_cmap_open_file" + }, + "OSV-2021-1752": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/sstring.c", + "crash_line": 416, + "crash_function": "s_hex_process" + }, + "OSV-2021-1753": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./psi/iname.c", + "crash_line": 248, + "crash_function": "names_string_ref" + }, + "OSV-2021-1754": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gsmchunk.c", + "crash_line": 441, + "crash_function": "insert_free_size" + }, + "OSV-2021-1763": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_optcontent.c", + "crash_line": 305, + "crash_function": "pdfi_oc_is_ocg_visible" + }, + "OSV-2021-1764": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_xref.c", + "crash_line": 108, + "crash_function": "read_xref_stream_entries" + }, + "OSV-2021-1767": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_dict.c", + "crash_line": 247, + "crash_function": "pdfi_dict_get" + }, + "OSV-2021-1770": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_obj.c", + "crash_line": 227, + "crash_function": "pdfi_free_xref_table" + }, + "OSV-2021-1771": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gsfunc3.c", + "crash_line": 121, + "crash_function": "fn_ElIn_evaluate" + }, + "OSV-2021-1772": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gsmchunk.c", + "crash_line": 1093, + "crash_function": "chunk_free_object" + }, + "OSV-2021-1774": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_array.c", + "crash_line": 138, + "crash_function": "pdfi_array_fetch" + }, + "OSV-2021-1781": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_xref.c", + "crash_line": 762, + "crash_function": "read_xref_section" + }, + "OSV-2021-1788": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_obj.c", + "crash_line": 209, + "crash_function": "pdfi_free_namestring" + }, + "OSV-2021-1795": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_cmap.c", + "crash_line": 205, + "crash_function": "general_endcidrange_func" + }, + "OSV-2021-1802": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_font1C.c", + "crash_line": 528, + "crash_function": "u16" + }, + "OSV-2021-1803": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gsmchunk.c", + "crash_line": 800, + "crash_function": "chunk_obj_alloc" + }, + "OSV-2021-1806": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_font.c", + "crash_line": 332, + "crash_function": "pdfi_open_CIDFont_substitute_file" + }, + "OSV-2022-1": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_dict.c", + "crash_line": 247, + "crash_function": "pdfi_dict_get" + }, + "OSV-2022-3": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_stack.h", + "crash_line": 56, + "crash_function": "pdfi_countdown_impl" + }, + "OSV-2022-18": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gspcolor.c", + "crash_line": 254, + "crash_function": "gx_restrict_Pattern" + }, + "OSV-2022-47": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gdevm1.c", + "crash_line": 683, + "crash_function": "mem_mono_copy_mono" + }, + "OSV-2022-79": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gxclimag.c", + "crash_line": 1404, + "crash_function": "clist_composite" + }, + "OSV-2022-83": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gsmchunk.c", + "crash_line": 800, + "crash_function": "chunk_obj_alloc" + }, + "OSV-2022-97": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./psi/interp.c", + "crash_line": 1518, + "crash_function": "interp" + }, + "OSV-2022-100": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/stream.c", + "crash_line": 999, + "crash_function": "stream_move" + }, + "OSV-2022-102": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gsmchunk.c", + "crash_line": 1092, + "crash_function": "chunk_free_object" + }, + "OSV-2022-177": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gxdcolor.c", + "crash_line": 1068, + "crash_function": "gx_dc_default_fill_masked" + }, + "OSV-2022-199": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_sec.c", + "crash_line": 129, + "crash_function": "pdf_compute_encryption_key_preR5" + }, + "OSV-2022-206": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/stream.c", + "crash_line": 1012, + "crash_function": "stream_compact" + }, + "OSV-2022-210": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_font1C.c", + "crash_line": 528, + "crash_function": "u16" + }, + "OSV-2022-218": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_obj.c", + "crash_line": 219, + "crash_function": "pdfi_free_keyword" + }, + "OSV-2022-270": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gsfunc3.c", + "crash_line": 121, + "crash_function": "fn_ElIn_evaluate" + }, + "OSV-2022-278": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/srle.c", + "crash_line": 150, + "crash_function": "s_RLE_process" + }, + "OSV-2022-339": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./psi/igc.c", + "crash_line": 915, + "crash_function": "gc_trace" + }, + "OSV-2022-351": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./psi/istack.c", + "crash_line": 253, + "crash_function": "ref_stack_counttomark" + }, + "OSV-2022-390": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/sfilter1.c", + "crash_line": 105, + "crash_function": "s_PFBD_process" + }, + "OSV-2022-415": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_obj.c", + "crash_line": 227, + "crash_function": "pdfi_free_xref_table" + }, + "OSV-2022-417": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_xref.c", + "crash_line": 762, + "crash_function": "read_xref_section" + }, + "OSV-2022-453": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./base/gsstate.c", + "crash_line": 1330, + "crash_function": "gstate_clone_core" + }, + "OSV-2022-496": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_repair.c", + "crash_line": 439, + "crash_function": "pdfi_repair_file" + }, + "OSV-2022-232": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ghostpdl/./pdf/pdf_fapi.c", + "crash_line": 1187, + "crash_function": "pdfi_fapi_get_glyph" + } + } +} diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/build.sh b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/build.sh new file mode 100755 index 000000000..b69457e26 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/build.sh @@ -0,0 +1,223 @@ +#!/bin/bash -eu +# Generated by fuzzbench_generate.py for bug transplant evaluation + +cd /src/ghostpdl + +# Checkout target commit +git checkout 2be8b436910cfc8b013a13df000c3c854cf3c5c5 + +# Restore harness sources that live outside the project git repository. +if [ -f /src/patches/harness_sources/manifest.json ]; then + python3 - <<'PY' +import json +import shutil +from pathlib import Path + +root = Path("/src/patches/harness_sources") +for entry in json.loads((root / "manifest.json").read_text()): + source = root / entry["snapshot"] + destination = Path(entry["container_path"]) + destination.parent.mkdir(parents=True, exist_ok=True) + shutil.copy2(source, destination) +PY +fi + +# Apply dispatch harness first (modifies build system), then bug patches +if ! git apply --check /src/patches/harness.diff 2>/dev/null; then + echo "Trying git apply --3way for harness.diff..." + git apply --3way /src/patches/harness.diff +else + git apply /src/patches/harness.diff +fi + +if ! git apply --check /src/patches/combined.diff 2>/dev/null; then + echo "Trying git apply --3way for combined.diff..." + git apply --3way /src/patches/combined.diff +else + git apply /src/patches/combined.diff +fi + +# --- Fix library CMakeLists.txt for new source files from combined.diff --- +# combined.diff may create new .c files (e.g., zfp_getcell.c) that need to +# be added to the library's explicit source list. +if [ -d blosc ] && [ -f blosc/CMakeLists.txt ]; then + for newfile in blosc/*.c; do + base=$(basename "$newfile") + if ! grep -q "$base" blosc/CMakeLists.txt 2>/dev/null; then + echo "Adding $base to blosc/CMakeLists.txt" + sed -i "/^set(SOURCES /s/)/ $base)/" blosc/CMakeLists.txt + fi + done +fi + +# --- Original build commands --- +pushd $SRC/cups +# Fix bad line +sed -i '2110s/\(\s\)f->value/\1(int)f->value/' cups/ppd-cache.c + +# Keep this flag live for the whole build: libafl's clang-17 elevates +# implicit-function-declaration to an error (e.g. gx_dc_is_pattern2_color +# in base/gxstroke.c), which the older clang-15 the other fuzzers ship +# still treats as a warning. +export CFLAGS="${CFLAGS:-} -Wno-error=implicit-function-declaration" +export CXXFLAGS="${CXXFLAGS:-} -Wno-error=implicit-function-declaration" + +# ghostpdl fires UBSAN "left shift of negative value" in base/std.h:66, +# base/gxpath.c, base/gspath.c, base/gxcpath.c, psi/imainarg.c and +# "member access within null pointer" in base/gsalloc.c on every input. +# afl++ forces ASAN_OPTIONS=abort_on_error=1 when spawning the target, +# overriding our Dockerfile ENV, so every UBSAN report turns into +# SIGABRT and afl++ rejects all 1147 seeds with "We need at least one +# valid input seed that does not crash!". Strip the specific UBSAN +# instrumentation for those pre-existing patterns — ASAN heap/stack/UAF +# detection for the transplanted bugs is unaffected. +export CFLAGS="${CFLAGS} -fno-sanitize=shift,null" +export CXXFLAGS="${CXXFLAGS} -fno-sanitize=shift,null" + +LSB_BUILD=y ./configure --prefix="$WORK" --libdir="$OUT" --disable-gnutls \ + --disable-libusb --with-components=core + +make clean +make install-headers install-libs +make -C filter libs install-libs +install -m755 cups-config "$WORK"/cups-config +popd + +rm -rf cups/libs || true +rm -rf freetype || true +rm -rf zlib || true +rm -rf libpng || true + +if [ -d "$SRC/freetype" ]; then + mv "$SRC/freetype" freetype +fi + +CUPSCONFIG="$WORK/cups-config" +CUPS_CFLAGS=$($CUPSCONFIG --cflags) +CUPS_LDFLAGS=$($CUPSCONFIG --ldflags) +CUPS_LIBS=$($CUPSCONFIG --image --libs) +export CXXFLAGS="$CXXFLAGS $CUPS_CFLAGS" + +# --disable-fontconfig: FuzzBench runner images are slim and do not ship +# libfontconfig.so.1, which would make the fuzzer fail to start. Font +# discovery isn't needed for the transplanted bug crashes. +CPPFLAGS="${CPPFLAGS:-} $CUPS_CFLAGS -DPACIFY_VALGRIND" ./autogen.sh \ + CUPSCONFIG=$CUPSCONFIG \ + --enable-freetype --disable-fontconfig \ + --enable-cups --with-ijs --with-jbig2dec \ + --with-drivers=cups,ljet4,laserjet,pxlmono,pxlcolor,pcl3,uniprint + +# ghostpdl's autogen.sh auto-adds `-fno-sanitize-recover=...,shift,signed-integer-overflow,...` +# when UBSAN is detected. That makes pre-existing shift UB in base/std.h +# abort the binary on every run, masking the real bug crashes we need to +# locate, and fails libafl's stricter build outright. Strip it so +# UBSAN_OPTIONS=halt_on_error=0 can take effect. +find . -name Makefile -exec sed -i 's/-fno-sanitize-recover=[^ ]*//g' {} + + +# ghostpdl's autogen also injects a per-check UBSAN list into every +# Makefile compile rule, of the form: +# -fsanitize=array-bounds,bool,builtin,enum,float-divide-by-zero, +# function,integer-divide-by-zero,null,object-size,return, +# returns-nonnull-attribute,shift,signed-integer-overflow, +# unreachable,vla-bound,vptr +# (NOT the umbrella -fsanitize=undefined form, so matching "undefined" +# does nothing.) UBSAN then fires "member access within null pointer" +# in base/gsalloc.c, psi/interp.c, psi/igcstr.c, base/std.h on every +# input. afl++ pins ASAN_OPTIONS=abort_on_error=1 at runtime, which +# turns each UBSAN report into SIGABRT, killing every seed during +# calibration. The transplanted bugs only need ASAN (all are +# heap/stack/UAF memory errors), so strip the UBSAN per-check list. +# The leading `-fsanitize=address` stays, so ASAN instrumentation is +# unaffected. +find . -name Makefile -exec sed -i 's/-fsanitize=array-bounds[^ ]*//g' {} + +# Safety net for the umbrella form in case any future check uses it. +find . -name Makefile -exec sed -i 's/-fsanitize=undefined//g' {} + + +make -j$(nproc) libgs + +$CC $CFLAGS -fno-zero-initialized-in-bss -c __bug_dispatch.c -o __bug_dispatch.o + +$CXX $CXXFLAGS $CUPS_LDFLAGS -std=c++11 -I. \ + $SRC/gstoraster_fuzzer.cc \ + __bug_dispatch.o \ + -o "$OUT/gstoraster_fuzzer" \ + -Wl,-rpath='$ORIGIN' \ + $CUPS_LIBS \ + $LIB_FUZZING_ENGINE bin/gs.a + +mkdir -p "$WORK/seeds" +for f in examples/*.{ps,pdf}; do + s=$(sha1sum "$f" | awk '{print $1}') + cp "$f" "$WORK/seeds/$s" +done +zip -j "$OUT/gstoraster_fuzzer_seed_corpus.zip" "$WORK"/seeds/* + + +# --- Seed corpus: expand original seeds and per-bug testcase candidates --- +# FuzzBench uses $OUT/{fuzz_target}_seed_corpus.zip as initial corpus. +# Create one seed variant for the default path plus one for each dispatch bit. +# Per-bug reproducers are used only as source material: exact crashing inputs +# are filtered out before packaging. +seed_zip="$OUT/gstoraster_fuzzer_seed_corpus.zip" +seed_target="$OUT/gstoraster_fuzzer" +mkdir -p /tmp/seeds_dispatch /tmp/original_seeds /tmp/benchmark_seed_candidates + +if [ -f "$seed_zip" ]; then + unzip -q -o "$seed_zip" -d /tmp/original_seeds 2>/dev/null || true + for f in /tmp/original_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + for dispatch in '\x00\x00\x00' '\x01\x00\x00' '\x02\x00\x00' '\x04\x00\x00' '\x08\x00\x00' '\x10\x00\x00' '\x20\x00\x00' '\x40\x00\x00' '\x80\x00\x00' '\x00\x01\x00' '\x00\x02\x00' '\x00\x04\x00' '\x00\x08\x00' '\x00\x10\x00' '\x00\x20\x00' '\x00\x40\x00' '\x00\x80\x00' '\x00\x00\x01' '\x00\x00\x02' '\x00\x00\x04' '\x00\x00\x08' '\x00\x00\x10' '\x00\x00\x20' '\x00\x00\x40' '\x00\x00\x80'; do + dispatch_name=$(printf '%s' "$dispatch" | tr -d '\x') + printf '%b' "$dispatch" | cat - "$f" > "/tmp/seeds_dispatch/${base}.dispatch_${dispatch_name}" + done + done +fi + +if [ -d /src/benchmark_seeds ]; then + for f in /src/benchmark_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + size=$(wc -c < "$f") + [ "$size" -gt 0 ] || continue + + cp "$f" "/tmp/benchmark_seed_candidates/${base}.exact" + # Zero the dispatch byte (byte 0): deactivates dispatch-gated patches + # while keeping the full APDU conversation and card driver routing intact. + cp "$f" "/tmp/benchmark_seed_candidates/${base}.dispatch_zero" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.dispatch_zero" bs=1 seek=0 conv=notrunc 2>/dev/null || true + for keep in 1 2 8 16 64 256 1024; do + if [ "$size" -gt "$keep" ]; then + head -c "$keep" "$f" > "/tmp/benchmark_seed_candidates/${base}.head_${keep}" + fi + done + if [ "$size" -gt 1 ]; then + head -c "$((size - 1))" "$f" > "/tmp/benchmark_seed_candidates/${base}.trim_1" + cp "$f" "/tmp/benchmark_seed_candidates/${base}.zero_last" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.zero_last" bs=1 seek="$((size - 1))" conv=notrunc 2>/dev/null || true + cp "$f" "/tmp/benchmark_seed_candidates/${base}.ff_last" + printf '\377' | dd of="/tmp/benchmark_seed_candidates/${base}.ff_last" bs=1 seek="$((size - 1))" conv=notrunc 2>/dev/null || true + fi + if [ "$size" -gt 4 ]; then + mid=$((size / 2)) + cp "$f" "/tmp/benchmark_seed_candidates/${base}.zero_mid" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.zero_mid" bs=1 seek="$mid" conv=notrunc 2>/dev/null || true + cp "$f" "/tmp/benchmark_seed_candidates/${base}.ff_mid" + printf '\377' | dd of="/tmp/benchmark_seed_candidates/${base}.ff_mid" bs=1 seek="$mid" conv=notrunc 2>/dev/null || true + fi + done +fi + +if [ -x "$seed_target" ] && ls /tmp/benchmark_seed_candidates/* 1>/dev/null 2>&1; then + for f in /tmp/benchmark_seed_candidates/*; do + [ -f "$f" ] || continue + if timeout 10s env ASAN_OPTIONS="${ASAN_OPTIONS:-detect_leaks=0:detect_stack_use_after_return=1}" "$seed_target" "$f" >/tmp/seed_replay.log 2>&1; then + cp "$f" "/tmp/seeds_dispatch/poc_$(basename "$f")" + fi + done +fi + +if ls /tmp/seeds_dispatch/* 1>/dev/null 2>&1; then + rm -f "$seed_zip" + zip -j -q "$seed_zip" /tmp/seeds_dispatch/* +fi diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2020-1875.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2020-1875.txt new file mode 100644 index 000000000..76adc2882 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2020-1875.txt @@ -0,0 +1,105 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1123187330 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7fbf77cbb9e0, 0x7fbf77cbef6c), 959 [0x7fbf77d1ca40, 0x7fbf77d1cdff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7fbf77cbef70,0x7fbf77cf4830), 959 [0x7fbf77d1ce00,0x7fbf77d209f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +gsapi_init_with_args: error -100 +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x62a00000c468 at pc 0x000000cebec3 bp 0x7ffd719be890 sp 0x7ffd719be888 +READ of size 8 at 0x62a00000c468 thread T0 + #0 0xcebec2 in dict_find_string /src/ghostpdl/./psi/idict.c:427:36 + #1 0x5693dd in gs_main_tempnames /src/ghostpdl/./psi/imain.c:1185:13 + #2 0x5693dd in gs_main_finit /src/ghostpdl/./psi/imain.c:1248:17 + #3 0x56b223 in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #4 0x56b223 in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #5 0xce78c5 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #6 0x55f5b0 in gsapi_exit /src/ghostpdl/./psi/iapi.c:420:12 + #7 0x55e474 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:104:8 + #8 0x55e474 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #9 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fbf776b5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #14 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x62a00000c468 is located 616 bytes inside of 20048-byte region [0x62a00000c200,0x62a000011050) +freed by thread T0 here: + #0 0x524bc2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:111:3 + #1 0x8e6e4b in gs_heap_free_object /src/ghostpdl/./base/gsmalloc.c:366:5 + #2 0x12b3915 in alloc_free_clump /src/ghostpdl/./base/gsalloc.c:2639:9 + #3 0x12b3915 in free_all_not_allocator /src/ghostpdl/./base/gsalloc.c:993:9 + #4 0x12b3915 in clump_splay_app /src/ghostpdl/./base/gsalloc.c:606:19 + #5 0x12b3915 in i_free_all /src/ghostpdl/./base/gsalloc.c:1029:9 + #6 0xe00bdd in restore_free /src/ghostpdl/./psi/isave.c:1000:5 + #7 0xe00bdd in alloc_restore_all /src/ghostpdl/./psi/isave.c:927:5 + #8 0x56a6dd in gs_main_finit /src/ghostpdl/./psi/imain.c:1391:20 + #9 0x101fe76 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:294:13 + #10 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #11 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #12 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #13 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #14 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #15 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #16 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #17 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #18 0x7fbf776b5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +previously allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x12bd3b4 in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2488:13 + #3 0x12bc262 in alloc_add_clump /src/ghostpdl/./base/gsalloc.c:2438:19 + #4 0x12bc262 in alloc_obj /src/ghostpdl/./base/gsalloc.c:2046:17 + #5 0x12b4cc1 in i_alloc_struct /src/ghostpdl/./base/gsalloc.c:1234:15 + #6 0x13a243e in context_state_alloc /src/ghostpdl/./psi/icontext.c:120:16 + #7 0xcf8fdd in gs_interp_init /src/ghostpdl/./psi/interp.c:303:16 + #8 0xcf51d0 in obj_init /src/ghostpdl/./psi/iinit.c:264:12 + #9 0x562158 in gs_main_init1 /src/ghostpdl/./psi/imain.c:221:12 + #10 0x101ab2e in swproc /src/ghostpdl/./psi/imainarg.c:789:29 + #11 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #12 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #13 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #14 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #15 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #16 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #17 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #18 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #19 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #20 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #21 0x7fbf776b5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/ghostpdl/./psi/idict.c:427:36 in dict_find_string +Shadow bytes around the buggy address: + 0x0c547fff9830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c547fff9840: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c547fff9850: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c547fff9860: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c547fff9870: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0c547fff9880: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd + 0x0c547fff9890: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c547fff98a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c547fff98b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c547fff98c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c547fff98d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1681.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1681.txt new file mode 100644 index 000000000..de9e7b232 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1681.txt @@ -0,0 +1,44 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 711222747 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f1aad9969e0, 0x7f1aad999f6c), 959 [0x7f1aad9f7a40, 0x7f1aad9f7dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f1aad999f70,0x7f1aad9cf830), 959 [0x7f1aad9f7e00,0x7f1aad9fb9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x0000006f2bf8 (pc 0x000000ffeee0 bp 0x7ffc2cb6ae10 sp 0x7ffc2cb6ac80 T0) +==1==The signal is caused by a WRITE memory access. + #0 0xffeee0 in pdfi_countup_impl /src/ghostpdl/./pdf/pdf_stack.h:36:18 + #1 0xffeee0 in pdfi_deref_compressed /src/ghostpdl/./pdf/pdf_deref.c:594:9 + #2 0xffeee0 in pdfi_dereference /src/ghostpdl/./pdf/pdf_deref.c:805:20 + #3 0x1010683 in pdfi_get_child /src/ghostpdl/./pdf/pdf_doc.c:282:16 + #4 0x100f4eb in pdfi_get_page_dict /src/ghostpdl/./pdf/pdf_doc.c:468:16 + #5 0x100fce6 in pdfi_get_page_dict /src/ghostpdl/./pdf/pdf_doc.c:491:36 + #6 0xf31bae in pdfi_page_get_dict /src/ghostpdl/./pdf/pdf_page.c:675:12 + #7 0xf3083f in pdfi_page_info /src/ghostpdl/./pdf/pdf_page.c:483:12 + #8 0xe99dca in zPDFpageinfo /src/ghostpdl/./psi/zpdfops.c:957:16 + #9 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #10 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #11 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #12 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #13 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #14 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #15 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #16 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #17 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #18 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #19 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #20 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #21 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #22 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #23 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #24 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #25 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #26 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #27 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #28 0x7f1aad390082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #29 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_stack.h:36:18 in pdfi_countup_impl +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1682.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1682.txt new file mode 100644 index 000000000..4150ece50 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1682.txt @@ -0,0 +1,105 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 714649793 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f150aec89e0, 0x7f150aecbf6c), 959 [0x7f150af29a40, 0x7f150af29dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f150aecbf70,0x7f150af01830), 959 [0x7f150af29e00,0x7f150af2d9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x63100008c9d0 at pc 0x000001005824 bp 0x7fff3fc1c770 sp 0x7fff3fc1c768 +WRITE of size 4 at 0x63100008c9d0 thread T0 + #0 0x1005823 in pdfi_repair_file /src/ghostpdl/./pdf/pdf_repair.c:439:103 + #1 0xec8cec in pdfi_read_xref_stream_dict /src/ghostpdl/./pdf/pdf_xref.c + #2 0xec57d3 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1038:20 + #3 0xeaca4c in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1051:12 + #4 0xeaca4c in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1328:12 + #5 0xe981b4 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:642:12 + #6 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #10 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #12 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #13 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #14 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #15 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #16 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #17 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #19 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #20 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #21 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #22 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #23 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #24 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7f150a8c2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #26 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x63100008c9d0 is located 16768 bytes to the right of 65616-byte region [0x631000078800,0x631000088850) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f2be8 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f546d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #5 0x6f453c in chunk_alloc_struct_array /src/ghostpdl/./base/gsmchunk.c:1024:12 + #6 0x1375e4a in gx_char_cache_alloc /src/ghostpdl/./base/gxccman.c:88:13 + #7 0x12c7179 in gs_font_dir_alloc2_limits /src/ghostpdl/./base/gsfont.c:263:12 + #8 0x12c7020 in gs_font_dir_alloc2 /src/ghostpdl/./base/gsfont.c:236:16 + #9 0xf6cf60 in pdfi_init_font_directory /src/ghostpdl/./pdf/pdf_font.c:1662:21 + #10 0xeb03e9 in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1637:12 + #11 0xe9c794 in zPDFInit /src/ghostpdl/./psi/zpdfops.c:1231:11 + #12 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #13 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #14 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #15 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #16 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #17 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #18 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #19 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #20 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #21 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #22 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #23 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #24 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #25 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #26 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #27 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #28 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #29 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #30 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #31 0x7f150a8c2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./pdf/pdf_repair.c:439:103 in pdfi_repair_file +Shadow bytes around the buggy address: + 0x0c62800098e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c62800098f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c6280009930: fa fa fa fa fa fa fa fa fa fa[fa]fa fa fa fa fa + 0x0c6280009940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009960: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009970: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1683.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1683.txt new file mode 100644 index 000000000..54be96046 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1683.txt @@ -0,0 +1,97 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1141744339 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f020f0779e0, 0x7f020f07af6c), 959 [0x7f020f0d8a40, 0x7f020f0d8dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f020f07af70,0x7f020f0b0830), 959 [0x7f020f0d8e00,0x7f020f0dc9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges [0x6310000689d9,0x6310000689e0) and [0x6310000689df, 0x6310000689e6) overlap + #0 0x4be7af in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xeac90b in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1313:21 + #2 0xe981b4 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:642:12 + #3 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #4 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #5 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #6 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #7 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #8 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #9 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #10 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #11 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #12 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #13 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #14 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #15 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #16 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #17 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #18 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #19 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #20 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #21 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #22 0x7f020ea71082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #23 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x6310000689d9 is located 16857 bytes inside of 65616-byte region [0x631000064800,0x631000074850) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f2be8 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f546d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #5 0x6f43b8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0xeb01e7 in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1601:27 + #7 0xe9c794 in zPDFInit /src/ghostpdl/./psi/zpdfops.c:1231:11 + #8 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #9 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #10 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #11 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #12 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #13 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #14 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #15 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #16 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #17 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #18 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #19 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #20 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #21 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #22 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #23 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #24 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #25 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #26 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #27 0x7f020ea71082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +0x6310000689df is located 16863 bytes inside of 65616-byte region [0x631000064800,0x631000074850) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f2be8 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f546d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #5 0x6f43b8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0xeb01e7 in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1601:27 + #7 0xe9c794 in zPDFInit /src/ghostpdl/./psi/zpdfops.c:1231:11 + #8 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #9 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #10 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #11 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #12 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #13 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #14 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #15 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #16 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #17 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #18 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #19 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #20 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #21 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #22 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #23 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #24 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #25 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #26 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #27 0x7f020ea71082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: memcpy-param-overlap /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1684.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1684.txt new file mode 100644 index 000000000..465a165cf --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1684.txt @@ -0,0 +1,60 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 717382686 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f0acdb229e0, 0x7f0acdb25f6c), 959 [0x7f0acdb83a40, 0x7f0acdb83dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f0acdb25f70,0x7f0acdb5b830), 959 [0x7f0acdb83e00,0x7f0acdb879f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x631000064878 (pc 0x631000064878 bp 0x7ffe03e84b70 sp 0x7ffe03e84af8 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: PC is at a non-executable region. Maybe a wild jump? + #0 0x631000064878 () + #1 0xee5c97 in pdfi_open_memory_stream_from_filtered_stream /src/ghostpdl/./pdf/pdf_file.c:1278:9 + #2 0xf06740 in pdfi_create_iccprofile /src/ghostpdl/./pdf/pdf_colour.c:1062:12 + #3 0xf06740 in pdfi_create_iccbased /src/ghostpdl/./pdf/pdf_colour.c:1157:12 + #4 0xefbde6 in pdfi_create_colorspace_by_array /src/ghostpdl/./pdf/pdf_colour.c:2332:16 + #5 0xef9ab0 in pdfi_create_colorspace /src/ghostpdl/./pdf/pdf_colour.c:2473:20 + #6 0xefa573 in pdfi_create_colorspace_by_name /src/ghostpdl/./pdf/pdf_colour.c:2408:16 + #7 0xefc83d in pdfi_create_colorspace /src/ghostpdl/./pdf/pdf_colour.c:2470:16 + #8 0xefc83d in pdfi_setcolorspace /src/ghostpdl/./pdf/pdf_colour.c:2488:12 + #9 0xefc83d in pdfi_setfillcolor_space /src/ghostpdl/./pdf/pdf_colour.c:2522:12 + #10 0xedc22e in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1455:24 + #11 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #12 0xed904d in pdfi_interpret_inner_content /src/ghostpdl/./pdf/pdf_int.c:1927:12 + #13 0xed904d in pdfi_interpret_inner_content_stream /src/ghostpdl/./pdf/pdf_int.c:2026:12 + #14 0xed904d in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1873:12 + #15 0xf25da1 in pdfi_form_execgroup /src/ghostpdl/./pdf/pdf_image.c:2161:12 + #16 0xf26e3d in pdfi_do_form /src/ghostpdl/./pdf/pdf_image.c:2395:16 + #17 0xf274a0 in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2493:16 + #18 0xf27c9f in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2571:12 + #19 0xedcab8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1472:24 + #20 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #21 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #22 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #23 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #24 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #25 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #26 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #27 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #28 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #29 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #30 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #31 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #32 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #33 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #34 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #35 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #36 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #37 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #38 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #39 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #40 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #41 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #42 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #43 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #44 0x7f0acd51c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV () +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1685.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1685.txt new file mode 100644 index 000000000..badb8b5d0 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1685.txt @@ -0,0 +1,106 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 720159375 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f8be8f319e0, 0x7f8be8f34f6c), 959 [0x7f8be8f92a40, 0x7f8be8f92dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f8be8f34f70,0x7f8be8f6a830), 959 [0x7f8be8f92e00,0x7f8be8f969f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000077968 at pc 0x00000100107b bp 0x7ffeaebc6010 sp 0x7ffeaebc6008 +READ of size 8 at 0x631000077968 thread T0 + #0 0x100107a in pdfi_deref_compressed /src/ghostpdl/./pdf/pdf_deref.c:560:27 + #1 0x100107a in pdfi_dereference /src/ghostpdl/./pdf/pdf_deref.c:805:20 + #2 0x10019d0 in pdfi_deref_loop_detect /src/ghostpdl/./pdf/pdf_deref.c:909:12 + #3 0xeb45d3 in pdfi_dict_get /src/ghostpdl/./pdf/pdf_dict.c:236:28 + #4 0xebc562 in pdfi_dict_get_type /src/ghostpdl/./pdf/pdf_dict.c:462:12 + #5 0xebc562 in pdfi_dict_knownget_type /src/ghostpdl/./pdf/pdf_dict.c:986:12 + #6 0x1013c84 in pdfi_doc_AcroForm /src/ghostpdl/./pdf/pdf_doc.c:1248:12 + #7 0x1013c84 in pdfi_doc_trailer /src/ghostpdl/./pdf/pdf_doc.c:1320:12 + #8 0xead1b9 in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1135:12 + #9 0xead1b9 in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1328:12 + #10 0xe981b4 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:642:12 + #11 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #12 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #13 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #14 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #15 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #16 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #17 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #18 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #19 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #20 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #21 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #22 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #23 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #24 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #25 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #26 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #27 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #28 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #29 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #30 0x7f8be892b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #31 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x631000077968 is located 12568 bytes to the right of 65616-byte region [0x631000064800,0x631000074850) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f2be8 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f546d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #5 0x6f43b8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0xeb01e7 in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1601:27 + #7 0xe9c794 in zPDFInit /src/ghostpdl/./psi/zpdfops.c:1231:11 + #8 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #9 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #10 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #11 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #12 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #13 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #14 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #15 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #16 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #17 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #18 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #19 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #20 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #21 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #22 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #23 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #24 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #25 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #26 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #27 0x7f8be892b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./pdf/pdf_deref.c:560:27 in pdfi_deref_compressed +Shadow bytes around the buggy address: + 0x0c6280006ed0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006ee0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006ef0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006f10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c6280006f20: fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]fa fa + 0x0c6280006f30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006f40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006f50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006f60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006f70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1686.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1686.txt new file mode 100644 index 000000000..73e1c4b58 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1686.txt @@ -0,0 +1,121 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 722850986 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f5b266a79e0, 0x7f5b266aaf6c), 959 [0x7f5b26708a40, 0x7f5b26708dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f5b266aaf70,0x7f5b266e0830), 959 [0x7f5b26708e00,0x7f5b2670c9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6310001148f8 at pc 0x0000006f661f bp 0x7fff379cab10 sp 0x7fff379cab08 +WRITE of size 8 at 0x6310001148f8 thread T0 + #0 0x6f661e in insert_free /src/ghostpdl/./base/gsmchunk.c:654:16 + #1 0x6f5c40 in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:930:17 + #2 0x6f43b8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #3 0x839898 in file_prepare_stream /src/ghostpdl/./base/sfxcommon.c:199:14 + #4 0x839162 in file_open_stream /src/ghostpdl/./base/sfxcommon.c:80:12 + #5 0xededbb in pdfi_filter_open /src/ghostpdl/./pdf/pdf_file.c:105:12 + #6 0xee3cb5 in pdfi_apply_SubFileDecode_filter /src/ghostpdl/./pdf/pdf_file.c:1172:12 + #7 0xf2424c in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:1949:16 + #8 0xf2739e in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2485:16 + #9 0xf27c9f in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2571:12 + #10 0xedcab8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1472:24 + #11 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #12 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #13 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #14 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #15 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #16 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #24 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #25 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #26 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #27 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #30 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7f5b260a1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x6310001148f8 is located 168 bytes to the right of 65616-byte region [0x631000104800,0x631000114850) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f2be8 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f546d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #5 0x6f43b8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0x10067a6 in pdfi_object_alloc /src/ghostpdl/./pdf/pdf_obj.c:104:41 + #7 0xed6fe7 in pdfi_name_alloc /src/ghostpdl/./pdf/pdf_int.c:1124:12 + #8 0xf99384 in pdf_ps_RD_oper_func /src/ghostpdl/./pdf/pdf_fontps.c:1136:24 + #9 0xf96dd0 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:363:36 + #10 0xf9871b in pdfi_read_ps_font /src/ghostpdl/./pdf/pdf_fontps.c:1234:12 + #11 0xf742d7 in pdfi_read_type1_font /src/ghostpdl/./pdf/pdf_font1.c:538:16 + #12 0xf6019b in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:727:32 + #13 0xf6d457 in pdfi_load_font_by_name_string /src/ghostpdl/./pdf/pdf_font.c:1706:12 + #14 0xf6a002 in pdfi_font_set_internal_inner /src/ghostpdl/./pdf/pdf_font.c:1793:12 + #15 0xf6a002 in pdfi_font_set_internal_name /src/ghostpdl/./pdf/pdf_font.c:1814:16 + #16 0xf69d0b in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1314:16 + #17 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #18 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #19 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #20 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #21 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #22 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #23 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #24 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #25 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #26 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #27 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #28 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #29 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #30 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #31 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #32 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #33 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #34 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #35 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #36 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #37 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/gsmchunk.c:654:16 in insert_free +Shadow bytes around the buggy address: + 0x0c628001a8c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001a8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001a8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001a8f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001a900: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa +=>0x0c628001a910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa] + 0x0c628001a920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001a930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001a940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001a950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001a960: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1687.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1687.txt new file mode 100644 index 000000000..1d9c4c742 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1687.txt @@ -0,0 +1,55 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 725835738 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f6f40bfd9e0, 0x7f6f40c00f6c), 959 [0x7f6f40c5ea40, 0x7f6f40c5edff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f6f40c00f70,0x7f6f40c36830), 959 [0x7f6f40c5ee00,0x7f6f40c629f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000719bc3 bp 0x7fff6f996ab0 sp 0x7fff6f996ab0 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: address points to the zero page. + #0 0x719bc3 in gx_num_components_ICC /src/ghostpdl/./base/gsicc.c:243:39 + #1 0x897318 in gs_color_space_num_components /src/ghostpdl/./base/gscspace.c:323:12 + #2 0x6c58fa in clist_begin_typed_image /src/ghostpdl/./base/gxclimag.c:541:30 + #3 0xbdc057 in gx_forward_begin_typed_image /src/ghostpdl/./base/gdevnfwd.c:526:12 + #4 0x63652b in pdf14_clist_begin_typed_image /src/ghostpdl/./base/gdevp14.c:11484:12 + #5 0x8d6c4b in gs_image_begin_typed /src/ghostpdl/./base/gsimage.c:268:12 + #6 0xf2de39 in pdfi_render_image /src/ghostpdl/./pdf/pdf_image.c:744:16 + #7 0xf24478 in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:2023:12 + #8 0xf2739e in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2485:16 + #9 0xf2c253 in pdfi_do_image_smask /src/ghostpdl/./pdf/pdf_image.c:1045:20 + #10 0xf23061 in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:1798:20 + #11 0xf2739e in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2485:16 + #12 0xf27c9f in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2571:12 + #13 0xedcab8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1472:24 + #14 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #15 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #16 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #17 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #18 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #19 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #20 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #21 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #22 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #23 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #24 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #25 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #26 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #27 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #28 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #29 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #30 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #31 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #32 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #33 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #34 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #35 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #36 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #37 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #38 0x7f6f405f7082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #39 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gsicc.c:243:39 in gx_num_components_ICC +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1688.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1688.txt new file mode 100644 index 000000000..046c8550f --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1688.txt @@ -0,0 +1,81 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 728828189 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7fe90257e9e0, 0x7fe902581f6c), 959 [0x7fe9025dfa40, 0x7fe9025dfdff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7fe902581f70,0x7fe9025b7830), 959 [0x7fe9025dfe00,0x7fe9025e39f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fe90131e4d4 at pc 0x0000004bea81 bp 0x7ffd30d29c10 sp 0x7ffd30d293d0 +WRITE of size 108 at 0x7fe90131e4d4 thread T0 + #0 0x4bea80 in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xf567b5 in pdfi_annot_draw /src/ghostpdl/./pdf/pdf_annot.c:3882:9 + #2 0xf489cb in pdfi_annot_handle /src/ghostpdl/./pdf/pdf_annot.c + #3 0xf489cb in pdfi_do_annotations /src/ghostpdl/./pdf/pdf_annot.c:4351:16 + #4 0xf3721e in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:167:13 + #5 0xf3721e in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #6 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #7 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #8 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #9 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #10 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #11 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #12 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #13 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #14 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #15 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #16 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #17 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #18 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #19 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #20 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #21 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #22 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #23 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #24 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #25 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #26 0x7fe901f78082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #27 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +Address 0x7fe90131e4d4 is located in stack of thread T0 at offset 212 in frame + #0 0xf561df in pdfi_annot_draw /src/ghostpdl/./pdf/pdf_annot.c:3849 + + This frame has 4 object(s): + [32, 40) 'F.i' (line 3776) + [64, 72) 'NormAP' (line 3850) + [96, 100) 'render_done' (line 3853) + [112, 212) 'str' (line 3881) <== Memory access at offset 212 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x0ffda025bc40: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffda025bc50: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffda025bc60: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffda025bc70: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffda025bc80: f1 f1 f1 f1 f8 f2 f2 f2 00 f2 f2 f2 04 f2 00 00 +=>0x0ffda025bc90: 00 00 00 00 00 00 00 00 00 00[04]f3 f3 f3 f3 f3 + 0x0ffda025bca0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffda025bcb0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffda025bcc0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffda025bcd0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffda025bce0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1689.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1689.txt new file mode 100644 index 000000000..18cadb4f6 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1689.txt @@ -0,0 +1,82 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 731646185 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f98cd0b39e0, 0x7f98cd0b6f6c), 959 [0x7f98cd114a40, 0x7f98cd114dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f98cd0b6f70,0x7f98cd0ec830), 959 [0x7f98cd114e00,0x7f98cd1189f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7f98cbe59f1f at pc 0x000000ec850d bp 0x7ffded20a370 sp 0x7ffded20a368 +WRITE of size 1 at 0x7f98cbe59f1f thread T0 + #0 0xec850c in read_xref_section /src/ghostpdl/./pdf/pdf_xref.c:761:19 + #1 0xec850c in read_xref /src/ghostpdl/./pdf/pdf_xref.c:800:16 + #2 0xec56d1 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1032:20 + #3 0xeaca4c in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1051:12 + #4 0xeaca4c in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1328:12 + #5 0xe981b4 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:642:12 + #6 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #10 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #12 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #13 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #14 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #15 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #16 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #17 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #19 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #20 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #21 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #22 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #23 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #24 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7f98ccaad082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #26 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +Address 0x7f98cbe59f1f is located in stack of thread T0 at offset 31 in frame + #0 0xec628f in read_xref /src/ghostpdl/./pdf/pdf_xref.c:788 + + This frame has 6 object(s): + [32, 53) 'Buffer.i' (line 660) <== Memory access at offset 31 underflows this variable + [96, 97) 'free.i' (line 740) + [112, 120) 'off.i' (line 741) + [144, 148) 'gen.i' (line 742) + [160, 168) 'num' (line 794) + [192, 200) 'size44' (line 846) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-underflow /src/ghostpdl/./pdf/pdf_xref.c:761:19 in read_xref_section +Shadow bytes around the buggy address: + 0x0ff3997c3390: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff3997c33a0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff3997c33b0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff3997c33c0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff3997c33d0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0ff3997c33e0: f1 f1 f1[f1]00 00 05 f2 f2 f2 f2 f2 01 f2 00 f2 + 0x0ff3997c33f0: f2 f2 04 f2 00 f2 f2 f2 f8 f3 f3 f3 00 00 00 00 + 0x0ff3997c3400: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff3997c3410: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff3997c3420: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff3997c3430: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1690.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1690.txt new file mode 100644 index 000000000..30485fcf9 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1690.txt @@ -0,0 +1,76 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1144583578 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f0189e009e0, 0x7f0189e03f6c), 959 [0x7f0189e61a40, 0x7f0189e61dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f0189e03f70,0x7f0189e39830), 959 [0x7f0189e61e00,0x7f0189e659f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000002ceff9b at pc 0x0000004bed6c bp 0x7ffd6efc0ae0 sp 0x7ffd6efc0288 +READ of size 1 at 0x000002ceff9b thread T0 + #0 0x4bed6b in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:861:7 + #1 0x4bf11b in memcmp /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:892:10 + #2 0xede4f8 in search_table_1 /src/ghostpdl/./pdf/pdf_int.c:1193:17 + #3 0xedddf7 in split_bogus_operator /src/ghostpdl/./pdf/pdf_int.c:1334:12 + #4 0xedbc6b in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1392:16 + #5 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #6 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #7 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #8 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #9 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #10 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #11 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #12 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #13 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #14 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #15 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #16 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #17 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #18 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #19 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #20 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #21 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #22 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #23 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #24 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #25 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #26 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #27 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #28 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #29 0x7f01897fa082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #30 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x000002ceff9b is located 37 bytes to the left of global variable 'op_table_2' defined in './pdf/pdf_int.c:1137:13' (0x2ceffc0) of size 78 +0x000002ceff9b is located 0 bytes to the right of global variable 'op_table_1' defined in './pdf/pdf_int.c:1142:13' (0x2ceff80) of size 27 +SUMMARY: AddressSanitizer: global-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:861:7 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) +Shadow bytes around the buggy address: + 0x000080595fa0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 + 0x000080595fb0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 + 0x000080595fc0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 + 0x000080595fd0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 + 0x000080595fe0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 00 07 f9 f9 +=>0x000080595ff0: 00 00 00[03]f9 f9 f9 f9 00 00 00 00 00 00 00 00 + 0x000080596000: 00 06 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00 + 0x000080596010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x000080596020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x000080596030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x000080596040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1692.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1692.txt new file mode 100644 index 000000000..07363ad79 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1692.txt @@ -0,0 +1,171 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 734580008 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7fcbdc89f9e0, 0x7fcbdc8a2f6c), 959 [0x7fcbdc900a40, 0x7fcbdc900dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7fcbdc8a2f70,0x7fcbdc8d8830), 959 [0x7fcbdc900e00,0x7fcbdc9049f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x62e00000c450 at pc 0x0000006f3d6d bp 0x7ffe42fe1cf0 sp 0x7ffe42fe1ce8 +READ of size 8 at 0x62e00000c450 thread T0 + #0 0x6f3d6c in chunk_free_object /src/ghostpdl/./base/gsmchunk.c:1092:14 + #1 0xee5c97 in pdfi_open_memory_stream_from_filtered_stream /src/ghostpdl/./pdf/pdf_file.c:1278:9 + #2 0xfd4f65 in pdfi_build_mesh_shading /src/ghostpdl/./pdf/pdf_shading.c:308:12 + #3 0xfd1fa9 in pdfi_shading5 /src/ghostpdl/./pdf/pdf_shading.c:432:12 + #4 0xfd0480 in pdfi_shading_build /src/ghostpdl/./pdf/pdf_shading.c:693:16 + #5 0xf0a88a in pdfi_setpattern_type2 /src/ghostpdl/./pdf/pdf_pattern.c:613:12 + #6 0xf0a88a in pdfi_pattern_set /src/ghostpdl/./pdf/pdf_pattern.c:688:16 + #7 0xef75cb in pdfi_setcolorN /src/ghostpdl/./pdf/pdf_colour.c:790:16 + #8 0xedca08 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c + #9 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #10 0xed904d in pdfi_interpret_inner_content /src/ghostpdl/./pdf/pdf_int.c:1927:12 + #11 0xed904d in pdfi_interpret_inner_content_stream /src/ghostpdl/./pdf/pdf_int.c:2026:12 + #12 0xed904d in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1873:12 + #13 0xf26a51 in pdfi_do_form /src/ghostpdl/./pdf/pdf_image.c:2407:16 + #14 0xf274a0 in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2493:16 + #15 0xf27c9f in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2571:12 + #16 0xedcab8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1472:24 + #17 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #18 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #19 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #20 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #21 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #22 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #23 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #24 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #25 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #26 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #27 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #28 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #29 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #30 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #31 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #32 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #33 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #34 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #35 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #36 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #37 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #38 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #39 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #40 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #41 0x7fcbdc299082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #42 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x62e00000c450 is located 80 bytes inside of 40304-byte region [0x62e00000c400,0x62e000016170) +freed by thread T0 here: + #0 0x524bc2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:111:3 + #1 0x8e6e4b in gs_heap_free_object /src/ghostpdl/./base/gsmalloc.c:366:5 + #2 0x6f3078 in chunk_free_object /src/ghostpdl/./base/gsmchunk.c:1105:9 + #3 0x6f3078 in chunk_free_object /src/ghostpdl/./base/gsmchunk.c:1105:9 + #4 0xee575d in pdfi_close_memory_stream /src/ghostpdl/./pdf/pdf_file.c:1363:5 + #5 0xee575d in pdfi_open_memory_stream_from_filtered_stream /src/ghostpdl/./pdf/pdf_file.c:1277:9 + #6 0xfd4f65 in pdfi_build_mesh_shading /src/ghostpdl/./pdf/pdf_shading.c:308:12 + #7 0xfd1fa9 in pdfi_shading5 /src/ghostpdl/./pdf/pdf_shading.c:432:12 + #8 0xfd0480 in pdfi_shading_build /src/ghostpdl/./pdf/pdf_shading.c:693:16 + #9 0xf0a88a in pdfi_setpattern_type2 /src/ghostpdl/./pdf/pdf_pattern.c:613:12 + #10 0xf0a88a in pdfi_pattern_set /src/ghostpdl/./pdf/pdf_pattern.c:688:16 + #11 0xef75cb in pdfi_setcolorN /src/ghostpdl/./pdf/pdf_colour.c:790:16 + #12 0xedca08 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c + #13 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #14 0xed904d in pdfi_interpret_inner_content /src/ghostpdl/./pdf/pdf_int.c:1927:12 + #15 0xed904d in pdfi_interpret_inner_content_stream /src/ghostpdl/./pdf/pdf_int.c:2026:12 + #16 0xed904d in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1873:12 + #17 0xf26a51 in pdfi_do_form /src/ghostpdl/./pdf/pdf_image.c:2407:16 + #18 0xf274a0 in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2493:16 + #19 0xf27c9f in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2571:12 + #20 0xedcab8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1472:24 + #21 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #22 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #23 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #24 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #25 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #26 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #27 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #28 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #29 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #30 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #31 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #32 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #33 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #34 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #35 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #36 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #37 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #38 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #39 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #40 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + +previously allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f2be8 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #5 0x6f43b8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0xee4372 in pdfi_open_memory_stream_from_stream /src/ghostpdl/./pdf/pdf_file.c:1202:15 + #7 0xee510f in pdfi_open_memory_stream_from_filtered_stream /src/ghostpdl/./pdf/pdf_file.c:1248:12 + #8 0xfd4f65 in pdfi_build_mesh_shading /src/ghostpdl/./pdf/pdf_shading.c:308:12 + #9 0xfd1fa9 in pdfi_shading5 /src/ghostpdl/./pdf/pdf_shading.c:432:12 + #10 0xfd0480 in pdfi_shading_build /src/ghostpdl/./pdf/pdf_shading.c:693:16 + #11 0xf0a88a in pdfi_setpattern_type2 /src/ghostpdl/./pdf/pdf_pattern.c:613:12 + #12 0xf0a88a in pdfi_pattern_set /src/ghostpdl/./pdf/pdf_pattern.c:688:16 + #13 0xef75cb in pdfi_setcolorN /src/ghostpdl/./pdf/pdf_colour.c:790:16 + #14 0xedca08 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c + #15 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #16 0xed904d in pdfi_interpret_inner_content /src/ghostpdl/./pdf/pdf_int.c:1927:12 + #17 0xed904d in pdfi_interpret_inner_content_stream /src/ghostpdl/./pdf/pdf_int.c:2026:12 + #18 0xed904d in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1873:12 + #19 0xf26a51 in pdfi_do_form /src/ghostpdl/./pdf/pdf_image.c:2407:16 + #20 0xf274a0 in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2493:16 + #21 0xf27c9f in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2571:12 + #22 0xedcab8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1472:24 + #23 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #24 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #25 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #26 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #27 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #28 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #29 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #30 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #31 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #32 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #33 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #34 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #35 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #36 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #37 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #38 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + +SUMMARY: AddressSanitizer: heap-use-after-free /src/ghostpdl/./base/gsmchunk.c:1092:14 in chunk_free_object +Shadow bytes around the buggy address: + 0x0c5c7fff9830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5c7fff9840: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5c7fff9850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5c7fff9860: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5c7fff9870: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c5c7fff9880: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd + 0x0c5c7fff9890: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c5c7fff98a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c5c7fff98b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c5c7fff98c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c5c7fff98d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1693.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1693.txt new file mode 100644 index 000000000..0e69d7c07 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1693.txt @@ -0,0 +1,90 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 737463756 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f8a14e499e0, 0x7f8a14e4cf6c), 959 [0x7f8a14eaaa40, 0x7f8a14eaadff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f8a14e4cf70,0x7f8a14e82830), 959 [0x7f8a14eaae00,0x7f8a14eae9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000002cd5a60 at pc 0x0000004be93e bp 0x7ffd74ceb4f0 sp 0x7ffd74ceacb0 +READ of size 13442 at 0x000002cd5a60 thread T0 + #0 0x4be93d in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0x13ab57d in pdfi_fapi_get_glyph /src/ghostpdl/./pdf/pdf_fapi.c:1187:21 + #2 0x9476a8 in get_fapi_glyph_data /src/ghostpdl/./base/fapi_ft.c:428:22 + #3 0x995635 in cff_get_glyph_data /src/ghostpdl/./freetype/src/cff/cffgload.c:56:19 + #4 0x995635 in cff_slot_load /src/ghostpdl/./freetype/src/cff/cffgload.c:417:15 + #5 0x9912fa in cff_glyph_load /src/ghostpdl/./freetype/src/cff/cffdrivr.c:192:13 + #6 0x95c6c7 in FT_Load_Glyph /src/ghostpdl/./freetype/src/base/ftobjs.c:987:15 + #7 0x948796 in load_glyph /src/ghostpdl/./base/fapi_ft.c:688:24 + #8 0x944a44 in gs_fapi_ft_get_char_raster_metrics /src/ghostpdl/./base/fapi_ft.c:1558:9 + #9 0x9399b2 in gs_fapi_do_char /src/ghostpdl/./base/gxfapi.c:1570:16 + #10 0x13a5e0d in pdfi_fapi_build_char /src/ghostpdl/./pdf/pdf_fapi.c:1386:12 + #11 0xa8e026 in show_proceed /src/ghostpdl/./base/gxchar.c:1239:12 + #12 0xa859e0 in continue_show /src/ghostpdl/./base/gxchar.c:761:12 + #13 0xa87ecc in gx_show_text_process /src/ghostpdl/./base/gxchar.c:738:12 + #14 0x921dcf in gs_text_process /src/ghostpdl/./base/gstext.c:696:12 + #15 0xfcd032 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:516:16 + #16 0xfcd032 in pdfi_show_Tr_0 /src/ghostpdl/./pdf/pdf_text.c:531:12 + #17 0xfc75a2 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:913:24 + #18 0xfc9021 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1131:12 + #19 0xedcc33 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1643:24 + #20 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #21 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #22 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #23 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #24 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #25 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #26 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #27 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #28 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #29 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #30 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #31 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #32 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #33 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #34 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #35 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #36 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #37 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #38 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #39 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #40 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #41 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #42 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #43 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #44 0x7f8a14843082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #45 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x000002cd5a60 is located 0 bytes to the right of global variable 'colorProcs' defined in './psi/zcolor.c:6312:19' (0x2cd5460) of size 1536 +SUMMARY: AddressSanitizer: global-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x000080592af0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x000080592b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x000080592b10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x000080592b20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x000080592b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x000080592b40: 00 00 00 00 00 00 00 00 00 00 00 00[f9]f9 f9 f9 + 0x000080592b50: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 + 0x000080592b60: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 + 0x000080592b70: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 + 0x000080592b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x000080592b90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1694.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1694.txt new file mode 100644 index 000000000..1b1d3a845 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1694.txt @@ -0,0 +1,89 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 741696002 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f10a51d49e0, 0x7f10a51d7f6c), 959 [0x7f10a5235a40, 0x7f10a5235dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f10a51d7f70,0x7f10a520d830), 959 [0x7f10a5235e00,0x7f10a52399f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f10a3f92200 at pc 0x000000f901c7 bp 0x7fff9694f350 sp 0x7fff9694f348 +WRITE of size 4 at 0x7f10a3f92200 thread T0 + #0 0xf901c6 in pdfi_read_cff_integer /src/ghostpdl/./pdf/pdf_font1C.c:765:14 + #1 0xf901c6 in pdfi_read_cff_dict /src/ghostpdl/./pdf/pdf_font1C.c:1029:21 + #2 0xf8fc74 in pdfi_read_cff_dict /src/ghostpdl/./pdf/pdf_font1C.c:1055:20 + #3 0xf8fc74 in pdfi_read_cff_dict /src/ghostpdl/./pdf/pdf_font1C.c:1055:20 + #4 0xf80bf6 in pdfi_read_cff /src/ghostpdl/./pdf/pdf_font1C.c:1552:12 + #5 0xf80bf6 in pdfi_read_cff_font /src/ghostpdl/./pdf/pdf_font1C.c:2132:20 + #6 0xf60137 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:731:32 + #7 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #8 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #9 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #10 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #11 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #12 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #13 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #14 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #15 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #16 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #24 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #25 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #26 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #27 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #30 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7f10a4bce082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +Address 0x7f10a3f92200 is located in stack of thread T0 at offset 512 in frame + #0 0xf8c8ef in pdfi_read_cff_dict /src/ghostpdl/./pdf/pdf_font1C.c:791 + + This frame has 3 object(s): + [32, 96) 'buf.i' (line 677) + [128, 512) 'args' (line 793) <== Memory access at offset 512 overflows this variable + [576, 584) 'fnamestr' (line 893) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ghostpdl/./pdf/pdf_font1C.c:765:14 in pdfi_read_cff_integer +Shadow bytes around the buggy address: + 0x0fe2947ea3f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe2947ea400: f1 f1 f1 f1 f8 f8 f8 f8 f8 f8 f8 f8 f2 f2 f2 f2 + 0x0fe2947ea410: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe2947ea420: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe2947ea430: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fe2947ea440:[f2]f2 f2 f2 f2 f2 f2 f2 f8 f3 f3 f3 00 00 00 00 + 0x0fe2947ea450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe2947ea460: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe2947ea470: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe2947ea480: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe2947ea490: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1697.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1697.txt new file mode 100644 index 000000000..24c973fd5 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1697.txt @@ -0,0 +1,129 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 744464476 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f336523d9e0, 0x7f3365240f6c), 959 [0x7f336529ea40, 0x7f336529edff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f3365240f70,0x7f3365276830), 959 [0x7f336529ee00,0x7f33652a29f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x61500000ce83 at pc 0x0000006bc192 bp 0x7ffdcc821690 sp 0x7ffdcc821688 +READ of size 1 at 0x61500000ce83 thread T0 + #0 0x6bc191 in stell /src/ghostpdl/./base/stream.c:415:24 + #1 0xee6ba7 in pdfi_unread_tell /src/ghostpdl/./pdf/pdf_file.c:1411:23 + #2 0xffe76b in pdfi_dereference /src/ghostpdl/./pdf/pdf_deref.c:799:31 + #3 0x1010683 in pdfi_get_child /src/ghostpdl/./pdf/pdf_doc.c:282:16 + #4 0x100f4eb in pdfi_get_page_dict /src/ghostpdl/./pdf/pdf_doc.c:468:16 + #5 0xf31bae in pdfi_page_get_dict /src/ghostpdl/./pdf/pdf_page.c:675:12 + #6 0xf3083f in pdfi_page_info /src/ghostpdl/./pdf/pdf_page.c:483:12 + #7 0xe99dca in zPDFpageinfo /src/ghostpdl/./psi/zpdfops.c:957:16 + #8 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #9 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #10 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #11 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #12 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #13 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #14 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #15 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #16 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #17 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #18 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #19 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #20 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #21 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #22 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #23 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #24 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #25 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #26 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #27 0x7f3364c37082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #28 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x61500000ce83 is located 259 bytes inside of 464-byte region [0x61500000cd80,0x61500000cf50) +freed by thread T0 here: + #0 0x524bc2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:111:3 + #1 0x8e6e4b in gs_heap_free_object /src/ghostpdl/./base/gsmalloc.c:366:5 + #2 0x12b2617 in alloc_free_clump /src/ghostpdl/./base/gsalloc.c:2639:9 + #3 0x12b2617 in i_free_object /src/ghostpdl/./base/gsalloc.c:1559:17 + #4 0xe98387 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:648:9 + #5 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #6 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #7 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #8 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #9 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #10 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #11 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #12 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #13 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #14 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #15 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #16 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #17 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #18 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #19 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #20 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #21 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #22 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #23 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #24 0x7f3364c37082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +previously allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x12bd3b4 in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2488:13 + #3 0x12b4e24 in alloc_obj /src/ghostpdl/./base/gsalloc.c:1952:13 + #4 0x12b4e24 in i_alloc_struct_immovable /src/ghostpdl/./base/gsalloc.c:1258:11 + #5 0x6b9788 in s_alloc_immovable /src/ghostpdl/./base/stream.c:132:17 + #6 0xe9808e in zPDFstream /src/ghostpdl/./psi/zpdfops.c:633:26 + #7 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #8 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #9 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #10 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #11 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #12 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #13 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #14 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #15 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #16 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #17 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #18 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #19 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #20 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #21 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #22 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #23 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #24 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #25 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #26 0x7f3364c37082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/ghostpdl/./base/stream.c:415:24 in stell +Shadow bytes around the buggy address: + 0x0c2a7fff9980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff9990: 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c2a7fff99a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff99b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c2a7fff99c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0c2a7fff99d0:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c2a7fff99e0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa + 0x0c2a7fff99f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff9a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff9a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff9a20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1698.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1698.txt new file mode 100644 index 000000000..d88fee2d6 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1698.txt @@ -0,0 +1,97 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 747266145 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f6814e4b9e0, 0x7f6814e4ef6c), 959 [0x7f6814eaca40, 0x7f6814eacdff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f6814e4ef70,0x7f6814e84830), 959 [0x7f6814eace00,0x7f6814eb09f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000000023 at pc 0x0000006f5e43 bp 0x7ffe282f7520 sp 0x7ffe282f7518 +READ of size 8 at 0x631000000023 thread T0 + #0 0x6f5e42 in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:857:24 + #1 0x6f43b8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #2 0x10063bc in pdfi_object_alloc /src/ghostpdl/./pdf/pdf_obj.c:81:23 + #3 0xed2d00 in pdfi_read_num /src/ghostpdl/./pdf/pdf_int.c + #4 0xed009f in pdfi_read_token /src/ghostpdl/./pdf/pdf_int.c:1025:20 + #5 0x1004b36 in pdfi_repair_file /src/ghostpdl/./pdf/pdf_repair.c:422:52 + #6 0xec6020 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1117:16 + #7 0xeaca4c in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1051:12 + #8 0xeaca4c in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1328:12 + #9 0xe981b4 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:642:12 + #10 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #11 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #12 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #13 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #14 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #15 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #16 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #17 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #18 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #19 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #20 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #21 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #22 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #23 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #24 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #25 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #26 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #27 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #28 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #29 0x7f6814845082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #30 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x631000000023 is located 2013 bytes to the left of 65584-byte region [0x631000000800,0x631000010830) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f546d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #3 0x6f2be8 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x9403ea in gs_fapi_ft_init /src/ghostpdl/./base/fapi_ft.c:1906:26 + #5 0x93e69e in gs_fapi_init /src/ghostpdl/./base/gxfapi.c:2013:16 + #6 0x8db72c in gs_lib_init1 /src/ghostpdl/./base/gsinit.c:59:21 + #7 0x561fbb in gs_main_init1 /src/ghostpdl/./psi/imain.c:201:12 + #8 0x101ab2e in swproc /src/ghostpdl/./psi/imainarg.c:789:29 + #9 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #10 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #11 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #12 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #13 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #14 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #15 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #16 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #17 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #18 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #19 0x7f6814845082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/gsmchunk.c:857:24 in chunk_obj_alloc +Shadow bytes around the buggy address: + 0x0c627fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c627fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c627fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c627fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c627fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c627fff8000: fa fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa + 0x0c627fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c627fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c627fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c627fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c627fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1703.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1703.txt new file mode 100644 index 000000000..8b8481184 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1703.txt @@ -0,0 +1,58 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 749998681 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f79f54ce9e0, 0x7f79f54d1f6c), 959 [0x7f79f552fa40, 0x7f79f552fdff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f79f54d1f70,0x7f79f5507830), 959 [0x7f79f552fe00,0x7f79f55339f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000ebfa23 bp 0x7fff2bb29b70 sp 0x7fff2bb29aa0 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: address points to the zero page. + #0 0xebfa23 in pdfi_array_fetch /src/ghostpdl/./pdf/pdf_array.c:138:14 + #1 0xebfa23 in pdfi_array_get /src/ghostpdl/./pdf/pdf_array.c:164:12 + #2 0x13a9c30 in pdfi_fapi_get_gsubr /src/ghostpdl/./pdf/pdf_fapi.c:693:20 + #3 0x952997 in write_gsubrs_index /src/ghostpdl/./base/write_t2.c:335:22 + #4 0x952997 in gs_fapi_serialize_type2_font /src/ghostpdl/./base/write_t2.c:583:5 + #5 0x942372 in gs_fapi_ft_get_scaled_font /src/ghostpdl/./base/fapi_ft.c:1252:30 + #6 0x930a94 in gs_fapi_prepare_font /src/ghostpdl/./base/gxfapi.c:498:43 + #7 0x93d531 in gs_fapi_passfont /src/ghostpdl/./base/gxfapi.c:1868:13 + #8 0x13a57f5 in pdfi_fapi_passfont /src/ghostpdl/./pdf/pdf_fapi.c:1463:9 + #9 0xf806b2 in pdfi_read_cff_font /src/ghostpdl/./pdf/pdf_font1C.c:2685:20 + #10 0xf60137 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:731:32 + #11 0xf6f616 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:277:16 + #12 0xf5f974 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #13 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #14 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #15 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #16 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #17 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #18 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #19 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #20 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #21 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #22 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #23 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #24 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #25 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #26 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #27 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #28 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #29 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #30 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #31 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #32 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #33 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #34 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #35 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #36 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #37 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #38 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #39 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #40 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #41 0x7f79f4ec8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #42 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_array.c:138:14 in pdfi_array_fetch +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1704.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1704.txt new file mode 100644 index 000000000..aeca08a1d --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1704.txt @@ -0,0 +1,95 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 752832585 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f8c662739e0, 0x7f8c66276f6c), 959 [0x7f8c662d4a40, 0x7f8c662d4dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f8c66276f70,0x7f8c662ac830), 959 [0x7f8c662d4e00,0x7f8c662d89f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f8c6502e520 at pc 0x000000f077e5 bp 0x7ffe91d35af0 sp 0x7ffe91d35ae8 +WRITE of size 4 at 0x7f8c6502e520 thread T0 + #0 0xf077e4 in pdfi_create_iccbased /src/ghostpdl/./pdf/pdf_colour.c:1152:26 + #1 0xefbde6 in pdfi_create_colorspace_by_array /src/ghostpdl/./pdf/pdf_colour.c:2332:16 + #2 0xefc3ca in pdfi_create_colorspace /src/ghostpdl/./pdf/pdf_colour.c:2473:20 + #3 0xefc3ca in pdfi_setcolorspace /src/ghostpdl/./pdf/pdf_colour.c:2488:12 + #4 0xfcf829 in pdfi_shading_build /src/ghostpdl/./pdf/pdf_shading.c:667:12 + #5 0xfd375c in pdfi_shading /src/ghostpdl/./pdf/pdf_shading.c:897:12 + #6 0xedc278 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1619:24 + #7 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #8 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #9 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #10 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #11 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #12 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #13 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #14 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #15 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #16 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #17 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #18 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #19 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #20 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #21 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #22 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #23 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #24 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #25 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #26 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #27 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #28 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #29 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #30 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #31 0x7f8c65c6d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #32 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +Address 0x7f8c6502e520 is located in stack of thread T0 at offset 288 in frame + #0 0xf05d3f in pdfi_create_iccbased /src/ghostpdl/./pdf/pdf_colour.c:1082 + + This frame has 13 object(s): + [32, 40) 'profile_stream.i' (line 1046) + [64, 72) 'profile_buffer.i' (line 1047) + [96, 104) 'ICC_obj' (line 1083) + [128, 136) 'dict' (line 1084) + [160, 168) 'a' (line 1085) + [192, 200) 'N' (line 1086) + [224, 232) 'Name' (line 1087) + [256, 288) 'range' (line 1091) <== Memory access at offset 288 overflows this variable + [320, 324) 'icc_N' (line 1092) + [336, 344) 'pcs' (line 1093) + [368, 376) 'dbl' (line 1125) + [400, 664) 'cc' (line 1175) + [736, 744) 'Alternate' (line 1192) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ghostpdl/./pdf/pdf_colour.c:1152:26 in pdfi_create_iccbased +Shadow bytes around the buggy address: + 0x0ff20c9fdc50: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff20c9fdc60: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff20c9fdc70: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff20c9fdc80: f1 f1 f1 f1 f8 f2 f2 f2 f8 f2 f2 f2 00 f2 f2 f2 + 0x0ff20c9fdc90: 00 f2 f2 f2 00 f2 f2 f2 00 f2 f2 f2 00 f2 f2 f2 +=>0x0ff20c9fdca0: 00 00 00 00[f2]f2 f2 f2 04 f2 00 f2 f2 f2 f8 f2 + 0x0ff20c9fdcb0: f2 f2 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 + 0x0ff20c9fdcc0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 + 0x0ff20c9fdcd0: f8 f8 f8 f2 f2 f2 f2 f2 f2 f2 f2 f2 f8 f3 f3 f3 + 0x0ff20c9fdce0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff20c9fdcf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1706.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1706.txt new file mode 100644 index 000000000..6e4de508e --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1706.txt @@ -0,0 +1,47 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 755590065 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7fc2b21fa9e0, 0x7fc2b21fdf6c), 959 [0x7fc2b225ba40, 0x7fc2b225bdff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7fc2b21fdf70,0x7fc2b2233830), 959 [0x7fc2b225be00,0x7fc2b225f9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x0000010b8eb2 bp 0x7fffbd1e8430 sp 0x7fffbd1e8400 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x10b8eb2 in gx_adjust_color_Pattern /src/ghostpdl/./base/gspcolor.c:307:5 + #1 0x10b3a62 in gs_setcolor /src/ghostpdl/./base/gscolor2.c:103:5 + #2 0xef7013 in pdfi_setfillcolor /src/ghostpdl/./pdf/pdf_colour.c:731:16 + #3 0xedc8fe in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1607:24 + #4 0xedda8e in split_bogus_operator /src/ghostpdl/./pdf/pdf_int.c:1359:12 + #5 0xedbc6b in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1392:16 + #6 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #7 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #8 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #9 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #10 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #11 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #12 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #13 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #14 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #15 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #16 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #17 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #18 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #19 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #20 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #21 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #22 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #23 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #24 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #25 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #26 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #27 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #28 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #29 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #30 0x7fc2b1bf4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #31 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gspcolor.c:307:5 in gx_adjust_color_Pattern +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1707.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1707.txt new file mode 100644 index 000000000..3416a5d51 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1707.txt @@ -0,0 +1,60 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 760931950 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7fd0023389e0, 0x7fd00233bf6c), 959 [0x7fd002399a40, 0x7fd002399dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7fd00233bf70,0x7fd002371830), 959 [0x7fd002399e00,0x7fd00239d9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: negative-size-param: (size=-1) + #0 0x4be84f in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xfb9a5d in general_endcidrange_func /src/ghostpdl/./pdf/pdf_cmap.c:205:17 + #2 0xfb699f in cmap_endcidrange_func /src/ghostpdl/./pdf/pdf_cmap.c:227:12 + #3 0xf96dd0 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:363:36 + #4 0xfb19a7 in pdfi_read_cmap /src/ghostpdl/./pdf/pdf_cmap.c:810:12 + #5 0xf6f304 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:260:20 + #6 0xf5f974 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #7 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #8 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #9 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #10 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #11 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #12 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #13 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #14 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #15 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #16 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #24 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #25 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #26 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #27 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #30 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7fd001d32082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x62d0000156ee is located 4846 bytes inside of 32880-byte region [0x62d000014400,0x62d00001c470) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f2be8 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #5 0x6f44ef in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0x6f44ef in chunk_alloc_byte_array_immovable /src/ghostpdl/./base/gsmchunk.c:1003:12 + #7 0x703b90 in s_zlib_alloc /src/ghostpdl/./base/szlibc.c:88:9 + #8 0x7fd0020a9708 in inflate (/lib/x86_64-linux-gnu/libz.so.1+0xa708) + +SUMMARY: AddressSanitizer: negative-size-param /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1709.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1709.txt new file mode 100644 index 000000000..ea93bb9a3 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1709.txt @@ -0,0 +1,111 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 763792338 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f483160d9e0, 0x7f4831610f6c), 959 [0x7f483166ea40, 0x7f483166edff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f4831610f70,0x7f4831646830), 959 [0x7f483166ee00,0x7f48316729f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f4830413934 at pc 0x0000004bea81 bp 0x7fffba094770 sp 0x7fffba093f30 +WRITE of size 121 at 0x7f4830413934 thread T0 + #0 0x4bea80 in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xf228a6 in pdfi_image_get_color /src/ghostpdl/./pdf/pdf_image.c:1431:13 + #2 0xf228a6 in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:1698:12 + #3 0xf2739e in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2485:16 + #4 0xf27c9f in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2571:12 + #5 0xedcab8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1472:24 + #6 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #7 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #8 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #9 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #10 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #11 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #12 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #13 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #14 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #15 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #16 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #17 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #18 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #19 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #20 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #21 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #22 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #23 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #24 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #25 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #26 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #27 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #28 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #29 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #30 0x7f4831007082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #31 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +Address 0x7f4830413934 is located in stack of thread T0 at offset 4404 in frame + #0 0xf209cf in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:1574 + + This frame has 30 object(s): + [32, 40) 'ColorSpace.i' (line 1307) + [64, 68) 'dummy.i' (line 1334) + [80, 4176) 'extra_info.i' (line 1389) + [4304, 4404) 'str.i' (line 1430) + [4448, 4456) 'item.i' (line 170) <== Memory access at offset 4404 partially underflows this variable + [4480, 4488) 'alt_stream.i' (line 171) <== Memory access at offset 4404 partially underflows this variable + [4512, 4516) 'flag.i' (line 174) <== Memory access at offset 4404 partially underflows this variable + [4528, 4532) 'known.i' (line 654) + [4544, 4552) 'new_stream' (line 1575) + [4576, 4584) 'SFD_stream' (line 1575) + [4608, 4616) 'pcs' (line 1578) + [4640, 5248) 't1image' (line 1579) + [5376, 6496) 't4image' (line 1580) + [6624, 7792) 't3image' (line 1581) + [7920, 10176) 't3ximage' (line 1582) + [10304, 10504) 'image_info' (line 1585) + [10576, 10776) 'mask_info' (line 1585) + [10848, 11048) 'smask_info' (line 1585) + [11120, 11128) 'mask_buffer' (line 1589) + [11152, 11160) 'mask_size' (line 1590) + [11184, 11204) 'trans_state' (line 1597) + [11248, 11256) 'EODString' (line 1601) + [11280, 11288) 'image_dict' (line 1614) + [11312, 11576) 'cc' (line 1727) + [11648, 11656) 'ColorSpace105' (line 1729) + [11680, 11684) 'has_Matte' (line 1792) + [11696, 11720) 'mat4' (line 1970) + [11760, 11784) 'inverseIM' (line 1970) + [11824, 11840) 'pt' (line 1971) + [11856, 11872) 'pt1' (line 1971) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x0fe98607a6d0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 + 0x0fe98607a6e0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 + 0x0fe98607a6f0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 + 0x0fe98607a700: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f2 f2 f2 f2 f2 f2 + 0x0fe98607a710: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 +=>0x0fe98607a720: 00 00 00 00 00 00[04]f2 f2 f2 f2 f2 f8 f2 f2 f2 + 0x0fe98607a730: f8 f2 f2 f2 f8 f2 f8 f2 00 f2 f2 f2 00 f2 f2 f2 + 0x0fe98607a740: 00 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe98607a750: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe98607a760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe98607a770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1711.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1711.txt new file mode 100644 index 000000000..950fd4cd6 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1711.txt @@ -0,0 +1,110 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 766594073 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f09f15a99e0, 0x7f09f15acf6c), 959 [0x7f09f160aa40, 0x7f09f160adff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f09f15acf70,0x7f09f15e2830), 959 [0x7f09f160ae00,0x7f09f160e9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000074850 at pc 0x0000004bea81 bp 0x7ffc221fc1a0 sp 0x7ffc221fb960 +WRITE of size 25360 at 0x631000074850 thread T0 + #0 0x4bea80 in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xfb48cb in cmap_endcodespacerange_func /src/ghostpdl/./pdf/pdf_cmap.c:120:13 + #2 0xf96dd0 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:363:36 + #3 0xfb19a7 in pdfi_read_cmap /src/ghostpdl/./pdf/pdf_cmap.c:810:12 + #4 0xf6f304 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:260:20 + #5 0xf5f974 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #6 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #7 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #8 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #9 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #10 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #11 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #12 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #13 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #14 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #15 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #16 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #17 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #18 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #19 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #20 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #21 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #22 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #23 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #24 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #25 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #26 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #27 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #28 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #29 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #30 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #31 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #32 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #33 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #34 0x7f09f0fa3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #35 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x631000074850 is located 0 bytes to the right of 65616-byte region [0x631000064800,0x631000074850) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f2be8 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f546d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #5 0x6f43b8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0xeb01e7 in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1601:27 + #7 0xe9c794 in zPDFInit /src/ghostpdl/./psi/zpdfops.c:1231:11 + #8 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #9 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #10 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #11 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #12 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #13 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #14 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #15 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #16 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #17 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #18 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #19 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #20 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #21 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #22 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #23 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #24 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #25 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #26 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #27 0x7f09f0fa3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x0c62800068b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800068c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800068d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800068e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800068f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c6280006900: 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa + 0x0c6280006910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1715.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1715.txt new file mode 100644 index 000000000..c4fa579e4 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1715.txt @@ -0,0 +1,56 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 769252040 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7fd55710a9e0, 0x7fd55710df6c), 959 [0x7fd55716ba40, 0x7fd55716bdff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7fd55710df70,0x7fd557143830), 959 [0x7fd55716be00,0x7fd55716f9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x0000006bdc9d bp 0x7fffe03bf8d0 sp 0x7fffe03bf7e0 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x6bdc9d in stream_compact /src/ghostpdl/./base/stream.c:1009:21 + #1 0x6bdc9d in sreadbuf /src/ghostpdl/./base/stream.c:855:13 + #2 0x6bc57c in s_process_read_buf /src/ghostpdl/./base/stream.c:768:14 + #3 0x6bc57c in spgetcc /src/ghostpdl/./base/stream.c:481:9 + #4 0x6bd38d in sgets /src/ghostpdl/./base/stream.c:577:17 + #5 0xee4c09 in pdfi_read_bytes /src/ghostpdl/./pdf/pdf_file.c:1471:16 + #6 0xece2d9 in pdfi_skip_white /src/ghostpdl/./pdf/pdf_int.c:115:17 + #7 0xece2d9 in pdfi_read_token /src/ghostpdl/./pdf/pdf_int.c:1002:5 + #8 0x100147e in pdfi_read_object /src/ghostpdl/./pdf/pdf_deref.c:494:12 + #9 0xfff53b in pdfi_dereference /src/ghostpdl/./pdf/pdf_deref.c:831:20 + #10 0xeb5b8f in pdfi_dict_get_no_store_R_inner /src/ghostpdl/./pdf/pdf_dict.c:420:28 + #11 0xeb5d78 in pdfi_dict_get_no_store_R_key /src/ghostpdl/./pdf/pdf_dict.c:443:12 + #12 0x1011b1f in pdfi_find_resource /src/ghostpdl/./pdf/pdf_doc.c + #13 0xf19019 in pdfi_setgstate /src/ghostpdl/./pdf/pdf_gstate.c:2347:12 + #14 0xedc9d6 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1515:24 + #15 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #16 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #17 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #18 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #19 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #20 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #21 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #22 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #23 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #24 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #25 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #26 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #27 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #28 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #29 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #30 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #31 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #32 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #33 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #34 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #35 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #36 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #37 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #38 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #39 0x7fd556b04082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #40 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/stream.c:1009:21 in stream_compact +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1717.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1717.txt new file mode 100644 index 000000000..fa5a241f1 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1717.txt @@ -0,0 +1,47 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 772370357 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f7ec45149e0, 0x7f7ec4517f6c), 959 [0x7f7ec4575a40, 0x7f7ec4575dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f7ec4517f70,0x7f7ec454d830), 959 [0x7f7ec4575e00,0x7f7ec45799f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x631100081b1f (pc 0x000000f81856 bp 0x7ffd3cf36ea0 sp 0x7ffd3cf36bc0 T0) +==1==The signal is caused by a READ memory access. + #0 0xf81856 in pdfi_read_cff /src/ghostpdl/./pdf/pdf_font1C.c:1643:30 + #1 0xf81856 in pdfi_read_cff_font /src/ghostpdl/./pdf/pdf_font1C.c:2132:20 + #2 0xf60137 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:731:32 + #3 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #4 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #5 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #6 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #7 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #8 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #9 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #10 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #11 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #12 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #13 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #14 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #15 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #16 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #17 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #18 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #19 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #20 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #21 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #22 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #23 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #24 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #25 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #26 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #27 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #28 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #29 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #30 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #31 0x7f7ec3f0e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #32 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_font1C.c:1643:30 in pdfi_read_cff +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1719.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1719.txt new file mode 100644 index 000000000..249ea56d5 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1719.txt @@ -0,0 +1,121 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 775195159 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f4c49a639e0, 0x7f4c49a66f6c), 959 [0x7f4c49ac4a40, 0x7f4c49ac4dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f4c49a66f70,0x7f4c49a9c830), 959 [0x7f4c49ac4e00,0x7f4c49ac89f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6310001148f8 at pc 0x0000006f661f bp 0x7ffd217aba10 sp 0x7ffd217aba08 +WRITE of size 8 at 0x6310001148f8 thread T0 + #0 0x6f661e in insert_free /src/ghostpdl/./base/gsmchunk.c:654:16 + #1 0x6f5c40 in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:930:17 + #2 0x6f43b8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #3 0x839898 in file_prepare_stream /src/ghostpdl/./base/sfxcommon.c:199:14 + #4 0x839162 in file_open_stream /src/ghostpdl/./base/sfxcommon.c:80:12 + #5 0xededbb in pdfi_filter_open /src/ghostpdl/./pdf/pdf_file.c:105:12 + #6 0xee3cb5 in pdfi_apply_SubFileDecode_filter /src/ghostpdl/./pdf/pdf_file.c:1172:12 + #7 0xf2424c in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:1949:16 + #8 0xf2739e in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2485:16 + #9 0xf27c9f in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2571:12 + #10 0xedcab8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1472:24 + #11 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #12 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #13 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #14 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #15 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #16 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #24 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #25 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #26 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #27 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #30 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7f4c4945d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x6310001148f8 is located 168 bytes to the right of 65616-byte region [0x631000104800,0x631000114850) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f2be8 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f546d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #5 0x6f43b8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0x10067a6 in pdfi_object_alloc /src/ghostpdl/./pdf/pdf_obj.c:104:41 + #7 0xed6fe7 in pdfi_name_alloc /src/ghostpdl/./pdf/pdf_int.c:1124:12 + #8 0xf99384 in pdf_ps_RD_oper_func /src/ghostpdl/./pdf/pdf_fontps.c:1136:24 + #9 0xf96dd0 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:363:36 + #10 0xf9871b in pdfi_read_ps_font /src/ghostpdl/./pdf/pdf_fontps.c:1234:12 + #11 0xf742d7 in pdfi_read_type1_font /src/ghostpdl/./pdf/pdf_font1.c:538:16 + #12 0xf6019b in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:727:32 + #13 0xf6d457 in pdfi_load_font_by_name_string /src/ghostpdl/./pdf/pdf_font.c:1706:12 + #14 0xf6a002 in pdfi_font_set_internal_inner /src/ghostpdl/./pdf/pdf_font.c:1793:12 + #15 0xf6a002 in pdfi_font_set_internal_name /src/ghostpdl/./pdf/pdf_font.c:1814:16 + #16 0xf69d0b in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1314:16 + #17 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #18 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #19 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #20 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #21 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #22 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #23 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #24 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #25 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #26 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #27 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #28 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #29 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #30 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #31 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #32 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #33 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #34 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #35 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #36 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #37 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/gsmchunk.c:654:16 in insert_free +Shadow bytes around the buggy address: + 0x0c628001a8c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001a8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001a8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001a8f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001a900: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa +=>0x0c628001a910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa] + 0x0c628001a920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001a930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001a940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001a950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001a960: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1723.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1723.txt new file mode 100644 index 000000000..0d9d6824f --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1723.txt @@ -0,0 +1,84 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 778345385 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f07616cf9e0, 0x7f07616d2f6c), 959 [0x7f0761730a40, 0x7f0761730dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f07616d2f70,0x7f0761708830), 959 [0x7f0761730e00,0x7f07617349f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0000019a90f1 at pc 0x0000004bec26 bp 0x7fffa3881900 sp 0x7fffa38810a8 +READ of size 20 at 0x0000019a90f1 thread T0 + #0 0x4bec25 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:860:7 + #1 0x4bf11b in memcmp /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:892:10 + #2 0xf9bfd4 in ps_font_def_func /src/ghostpdl/./pdf/pdf_fontps.c:696:19 + #3 0xf96dd0 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:363:36 + #4 0xf9871b in pdfi_read_ps_font /src/ghostpdl/./pdf/pdf_fontps.c:1234:12 + #5 0xf742d7 in pdfi_read_type1_font /src/ghostpdl/./pdf/pdf_font1.c:538:16 + #6 0xf6019b in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:727:32 + #7 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #8 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #9 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #10 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #11 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #12 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #13 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #14 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #15 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #16 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #24 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #25 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #26 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #27 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #30 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7f07610c9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x0000019a90f1 is located 47 bytes to the left of global variable '' defined in './pdf/pdf_fontps.c:1117:25' (0x19a9120) of size 33 + '' is ascii string 'pdf_ps_RD_oper_func(subr string)' +0x0000019a90f1 is located 0 bytes to the right of global variable '' defined in './pdf/pdf_fontps.c:1220:6' (0x19a90e0) of size 17 + '' is ascii string 'StandardEncoding' +SUMMARY: AddressSanitizer: global-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:860:7 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) +Shadow bytes around the buggy address: + 0x00008032d1c0: f9 f9 f9 f9 03 f9 f9 f9 03 f9 f9 f9 02 f9 f9 f9 + 0x00008032d1d0: 00 05 f9 f9 05 f9 f9 f9 06 f9 f9 f9 04 f9 f9 f9 + 0x00008032d1e0: 04 f9 f9 f9 04 f9 f9 f9 04 f9 f9 f9 00 07 f9 f9 + 0x00008032d1f0: 00 03 f9 f9 00 01 f9 f9 05 f9 f9 f9 06 f9 f9 f9 + 0x00008032d200: 06 f9 f9 f9 06 f9 f9 f9 06 f9 f9 f9 03 f9 f9 f9 +=>0x00008032d210: 07 f9 f9 f9 04 f9 f9 f9 04 f9 f9 f9 00 00[01]f9 + 0x00008032d220: f9 f9 f9 f9 00 00 00 00 01 f9 f9 f9 f9 f9 f9 f9 + 0x00008032d230: 00 01 f9 f9 00 04 f9 f9 00 01 f9 f9 00 02 f9 f9 + 0x00008032d240: 00 04 f9 f9 06 f9 f9 f9 06 f9 f9 f9 00 01 f9 f9 + 0x00008032d250: 05 f9 f9 f9 00 00 00 04 f9 f9 f9 f9 00 00 00 00 + 0x00008032d260: f9 f9 f9 f9 00 01 f9 f9 00 00 00 00 f9 f9 f9 f9 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1724.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1724.txt new file mode 100644 index 000000000..17856e627 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1724.txt @@ -0,0 +1,49 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 781095747 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f0c72df79e0, 0x7f0c72dfaf6c), 959 [0x7f0c72e58a40, 0x7f0c72e58dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f0c72dfaf70,0x7f0c72e30830), 959 [0x7f0c72e58e00,0x7f0c72e5c9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: unknown-crash on address 0x3470203662342872 at pc 0x0000004be93e bp 0x7ffc9267ece0 sp 0x7ffc9267e4a0 +READ of size 1920286312 at 0x3470203662342872 thread T0 + #0 0x4be93d in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xfb48cb in cmap_endcodespacerange_func /src/ghostpdl/./pdf/pdf_cmap.c:120:13 + #2 0xf96dd0 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:363:36 + #3 0xfb19a7 in pdfi_read_cmap /src/ghostpdl/./pdf/pdf_cmap.c:810:12 + #4 0xfa9086 in pdfi_read_truetype_font /src/ghostpdl/./pdf/pdf_fontTT.c:459:20 + #5 0xf6028c in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:739:40 + #6 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #7 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #8 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #9 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #10 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #11 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #12 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #13 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #14 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #15 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #16 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #17 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #18 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #19 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #20 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #21 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #22 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #23 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #24 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #25 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #26 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #27 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #28 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #29 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #30 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #31 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #32 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #33 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #34 0x7f0c727f1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #35 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +Address 0x3470203662342872 is a wild pointer inside of access range of size 0x000072753e68. +SUMMARY: AddressSanitizer: unknown-crash /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1731.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1731.txt new file mode 100644 index 000000000..f42dbdc0c --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1731.txt @@ -0,0 +1,108 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 783789462 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f43646809e0, 0x7f4364683f6c), 959 [0x7f43646e1a40, 0x7f43646e1dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f4364683f70,0x7f43646b9830), 959 [0x7f43646e1e00,0x7f43646e59f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges [0x6310000008a8,0x6311121e08a8) and [0x631000086680, 0x631112266680) overlap + #0 0x4be7af in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0x9375f5 in recreate_multiple_master /src/ghostpdl/./base/gxfapi.c:297:13 + #2 0x9375f5 in gs_fapi_do_char /src/ghostpdl/./base/gxfapi.c:1312:9 + #3 0x13a5e0d in pdfi_fapi_build_char /src/ghostpdl/./pdf/pdf_fapi.c:1386:12 + #4 0xa8e026 in show_proceed /src/ghostpdl/./base/gxchar.c:1239:12 + #5 0xa859e0 in continue_show /src/ghostpdl/./base/gxchar.c:761:12 + #6 0xa87ecc in gx_show_text_process /src/ghostpdl/./base/gxchar.c:738:12 + #7 0x921dcf in gs_text_process /src/ghostpdl/./base/gstext.c:696:12 + #8 0xfcd032 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:516:16 + #9 0xfcd032 in pdfi_show_Tr_0 /src/ghostpdl/./pdf/pdf_text.c:531:12 + #10 0xfc75a2 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:913:24 + #11 0xfc9021 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1131:12 + #12 0xedcc33 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1643:24 + #13 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #14 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #15 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #16 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #17 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #18 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #19 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #20 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #21 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #22 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #23 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #24 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #25 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #26 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #27 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #28 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #29 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #30 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #31 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #32 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #33 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #34 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #35 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #36 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #37 0x7f436407a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #38 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x631000010830 is located 0 bytes to the right of 65584-byte region [0x631000000800,0x631000010830) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f546d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #3 0x6f2be8 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x9403ea in gs_fapi_ft_init /src/ghostpdl/./base/fapi_ft.c:1906:26 + #5 0x93e69e in gs_fapi_init /src/ghostpdl/./base/gxfapi.c:2013:16 + #6 0x8db72c in gs_lib_init1 /src/ghostpdl/./base/gsinit.c:59:21 + #7 0x561fbb in gs_main_init1 /src/ghostpdl/./psi/imain.c:201:12 + #8 0x101ab2e in swproc /src/ghostpdl/./psi/imainarg.c:789:29 + #9 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #10 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #11 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #12 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #13 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #14 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #15 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #16 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #17 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #18 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #19 0x7f436407a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +0x631000088850 is located 0 bytes to the right of 65616-byte region [0x631000078800,0x631000088850) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f2be8 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f546d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #5 0x6f453c in chunk_alloc_struct_array /src/ghostpdl/./base/gsmchunk.c:1024:12 + #6 0x1375e4a in gx_char_cache_alloc /src/ghostpdl/./base/gxccman.c:88:13 + #7 0x12c7179 in gs_font_dir_alloc2_limits /src/ghostpdl/./base/gsfont.c:263:12 + #8 0x12c7020 in gs_font_dir_alloc2 /src/ghostpdl/./base/gsfont.c:236:16 + #9 0xf6cf60 in pdfi_init_font_directory /src/ghostpdl/./pdf/pdf_font.c:1662:21 + #10 0xeb03e9 in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1637:12 + #11 0xe9c794 in zPDFInit /src/ghostpdl/./psi/zpdfops.c:1231:11 + #12 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #13 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #14 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #15 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #16 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #17 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #18 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #19 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #20 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #21 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #22 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #23 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #24 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #25 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #26 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #27 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #28 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #29 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #30 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #31 0x7f436407a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: memcpy-param-overlap /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1740.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1740.txt new file mode 100644 index 000000000..89afa4b45 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1740.txt @@ -0,0 +1,81 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 787131058 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f20cd3d29e0, 0x7f20cd3d5f6c), 959 [0x7f20cd433a40, 0x7f20cd433dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f20cd3d5f70,0x7f20cd40b830), 959 [0x7f20cd433e00,0x7f20cd4379f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f20cc170984 at pc 0x0000004bea81 bp 0x7ffd7ee64470 sp 0x7ffd7ee63c30 +WRITE of size 2448 at 0x7f20cc170984 thread T0 + #0 0x4bea80 in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xf4f845 in pdfi_annot_draw_LE_one /src/ghostpdl/./pdf/pdf_annot.c:1449:9 + #2 0xf4f270 in pdfi_annot_draw_LE /src/ghostpdl/./pdf/pdf_annot.c:1508:16 + #3 0xf3dfb6 in pdfi_annot_draw_Line /src/ghostpdl/./pdf/pdf_annot.c:3025:12 + #4 0xf5670f in pdfi_annot_draw /src/ghostpdl/./pdf/pdf_annot.c:3876:24 + #5 0xf489cb in pdfi_annot_handle /src/ghostpdl/./pdf/pdf_annot.c + #6 0xf489cb in pdfi_do_annotations /src/ghostpdl/./pdf/pdf_annot.c:4351:16 + #7 0xf3721e in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:167:13 + #8 0xf3721e in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #9 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #10 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #11 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #12 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #13 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #14 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #15 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #16 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #17 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #18 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #19 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #20 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #21 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #22 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #23 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #24 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #25 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #26 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #27 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #28 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #29 0x7f20ccdcc082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #30 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +Address 0x7f20cc170984 is located in stack of thread T0 at offset 132 in frame + #0 0xf4f55f in pdfi_annot_draw_LE_one /src/ghostpdl/./pdf/pdf_annot.c:1428 + + This frame has 1 object(s): + [32, 132) 'str' (line 1448) <== Memory access at offset 132 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x0fe4998260e0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe4998260f0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe499826100: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe499826110: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe499826120: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fe499826130:[04]f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 + 0x0fe499826140: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe499826150: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe499826160: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe499826170: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe499826180: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1741.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1741.txt new file mode 100644 index 000000000..5333f56ca --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1741.txt @@ -0,0 +1,87 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1147509162 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f7d6fcf79e0, 0x7f7d6fcfaf6c), 959 [0x7f7d6fd58a40, 0x7f7d6fd58dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f7d6fcfaf70,0x7f7d6fd30830), 959 [0x7f7d6fd58e00,0x7f7d6fd5c9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f7d6ea864c8 at pc 0x000000ba65b8 bp 0x7fff59851a50 sp 0x7fff59851a48 +WRITE of size 4 at 0x7f7d6ea864c8 thread T0 + #0 0xba65b7 in line_join_points /src/ghostpdl/./base/gxstroke.c:2439:9 + #1 0xb9e6e8 in stroke_add_compat /src/ghostpdl/./base/gxstroke.c:2271:20 + #2 0xb96159 in gx_stroke_path_only_aux /src/ghostpdl/./base/gxstroke.c:1002:24 + #3 0xb96159 in gx_stroke_path_only /src/ghostpdl/./base/gxstroke.c:1090:12 + #4 0xb91eec in gx_default_stroke_path /src/ghostpdl/./base/gxstroke.c:347:20 + #5 0x6e3897 in clist_stroke_path /src/ghostpdl/./base/gxclpath.c:1256:20 + #6 0xb70036 in gx_stroke_fill /src/ghostpdl/./base/gxpaint.c:71:12 + #7 0x8fe433 in do_stroke /src/ghostpdl/./base/gspaint.c:519:16 + #8 0x8fe433 in gs_stroke /src/ghostpdl/./base/gspaint.c:555:16 + #9 0xeee818 in pdfi_stroke /src/ghostpdl/./pdf/pdf_path.c:182:16 + #10 0xedc5ee in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1599:24 + #11 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #12 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #13 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #14 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #15 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #16 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #24 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #25 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #26 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #27 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #30 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7f7d6f6f1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +Address 0x7f7d6ea864c8 is located in stack of thread T0 at offset 72 in frame + #0 0xb9d3ef in stroke_add_compat /src/ghostpdl/./base/gxstroke.c:2207 + + This frame has 1 object(s): + [32, 72) 'points' (line 2212) <== Memory access at offset 72 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ghostpdl/./base/gxstroke.c:2439:9 in line_join_points +Shadow bytes around the buggy address: + 0x0ff02dd48c40: f1 f1 f1 f1 00 00 04 f3 f3 f3 f3 f3 00 00 00 00 + 0x0ff02dd48c50: f1 f1 f1 f1 00 f2 f2 f2 00 f3 f3 f3 00 00 00 00 + 0x0ff02dd48c60: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff02dd48c70: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff02dd48c80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0ff02dd48c90: f1 f1 f1 f1 00 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 + 0x0ff02dd48ca0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff02dd48cb0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff02dd48cc0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff02dd48cd0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff02dd48ce0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1743.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1743.txt new file mode 100644 index 000000000..d69a477fb --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1743.txt @@ -0,0 +1,86 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 789963825 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7fa6607679e0, 0x7fa66076af6c), 959 [0x7fa6607c8a40, 0x7fa6607c8dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7fa66076af70,0x7fa6607a0830), 959 [0x7fa6607c8e00,0x7fa6607cc9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fa65f553840 at pc 0x00000050f474 bp 0x7ffce878e1b0 sp 0x7ffce878d940 +WRITE of size 16134 at 0x7fa65f553840 thread T0 + #0 0x50f473 in strncat /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:399:5 + #1 0xfb2b23 in pdf_cmap_open_file /src/ghostpdl/./pdf/pdf_cmap.c:642:5 + #2 0xfb132a in pdfi_read_cmap /src/ghostpdl/./pdf/pdf_cmap.c:746:16 + #3 0xf6e973 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:197:16 + #4 0xf5f974 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #5 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #6 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #7 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #8 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #9 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #10 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #11 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #12 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #13 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #14 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #15 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #16 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #17 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #18 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #19 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #20 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #21 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #22 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #23 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #24 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #25 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #26 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #27 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #28 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #29 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #30 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #31 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #32 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #33 0x7fa660161082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #34 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +Address 0x7fa65f553840 is located in stack of thread T0 at offset 4160 in frame + #0 0xfb29af in pdf_cmap_open_file /src/ghostpdl/./pdf/pdf_cmap.c:634 + + This frame has 2 object(s): + [32, 40) 's' (line 636) + [64, 4160) 'fname' (line 637) <== Memory access at offset 4160 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:399:5 in strncat +Shadow bytes around the buggy address: + 0x0ff54bea26b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff54bea26c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff54bea26d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff54bea26e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff54bea26f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0ff54bea2700: 00 00 00 00 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 f3 + 0x0ff54bea2710: f3 f3 f3 f3 f3 f3 f3 f3 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff54bea2720: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff54bea2730: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff54bea2740: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff54bea2750: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1752.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1752.txt new file mode 100644 index 000000000..f18c177a3 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1752.txt @@ -0,0 +1,118 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 793337970 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7fe0227289e0, 0x7fe02272bf6c), 959 [0x7fe022789a40, 0x7fe022789dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7fe02272bf70,0x7fe022761830), 959 [0x7fe022789e00,0x7fe02278d9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000088850 at pc 0x000000d2be9b bp 0x7ffe9a18af60 sp 0x7ffe9a18af58 +READ of size 1 at 0x631000088850 thread T0 + #0 0xd2be9a in s_hex_process /src/ghostpdl/./base/sstring.c:416:33 + #1 0xc9a208 in s_exD_process /src/ghostpdl/./base/seexec.c:168:18 + #2 0x6bdbb7 in sreadbuf /src/ghostpdl/./base/stream.c:842:22 + #3 0x6bc57c in s_process_read_buf /src/ghostpdl/./base/stream.c:768:14 + #4 0x6bc57c in spgetcc /src/ghostpdl/./base/stream.c:481:9 + #5 0xfa2b54 in ps_font_eexec_func /src/ghostpdl/./pdf/pdf_fontps.c:969:13 + #6 0xf96dd0 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:363:36 + #7 0xf9871b in pdfi_read_ps_font /src/ghostpdl/./pdf/pdf_fontps.c:1234:12 + #8 0xf742d7 in pdfi_read_type1_font /src/ghostpdl/./pdf/pdf_font1.c:538:16 + #9 0xf6019b in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:727:32 + #10 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #11 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #12 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #13 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #14 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #15 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #16 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #17 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #18 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #19 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #20 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #21 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #22 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #23 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #24 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #25 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #26 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #27 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #28 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #29 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #30 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #31 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #32 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #33 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #34 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #35 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #36 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #37 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #38 0x7fe022122082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #39 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x631000088850 is located 0 bytes to the right of 65616-byte region [0x631000078800,0x631000088850) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f2be8 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f546d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #5 0x6f453c in chunk_alloc_struct_array /src/ghostpdl/./base/gsmchunk.c:1024:12 + #6 0x1375e4a in gx_char_cache_alloc /src/ghostpdl/./base/gxccman.c:88:13 + #7 0x12c7179 in gs_font_dir_alloc2_limits /src/ghostpdl/./base/gsfont.c:263:12 + #8 0x12c7020 in gs_font_dir_alloc2 /src/ghostpdl/./base/gsfont.c:236:16 + #9 0xf6cf60 in pdfi_init_font_directory /src/ghostpdl/./pdf/pdf_font.c:1662:21 + #10 0xeb03e9 in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1637:12 + #11 0xe9c794 in zPDFInit /src/ghostpdl/./psi/zpdfops.c:1231:11 + #12 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #13 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #14 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #15 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #16 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #17 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #18 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #19 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #20 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #21 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #22 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #23 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #24 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #25 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #26 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #27 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #28 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #29 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #30 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #31 0x7fe022122082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/sstring.c:416:33 in s_hex_process +Shadow bytes around the buggy address: + 0x0c62800090b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800090c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800090d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800090e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800090f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c6280009100: 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa + 0x0c6280009110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1753.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1753.txt new file mode 100644 index 000000000..778c64849 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1753.txt @@ -0,0 +1,54 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 796190150 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f97061509e0, 0x7f9706153f6c), 959 [0x7f97061b1a40, 0x7f97061b1dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f9706153f70,0x7f9706189830), 959 [0x7f97061b1e00,0x7f97061b59f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000001000 (pc 0x000000df7c9c bp 0x7ffe93ac9670 sp 0x7ffe93ac9640 T0) +==1==The signal is caused by a READ memory access. + #0 0xdf7c9c in names_string_ref /src/ghostpdl/./psi/iname.c:248:34 + #1 0xd78282 in zfont_glyph_name /src/ghostpdl/./psi/zbfont.c:141:5 + #2 0x13ad450 in pdfi_fapi_get_glyphname_or_cid /src/ghostpdl/./pdf/pdf_fapi.c:1094:16 + #3 0x938880 in gs_fapi_do_char /src/ghostpdl/./base/gxfapi.c:1448:14 + #4 0x13a5e0d in pdfi_fapi_build_char /src/ghostpdl/./pdf/pdf_fapi.c:1386:12 + #5 0xa8e026 in show_proceed /src/ghostpdl/./base/gxchar.c:1239:12 + #6 0xa859e0 in continue_show /src/ghostpdl/./base/gxchar.c:761:12 + #7 0xa87ecc in gx_show_text_process /src/ghostpdl/./base/gxchar.c:738:12 + #8 0x921dcf in gs_text_process /src/ghostpdl/./base/gstext.c:696:12 + #9 0xfcd032 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:516:16 + #10 0xfcd032 in pdfi_show_Tr_0 /src/ghostpdl/./pdf/pdf_text.c:531:12 + #11 0xfc75a2 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:913:24 + #12 0xfc9021 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1131:12 + #13 0xedcc33 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1643:24 + #14 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #15 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #16 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #17 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #18 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #19 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #20 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #21 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #22 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #23 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #24 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #25 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #26 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #27 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #28 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #29 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #30 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #31 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #32 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #33 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #34 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #35 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #36 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #37 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #38 0x7f9705b4a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #39 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./psi/iname.c:248:34 in names_string_ref +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1754.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1754.txt new file mode 100644 index 000000000..2893cf624 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1754.txt @@ -0,0 +1,51 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 799515754 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f5948ff59e0, 0x7f5948ff8f6c), 959 [0x7f5949056a40, 0x7f5949056dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f5948ff8f70,0x7f594902e830), 959 [0x7f5949056e00,0x7f594905a9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000330120 (pc 0x0000006f6939 bp 0x7ffc89b4cf10 sp 0x7ffc89b4ceb0 T0) +==1==The signal is caused by a READ memory access. + #0 0x6f6939 in CMP_SIZE /src/ghostpdl/./base/gsmchunk.c + #1 0x6f6939 in insert_free_size /src/ghostpdl/./base/gsmchunk.c:441:13 + #2 0x6f3c20 in chunk_free_object /src/ghostpdl/./base/gsmchunk.c:1301:9 + #3 0xf94511 in pdfi_pscript_stack_finit /src/ghostpdl/./pdf/pdf_fontps.c:70:5 + #4 0xfb19b2 in pdfi_read_cmap /src/ghostpdl/./pdf/pdf_cmap.c:811:5 + #5 0xf6e973 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:197:16 + #6 0xf5f974 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #7 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #8 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #9 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #10 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #11 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #12 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #13 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #14 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #15 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #16 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #24 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #25 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #26 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #27 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #30 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7f59489ef082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gsmchunk.c in CMP_SIZE +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1763.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1763.txt new file mode 100644 index 000000000..81bed7db4 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1763.txt @@ -0,0 +1,88 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 802267133 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f03b34ca9e0, 0x7f03b34cdf6c), 959 [0x7f03b352ba40, 0x7f03b352bdff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f03b34cdf70,0x7f03b3503830), 959 [0x7f03b352be00,0x7f03b352f9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f03b2280f84 at pc 0x0000004bea81 bp 0x7ffc22018810 sp 0x7ffc22017fd0 +WRITE of size 122 at 0x7f03b2280f84 thread T0 + #0 0x4bea80 in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xfe3cab in pdfi_oc_is_ocg_visible /src/ghostpdl/./pdf/pdf_optcontent.c:305:9 + #2 0xfe6d74 in pdfi_op_BDC /src/ghostpdl/./pdf/pdf_optcontent.c:620:22 + #3 0xedc9a6 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1428:24 + #4 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #5 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #6 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #7 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #8 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #9 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #10 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #11 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #12 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #13 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #14 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #15 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #16 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #17 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #18 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #19 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #20 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #21 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #22 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #23 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #24 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #25 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #26 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #27 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #28 0x7f03b2ec4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #29 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +Address 0x7f03b2280f84 is located in stack of thread T0 at offset 388 in frame + #0 0xfe367f in pdfi_oc_is_ocg_visible /src/ghostpdl/./pdf/pdf_optcontent.c:286 + + This frame has 9 object(s): + [32, 40) 'Usage.i' (line 99) + [64, 72) 'dict.i' (line 100) + [96, 104) 'name.i' (line 101) + [128, 136) 'val.i.i' (line 150) + [160, 168) 'VE.i' (line 221) + [192, 200) 'obj.i' (line 222) + [224, 232) 'Pname.i' (line 223) + [256, 264) 'type' (line 287) + [288, 388) 'str' (line 304) <== Memory access at offset 388 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x0fe0f64481a0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe0f64481b0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe0f64481c0: f1 f1 f1 f1 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 + 0x0fe0f64481d0: f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 + 0x0fe0f64481e0: 00 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fe0f64481f0:[04]f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 + 0x0fe0f6448200: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe0f6448210: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe0f6448220: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe0f6448230: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe0f6448240: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1764.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1764.txt new file mode 100644 index 000000000..d89cd8d37 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1764.txt @@ -0,0 +1,42 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 805125859 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f959fe5c9e0, 0x7f959fe5ff6c), 959 [0x7f959febda40, 0x7f959febddff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f959fe5ff70,0x7f959fe95830), 959 [0x7f959febde00,0x7f959fec19f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x63380006a598 (pc 0x000000ecd3e0 bp 0x7ffd2b132310 sp 0x7ffd2b132240 T0) +==1==The signal is caused by a READ memory access. + #0 0xecd3e0 in read_xref_stream_entries /src/ghostpdl/./pdf/pdf_xref.c:108:20 + #1 0xecbbc5 in pdfi_process_xref_stream /src/ghostpdl/./pdf/pdf_xref.c:353:20 + #2 0xec90f4 in pdfi_read_xref_stream_dict /src/ghostpdl/./pdf/pdf_xref.c:502:32 + #3 0xec57d3 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1038:20 + #4 0xeaca4c in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1051:12 + #5 0xeaca4c in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1328:12 + #6 0xe981b4 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:642:12 + #7 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #8 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #9 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #10 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #11 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #12 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #13 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #14 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #15 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #16 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #17 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #18 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #19 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #20 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #21 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #22 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #23 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #24 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #25 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #26 0x7f959f856082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #27 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_xref.c:108:20 in read_xref_stream_entries +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1767.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1767.txt new file mode 100644 index 000000000..ff0849de2 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1767.txt @@ -0,0 +1,84 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 807815064 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7fccb5ebd9e0, 0x7fccb5ec0f6c), 959 [0x7fccb5f1ea40, 0x7fccb5f1edff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7fccb5ec0f70,0x7fccb5ef6830), 959 [0x7fccb5f1ee00,0x7fccb5f229f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000001625000 at pc 0x000000eb4912 bp 0x7ffd7cf3ba60 sp 0x7ffd7cf3ba58 +READ of size 8 at 0x000001625000 thread T0 + #0 0xeb4911 in pdfi_dict_get /src/ghostpdl/./pdf/pdf_dict.c:247:25 + #1 0xeb686e in pdfi_dict_get_type /src/ghostpdl/./pdf/pdf_dict.c:462:12 + #2 0xeb686e in pdfi_dict_get_int /src/ghostpdl/./pdf/pdf_dict.c:492:12 + #3 0xffcd88 in pdfi_read_stream_object /src/ghostpdl/./pdf/pdf_deref.c:255:12 + #4 0xffcd88 in pdfi_read_bare_object /src/ghostpdl/./pdf/pdf_deref.c:439:16 + #5 0x1001792 in pdfi_read_object /src/ghostpdl/./pdf/pdf_deref.c:534:12 + #6 0xfff53b in pdfi_dereference /src/ghostpdl/./pdf/pdf_deref.c:831:20 + #7 0xebd221 in pdfi_dict_next /src/ghostpdl/./pdf/pdf_dict.c:1067:20 + #8 0xfecf90 in pdfi_check_XObject_dict /src/ghostpdl/./pdf/pdf_check.c:457:24 + #9 0xfecf90 in pdfi_check_Resources /src/ghostpdl/./pdf/pdf_check.c:897:15 + #10 0xfee3fc in pdfi_check_Font /src/ghostpdl/./pdf/pdf_check.c:794:23 + #11 0xfee3fc in pdfi_check_Font_dict /src/ghostpdl/./pdf/pdf_check.c:827:20 + #12 0xfee3fc in pdfi_check_Resources /src/ghostpdl/./pdf/pdf_check.c:909:15 + #13 0xfe88a7 in pdfi_check_page_inner /src/ghostpdl/./pdf/pdf_check.c:1104:16 + #14 0xfe88a7 in pdfi_check_page /src/ghostpdl/./pdf/pdf_check.c:1149:12 + #15 0xf3090d in pdfi_page_info /src/ghostpdl/./pdf/pdf_page.c:492:12 + #16 0xe99dca in zPDFpageinfo /src/ghostpdl/./psi/zpdfops.c:957:16 + #17 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #18 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #19 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #20 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #21 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #22 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #23 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #24 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #25 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #26 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #27 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #28 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #29 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #30 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #31 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #32 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #33 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #34 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #35 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #36 0x7fccb58b7082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #37 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x000001625000 is located 32 bytes to the left of global variable '' defined in './base/gsmemory.c:41:1' (0x1625020) of size 13 + '' is ascii string 'gs_gc_root_t' +0x000001625000 is located 0 bytes to the right of global variable 'st_bytes' defined in './base/gsmemory.c:38:1' (0x1624fc0) of size 64 +SUMMARY: AddressSanitizer: global-buffer-overflow /src/ghostpdl/./pdf/pdf_dict.c:247:25 in pdfi_dict_get +Shadow bytes around the buggy address: + 0x0000802bc9b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0000802bc9c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0000802bc9d0: 01 f9 f9 f9 01 f9 f9 f9 01 f9 f9 f9 01 f9 f9 f9 + 0x0000802bc9e0: 01 f9 f9 f9 07 f9 f9 f9 00 00 00 00 00 00 00 00 + 0x0000802bc9f0: f9 f9 f9 f9 06 f9 f9 f9 00 00 00 00 00 00 00 00 +=>0x0000802bca00:[f9]f9 f9 f9 00 05 f9 f9 00 00 00 f9 f9 f9 f9 f9 + 0x0000802bca10: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 02 f9 + 0x0000802bca20: f9 f9 f9 f9 00 00 00 00 00 00 00 00 f9 f9 f9 f9 + 0x0000802bca30: 04 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0000802bca40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0000802bca50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1770.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1770.txt new file mode 100644 index 000000000..6d84379d2 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1770.txt @@ -0,0 +1,41 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 810760347 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f9373e939e0, 0x7f9373e96f6c), 959 [0x7f9373ef4a40, 0x7f9373ef4dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f9373e96f70,0x7f9373ecc830), 959 [0x7f9373ef4e00,0x7f9373ef89f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x00009fff8006 (pc 0x00000100728f bp 0x7ffc351861a0 sp 0x7ffc35186170 T0) +==1==The signal is caused by a READ memory access. + #0 0x100728f in pdfi_free_xref_table /src/ghostpdl/./pdf/pdf_obj.c:227:5 + #1 0x100728f in pdfi_free_object /src/ghostpdl/./pdf/pdf_obj.c:269:13 + #2 0xea6b9e in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:83:13 + #3 0xea6b9e in pdfi_clear_context /src/ghostpdl/./pdf/ghostpdf.c:1836:9 + #4 0xeb0d80 in pdfi_free_context /src/ghostpdl/./pdf/ghostpdf.c:1967:5 + #5 0xe98791 in zPDFclose /src/ghostpdl/./psi/zpdfops.c:724:16 + #6 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #10 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #12 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #13 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #14 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #15 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #16 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #17 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #19 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #20 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #21 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #22 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #23 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #24 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7f937388d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #26 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_obj.c:227:5 in pdfi_free_xref_table +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1771.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1771.txt new file mode 100644 index 000000000..acf973882 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1771.txt @@ -0,0 +1,98 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 813553901 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f8da88b09e0, 0x7f8da88b3f6c), 959 [0x7f8da8911a40, 0x7f8da8911dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f8da88b3f70,0x7f8da88e9830), 959 [0x7f8da8911e00,0x7f8da89159f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f8da768e354 at pc 0x0000010335f2 bp 0x7fff22dd0660 sp 0x7fff22dd0658 +WRITE of size 4 at 0x7f8da768e354 thread T0 + #0 0x10335f1 in fn_ElIn_evaluate /src/ghostpdl/./base/gsfunc3.c:121:16 + #1 0xfe01f0 in pdfi_tf_using_function /src/ghostpdl/./pdf/pdf_trans.c:43:12 + #2 0x5b7c6d in gs_begin_transparency_mask /src/ghostpdl/./base/gstrans.c:625:17 + #3 0xfdecfe in pdfi_trans_set_mask /src/ghostpdl/./pdf/pdf_trans.c:287:16 + #4 0xfdecfe in pdfi_trans_set_params /src/ghostpdl/./pdf/pdf_trans.c:813:13 + #5 0xf27276 in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2459:12 + #6 0xf27c9f in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2571:12 + #7 0xedcab8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1472:24 + #8 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #9 0xed904d in pdfi_interpret_inner_content /src/ghostpdl/./pdf/pdf_int.c:1927:12 + #10 0xed904d in pdfi_interpret_inner_content_stream /src/ghostpdl/./pdf/pdf_int.c:2026:12 + #11 0xed904d in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1873:12 + #12 0xf25da1 in pdfi_form_execgroup /src/ghostpdl/./pdf/pdf_image.c:2161:12 + #13 0xf26e3d in pdfi_do_form /src/ghostpdl/./pdf/pdf_image.c:2395:16 + #14 0xf274a0 in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2493:16 + #15 0xf27c9f in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2571:12 + #16 0xedcab8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1472:24 + #17 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #18 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #19 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #20 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #21 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #22 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #23 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #24 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #25 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #26 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #27 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #28 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #29 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #30 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #31 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #32 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #33 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #34 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #35 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #36 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #37 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #38 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #39 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #40 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #41 0x7f8da82aa082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #42 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +Address 0x7f8da768e354 is located in stack of thread T0 at offset 2900 in frame + #0 0x5b6f0f in gs_begin_transparency_mask /src/ghostpdl/./base/gstrans.c:543 + + This frame has 6 object(s): + [32, 40) 'pdf14dev.i.i180' (line 134) + [64, 72) 'pdf14dev.i.i' (line 134) + [96, 1360) 'params' (line 544) + [1488, 2752) 'params_color' (line 545) + [2880, 2884) 'out' (line 611) + [2896, 2900) 'out87' (line 623) <== Memory access at offset 2900 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ghostpdl/./base/gsfunc3.c:121:16 in fn_ElIn_evaluate +Shadow bytes around the buggy address: + 0x0ff234ec9c10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff234ec9c20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff234ec9c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff234ec9c40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff234ec9c50: 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 f2 f2 f2 +=>0x0ff234ec9c60: f2 f2 f2 f2 f2 f2 f2 f2 f8 f2[04]f3 00 00 00 00 + 0x0ff234ec9c70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff234ec9c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff234ec9c90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff234ec9ca0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff234ec9cb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1772.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1772.txt new file mode 100644 index 000000000..239c16c21 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1772.txt @@ -0,0 +1,40 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 816501692 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7fe29a0729e0, 0x7fe29a075f6c), 959 [0x7fe29a0d3a40, 0x7fe29a0d3dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7fe29a075f70,0x7fe29a0ab830), 959 [0x7fe29a0d3e00,0x7fe29a0d79f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x49518bff8006 (pc 0x0000006f2f16 bp 0x7ffdd0142ca0 sp 0x7ffdd0142c30 T0) +==1==The signal is caused by a READ memory access. + #0 0x6f2f16 in chunk_free_object /src/ghostpdl/./base/gsmchunk.c:1093:31 + #1 0x12cb40e in gs_font_dir_finalize /src/ghostpdl/./base/gsfont.c:320:9 + #2 0x6f2f42 in chunk_free_object /src/ghostpdl/./base/gsmchunk.c:1095:13 + #3 0xeb10b7 in pdfi_free_context /src/ghostpdl/./pdf/ghostpdf.c:1982:9 + #4 0xe98791 in zPDFclose /src/ghostpdl/./psi/zpdfops.c:724:16 + #5 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #6 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #7 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #8 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #9 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #10 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #11 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #12 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #13 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #14 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #15 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #16 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #17 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #18 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #19 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #20 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #21 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #22 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #23 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #24 0x7fe299a6c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #25 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gsmchunk.c:1093:31 in chunk_free_object +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1774.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1774.txt new file mode 100644 index 000000000..7a86d99c7 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1774.txt @@ -0,0 +1,52 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 819729297 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7fe60d8779e0, 0x7fe60d87af6c), 959 [0x7fe60d8d8a40, 0x7fe60d8d8dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7fe60d87af70,0x7fe60d8b0830), 959 [0x7fe60d8d8e00,0x7fe60d8dc9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000009b98 (pc 0x000000ebfa23 bp 0x7ffcf44eb5b0 sp 0x7ffcf44eb4e0 T0) +==1==The signal is caused by a READ memory access. + #0 0xebfa23 in pdfi_array_fetch /src/ghostpdl/./pdf/pdf_array.c:138:14 + #1 0xebfa23 in pdfi_array_get /src/ghostpdl/./pdf/pdf_array.c:164:12 + #2 0xec0433 in pdfi_array_get_type /src/ghostpdl/./pdf/pdf_array.c:207:12 + #3 0xefa8a1 in pdfi_create_colorspace_by_array /src/ghostpdl/./pdf/pdf_colour.c:2285:12 + #4 0xf02703 in pdfi_create_DeviceN /src/ghostpdl/./pdf/pdf_colour.c:1816:20 + #5 0xefbd90 in pdfi_create_colorspace_by_array /src/ghostpdl/./pdf/pdf_colour.c:2330:16 + #6 0xef9ab0 in pdfi_create_colorspace /src/ghostpdl/./pdf/pdf_colour.c:2473:20 + #7 0xefa573 in pdfi_create_colorspace_by_name /src/ghostpdl/./pdf/pdf_colour.c:2408:16 + #8 0xefc83d in pdfi_create_colorspace /src/ghostpdl/./pdf/pdf_colour.c:2470:16 + #9 0xefc83d in pdfi_setcolorspace /src/ghostpdl/./pdf/pdf_colour.c:2488:12 + #10 0xefc83d in pdfi_setfillcolor_space /src/ghostpdl/./pdf/pdf_colour.c:2522:12 + #11 0xedc22e in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1455:24 + #12 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #13 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #14 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #15 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #16 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #17 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #18 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #19 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #20 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #21 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #22 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #23 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #24 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #25 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #26 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #27 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #28 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #29 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #30 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #31 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #32 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #33 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #34 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #35 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #36 0x7fe60d271082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #37 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_array.c:138:14 in pdfi_array_fetch +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1781.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1781.txt new file mode 100644 index 000000000..833b7f285 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1781.txt @@ -0,0 +1,106 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 822629925 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f3615bac9e0, 0x7f3615baff6c), 959 [0x7f3615c0da40, 0x7f3615c0ddff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f3615baff70,0x7f3615be5830), 959 [0x7f3615c0de00,0x7f3615c119f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f3611f13490 at pc 0x000000ec845a bp 0x7ffeb343e450 sp 0x7ffeb343e448 +READ of size 8 at 0x7f3611f13490 thread T0 + #0 0xec8459 in read_xref_section /src/ghostpdl/./pdf/pdf_xref.c:762:20 + #1 0xec8459 in read_xref /src/ghostpdl/./pdf/pdf_xref.c:800:16 + #2 0xec56d1 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1032:20 + #3 0xeaca4c in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1051:12 + #4 0xeaca4c in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1328:12 + #5 0xe981b4 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:642:12 + #6 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #10 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #12 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #13 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #14 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #15 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #16 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #17 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #19 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #20 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #21 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #22 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #23 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #24 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7f36155a6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #26 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x7f3611f13490 is located 880 bytes to the left of 1309872-byte region [0x7f3611f13800,0x7f36120534b0) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f2be8 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #5 0x6f43b8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0xec94e7 in resize_xref /src/ghostpdl/./pdf/pdf_xref.c:39:31 + #7 0xec6a21 in read_xref_section /src/ghostpdl/./pdf/pdf_xref.c:730:24 + #8 0xec6a21 in read_xref /src/ghostpdl/./pdf/pdf_xref.c:800:16 + #9 0xec56d1 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1032:20 + #10 0xeaca4c in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1051:12 + #11 0xeaca4c in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1328:12 + #12 0xe981b4 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:642:12 + #13 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #14 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #15 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #16 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #17 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #18 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #19 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #20 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #21 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #22 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #23 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #24 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #25 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #26 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #27 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #28 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #29 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #30 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #31 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #32 0x7f36155a6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./pdf/pdf_xref.c:762:20 in read_xref_section +Shadow bytes around the buggy address: + 0x0fe7423da640: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fe7423da650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fe7423da660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fe7423da670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fe7423da680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0fe7423da690: fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fe7423da6a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fe7423da6b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fe7423da6c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fe7423da6d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fe7423da6e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1788.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1788.txt new file mode 100644 index 000000000..50020bd0e --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1788.txt @@ -0,0 +1,53 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 825429564 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f51943669e0, 0x7f5194369f6c), 959 [0x7f51943c7a40, 0x7f51943c7dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f5194369f70,0x7f519439f830), 959 [0x7f51943c7e00,0x7f51943cb9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x631000064878 (pc 0x631000064878 bp 0x7fff19e72990 sp 0x7fff19e72918 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: PC is at a non-executable region. Maybe a wild jump? + #0 0x631000064878 () + #1 0x10073b5 in pdfi_free_namestring /src/ghostpdl/./pdf/pdf_obj.c:209:9 + #2 0x10073b5 in pdfi_free_object /src/ghostpdl/./pdf/pdf_obj.c:254:13 + #3 0xefa9fe in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:83:13 + #4 0xefa9fe in pdfi_create_colorspace_by_array /src/ghostpdl/./pdf/pdf_colour.c:2351:5 + #5 0xf02703 in pdfi_create_DeviceN /src/ghostpdl/./pdf/pdf_colour.c:1816:20 + #6 0xefbd90 in pdfi_create_colorspace_by_array /src/ghostpdl/./pdf/pdf_colour.c:2330:16 + #7 0xef9ab0 in pdfi_create_colorspace /src/ghostpdl/./pdf/pdf_colour.c:2473:20 + #8 0xefa573 in pdfi_create_colorspace_by_name /src/ghostpdl/./pdf/pdf_colour.c:2408:16 + #9 0xefc83d in pdfi_create_colorspace /src/ghostpdl/./pdf/pdf_colour.c:2470:16 + #10 0xefc83d in pdfi_setcolorspace /src/ghostpdl/./pdf/pdf_colour.c:2488:12 + #11 0xefc83d in pdfi_setfillcolor_space /src/ghostpdl/./pdf/pdf_colour.c:2522:12 + #12 0xedc22e in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1455:24 + #13 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #14 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #15 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #16 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #17 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #18 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #19 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #20 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #21 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #22 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #23 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #24 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #25 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #26 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #27 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #28 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #29 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #30 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #31 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #32 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #33 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #34 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #35 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #36 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #37 0x7f5193d60082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV () +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1795.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1795.txt new file mode 100644 index 000000000..980e3d118 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1795.txt @@ -0,0 +1,83 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 828262775 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f3e7137c9e0, 0x7f3e7137ff6c), 959 [0x7f3e713dda40, 0x7f3e713dddff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f3e7137ff70,0x7f3e713b5830), 959 [0x7f3e713dde00,0x7f3e713e19f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: negative-size-param: (size=-57875) + #0 0x4be84f in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xfb9a5d in general_endcidrange_func /src/ghostpdl/./pdf/pdf_cmap.c:205:17 + #2 0xfb699f in cmap_endcidrange_func /src/ghostpdl/./pdf/pdf_cmap.c:227:12 + #3 0xf96dd0 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:363:36 + #4 0xfb19a7 in pdfi_read_cmap /src/ghostpdl/./pdf/pdf_cmap.c:810:12 + #5 0xf6e973 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:197:16 + #6 0xf5f974 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #7 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #8 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #9 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #10 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #11 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #12 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #13 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #14 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #15 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #16 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #24 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #25 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #26 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #27 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #30 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7f3e70d76082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x63100007daf4 is located 21236 bytes inside of 65616-byte region [0x631000078800,0x631000088850) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f2be8 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f546d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #5 0x6f453c in chunk_alloc_struct_array /src/ghostpdl/./base/gsmchunk.c:1024:12 + #6 0x1375e4a in gx_char_cache_alloc /src/ghostpdl/./base/gxccman.c:88:13 + #7 0x12c7179 in gs_font_dir_alloc2_limits /src/ghostpdl/./base/gsfont.c:263:12 + #8 0x12c7020 in gs_font_dir_alloc2 /src/ghostpdl/./base/gsfont.c:236:16 + #9 0xf6cf60 in pdfi_init_font_directory /src/ghostpdl/./pdf/pdf_font.c:1662:21 + #10 0xeb03e9 in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1637:12 + #11 0xe9c794 in zPDFInit /src/ghostpdl/./psi/zpdfops.c:1231:11 + #12 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #13 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #14 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #15 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #16 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #17 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #18 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #19 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #20 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #21 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #22 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #23 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #24 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #25 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #26 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #27 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #28 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #29 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #30 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #31 0x7f3e70d76082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: negative-size-param /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1802.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1802.txt new file mode 100644 index 000000000..422f84213 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1802.txt @@ -0,0 +1,51 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 831054305 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f69e77069e0, 0x7f69e7709f6c), 959 [0x7f69e7767a40, 0x7f69e7767dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f69e7709f70,0x7f69e773f830), 959 [0x7f69e7767e00,0x7f69e776b9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x62cff74a7f56 (pc 0x000000f8c15d bp 0x7ffd9e5e3d90 sp 0x7ffd9e5e3d60 T0) +==1==The signal is caused by a READ memory access. + #0 0xf8c15d in u16 /src/ghostpdl/./pdf/pdf_font1C.c:528:13 + #1 0xf8c15d in pdfi_count_cff_index /src/ghostpdl/./pdf/pdf_font1C.c:1079:13 + #2 0xf80c86 in pdfi_read_cff /src/ghostpdl/./pdf/pdf_font1C.c:1559:13 + #3 0xf80c86 in pdfi_read_cff_font /src/ghostpdl/./pdf/pdf_font1C.c:2132:20 + #4 0xf60137 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:731:32 + #5 0xf6f616 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:277:16 + #6 0xf5f974 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #7 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #8 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #9 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #10 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #11 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #12 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #13 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #14 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #15 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #16 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #24 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #25 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #26 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #27 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #30 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7f69e7100082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_font1C.c:528:13 in u16 +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1803.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1803.txt new file mode 100644 index 000000000..1d58d3df5 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1803.txt @@ -0,0 +1,51 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 833771000 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f68abdd09e0, 0x7f68abdd3f6c), 959 [0x7f68abe31a40, 0x7f68abe31dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f68abdd3f70,0x7f68abe09830), 959 [0x7f68abe31e00,0x7f68abe359f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x0000bfff8004 (pc 0x0000006f4e4b bp 0x7ffca518d2e0 sp 0x7ffca518d270 T0) +==1==The signal is caused by a READ memory access. + #0 0x6f4e4b in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:800:20 + #1 0x6f43b8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #2 0xfb5e1f in cmap_endfbrange_func /src/ghostpdl/./pdf/pdf_cmap.c:331:50 + #3 0xf96dd0 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:363:36 + #4 0xfb19a7 in pdfi_read_cmap /src/ghostpdl/./pdf/pdf_cmap.c:810:12 + #5 0xf6f304 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:260:20 + #6 0xf5f974 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #7 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #8 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #9 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #10 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #11 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #12 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #13 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #14 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #15 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #16 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #24 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #25 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #26 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #27 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #30 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7f68ab7ca082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gsmchunk.c:800:20 in chunk_obj_alloc +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1806.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1806.txt new file mode 100644 index 000000000..c92ff1956 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-1806.txt @@ -0,0 +1,95 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 840020044 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f24e282f9e0, 0x7f24e2832f6c), 959 [0x7f24e2890a40, 0x7f24e2890dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f24e2832f70,0x7f24e2868830), 959 [0x7f24e2890e00,0x7f24e28949f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f24e1619820 at pc 0x0000004bea81 bp 0x7ffce9fd9490 sp 0x7ffce9fd8c50 +WRITE of size 5575 at 0x7f24e1619820 thread T0 + #0 0x4bea80 in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xf61faf in pdfi_open_CIDFont_substitute_file /src/ghostpdl/./pdf/pdf_font.c:332:9 + #2 0xf604b4 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:761:29 + #3 0xf6f616 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:277:16 + #4 0xf5f974 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #5 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #6 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #7 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #8 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #9 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #10 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #11 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #12 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #13 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #14 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #15 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #16 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #17 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #18 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #19 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #20 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #21 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #22 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #23 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #24 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #25 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #26 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #27 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #28 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #29 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #30 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #31 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #32 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #33 0x7f24e2229082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #34 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +Address 0x7f24e1619820 is located in stack of thread T0 at offset 4128 in frame + #0 0xf6184f in pdfi_open_CIDFont_substitute_file /src/ghostpdl/./pdf/pdf_font.c:169 + + This frame has 11 object(s): + [32, 4128) 'fontfname' (line 171) + [4256, 4264) 's' (line 172) <== Memory access at offset 4128 partially underflows this variable + [4288, 4296) 'cidname' (line 173) <== Memory access at offset 4128 partially underflows this variable + [4320, 4336) 'fname' (line 174) <== Memory access at offset 4128 partially underflows this variable + [4352, 4360) 'mname' (line 179) <== Memory access at offset 4128 partially underflows this variable + [4384, 4392) 'csi' (line 180) <== Memory access at offset 4128 partially underflows this variable + [4416, 4424) 'csi_reg' (line 184) <== Memory access at offset 4128 partially underflows this variable + [4448, 4456) 'csi_ord' (line 184) <== Memory access at offset 4128 partially underflows this variable + [4480, 4488) 'reg_ord' (line 190) <== Memory access at offset 4128 partially underflows this variable + [4512, 4516) 'defcidfallacklen' (line 215) <== Memory access at offset 4128 partially underflows this variable + [4528, 4532) 'len' (line 232) <== Memory access at offset 4128 partially underflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x0fe51c2bb2b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe51c2bb2c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe51c2bb2d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe51c2bb2e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe51c2bb2f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fe51c2bb300: 00 00 00 00[f2]f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 + 0x0fe51c2bb310: f2 f2 f2 f2 00 f2 f2 f2 00 f2 f2 f2 00 00 f2 f2 + 0x0fe51c2bb320: f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 + 0x0fe51c2bb330: f8 f2 f2 f2 f8 f2 f8 f3 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe51c2bb340: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe51c2bb350: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-237.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-237.txt new file mode 100644 index 000000000..0c2615da2 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-237.txt @@ -0,0 +1,123 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1125929112 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f73393839e0, 0x7f7339386f6c), 959 [0x7f73393e4a40, 0x7f73393e4dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f7339386f70,0x7f73393bc830), 959 [0x7f73393e4e00,0x7f73393e89f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x6270000377c0 at pc 0x000000e5d4a1 bp 0x7ffefc3de190 sp 0x7ffefc3de188 +WRITE of size 4 at 0x6270000377c0 thread T0 + #0 0xe5d4a0 in sampled_data_sample /src/ghostpdl/./psi/zfsample.c:465:9 + #1 0xe5d4a0 in sampled_data_continue /src/ghostpdl/./psi/zfsample.c:588:12 + #2 0xcfaf9c in interp /src/ghostpdl/./psi/interp.c:1351:28 + #3 0xcfaf9c in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #4 0xcfaf9c in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #5 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #6 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #7 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #8 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #9 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #10 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #11 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #12 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #13 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #14 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #15 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #16 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #17 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #18 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #19 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #20 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #21 0x7f7338d7d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #22 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x6270000377c0 is located 11968 bytes inside of 13272-byte region [0x627000034900,0x627000037cd8) +freed by thread T0 here: + #0 0x524bc2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:111:3 + #1 0x8e6e4b in gs_heap_free_object /src/ghostpdl/./base/gsmalloc.c:366:5 + #2 0x12babc3 in alloc_free_clump /src/ghostpdl/./base/gsalloc.c:2639:9 + #3 0xde7e92 in gs_free_ref_array /src/ghostpdl/./psi/ialloc.c:359:13 + #4 0xd20e8e in ref_stack_pop_block /src/ghostpdl/./psi/istack.c:522:9 + #5 0xd209d5 in ref_stack_pop /src/ghostpdl/./psi/istack.c:460:9 + #6 0xd3a756 in zdicttomark /src/ghostpdl/./psi/zdict.c:407:5 + #7 0xcfdce9 in interp /src/ghostpdl/./psi/interp.c:1461:40 + #8 0xcfdce9 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #9 0xcfdce9 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #10 0x562a1f in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #11 0x562a1f in gs_run_init_file /src/ghostpdl/./psi/imain.c:861:12 + #12 0x562a1f in gs_main_init2aux /src/ghostpdl/./psi/imain.c:305:16 + #13 0x5642db in gs_main_init2 /src/ghostpdl/./psi/imain.c:491:12 + #14 0x101c00f in swproc /src/ghostpdl/./psi/imainarg.c:371:20 + #15 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #16 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #17 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #19 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #20 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #21 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #22 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #23 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #24 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7f7338d7d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +previously allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x12bd3b4 in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2488:13 + #3 0x12bb8e0 in alloc_obj /src/ghostpdl/./base/gsalloc.c:1952:13 + #4 0x12b5531 in i_alloc_struct_array /src/ghostpdl/./base/gsalloc.c:1365:11 + #5 0xde7042 in gs_alloc_ref_array /src/ghostpdl/./psi/ialloc.c:226:15 + #6 0xd1e2f9 in ref_stack_push_block /src/ghostpdl/./psi/istack.c:615:12 + #7 0xd21279 in ref_stack_extend /src/ghostpdl/./psi/istack.c:549:12 + #8 0xd01d11 in gs_call_interp /src/ghostpdl/./psi/interp.c:640:17 + #9 0xd01d11 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #10 0x562a1f in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #11 0x562a1f in gs_run_init_file /src/ghostpdl/./psi/imain.c:861:12 + #12 0x562a1f in gs_main_init2aux /src/ghostpdl/./psi/imain.c:305:16 + #13 0x5642db in gs_main_init2 /src/ghostpdl/./psi/imain.c:491:12 + #14 0x101c00f in swproc /src/ghostpdl/./psi/imainarg.c:371:20 + #15 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #16 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #17 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #19 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #20 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #21 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #22 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #23 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #24 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7f7338d7d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/ghostpdl/./psi/zfsample.c:465:9 in sampled_data_sample +Shadow bytes around the buggy address: + 0x0c4e7fffeea0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e7fffeeb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e7fffeec0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e7fffeed0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e7fffeee0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0c4e7fffeef0: fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd + 0x0c4e7fffef00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e7fffef10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e7fffef20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e7fffef30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e7fffef40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-337.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-337.txt new file mode 100644 index 000000000..ada2db2ca --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-337.txt @@ -0,0 +1,124 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1129352973 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f83ad93b9e0, 0x7f83ad93ef6c), 959 [0x7f83ad99ca40, 0x7f83ad99cdff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f83ad93ef70,0x7f83ad974830), 959 [0x7f83ad99ce00,0x7f83ad9a09f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x62700006e528 at pc 0x00000052430c bp 0x7ffd3e3a1d10 sp 0x7ffd3e3a14d8 +WRITE of size 16 at 0x62700006e528 thread T0 + #0 0x52430b in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0xe5aa62 in sampled_data_finish /src/ghostpdl/./psi/zfsample.c:620:5 + #2 0xe5ccdc in sampled_data_continue /src/ghostpdl/./psi/zfsample.c:562:20 + #3 0xcfaf9c in interp /src/ghostpdl/./psi/interp.c:1351:28 + #4 0xcfaf9c in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #5 0xcfaf9c in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #6 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #7 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #8 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #9 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #10 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #11 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #12 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #13 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #14 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #15 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #16 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #17 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #18 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #19 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #20 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #21 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #22 0x7f83ad335082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #23 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x62700006e528 is located 7208 bytes inside of 13272-byte region [0x62700006c900,0x62700006fcd8) +freed by thread T0 here: + #0 0x524bc2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:111:3 + #1 0x8e6e4b in gs_heap_free_object /src/ghostpdl/./base/gsmalloc.c:366:5 + #2 0x12babc3 in alloc_free_clump /src/ghostpdl/./base/gsalloc.c:2639:9 + #3 0xde7e92 in gs_free_ref_array /src/ghostpdl/./psi/ialloc.c:359:13 + #4 0xd20e8e in ref_stack_pop_block /src/ghostpdl/./psi/istack.c:522:9 + #5 0xd209d5 in ref_stack_pop /src/ghostpdl/./psi/istack.c:460:9 + #6 0xd2f5fe in zastore /src/ghostpdl/./psi/zarray.c:116:9 + #7 0xcfaf9c in interp /src/ghostpdl/./psi/interp.c:1351:28 + #8 0xcfaf9c in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #9 0xcfaf9c in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #10 0x562a1f in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #11 0x562a1f in gs_run_init_file /src/ghostpdl/./psi/imain.c:861:12 + #12 0x562a1f in gs_main_init2aux /src/ghostpdl/./psi/imain.c:305:16 + #13 0x5642db in gs_main_init2 /src/ghostpdl/./psi/imain.c:491:12 + #14 0x101c00f in swproc /src/ghostpdl/./psi/imainarg.c:371:20 + #15 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #16 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #17 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #19 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #20 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #21 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #22 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #23 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #24 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7f83ad335082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +previously allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x12bd3b4 in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2488:13 + #3 0x12bb8e0 in alloc_obj /src/ghostpdl/./base/gsalloc.c:1952:13 + #4 0x12b5531 in i_alloc_struct_array /src/ghostpdl/./base/gsalloc.c:1365:11 + #5 0xde7042 in gs_alloc_ref_array /src/ghostpdl/./psi/ialloc.c:226:15 + #6 0xd1e2f9 in ref_stack_push_block /src/ghostpdl/./psi/istack.c:615:12 + #7 0xd21279 in ref_stack_extend /src/ghostpdl/./psi/istack.c:549:12 + #8 0xd01d11 in gs_call_interp /src/ghostpdl/./psi/interp.c:640:17 + #9 0xd01d11 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #10 0x562a1f in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #11 0x562a1f in gs_run_init_file /src/ghostpdl/./psi/imain.c:861:12 + #12 0x562a1f in gs_main_init2aux /src/ghostpdl/./psi/imain.c:305:16 + #13 0x5642db in gs_main_init2 /src/ghostpdl/./psi/imain.c:491:12 + #14 0x101c00f in swproc /src/ghostpdl/./psi/imainarg.c:371:20 + #15 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #16 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #17 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #19 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #20 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #21 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #22 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #23 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #24 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7f83ad335082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c4e80005c50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e80005c60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e80005c70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e80005c80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e80005c90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0c4e80005ca0: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd + 0x0c4e80005cb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e80005cc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e80005cd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e80005ce0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e80005cf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-668.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-668.txt new file mode 100644 index 000000000..b3ddac96d --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-668.txt @@ -0,0 +1,94 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1132801849 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7fcd303fc9e0, 0x7fcd303fff6c), 959 [0x7fcd3045da40, 0x7fcd3045ddff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7fcd303fff70,0x7fcd30435830), 959 [0x7fcd3045de00,0x7fcd304619f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-use-after-return on address 0x7fcd2f1dcbe0 at pc 0x0000005f84b9 bp 0x7ffe4f62f9c0 sp 0x7ffe4f62f9b8 +WRITE of size 8 at 0x7fcd2f1dcbe0 thread T0 + #0 0x5f84b8 in pdf14_initialize_device /src/ghostpdl/./base/gdevp14.c:6202:15 + #1 0x628baa in pdf14_push_color_model /src/ghostpdl/./base/gdevp14.c:7094:23 + #2 0x604257 in pdf14_begin_transparency_group /src/ghostpdl/./base/gdevp14.c:6820:24 + #3 0x5b4b6f in gx_begin_transparency_group /src/ghostpdl/./base/gstrans.c:380:12 + #4 0x623911 in gx_update_pdf14_compositor /src/ghostpdl/./base/gdevp14.c:5945:20 + #5 0x602296 in pdf14_composite /src/ghostpdl/./base/gdevp14.c:6052:16 + #6 0x11b7db6 in apply_composite /src/ghostpdl/./base/gxclrast.c:3083:12 + #7 0x11b7db6 in execute_compositor_queue /src/ghostpdl/./base/gxclrast.c:395:16 + #8 0x11a911d in clist_playback_band /src/ghostpdl/./base/gxclrast.c:1789:48 + #9 0x68e64c in clist_playback_file_bands /src/ghostpdl/./base/gxclread.c:1035:16 + #10 0x692ca0 in clist_render_rectangle /src/ghostpdl/./base/gxclread.c:969:16 + #11 0x69207a in clist_rasterize_lines /src/ghostpdl/./base/gxclread.c:858:20 + #12 0x69123f in clist_get_bits_rectangle /src/ghostpdl/./base/gxclread.c:747:12 + #13 0x66581a in gdev_prn_get_bits /src/ghostpdl/./base/gdevprn.c:1636:12 + #14 0x7ec824 in cups_print_chunked /src/ghostpdl/./cups/gdevcups.c:4849:9 + #15 0x7db10b in cups_print_pages /src/ghostpdl/./cups/gdevcups.c + #16 0x6616a9 in gdev_prn_output_page_aux /src/ghostpdl/./base/gdevprn.c:1049:27 + #17 0x660965 in gdev_prn_output_page /src/ghostpdl/./base/gdevprn.c:1085:12 + #18 0x7ebfd9 in cups_output_page /src/ghostpdl/./cups/gdevcups.c:2826:15 + #19 0x8a6e3f in gs_output_page /src/ghostpdl/./base/gsdevice.c:207:17 + #20 0xdcc0d2 in zoutputpage /src/ghostpdl/./psi/zdevice.c:416:12 + #21 0xcfaf9c in interp /src/ghostpdl/./psi/interp.c:1351:28 + #22 0xcfaf9c in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #23 0xcfaf9c in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #24 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #25 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #26 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #27 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #28 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #29 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #30 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #31 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #32 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #33 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #34 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #35 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #36 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #37 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #38 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #39 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #40 0x7fcd2fdf6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #41 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +Address 0x7fcd2f1dcbe0 is located in stack of thread T0 at offset 992 in frame + #0 0x91428f in gs_grestore /src/ghostpdl/./base/gsstate.c:409 + + This frame has 3 object(s): + [32, 128) 'clone_data.i.i20' (line 1388) + [160, 2216) 'tmp_gstate.i' (line 379) <== Memory access at offset 992 is inside this variable + [2352, 2448) 'clone_data.i.i' (line 1388) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-use-after-return /src/ghostpdl/./base/gdevp14.c:6202:15 in pdf14_initialize_device +Shadow bytes around the buggy address: + 0x0ffa25e33920: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffa25e33930: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffa25e33940: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffa25e33950: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffa25e33960: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0ffa25e33970: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5[f5]f5 f5 f5 + 0x0ffa25e33980: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffa25e33990: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffa25e339a0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffa25e339b0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffa25e339c0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-717.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-717.txt new file mode 100644 index 000000000..685d916a1 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-717.txt @@ -0,0 +1,69 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1135788055 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7fbe534159e0, 0x7fbe53418f6c), 959 [0x7fbe53476a40, 0x7fbe53476dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7fbe53418f70,0x7fbe5344e830), 959 [0x7fbe53476e00,0x7fbe5347a9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62700013e0e9 at pc 0x000000d2883a bp 0x7fff3500e640 sp 0x7fff3500e638 +READ of size 1 at 0x62700013e0e9 thread T0 + #0 0xd28839 in real_param /src/ghostpdl/./psi/iutil.c:860:13 + #1 0xe95931 in zpdfinkpath_bug /src/ghostpdl/./psi/zpdfops.c:128:17 + #2 0xe95931 in zpdfinkpath /src/ghostpdl/./psi/zpdfops.c:304:16 + #3 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #4 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #5 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #6 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #7 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #8 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #9 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #10 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #11 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #12 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #13 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #14 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #15 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #16 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #17 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #18 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #19 0x457065 in fuzzer::Fuzzer::TryDetectingAMemoryLeak(unsigned char const*, unsigned long, bool) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:687:3 + #20 0x44221e in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:8 + #21 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #22 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #23 0x7fbe52e0f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #24 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +Address 0x62700013e0e9 is a wild pointer inside of access range of size 0x000000000001. +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./psi/iutil.c:860:13 in real_param +Shadow bytes around the buggy address: + 0x0c4e8001fbc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4e8001fbd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4e8001fbe0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4e8001fbf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4e8001fc00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c4e8001fc10: fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]fa fa + 0x0c4e8001fc20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4e8001fc30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4e8001fc40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4e8001fc50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c4e8001fc60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-803.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-803.txt new file mode 100644 index 000000000..05b1c1ae7 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2021-803.txt @@ -0,0 +1,126 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1138911496 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f98a40fa9e0, 0x7f98a40fdf6c), 959 [0x7f98a415ba40, 0x7f98a415bdff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f98a40fdf70,0x7f98a4133830), 959 [0x7f98a415be00,0x7f98a415f9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x627000087d68 at pc 0x00000052430c bp 0x7ffd07d068f0 sp 0x7ffd07d060b8 +WRITE of size 16 at 0x627000087d68 thread T0 + #0 0x52430b in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0xe5aa62 in sampled_data_finish /src/ghostpdl/./psi/zfsample.c:620:5 + #2 0xe5ccdc in sampled_data_continue /src/ghostpdl/./psi/zfsample.c:562:20 + #3 0xcfaf9c in interp /src/ghostpdl/./psi/interp.c:1351:28 + #4 0xcfaf9c in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #5 0xcfaf9c in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #6 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #7 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #8 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #9 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #10 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #11 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #12 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #13 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #14 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #15 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #16 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #17 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #18 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #19 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #20 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #21 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #22 0x7f98a3af4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #23 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x627000087d68 is located 11368 bytes inside of 13272-byte region [0x627000085100,0x6270000884d8) +freed by thread T0 here: + #0 0x524bc2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:111:3 + #1 0x8e6e4b in gs_heap_free_object /src/ghostpdl/./base/gsmalloc.c:366:5 + #2 0x12babc3 in alloc_free_clump /src/ghostpdl/./base/gsalloc.c:2639:9 + #3 0xde7e92 in gs_free_ref_array /src/ghostpdl/./psi/ialloc.c:359:13 + #4 0xd20e8e in ref_stack_pop_block /src/ghostpdl/./psi/istack.c:522:9 + #5 0xd209d5 in ref_stack_pop /src/ghostpdl/./psi/istack.c:460:9 + #6 0xe5cdd2 in sampled_data_continue /src/ghostpdl/./psi/zfsample.c:574:21 + #7 0xcfaf9c in interp /src/ghostpdl/./psi/interp.c:1351:28 + #8 0xcfaf9c in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #9 0xcfaf9c in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #10 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #11 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #12 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #13 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #14 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #15 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #16 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #17 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #18 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #19 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #20 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #21 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #22 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #23 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #24 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #25 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #26 0x7f98a3af4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +previously allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x12bd3b4 in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2488:13 + #3 0x12bb8e0 in alloc_obj /src/ghostpdl/./base/gsalloc.c:1952:13 + #4 0x12b5531 in i_alloc_struct_array /src/ghostpdl/./base/gsalloc.c:1365:11 + #5 0xde7042 in gs_alloc_ref_array /src/ghostpdl/./psi/ialloc.c:226:15 + #6 0xd1e2f9 in ref_stack_push_block /src/ghostpdl/./psi/istack.c:615:12 + #7 0xd21279 in ref_stack_extend /src/ghostpdl/./psi/istack.c:549:12 + #8 0xd01d11 in gs_call_interp /src/ghostpdl/./psi/interp.c:640:17 + #9 0xd01d11 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #10 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #11 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #12 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #13 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #14 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #15 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #16 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #17 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #18 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #19 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #20 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #21 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #22 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #23 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #24 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #25 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #26 0x7f98a3af4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c4e80008f50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e80008f60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e80008f70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e80008f80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e80008f90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0c4e80008fa0: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd + 0x0c4e80008fb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e80008fc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e80008fd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e80008fe0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c4e80008ff0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-1.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-1.txt new file mode 100644 index 000000000..7a1749988 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-1.txt @@ -0,0 +1,84 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 842795064 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f7a67e099e0, 0x7f7a67e0cf6c), 959 [0x7f7a67e6aa40, 0x7f7a67e6adff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f7a67e0cf70,0x7f7a67e42830), 959 [0x7f7a67e6ae00,0x7f7a67e6e9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000001625000 at pc 0x000000eb4912 bp 0x7ffec25d5800 sp 0x7ffec25d57f8 +READ of size 8 at 0x000001625000 thread T0 + #0 0xeb4911 in pdfi_dict_get /src/ghostpdl/./pdf/pdf_dict.c:247:25 + #1 0xeb686e in pdfi_dict_get_type /src/ghostpdl/./pdf/pdf_dict.c:462:12 + #2 0xeb686e in pdfi_dict_get_int /src/ghostpdl/./pdf/pdf_dict.c:492:12 + #3 0xffcd88 in pdfi_read_stream_object /src/ghostpdl/./pdf/pdf_deref.c:255:12 + #4 0xffcd88 in pdfi_read_bare_object /src/ghostpdl/./pdf/pdf_deref.c:439:16 + #5 0x1001792 in pdfi_read_object /src/ghostpdl/./pdf/pdf_deref.c:534:12 + #6 0xfff53b in pdfi_dereference /src/ghostpdl/./pdf/pdf_deref.c:831:20 + #7 0xebd221 in pdfi_dict_next /src/ghostpdl/./pdf/pdf_dict.c:1067:20 + #8 0xfecf90 in pdfi_check_XObject_dict /src/ghostpdl/./pdf/pdf_check.c:457:24 + #9 0xfecf90 in pdfi_check_Resources /src/ghostpdl/./pdf/pdf_check.c:897:15 + #10 0xfee3fc in pdfi_check_Font /src/ghostpdl/./pdf/pdf_check.c:794:23 + #11 0xfee3fc in pdfi_check_Font_dict /src/ghostpdl/./pdf/pdf_check.c:827:20 + #12 0xfee3fc in pdfi_check_Resources /src/ghostpdl/./pdf/pdf_check.c:909:15 + #13 0xfe88a7 in pdfi_check_page_inner /src/ghostpdl/./pdf/pdf_check.c:1104:16 + #14 0xfe88a7 in pdfi_check_page /src/ghostpdl/./pdf/pdf_check.c:1149:12 + #15 0xf3090d in pdfi_page_info /src/ghostpdl/./pdf/pdf_page.c:492:12 + #16 0xe99dca in zPDFpageinfo /src/ghostpdl/./psi/zpdfops.c:957:16 + #17 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #18 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #19 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #20 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #21 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #22 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #23 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #24 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #25 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #26 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #27 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #28 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #29 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #30 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #31 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #32 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #33 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #34 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #35 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #36 0x7f7a67803082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #37 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x000001625000 is located 32 bytes to the left of global variable '' defined in './base/gsmemory.c:41:1' (0x1625020) of size 13 + '' is ascii string 'gs_gc_root_t' +0x000001625000 is located 0 bytes to the right of global variable 'st_bytes' defined in './base/gsmemory.c:38:1' (0x1624fc0) of size 64 +SUMMARY: AddressSanitizer: global-buffer-overflow /src/ghostpdl/./pdf/pdf_dict.c:247:25 in pdfi_dict_get +Shadow bytes around the buggy address: + 0x0000802bc9b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0000802bc9c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0000802bc9d0: 01 f9 f9 f9 01 f9 f9 f9 01 f9 f9 f9 01 f9 f9 f9 + 0x0000802bc9e0: 01 f9 f9 f9 07 f9 f9 f9 00 00 00 00 00 00 00 00 + 0x0000802bc9f0: f9 f9 f9 f9 06 f9 f9 f9 00 00 00 00 00 00 00 00 +=>0x0000802bca00:[f9]f9 f9 f9 00 05 f9 f9 00 00 00 f9 f9 f9 f9 f9 + 0x0000802bca10: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 02 f9 + 0x0000802bca20: f9 f9 f9 f9 00 00 00 00 00 00 00 00 f9 f9 f9 f9 + 0x0000802bca30: 04 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0000802bca40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0000802bca50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-100.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-100.txt new file mode 100644 index 000000000..0f9adaaee --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-100.txt @@ -0,0 +1,85 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 870711206 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7faa846a59e0, 0x7faa846a8f6c), 959 [0x7faa84706a40, 0x7faa84706dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7faa846a8f70,0x7faa846de830), 959 [0x7faa84706e00,0x7faa8470a9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7faa8343c1d4 at pc 0x0000004be68c bp 0x7ffe3d0c7130 sp 0x7ffe3d0c68f0 +WRITE of size 1 at 0x7faa8343c1d4 thread T0 + #0 0x4be68b in __interceptor_memmove /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:810:3 + #1 0x6bd0a0 in stream_move /src/ghostpdl/./base/stream.c:999:5 + #2 0x6bd0a0 in sgets /src/ghostpdl/./base/stream.c:547:13 + #3 0xee4c09 in pdfi_read_bytes /src/ghostpdl/./pdf/pdf_file.c:1471:16 + #4 0xec9cef in read_digits /src/ghostpdl/./pdf/pdf_xref.c:549:17 + #5 0xec9cef in read_xref_entry_slow /src/ghostpdl/./pdf/pdf_xref.c:590:12 + #6 0xec6e3b in read_xref_section /src/ghostpdl/./pdf/pdf_xref.c:752:24 + #7 0xec6e3b in read_xref /src/ghostpdl/./pdf/pdf_xref.c:800:16 + #8 0xec56d1 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1032:20 + #9 0xeaca4c in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1051:12 + #10 0xeaca4c in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1328:12 + #11 0xe981b4 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:642:12 + #12 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #13 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #14 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #15 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #16 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #17 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #18 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #19 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #20 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #21 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #22 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #23 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #24 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #25 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #26 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #27 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #28 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #29 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #30 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #31 0x7faa8409f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #32 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +Address 0x7faa8343c1d4 is located in stack of thread T0 at offset 84 in frame + #0 0xec977f in read_xref_entry_slow /src/ghostpdl/./pdf/pdf_xref.c:563 + + This frame has 3 object(s): + [32, 33) 'c.i146' (line 528) + [48, 49) 'c.i' (line 528) + [64, 84) 'Buffer' (line 564) <== Memory access at offset 84 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:810:3 in __interceptor_memmove +Shadow bytes around the buggy address: + 0x0ff5d067f7e0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff5d067f7f0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff5d067f800: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff5d067f810: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff5d067f820: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0ff5d067f830: f1 f1 f1 f1 f8 f2 f8 f2 00 00[04]f3 f3 f3 f3 f3 + 0x0ff5d067f840: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff5d067f850: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff5d067f860: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff5d067f870: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff5d067f880: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-102.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-102.txt new file mode 100644 index 000000000..7b73e5c70 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-102.txt @@ -0,0 +1,55 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 873436319 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f9ca88719e0, 0x7f9ca8874f6c), 959 [0x7f9ca88d2a40, 0x7f9ca88d2dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f9ca8874f70,0x7f9ca88aa830), 959 [0x7f9ca88d2e00,0x7f9ca88d69f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x0000006f2ef1 bp 0x7ffe7bc03d60 sp 0x7ffe7bc03cf0 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x6f2ef1 in chunk_free_object /src/ghostpdl/./base/gsmchunk.c:1092:14 + #1 0xf78873 in pdfi_free_font_type1 /src/ghostpdl/./pdf/pdf_font1.c:825:13 + #2 0xf6a465 in pdfi_free_font /src/ghostpdl/./pdf/pdf_font.c:1330:20 + #3 0x10071df in pdfi_free_object /src/ghostpdl/./pdf/pdf_obj.c:272:13 + #4 0xf0eac7 in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:83:13 + #5 0xf0eac7 in pdfi_grestore /src/ghostpdl/./pdf/pdf_gstate.c:294:13 + #6 0xf25de4 in pdfi_form_execgroup /src/ghostpdl/./pdf/pdf_image.c:2167:16 + #7 0xfded84 in pdfi_trans_set_mask /src/ghostpdl/./pdf/pdf_trans.c:291:16 + #8 0xfded84 in pdfi_trans_set_params /src/ghostpdl/./pdf/pdf_trans.c:813:13 + #9 0xfdcfc8 in pdfi_trans_setup /src/ghostpdl/./pdf/pdf_trans.c:701:12 + #10 0xfdfd55 in pdfi_trans_setup_text /src/ghostpdl/./pdf/pdf_trans.c + #11 0xfc7275 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:898:12 + #12 0xfca3f4 in pdfi_TJ /src/ghostpdl/./pdf/pdf_text.c:1268:28 + #13 0xedcc5b in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1647:24 + #14 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #15 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #16 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #17 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #18 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #19 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #20 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #21 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #22 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #23 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #24 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #25 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #26 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #27 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #28 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #29 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #30 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #31 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #32 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #33 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #34 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #35 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #36 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #37 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #38 0x7f9ca826b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #39 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gsmchunk.c:1092:14 in chunk_free_object +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-121.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-121.txt new file mode 100644 index 000000000..09456df46 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-121.txt @@ -0,0 +1,124 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1161616276 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f13bb83f9e0, 0x7f13bb842f6c), 959 [0x7f13bb8a0a40, 0x7f13bb8a0dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f13bb842f70,0x7f13bb878830), 959 [0x7f13bb8a0e00,0x7f13bb8a49f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x63100009cd30 at pc 0x000000d2be93 bp 0x7ffdd2bd90c0 sp 0x7ffdd2bd90b8 +READ of size 1 at 0x63100009cd30 thread T0 + #0 0xd2be92 in s_hex_process /src/ghostpdl/./base/sstring.c:445:33 + #1 0xc9a208 in s_exD_process /src/ghostpdl/./base/seexec.c:168:18 + #2 0x6bdbb7 in sreadbuf /src/ghostpdl/./base/stream.c:842:22 + #3 0x6bc57c in s_process_read_buf /src/ghostpdl/./base/stream.c:768:14 + #4 0x6bc57c in spgetcc /src/ghostpdl/./base/stream.c:481:9 + #5 0xfa2b54 in ps_font_eexec_func /src/ghostpdl/./pdf/pdf_fontps.c:969:13 + #6 0xf96dd0 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:363:36 + #7 0xf9871b in pdfi_read_ps_font /src/ghostpdl/./pdf/pdf_fontps.c:1234:12 + #8 0xf742d7 in pdfi_read_type1_font /src/ghostpdl/./pdf/pdf_font1.c:538:16 + #9 0xf6019b in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:727:32 + #10 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #11 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #12 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #13 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #14 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #15 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #16 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #17 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #18 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #19 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #20 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #21 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #22 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #23 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #24 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #25 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #26 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #27 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #28 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #29 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #30 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #31 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #32 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #33 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #34 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #35 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #36 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #37 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #38 0x7f13bb239082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #39 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x63100009cd30 is located 0 bytes to the right of 66864-byte region [0x63100008c800,0x63100009cd30) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f2be8 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #5 0x6f43b8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0xf73e29 in pdfi_t1_decode_pfb /src/ghostpdl/./pdf/pdf_font1.c + #7 0xf73e29 in pdfi_read_type1_font /src/ghostpdl/./pdf/pdf_font1.c:527:16 + #8 0xf6019b in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:727:32 + #9 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #10 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #11 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #12 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #13 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #14 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #15 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #16 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #17 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #18 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #19 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #20 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #21 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #22 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #23 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #24 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #25 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #26 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #27 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #28 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #29 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #30 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #31 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #32 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #33 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #34 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #35 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #36 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #37 0x7f13bb239082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/sstring.c:445:33 in s_hex_process +Shadow bytes around the buggy address: + 0x0c628000b950: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628000b960: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628000b970: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628000b980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628000b990: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c628000b9a0: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa + 0x0c628000b9b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628000b9c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628000b9d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628000b9e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628000b9f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-177.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-177.txt new file mode 100644 index 000000000..eaca33303 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-177.txt @@ -0,0 +1,60 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 877354450 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f7ab99d69e0, 0x7f7ab99d9f6c), 959 [0x7f7ab9a37a40, 0x7f7ab9a37dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f7ab99d9f70,0x7f7ab9a0f830), 959 [0x7f7ab9a37e00,0x7f7ab9a3b9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x6310100f6f40 (pc 0x000000ad8fac bp 0x7ffd63e4d950 sp 0x7ffd63e4d8d0 T0) +==1==The signal is caused by a READ memory access. + #0 0xad8fac in gx_dc_default_fill_masked /src/ghostpdl/./base/gxdcolor.c:1068:44 + #1 0xb2899b in copy_portrait /src/ghostpdl/./base/gxifast.c:567:16 + #2 0xb26225 in image_render_simple /src/ghostpdl/./base/gxifast.c:678:20 + #3 0x137ff53 in gx_image1_plane_data /src/ghostpdl/./base/gxidata.c:238:20 + #4 0xb29dc1 in gx_image_plane_data_rows /src/ghostpdl/./base/gximage.c:171:12 + #5 0x8d9ff8 in gs_image_next_planes /src/ghostpdl/./base/gsimage.c:636:20 + #6 0x8d8dbf in gs_image_next /src/ghostpdl/./base/gsimage.c:517:12 + #7 0x9349e7 in fapi_image_uncached_glyph /src/ghostpdl/./base/gxfapi.c:941:32 + #8 0x9349e7 in gs_fapi_finish_render /src/ghostpdl/./base/gxfapi.c:1191:22 + #9 0x93bbb4 in gs_fapi_do_char /src/ghostpdl/./base/gxfapi.c:1752:16 + #10 0x13a5e0d in pdfi_fapi_build_char /src/ghostpdl/./pdf/pdf_fapi.c:1386:12 + #11 0xa8e026 in show_proceed /src/ghostpdl/./base/gxchar.c:1239:12 + #12 0xa859e0 in continue_show /src/ghostpdl/./base/gxchar.c:761:12 + #13 0xa87ecc in gx_show_text_process /src/ghostpdl/./base/gxchar.c:738:12 + #14 0x921dcf in gs_text_process /src/ghostpdl/./base/gstext.c:696:12 + #15 0xfcd032 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:516:16 + #16 0xfcd032 in pdfi_show_Tr_0 /src/ghostpdl/./pdf/pdf_text.c:531:12 + #17 0xfc75a2 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:913:24 + #18 0xfc9021 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1131:12 + #19 0xedcc33 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1643:24 + #20 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #21 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #22 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #23 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #24 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #25 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #26 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #27 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #28 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #29 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #30 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #31 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #32 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #33 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #34 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #35 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #36 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #37 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #38 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #39 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #40 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #41 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #42 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #43 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #44 0x7f7ab93d0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #45 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gxdcolor.c:1068:44 in gx_dc_default_fill_masked +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-18.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-18.txt new file mode 100644 index 000000000..a36220e51 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-18.txt @@ -0,0 +1,45 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 849230385 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7ff485be39e0, 0x7ff485be6f6c), 959 [0x7ff485c44a40, 0x7ff485c44dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7ff485be6f70,0x7ff485c1c830), 959 [0x7ff485c44e00,0x7ff485c489f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x0000ceff8001 (pc 0x0000010b87e2 bp 0x7ffce42cba90 sp 0x7ffce42cba60 T0) +==1==The signal is caused by a READ memory access. + #0 0x10b87e2 in gx_restrict_Pattern /src/ghostpdl/./base/gspcolor.c:254:35 + #1 0x10b3ae1 in gs_setcolor /src/ghostpdl/./base/gscolor2.c:105:5 + #2 0xef3eb6 in pdfi_gs_setrgbcolor /src/ghostpdl/./pdf/pdf_colour.c:380:16 + #3 0xef56a4 in pdfi_setrgbfill /src/ghostpdl/./pdf/pdf_colour.c:567:12 + #4 0xedc8ae in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1587:24 + #5 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #6 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #7 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #8 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #9 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #10 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #11 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #12 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #13 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #14 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #15 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #16 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #17 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #18 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #19 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #20 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #21 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #22 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #23 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #24 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #25 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #26 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #27 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #28 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #29 0x7ff4855dd082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #30 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gspcolor.c:254:35 in gx_restrict_Pattern +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-199.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-199.txt new file mode 100644 index 000000000..9c5fe5c8a --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-199.txt @@ -0,0 +1,92 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 880611720 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7ff92601b9e0, 0x7ff92601ef6c), 959 [0x7ff92607ca40, 0x7ff92607cdff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7ff92601ef70,0x7ff926054830), 959 [0x7ff92607ce00,0x7ff9260809f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ff924dde440 at pc 0x0000004be93e bp 0x7fff7fd22610 sp 0x7fff7fd21dd0 +READ of size 72 at 0x7ff924dde440 thread T0 + #0 0x4be93d in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xff71fd in pdf_compute_encryption_key_preR5 /src/ghostpdl/./pdf/pdf_sec.c:129:13 + #2 0xff71fd in check_user_password_preR5 /src/ghostpdl/./pdf/pdf_sec.c:442:12 + #3 0xff4252 in check_password_preR5 /src/ghostpdl/./pdf/pdf_sec.c:1227:12 + #4 0xff4252 in pdfi_initialise_Decryption /src/ghostpdl/./pdf/pdf_sec.c:1374:20 + #5 0xeacbe2 in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1075:20 + #6 0xeacbe2 in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1328:12 + #7 0xe981b4 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:642:12 + #8 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #9 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #10 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #11 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #12 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #13 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #14 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #15 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #16 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #17 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #18 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #19 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #20 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #21 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #22 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #23 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #24 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #25 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #26 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #27 0x7ff925a15082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #28 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +Address 0x7ff924dde440 is located in stack of thread T0 at offset 64 in frame + #0 0xff6a1f in check_user_password_preR5 /src/ghostpdl/./pdf/pdf_sec.c:424 + + This frame has 14 object(s): + [32, 64) 'Key.i' (line 54) + [96, 100) 'P.i' (line 56) <== Memory access at offset 64 partially underflows this variable + [112, 200) 'md5.i' (line 57) <== Memory access at offset 64 partially underflows this variable + [240, 248) 'a.i' (line 58) + [272, 280) 's.i' (line 59) + [304, 312) 'Key' (line 425) + [336, 344) 'XORKey' (line 425) + [368, 376) 'stream' (line 427) + [400, 408) 'arc4_stream' (line 427) + [432, 464) 'Buffer' (line 428) + [496, 512) 'Hash' (line 429) + [528, 616) 'md5' (line 430) + [656, 664) 's' (line 431) + [688, 696) 'a' (line 432) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x0fffa49b3c30: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fffa49b3c40: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fffa49b3c50: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fffa49b3c60: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fffa49b3c70: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0fffa49b3c80: f1 f1 f1 f1 00 00 00 00[f2]f2 f2 f2 04 f2 00 00 + 0x0fffa49b3c90: 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 00 f2 + 0x0fffa49b3ca0: f2 f2 00 f2 f2 f2 00 f2 f2 f2 00 f2 f2 f2 00 f2 + 0x0fffa49b3cb0: f2 f2 00 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 00 00 + 0x0fffa49b3cc0: f2 f2 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 + 0x0fffa49b3cd0: f2 f2 00 f2 f2 f2 00 f3 f3 f3 f3 f3 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-206.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-206.txt new file mode 100644 index 000000000..28056c3bf --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-206.txt @@ -0,0 +1,93 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 883320488 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f5f074259e0, 0x7f5f07428f6c), 959 [0x7f5f07486a40, 0x7f5f07486dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f5f07428f70,0x7f5f0745e830), 959 [0x7f5f07486e00,0x7f5f0748a9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62a000005050 at pc 0x0000004be54d bp 0x7ffdb24cb910 sp 0x7ffdb24cb0d0 +READ of size 4294967295 at 0x62a000005050 thread T0 + #0 0x4be54c in __interceptor_memmove /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:810:3 + #1 0x6bc4f8 in stream_compact /src/ghostpdl/./base/stream.c:1012:9 + #2 0x6bc4f8 in s_process_read_buf /src/ghostpdl/./base/stream.c:767:5 + #3 0x6bc4f8 in spgetcc /src/ghostpdl/./base/stream.c:481:9 + #4 0xd1585a in gs_scan_token /src/ghostpdl/./psi/iscan.c:560:11 + #5 0xcfca45 in interp /src/ghostpdl/./psi/interp.c:1502:24 + #6 0xcfca45 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #7 0xcfca45 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #8 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #9 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #10 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #11 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #12 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #13 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #14 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #15 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #16 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #17 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #18 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #19 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #20 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #21 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #22 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #23 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #24 0x7f5f06e1f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #25 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x62a000005050 is located 0 bytes to the right of 20048-byte region [0x62a000000200,0x62a000005050) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x12bd3b4 in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2488:13 + #3 0x12bc262 in alloc_add_clump /src/ghostpdl/./base/gsalloc.c:2438:19 + #4 0x12bc262 in alloc_obj /src/ghostpdl/./base/gsalloc.c:2046:17 + #5 0x12b4cc1 in i_alloc_struct /src/ghostpdl/./base/gsalloc.c:1234:15 + #6 0xdf6896 in name_alloc_sub /src/ghostpdl/./psi/iname.c:496:11 + #7 0xdf5ca8 in names_init /src/ghostpdl/./psi/iname.c:102:20 + #8 0x562015 in gs_main_init1 /src/ghostpdl/./psi/imain.c:207:14 + #9 0x101ab2e in swproc /src/ghostpdl/./psi/imainarg.c:789:29 + #10 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #11 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #12 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #13 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #14 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #15 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #16 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #17 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #18 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #19 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #20 0x7f5f06e1f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:810:3 in __interceptor_memmove +Shadow bytes around the buggy address: + 0x0c547fff89b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c547fff89c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c547fff89d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c547fff89e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c547fff89f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c547fff8a00: 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa + 0x0c547fff8a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c547fff8a20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c547fff8a30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c547fff8a40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c547fff8a50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-210.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-210.txt new file mode 100644 index 000000000..a8ae2d69b --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-210.txt @@ -0,0 +1,51 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 886230426 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7fdcc31f49e0, 0x7fdcc31f7f6c), 959 [0x7fdcc3255a40, 0x7fdcc3255dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7fdcc31f7f70,0x7fdcc322d830), 959 [0x7fdcc3255e00,0x7fdcc32599f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x62cff76fa5a0 (pc 0x000000f8c15d bp 0x7ffd5331b590 sp 0x7ffd5331b560 T0) +==1==The signal is caused by a READ memory access. + #0 0xf8c15d in u16 /src/ghostpdl/./pdf/pdf_font1C.c:528:13 + #1 0xf8c15d in pdfi_count_cff_index /src/ghostpdl/./pdf/pdf_font1C.c:1079:13 + #2 0xf7e8a4 in pdfi_read_cff /src/ghostpdl/./pdf/pdf_font1C.c:1546:9 + #3 0xf7e8a4 in pdfi_read_cff_font /src/ghostpdl/./pdf/pdf_font1C.c:2132:20 + #4 0xf60137 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:731:32 + #5 0xf6f616 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:277:16 + #6 0xf5f974 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #7 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #8 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #9 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #10 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #11 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #12 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #13 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #14 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #15 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #16 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #24 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #25 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #26 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #27 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #30 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7fdcc2bee082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_font1C.c:528:13 in u16 +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-218.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-218.txt new file mode 100644 index 000000000..2e02eb4e3 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-218.txt @@ -0,0 +1,46 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 888995288 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7fb2639a69e0, 0x7fb2639a9f6c), 959 [0x7fb263a07a40, 0x7fb263a07dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7fb2639a9f70,0x7fb2639df830), 959 [0x7fb263a07e00,0x7fb263a0b9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000055 (pc 0x00000100714f bp 0x7ffe7e0cbc10 sp 0x7ffe7e0cbbe0 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: address points to the zero page. + #0 0x100714f in pdfi_free_keyword /src/ghostpdl/./pdf/pdf_obj.c:219:9 + #1 0x100714f in pdfi_free_object /src/ghostpdl/./pdf/pdf_obj.c:266:13 + #2 0xf1fd5e in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:83:13 + #3 0xf1fd5e in pdfi_pop /src/ghostpdl/./pdf/pdf_stack.c:35:9 + #4 0xf1fd5e in pdfi_clearstack /src/ghostpdl/./pdf/pdf_stack.c:96:5 + #5 0x10046f9 in pdfi_repair_file /src/ghostpdl/./pdf/pdf_repair.c + #6 0xec6020 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1117:16 + #7 0xeaca4c in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1051:12 + #8 0xeaca4c in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1328:12 + #9 0xe981b4 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:642:12 + #10 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #11 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #12 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #13 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #14 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #15 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #16 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #17 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #18 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #19 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #20 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #21 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #22 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #23 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #24 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #25 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #26 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #27 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #28 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #29 0x7fb2633a0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #30 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_obj.c:219:9 in pdfi_free_keyword +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-229.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-229.txt new file mode 100644 index 000000000..79ef34c06 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-229.txt @@ -0,0 +1,47 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1164373763 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f0e81de49e0, 0x7f0e81de7f6c), 959 [0x7f0e81e45a40, 0x7f0e81e45dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f0e81de7f70,0x7f0e81e1d830), 959 [0x7f0e81e45e00,0x7f0e81e499f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x62a10032dc6b (pc 0x00000053b5d0 bp 0x7ffd1ed515f0 sp 0x7ffd1ed50da0 T0) +==1==The signal is caused by a READ memory access. + #0 0x53b5d0 in __sanitizer::internal_memmove(void*, void const*, unsigned long) /src/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_libc.cpp:68:16 + #1 0x4be6bf in __interceptor_memmove /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:810:3 + #2 0x6bd0a0 in stream_move /src/ghostpdl/./base/stream.c:999:5 + #3 0x6bd0a0 in sgets /src/ghostpdl/./base/stream.c:547:13 + #4 0xee4c09 in pdfi_read_bytes /src/ghostpdl/./pdf/pdf_file.c:1471:16 + #5 0xece2d9 in pdfi_skip_white /src/ghostpdl/./pdf/pdf_int.c:115:17 + #6 0xece2d9 in pdfi_read_token /src/ghostpdl/./pdf/pdf_int.c:1002:5 + #7 0xedae6b in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2076:16 + #8 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #9 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #10 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #11 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #12 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #13 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #14 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #15 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #16 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #17 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #18 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #19 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #20 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #21 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #22 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #23 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #24 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #25 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #26 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #27 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #28 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #29 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #30 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #31 0x7f0e817de082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #32 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_libc.cpp:68:16 in __sanitizer::internal_memmove(void*, void const*, unsigned long) +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-232.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-232.txt new file mode 100644 index 000000000..b7ebf80c4 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-232.txt @@ -0,0 +1,122 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4022769338 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f2c45b899e0, 0x7f2c45b8cf6c), 959 [0x7f2c45beaa40, 0x7f2c45beadff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f2c45b8cf70,0x7f2c45bc2830), 959 [0x7f2c45beae00,0x7f2c45bee9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 1000 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62a00036b050 at pc 0x0000004be93e bp 0x7ffd5b02e0d0 sp 0x7ffd5b02d890 +READ of size 19603344 at 0x62a00036b050 thread T0 + #0 0x4be93d in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0x13ab57d in pdfi_fapi_get_glyph /src/ghostpdl/./pdf/pdf_fapi.c:1187:21 + #2 0x9476a8 in get_fapi_glyph_data /src/ghostpdl/./base/fapi_ft.c:428:22 + #3 0x995635 in cff_get_glyph_data /src/ghostpdl/./freetype/src/cff/cffgload.c:56:19 + #4 0x995635 in cff_slot_load /src/ghostpdl/./freetype/src/cff/cffgload.c:417:15 + #5 0x9912fa in cff_glyph_load /src/ghostpdl/./freetype/src/cff/cffdrivr.c:192:13 + #6 0x95c6c7 in FT_Load_Glyph /src/ghostpdl/./freetype/src/base/ftobjs.c:987:15 + #7 0x948796 in load_glyph /src/ghostpdl/./base/fapi_ft.c:688:24 + #8 0x944a44 in gs_fapi_ft_get_char_raster_metrics /src/ghostpdl/./base/fapi_ft.c:1558:9 + #9 0x9399b2 in gs_fapi_do_char /src/ghostpdl/./base/gxfapi.c:1570:16 + #10 0x13a5e0d in pdfi_fapi_build_char /src/ghostpdl/./pdf/pdf_fapi.c:1386:12 + #11 0xa8e026 in show_proceed /src/ghostpdl/./base/gxchar.c:1239:12 + #12 0xa859e0 in continue_show /src/ghostpdl/./base/gxchar.c:761:12 + #13 0xa87ecc in gx_show_text_process /src/ghostpdl/./base/gxchar.c:738:12 + #14 0x921dcf in gs_text_process /src/ghostpdl/./base/gstext.c:696:12 + #15 0xfcd032 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:516:16 + #16 0xfcd032 in pdfi_show_Tr_0 /src/ghostpdl/./pdf/pdf_text.c:531:12 + #17 0xfc75a2 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:913:24 + #18 0xfc9021 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1131:12 + #19 0xedcc33 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1643:24 + #20 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #21 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #22 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #23 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #24 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #25 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #26 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #27 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #28 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #29 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #30 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #31 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #32 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #33 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #34 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #35 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #36 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #37 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #38 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #39 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #40 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #41 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #42 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #43 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #44 0x7f2c45583082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #45 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x62a00036b050 is located 0 bytes to the right of 20048-byte region [0x62a000366200,0x62a00036b050) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x12bd3b4 in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2488:13 + #3 0x12bc262 in alloc_add_clump /src/ghostpdl/./base/gsalloc.c:2438:19 + #4 0x12bc262 in alloc_obj /src/ghostpdl/./base/gsalloc.c:2046:17 + #5 0x12b5531 in i_alloc_struct_array /src/ghostpdl/./base/gsalloc.c:1365:11 + #6 0xb1917f in gx_ht_alloc_cache /src/ghostpdl/./base/gxht.c:144:9 + #7 0x8ce5e3 in gx_gstate_dev_ht_install /src/ghostpdl/./base/gsht.c:1074:22 + #8 0x8d0a36 in gx_ht_install /src/ghostpdl/./base/gsht.c:1224:12 + #9 0xc6e85d in setcolorscreen_finish /src/ghostpdl/./psi/zht1.c:118:12 + #10 0xcfaf9c in interp /src/ghostpdl/./psi/interp.c:1351:28 + #11 0xcfaf9c in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #12 0xcfaf9c in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #13 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #14 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #15 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #16 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #17 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #18 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #19 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #20 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #21 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #22 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #23 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #24 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #25 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #26 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #27 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #28 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #29 0x7f2c45583082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x0c54800655b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c54800655c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c54800655d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c54800655e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c54800655f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c5480065600: 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa + 0x0c5480065610: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5480065620: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5480065630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5480065640: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5480065650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-270.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-270.txt new file mode 100644 index 000000000..bbb795b7d --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-270.txt @@ -0,0 +1,100 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 891713207 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f06359bb9e0, 0x7f06359bef6c), 959 [0x7f0635a1ca40, 0x7f0635a1cdff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f06359bef70,0x7f06359f4830), 959 [0x7f0635a1ce00,0x7f0635a209f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f0634769444 at pc 0x0000010335f2 bp 0x7ffc3f07f4c0 sp 0x7ffc3f07f4b8 +WRITE of size 4 at 0x7f0634769444 thread T0 + #0 0x10335f1 in fn_ElIn_evaluate /src/ghostpdl/./base/gsfunc3.c:121:16 + #1 0xf1b20f in pdfi_set_gray_transfer /src/ghostpdl/./pdf/pdf_gstate.c:1015:16 + #2 0xf1b20f in pdfi_set_transfer /src/ghostpdl/./pdf/pdf_gstate.c:1057:16 + #3 0xf12176 in GS_TR /src/ghostpdl/./pdf/pdf_gstate.c:1072:12 + #4 0xf19177 in pdfi_set_ExtGState /src/ghostpdl/./pdf/pdf_gstate.c:2318:20 + #5 0xf19177 in pdfi_setgstate /src/ghostpdl/./pdf/pdf_gstate.c:2358:12 + #6 0xedc9d6 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1515:24 + #7 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #8 0xed904d in pdfi_interpret_inner_content /src/ghostpdl/./pdf/pdf_int.c:1927:12 + #9 0xed904d in pdfi_interpret_inner_content_stream /src/ghostpdl/./pdf/pdf_int.c:2026:12 + #10 0xed904d in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1873:12 + #11 0xf25da1 in pdfi_form_execgroup /src/ghostpdl/./pdf/pdf_image.c:2161:12 + #12 0xf26e3d in pdfi_do_form /src/ghostpdl/./pdf/pdf_image.c:2395:16 + #13 0xf274a0 in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2493:16 + #14 0xf27c9f in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2571:12 + #15 0xedcab8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1472:24 + #16 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #17 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #18 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #19 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #20 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #21 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #22 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #23 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #24 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #25 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #26 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #27 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #28 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #29 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #30 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #31 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #32 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #33 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #34 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #35 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #36 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #37 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #38 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #39 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #40 0x7f06353b5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #41 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +Address 0x7f0634769444 is located in stack of thread T0 at offset 68 in frame + #0 0xf1aa7f in pdfi_set_transfer /src/ghostpdl/./pdf/pdf_gstate.c:1030 + + This frame has 9 object(s): + [32, 40) 'pfn.i43' (line 1000) + [64, 68) 'v.i44' (line 1011) <== Memory access at offset 68 overflows this variable + [80, 84) 'f.i45' (line 1011) + [96, 104) 'o.i' (line 889) + [128, 144) 'proc_types.i' (line 890) + [160, 192) 'map_procs.i' (line 891) + [224, 256) 'pfn.i' (line 892) + [288, 292) 'v.i' (line 959) + [304, 308) 'f.i' (line 959) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ghostpdl/./base/gsfunc3.c:121:16 in fn_ElIn_evaluate +Shadow bytes around the buggy address: + 0x0fe1468e5230: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe1468e5240: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe1468e5250: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe1468e5260: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe1468e5270: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0fe1468e5280: f1 f1 f1 f1 00 f2 f2 f2[04]f2 04 f2 f8 f2 f2 f2 + 0x0fe1468e5290: f8 f8 f2 f2 f8 f8 f8 f8 f2 f2 f2 f2 f8 f8 f8 f8 + 0x0fe1468e52a0: f2 f2 f2 f2 f8 f2 f8 f3 00 00 00 00 00 00 00 00 + 0x0fe1468e52b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe1468e52c0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe1468e52d0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-271.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-271.txt new file mode 100644 index 000000000..b50febec0 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-271.txt @@ -0,0 +1,58 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1167314822 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7ffb5ff4d9e0, 0x7ffb5ff50f6c), 959 [0x7ffb5ffaea40, 0x7ffb5ffaedff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7ffb5ff50f70,0x7ffb5ff86830), 959 [0x7ffb5ffaee00,0x7ffb5ffb29f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x4074000005dc (pc 0x00000060ef50 bp 0x7ffc0d4b3bf0 sp 0x7ffc0d4b3ba0 T0) +==1==The signal is caused by a READ memory access. + #0 0x60ef50 in pdf14_buf_free /src/ghostpdl/./base/gdevp14.c:1175:45 + #1 0x60ee2b in rc_pdf14_maskbuf_free /src/ghostpdl/./base/gdevp14.c:1203:9 + #2 0x62a083 in pdf14_free_mask_stack /src/ghostpdl/./base/gdevp14.c:1899:21 + #3 0x607b82 in pdf14_pop_transparency_mask /src/ghostpdl/./base/gdevp14.c:1976:17 + #4 0x607b82 in pdf14_end_transparency_mask /src/ghostpdl/./base/gdevp14.c:7621:10 + #5 0x5b9515 in gx_end_transparency_mask /src/ghostpdl/./base/gstrans.c:745:12 + #6 0x623520 in gx_update_pdf14_compositor /src/ghostpdl/./base/gdevp14.c:5970:20 + #7 0x602296 in pdf14_composite /src/ghostpdl/./base/gdevp14.c:6052:16 + #8 0x11b7db6 in apply_composite /src/ghostpdl/./base/gxclrast.c:3083:12 + #9 0x11b7db6 in execute_compositor_queue /src/ghostpdl/./base/gxclrast.c:395:16 + #10 0x11a911d in clist_playback_band /src/ghostpdl/./base/gxclrast.c:1789:48 + #11 0x68e64c in clist_playback_file_bands /src/ghostpdl/./base/gxclread.c:1035:16 + #12 0x692ca0 in clist_render_rectangle /src/ghostpdl/./base/gxclread.c:969:16 + #13 0x69207a in clist_rasterize_lines /src/ghostpdl/./base/gxclread.c:858:20 + #14 0x69123f in clist_get_bits_rectangle /src/ghostpdl/./base/gxclread.c:747:12 + #15 0x66581a in gdev_prn_get_bits /src/ghostpdl/./base/gdevprn.c:1636:12 + #16 0x7ec824 in cups_print_chunked /src/ghostpdl/./cups/gdevcups.c:4849:9 + #17 0x7db10b in cups_print_pages /src/ghostpdl/./cups/gdevcups.c + #18 0x6616a9 in gdev_prn_output_page_aux /src/ghostpdl/./base/gdevprn.c:1049:27 + #19 0x660965 in gdev_prn_output_page /src/ghostpdl/./base/gdevprn.c:1085:12 + #20 0x7ebfd9 in cups_output_page /src/ghostpdl/./cups/gdevcups.c:2826:15 + #21 0x8a6e3f in gs_output_page /src/ghostpdl/./base/gsdevice.c:207:17 + #22 0xdcc0d2 in zoutputpage /src/ghostpdl/./psi/zdevice.c:416:12 + #23 0xcfaf9c in interp /src/ghostpdl/./psi/interp.c:1351:28 + #24 0xcfaf9c in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #25 0xcfaf9c in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #26 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #27 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #28 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #29 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #30 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #31 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #32 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #33 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #34 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #35 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #36 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #37 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #38 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #39 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #40 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #41 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #42 0x7ffb5f947082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #43 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gdevp14.c:1175:45 in pdf14_buf_free +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-278.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-278.txt new file mode 100644 index 000000000..3727fb908 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-278.txt @@ -0,0 +1,58 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 894714273 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7fa5ae72b9e0, 0x7fa5ae72ef6c), 959 [0x7fa5ae78ca40, 0x7fa5ae78cdff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7fa5ae72ef70,0x7fa5ae764830), 959 [0x7fa5ae78ce00,0x7fa5ae7909f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x629ff036cd50 (pc 0x000000718f2e bp 0x7ffe69a7e690 sp 0x7ffe69a7e5a0 T0) +==1==The signal is caused by a READ memory access. + #0 0x718f2e in s_RLE_process /src/ghostpdl/./base/srle.c:150:22 + #1 0x1192e80 in go_process /src/ghostpdl/./base/gxclbits.c:76:18 + #2 0x1192e80 in cmd_compress_bitmap /src/ghostpdl/./base/gxclbits.c:107:22 + #3 0x1192e80 in cmd_put_bits /src/ghostpdl/./base/gxclbits.c:229:22 + #4 0x69e8eb in clist_copy_mono /src/ghostpdl/./base/gxclrect.c:857:16 + #5 0x102b002 in mask_clip_fill_rectangle /src/ghostpdl/./base/gxclipm.c:165:12 + #6 0xad48ac in gx_dc_pure_fill_rectangle /src/ghostpdl/./base/gxdcolor.c:842:16 + #7 0x59e1f8 in image_render_color_DeviceN /src/ghostpdl/./base/gxicolor.c + #8 0x137ff53 in gx_image1_plane_data /src/ghostpdl/./base/gxidata.c:238:20 + #9 0xb29dc1 in gx_image_plane_data_rows /src/ghostpdl/./base/gximage.c:171:12 + #10 0x573f15 in gx_image3_plane_data /src/ghostpdl/./base/gximage3.c:672:16 + #11 0xb29dc1 in gx_image_plane_data_rows /src/ghostpdl/./base/gximage.c:171:12 + #12 0x8d9ff8 in gs_image_next_planes /src/ghostpdl/./base/gsimage.c:636:20 + #13 0xf2e54d in pdfi_render_image /src/ghostpdl/./pdf/pdf_image.c:825:16 + #14 0xf24478 in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:2023:12 + #15 0xf2739e in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2485:16 + #16 0xf27c9f in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2571:12 + #17 0xedcab8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1472:24 + #18 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #19 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #20 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #21 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #22 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #23 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #24 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #25 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #26 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #27 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #28 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #29 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #30 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #31 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #32 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #33 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #34 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #35 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #36 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #37 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #38 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #39 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #40 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #41 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #42 0x7fa5ae125082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #43 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/srle.c:150:22 in s_RLE_process +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-3.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-3.txt new file mode 100644 index 000000000..80683a26a --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-3.txt @@ -0,0 +1,49 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 845536356 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f5f2ab579e0, 0x7f5f2ab5af6c), 959 [0x7f5f2abb8a40, 0x7f5f2abb8dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f5f2ab5af70,0x7f5f2ab90830), 959 [0x7f5f2abb8e00,0x7f5f2abbc9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x00013fff8001 (pc 0x000000ebe6c4 bp 0x7fffcec07300 sp 0x7fffcec072b0 T0) +==1==The signal is caused by a READ memory access. + #0 0xebe6c4 in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:56:18 + #1 0xebe6c4 in pdfi_free_array /src/ghostpdl/./pdf/pdf_array.c:34:13 + #2 0x10073c9 in pdfi_free_object /src/ghostpdl/./pdf/pdf_obj.c:257:13 + #3 0xeb2c3e in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:83:13 + #4 0xeb2c3e in pdfi_free_dict /src/ghostpdl/./pdf/pdf_dict.c:41:13 + #5 0x10071cb in pdfi_free_object /src/ghostpdl/./pdf/pdf_obj.c:260:13 + #6 0xf78083 in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:83:13 + #7 0xf78083 in pdfi_free_font_type1 /src/ghostpdl/./pdf/pdf_font1.c:804:5 + #8 0xf6a465 in pdfi_free_font /src/ghostpdl/./pdf/pdf_font.c:1330:20 + #9 0x10071df in pdfi_free_object /src/ghostpdl/./pdf/pdf_obj.c:272:13 + #10 0xea743e in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:83:13 + #11 0xea743e in pdfi_clear_context /src/ghostpdl/./pdf/ghostpdf.c:1933:13 + #12 0xeb0d80 in pdfi_free_context /src/ghostpdl/./pdf/ghostpdf.c:1967:5 + #13 0xe98791 in zPDFclose /src/ghostpdl/./psi/zpdfops.c:724:16 + #14 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #15 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #16 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #17 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #18 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #19 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #20 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #21 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #22 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #23 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #24 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #25 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #26 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #27 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #28 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #29 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #30 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #31 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #32 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #33 0x7f5f2a551082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #34 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_stack.h:56:18 in pdfi_countdown_impl +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-301.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-301.txt new file mode 100644 index 000000000..417555c03 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-301.txt @@ -0,0 +1,144 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1170330388 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f31f9bb49e0, 0x7f31f9bb7f6c), 959 [0x7f31f9c15a40, 0x7f31f9c15dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f31f9bb7f70,0x7f31f9bed830), 959 [0x7f31f9c15e00,0x7f31f9c199f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f31f47634e8 at pc 0x0000005dc256 bp 0x7ffe472b4b10 sp 0x7ffe472b4b08 +READ of size 1 at 0x7f31f47634e8 thread T0 + #0 0x5dc255 in template_compose_group /src/ghostpdl/./base/gxblend.c:2984:40 + #1 0x5d91d9 in compose_group_nonknockout_noblend_general /src/ghostpdl/./base/gxblend.c:3367:5 + #2 0x5cd0b6 in do_compose_group /src/ghostpdl/./base/gxblend.c:3595:5 + #3 0x5cd0b6 in pdf14_compose_group /src/ghostpdl/./base/gxblend.c:4391:9 + #4 0x61f782 in pdf14_pop_transparency_group /src/ghostpdl/./base/gdevp14.c:1751:13 + #5 0x5fc799 in pdf14_tile_pattern_fill /src/ghostpdl/./base/gdevp14.c:5213:16 + #6 0x5fc799 in pdf14_fill_path /src/ghostpdl/./base/gdevp14.c:4131:20 + #7 0xb6fc3f in gx_fill_path /src/ghostpdl/./base/gxpaint.c:53:12 + #8 0x8fd430 in do_fill /src/ghostpdl/./base/gspaint.c:339:12 + #9 0x8fd430 in fill_with_rule /src/ghostpdl/./base/gspaint.c:373:16 + #10 0x8fc9cb in gs_fill /src/ghostpdl/./base/gspaint.c:384:12 + #11 0xeee446 in pdfi_fill_inner /src/ghostpdl/./pdf/pdf_path.c:137:20 + #12 0xeee142 in pdfi_fill /src/ghostpdl/./pdf/pdf_path.c:154:12 + #13 0xedc756 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c + #14 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #15 0xed904d in pdfi_interpret_inner_content /src/ghostpdl/./pdf/pdf_int.c:1927:12 + #16 0xed904d in pdfi_interpret_inner_content_stream /src/ghostpdl/./pdf/pdf_int.c:2026:12 + #17 0xed904d in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1873:12 + #18 0xf0ce19 in pdfi_pattern_paint_stream /src/ghostpdl/./pdf/pdf_pattern.c:182:12 + #19 0xf0ce19 in pdfi_pattern_paint /src/ghostpdl/./pdf/pdf_pattern.c:223:12 + #20 0xf0ce19 in pdfi_pattern_paintproc /src/ghostpdl/./pdf/pdf_pattern.c:340:16 + #21 0x596cba in gx_pattern_load /src/ghostpdl/./base/gxpcmap.c:1507:12 + #22 0x597aa0 in gs_pattern1_remap_color /src/ghostpdl/./base/gxpcmap.c:1653:12 + #23 0x10b89f4 in gx_remap_Pattern /src/ghostpdl/./base/gspcolor.c:229:9 + #24 0xab3df4 in gx_remap_color /src/ghostpdl/./base/gxcmap.c:572:16 + #25 0x8fd036 in do_fill /src/ghostpdl/./base/gspaint.c:302:12 + #26 0x8fd036 in fill_with_rule /src/ghostpdl/./base/gspaint.c:373:16 + #27 0x8fc9cb in gs_fill /src/ghostpdl/./base/gspaint.c:384:12 + #28 0xeee446 in pdfi_fill_inner /src/ghostpdl/./pdf/pdf_path.c:137:20 + #29 0xeee142 in pdfi_fill /src/ghostpdl/./pdf/pdf_path.c:154:12 + #30 0xedc756 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c + #31 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #32 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #33 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #34 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #35 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #36 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #37 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #38 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #39 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #40 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #41 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #42 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #43 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #44 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #45 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #46 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #47 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #48 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #49 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #50 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #51 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #52 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #53 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #54 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #55 0x7f31f95ae082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #56 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x7f31f47634e8 is located 0 bytes to the right of 2473192-byte region [0x7f31f4507800,0x7f31f47634e8) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x12bd3b4 in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2488:13 + #3 0x12bb8e0 in alloc_obj /src/ghostpdl/./base/gsalloc.c:1952:13 + #4 0x12b45c6 in i_alloc_bytes /src/ghostpdl/./base/gsalloc.c:1179:15 + #5 0x614e0e in pdf14_buf_new /src/ghostpdl/./base/gdevp14.c:1140:24 + #6 0x61db1f in pdf14_push_transparency_group /src/ghostpdl/./base/gdevp14.c:1477:11 + #7 0x5fc0ce in pdf14_tile_pattern_fill /src/ghostpdl/./base/gdevp14.c:5117:16 + #8 0x5fc0ce in pdf14_fill_path /src/ghostpdl/./base/gdevp14.c:4131:20 + #9 0xb6fc3f in gx_fill_path /src/ghostpdl/./base/gxpaint.c:53:12 + #10 0x8fd430 in do_fill /src/ghostpdl/./base/gspaint.c:339:12 + #11 0x8fd430 in fill_with_rule /src/ghostpdl/./base/gspaint.c:373:16 + #12 0x8fc9cb in gs_fill /src/ghostpdl/./base/gspaint.c:384:12 + #13 0xeee446 in pdfi_fill_inner /src/ghostpdl/./pdf/pdf_path.c:137:20 + #14 0xeee142 in pdfi_fill /src/ghostpdl/./pdf/pdf_path.c:154:12 + #15 0xedc756 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c + #16 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #17 0xed904d in pdfi_interpret_inner_content /src/ghostpdl/./pdf/pdf_int.c:1927:12 + #18 0xed904d in pdfi_interpret_inner_content_stream /src/ghostpdl/./pdf/pdf_int.c:2026:12 + #19 0xed904d in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1873:12 + #20 0xf0ce19 in pdfi_pattern_paint_stream /src/ghostpdl/./pdf/pdf_pattern.c:182:12 + #21 0xf0ce19 in pdfi_pattern_paint /src/ghostpdl/./pdf/pdf_pattern.c:223:12 + #22 0xf0ce19 in pdfi_pattern_paintproc /src/ghostpdl/./pdf/pdf_pattern.c:340:16 + #23 0x596cba in gx_pattern_load /src/ghostpdl/./base/gxpcmap.c:1507:12 + #24 0x597aa0 in gs_pattern1_remap_color /src/ghostpdl/./base/gxpcmap.c:1653:12 + #25 0x10b89f4 in gx_remap_Pattern /src/ghostpdl/./base/gspcolor.c:229:9 + #26 0xab3df4 in gx_remap_color /src/ghostpdl/./base/gxcmap.c:572:16 + #27 0x8fd036 in do_fill /src/ghostpdl/./base/gspaint.c:302:12 + #28 0x8fd036 in fill_with_rule /src/ghostpdl/./base/gspaint.c:373:16 + #29 0x8fc9cb in gs_fill /src/ghostpdl/./base/gspaint.c:384:12 + #30 0xeee446 in pdfi_fill_inner /src/ghostpdl/./pdf/pdf_path.c:137:20 + #31 0xeee142 in pdfi_fill /src/ghostpdl/./pdf/pdf_path.c:154:12 + #32 0xedc756 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c + #33 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #34 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #35 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #36 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #37 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #38 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #39 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #40 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/gxblend.c:2984:40 in template_compose_group +Shadow bytes around the buggy address: + 0x0fe6be8e4640: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe6be8e4650: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe6be8e4660: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe6be8e4670: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe6be8e4680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fe6be8e4690: 00 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa fa + 0x0fe6be8e46a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fe6be8e46b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fe6be8e46c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fe6be8e46d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fe6be8e46e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-339.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-339.txt new file mode 100644 index 000000000..03f7b3940 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-339.txt @@ -0,0 +1,127 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3097674225 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f22fb8459e0, 0x7f22fb848f6c), 959 [0x7f22fb8a6a40, 0x7f22fb8a6dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f22fb848f70,0x7f22fb87e830), 959 [0x7f22fb8a6e00,0x7f22fb8aa9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 100 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x62a00031bcb0 at pc 0x000000def27c bp 0x7ffd130a0930 sp 0x7ffd130a0928 +READ of size 2 at 0x62a00031bcb0 thread T0 + #0 0xdef27b in gc_trace /src/ghostpdl/./psi/igc.c:915:17 + #1 0xde9b3c in gs_gc_reclaim /src/ghostpdl/./psi/igc.c:338:21 + #2 0xd10d24 in gs_vmreclaim /src/ghostpdl/./psi/ireclaim.c:165:9 + #3 0xd10d24 in ireclaim /src/ghostpdl/./psi/ireclaim.c:80:12 + #4 0xcf9b26 in interp_reclaim /src/ghostpdl/./psi/interp.c:452:12 + #5 0x569790 in gs_main_finit /src/ghostpdl/./psi/imain.c:1281:20 + #6 0x56b223 in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #7 0x56b223 in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #8 0xce78c5 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #9 0x55f5b0 in gsapi_exit /src/ghostpdl/./psi/iapi.c:420:12 + #10 0x55e474 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:104:8 + #11 0x55e474 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #12 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #13 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #14 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #15 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #16 0x7f22fb23f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #17 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x62a00031bcb0 is located 15024 bytes inside of 20048-byte region [0x62a000318200,0x62a00031d050) +freed by thread T0 here: + #0 0x524bc2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:111:3 + #1 0x8e6e4b in gs_heap_free_object /src/ghostpdl/./base/gsmalloc.c:366:5 + #2 0x12b3915 in alloc_free_clump /src/ghostpdl/./base/gsalloc.c:2639:9 + #3 0x12b3915 in free_all_not_allocator /src/ghostpdl/./base/gsalloc.c:993:9 + #4 0x12b3915 in clump_splay_app /src/ghostpdl/./base/gsalloc.c:606:19 + #5 0x12b3915 in i_free_all /src/ghostpdl/./base/gsalloc.c:1029:9 + #6 0xdfec02 in restore_free /src/ghostpdl/./psi/isave.c:1000:5 + #7 0xdfec02 in restore_space /src/ghostpdl/./psi/isave.c:850:5 + #8 0xdfec02 in alloc_restore_step_in /src/ghostpdl/./psi/isave.c:787:9 + #9 0xd755a8 in dorestore /src/ghostpdl/./psi/zvmem.c:193:16 + #10 0xcde3a8 in z2restore /src/ghostpdl/./psi/zdevice2.c:373:12 + #11 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #12 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #13 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #14 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #15 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #16 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #17 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #18 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #19 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #20 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #21 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #22 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #23 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #24 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #25 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #26 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #27 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #28 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #29 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #30 0x7f22fb23f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +previously allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x12bd3b4 in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2488:13 + #3 0x12bc262 in alloc_add_clump /src/ghostpdl/./base/gsalloc.c:2438:19 + #4 0x12bc262 in alloc_obj /src/ghostpdl/./base/gsalloc.c:2046:17 + #5 0x12b4cc1 in i_alloc_struct /src/ghostpdl/./base/gsalloc.c:1234:15 + #6 0xdfb1fa in alloc_save_space /src/ghostpdl/./psi/isave.c:443:12 + #7 0xdfa6b9 in alloc_save_state /src/ghostpdl/./psi/isave.c:341:27 + #8 0xd74c4a in zsave /src/ghostpdl/./psi/zvmem.c:75:12 + #9 0xcdd412 in z2save /src/ghostpdl/./psi/zdevice2.c:220:16 + #10 0xcfaf9c in interp /src/ghostpdl/./psi/interp.c:1351:28 + #11 0xcfaf9c in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #12 0xcfaf9c in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #13 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #14 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #15 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #16 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #17 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #18 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #19 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #20 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #21 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #22 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #23 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #24 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #25 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #26 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #27 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #28 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #29 0x7f22fb23f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/ghostpdl/./psi/igc.c:915:17 in gc_trace +Shadow bytes around the buggy address: + 0x0c548005b740: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c548005b750: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c548005b760: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c548005b770: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c548005b780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0c548005b790: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd + 0x0c548005b7a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c548005b7b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c548005b7c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c548005b7d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c548005b7e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-351.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-351.txt new file mode 100644 index 000000000..141cada92 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-351.txt @@ -0,0 +1,37 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1091420279 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f5d5cf639e0, 0x7f5d5cf66f6c), 959 [0x7f5d5cfc4a40, 0x7f5d5cfc4dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f5d5cf66f70,0x7f5d5cf9c830), 959 [0x7f5d5cfc4e00,0x7f5d5cfc89f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x6330000008e9 (pc 0x000000d1ebef bp 0x7fff184ee4f0 sp 0x7fff184ee4a0 T0) +==1==The signal is caused by a READ memory access. + #0 0xd1ebef in ref_stack_counttomark /src/ghostpdl/./psi/istack.c:253:17 + #1 0xd6c17f in zcounttomark /src/ghostpdl/./psi/zstack.c:291:18 + #2 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #3 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #4 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #5 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #6 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #7 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #8 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #9 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #10 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #11 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #12 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #13 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #14 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #15 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #16 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #17 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #18 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #19 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #20 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #21 0x7f5d5c95d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #22 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./psi/istack.c:253:17 in ref_stack_counttomark +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-390.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-390.txt new file mode 100644 index 000000000..5e5f311c0 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-390.txt @@ -0,0 +1,120 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1094251963 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7fa020a049e0, 0x7fa020a07f6c), 959 [0x7fa020a65a40, 0x7fa020a65dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7fa020a07f70,0x7fa020a3d830), 959 [0x7fa020a65e00,0x7fa020a699f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62d00003a7d0 at pc 0x000000cd52d0 bp 0x7ffeadfd1490 sp 0x7ffeadfd1488 +READ of size 1 at 0x62d00003a7d0 thread T0 + #0 0xcd52cf in s_PFBD_process /src/ghostpdl/./base/sfilter1.c:105:25 + #1 0x6bdbb7 in sreadbuf /src/ghostpdl/./base/stream.c:842:22 + #2 0x6bc57c in s_process_read_buf /src/ghostpdl/./base/stream.c:768:14 + #3 0x6bc57c in spgetcc /src/ghostpdl/./base/stream.c:481:9 + #4 0xf73b04 in pdfi_t1_decode_pfb /src/ghostpdl/./pdf/pdf_font1.c:378:17 + #5 0xf73b04 in pdfi_read_type1_font /src/ghostpdl/./pdf/pdf_font1.c:527:16 + #6 0xf6019b in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:727:32 + #7 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #8 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #9 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #10 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #11 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #12 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #13 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #14 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #15 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #16 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #24 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #25 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #26 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #27 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #30 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7fa0203fe082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x62d00003a7d0 is located 0 bytes to the right of 33744-byte region [0x62d000032400,0x62d00003a7d0) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f2be8 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #5 0x6f43b8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0xee73ca in pdfi_stream_to_buffer /src/ghostpdl/./pdf/pdf_file.c:1541:14 + #7 0xf5fb66 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:699:20 + #8 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #9 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #10 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #11 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #12 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #13 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #14 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #15 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #16 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #17 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #18 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #19 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #20 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #21 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #22 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #23 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #24 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #25 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #26 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #27 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #28 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #29 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #30 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #31 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #32 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #33 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #34 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #35 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #36 0x7fa0203fe082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/sfilter1.c:105:25 in s_PFBD_process +Shadow bytes around the buggy address: + 0x0c5a7ffff4a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c5a7ffff4b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c5a7ffff4c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c5a7ffff4d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c5a7ffff4e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c5a7ffff4f0: 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa + 0x0c5a7ffff500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5a7ffff510: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5a7ffff520: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5a7ffff530: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5a7ffff540: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-415.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-415.txt new file mode 100644 index 000000000..7fd8a71f3 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-415.txt @@ -0,0 +1,41 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1097218700 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7fb24db819e0, 0x7fb24db84f6c), 959 [0x7fb24dbe2a40, 0x7fb24dbe2dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7fb24db84f70,0x7fb24dbba830), 959 [0x7fb24dbe2e00,0x7fb24dbe69f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x00009fff8006 (pc 0x00000100728f bp 0x7ffe815fd1e0 sp 0x7ffe815fd1b0 T0) +==1==The signal is caused by a READ memory access. + #0 0x100728f in pdfi_free_xref_table /src/ghostpdl/./pdf/pdf_obj.c:227:5 + #1 0x100728f in pdfi_free_object /src/ghostpdl/./pdf/pdf_obj.c:269:13 + #2 0xea6b9e in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:83:13 + #3 0xea6b9e in pdfi_clear_context /src/ghostpdl/./pdf/ghostpdf.c:1836:9 + #4 0xeb0d80 in pdfi_free_context /src/ghostpdl/./pdf/ghostpdf.c:1967:5 + #5 0xe98791 in zPDFclose /src/ghostpdl/./psi/zpdfops.c:724:16 + #6 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #10 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #12 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #13 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #14 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #15 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #16 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #17 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #19 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #20 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #21 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #22 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #23 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #24 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7fb24d57b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #26 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_obj.c:227:5 in pdfi_free_xref_table +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-417.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-417.txt new file mode 100644 index 000000000..a2e017607 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-417.txt @@ -0,0 +1,106 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1100658555 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7fe95a6859e0, 0x7fe95a688f6c), 959 [0x7fe95a6e6a40, 0x7fe95a6e6dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7fe95a688f70,0x7fe95a6be830), 959 [0x7fe95a6e6e00,0x7fe95a6ea9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fe9569ec490 at pc 0x000000ec845a bp 0x7fff41937e50 sp 0x7fff41937e48 +READ of size 8 at 0x7fe9569ec490 thread T0 + #0 0xec8459 in read_xref_section /src/ghostpdl/./pdf/pdf_xref.c:762:20 + #1 0xec8459 in read_xref /src/ghostpdl/./pdf/pdf_xref.c:800:16 + #2 0xec56d1 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1032:20 + #3 0xeaca4c in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1051:12 + #4 0xeaca4c in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1328:12 + #5 0xe981b4 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:642:12 + #6 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #10 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #12 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #13 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #14 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #15 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #16 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #17 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #19 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #20 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #21 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #22 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #23 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #24 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7fe95a07f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #26 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x7fe9569ec490 is located 880 bytes to the left of 1309872-byte region [0x7fe9569ec800,0x7fe956b2c4b0) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f2be8 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #5 0x6f43b8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0xec94e7 in resize_xref /src/ghostpdl/./pdf/pdf_xref.c:39:31 + #7 0xec6a21 in read_xref_section /src/ghostpdl/./pdf/pdf_xref.c:730:24 + #8 0xec6a21 in read_xref /src/ghostpdl/./pdf/pdf_xref.c:800:16 + #9 0xec56d1 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1032:20 + #10 0xeaca4c in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1051:12 + #11 0xeaca4c in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1328:12 + #12 0xe981b4 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:642:12 + #13 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #14 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #15 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #16 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #17 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #18 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #19 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #20 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #21 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #22 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #23 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #24 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #25 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #26 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #27 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #28 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #29 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #30 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #31 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #32 0x7fe95a07f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./pdf/pdf_xref.c:762:20 in read_xref_section +Shadow bytes around the buggy address: + 0x0ffdaad35840: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffdaad35850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffdaad35860: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffdaad35870: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffdaad35880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0ffdaad35890: fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffdaad358a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffdaad358b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffdaad358c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffdaad358d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffdaad358e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-422.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-422.txt new file mode 100644 index 000000000..85fd5c466 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-422.txt @@ -0,0 +1,110 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1173312252 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f94865909e0, 0x7f9486593f6c), 959 [0x7f94865f1a40, 0x7f94865f1dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f9486593f70,0x7f94865c9830), 959 [0x7f94865f1e00,0x7f94865f59f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +gsapi_init_with_args: error -100 +gsapi_init_with_args: error -100 +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x611000002c50 at pc 0x000000def30b bp 0x7ffcc37bf470 sp 0x7ffcc37bf468 +READ of size 4 at 0x611000002c50 thread T0 + #0 0xdef30a in ptr_struct_mark /src/ghostpdl/./psi/igc.c:1091:10 + #1 0xdef30a in gc_trace /src/ghostpdl/./psi/igc.c:951:26 + #2 0xde9b3c in gs_gc_reclaim /src/ghostpdl/./psi/igc.c:338:21 + #3 0xd10d24 in gs_vmreclaim /src/ghostpdl/./psi/ireclaim.c:165:9 + #4 0xd10d24 in ireclaim /src/ghostpdl/./psi/ireclaim.c:80:12 + #5 0xcf9b26 in interp_reclaim /src/ghostpdl/./psi/interp.c:452:12 + #6 0x569790 in gs_main_finit /src/ghostpdl/./psi/imain.c:1281:20 + #7 0x56b223 in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #8 0x56b223 in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #9 0xce78c5 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #10 0x55f5b0 in gsapi_exit /src/ghostpdl/./psi/iapi.c:420:12 + #11 0x55e474 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:104:8 + #12 0x55e474 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #13 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #14 0x457065 in fuzzer::Fuzzer::TryDetectingAMemoryLeak(unsigned char const*, unsigned long, bool) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:687:3 + #15 0x44221e in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:8 + #16 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #17 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #18 0x7f9485f8a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #19 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x611000002c50 is located 80 bytes inside of 248-byte region [0x611000002c00,0x611000002cf8) +freed by thread T0 here: + #0 0x524bc2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:111:3 + #1 0x8e6e4b in gs_heap_free_object /src/ghostpdl/./base/gsmalloc.c:366:5 + #2 0x12b3915 in alloc_free_clump /src/ghostpdl/./base/gsalloc.c:2639:9 + #3 0x12b3915 in free_all_not_allocator /src/ghostpdl/./base/gsalloc.c:993:9 + #4 0x12b3915 in clump_splay_app /src/ghostpdl/./base/gsalloc.c:606:19 + #5 0x12b3915 in i_free_all /src/ghostpdl/./base/gsalloc.c:1029:9 + #6 0xe00cdb in restore_free /src/ghostpdl/./psi/isave.c:1000:5 + #7 0xe00cdb in alloc_restore_all /src/ghostpdl/./psi/isave.c:932:13 + #8 0x56a6dd in gs_main_finit /src/ghostpdl/./psi/imain.c:1391:20 + #9 0x56b223 in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #10 0x56b223 in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #11 0xce78c5 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #12 0x55f5b0 in gsapi_exit /src/ghostpdl/./psi/iapi.c:420:12 + #13 0x55e474 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:104:8 + #14 0x55e474 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #15 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #16 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #17 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #18 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #19 0x7f9485f8a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +previously allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x12bd3b4 in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2488:13 + #3 0x12b4e24 in alloc_obj /src/ghostpdl/./base/gsalloc.c:1952:13 + #4 0x12b4e24 in i_alloc_struct_immovable /src/ghostpdl/./base/gsalloc.c:1258:11 + #5 0x8dc4db in gs_iodev_init /src/ghostpdl/./base/gsiodev.c:83:13 + #6 0xcf77d4 in i_iodev_init /src/ghostpdl/./psi/iinit.c:555:12 + #7 0x5621be in gs_main_init1 /src/ghostpdl/./psi/imain.c:228:12 + #8 0x101ab2e in swproc /src/ghostpdl/./psi/imainarg.c:789:29 + #9 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #10 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #11 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #12 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #13 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #14 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #15 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #16 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #17 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #18 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #19 0x7f9485f8a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/ghostpdl/./psi/igc.c:1091:10 in ptr_struct_mark +Shadow bytes around the buggy address: + 0x0c227fff8530: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c227fff8540: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa + 0x0c227fff8550: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c227fff8560: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c227fff8570: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa +=>0x0c227fff8580: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd + 0x0c227fff8590: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa + 0x0c227fff85a0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c227fff85b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c227fff85c0: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff85d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-429.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-429.txt new file mode 100644 index 000000000..432b19b31 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-429.txt @@ -0,0 +1,116 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1176354017 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f62724d19e0, 0x7f62724d4f6c), 959 [0x7f6272532a40, 0x7f6272532dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f62724d4f70,0x7f627250a830), 959 [0x7f6272532e00,0x7f62725369f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000074850 at pc 0x0000004be93e bp 0x7ffc9fb0e790 sp 0x7ffc9fb0df50 +READ of size 518168 at 0x631000074850 thread T0 + #0 0x4be93d in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xeb57ad in pdfi_dict_find_key /src/ghostpdl/./pdf/pdf_dict.c:364:9 + #2 0xeb57ad in pdfi_dict_get_no_store_R_inner /src/ghostpdl/./pdf/pdf_dict.c:400:13 + #3 0xeb5d78 in pdfi_dict_get_no_store_R_key /src/ghostpdl/./pdf/pdf_dict.c:443:12 + #4 0x1011b1f in pdfi_find_resource /src/ghostpdl/./pdf/pdf_doc.c + #5 0xf27aac in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2533:12 + #6 0xedcab8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1472:24 + #7 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #8 0xed904d in pdfi_interpret_inner_content /src/ghostpdl/./pdf/pdf_int.c:1927:12 + #9 0xed904d in pdfi_interpret_inner_content_stream /src/ghostpdl/./pdf/pdf_int.c:2026:12 + #10 0xed904d in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1873:12 + #11 0xf25da1 in pdfi_form_execgroup /src/ghostpdl/./pdf/pdf_image.c:2161:12 + #12 0xf26e3d in pdfi_do_form /src/ghostpdl/./pdf/pdf_image.c:2395:16 + #13 0xf274a0 in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2493:16 + #14 0xf27c9f in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2571:12 + #15 0xedcab8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1472:24 + #16 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #17 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #18 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #19 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #20 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #21 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #22 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #23 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #24 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #25 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #26 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #27 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #28 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #29 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #30 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #31 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #32 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #33 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #34 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #35 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #36 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #37 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #38 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #39 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #40 0x7f6271ecb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #41 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x631000074850 is located 0 bytes to the right of 65616-byte region [0x631000064800,0x631000074850) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f2be8 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f546d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #5 0x6f43b8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0xeb01e7 in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1601:27 + #7 0xe9c794 in zPDFInit /src/ghostpdl/./psi/zpdfops.c:1231:11 + #8 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #9 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #10 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #11 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #12 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #13 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #14 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #15 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #16 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #17 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #18 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #19 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #20 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #21 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #22 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #23 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #24 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #25 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #26 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #27 0x7f6271ecb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x0c62800068b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800068c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800068d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800068e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800068f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c6280006900: 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa + 0x0c6280006910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-449.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-449.txt new file mode 100644 index 000000000..143c8792b --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-449.txt @@ -0,0 +1,31 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1179234272 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7effd8e519e0, 0x7effd8e54f6c), 959 [0x7effd8eb2a40, 0x7effd8eb2dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7effd8e54f70,0x7effd8e8a830), 959 [0x7effd8eb2e00,0x7effd8eb69f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +gsapi_init_with_args: error -100 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x629ffe9ee510 (pc 0x000000dfec7a bp 0x7ffe5be89b90 sp 0x7ffe5be89a80 T0) +==1==The signal is caused by a WRITE memory access. + #0 0xdfec7a in restore_space /src/ghostpdl/./psi/isave.c:854:40 + #1 0xdfec7a in alloc_restore_step_in /src/ghostpdl/./psi/isave.c:787:9 + #2 0xdfff4c in alloc_restore_all /src/ghostpdl/./psi/isave.c:897:16 + #3 0x56a6dd in gs_main_finit /src/ghostpdl/./psi/imain.c:1391:20 + #4 0x56b223 in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #5 0x56b223 in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #6 0xce78c5 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #7 0x55f5b0 in gsapi_exit /src/ghostpdl/./psi/iapi.c:420:12 + #8 0x55e474 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:104:8 + #9 0x55e474 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #10 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #11 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #12 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #13 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7effd884b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #15 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./psi/isave.c:854:40 in restore_space +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-453.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-453.txt new file mode 100644 index 000000000..4d76d881e --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-453.txt @@ -0,0 +1,56 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1103650684 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f2b8892d9e0, 0x7f2b88930f6c), 959 [0x7f2b8898ea40, 0x7f2b8898edff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f2b88930f70,0x7f2b88966830), 959 [0x7f2b8898ee00,0x7f2b889929f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x00000091a003 bp 0x7ffc74fa2bf0 sp 0x7ffc74fa2b50 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: address points to the zero page. + #0 0x91a003 in gstate_clone_core /src/ghostpdl/./base/gsstate.c:1330:28 + #1 0x915c01 in gstate_clone_for_gstate /src/ghostpdl/./base/gsstate.c:1410:22 + #2 0x915c01 in gs_gstate_copy /src/ghostpdl/./base/gsstate.c:470:12 + #3 0xf19773 in pdfi_set_DefaultQState /src/ghostpdl/./pdf/pdf_gstate.c:2381:26 + #4 0xf19773 in pdfi_restore_DefaultQState /src/ghostpdl/./pdf/pdf_gstate.c:2405:12 + #5 0xed9156 in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1874:5 + #6 0xfa73f6 in pdfi_type3_build_char /src/ghostpdl/./pdf/pdf_font3.c:114:9 + #7 0xa8e026 in show_proceed /src/ghostpdl/./base/gxchar.c:1239:12 + #8 0xa859e0 in continue_show /src/ghostpdl/./base/gxchar.c:761:12 + #9 0xa87ecc in gx_show_text_process /src/ghostpdl/./base/gxchar.c:738:12 + #10 0x921dcf in gs_text_process /src/ghostpdl/./base/gstext.c:696:12 + #11 0xfce0c9 in pdfi_show_Tr_3 /src/ghostpdl/./pdf/pdf_text.c:696:12 + #12 0xfc77ae in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:922:24 + #13 0xfc9021 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1131:12 + #14 0xedcc33 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1643:24 + #15 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #16 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #17 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #18 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #19 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #20 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #21 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #22 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #23 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #24 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #25 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #26 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #27 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #28 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #29 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #30 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #31 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #32 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #33 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #34 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #35 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #36 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #37 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #38 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #39 0x7f2b88327082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #40 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gsstate.c:1330:28 in gstate_clone_core +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-456.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-456.txt new file mode 100644 index 000000000..cbd6d9a19 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-456.txt @@ -0,0 +1,54 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1182058921 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f21fa8259e0, 0x7f21fa828f6c), 959 [0x7f21fa886a40, 0x7f21fa886dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f21fa828f70,0x7f21fa85e830), 959 [0x7f21fa886e00,0x7f21fa88a9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000009487de bp 0x7ffdafa9e4f0 sp 0x7ffdafa9e3c0 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: address points to the zero page. + #0 0x9487de in load_glyph /src/ghostpdl/./base/fapi_ft.c:685:20 + #1 0x944a44 in gs_fapi_ft_get_char_raster_metrics /src/ghostpdl/./base/fapi_ft.c:1558:9 + #2 0x9399b2 in gs_fapi_do_char /src/ghostpdl/./base/gxfapi.c:1570:16 + #3 0x13a5e0d in pdfi_fapi_build_char /src/ghostpdl/./pdf/pdf_fapi.c:1386:12 + #4 0xa8e026 in show_proceed /src/ghostpdl/./base/gxchar.c:1239:12 + #5 0xa859e0 in continue_show /src/ghostpdl/./base/gxchar.c:761:12 + #6 0xa87ecc in gx_show_text_process /src/ghostpdl/./base/gxchar.c:738:12 + #7 0x921dcf in gs_text_process /src/ghostpdl/./base/gstext.c:696:12 + #8 0xfcd032 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:516:16 + #9 0xfcd032 in pdfi_show_Tr_0 /src/ghostpdl/./pdf/pdf_text.c:531:12 + #10 0xfc75a2 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:913:24 + #11 0xfca3f4 in pdfi_TJ /src/ghostpdl/./pdf/pdf_text.c:1268:28 + #12 0xedcc5b in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1647:24 + #13 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #14 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #15 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #16 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #17 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #18 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #19 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #20 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #21 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #22 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #23 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #24 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #25 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #26 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #27 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #28 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #29 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #30 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #31 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #32 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #33 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #34 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #35 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #36 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #37 0x7f21fa21f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #38 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/fapi_ft.c:685:20 in load_glyph +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-47.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-47.txt new file mode 100644 index 000000000..7f3ffc5f4 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-47.txt @@ -0,0 +1,117 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 852055478 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f48ae1099e0, 0x7f48ae10cf6c), 959 [0x7f48ae16aa40, 0x7f48ae16adff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f48ae10cf70,0x7f48ae142830), 959 [0x7f48ae16ae00,0x7f48ae16e9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62a000107064 at pc 0x000000bf8d53 bp 0x7ffd71fa3f10 sp 0x7ffd71fa3f08 +READ of size 2 at 0x62a000107064 thread T0 + #0 0xbf8d52 in mem_mono_copy_mono /src/ghostpdl/./base/gdevm1.c:683:17 + #1 0xbfc666 in mem_mapped4_copy_color /src/ghostpdl/./base/gdevm4.c:229:12 + #2 0x10bbbca in tile_clip_copy_color /src/ghostpdl/./base/gxclip2.c:301:24 + #3 0x587112 in tile_colored_fill /src/ghostpdl/./base/gxp1fill.c:269:20 + #4 0x586313 in tile_by_steps /src/ghostpdl/./base/gxp1fill.c:237:24 + #5 0x584884 in gx_dc_pattern_fill_rectangle /src/ghostpdl/./base/gxp1fill.c:395:20 + #6 0xad93cd in gx_dc_default_fill_masked /src/ghostpdl/./base/gxdcolor.c:1109:20 + #7 0xbb1f94 in gx_default_fill_mask /src/ghostpdl/./base/gdevdbit.c:584:16 + #8 0xb49b4e in gx_image_fill_masked /src/ghostpdl/./base/gximask.c:115:16 + #9 0x11a0031 in clist_playback_band /src/ghostpdl/./base/gxclrast.c:2306:28 + #10 0x68e64c in clist_playback_file_bands /src/ghostpdl/./base/gxclread.c:1035:16 + #11 0x692ca0 in clist_render_rectangle /src/ghostpdl/./base/gxclread.c:969:16 + #12 0x69207a in clist_rasterize_lines /src/ghostpdl/./base/gxclread.c:858:20 + #13 0x69123f in clist_get_bits_rectangle /src/ghostpdl/./base/gxclread.c:747:12 + #14 0x66581a in gdev_prn_get_bits /src/ghostpdl/./base/gdevprn.c:1636:12 + #15 0x7ec824 in cups_print_chunked /src/ghostpdl/./cups/gdevcups.c:4849:9 + #16 0x7db10b in cups_print_pages /src/ghostpdl/./cups/gdevcups.c + #17 0x6616a9 in gdev_prn_output_page_aux /src/ghostpdl/./base/gdevprn.c:1049:27 + #18 0x660965 in gdev_prn_output_page /src/ghostpdl/./base/gdevprn.c:1085:12 + #19 0x7ebfd9 in cups_output_page /src/ghostpdl/./cups/gdevcups.c:2826:15 + #20 0x8a6e3f in gs_output_page /src/ghostpdl/./base/gsdevice.c:207:17 + #21 0xdcc0d2 in zoutputpage /src/ghostpdl/./psi/zdevice.c:416:12 + #22 0xcfaf9c in interp /src/ghostpdl/./psi/interp.c:1351:28 + #23 0xcfaf9c in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #24 0xcfaf9c in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #25 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #26 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #27 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #28 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #29 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #30 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #31 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #32 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #33 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #34 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #35 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #36 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #37 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #38 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #39 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #40 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #41 0x7f48adb03082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #42 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x62a000107064 is located 20 bytes to the right of 20048-byte region [0x62a000102200,0x62a000107050) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x12bd3b4 in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2488:13 + #3 0x12bc262 in alloc_add_clump /src/ghostpdl/./base/gsalloc.c:2438:19 + #4 0x12bc262 in alloc_obj /src/ghostpdl/./base/gsalloc.c:2046:17 + #5 0x12b5531 in i_alloc_struct_array /src/ghostpdl/./base/gsalloc.c:1365:11 + #6 0xde7042 in gs_alloc_ref_array /src/ghostpdl/./psi/ialloc.c:226:15 + #7 0xd67d80 in make_packed_array /src/ghostpdl/./psi/zpacked.c:157:12 + #8 0xd19de5 in gs_scan_token /src/ghostpdl/./psi/iscan.c:715:31 + #9 0xcfca45 in interp /src/ghostpdl/./psi/interp.c:1502:24 + #10 0xcfca45 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #11 0xcfca45 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #12 0x562a1f in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #13 0x562a1f in gs_run_init_file /src/ghostpdl/./psi/imain.c:861:12 + #14 0x562a1f in gs_main_init2aux /src/ghostpdl/./psi/imain.c:305:16 + #15 0x5642db in gs_main_init2 /src/ghostpdl/./psi/imain.c:491:12 + #16 0x101c00f in swproc /src/ghostpdl/./psi/imainarg.c:371:20 + #17 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #18 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #19 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #20 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #21 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #22 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #23 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #24 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #25 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #26 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #27 0x7f48adb03082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/gdevm1.c:683:17 in mem_mono_copy_mono +Shadow bytes around the buggy address: + 0x0c5480018db0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c5480018dc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c5480018dd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c5480018de0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c5480018df0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c5480018e00: 00 00 00 00 00 00 00 00 00 00 fa fa[fa]fa fa fa + 0x0c5480018e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5480018e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5480018e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5480018e40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5480018e50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-496.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-496.txt new file mode 100644 index 000000000..58a07b459 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-496.txt @@ -0,0 +1,41 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1109968574 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f6534ad39e0, 0x7f6534ad6f6c), 959 [0x7f6534b34a40, 0x7f6534b34dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f6534ad6f70,0x7f6534b0c830), 959 [0x7f6534b34e00,0x7f6534b389f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x6310000f0b98 (pc 0x000001004d45 bp 0x7fff90bcbd90 sp 0x7fff90bcbc40 T0) +==1==The signal is caused by a WRITE memory access. + #0 0x1004d45 in pdfi_repair_file /src/ghostpdl/./pdf/pdf_repair.c:439:103 + #1 0xec91fb in pdfi_read_xref_stream_dict /src/ghostpdl/./pdf/pdf_stack.h + #2 0xec57d3 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1038:20 + #3 0xeaca4c in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1051:12 + #4 0xeaca4c in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1328:12 + #5 0xe981b4 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:642:12 + #6 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #10 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #12 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #13 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #14 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #15 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #16 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #17 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #19 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #20 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #21 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #22 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #23 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #24 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7f65344cd082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #26 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_repair.c:439:103 in pdfi_repair_file +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-53.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-53.txt new file mode 100644 index 000000000..480d01a04 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-53.txt @@ -0,0 +1,113 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1150303917 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f4d114869e0, 0x7f4d11489f6c), 959 [0x7f4d114e7a40, 0x7f4d114e7dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f4d11489f70,0x7f4d114bf830), 959 [0x7f4d114e7e00,0x7f4d114eb9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f4d0dc08030 at pc 0x000000c014ca bp 0x7ffdeffdbec0 sp 0x7ffdeffdbeb8 +WRITE of size 4 at 0x7f4d0dc08030 thread T0 + #0 0xc014c9 in mem_true24_fill_rectangle /src/ghostpdl/./base/gdevm24.c:281:21 + #1 0xad48ac in gx_dc_pure_fill_rectangle /src/ghostpdl/./base/gxdcolor.c:842:16 + #2 0xbc135a in gx_default_fillpage /src/ghostpdl/./base/gdevddrw.c:1004:16 + #3 0x11a4be8 in clist_playback_band /src/ghostpdl/./base/gxclrast.c + #4 0x68e64c in clist_playback_file_bands /src/ghostpdl/./base/gxclread.c:1035:16 + #5 0x692ca0 in clist_render_rectangle /src/ghostpdl/./base/gxclread.c:969:16 + #6 0x69207a in clist_rasterize_lines /src/ghostpdl/./base/gxclread.c:858:20 + #7 0x69123f in clist_get_bits_rectangle /src/ghostpdl/./base/gxclread.c:747:12 + #8 0x66581a in gdev_prn_get_bits /src/ghostpdl/./base/gdevprn.c:1636:12 + #9 0x7ec824 in cups_print_chunked /src/ghostpdl/./cups/gdevcups.c:4849:9 + #10 0x7db10b in cups_print_pages /src/ghostpdl/./cups/gdevcups.c + #11 0x6616a9 in gdev_prn_output_page_aux /src/ghostpdl/./base/gdevprn.c:1049:27 + #12 0x660965 in gdev_prn_output_page /src/ghostpdl/./base/gdevprn.c:1085:12 + #13 0x7ebfd9 in cups_output_page /src/ghostpdl/./cups/gdevcups.c:2826:15 + #14 0x8a6e3f in gs_output_page /src/ghostpdl/./base/gsdevice.c:207:17 + #15 0xdcc0d2 in zoutputpage /src/ghostpdl/./psi/zdevice.c:416:12 + #16 0xcfaf9c in interp /src/ghostpdl/./psi/interp.c:1351:28 + #17 0xcfaf9c in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfaf9c in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #24 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #25 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #26 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #27 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #30 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7f4d10e80082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x7f4d0dc08030 is located 0 bytes to the right of 460848-byte region [0x7f4d0db97800,0x7f4d0dc08030) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x685777 in clist_mutate_to_clist /src/ghostpdl/./base/gxclist.c:1476:17 + #3 0x65c9b1 in gdev_prn_allocate /src/ghostpdl/./base/gdevprn.c:424:20 + #4 0x659502 in gdev_prn_allocate_memory /src/ghostpdl/./base/gdevprn.c:510:12 + #5 0x659502 in gdev_prn_open /src/ghostpdl/./base/gdevprn.c:92:12 + #6 0x7e9640 in cups_open /src/ghostpdl/./cups/gdevcups.c:2795:15 + #7 0x8a9753 in gs_opendevice /src/ghostpdl/./base/gsdevice.c:461:20 + #8 0x8a9753 in gs_setdevice_no_erase /src/ghostpdl/./base/gsdevice.c:580:28 + #9 0xdc87df in zsetdevice_no_safer /src/ghostpdl/./psi/zdevice.c:520:12 + #10 0xdc87df in zsetdevice /src/ghostpdl/./psi/zdevice.c:564:12 + #11 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #12 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #13 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #14 0x562a1f in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #15 0x562a1f in gs_run_init_file /src/ghostpdl/./psi/imain.c:861:12 + #16 0x562a1f in gs_main_init2aux /src/ghostpdl/./psi/imain.c:305:16 + #17 0x5642db in gs_main_init2 /src/ghostpdl/./psi/imain.c:491:12 + #18 0x101c00f in swproc /src/ghostpdl/./psi/imainarg.c:371:20 + #19 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #20 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #21 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #22 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #23 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #24 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #25 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #26 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #27 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #28 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #29 0x7f4d10e80082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/gdevm24.c:281:21 in mem_true24_fill_rectangle +Shadow bytes around the buggy address: + 0x0fea21b78fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fea21b78fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fea21b78fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fea21b78fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fea21b78ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fea21b79000: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa + 0x0fea21b79010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fea21b79020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fea21b79030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fea21b79040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fea21b79050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-54.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-54.txt new file mode 100644 index 000000000..f6a11990a --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-54.txt @@ -0,0 +1,125 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1153072287 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7fe9c95819e0, 0x7fe9c9584f6c), 959 [0x7fe9c95e2a40, 0x7fe9c95e2dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7fe9c9584f70,0x7fe9c95ba830), 959 [0x7fe9c95e2e00,0x7fe9c95e69f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62d000030470 at pc 0x000000d2be79 bp 0x7ffd851316e0 sp 0x7ffd851316d8 +READ of size 1 at 0x62d000030470 thread T0 + #0 0xd2be78 in s_hex_process /src/ghostpdl/./base/sstring.c:400:37 + #1 0xc9a208 in s_exD_process /src/ghostpdl/./base/seexec.c:168:18 + #2 0x6bdbb7 in sreadbuf /src/ghostpdl/./base/stream.c:842:22 + #3 0x6bc57c in s_process_read_buf /src/ghostpdl/./base/stream.c:768:14 + #4 0x6bc57c in spgetcc /src/ghostpdl/./base/stream.c:481:9 + #5 0xfa2b54 in ps_font_eexec_func /src/ghostpdl/./pdf/pdf_fontps.c:969:13 + #6 0xf96dd0 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:363:36 + #7 0xf9871b in pdfi_read_ps_font /src/ghostpdl/./pdf/pdf_fontps.c:1234:12 + #8 0xf742d7 in pdfi_read_type1_font /src/ghostpdl/./pdf/pdf_font1.c:538:16 + #9 0xf6019b in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:727:32 + #10 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #11 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #12 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #13 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #14 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #15 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #16 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #17 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #18 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #19 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #20 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #21 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #22 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #23 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #24 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #25 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #26 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #27 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #28 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #29 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #30 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #31 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #32 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #33 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #34 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #35 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #36 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #37 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #38 0x7fe9c8f7b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #39 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x62d000030470 is located 0 bytes to the right of 32880-byte region [0x62d000028400,0x62d000030470) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f2be8 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f4ddf in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #5 0x6f43b8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0xfa269f in push_eexec_filter /src/ghostpdl/./pdf/pdf_fontps.c:906:19 + #7 0xfa269f in ps_font_eexec_func /src/ghostpdl/./pdf/pdf_fontps.c:967:12 + #8 0xf96dd0 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:363:36 + #9 0xf9871b in pdfi_read_ps_font /src/ghostpdl/./pdf/pdf_fontps.c:1234:12 + #10 0xf742d7 in pdfi_read_type1_font /src/ghostpdl/./pdf/pdf_font1.c:538:16 + #11 0xf6019b in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:727:32 + #12 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #13 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #14 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #15 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #16 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #17 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #18 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #19 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #20 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #21 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #22 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #23 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #24 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #25 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #26 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #27 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #28 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #29 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #30 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #31 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #32 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #33 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #34 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #35 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #36 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #37 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #38 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/sstring.c:400:37 in s_hex_process +Shadow bytes around the buggy address: + 0x0c5a7fffe030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c5a7fffe040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c5a7fffe050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c5a7fffe060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c5a7fffe070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c5a7fffe080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa + 0x0c5a7fffe090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5a7fffe0a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5a7fffe0b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5a7fffe0c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5a7fffe0d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-684.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-684.txt new file mode 100644 index 000000000..1106c5b2e --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-684.txt @@ -0,0 +1,110 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1185145196 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f993884b9e0, 0x7f993884ef6c), 959 [0x7f99388aca40, 0x7f99388acdff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f993884ef70,0x7f9938884830), 959 [0x7f99388ace00,0x7f99388b09f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000003b0 at pc 0x000000f6177e bp 0x7ffe0f65ea90 sp 0x7ffe0f65ea88 +READ of size 8 at 0x6020000003b0 thread T0 + #0 0xf6177d in pdfi_font_match_glyph_widths /src/ghostpdl/./pdf/pdf_font.c:111:33 + #1 0xf6177d in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:796:24 + #2 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #3 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #4 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #5 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #6 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #7 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #8 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #9 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #10 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #11 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #12 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #13 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #14 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #15 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #16 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #17 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #18 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #19 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #20 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #21 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #22 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #23 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #24 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #25 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #26 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #27 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #28 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #29 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #30 0x7f9938245082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #31 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x6020000003b0 is located 760 bytes to the right of 8-byte region [0x6020000000b0,0x6020000000b8) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0xf7631f in pdfi_read_type1_font /src/ghostpdl/./pdf/pdf_font1.c:661:49 + #2 0xf6019b in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:727:32 + #3 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #4 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #5 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #6 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #7 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #8 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #9 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #10 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #11 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #12 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #13 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #14 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #15 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #16 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #17 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #18 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #19 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #20 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #21 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #22 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #23 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #24 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #25 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #26 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #27 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #28 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #29 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #30 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #31 0x7f9938245082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./pdf/pdf_font.c:111:33 in pdfi_font_match_glyph_widths +Shadow bytes around the buggy address: + 0x0c047fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c047fff8070: fa fa fa fa fa fa[fa]fa fa fa fa fa fa fa fa fa + 0x0c047fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-79.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-79.txt new file mode 100644 index 000000000..51539de8d --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-79.txt @@ -0,0 +1,49 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 854838452 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f82a342a9e0, 0x7f82a342df6c), 959 [0x7f82a348ba40, 0x7f82a348bdff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f82a342df70,0x7f82a3463830), 959 [0x7f82a348be00,0x7f82a348f9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000002 (pc 0x0000006cb54d bp 0x7fffdd68fc50 sp 0x7fffdd68fb40 T0) +==1==The signal is caused by a WRITE memory access. +==1==Hint: address points to the zero page. + #0 0x6cb54d in clist_composite /src/ghostpdl/./base/gxclimag.c:1404:15 + #1 0x6226b1 in pdf14_clist_update_params /src/ghostpdl/./base/gdevp14.c:10863:16 + #2 0x6352a6 in pdf14_clist_stroke_path /src/ghostpdl/./base/gdevp14.c:10995:12 + #3 0xb70036 in gx_stroke_fill /src/ghostpdl/./base/gxpaint.c:71:12 + #4 0x8fe433 in do_stroke /src/ghostpdl/./base/gspaint.c:519:16 + #5 0x8fe433 in gs_stroke /src/ghostpdl/./base/gspaint.c:555:16 + #6 0xeee818 in pdfi_stroke /src/ghostpdl/./pdf/pdf_path.c:182:16 + #7 0xedc5ee in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1599:24 + #8 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #9 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #10 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #11 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #12 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #13 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #14 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #15 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #16 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #17 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #18 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #19 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #20 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #21 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #22 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #23 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #24 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #25 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #26 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #27 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #28 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #29 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #30 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #31 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #32 0x7f82a2e24082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #33 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gxclimag.c:1404:15 in clist_composite +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-81.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-81.txt new file mode 100644 index 000000000..b62577838 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-81.txt @@ -0,0 +1,44 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1155942915 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f3ab168b9e0, 0x7f3ab168ef6c), 959 [0x7f3ab16eca40, 0x7f3ab16ecdff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f3ab168ef70,0x7f3ab16c4830), 959 [0x7f3ab16ece00,0x7f3ab16f09f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x20007fff7fff (pc 0x000000ef7d0a bp 0x7fff0b0e5730 sp 0x7fff0b0e5640 T0) +==1==The signal is caused by a READ memory access. + #0 0xef7d0a in pdfi_setcolorN /src/ghostpdl/./pdf/pdf_colour.c:857:9 + #1 0xedca08 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c + #2 0xedda8e in split_bogus_operator /src/ghostpdl/./pdf/pdf_int.c:1359:12 + #3 0xedbc6b in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1392:16 + #4 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #5 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #6 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #7 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #8 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #9 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #10 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #11 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #12 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #13 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #14 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #15 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #16 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #17 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #18 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #19 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #20 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #21 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #22 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #23 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #24 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #25 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #26 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #27 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #28 0x7f3ab1085082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #29 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_colour.c:857:9 in pdfi_setcolorN +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-83.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-83.txt new file mode 100644 index 000000000..68368e638 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-83.txt @@ -0,0 +1,51 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 861287396 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f17ac5439e0, 0x7f17ac546f6c), 959 [0x7f17ac5a4a40, 0x7f17ac5a4dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f17ac546f70,0x7f17ac57c830), 959 [0x7f17ac5a4e00,0x7f17ac5a89f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x0000bfff8004 (pc 0x0000006f4e4b bp 0x7fff197c0d20 sp 0x7fff197c0cb0 T0) +==1==The signal is caused by a READ memory access. + #0 0x6f4e4b in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:800:20 + #1 0x6f43b8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #2 0xfb5e1f in cmap_endfbrange_func /src/ghostpdl/./pdf/pdf_cmap.c:331:50 + #3 0xf96dd0 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:363:36 + #4 0xfb19a7 in pdfi_read_cmap /src/ghostpdl/./pdf/pdf_cmap.c:810:12 + #5 0xf6f304 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:260:20 + #6 0xf5f974 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #7 0xf65524 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #8 0xf69ba5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #9 0xf69ba5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #10 0xedcbe3 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1639:24 + #11 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #12 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #13 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #14 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #15 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #16 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #24 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #25 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #26 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #27 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #30 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7f17abf3d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gsmchunk.c:800:20 in chunk_obj_alloc +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-85.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-85.txt new file mode 100644 index 000000000..882a15e1d --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-85.txt @@ -0,0 +1,42 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1158751343 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f3f75b5d9e0, 0x7f3f75b60f6c), 959 [0x7f3f75bbea40, 0x7f3f75bbedff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f3f75b60f70,0x7f3f75b96830), 959 [0x7f3f75bbee00,0x7f3f75bc29f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x00006d6c7563 (pc 0x000000ef7d1b bp 0x7ffe07d16170 sp 0x7ffe07d16080 T0) +==1==The signal is caused by a WRITE memory access. + #0 0xef7d1b in pdfi_setcolorN /src/ghostpdl/./pdf/pdf_colour.c:857:9 + #1 0xedca08 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c + #2 0xedb108 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2118:32 + #3 0xf36fef in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:128:20 + #4 0xf36fef in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:153:12 + #5 0xf36fef in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:960:12 + #6 0xe9c225 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1150:12 + #7 0xcfe40b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #8 0xcfe40b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #9 0xcfe40b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #10 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #11 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #12 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #13 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #14 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #15 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #16 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #17 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #18 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #19 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #20 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #21 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #22 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #23 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #24 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #25 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #26 0x7f3f75557082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #27 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_colour.c:857:9 in pdfi_setcolorN +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-97.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-97.txt new file mode 100644 index 000000000..3202f3d52 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/crashes/OSV-2022-97.txt @@ -0,0 +1,91 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 867411834 +INFO: Loaded 3 modules (183099 inline 8-bit counters): 13708 [0x7f146fd579e0, 0x7f146fd5af6c), 959 [0x7f146fdb8a40, 0x7f146fdb8dff), 168432 [0x2dab740, 0x2dd4930), +INFO: Loaded 3 PC tables (183099 PCs): 13708 [0x7f146fd5af70,0x7f146fd90830), 959 [0x7f146fdb8e00,0x7f146fdbc9f0), 168432 [0x24d5bf0,0x2767af0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6320000007e8 at pc 0x00000052430c bp 0x7ffe3cee6290 sp 0x7ffe3cee5a58 +WRITE of size 16 at 0x6320000007e8 thread T0 + #0 0x52430b in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0xcfcead in interp /src/ghostpdl/./psi/interp.c:1518:29 + #2 0xcfcead in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #3 0xcfcead in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #4 0x5678ca in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #5 0x5678ca in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #6 0x5678ca in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #7 0x562d72 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #8 0x10200b1 in run_string /src/ghostpdl/./psi/imainarg.c:1174:12 + #9 0x101c059 in swproc /src/ghostpdl/./psi/imainarg.c:375:20 + #10 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #11 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #12 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #13 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #14 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #15 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #16 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #17 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #18 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #19 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #20 0x7f146f751082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #21 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x6320000007e8 is located 24 bytes to the left of 93832-byte region [0x632000000800,0x632000017688) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6671 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x12bd3b4 in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2488:13 + #3 0x12bb8e0 in alloc_obj /src/ghostpdl/./base/gsalloc.c:1952:13 + #4 0x12b5531 in i_alloc_struct_array /src/ghostpdl/./base/gsalloc.c:1365:11 + #5 0xde7042 in gs_alloc_ref_array /src/ghostpdl/./psi/ialloc.c:226:15 + #6 0xcf9286 in gs_interp_alloc_stacks /src/ghostpdl/./psi/interp.c:333:12 + #7 0x13a2473 in context_state_alloc /src/ghostpdl/./psi/icontext.c:127:12 + #8 0xcf8fdd in gs_interp_init /src/ghostpdl/./psi/interp.c:303:16 + #9 0xcf51d0 in obj_init /src/ghostpdl/./psi/iinit.c:264:12 + #10 0x562158 in gs_main_init1 /src/ghostpdl/./psi/imain.c:221:12 + #11 0x101ab2e in swproc /src/ghostpdl/./psi/imainarg.c:789:29 + #12 0x1018f3e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:225:24 + #13 0x101fdac in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:290:16 + #14 0xce6a84 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #15 0x55f280 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #16 0x55e422 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:99:8 + #17 0x55e422 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:121:2 + #18 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #19 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #20 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #21 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #22 0x7f146f751082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c647fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c647fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c647fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c647fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c647fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c647fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]fa fa + 0x0c647fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c647fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c647fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c647fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c647fff8140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/dicts/pdf.dict b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/dicts/pdf.dict new file mode 100644 index 000000000..a6c48d59e --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/dicts/pdf.dict @@ -0,0 +1,1466 @@ +# +# AFL dictionary for PDF +# ---------------------- +# +# This is a pretty big PDF dictionary constructed by Ben by manually reviewing +# the spec and combining that with the data pulled out of a corpus of sample +# PDFs. +# +# Contributed by Ben Nagy +# + +"#" +"%" +"%%" +"%%EOF" +"%FDF-1.7" +"%PDF-1.7" +"(" +"(/xdp:xdp)" +"(\\001)" +"(config)" +"(datasets)" +"(template)" +"(xdp:xdp)" +")" +"-1" +"-1.0" +".." +"/" +"/#23clipboard" +"/.notdef" +"/1" +"/1.0" +"/1.3" +"/3D" +"/3DA" +"/3DAnimationStyle" +"/3DB" +"/3DD" +"/3DI" +"/3DLightingScheme" +"/3DRenderMode" +"/3DV" +"/3DView" +"/90pv-RKSJ-H" +"/A" +"/A0" +"/A85" +"/AA" +"/AAIC" +"/AAPL" +"/ABCDEF+ACaslonPro-Regular" +"/ABCDEF+AJensonPro-LtIt" +"/ABCDEF+AdobeCorpID-MinionRg" +"/ABCDEF+Arial,Bold" +"/ABCDEF+BankGothicMdBT" +"/ABCDEF+Bauhaus-Heavy" +"/ABCDEF+BluesClues" +"/ABCDEF+BodegaSans" +"/ABCDEF+BodoniMTCondensed" +"/ABCDEF+BookAntiqua" +"/ABCDEF+CMBX10" +"/ABCDEF+CaflischScriptPro-Regular" +"/ABCDEF+CityBlueprint" +"/ABCDEF+CourierNewPSMT" +"/ABCDEF+FixedsysExcelsior2.00" +"/ABCDEF+MSTT31854bd45bo188067S00" +"/ABCDEF+MinionPro-BoldCnIt" +"/ABCDEF+MyriadMM-It_400_300_" +"/ABCDEF+Wingdings" +"/ABCDEF+ZapfDingbats" +"/AC" +"/ADBE" +"/ADB_DEVICE_DEFAULT_STYLE" +"/ADB_DefaultStyle" +"/ADB_NO_TRAP_STYLE" +"/AE" +"/AESV2" +"/AGaramond" +"/AH" +"/AI8DstIndex" +"/AI8SrcIndex" +"/AIMetaData" +"/AIPDFPrivateData1" +"/AIS" +"/AL" +"/AN" +"/AP" +"/AS" +"/ASCII85Decode" +"/ASCIIHexDecode" +"/ASomewhatLongerName" +"/AU" +"/Aacute" +"/Acc.#20Prod.#202501#20#2F2#20#20" +"/Accounts#20payable" +"/AccurateScreens" +"/Acircumflex" +"/AcroForm" +"/Action" +"/Actual" +"/Add" +"/Adieresis" +"/Adobe" +"/Adobe#20PDF#20Library" +"/Adobe.PPKLite" +"/AdobeCorpID-Acrobat" +"/AdobeCorpID-MinionRg" +"/AdobePhotoshop" +"/Agrave" +"/All" +"/AllKO" +"/AllOn" +"/Alt" +"/Alternate" +"/AlternatePresentations" +"/Alternates" +"/Amex" +"/And" +"/Angle" +"/Annot" +"/Annots" +"/AntiAlias" +"/AnyOn" +"/Apag_PDFX_Checkup" +"/App" +"/Architecture-Normal" +"/Arial" +"/Aring" +"/Art" +"/ArtBox" +"/Article" +"/Artifact" +"/Artwork" +"/Ascent" +"/Aspect" +"/Assistant" +"/Atilde" +"/AuthEvent" +"/Author" +"/Avenir-Heavy" +"/Avenir-MediumOblique" +"/AvgWidth" +"/BBox" +"/BC" +"/BCL" +"/BDC" +"/BDL" +"/BE" +"/BFSOL" +"/BG" +"/BG2" +"/BM" +"/BMC" +"/BS" +"/BW" +"/Bank" +"/BaseEncoding" +"/BaseFont" +"/BaseState" +"/BaseVersion" +"/Birch" +"/BitsPerComponent" +"/BitsPerCoordinate" +"/BitsPerFlag" +"/BitsPerSample" +"/Bl" +"/BlCDel" +"/BlMiNu" +"/Black" +"/BlackIs1" +"/BlackOP" +"/BlackPoint" +"/BleedBox" +"/Blend" +"/Block" +"/Blue" +"/BluesClues" +"/Bookshelf" +"/Border" +"/Bounds" +"/BoxColorInfo" +"/Btn" +"/BulmerMT-BoldDisplay" +"/ByteRange" +"/C" +"/C0" +"/C0_0" +"/C1" +"/C2W" +"/C3" +"/CALS_AIS" +"/CALS_BM" +"/CALS_HT" +"/CALS_SMASK" +"/CALS_ca" +"/CAM" +"/CB" +"/CC" +"/CCH" +"/CCITTFaxDecode" +"/CD" +"/CDL" +"/CEN" +"/CF" +"/CFM" +"/CI" +"/CIDFontType0" +"/CIDFontType0C" +"/CIDFontType2" +"/CIDInit" +"/CIDSet" +"/CIDSystemInfo" +"/CIDToGIDMap" +"/CMV_LabBar" +"/CMV_LabControl" +"/CMYK" +"/CMYK#20#2880,#208,#2034,#200#29" +"/CMap" +"/CMapName" +"/CMapType" +"/CMapVersion" +"/CO" +"/CP" +"/CS" +"/CS0" +"/CT" +"/CV" +"/CalGray" +"/CalRGB" +"/CapHeight" +"/Caption" +"/Caslon540BT-Roman" +"/CaslonBT-Bold" +"/CaslonBT-BoldItalic" +"/Catalog" +"/Category" +"/Ccedilla" +"/CenturySchoolbookBT-Roman" +"/Ch" +"/Chair" +"/Chap" +"/Chaparral-Display" +"/CharProcs" +"/CharSet" +"/CheckSum" +"/Circle" +"/ClarendonBT-Black" +"/ClassMap" +"/Clearface-Black" +"/Clip" +"/ClippedText" +"/Cn" +"/Collection" +"/CollectionItem" +"/CollectionSchema" +"/CollectionSubitem" +"/Color" +"/ColorBurn" +"/ColorDodge" +"/ColorMatch" +"/ColorSpace" +"/ColorTransform" +"/ColorType" +"/Colorants" +"/Colors" +"/Columns" +"/ComicSansMS,Bold" +"/Comment" +"/Comments" +"/Company" +"/Compatibility" +"/Compatible" +"/Components" +"/CompressArt" +"/Condensed" +"/Configs" +"/Consultant" +"/ContainerVersion" +"/Contents" +"/Coords" +"/Copy" +"/Copy#20center" +"/Cor" +"/Corner#20surface" +"/CosineDot" +"/Count" +"/Cour" +"/Courier" +"/Create" +"/CreationDate" +"/Creator" +"/CreatorInfo" +"/CreatorVersion" +"/CropBox" +"/CropFixed" +"/CropRect" +"/Crypt" +"/CryptFilter" +"/CryptFilterDecodeParms" +"/Cs12" +"/Cs3" +"/Cyan" +"/D" +"/DA" +"/DCTDecode" +"/DIC#202525p*" +"/DIS" +"/DL" +"/DOS" +"/DP" +"/DR" +"/DS" +"/DSz" +"/DV" +"/DW" +"/DamagedRowsBeforeError" +"/Darken" +"/Data" +"/Date" +"/Decode" +"/DecodeParms" +"/DefEmbeddedFile" +"/Default" +"/DefaultCryptFilter" +"/DefaultForPrinting" +"/DefaultRGB" +"/Delete" +"/Delta" +"/DescendantFonts" +"/Descent" +"/Description" +"/Design" +"/Dest" +"/DestOutputProfile" +"/DestOutputProfileRef" +"/Dests" +"/DeviceCMYK" +"/DeviceGray" +"/DeviceN" +"/DeviceRGB" +"/Difference" +"/Differences" +"/DigestLocation" +"/DigestMethod" +"/DigestValue" +"/Dimmed" +"/Direction" +"/DisplayDocTitle" +"/Dissolve" +"/Div" +"/Dm" +"/DocMDP" +"/DocOpen" +"/Document" +"/Documents" +"/Domain" +"/Door" +"/DotGain" +"/Draw" +"/Dt" +"/Dur" +"/Dynamic#20connector" +"/E" +"/EF" +"/EFF" +"/EMC" +"/Eacute" +"/EarlyChange" +"/Ecircumflex" +"/Edieresis" +"/Editable" +"/Egrave" +"/EmbedFonts" +"/EmbedICCProfile" +"/Embedded" +"/EmbeddedFile" +"/EmbeddedFiles" +"/Encode" +"/EncodedByteAlign" +"/Encoding" +"/Encrypt" +"/EncryptMetadata" +"/EndIndent" +"/EndOfBlock" +"/EndOfLine" +"/Euro" +"/Euro.037" +"/Event" +"/ExData" +"/Exchange-Pro" +"/Exclude" +"/Exclusion" +"/Executive" +"/Export" +"/ExportCrispy" +"/ExportState" +"/ExtGState" +"/Extend" +"/Extends" +"/ExtensionLevel" +"/Extensions" +"/F1" +"/F1.0" +"/F12" +"/F13" +"/F3" +"/F5" +"/F6" +"/F7" +"/F8" +"/FB" +"/FD" +"/FDecodeParms" +"/FFilter" +"/FICL" +"/FM" +"/FOV" +"/FRM" +"/FS" +"/FT" +"/Facilities" +"/Fade" +"/False" +"/Feature" +"/FedEx#20Orange" +"/FedEx#20Purple" +"/Field" +"/Fields" +"/Figure" +"/File" +"/Files" +"/Filespec" +"/FillIn" +"/Filter" +"/First" +"/FirstChar" +"/FirstPage" +"/Fit" +"/FitB" +"/FitBH" +"/FitBV" +"/FitH" +"/FitR" +"/FitV" +"/FitWindow" +"/FixedPrint" +"/Flags" +"/FlateDecode" +"/Fm0" +"/Fm4" +"/Fo" +"/Focoltone#201047" +"/Font" +"/FontBBox" +"/FontDescriptor" +"/FontFamily" +"/FontFile" +"/FontFile2" +"/FontMatrix" +"/FontName" +"/FontStretch" +"/FontWeight" +"/Form" +"/FormEx" +"/FormType" +"/FreeText" +"/FreeTextCallout" +"/Frequency" +"/FullSave" +"/FullScreen" +"/Function" +"/FunctionType" +"/Functions" +"/Futura-Bold" +"/Futura-CondensedExtraBold" +"/G" +"/G02" +"/GLGR" +"/GS0" +"/GS1" +"/GS2" +"/GTS" +"/GTS_PDFA1" +"/GTS_PDFX" +"/GTS_PDFXConformance" +"/GTS_PDFXVersion" +"/GWG#20Green" +"/Gamma" +"/Garamond" +"/Georgia,Bold" +"/GoTo" +"/GoTo3DView" +"/GoToE" +"/GoToR" +"/Gold" +"/Goudy" +"/Gray" +"/Green" +"/GreymantleMVB" +"/GrotesqueMT" +"/Group" +"/H" +"/HDAG_Tools" +"/HKana" +"/HT" +"/HT2" +"/Halftone" +"/HalftoneName" +"/HalftoneType" +"/HardLight" +"/HeBo" +"/Head1" +"/Headlamp" +"/Height" +"/HeiseiMin" +"/Helv" +"/Helvetica" +"/Helvetica-Bold" +"/Helvetica-BoldOblique" +"/Helvetica-Condensed" +"/HelveticaNeue-Black" +"/Hide" +"/HonMincho-M" +"/Horizontal" +"/Hue" +"/I" +"/I0" +"/IC" +"/ICCBased" +"/ICCVersion" +"/ID" +"/IDS" +"/IDTree" +"/IEC" +"/IF" +"/IN" +"/ISO32000Registry" +"/ISO_PDFE1" +"/ISO_PDFEVersion" +"/IT" +"/ITO" +"/ITP" +"/IV" +"/IX" +"/Icircumflex" +"/Icon" +"/Identity" +"/Identity-H" +"/IgnEP" +"/Illustrator" +"/Illustrator8.0" +"/Im0" +"/Im1" +"/Im2" +"/Im3" +"/Im4" +"/Image" +"/Image1" +"/ImageB" +"/ImageC" +"/ImageI" +"/ImageMask" +"/ImageResources" +"/ImageType" +"/Import" +"/ImportData" +"/ImpressBT-Regular" +"/Index" +"/Indexed" +"/Info" +"/Information#20services" +"/Ink" +"/InkList" +"/InsertPages" +"/Insignia" +"/IntegerItem" +"/Intent" +"/Interpolate" +"/ItalicAngle" +"/ItcKabel-Ultra" +"/Item1" +"/Item2" +"/JBIG2Decode" +"/JBIG2Globals" +"/JPXDecode" +"/JS" +"/JT" +"/JTC" +"/JTF" +"/JTFile" +"/JTM" +"/JavaScript" +"/JobTicketContents" +"/Justify" +"/Keywords" +"/Kids" +"/L" +"/L1" +"/L1a" +"/L1b" +"/L2R" +"/L50188" +"/LBody" +"/LI" +"/LL" +"/LLE" +"/LLO" +"/LS" +"/LSP" +"/LZW" +"/LZWDecode" +"/Lab" +"/Lang" +"/Last" +"/LastChar" +"/LastItem" +"/LastModified" +"/Lateral#20file" +"/Launch" +"/Layout" +"/Lbl" +"/Leading" +"/Legal" +"/Length" +"/Length1" +"/Length2" +"/Length3" +"/LetterspaceFlags" +"/Lighten" +"/Limits" +"/Line" +"/LineDimension" +"/LineHeight" +"/Linear" +"/Linearized" +"/Link" +"/Locked" +"/LogoGreen" +"/LrTb" +"/Lslash" +"/Luminosity" +"/M" +"/MB" +"/MC" +"/MC0" +"/MCD" +"/MCID" +"/MCR" +"/MD5" +"/MH" +"/MIT" +"/MK" +"/MMType1" +"/MP" +"/MR" +"/MS" +"/MUX#20#2F#20DEMUX" +"/Mac" +"/MacRomanEncoding" +"/Magenta" +"/Manager" +"/MarkInfo" +"/Marked" +"/MarkedPDF" +"/Marker#20board" +"/Markup3D" +"/Mask" +"/Mastercard" +"/Matrix" +"/Max" +"/MaxLen" +"/MaxWidth" +"/Me" +"/Measure" +"/MediaBox" +"/MetaData" +"/Min" +"/MinionMM" +"/MissingWidth" +"/MixedContainer" +"/MixingHints" +"/ModDate" +"/Mode" +"/Modify" +"/Movie" +"/Msg" +"/MurrayHillBT-Bold" +"/MxGeom" +"/MxLaNu" +"/MxPts" +"/MyriadPro-Black" +"/NA" +"/NChannel" +"/ND" +"/NL" +"/NM" +"/NR" +"/Name" +"/Name1" +"/Named" +"/Names" +"/NeedsRendering" +"/NewCenturySchlbk-Italic" +"/NewWindow" +"/Next" +"/NextPage" +"/No" +"/NonEFontNoWarn" +"/NonStruct" +"/None" +"/Normal" +"/Not" +"/NotDefSpecial" +"/NumBlock" +"/Nums" +"/OB" +"/OBJR" +"/OC" +"/OC2" +"/OC3" +"/OC4" +"/OCG" +"/OCGs" +"/OCL" +"/OCMD" +"/OCProperties" +"/OE" +"/OFF" +"/OLN" +"/ON" +"/OOL" +"/OPBG" +"/OPBS" +"/OPI" +"/OPM" +"/OS" +"/OT" +"/Oacute" +"/Obj" +"/ObjStm" +"/Ocircumflex" +"/Odieresis" +"/Ograve" +"/Omega" +"/OneColumn" +"/Online" +"/Open" +"/OpenAction" +"/Operation" +"/Opt" +"/OptionSet" +"/Options" +"/Or" +"/Orange" +"/Order" +"/Ordering" +"/OriginalLayerName" +"/Oslash" +"/Otilde" +"/Outlines" +"/OutputCondition" +"/OutputConditionIdentifier" +"/OutputIntent" +"/OutputIntents" +"/Overlay" +"/P0" +"/P1" +"/P2" +"/P2,#2300ff007900000000,PANTONE#20151#20C" +"/PANTONE" +"/PANTONE#20158-5#20CVS" +"/PANTONE#20221#20CVU" +"/PANTONE#203405#20C" +"/PANTONE#20399#20CVC" +"/PANTONE#20Blue#20072#20C" +"/PANTONE#20Orange#20021#20C" +"/PANTONE#20Orange#20021#20CVC" +"/PANTONE#20Yellow#20C" +"/PC" +"/PDFDocEncoding" +"/PIX" +"/PO" +"/PS" +"/PUBLISHER" +"/PZ" +"/Pa0" +"/Page" +"/PageElement" +"/PageLabels" +"/PageLayout" +"/PageMode" +"/PageRange" +"/Pages" +"/PaintType" +"/Palatino,Bold" +"/Pale#20Brown.c" +"/Panose" +"/Paper#20tray" +"/Para" +"/Params" +"/Parent" +"/ParentTree" +"/ParentTreeNextKey" +"/Part" +"/Pattern" +"/PatternType" +"/PcZ" +"/Perceptual" +"/Perms" +"/Pg" +"/Pgf" +"/PieceInfo" +"/PitStop" +"/Placement" +"/Play" +"/Polygon" +"/PolygonCloud" +"/Popup" +"/Position" +"/PowerUpPDF" +"/PrOut" +"/PrRGBGra" +"/PrRGBIma" +"/Predictor" +"/PresSteps" +"/PreserveRB" +"/Prev" +"/PrevPage" +"/Preview" +"/Print" +"/PrintRecord" +"/PrintScaling" +"/PrintState" +"/PrintStyle" +"/Printed" +"/PrintingOrder" +"/Private" +"/ProcSet" +"/Process" +"/ProcessBlue" +"/ProcessGreen" +"/ProcessRed" +"/Producer" +"/ProfileCS" +"/ProfileName" +"/Prop_Build" +"/Properties" +"/Proportional" +"/PubSec" +"/Q" +"/QuadPoints" +"/R1" +"/RBGroups" +"/RC" +"/RD" +"/REC" +"/REx" +"/RF" +"/RGB" +"/RI" +"/RICMYKGra" +"/RICMYKIma" +"/RICalGra" +"/RICalIma" +"/RIDefault" +"/RIDevNGra" +"/RIDevNIma" +"/RIRGBGra" +"/RIRGBIma" +"/RL" +"/RM" +"/RV" +"/Range" +"/Rect" +"/Red" +"/Redact" +"/Ref" +"/Reference" +"/Registry" +"/RegistryName" +"/RelativeColorimetric" +"/Rendition" +"/Renditions" +"/Requirements" +"/ResetForm" +"/Resolution" +"/Resources" +"/ReversedChars" +"/RoleMap" +"/Root" +"/Rotate" +"/Round" +"/RoundTrip" +"/RoundtripVersion" +"/Router" +"/Rows" +"/RunLengthDecode" +"/Ryumin" +"/SA" +"/SBDraft" +"/SC" +"/SE" +"/SFSSL" +"/SFTWS" +"/SI" +"/SL" +"/SLA" +"/SM" +"/SMask" +"/SMaskInData" +"/SP" +"/SPS" +"/STL" +"/SU" +"/SW" +"/Saturation" +"/SaveAs" +"/SaveContents" +"/SaveResource" +"/SavedBy" +"/Scaron" +"/Schema" +"/Screen" +"/Sect" +"/SemiCondensed" +"/SemiExpanded" +"/Separation" +"/SeparationInfo" +"/SetOCGState" +"/SettingsFileName" +"/Sh0" +"/Sh1" +"/Shading" +"/ShadingType" +"/Shape" +"/Sig" +"/SigFlags" +"/SigRef" +"/Signature" +"/Signed" +"/SinglePage" +"/Size" +"/SlideShow" +"/SoftLight" +"/Solid" +"/Solidities" +"/SomeName" +"/Sort" +"/Sound" +"/Space" +"/SpaceAfter" +"/SpaceBefore" +"/Span" +"/SpawnTemplate" +"/SpdrArt" +"/SpiderInfo" +"/Split" +"/Spot" +"/Spot1" +"/Spot2" +"/SpotFunction" +"/SpotMap" +"/St" +"/Stamp" +"/StandardImageFileData" +"/Star" +"/Start" +"/StartIndent" +"/StartResource" +"/State" +"/StdCF" +"/StemH" +"/StemV" +"/Stm" +"/StmF" +"/Stop" +"/Story" +"/StrF" +"/StrikeOut" +"/StringItem" +"/StructElem" +"/StructParent" +"/StructParents" +"/StructTreeRoot" +"/Style" +"/SubFilter" +"/SubType" +"/Subdictionary" +"/Subform" +"/Subj" +"/Subject" +"/SubmitForm" +"/SubmitStandalone" +"/SubsetFontsBelow" +"/SubsetFontsRatio" +"/Supplement" +"/Swiss721BT-Black" +"/Switch" +"/T" +"/T1" +"/T1_0" +"/TB" +"/TC" +"/TCS" +"/TF" +"/TID" +"/TK" +"/TM" +"/TO" +"/TOC" +"/TOCI" +"/TOYO#200004pc" +"/TP" +"/TR" +"/TR2" +"/TRUMATCH#206-e" +"/TS" +"/TSV" +"/TT" +"/TT0" +"/TTRefMan" +"/TU" +"/TV" +"/TW" +"/TWS" +"/TWY" +"/Tabs" +"/TagSuspect" +"/TargetCS" +"/Technical" +"/Template" +"/TemplateInstantiated" +"/Templates" +"/Text" +"/TextAlign" +"/TextBox" +"/TextIndent" +"/The" +"/This" +"/Thorn" +"/Thread" +"/Threads" +"/Thumb" +"/Thumbnail" +"/Thumbs" +"/Ti" +"/TiBI" +"/TilingType" +"/Times-BoldItalic" +"/Times-Roman" +"/Title" +"/ToUnicode" +"/Toggle" +"/Trans" +"/TransferFunction" +"/TransformMethod" +"/TransformParams" +"/Transparency" +"/TrapInfo" +"/TrapMagicNumber" +"/TrapRegions" +"/TrapSet" +"/Trapped" +"/Trapping" +"/TrappingDetails" +"/TrappingParameters" +"/TrimBox" +"/True" +"/TrueType" +"/TrustedMode" +"/TwoColumnLeft" +"/Tx" +"/Type" +"/Type0" +"/U3D" +"/UA" +"/UCR" +"/UCR2" +"/UIDOffset" +"/UR" +"/UR3" +"/URI" +"/URL" +"/URLs" +"/Uacute" +"/Ucircumflex" +"/Udieresis" +"/Ugrave" +"/Univers-BoldExt" +"/Unix" +"/Unknown" +"/Usage" +"/UseAttachments" +"/UseNone" +"/UseOC" +"/UseOutlines" +"/UseThumbs" +"/UsedCMYK" +"/UserProperties" +"/UserUnit" +"/V2" +"/VA" +"/VE" +"/VP" +"/Verdana,Bold" +"/Version" +"/Vertical" +"/VeryLastItem" +"/View" +"/ViewerPreferences" +"/Visa" +"/Visible" +"/Volume" +"/W2" +"/WAI" +"/WAN" +"/WMode" +"/WP" +"/WarnockPro-BoldIt" +"/Watermark" +"/WebCapture" +"/Which" +"/WhiteBG" +"/WhitePoint" +"/Widget" +"/Width" +"/Widths" +"/Win" +"/WinAnsiEncoding" +"/Window" +"/Windows" +"/Work#20surface" +"/Workbook" +"/Worksheet" +"/WritingMode" +"/X" +"/X1" +"/XFA" +"/XHeight" +"/XML" +"/XN" +"/XObject" +"/XRef" +"/XRefStm" +"/XStep" +"/XUID" +"/XYZ" +"/Y" +"/YStep" +"/Yacute" +"/Ydieresis" +"/Yellow" +"/Z" +"/Z7KNXbN" +"/ZaDb" +"/ZapfDingbats" +"/Zcaron" +"/Zoom" +"/_No_paragraph_style_" +"/a1" +"/acute" +"/adbe.pkcs7.detached" +"/ampersand" +"/apple" +"/approxequal" +"/asciicircum" +"/asciitilde" +"/asterisk" +"/at" +"/audio#2Fmpeg" +"/b" +"/backslash" +"/bar" +"/blank" +"/braceleft" +"/braceright" +"/bracketleft" +"/bracketright" +"/breve" +"/brokenbar" +"/bullet" +"/c108" +"/cCompKind" +"/cCompQuality" +"/cCompression" +"/cRes" +"/cResolution" +"/ca" +"/caron" +"/cedilla" +"/cent" +"/circumflex" +"/colon" +"/comma" +"/copyright" +"/currency" +"/dagger" +"/daggerdbl" +"/degree" +"/deviceNumber" +"/dieresis" +"/divide" +"/dollar" +"/dotaccent" +"/dotlessi" +"/dotlessj" +"/eight" +"/ellipsis" +"/emdash" +"/endash" +"/equal" +"/eth" +"/exclam" +"/exclamdown" +"/f" +"/ff" +"/ffi" +"/ffl" +"/fi" +"/five" +"/fl" +"/florin" +"/four" +"/fraction" +"/gCompKind" +"/gCompQuality" +"/gCompression" +"/gRes" +"/gResolution" +"/germandbls" +"/go1" +"/grave" +"/greater" +"/greaterequal" +"/guillemotleft" +"/guillemotright" +"/guilsinglleft" +"/guilsinglright" +"/hungarumlaut" +"/hyphen" +"/iacute" +"/idieresis" +"/igrave" +"/infinity" +"/integral" +"/j" +"/k" +"/less" +"/lessequal" +"/logicalnot" +"/lozenge" +"/lt#20blue" +"/mCompKind" +"/mCompression" +"/mRes" +"/mResolution" +"/macron" +"/minus" +"/mu" +"/multiply" +"/n" +"/n0" +"/nine" +"/notequal" +"/ntilde" +"/numbersign" +"/o" +"/ogonek" +"/one" +"/onehalf" +"/onequarter" +"/onesuperior" +"/op" +"/ordfeminine" +"/ordmasculine" +"/p" +"/pageH" +"/pageV" +"/paragraph" +"/parenleft" +"/parenright" +"/partialdiff" +"/pdf" +"/pdfx" +"/percent" +"/period" +"/periodcentered" +"/perthousand" +"/pi" +"/plus" +"/plusminus" +"/pms#208400" +"/printX" +"/product" +"/question" +"/questiondown" +"/quotedbl" +"/quotedblbase" +"/quotedblleft" +"/quotedblright" +"/quoteleft" +"/quoteright" +"/quotesinglbase" +"/quotesingle" +"/r" +"/radical" +"/registered" +"/ring" +"/s" +"/s1" +"/sd1" +"/sd2" +"/section" +"/semicolon" +"/seven" +"/six" +"/slash" +"/sterling" +"/summation" +"/thinspace" +"/three" +"/threequarters" +"/threesuperior" +"/tilde" +"/trademark" +"/two" +"/twosuperior" +"/u" +"/underscore" +"/v" +"/w" +"/y1" +"/yen" +"/yes" +"/zero" +"0 R" +"1" +"1.0" +"<" +"<<" +">" +">>" +"Adobe.PPKLite" +"Adobe.PubSec" +"B*" +"BDC" +"BI" +"BMC" +"BT" +"BX" +"CS" +"DP" +"Do" +"EI" +"EMC" +"ET" +"EX" +"Entrust.PPKEF" +"ID" +"MP" +"R" +"T*" +"TJ" +"TL" +"Tc" +"Td" +"Tf" +"Tj" +"Tm" +"Tr" +"Ts" +"Tw" +"W*" +"[" +"[0.0 0.0 0.0 0.0 0.0 0.0]" +"[1 1 1]" +"[1.0 -1.0 1.0 -1.0]" +"[1.0 -1.0]" +"\\" +"]" +"abs" +"adbe.pkcs7.s3" +"adbe.pkcs7.s4" +"adbe.pkcs7.s5" +"add" +"and" +"atan" +"begin" +"beginarrangedfont" +"beginbfchar" +"begincidrange" +"begincmap" +"begincodespacerange" +"beginnotdefchar" +"beginnotdefrange" +"beginusematrix" +"bitshift" +"ceiling" +"cm" +"copy" +"cos" +"cvi" +"cvr" +"d0" +"d1" +"div" +"dup" +"end" +"endarrangedfont" +"endbfchar" +"endcidrange" +"endcmap" +"endcodespacerange" +"endnotdefchar" +"endnotdefrange" +"endobj" +"endstream" +"endusematrix" +"eq" +"exch" +"exp" +"f*" +"false" +"findresource" +"floor" +"ge" +"gs" +"gt" +"idiv" +"if" +"ifelse" +"index" +"le" +"ln" +"log" +"lt" +"mod" +"mul" +"ne" +"neg" +"not" +"null" +"obj" +"or" +"page" +"pop" +"re" +"rg" +"ri" +"roll" +"round" +"sin" +"sqrt" +"startxref" +"stream" +"sub" +"trailer" +"true" +"truncate" +"usecmap" +"usefont" +"xor" +"xref" +"{" +"}" diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/dicts/ps.dict b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/dicts/ps.dict new file mode 100644 index 000000000..bcb7eca7b --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/dicts/ps.dict @@ -0,0 +1,232 @@ +"exch" +"pop" +"copy" +"dup" +"index" +"roll" +"clear" +"count" +"mark" +"cleartomark" +"countomark" +"add" +"div" +"sub" +"idiv" +"mul" +"mod" +"abs" +"neg" +"ceiling" +"floor" +"round" +"truncate" +"sqrt" +"atan" +"cos" +"sin" +"exp" +"ln" +"log" +"rand" +"srand" +"rrand" +"array" +"[" +"]" +"length" +"get" +"put" +"getinterval" +"putinterval" +"aload" +"astore" +"copy" +"forall" +"dict" +"length" +"maxlength" +"begin" +"end" +"def" +"load" +"store" +"get" +"put" +"known" +"where" +"copy" +"forall" +"errordict" +"systemdict" +"userdict" +"currentdict" +"countdictstack" +"dictstack" +"string" +"anchorsearch" +"search" +"token" +"eq" +"ne" +"ge" +"gt" +"le" +"lt" +"and" +"not" +"or" +"xor" +"true" +"false" +"bitshift" +"exec" +"if" +"ifself" +"for" +"repeat" +"loop" +"exit" +"stop" +"stopped" +"countexecstack" +"quit" +"start" +"type" +"cvlit" +"cvx" +"xcheck" +"executeonly" +"noaccess" +"readonly" +"rcheck" +"wcheck" +"cvi" +"cvn" +"cvr" +"cvrs" +"cvs" +"file" +"closefile" +"read" +"write" +"readhexstring" +"writehexstring" +"readstring" +"writestring" +"readline" +"bytesavailable" +"flush" +"flushfile" +"resetfile" +"status" +"run" +"currentfile" +"print" +"=" +"stack" +"==" +"pstack" +"prompt" +"echo" +"save" +"restore" +"vmstatus" +"bind" +"null" +"usertime" +"version" +"gsave" +"grestore" +"grestoreall" +"initgraphics" +"setlinewidth" +"currentlinewidth" +"setlinecap" +"currentlinecap" +"setlinejoine" +"currentlinejoin" +"setmiterlimit" +"currentmiterlimit" +"setdash" +"currentdash" +"setflat" +"currentflat" +"setgray" +"currentgray" +"sethsbcolor" +"currenthsbcolor" +"setrgbcolor" +"currentrgbcolor" +"setscreen" +"currentscreen" +"settransfer" +"currenttransfer" +"matrix" +"initmatrix" +"identmatrix2" +"defaultmatrix" +"currentmatrix" +"setmatrix" +"translate" +"scale" +"rotate" +"concat" +"concatmatrix" +"transform" +"dtransform" +"itransform" +"idtransform" +"invertmatrix" +"newpath" +"currentpoint" +"moveto" +"rmoveto" +"lineto" +"rlineto" +"arc" +"arcn" +"arcto" +"curveto" +"rcurveto" +"closepath" +"flattenpath" +"reversepath" +"strokepath" +"charpath" +"clippath" +"pathbbox" +"pathforall" +"initclip" +"clip" +"eoclip" +"erasepage" +"fill" +"eofill" +"stroke" +"image" +"imagemask" +"showpage" +"copypage" +"banddevice" +"framedevice" +"nulldevice" +"renderbands" +"definefont" +"findfont" +"scalefont" +"makefont" +"setfont" +"currentfont" +"show" +"ashow" +"widthshow" +"awidthshow" +"kshow" +"stringwidth" +"FontDirectory" +"standardEncoding" +"cachestatus" +"setcachedevice" +"setcharwidth" +"setcachelimit" diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/gs_fuzzlib.h b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/gs_fuzzlib.h new file mode 100644 index 000000000..088227945 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/gs_fuzzlib.h @@ -0,0 +1,153 @@ +/* +# Copyright 2019 The Chromium OS Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ +*/ + +#include +#include + +#include +#include +#include +#include + +static const unsigned char *g_data; +static size_t g_size; + +int fuzz_gs_device( + const unsigned char *buf, + size_t size, + int color_scheme, + const char *device_target, + const char *output_file, + int do_interpolation +); + +#define min(x, y) ((x) < (y) ? (x) : (y)) + +static int gs_stdin(void *inst, char *buf, int len) +{ + size_t to_copy = min(len, g_size); + to_copy = min(INT_MAX, to_copy); + + memcpy(buf, g_data, to_copy); + + g_data += to_copy; + g_size -= to_copy; + + return to_copy; +} + +static int gs_stdnull(void *inst, const char *buf, int len) +{ + /* Just discard everything. */ + return len; +} + +int gs_to_raster_fuzz( + const unsigned char *buf, + size_t size, + int color_scheme +) +{ + return fuzz_gs_device(buf, size, color_scheme, "cups", "/dev/null", 0); +} + +int fuzz_gs_device( + const unsigned char *buf, + size_t size, + int color_scheme, + const char *device_target, + const char *output_file, + int do_interpolation +) +{ + int ret; + void *gs = NULL; + char color_space[50]; + char gs_device[50]; + char gs_o[100]; + char opt_interpolation[50]; + /* + * We are expecting color_scheme to be in the [0:62] interval. + * This corresponds to the color schemes defined here: + * https://github.com/ArtifexSoftware/ghostpdl/blob/8c97d5adce0040ac38a1fb4d7954499c65f582ff/cups/libs/cups/raster.h#L102 + */ + sprintf(color_space, "-dcupsColorSpace=%d", color_scheme); + sprintf(gs_device, "-sDEVICE=%s", device_target); + sprintf(gs_o, "-sOutputFile=%s", output_file); + if (do_interpolation) { + sprintf(opt_interpolation, "-dDOINTERPOLATE"); + } + else { + sprintf(opt_interpolation, "-dNOINTERPOLATE"); + } + /* Mostly stolen from cups-filters gstoraster. */ + char *args[] = { + "gs", + "-K1048576", + "-r200x200", + "-sBandListStorage=memory", + "-dMaxBitmap=0", + "-dBufferSpace=450k", + "-dMediaPosition=1", + color_space, + "-dQUIET", + "-dSAFER", + "-dNOPAUSE", + "-dBATCH", + opt_interpolation, + "-dNOMEDIAATTRS", + "-sstdout=%%stderr", + gs_o, + gs_device, + "-_", + }; + int argc = sizeof(args) / sizeof(args[0]); + + /* Stash buffers globally, for gs_stdin(). */ + g_data = buf; + g_size = size; + + ret = gsapi_new_instance(&gs, NULL); + if (ret < 0) { + fprintf(stderr, "gsapi_new_instance: error %d\n", ret); + return ret; + } + + gsapi_set_stdio(gs, gs_stdin, gs_stdnull, gs_stdnull); + ret = gsapi_set_arg_encoding(gs, GS_ARG_ENCODING_UTF8); + if (ret < 0) { + fprintf(stderr, "gsapi_set_arg_encoding: error %d\n", ret); + gsapi_delete_instance(gs); + return ret; + } + + ret = gsapi_init_with_args(gs, argc, args); + if (ret && ret != gs_error_Quit) + /* Just keep going, to cleanup. */ + fprintf(stderr, "gsapi_init_with_args: error %d\n", ret); + + ret = gsapi_exit(gs); + if (ret < 0 && ret != gs_error_Quit) { + fprintf(stderr, "gsapi_exit: error %d\n", ret); + return ret; + } + + gsapi_delete_instance(gs); + + return 0; +} diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/gstoraster_fuzzer.cc b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/gstoraster_fuzzer.cc new file mode 100644 index 000000000..61916f5c4 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/gstoraster_fuzzer.cc @@ -0,0 +1,25 @@ +/* +# Copyright 2019 The Chromium OS Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ +*/ + +#include "gs_fuzzlib.h" + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + /* Tests RGB color scheme */ + gs_to_raster_fuzz(data, size, 1); + return 0; +} diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/COMMANDS.md b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/COMMANDS.md new file mode 100644 index 000000000..aba1de817 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/COMMANDS.md @@ -0,0 +1,268 @@ +# Original Crash Collection: ghostscript gstoraster_fuzzer + +Generated: 2026-04-24 UTC + +Benchmark: `ghostscript_transplant_gstoraster_fuzzer` +Project: `ghostscript` +Fuzzer: `gstoraster_fuzzer` +Sanitizer: `address` + +Target source commit: `2be8b436910cfc8b013a13df000c3c854cf3c5c5` (2021-12-14) +Target OSS-Fuzz commit: `7490e8a466e40c3ac4c092a26f737c5276c4a860` (from `/home/user/log/ghostscript_builds.csv`) +Target-era base-runner: `gcr.io/oss-fuzz-base/base-runner@sha256:83dc2104f6325551cf7b2dd928b63a3545bd283d00c3179827dcd963cff7764b` + +## Semantics + +Each `OSV-*.txt` is a crash on the pristine, un-transplanted source tree: + +- **Local bugs** (already triggering at the target commit) are replayed against + the `-address` prebuilt binary at `ghostscript-2be8b436910c...-address/gstoraster_fuzzer` + using the target-era base-runner. +- **Migration bugs** come from `/mnt/nas/linke/new_migrate/ghostscript/gstoraster_fuzzer/crash/`, + captured per-bug by the migration pipeline (`fuzz_helper.py collect_crash + --runner-image auto`) which era-matches the runner image per source commit. + When a migration crash file had no ASAN error (broken `collect_crash` capture — e.g. binary-missing), the fallback was `bug_transplant/_/transplant_crash.txt` + captured during the transplant agent's verification step. + +## Bug → source commit / OSS-Fuzz commit + +| Bug | Kind | Source commit | OSS-Fuzz commit | +| --- | --- | --- | --- | +| OSV-2020-1875 | migration | `ad317d8d436f` | `da9cbde065a6` | +| OSV-2021-1681 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1682 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1683 | migration | `991a95ff4c4f` | `7490e8a466e4` | +| OSV-2021-1684 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1685 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1686 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1687 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1688 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1689 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1690 | migration | `991a95ff4c4f` | `7490e8a466e4` | +| OSV-2021-1692 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1693 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1694 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1697 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1698 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1703 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1704 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1706 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1707 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1709 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1711 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1715 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1717 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1719 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1723 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1724 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1731 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1740 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1741 | migration | `d066f5000d9a` | `ad1ecf0c592d` | +| OSV-2021-1743 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1752 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1753 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1754 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1763 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1764 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1767 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1770 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1771 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1772 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1774 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1781 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1788 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1795 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1802 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1803 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-1806 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2021-237 | migration | `7a469b14c884` | `d108b02e950a` | +| OSV-2021-337 | migration | `7a469b14c884` | `d108b02e950a` | +| OSV-2021-668 | migration | `edd20b3b8c3c` | `c2abaa0bd34f` | +| OSV-2021-717 | migration | `d859bc3a556d` | `4442574e302a` | +| OSV-2021-803 | migration | `1419607dd606` | `f8d0ee3c89b8` | +| OSV-2022-1 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2022-100 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2022-102 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2022-121 | migration | `a16d4303a172` | `4261d526ad02` | +| OSV-2022-177 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2022-18 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2022-199 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2022-206 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2022-210 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2022-218 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2022-229 | migration | `ed4ea44d3a6e` | `10fdf2878d52` | +| OSV-2022-232 | migration | `61e2de99c2d4` | `4d723ba45142` | +| OSV-2022-270 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2022-271 | migration | `3aac4c1d09c3` | `7dd39a677caf` | +| OSV-2022-278 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2022-3 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2022-301 | migration | `31ccc0f92038` | `3291b708db4f` | +| OSV-2022-339 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2022-351 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2022-390 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2022-415 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2022-417 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2022-422 | migration | `1b5c3c953c69` | `3ce6a5816906` | +| OSV-2022-429 | migration | `3c317be3539c` | `d1e407f0f335` | +| OSV-2022-449 | migration | `c519bbf479cf` | `beb98b4d1a3b` | +| OSV-2022-453 | local* | `13dd78221346` | `7bcd9edc3608` | +| OSV-2022-456 | migration | `c519bbf479cf` | `beb98b4d1a3b` | +| OSV-2022-47 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2022-496 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2022-53 | migration | `9c4eb789379c` | `f72ca0fd0938` | +| OSV-2022-54 | migration | `f4f1797aabba` | `55e0764b3308` | +| OSV-2022-684 | migration | `db0f222fd72d` | `b5c6cd48c0f6` | +| OSV-2022-79 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2022-81 | migration | `6fde1cf8be08` | `9b03e118c244` | +| OSV-2022-83 | local | `2be8b436910c` | `7490e8a466e4` | +| OSV-2022-85 | migration | `6fde1cf8be08` | `9b03e118c244` | +| OSV-2022-97 | local | `2be8b436910c` | `7490e8a466e4` | + +*`OSV-2022-453` was flagged as 'already triggering at target' by the migration +pipeline, but its OSV-reported `introduced` commit (`e4fef6cf`, 2022-05-31) is +actually **after** the benchmark target (2021-12-14). The buggy code is not +present at target; the crash was captured at the first in-range CSV-mapped commit +`13dd7822` (2022-06-XX) instead. + +## ASAN options note + +Three local bugs (`OSV-2021-1693`, `OSV-2021-1706`, `OSV-2022-453`) are sensitive +to ASAN's `detect_stack_use_after_return=1` flag which the other benchmarks in this +repo set by default. With it enabled, ASAN's stack-rewrite layout masks the bug +and the process exits cleanly. These three logs were captured with the plainer +`ASAN_OPTIONS=abort_on_error=1:symbolize=1:detect_leaks=0` to surface the crash. + +## Re-run command (migration bugs) + +```bash +BUILD_CSV='/home/user/oss-fuzz-build/fuzzbench/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/collect_crash_builds.csv' +OUT_DIR='/home/user/oss-fuzz-build/fuzzbench/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes' + +while IFS=$'\t' read -r bug commit; do + [ "$bug" = "bug" ] && continue + ts=$(git -C /home/user/tasks-git/ghostscript log -1 --format=%ct "$commit") + /home/user/pyenv/venv/bin/python3 /home/user/oss-fuzz-for-select/script/fuzz_helper.py collect_crash \ + --commit "$commit" \ + --build_csv "$BUILD_CSV" \ + --testcases /home/user/oss-fuzz-for-select/pocs/tmp \ + --test_input "testcase-${bug}" \ + --runner-image auto --commit-date "$ts" \ + ghostscript gstoraster_fuzzer + cp "/home/user/oss-fuzz-build/data/crash/target_crash-${commit:0:6}-testcase-${bug}.txt" "${OUT_DIR}/${bug}.txt" +done <<'JOBS' +bug commit +OSV-2020-1875 ad317d8d436f3ae282597631464313666451747f +OSV-2021-1683 991a95ff4c4ffd6114f0ae5b9ecb7887ba775d50 +OSV-2021-1690 991a95ff4c4ffd6114f0ae5b9ecb7887ba775d50 +OSV-2021-1741 d066f5000d9a959708838c0ee471ffeb84d00bfc +OSV-2021-237 7a469b14c88409b96614e6b8abe2b645078ded3a +OSV-2021-337 7a469b14c88409b96614e6b8abe2b645078ded3a +OSV-2021-668 edd20b3b8c3c1a7117dd5dbee0b54cd1de7838bf +OSV-2021-717 d859bc3a556d76adeff89a00fa7b41f308bda88c +OSV-2021-803 1419607dd606ac6bc6850308621d0bd275bddac2 +OSV-2022-121 a16d4303a172eb1f4f0e6c0133a728fe5f78c07e +OSV-2022-229 ed4ea44d3a6e0f705fa055a81beef964a1b1cfea +OSV-2022-232 61e2de99c2d465abf3dec54180da20e4659c42e7 +OSV-2022-271 3aac4c1d09c3b0772727609cac0242905e45ceea +OSV-2022-301 31ccc0f920386b3f3cf42040f82aa8ed74b10c92 +OSV-2022-422 1b5c3c953c69837889ecca694097eccacfdcb567 +OSV-2022-429 3c317be3539c6fe9920b4065612a9d209a8ea872 +OSV-2022-449 c519bbf479cfd22ef57cd486470f5031137539e8 +OSV-2022-456 c519bbf479cfd22ef57cd486470f5031137539e8 +OSV-2022-53 9c4eb789379cfd0902a4e4981d101d11fc7b01a4 +OSV-2022-54 f4f1797aabba7c931903eacbd78003d006770c7d +OSV-2022-684 db0f222fd72d3038aad3a32427603f05a76600e2 +OSV-2022-81 6fde1cf8be088fbe074c97eac334c6a539b0e380 +OSV-2022-85 6fde1cf8be088fbe074c97eac334c6a539b0e380 +JOBS +``` + +## Re-run command (local bugs + OSV-2022-453) + +```bash +RUNNER_IMAGE='gcr.io/oss-fuzz-base/base-runner@sha256:83dc2104f6325551cf7b2dd928b63a3545bd283d00c3179827dcd963cff7764b' +OUT_DIR='/home/user/oss-fuzz-build/fuzzbench/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes' + +while IFS=$'\t' read -r bug commit asan_opts; do + [ "$bug" = "bug" ] && continue + BIN_DIR="/mnt/nas/linke/ghostscript/ghostscript-${commit}-address" + TMPD=$(mktemp -d) + cp /home/user/oss-fuzz-for-select/pocs/tmp/testcase-${bug} "$TMPD/" + docker run --rm --platform linux/amd64 --shm-size=2g \ + -v "$BIN_DIR":/out:ro -v "$TMPD":/corpus:ro \ + -e ASAN_OPTIONS="$asan_opts" \ + "$RUNNER_IMAGE" \ + /out/gstoraster_fuzzer "/corpus/testcase-${bug}" -rss_limit_mb=8192 -runs=10 \ + > "${OUT_DIR}/${bug}.txt" 2>&1 + rm -rf "$TMPD" +done <<'JOBS' +bug commit asan_opts +OSV-2021-1681 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1682 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1684 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1685 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1686 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1687 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1688 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1689 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1692 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1693 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0 +OSV-2021-1694 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1697 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1698 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1703 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1704 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1706 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0 +OSV-2021-1707 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1709 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1711 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1715 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1717 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1719 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1723 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1724 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1731 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1740 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1743 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1752 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1753 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1754 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1763 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1764 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1767 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1770 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1771 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1772 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1774 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1781 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1788 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1795 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1802 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1803 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2021-1806 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-1 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-100 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-102 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-177 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-18 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-199 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-206 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-210 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-218 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-270 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-278 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-3 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-339 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-351 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-390 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-415 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-417 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-453 13dd78221346a098445c4c8ab3f68d2f44651be2 abort_on_error=1:symbolize=1:detect_leaks=0 +OSV-2022-47 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-496 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-79 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-83 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +OSV-2022-97 2be8b436910cfc8b013a13df000c3c854cf3c5c5 abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 +JOBS +``` + diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2020-1875.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2020-1875.txt new file mode 100755 index 000000000..cca9fac11 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2020-1875.txt @@ -0,0 +1,110 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1453875139 +INFO: Loaded 3 modules (138140 inline 8-bit counters): 11664 [0x7f12c2fbcec0, 0x7f12c2fbfc50), 878 [0x7f12c3215798, 0x7f12c3215b06), 125598 [0x555b65c40f90, 0x555b65c5fa2e), +INFO: Loaded 3 PC tables (138140 PCs): 11664 [0x7f12c2fbfc50,0x7f12c2fed550), 878 [0x7f12c3215b08,0x7f12c32191e8), 125598 [0x555b65c5fa30,0x555b65e4a410), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2020-1875 +INFO: Start rendering... +INFO: Processing page 1... +Error: /undefined in +Operand stack: + true +Execution stack: + %interp_exit .runexec2 --nostringval-- --nostringval-- --nostringval-- 2 %stopped_push --nostringval-- --nostringval-- --nostringval-- false 1 %stopped_push 1974 2 3 %oparray_pop 1973 2 3 %oparray_pop 1961 2 3 %oparray_pop 1817 2 3 %oparray_pop --nostringval-- %errorexec_pop .runexec2 --nostringval-- --nostringval-- --nostringval-- 2 %stopped_push --nostringval-- +Dictionary stack: + --dict:705/1123(ro)(G)-- --dict:0/20(G)-- --dict:75/200(L)-- +Current allocation mode is local +Last OS error: No such file or directory +GPL Ghostscript GIT PRERELEASE 9.51: Unrecoverable error, exit code 1 +INFO: Rendering completed +gsapi_init_with_args: error -100 +================================================================= +==8525==ERROR: AddressSanitizer: heap-use-after-free on address 0x7db2c1dec468 at pc 0x555b645b00c1 bp 0x7ffe6c9fdf30 sp 0x7ffe6c9fdf28 +READ of size 8 at 0x7db2c1dec468 thread T0 + #0 0x555b645b00c0 in dict_find_string /src/ghostpdl/./psi/idict.c:425:36 + #1 0x555b63fe6674 in gs_main_tempnames /src/ghostpdl/./psi/imain.c:1031:13 + #2 0x555b63fe51c0 in gs_main_finit /src/ghostpdl/./psi/imain.c:1094:17 + #3 0x555b645ac24f in psapi_exit /src/ghostpdl/./psi/psapi.c:506:5 + #4 0x555b63fdfa11 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/ghostpdl/fuzz/gstoraster_fuzzer.cc:99:8 + #5 0x555b63fdf81b in LLVMFuzzerTestOneInput /src/ghostpdl/fuzz/gstoraster_fuzzer.cc:111:2 + #6 0x555b63e7d14d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x555b63e67ec2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x555b63e6dd90 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x555b63e998c2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f12c2ae3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x555b63e60fad in _start (/out/gstoraster_fuzzer+0x427fad) + +0x7db2c1dec468 is located 616 bytes inside of 20048-byte region [0x7db2c1dec200,0x7db2c1df1050) +freed by thread T0 here: + #0 0x555b63f9b806 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3 + #1 0x555b648e6c33 in alloc_free_clump /src/ghostpdl/./base/gsalloc.c:2636:9 + #2 0x555b648e79b7 in free_all_not_allocator /src/ghostpdl/./base/gsalloc.c:994:9 + #3 0x555b648e487a in clump_splay_app /src/ghostpdl/./base/gsalloc.c:606:19 + #4 0x555b648e24d1 in i_free_all /src/ghostpdl/./base/gsalloc.c:1030:9 + #5 0x555b64689218 in alloc_restore_all /src/ghostpdl/./psi/isave.c:916:5 + #6 0x555b63fe5dfc in gs_main_finit /src/ghostpdl/./psi/imain.c:1229:16 + #7 0x555b646fac12 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c + #8 0x555b646ff894 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:304:16 + #9 0x555b63fdf9d3 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/ghostpdl/fuzz/gstoraster_fuzzer.cc:94:8 + #10 0x555b63fdf81b in LLVMFuzzerTestOneInput /src/ghostpdl/fuzz/gstoraster_fuzzer.cc:111:2 + #11 0x555b63e7d14d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #12 0x555b63e67ec2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #13 0x555b63e6dd90 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #14 0x555b63e998c2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f12c2ae3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +previously allocated by thread T0 here: + #0 0x555b63f9baa4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x555b6428db80 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:191:34 + #2 0x555b648e8dbe in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2485:13 + #3 0x555b648e593b in alloc_add_clump /src/ghostpdl/./base/gsalloc.c:2435:19 + #4 0x555b648e8350 in alloc_obj /src/ghostpdl/./base/gsalloc.c:2043:17 + #5 0x555b648e2d45 in i_alloc_struct /src/ghostpdl/./base/gsalloc.c:1231:15 + #6 0x555b6498d7f6 in context_state_alloc /src/ghostpdl/./psi/icontext.c:120:16 + #7 0x555b645babb7 in gs_interp_init /src/ghostpdl/./psi/interp.c:301:16 + #8 0x555b645b7a6b in obj_init /src/ghostpdl/./psi/iinit.c:264:12 + #9 0x555b63fe1101 in gs_main_init1 /src/ghostpdl/./psi/imain.c:218:12 + #10 0x555b646fc51e in swproc /src/ghostpdl/./psi/imainarg.c:788:29 + #11 0x555b646faf61 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:232:24 + #12 0x555b646ff894 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:304:16 + #13 0x555b63fdf9d3 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/ghostpdl/fuzz/gstoraster_fuzzer.cc:94:8 + #14 0x555b63fdf81b in LLVMFuzzerTestOneInput /src/ghostpdl/fuzz/gstoraster_fuzzer.cc:111:2 + #15 0x555b63e7d14d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #16 0x555b63e67ec2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #17 0x555b63e6dd90 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #18 0x555b63e998c2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #19 0x7f12c2ae3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/ghostpdl/./psi/idict.c:425:36 in dict_find_string +Shadow bytes around the buggy address: + 0x7db2c1dec180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7db2c1dec200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7db2c1dec280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7db2c1dec300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7db2c1dec380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x7db2c1dec400: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd + 0x7db2c1dec480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7db2c1dec500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7db2c1dec580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7db2c1dec600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7db2c1dec680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==8525==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1681.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1681.txt new file mode 100644 index 000000000..1ad16e896 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1681.txt @@ -0,0 +1,46 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1571029656 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f488c6209e0, 0x7f488c623f6c), 959 [0x7f488c681a40, 0x7f488c681dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f488c623f70,0x7f488c659830), 959 [0x7f488c681e00,0x7f488c6859f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1681 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x0000006f3028 (pc 0x000000ffb7d0 bp 0x7ffec3145d10 sp 0x7ffec3145b80 T0) +==1==The signal is caused by a WRITE memory access. + #0 0xffb7d0 in pdfi_countup_impl /src/ghostpdl/./pdf/pdf_stack.h:36:18 + #1 0xffb7d0 in pdfi_deref_compressed /src/ghostpdl/./pdf/pdf_deref.c:594:9 + #2 0xffb7d0 in pdfi_dereference /src/ghostpdl/./pdf/pdf_deref.c:805:20 + #3 0x100cf73 in pdfi_get_child /src/ghostpdl/./pdf/pdf_doc.c:282:16 + #4 0x100bddb in pdfi_get_page_dict /src/ghostpdl/./pdf/pdf_doc.c:468:16 + #5 0x100c5d6 in pdfi_get_page_dict /src/ghostpdl/./pdf/pdf_doc.c:491:36 + #6 0xf2f07e in pdfi_page_get_dict /src/ghostpdl/./pdf/pdf_page.c:610:12 + #7 0xf2dd0f in pdfi_page_info /src/ghostpdl/./pdf/pdf_page.c:481:12 + #8 0xe98c37 in zPDFpageinfo /src/ghostpdl/./psi/zpdfops.c:726:12 + #9 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #10 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #11 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #12 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #13 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #14 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #15 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #16 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #17 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #18 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #19 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #20 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #21 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #22 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #23 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #24 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #25 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #26 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #27 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #28 0x7f488c01d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #29 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: pdfi_countup_impl--pdfi_deref_compressed--pdfi_dereference +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_stack.h:36:18 in pdfi_countup_impl +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1682.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1682.txt new file mode 100644 index 000000000..574a1bc13 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1682.txt @@ -0,0 +1,110 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1571821885 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7fe83e3e89e0, 0x7fe83e3ebf6c), 959 [0x7fe83e449a40, 0x7fe83e449dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7fe83e3ebf70,0x7fe83e421830), 959 [0x7fe83e449e00,0x7fe83e44d9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1682 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x63100008c9d0 at pc 0x000001002114 bp 0x7ffff2f2ce10 sp 0x7ffff2f2ce08 +WRITE of size 4 at 0x63100008c9d0 thread T0 + #0 0x1002113 in pdfi_repair_file /src/ghostpdl/./pdf/pdf_repair.c:439:103 + #1 0xec6a2c in pdfi_read_xref_stream_dict /src/ghostpdl/./pdf/pdf_xref.c + #2 0xec3513 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1038:20 + #3 0xeaa746 in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1048:12 + #4 0xeaa746 in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1315:12 + #5 0xe97094 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:521:12 + #6 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #10 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #12 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #13 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #14 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #15 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #16 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #17 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #19 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #20 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #21 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #22 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #23 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #24 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7fe83dde5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #26 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: pdfi_repair_file--pdfi_read_xref_stream_dict--pdfi_read_xref +0x63100008c9d0 is located 16768 bytes to the right of 65616-byte region [0x631000078800,0x631000088850) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6aa1 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f520f in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f3018 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f589d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #5 0x6f496c in chunk_alloc_struct_array /src/ghostpdl/./base/gsmchunk.c:1024:12 + #6 0x136637a in gx_char_cache_alloc /src/ghostpdl/./base/gxccman.c:88:13 + #7 0x12c39d9 in gs_font_dir_alloc2_limits /src/ghostpdl/./base/gsfont.c:263:12 + #8 0x12c3880 in gs_font_dir_alloc2 /src/ghostpdl/./base/gsfont.c:236:16 + #9 0xf69ab0 in pdfi_init_font_directory /src/ghostpdl/./pdf/pdf_font.c:1662:21 + #10 0xeae0c9 in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1624:12 + #11 0xe9b4d4 in zPDFInit /src/ghostpdl/./psi/zpdfops.c:991:11 + #12 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #13 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #14 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #15 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #16 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #17 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #18 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #19 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #20 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #21 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #22 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #23 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #24 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #25 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #26 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #27 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #28 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #29 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #30 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #31 0x7fe83dde5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--chunk_obj_alloc +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./pdf/pdf_repair.c:439:103 in pdfi_repair_file +Shadow bytes around the buggy address: + 0x0c62800098e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c62800098f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c6280009930: fa fa fa fa fa fa fa fa fa fa[fa]fa fa fa fa fa + 0x0c6280009940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009960: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009970: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1683.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1683.txt new file mode 100755 index 000000000..a90aeeb13 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1683.txt @@ -0,0 +1,81 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3399529502 +INFO: Loaded 3 modules (156781 inline 8-bit counters): 11664 [0x7fd816dbcec0, 0x7fd816dbfc50), 878 [0x7fd816fc6798, 0x7fd816fc6b06), 144239 [0x55ea7de60a80, 0x55ea7de83def), +INFO: Loaded 3 PC tables (156781 PCs): 11664 [0x7fd816dbfc50,0x7fd816ded550), 878 [0x7fd816fc6b08,0x7fd816fca1e8), 144239 [0x55ea7de83df0,0x55ea7e0b74e0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2021-1683 +================================================================= +==12147==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges [0x7ee815c489d9,0x7ee815c489e0) and [0x7ee815c489df, 0x7ee815c489e6) overlap + #0 0x55ea7bcd96c9 in memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:117:5 + #1 0x55ea7c49c2c0 in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1303:17 + #2 0x55ea7c48c8ec in zPDFstream /src/ghostpdl/./psi/zpdfops.c:521:12 + #3 0x55ea7c34de18 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #4 0x55ea7c348426 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #5 0x55ea7c347d8e in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #6 0x55ea7bd25f1d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #7 0x55ea7bd25aea in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #8 0x55ea7c5a14ef in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #9 0x55ea7c59e887 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #10 0x55ea7c59c792 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #11 0x55ea7c5a12c4 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #12 0x55ea7bd1e9d8 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:97:8 + #13 0x55ea7bd1e82b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #14 0x55ea7bbbc15d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #15 0x55ea7bba6ed2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #16 0x55ea7bbacda0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #17 0x55ea7bbd88d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #18 0x7fd8168e3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #19 0x55ea7bb9ffbd in _start (/out/gstoraster_fuzzer+0x517fbd) + +0x7ee815c489d9 is located 16857 bytes inside of 65616-byte region [0x7ee815c44800,0x7ee815c54850) +allocated by thread T0 here: + #0 0x55ea7bcdaab4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55ea7c007620 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x55ea7be6eca0 in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x55ea7be6f455 in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #4 0x55ea7c49ed15 in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1588:27 + #5 0x55ea7c4901cc in zPDFInit /src/ghostpdl/./psi/zpdfops.c:991:11 + #6 0x55ea7c34de18 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0x55ea7c348426 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0x55ea7c347d8e in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x55ea7bd25f1d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #10 0x55ea7bd25aea in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #11 0x55ea7c5a14ef in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #12 0x55ea7c59e887 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #13 0x55ea7c59c792 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #14 0x55ea7c5a12c4 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #15 0x55ea7bd1e9d8 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:97:8 + #16 0x55ea7bd1e82b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #17 0x55ea7bbbc15d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #18 0x55ea7bba6ed2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #19 0x55ea7bbacda0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #20 0x55ea7bbd88d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #21 0x7fd8168e3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +0x7ee815c489df is located 16863 bytes inside of 65616-byte region [0x7ee815c44800,0x7ee815c54850) +allocated by thread T0 here: + #0 0x55ea7bcdaab4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55ea7c007620 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x55ea7be6eca0 in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x55ea7be6f455 in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #4 0x55ea7c49ed15 in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1588:27 + #5 0x55ea7c4901cc in zPDFInit /src/ghostpdl/./psi/zpdfops.c:991:11 + #6 0x55ea7c34de18 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0x55ea7c348426 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0x55ea7c347d8e in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x55ea7bd25f1d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #10 0x55ea7bd25aea in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #11 0x55ea7c5a14ef in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #12 0x55ea7c59e887 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #13 0x55ea7c59c792 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #14 0x55ea7c5a12c4 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #15 0x55ea7bd1e9d8 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:97:8 + #16 0x55ea7bd1e82b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #17 0x55ea7bbbc15d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #18 0x55ea7bba6ed2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #19 0x55ea7bbacda0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #20 0x55ea7bbd88d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #21 0x7fd8168e3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: memcpy-param-overlap /src/ghostpdl/./pdf/ghostpdf.c:1303:17 in pdfi_set_input_stream +==12147==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1684.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1684.txt new file mode 100644 index 000000000..5854e0f38 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1684.txt @@ -0,0 +1,62 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1572213182 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7eff50fb79e0, 0x7eff50fbaf6c), 959 [0x7eff51018a40, 0x7eff51018dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7eff50fbaf70,0x7eff50ff0830), 959 [0x7eff51018e00,0x7eff5101c9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1684 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x631000064878 (pc 0x631000064878 bp 0x7ffc65ec1a30 sp 0x7ffc65ec19b8 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: PC is at a non-executable region. Maybe a wild jump? + #0 0x631000064878 () + #1 0xee3d57 in pdfi_open_memory_stream_from_filtered_stream /src/ghostpdl/./pdf/pdf_file.c:1278:9 + #2 0xf04420 in pdfi_create_iccprofile /src/ghostpdl/./pdf/pdf_colour.c:1026:12 + #3 0xf04420 in pdfi_create_iccbased /src/ghostpdl/./pdf/pdf_colour.c:1121:12 + #4 0xef9ac6 in pdfi_create_colorspace_by_array /src/ghostpdl/./pdf/pdf_colour.c:2296:16 + #5 0xef7790 in pdfi_create_colorspace /src/ghostpdl/./pdf/pdf_colour.c:2437:20 + #6 0xef8253 in pdfi_create_colorspace_by_name /src/ghostpdl/./pdf/pdf_colour.c:2372:16 + #7 0xefa51d in pdfi_create_colorspace /src/ghostpdl/./pdf/pdf_colour.c:2434:16 + #8 0xefa51d in pdfi_setcolorspace /src/ghostpdl/./pdf/pdf_colour.c:2452:12 + #9 0xefa51d in pdfi_setfillcolor_space /src/ghostpdl/./pdf/pdf_colour.c:2486:12 + #10 0xed9f6e in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1440:24 + #11 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #12 0xed6d8d in pdfi_interpret_inner_content /src/ghostpdl/./pdf/pdf_int.c:1912:12 + #13 0xed6d8d in pdfi_interpret_inner_content_stream /src/ghostpdl/./pdf/pdf_int.c:2011:12 + #14 0xed6d8d in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1858:12 + #15 0xf235d1 in pdfi_form_execgroup /src/ghostpdl/./pdf/pdf_image.c:2130:12 + #16 0xf2466d in pdfi_do_form /src/ghostpdl/./pdf/pdf_image.c:2364:16 + #17 0xf24cd0 in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2462:16 + #18 0xf254cf in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2540:12 + #19 0xeda7f8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1457:24 + #20 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #21 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #22 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #23 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #24 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #25 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #26 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #27 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #28 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #29 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #30 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #31 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #32 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #33 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #34 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #35 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #36 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #37 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #38 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #39 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #40 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #41 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #42 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #43 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #44 0x7eff509b4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: pdfi_open_memory_stream_from_filtered_stream--pdfi_create_iccprofile +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV () +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1685.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1685.txt new file mode 100644 index 000000000..d4d2a1d40 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1685.txt @@ -0,0 +1,111 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1572606033 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f98478379e0, 0x7f984783af6c), 959 [0x7f9847898a40, 0x7f9847898dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f984783af70,0x7f9847870830), 959 [0x7f9847898e00,0x7f984789c9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1685 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000077968 at pc 0x000000ffd96b bp 0x7ffecaf4e5b0 sp 0x7ffecaf4e5a8 +READ of size 8 at 0x631000077968 thread T0 + #0 0xffd96a in pdfi_deref_compressed /src/ghostpdl/./pdf/pdf_deref.c:560:27 + #1 0xffd96a in pdfi_dereference /src/ghostpdl/./pdf/pdf_deref.c:805:20 + #2 0xffe2c0 in pdfi_deref_loop_detect /src/ghostpdl/./pdf/pdf_deref.c:909:12 + #3 0xeb22b3 in pdfi_dict_get /src/ghostpdl/./pdf/pdf_dict.c:235:28 + #4 0xeba2a2 in pdfi_dict_get_type /src/ghostpdl/./pdf/pdf_dict.c:431:12 + #5 0xeba2a2 in pdfi_dict_knownget_type /src/ghostpdl/./pdf/pdf_dict.c:955:12 + #6 0x1010574 in pdfi_doc_AcroForm /src/ghostpdl/./pdf/pdf_doc.c:1248:12 + #7 0x1010574 in pdfi_doc_trailer /src/ghostpdl/./pdf/pdf_doc.c:1320:12 + #8 0xeaaeb3 in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1132:12 + #9 0xeaaeb3 in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1315:12 + #10 0xe97094 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:521:12 + #11 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #12 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #13 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #14 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #15 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #16 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #17 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #18 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #19 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #20 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #21 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #22 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #23 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #24 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #25 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #26 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #27 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #28 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #29 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #30 0x7f9847234082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #31 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: pdfi_deref_compressed--pdfi_dereference--pdfi_deref_loop_detect +0x631000077968 is located 12568 bytes to the right of 65616-byte region [0x631000064800,0x631000074850) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6aa1 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f520f in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f3018 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f589d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #5 0x6f47e8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0xeadec7 in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1588:27 + #7 0xe9b4d4 in zPDFInit /src/ghostpdl/./psi/zpdfops.c:991:11 + #8 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #9 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #10 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #11 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #12 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #13 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #14 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #15 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #16 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #17 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #18 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #19 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #20 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #21 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #22 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #23 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #24 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #25 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #26 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #27 0x7f9847234082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--chunk_obj_alloc +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./pdf/pdf_deref.c:560:27 in pdfi_deref_compressed +Shadow bytes around the buggy address: + 0x0c6280006ed0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006ee0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006ef0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006f10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c6280006f20: fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]fa fa + 0x0c6280006f30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006f40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006f50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006f60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006f70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1686.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1686.txt new file mode 100644 index 000000000..4a27ef9f2 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1686.txt @@ -0,0 +1,126 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1572997111 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f3b9406d9e0, 0x7f3b94070f6c), 959 [0x7f3b940cea40, 0x7f3b940cedff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f3b94070f70,0x7f3b940a6830), 959 [0x7f3b940cee00,0x7f3b940d29f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1686 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6310001148f8 at pc 0x0000006f6a4f bp 0x7ffc0ee24d90 sp 0x7ffc0ee24d88 +WRITE of size 8 at 0x6310001148f8 thread T0 + #0 0x6f6a4e in insert_free /src/ghostpdl/./base/gsmchunk.c:654:16 + #1 0x6f6070 in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:930:17 + #2 0x6f47e8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #3 0x839cc8 in file_prepare_stream /src/ghostpdl/./base/sfxcommon.c:199:14 + #4 0x839592 in file_open_stream /src/ghostpdl/./base/sfxcommon.c:80:12 + #5 0xedce7b in pdfi_filter_open /src/ghostpdl/./pdf/pdf_file.c:105:12 + #6 0xee1d75 in pdfi_apply_SubFileDecode_filter /src/ghostpdl/./pdf/pdf_file.c:1172:12 + #7 0xf21a7c in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:1918:16 + #8 0xf24bce in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2454:16 + #9 0xf254cf in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2540:12 + #10 0xeda7f8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1457:24 + #11 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #12 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #13 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #14 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #15 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #16 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #24 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #25 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #26 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #27 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #30 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7f3b93a6a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: insert_free--chunk_obj_alloc--chunk_alloc_bytes +0x6310001148f8 is located 168 bytes to the right of 65616-byte region [0x631000104800,0x631000114850) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6aa1 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f520f in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f3018 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f589d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #5 0x6f47e8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0x1003096 in pdfi_object_alloc /src/ghostpdl/./pdf/pdf_obj.c:104:41 + #7 0xed4d27 in pdfi_name_alloc /src/ghostpdl/./pdf/pdf_int.c:1123:12 + #8 0xf95d14 in pdf_ps_RD_oper_func /src/ghostpdl/./pdf/pdf_fontps.c:1128:24 + #9 0xf93760 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:362:36 + #10 0xf950ab in pdfi_read_ps_font /src/ghostpdl/./pdf/pdf_fontps.c:1226:12 + #11 0xf70d6c in pdfi_read_type1_font /src/ghostpdl/./pdf/pdf_font1.c:529:16 + #12 0xf5cceb in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:727:32 + #13 0xf69fa7 in pdfi_load_font_by_name_string /src/ghostpdl/./pdf/pdf_font.c:1706:12 + #14 0xf66b52 in pdfi_font_set_internal_inner /src/ghostpdl/./pdf/pdf_font.c:1793:12 + #15 0xf66b52 in pdfi_font_set_internal_name /src/ghostpdl/./pdf/pdf_font.c:1814:16 + #16 0xf6685b in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1314:16 + #17 0xeda923 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1624:24 + #18 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #19 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #20 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #21 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #22 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #23 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #24 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #25 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #26 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #27 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #28 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #29 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #30 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #31 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #32 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #33 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #34 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #35 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #36 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #37 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--chunk_obj_alloc +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/gsmchunk.c:654:16 in insert_free +Shadow bytes around the buggy address: + 0x0c628001a8c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001a8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001a8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001a8f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001a900: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa +=>0x0c628001a910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa] + 0x0c628001a920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001a930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001a940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001a950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001a960: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1687.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1687.txt new file mode 100644 index 000000000..9ca4dc7e3 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1687.txt @@ -0,0 +1,57 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1573468555 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7fae518bd9e0, 0x7fae518c0f6c), 959 [0x7fae5191ea40, 0x7fae5191edff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7fae518c0f70,0x7fae518f6830), 959 [0x7fae5191ee00,0x7fae519229f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1687 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000719ff3 bp 0x7ffd73f9ff90 sp 0x7ffd73f9ff90 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: address points to the zero page. + #0 0x719ff3 in gx_num_components_ICC /src/ghostpdl/./base/gsicc.c:243:39 + #1 0x897748 in gs_color_space_num_components /src/ghostpdl/./base/gscspace.c:323:12 + #2 0x6c5d2a in clist_begin_typed_image /src/ghostpdl/./base/gxclimag.c:541:30 + #3 0xbdc087 in gx_forward_begin_typed_image /src/ghostpdl/./base/gdevnfwd.c:526:12 + #4 0x63695b in pdf14_clist_begin_typed_image /src/ghostpdl/./base/gdevp14.c:11474:12 + #5 0x8d707b in gs_image_begin_typed /src/ghostpdl/./base/gsimage.c:268:12 + #6 0xf2b661 in pdfi_render_image /src/ghostpdl/./pdf/pdf_image.c:742:16 + #7 0xf21ca8 in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:1992:12 + #8 0xf24bce in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2454:16 + #9 0xf29a83 in pdfi_do_image_smask /src/ghostpdl/./pdf/pdf_image.c:1014:20 + #10 0xf20891 in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:1767:20 + #11 0xf24bce in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2454:16 + #12 0xf254cf in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2540:12 + #13 0xeda7f8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1457:24 + #14 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #15 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #16 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #17 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #18 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #19 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #20 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #21 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #22 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #23 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #24 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #25 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #26 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #27 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #28 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #29 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #30 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #31 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #32 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #33 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #34 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #35 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #36 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #37 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #38 0x7fae512ba082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #39 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: gx_num_components_ICC--gs_color_space_num_components--clist_begin_typed_image +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gsicc.c:243:39 in gx_num_components_ICC +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1688.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1688.txt new file mode 100644 index 000000000..1ab333f75 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1688.txt @@ -0,0 +1,86 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1573955276 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f15035449e0, 0x7f1503547f6c), 959 [0x7f15035a5a40, 0x7f15035a5dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f1503547f70,0x7f150357d830), 959 [0x7f15035a5e00,0x7f15035a99f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1688 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f1501986cd4 at pc 0x0000004bea81 bp 0x7ffc56817830 sp 0x7ffc56816ff0 +WRITE of size 108 at 0x7f1501986cd4 thread T0 + #0 0x4bea80 in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xf53305 in pdfi_annot_draw /src/ghostpdl/./pdf/pdf_annot.c:3882:9 + #2 0xf4551b in pdfi_annot_handle /src/ghostpdl/./pdf/pdf_annot.c + #3 0xf4551b in pdfi_do_annotations /src/ghostpdl/./pdf/pdf_annot.c:4351:16 + #4 0xf33dee in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:165:13 + #5 0xf33dee in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #6 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #7 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #8 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #9 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #10 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #11 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #12 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #13 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #14 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #15 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #16 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #17 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #18 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #19 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #20 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #21 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #22 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #23 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #24 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #25 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #26 0x7f1502f41082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #27 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: __interceptor_memcpy--pdfi_annot_draw--pdfi_annot_handle +Address 0x7f1501986cd4 is located in stack of thread T0 at offset 212 in frame + #0 0xf52d2f in pdfi_annot_draw /src/ghostpdl/./pdf/pdf_annot.c:3849 + +DEDUP_TOKEN: pdfi_annot_draw + This frame has 4 object(s): + [32, 40) 'F.i' (line 3776) + [64, 72) 'NormAP' (line 3850) + [96, 100) 'render_done' (line 3853) + [112, 212) 'str' (line 3881) <== Memory access at offset 212 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x0fe320328d40: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe320328d50: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe320328d60: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe320328d70: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe320328d80: f1 f1 f1 f1 f8 f2 f2 f2 00 f2 f2 f2 04 f2 00 00 +=>0x0fe320328d90: 00 00 00 00 00 00 00 00 00 00[04]f3 f3 f3 f3 f3 + 0x0fe320328da0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe320328db0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe320328dc0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe320328dd0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe320328de0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1689.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1689.txt new file mode 100644 index 000000000..c77ff1c1c --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1689.txt @@ -0,0 +1,87 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1574396002 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f834faee9e0, 0x7f834faf1f6c), 959 [0x7f834fb4fa40, 0x7f834fb4fdff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f834faf1f70,0x7f834fb27830), 959 [0x7f834fb4fe00,0x7f834fb539f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1689 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7f834df5d71f at pc 0x000000ec624d bp 0x7ffe55da8570 sp 0x7ffe55da8568 +WRITE of size 1 at 0x7f834df5d71f thread T0 + #0 0xec624c in read_xref_section /src/ghostpdl/./pdf/pdf_xref.c:761:19 + #1 0xec624c in read_xref /src/ghostpdl/./pdf/pdf_xref.c:800:16 + #2 0xec3411 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1032:20 + #3 0xeaa746 in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1048:12 + #4 0xeaa746 in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1315:12 + #5 0xe97094 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:521:12 + #6 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #10 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #12 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #13 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #14 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #15 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #16 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #17 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #19 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #20 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #21 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #22 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #23 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #24 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7f834f4eb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #26 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: read_xref_section--read_xref--pdfi_read_xref +Address 0x7f834df5d71f is located in stack of thread T0 at offset 31 in frame + #0 0xec3fcf in read_xref /src/ghostpdl/./pdf/pdf_xref.c:788 + +DEDUP_TOKEN: read_xref + This frame has 6 object(s): + [32, 53) 'Buffer.i' (line 660) <== Memory access at offset 31 underflows this variable + [96, 97) 'free.i' (line 740) + [112, 120) 'off.i' (line 741) + [144, 148) 'gen.i' (line 742) + [160, 168) 'num' (line 794) + [192, 200) 'size44' (line 846) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-underflow /src/ghostpdl/./pdf/pdf_xref.c:761:19 in read_xref_section +Shadow bytes around the buggy address: + 0x0ff0e9be3a90: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff0e9be3aa0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff0e9be3ab0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff0e9be3ac0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff0e9be3ad0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0ff0e9be3ae0: f1 f1 f1[f1]00 00 05 f2 f2 f2 f2 f2 01 f2 00 f2 + 0x0ff0e9be3af0: f2 f2 04 f2 00 f2 f2 f2 f8 f3 f3 f3 00 00 00 00 + 0x0ff0e9be3b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff0e9be3b10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff0e9be3b20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff0e9be3b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1690.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1690.txt new file mode 100755 index 000000000..5c1e4cb54 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1690.txt @@ -0,0 +1,72 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3604000985 +INFO: Loaded 3 modules (156781 inline 8-bit counters): 11664 [0x7f950e7bcec0, 0x7f950e7bfc50), 878 [0x7f950e8db798, 0x7f950e8dbb06), 144239 [0x558fc6291a80, 0x558fc62b4def), +INFO: Loaded 3 PC tables (156781 PCs): 11664 [0x7f950e7bfc50,0x7f950e7ed550), 878 [0x7f950e8dbb08,0x7f950e8df1e8), 144239 [0x558fc62b4df0,0x558fc64e84e0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2021-1690 +================================================================= +==12147==ERROR: AddressSanitizer: global-buffer-overflow on address 0x558fc62718bb at pc 0x558fc40876b0 bp 0x7ffc2d192c00 sp 0x7ffc2d1923a8 +READ of size 1 at 0x558fc62718bb thread T0 + #0 0x558fc40876af in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:849:7 + #1 0x558fc408798c in memcmp /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:880:10 + #2 0x558fc48efb40 in search_table_1 /src/ghostpdl/./pdf/pdf_int.c:1191:13 + #3 0x558fc48ef6ba in split_bogus_operator /src/ghostpdl/./pdf/pdf_int.c:1319:12 + #4 0x558fc48ed89a in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1377:16 + #5 0x558fc48ed0d1 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #6 0x558fc492dd7e in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #7 0x558fc492ced4 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #8 0x558fc492a998 in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #9 0x558fc48c0cce in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #10 0x558fc477ee18 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #11 0x558fc4779426 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #12 0x558fc4778d8e in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #13 0x558fc4156f1d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #14 0x558fc4156aea in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #15 0x558fc49d24ef in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #16 0x558fc49cf887 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #17 0x558fc49cd792 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #18 0x558fc49d22c4 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #19 0x558fc414f9d8 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:97:8 + #20 0x558fc414f82b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #21 0x558fc3fed15d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #22 0x558fc3fd7ed2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #23 0x558fc3fddda0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #24 0x558fc40098d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7f950e2a2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #26 0x558fc3fd0fbd in _start (/out/gstoraster_fuzzer+0x517fbd) + +0x558fc62718bb is located 37 bytes before global variable 'op_table_2' defined in '/src/ghostpdl/./pdf/pdf_int.c:1136' (0x558fc62718e0) of size 78 +0x558fc62718bb is located 0 bytes after global variable 'op_table_1' defined in '/src/ghostpdl/./pdf/pdf_int.c:1141' (0x558fc62718a0) of size 27 +SUMMARY: AddressSanitizer: global-buffer-overflow /src/ghostpdl/./pdf/pdf_int.c:1191:13 in search_table_1 +Shadow bytes around the buggy address: + 0x558fc6271600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x558fc6271680: 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 + 0x558fc6271700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 + 0x558fc6271780: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 + 0x558fc6271800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x558fc6271880: 00 07 f9 f9 00 00 00[03]f9 f9 f9 f9 00 00 00 00 + 0x558fc6271900: 00 00 00 00 00 06 f9 f9 f9 f9 f9 f9 00 00 00 00 + 0x558fc6271980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x558fc6271a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x558fc6271a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x558fc6271b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==12147==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1692.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1692.txt new file mode 100644 index 000000000..0218936f0 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1692.txt @@ -0,0 +1,177 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1574782004 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7fe9da8d99e0, 0x7fe9da8dcf6c), 959 [0x7fe9da93aa40, 0x7fe9da93adff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7fe9da8dcf70,0x7fe9da912830), 959 [0x7fe9da93ae00,0x7fe9da93e9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1692 +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x62e00000c450 at pc 0x0000006f419d bp 0x7ffde3d36cb0 sp 0x7ffde3d36ca8 +READ of size 8 at 0x62e00000c450 thread T0 + #0 0x6f419c in chunk_free_object /src/ghostpdl/./base/gsmchunk.c:1092:14 + #1 0xee3d57 in pdfi_open_memory_stream_from_filtered_stream /src/ghostpdl/./pdf/pdf_file.c:1278:9 + #2 0xfd1855 in pdfi_build_mesh_shading /src/ghostpdl/./pdf/pdf_shading.c:308:12 + #3 0xfce899 in pdfi_shading5 /src/ghostpdl/./pdf/pdf_shading.c:432:12 + #4 0xfccd70 in pdfi_shading_build /src/ghostpdl/./pdf/pdf_shading.c:693:16 + #5 0xf08278 in pdfi_setpattern_type2 /src/ghostpdl/./pdf/pdf_pattern.c:588:12 + #6 0xf08278 in pdfi_pattern_set /src/ghostpdl/./pdf/pdf_pattern.c:663:16 + #7 0xef565c in pdfi_setcolorN /src/ghostpdl/./pdf/pdf_colour.c:773:16 + #8 0xeda748 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c + #9 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #10 0xed6d8d in pdfi_interpret_inner_content /src/ghostpdl/./pdf/pdf_int.c:1912:12 + #11 0xed6d8d in pdfi_interpret_inner_content_stream /src/ghostpdl/./pdf/pdf_int.c:2011:12 + #12 0xed6d8d in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1858:12 + #13 0xf24281 in pdfi_do_form /src/ghostpdl/./pdf/pdf_image.c:2376:16 + #14 0xf24cd0 in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2462:16 + #15 0xf254cf in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2540:12 + #16 0xeda7f8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1457:24 + #17 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #18 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #19 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #20 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #21 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #22 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #23 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #24 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #25 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #26 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #27 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #28 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #29 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #30 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #31 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #32 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #33 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #34 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #35 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #36 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #37 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #38 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #39 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #40 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #41 0x7fe9da2d6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #42 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: chunk_free_object--pdfi_open_memory_stream_from_filtered_stream--pdfi_build_mesh_shading +0x62e00000c450 is located 80 bytes inside of 40304-byte region [0x62e00000c400,0x62e000016170) +freed by thread T0 here: + #0 0x524bc2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:111:3 + #1 0x8e727b in gs_heap_free_object /src/ghostpdl/./base/gsmalloc.c:366:5 + #2 0x6f34a8 in chunk_free_object /src/ghostpdl/./base/gsmchunk.c:1105:9 + #3 0x6f34a8 in chunk_free_object /src/ghostpdl/./base/gsmchunk.c:1105:9 + #4 0xee381d in pdfi_close_memory_stream /src/ghostpdl/./pdf/pdf_file.c:1363:5 + #5 0xee381d in pdfi_open_memory_stream_from_filtered_stream /src/ghostpdl/./pdf/pdf_file.c:1277:9 + #6 0xfd1855 in pdfi_build_mesh_shading /src/ghostpdl/./pdf/pdf_shading.c:308:12 + #7 0xfce899 in pdfi_shading5 /src/ghostpdl/./pdf/pdf_shading.c:432:12 + #8 0xfccd70 in pdfi_shading_build /src/ghostpdl/./pdf/pdf_shading.c:693:16 + #9 0xf08278 in pdfi_setpattern_type2 /src/ghostpdl/./pdf/pdf_pattern.c:588:12 + #10 0xf08278 in pdfi_pattern_set /src/ghostpdl/./pdf/pdf_pattern.c:663:16 + #11 0xef565c in pdfi_setcolorN /src/ghostpdl/./pdf/pdf_colour.c:773:16 + #12 0xeda748 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c + #13 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #14 0xed6d8d in pdfi_interpret_inner_content /src/ghostpdl/./pdf/pdf_int.c:1912:12 + #15 0xed6d8d in pdfi_interpret_inner_content_stream /src/ghostpdl/./pdf/pdf_int.c:2011:12 + #16 0xed6d8d in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1858:12 + #17 0xf24281 in pdfi_do_form /src/ghostpdl/./pdf/pdf_image.c:2376:16 + #18 0xf24cd0 in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2462:16 + #19 0xf254cf in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2540:12 + #20 0xeda7f8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1457:24 + #21 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #22 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #23 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #24 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #25 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #26 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #27 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #28 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #29 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #30 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #31 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #32 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #33 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #34 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #35 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #36 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #37 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #38 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #39 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #40 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + +DEDUP_TOKEN: free--gs_heap_free_object--chunk_free_object +previously allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6aa1 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f520f in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f3018 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f520f in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #5 0x6f47e8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0xee2432 in pdfi_open_memory_stream_from_stream /src/ghostpdl/./pdf/pdf_file.c:1202:15 + #7 0xee31cf in pdfi_open_memory_stream_from_filtered_stream /src/ghostpdl/./pdf/pdf_file.c:1248:12 + #8 0xfd1855 in pdfi_build_mesh_shading /src/ghostpdl/./pdf/pdf_shading.c:308:12 + #9 0xfce899 in pdfi_shading5 /src/ghostpdl/./pdf/pdf_shading.c:432:12 + #10 0xfccd70 in pdfi_shading_build /src/ghostpdl/./pdf/pdf_shading.c:693:16 + #11 0xf08278 in pdfi_setpattern_type2 /src/ghostpdl/./pdf/pdf_pattern.c:588:12 + #12 0xf08278 in pdfi_pattern_set /src/ghostpdl/./pdf/pdf_pattern.c:663:16 + #13 0xef565c in pdfi_setcolorN /src/ghostpdl/./pdf/pdf_colour.c:773:16 + #14 0xeda748 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c + #15 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #16 0xed6d8d in pdfi_interpret_inner_content /src/ghostpdl/./pdf/pdf_int.c:1912:12 + #17 0xed6d8d in pdfi_interpret_inner_content_stream /src/ghostpdl/./pdf/pdf_int.c:2011:12 + #18 0xed6d8d in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1858:12 + #19 0xf24281 in pdfi_do_form /src/ghostpdl/./pdf/pdf_image.c:2376:16 + #20 0xf24cd0 in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2462:16 + #21 0xf254cf in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2540:12 + #22 0xeda7f8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1457:24 + #23 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #24 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #25 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #26 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #27 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #28 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #29 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #30 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #31 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #32 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #33 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #34 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #35 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #36 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #37 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #38 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--chunk_obj_alloc +SUMMARY: AddressSanitizer: heap-use-after-free /src/ghostpdl/./base/gsmchunk.c:1092:14 in chunk_free_object +Shadow bytes around the buggy address: + 0x0c5c7fff9830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5c7fff9840: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5c7fff9850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5c7fff9860: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5c7fff9870: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c5c7fff9880: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd + 0x0c5c7fff9890: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c5c7fff98a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c5c7fff98b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c5c7fff98c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c5c7fff98d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1693.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1693.txt new file mode 100644 index 000000000..ad80878fc --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1693.txt @@ -0,0 +1,62 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1961254688 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f605b1299e0, 0x7f605b12cf6c), 959 [0x7f605b18aa40, 0x7f605b18adff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f605b12cf70,0x7f605b162830), 959 [0x7f605b18ae00,0x7f605b18e9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2021-1693 +================================================================= +==1==ERROR: AddressSanitizer: unknown-crash on address 0x6874676e654c06 at pc 0x0000004be93e bp 0x7ffd45d52e90 sp 0x7ffd45d52650 +READ of size 5390569 at 0x6874676e654c06 thread T0 + #0 0x4be93d in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0x139baad in pdfi_fapi_get_glyph /src/ghostpdl/./pdf/pdf_fapi.c:1187:21 + #2 0x947ad8 in get_fapi_glyph_data /src/ghostpdl/./base/fapi_ft.c:427:22 + #3 0x995975 in cff_get_glyph_data /src/ghostpdl/./freetype/src/cff/cffgload.c:56:19 + #4 0x995975 in cff_slot_load /src/ghostpdl/./freetype/src/cff/cffgload.c:417:15 + #5 0x99163a in cff_glyph_load /src/ghostpdl/./freetype/src/cff/cffdrivr.c:192:13 + #6 0x95ca07 in FT_Load_Glyph /src/ghostpdl/./freetype/src/base/ftobjs.c:987:15 + #7 0x948b95 in load_glyph /src/ghostpdl/./base/fapi_ft.c:683:20 + #8 0x944e74 in gs_fapi_ft_get_char_raster_metrics /src/ghostpdl/./base/fapi_ft.c:1552:9 + #9 0x939de2 in gs_fapi_do_char /src/ghostpdl/./base/gxfapi.c:1570:16 + #10 0x139633d in pdfi_fapi_build_char /src/ghostpdl/./pdf/pdf_fapi.c:1386:12 + #11 0xa8e366 in show_proceed /src/ghostpdl/./base/gxchar.c:1239:12 + #12 0xa85d20 in continue_show /src/ghostpdl/./base/gxchar.c:761:12 + #13 0xa8820c in gx_show_text_process /src/ghostpdl/./base/gxchar.c:738:12 + #14 0x9221ff in gs_text_process /src/ghostpdl/./base/gstext.c:696:12 + #15 0xfc9922 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:516:16 + #16 0xfc9922 in pdfi_show_Tr_0 /src/ghostpdl/./pdf/pdf_text.c:531:12 + #17 0xfc3e92 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:913:24 + #18 0xfc5911 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1131:12 + #19 0xeda973 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1628:24 + #20 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #21 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #22 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #23 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #24 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #25 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #26 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #27 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #28 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #29 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #30 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #31 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #32 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #33 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #34 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #35 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #36 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #37 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #38 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #39 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #40 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #41 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #42 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #43 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #44 0x7f605ab26082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #45 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: __interceptor_memcpy--pdfi_fapi_get_glyph--get_fapi_glyph_data +Address 0x6874676e654c06 is a wild pointer inside of access range of size 0x0000005240e9. +SUMMARY: AddressSanitizer: unknown-crash /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1694.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1694.txt new file mode 100644 index 000000000..fba5a394a --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1694.txt @@ -0,0 +1,94 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1575747656 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7fd660b209e0, 0x7fd660b23f6c), 959 [0x7fd660b81a40, 0x7fd660b81dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7fd660b23f70,0x7fd660b59830), 959 [0x7fd660b81e00,0x7fd660b859f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1694 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fd65f124600 at pc 0x000000f8cb57 bp 0x7ffe03b6dad0 sp 0x7ffe03b6dac8 +WRITE of size 4 at 0x7fd65f124600 thread T0 + #0 0xf8cb56 in pdfi_read_cff_integer /src/ghostpdl/./pdf/pdf_font1C.c:765:14 + #1 0xf8cb56 in pdfi_read_cff_dict /src/ghostpdl/./pdf/pdf_font1C.c:1029:21 + #2 0xf8c604 in pdfi_read_cff_dict /src/ghostpdl/./pdf/pdf_font1C.c:1055:20 + #3 0xf8c604 in pdfi_read_cff_dict /src/ghostpdl/./pdf/pdf_font1C.c:1055:20 + #4 0xf7d586 in pdfi_read_cff /src/ghostpdl/./pdf/pdf_font1C.c:1552:12 + #5 0xf7d586 in pdfi_read_cff_font /src/ghostpdl/./pdf/pdf_font1C.c:2132:20 + #6 0xf5cc87 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:731:32 + #7 0xf62074 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #8 0xf666f5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #9 0xf666f5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #10 0xeda923 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1624:24 + #11 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #12 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #13 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #14 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #15 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #16 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #24 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #25 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #26 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #27 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #30 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7fd66051d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: pdfi_read_cff_integer--pdfi_read_cff_dict--pdfi_read_cff_dict +Address 0x7fd65f124600 is located in stack of thread T0 at offset 512 in frame + #0 0xf8927f in pdfi_read_cff_dict /src/ghostpdl/./pdf/pdf_font1C.c:791 + +DEDUP_TOKEN: pdfi_read_cff_dict + This frame has 3 object(s): + [32, 96) 'buf.i' (line 677) + [128, 512) 'args' (line 793) <== Memory access at offset 512 overflows this variable + [576, 584) 'fnamestr' (line 893) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ghostpdl/./pdf/pdf_font1C.c:765:14 in pdfi_read_cff_integer +Shadow bytes around the buggy address: + 0x0ffb4be1c870: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffb4be1c880: f1 f1 f1 f1 f8 f8 f8 f8 f8 f8 f8 f8 f2 f2 f2 f2 + 0x0ffb4be1c890: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffb4be1c8a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffb4be1c8b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0ffb4be1c8c0:[f2]f2 f2 f2 f2 f2 f2 f2 f8 f3 f3 f3 00 00 00 00 + 0x0ffb4be1c8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffb4be1c8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffb4be1c8f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffb4be1c900: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffb4be1c910: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1697.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1697.txt new file mode 100644 index 000000000..fb294cb2d --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1697.txt @@ -0,0 +1,135 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1576124009 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f93862339e0, 0x7f9386236f6c), 959 [0x7f9386294a40, 0x7f9386294dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f9386236f70,0x7f938626c830), 959 [0x7f9386294e00,0x7f93862989f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1697 +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x61500000ce83 at pc 0x0000006bc5c2 bp 0x7fffdd57fd50 sp 0x7fffdd57fd48 +READ of size 1 at 0x61500000ce83 thread T0 + #0 0x6bc5c1 in stell /src/ghostpdl/./base/stream.c:415:24 + #1 0xee4c67 in pdfi_unread_tell /src/ghostpdl/./pdf/pdf_file.c:1411:23 + #2 0xffb05b in pdfi_dereference /src/ghostpdl/./pdf/pdf_deref.c:799:31 + #3 0x100cf73 in pdfi_get_child /src/ghostpdl/./pdf/pdf_doc.c:282:16 + #4 0x100bddb in pdfi_get_page_dict /src/ghostpdl/./pdf/pdf_doc.c:468:16 + #5 0xf2f07e in pdfi_page_get_dict /src/ghostpdl/./pdf/pdf_page.c:610:12 + #6 0xf2dd0f in pdfi_page_info /src/ghostpdl/./pdf/pdf_page.c:481:12 + #7 0xe98c37 in zPDFpageinfo /src/ghostpdl/./psi/zpdfops.c:726:12 + #8 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #9 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #10 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #11 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #12 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #13 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #14 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #15 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #16 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #17 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #18 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #19 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #20 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #21 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #22 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #23 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #24 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #25 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #26 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #27 0x7f9385c30082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #28 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: stell--pdfi_unread_tell--pdfi_dereference +0x61500000ce83 is located 259 bytes inside of 464-byte region [0x61500000cd80,0x61500000cf50) +freed by thread T0 here: + #0 0x524bc2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:111:3 + #1 0x8e727b in gs_heap_free_object /src/ghostpdl/./base/gsmalloc.c:366:5 + #2 0x12aee77 in alloc_free_clump /src/ghostpdl/./base/gsalloc.c:2639:9 + #3 0x12aee77 in i_free_object /src/ghostpdl/./base/gsalloc.c:1559:17 + #4 0xe97267 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:527:9 + #5 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #6 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #7 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #8 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #9 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #10 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #11 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #12 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #13 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #14 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #15 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #16 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #17 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #18 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #19 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #20 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #21 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #22 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #23 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #24 0x7f9385c30082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: free--gs_heap_free_object--alloc_free_clump +previously allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6aa1 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x12b9c14 in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2488:13 + #3 0x12b1684 in alloc_obj /src/ghostpdl/./base/gsalloc.c:1952:13 + #4 0x12b1684 in i_alloc_struct_immovable /src/ghostpdl/./base/gsalloc.c:1258:11 + #5 0x6b9bb8 in s_alloc_immovable /src/ghostpdl/./base/stream.c:132:17 + #6 0xe96f6e in zPDFstream /src/ghostpdl/./psi/zpdfops.c:512:26 + #7 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #8 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #9 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #10 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #11 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #12 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #13 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #14 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #15 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #16 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #17 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #18 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #19 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #20 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #21 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #22 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #23 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #24 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #25 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #26 0x7f9385c30082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--alloc_acquire_clump +SUMMARY: AddressSanitizer: heap-use-after-free /src/ghostpdl/./base/stream.c:415:24 in stell +Shadow bytes around the buggy address: + 0x0c2a7fff9980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff9990: 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c2a7fff99a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff99b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c2a7fff99c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0c2a7fff99d0:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c2a7fff99e0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa + 0x0c2a7fff99f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff9a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff9a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff9a20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1698.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1698.txt new file mode 100644 index 000000000..4f9dd406d --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1698.txt @@ -0,0 +1,102 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1576503064 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7fc9eea0b9e0, 0x7fc9eea0ef6c), 959 [0x7fc9eea6ca40, 0x7fc9eea6cdff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7fc9eea0ef70,0x7fc9eea44830), 959 [0x7fc9eea6ce00,0x7fc9eea709f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1698 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000000023 at pc 0x0000006f6273 bp 0x7fff2e0f8420 sp 0x7fff2e0f8418 +READ of size 8 at 0x631000000023 thread T0 + #0 0x6f6272 in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:857:24 + #1 0x6f47e8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #2 0x1002cac in pdfi_object_alloc /src/ghostpdl/./pdf/pdf_obj.c:81:23 + #3 0xed0a40 in pdfi_read_num /src/ghostpdl/./pdf/pdf_int.c + #4 0xecdddf in pdfi_read_token /src/ghostpdl/./pdf/pdf_int.c:1024:20 + #5 0x1001426 in pdfi_repair_file /src/ghostpdl/./pdf/pdf_repair.c:422:52 + #6 0xec3d60 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1117:16 + #7 0xeaa746 in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1048:12 + #8 0xeaa746 in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1315:12 + #9 0xe97094 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:521:12 + #10 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #11 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #12 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #13 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #14 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #15 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #16 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #17 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #18 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #19 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #20 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #21 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #22 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #23 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #24 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #25 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #26 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #27 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #28 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #29 0x7fc9ee408082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #30 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: chunk_obj_alloc--chunk_alloc_bytes--pdfi_object_alloc +0x631000000023 is located 2013 bytes to the left of 65584-byte region [0x631000000800,0x631000010830) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6aa1 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f589d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #3 0x6f3018 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x94081a in gs_fapi_ft_init /src/ghostpdl/./base/fapi_ft.c:1900:26 + #5 0x93eace in gs_fapi_init /src/ghostpdl/./base/gxfapi.c:2013:16 + #6 0x8dbb5c in gs_lib_init1 /src/ghostpdl/./base/gsinit.c:59:21 + #7 0x561f3b in gs_main_init1 /src/ghostpdl/./psi/imain.c:201:12 + #8 0x101741e in swproc /src/ghostpdl/./psi/imainarg.c:781:29 + #9 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #10 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #11 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #12 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #13 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #14 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #15 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #16 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #17 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #18 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #19 0x7fc9ee408082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--chunk_obj_alloc +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/gsmchunk.c:857:24 in chunk_obj_alloc +Shadow bytes around the buggy address: + 0x0c627fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c627fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c627fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c627fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c627fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c627fff8000: fa fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa + 0x0c627fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c627fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c627fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c627fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c627fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1703.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1703.txt new file mode 100644 index 000000000..31fe3c4fb --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1703.txt @@ -0,0 +1,60 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1576876786 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7fcc007da9e0, 0x7fcc007ddf6c), 959 [0x7fcc0083ba40, 0x7fcc0083bdff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7fcc007ddf70,0x7fcc00813830), 959 [0x7fcc0083be00,0x7fcc0083f9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1703 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000ebd763 bp 0x7ffda9ad28b0 sp 0x7ffda9ad27e0 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: address points to the zero page. + #0 0xebd763 in pdfi_array_fetch /src/ghostpdl/./pdf/pdf_array.c:138:14 + #1 0xebd763 in pdfi_array_get /src/ghostpdl/./pdf/pdf_array.c:164:12 + #2 0x139a160 in pdfi_fapi_get_gsubr /src/ghostpdl/./pdf/pdf_fapi.c:693:20 + #3 0x952cd7 in write_gsubrs_index /src/ghostpdl/./base/write_t2.c:335:22 + #4 0x952cd7 in gs_fapi_serialize_type2_font /src/ghostpdl/./base/write_t2.c:583:5 + #5 0x9427a2 in gs_fapi_ft_get_scaled_font /src/ghostpdl/./base/fapi_ft.c:1246:30 + #6 0x930ec4 in gs_fapi_prepare_font /src/ghostpdl/./base/gxfapi.c:498:43 + #7 0x93d961 in gs_fapi_passfont /src/ghostpdl/./base/gxfapi.c:1868:13 + #8 0x1395d25 in pdfi_fapi_passfont /src/ghostpdl/./pdf/pdf_fapi.c:1463:9 + #9 0xf7d042 in pdfi_read_cff_font /src/ghostpdl/./pdf/pdf_font1C.c:2685:20 + #10 0xf5cc87 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:731:32 + #11 0xf6c166 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:277:16 + #12 0xf5c4c4 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #13 0xf62074 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #14 0xf666f5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #15 0xf666f5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #16 0xeda923 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1624:24 + #17 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #18 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #19 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #20 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #21 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #22 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #23 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #24 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #25 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #26 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #27 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #28 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #29 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #30 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #31 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #32 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #33 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #34 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #35 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #36 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #37 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #38 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #39 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #40 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #41 0x7fcc001d7082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #42 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: pdfi_array_fetch--pdfi_array_get--pdfi_fapi_get_gsubr +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_array.c:138:14 in pdfi_array_fetch +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1704.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1704.txt new file mode 100644 index 000000000..5dc850f85 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1704.txt @@ -0,0 +1,100 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1577251083 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f3c6e9049e0, 0x7f3c6e907f6c), 959 [0x7f3c6e965a40, 0x7f3c6e965dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f3c6e907f70,0x7f3c6e93d830), 959 [0x7f3c6e965e00,0x7f3c6e9699f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1704 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f3c6cf41920 at pc 0x000000f054c5 bp 0x7ffff5de42b0 sp 0x7ffff5de42a8 +WRITE of size 4 at 0x7f3c6cf41920 thread T0 + #0 0xf054c4 in pdfi_create_iccbased /src/ghostpdl/./pdf/pdf_colour.c:1116:26 + #1 0xef9ac6 in pdfi_create_colorspace_by_array /src/ghostpdl/./pdf/pdf_colour.c:2296:16 + #2 0xefa0aa in pdfi_create_colorspace /src/ghostpdl/./pdf/pdf_colour.c:2437:20 + #3 0xefa0aa in pdfi_setcolorspace /src/ghostpdl/./pdf/pdf_colour.c:2452:12 + #4 0xfcc119 in pdfi_shading_build /src/ghostpdl/./pdf/pdf_shading.c:667:12 + #5 0xfd004c in pdfi_shading /src/ghostpdl/./pdf/pdf_shading.c:897:12 + #6 0xed9fb8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1604:24 + #7 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #8 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #9 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #10 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #11 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #12 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #13 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #14 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #15 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #16 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #17 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #18 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #19 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #20 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #21 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #22 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #23 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #24 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #25 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #26 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #27 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #28 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #29 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #30 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #31 0x7f3c6e301082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #32 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: pdfi_create_iccbased--pdfi_create_colorspace_by_array--pdfi_create_colorspace +Address 0x7f3c6cf41920 is located in stack of thread T0 at offset 288 in frame + #0 0xf03a1f in pdfi_create_iccbased /src/ghostpdl/./pdf/pdf_colour.c:1046 + +DEDUP_TOKEN: pdfi_create_iccbased + This frame has 13 object(s): + [32, 40) 'profile_stream.i' (line 1010) + [64, 72) 'profile_buffer.i' (line 1011) + [96, 104) 'ICC_obj' (line 1047) + [128, 136) 'dict' (line 1048) + [160, 168) 'a' (line 1049) + [192, 200) 'N' (line 1050) + [224, 232) 'Name' (line 1051) + [256, 288) 'range' (line 1055) <== Memory access at offset 288 overflows this variable + [320, 324) 'icc_N' (line 1056) + [336, 344) 'pcs' (line 1057) + [368, 376) 'dbl' (line 1089) + [400, 664) 'cc' (line 1139) + [736, 744) 'Alternate' (line 1156) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ghostpdl/./pdf/pdf_colour.c:1116:26 in pdfi_create_iccbased +Shadow bytes around the buggy address: + 0x0fe80d9e02d0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe80d9e02e0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe80d9e02f0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe80d9e0300: f1 f1 f1 f1 f8 f2 f2 f2 f8 f2 f2 f2 00 f2 f2 f2 + 0x0fe80d9e0310: 00 f2 f2 f2 00 f2 f2 f2 00 f2 f2 f2 00 f2 f2 f2 +=>0x0fe80d9e0320: 00 00 00 00[f2]f2 f2 f2 04 f2 00 f2 f2 f2 f8 f2 + 0x0fe80d9e0330: f2 f2 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 + 0x0fe80d9e0340: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 + 0x0fe80d9e0350: f8 f8 f8 f2 f2 f2 f2 f2 f2 f2 f2 f2 f8 f3 f3 f3 + 0x0fe80d9e0360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe80d9e0370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1706.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1706.txt new file mode 100644 index 000000000..8b8a3203d --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1706.txt @@ -0,0 +1,102 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1961800895 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f80381529e0, 0x7f8038155f6c), 959 [0x7f80381b3a40, 0x7f80381b3dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f8038155f70,0x7f803818b830), 959 [0x7f80381b3e00,0x7f80381b79f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2021-1706 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000000000 at pc 0x0000010b58ae bp 0x7ffdc264c610 sp 0x7ffdc264c608 +READ of size 8 at 0x631000000000 thread T0 + #0 0x10b58ad in gx_adjust_color_Pattern /src/ghostpdl/./base/gspcolor.c:307:5 + #1 0x10b02c2 in gs_setcolor /src/ghostpdl/./base/gscolor2.c:103:5 + #2 0xef50d3 in pdfi_setfillcolor /src/ghostpdl/./pdf/pdf_colour.c:730:16 + #3 0xeda63e in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1592:24 + #4 0xedbbdb in split_bogus_operator /src/ghostpdl/./pdf/pdf_int.c:1344:12 + #5 0xed99ab in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1377:16 + #6 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #7 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #8 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #9 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #10 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #11 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #12 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #13 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #14 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #15 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #16 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #17 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #18 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #19 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #20 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #21 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #22 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #23 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #24 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #25 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #26 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #27 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #28 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #29 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #30 0x7f8037b4f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #31 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: gx_adjust_color_Pattern--gs_setcolor--pdfi_setfillcolor +0x631000000000 is located 2048 bytes to the left of 65584-byte region [0x631000000800,0x631000010830) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6aa1 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f589d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #3 0x6f3018 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x94081a in gs_fapi_ft_init /src/ghostpdl/./base/fapi_ft.c:1900:26 + #5 0x93eace in gs_fapi_init /src/ghostpdl/./base/gxfapi.c:2013:16 + #6 0x8dbb5c in gs_lib_init1 /src/ghostpdl/./base/gsinit.c:59:21 + #7 0x561f3b in gs_main_init1 /src/ghostpdl/./psi/imain.c:201:12 + #8 0x101741e in swproc /src/ghostpdl/./psi/imainarg.c:781:29 + #9 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #10 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #11 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #12 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #13 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #14 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #15 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #16 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #17 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #18 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #19 0x7f8037b4f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--chunk_obj_alloc +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/gspcolor.c:307:5 in gx_adjust_color_Pattern +Shadow bytes around the buggy address: + 0x0c627fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c627fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c627fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c627fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c627fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c627fff8000:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c627fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c627fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c627fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c627fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c627fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1707.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1707.txt new file mode 100644 index 000000000..9bbe3dc72 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1707.txt @@ -0,0 +1,65 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1578179214 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f78abbcb9e0, 0x7f78abbcef6c), 959 [0x7f78abc2ca40, 0x7f78abc2cdff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f78abbcef70,0x7f78abc04830), 959 [0x7f78abc2ce00,0x7f78abc309f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1707 +================================================================= +==1==ERROR: AddressSanitizer: negative-size-param: (size=-1) + #0 0x4be84f in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xfb634d in general_endcidrange_func /src/ghostpdl/./pdf/pdf_cmap.c:205:17 + #2 0xfb328f in cmap_endcidrange_func /src/ghostpdl/./pdf/pdf_cmap.c:227:12 + #3 0xf93760 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:362:36 + #4 0xfae297 in pdfi_read_cmap /src/ghostpdl/./pdf/pdf_cmap.c:810:12 + #5 0xf6be54 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:260:20 + #6 0xf5c4c4 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #7 0xf62074 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #8 0xf666f5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #9 0xf666f5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #10 0xeda923 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1624:24 + #11 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #12 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #13 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #14 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #15 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #16 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #24 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #25 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #26 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #27 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #30 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7f78ab5c8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: __interceptor_memcpy--general_endcidrange_func--cmap_endcidrange_func +0x62d0000156ee is located 4846 bytes inside of 32880-byte region [0x62d000014400,0x62d00001c470) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6aa1 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f520f in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f3018 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f520f in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #5 0x6f491f in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0x6f491f in chunk_alloc_byte_array_immovable /src/ghostpdl/./base/gsmchunk.c:1003:12 + #7 0x703fc0 in s_zlib_alloc /src/ghostpdl/./base/szlibc.c:88:9 + #8 0x7f78ab93f708 in inflate (/lib/x86_64-linux-gnu/libz.so.1+0xa708) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--chunk_obj_alloc +SUMMARY: AddressSanitizer: negative-size-param /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1709.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1709.txt new file mode 100644 index 000000000..7c036b6e5 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1709.txt @@ -0,0 +1,116 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1578566033 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f9ae98f19e0, 0x7f9ae98f4f6c), 959 [0x7f9ae9952a40, 0x7f9ae9952dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f9ae98f4f70,0x7f9ae992a830), 959 [0x7f9ae9952e00,0x7f9ae99569f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1709 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f9ae835d134 at pc 0x0000004bea81 bp 0x7ffd2ac5c270 sp 0x7ffd2ac5ba30 +WRITE of size 121 at 0x7f9ae835d134 thread T0 + #0 0x4bea80 in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xf200d6 in pdfi_image_get_color /src/ghostpdl/./pdf/pdf_image.c:1400:13 + #2 0xf200d6 in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:1667:12 + #3 0xf24bce in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2454:16 + #4 0xf254cf in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2540:12 + #5 0xeda7f8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1457:24 + #6 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #7 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #8 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #9 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #10 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #11 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #12 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #13 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #14 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #15 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #16 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #17 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #18 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #19 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #20 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #21 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #22 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #23 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #24 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #25 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #26 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #27 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #28 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #29 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #30 0x7f9ae92ee082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #31 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: __interceptor_memcpy--pdfi_image_get_color--pdfi_do_image +Address 0x7f9ae835d134 is located in stack of thread T0 at offset 4404 in frame + #0 0xf1e1ff in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:1543 + +DEDUP_TOKEN: pdfi_do_image + This frame has 30 object(s): + [32, 40) 'ColorSpace.i' (line 1276) + [64, 68) 'dummy.i' (line 1303) + [80, 4176) 'extra_info.i' (line 1358) + [4304, 4404) 'str.i' (line 1399) + [4448, 4456) 'item.i' (line 169) <== Memory access at offset 4404 partially underflows this variable + [4480, 4488) 'alt_stream.i' (line 170) <== Memory access at offset 4404 partially underflows this variable + [4512, 4516) 'flag.i' (line 173) <== Memory access at offset 4404 partially underflows this variable + [4528, 4532) 'known.i' (line 653) + [4544, 4552) 'new_stream' (line 1544) + [4576, 4584) 'SFD_stream' (line 1544) + [4608, 4616) 'pcs' (line 1547) + [4640, 5248) 't1image' (line 1548) + [5376, 6496) 't4image' (line 1549) + [6624, 7792) 't3image' (line 1550) + [7920, 10176) 't3ximage' (line 1551) + [10304, 10504) 'image_info' (line 1554) + [10576, 10776) 'mask_info' (line 1554) + [10848, 11048) 'smask_info' (line 1554) + [11120, 11128) 'mask_buffer' (line 1558) + [11152, 11160) 'mask_size' (line 1559) + [11184, 11204) 'trans_state' (line 1566) + [11248, 11256) 'EODString' (line 1570) + [11280, 11288) 'image_dict' (line 1583) + [11312, 11576) 'cc' (line 1696) + [11648, 11656) 'ColorSpace105' (line 1698) + [11680, 11684) 'has_Matte' (line 1761) + [11696, 11720) 'mat4' (line 1939) + [11760, 11784) 'inverseIM' (line 1939) + [11824, 11840) 'pt' (line 1940) + [11856, 11872) 'pt1' (line 1940) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x0ff3dd0639d0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 + 0x0ff3dd0639e0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 + 0x0ff3dd0639f0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 + 0x0ff3dd063a00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f2 f2 f2 f2 f2 f2 + 0x0ff3dd063a10: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 +=>0x0ff3dd063a20: 00 00 00 00 00 00[04]f2 f2 f2 f2 f2 f8 f2 f2 f2 + 0x0ff3dd063a30: f8 f2 f2 f2 f8 f2 f8 f2 00 f2 f2 f2 00 f2 f2 f2 + 0x0ff3dd063a40: 00 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff3dd063a50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff3dd063a60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff3dd063a70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1711.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1711.txt new file mode 100644 index 000000000..23b554a1f --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1711.txt @@ -0,0 +1,115 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1578959619 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f7449da89e0, 0x7f7449dabf6c), 959 [0x7f7449e09a40, 0x7f7449e09dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f7449dabf70,0x7f7449de1830), 959 [0x7f7449e09e00,0x7f7449e0d9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1711 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000074850 at pc 0x0000004bea81 bp 0x7ffd7b8d0380 sp 0x7ffd7b8cfb40 +WRITE of size 25360 at 0x631000074850 thread T0 + #0 0x4bea80 in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xfb11bb in cmap_endcodespacerange_func /src/ghostpdl/./pdf/pdf_cmap.c:120:13 + #2 0xf93760 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:362:36 + #3 0xfae297 in pdfi_read_cmap /src/ghostpdl/./pdf/pdf_cmap.c:810:12 + #4 0xf6be54 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:260:20 + #5 0xf5c4c4 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #6 0xf62074 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #7 0xf666f5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #8 0xf666f5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #9 0xeda923 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1624:24 + #10 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #11 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #12 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #13 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #14 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #15 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #16 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #17 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #18 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #19 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #20 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #21 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #22 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #23 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #24 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #25 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #26 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #27 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #28 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #29 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #30 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #31 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #32 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #33 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #34 0x7f74497a5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #35 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: __interceptor_memcpy--cmap_endcodespacerange_func--pdfi_pscript_interpret +0x631000074850 is located 0 bytes to the right of 65616-byte region [0x631000064800,0x631000074850) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6aa1 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f520f in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f3018 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f589d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #5 0x6f47e8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0xeadec7 in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1588:27 + #7 0xe9b4d4 in zPDFInit /src/ghostpdl/./psi/zpdfops.c:991:11 + #8 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #9 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #10 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #11 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #12 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #13 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #14 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #15 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #16 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #17 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #18 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #19 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #20 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #21 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #22 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #23 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #24 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #25 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #26 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #27 0x7f74497a5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--chunk_obj_alloc +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x0c62800068b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800068c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800068d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800068e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800068f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c6280006900: 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa + 0x0c6280006910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280006950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1715.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1715.txt new file mode 100644 index 000000000..277712bf9 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1715.txt @@ -0,0 +1,58 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1579374767 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f38b144d9e0, 0x7f38b1450f6c), 959 [0x7f38b14aea40, 0x7f38b14aedff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f38b1450f70,0x7f38b1486830), 959 [0x7f38b14aee00,0x7f38b14b29f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1715 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x0000006be0cd bp 0x7ffcaa365b30 sp 0x7ffcaa365a40 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x6be0cd in stream_compact /src/ghostpdl/./base/stream.c:1009:21 + #1 0x6be0cd in sreadbuf /src/ghostpdl/./base/stream.c:855:13 + #2 0x6bc9ac in s_process_read_buf /src/ghostpdl/./base/stream.c:768:14 + #3 0x6bc9ac in spgetcc /src/ghostpdl/./base/stream.c:481:9 + #4 0x6bd7bd in sgets /src/ghostpdl/./base/stream.c:577:17 + #5 0xee2cc9 in pdfi_read_bytes /src/ghostpdl/./pdf/pdf_file.c:1471:16 + #6 0xecc019 in pdfi_skip_white /src/ghostpdl/./pdf/pdf_int.c:114:17 + #7 0xecc019 in pdfi_read_token /src/ghostpdl/./pdf/pdf_int.c:1001:5 + #8 0xffdd6e in pdfi_read_object /src/ghostpdl/./pdf/pdf_deref.c:494:12 + #9 0xffbe2b in pdfi_dereference /src/ghostpdl/./pdf/pdf_deref.c:831:20 + #10 0xeb399c in pdfi_dict_get_no_store_R_inner /src/ghostpdl/./pdf/pdf_dict.c:389:28 + #11 0xeb399c in pdfi_dict_get_no_store_R_key /src/ghostpdl/./pdf/pdf_dict.c:412:12 + #12 0x100e40f in pdfi_find_resource /src/ghostpdl/./pdf/pdf_doc.c + #13 0xf16849 in pdfi_setgstate /src/ghostpdl/./pdf/pdf_gstate.c:2347:12 + #14 0xeda716 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1500:24 + #15 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #16 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #17 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #18 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #19 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #20 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #21 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #22 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #23 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #24 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #25 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #26 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #27 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #28 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #29 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #30 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #31 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #32 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #33 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #34 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #35 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #36 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #37 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #38 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #39 0x7f38b0e4a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #40 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: stream_compact--sreadbuf--s_process_read_buf +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/stream.c:1009:21 in stream_compact +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1717.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1717.txt new file mode 100644 index 000000000..aa478a817 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1717.txt @@ -0,0 +1,49 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1579890300 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7fe6c9ab79e0, 0x7fe6c9abaf6c), 959 [0x7fe6c9b18a40, 0x7fe6c9b18dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7fe6c9abaf70,0x7fe6c9af0830), 959 [0x7fe6c9b18e00,0x7fe6c9b1c9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1717 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x631100081b1f (pc 0x000000f7e1e6 bp 0x7ffea5176180 sp 0x7ffea5175ea0 T0) +==1==The signal is caused by a READ memory access. + #0 0xf7e1e6 in pdfi_read_cff /src/ghostpdl/./pdf/pdf_font1C.c:1643:30 + #1 0xf7e1e6 in pdfi_read_cff_font /src/ghostpdl/./pdf/pdf_font1C.c:2132:20 + #2 0xf5cc87 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:731:32 + #3 0xf62074 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #4 0xf666f5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #5 0xf666f5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #6 0xeda923 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1624:24 + #7 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #8 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #9 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #10 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #11 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #12 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #13 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #14 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #15 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #16 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #17 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #18 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #19 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #20 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #21 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #22 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #23 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #24 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #25 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #26 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #27 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #28 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #29 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #30 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #31 0x7fe6c94b4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #32 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: pdfi_read_cff--pdfi_read_cff_font--pdfi_load_font +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_font1C.c:1643:30 in pdfi_read_cff +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1719.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1719.txt new file mode 100644 index 000000000..8ec293949 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1719.txt @@ -0,0 +1,126 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1580275236 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7fadf87b79e0, 0x7fadf87baf6c), 959 [0x7fadf8818a40, 0x7fadf8818dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7fadf87baf70,0x7fadf87f0830), 959 [0x7fadf8818e00,0x7fadf881c9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1719 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6310001148f8 at pc 0x0000006f6a4f bp 0x7ffe119fba10 sp 0x7ffe119fba08 +WRITE of size 8 at 0x6310001148f8 thread T0 + #0 0x6f6a4e in insert_free /src/ghostpdl/./base/gsmchunk.c:654:16 + #1 0x6f6070 in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:930:17 + #2 0x6f47e8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #3 0x839cc8 in file_prepare_stream /src/ghostpdl/./base/sfxcommon.c:199:14 + #4 0x839592 in file_open_stream /src/ghostpdl/./base/sfxcommon.c:80:12 + #5 0xedce7b in pdfi_filter_open /src/ghostpdl/./pdf/pdf_file.c:105:12 + #6 0xee1d75 in pdfi_apply_SubFileDecode_filter /src/ghostpdl/./pdf/pdf_file.c:1172:12 + #7 0xf21a7c in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:1918:16 + #8 0xf24bce in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2454:16 + #9 0xf254cf in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2540:12 + #10 0xeda7f8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1457:24 + #11 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #12 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #13 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #14 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #15 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #16 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #24 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #25 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #26 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #27 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #30 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7fadf81b4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: insert_free--chunk_obj_alloc--chunk_alloc_bytes +0x6310001148f8 is located 168 bytes to the right of 65616-byte region [0x631000104800,0x631000114850) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6aa1 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f520f in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f3018 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f589d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #5 0x6f47e8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0x1003096 in pdfi_object_alloc /src/ghostpdl/./pdf/pdf_obj.c:104:41 + #7 0xed4d27 in pdfi_name_alloc /src/ghostpdl/./pdf/pdf_int.c:1123:12 + #8 0xf95d14 in pdf_ps_RD_oper_func /src/ghostpdl/./pdf/pdf_fontps.c:1128:24 + #9 0xf93760 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:362:36 + #10 0xf950ab in pdfi_read_ps_font /src/ghostpdl/./pdf/pdf_fontps.c:1226:12 + #11 0xf70d6c in pdfi_read_type1_font /src/ghostpdl/./pdf/pdf_font1.c:529:16 + #12 0xf5cceb in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:727:32 + #13 0xf69fa7 in pdfi_load_font_by_name_string /src/ghostpdl/./pdf/pdf_font.c:1706:12 + #14 0xf66b52 in pdfi_font_set_internal_inner /src/ghostpdl/./pdf/pdf_font.c:1793:12 + #15 0xf66b52 in pdfi_font_set_internal_name /src/ghostpdl/./pdf/pdf_font.c:1814:16 + #16 0xf6685b in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1314:16 + #17 0xeda923 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1624:24 + #18 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #19 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #20 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #21 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #22 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #23 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #24 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #25 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #26 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #27 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #28 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #29 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #30 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #31 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #32 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #33 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #34 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #35 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #36 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #37 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--chunk_obj_alloc +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/gsmchunk.c:654:16 in insert_free +Shadow bytes around the buggy address: + 0x0c628001a8c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001a8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001a8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001a8f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c628001a900: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa +=>0x0c628001a910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa] + 0x0c628001a920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001a930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001a940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001a950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c628001a960: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1723.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1723.txt new file mode 100644 index 000000000..904b3d30f --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1723.txt @@ -0,0 +1,88 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1580745399 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f7f84bd19e0, 0x7f7f84bd4f6c), 959 [0x7f7f84c32a40, 0x7f7f84c32dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f7f84bd4f70,0x7f7f84c0a830), 959 [0x7f7f84c32e00,0x7f7f84c369f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1723 +================================================================= +==1==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000001999d91 at pc 0x0000004bec26 bp 0x7ffcb487f720 sp 0x7ffcb487eec8 +READ of size 20 at 0x000001999d91 thread T0 + #0 0x4bec25 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:860:7 + #1 0x4bf11b in memcmp /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:892:10 + #2 0xf98964 in ps_font_def_func /src/ghostpdl/./pdf/pdf_fontps.c:695:19 + #3 0xf93760 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:362:36 + #4 0xf950ab in pdfi_read_ps_font /src/ghostpdl/./pdf/pdf_fontps.c:1226:12 + #5 0xf70d6c in pdfi_read_type1_font /src/ghostpdl/./pdf/pdf_font1.c:529:16 + #6 0xf5cceb in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:727:32 + #7 0xf62074 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #8 0xf666f5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #9 0xf666f5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #10 0xeda923 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1624:24 + #11 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #12 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #13 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #14 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #15 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #16 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #24 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #25 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #26 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #27 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #30 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7f7f845ce082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long)--memcmp--ps_font_def_func +0x000001999d91 is located 47 bytes to the left of global variable '' defined in './pdf/pdf_fontps.c:1109:25' (0x1999dc0) of size 33 + '' is ascii string 'pdf_ps_RD_oper_func(subr string)' +0x000001999d91 is located 0 bytes to the right of global variable '' defined in './pdf/pdf_fontps.c:1212:6' (0x1999d80) of size 17 + '' is ascii string 'StandardEncoding' +SUMMARY: AddressSanitizer: global-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:860:7 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) +Shadow bytes around the buggy address: + 0x00008032b360: 02 f9 f9 f9 00 05 f9 f9 05 f9 f9 f9 06 f9 f9 f9 + 0x00008032b370: 04 f9 f9 f9 04 f9 f9 f9 04 f9 f9 f9 04 f9 f9 f9 + 0x00008032b380: 00 07 f9 f9 00 03 f9 f9 00 01 f9 f9 05 f9 f9 f9 + 0x00008032b390: 06 f9 f9 f9 06 f9 f9 f9 06 f9 f9 f9 06 f9 f9 f9 + 0x00008032b3a0: 03 f9 f9 f9 07 f9 f9 f9 04 f9 f9 f9 04 f9 f9 f9 +=>0x00008032b3b0: 00 00[01]f9 f9 f9 f9 f9 00 00 00 00 01 f9 f9 f9 + 0x00008032b3c0: f9 f9 f9 f9 00 01 f9 f9 00 04 f9 f9 00 01 f9 f9 + 0x00008032b3d0: 00 02 f9 f9 00 04 f9 f9 06 f9 f9 f9 06 f9 f9 f9 + 0x00008032b3e0: 00 01 f9 f9 05 f9 f9 f9 00 00 00 04 f9 f9 f9 f9 + 0x00008032b3f0: 00 00 00 00 f9 f9 f9 f9 00 01 f9 f9 00 00 00 00 + 0x00008032b400: f9 f9 f9 f9 00 01 f9 f9 00 03 f9 f9 00 03 f9 f9 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1724.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1724.txt new file mode 100644 index 000000000..5c72d90a9 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1724.txt @@ -0,0 +1,53 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1581143176 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f997981b9e0, 0x7f997981ef6c), 959 [0x7f997987ca40, 0x7f997987cdff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f997981ef70,0x7f9979854830), 959 [0x7f997987ce00,0x7f99798809f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1724 +================================================================= +==1==ERROR: AddressSanitizer: unknown-crash on address 0x3470203662342872 at pc 0x0000004be93e bp 0x7fff284f3b40 sp 0x7fff284f3300 +READ of size 1920286312 at 0x3470203662342872 thread T0 + #0 0x4be93d in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xfb11bb in cmap_endcodespacerange_func /src/ghostpdl/./pdf/pdf_cmap.c:120:13 + #2 0xf93760 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:362:36 + #3 0xfae297 in pdfi_read_cmap /src/ghostpdl/./pdf/pdf_cmap.c:810:12 + #4 0xfa5976 in pdfi_read_truetype_font /src/ghostpdl/./pdf/pdf_fontTT.c:459:20 + #5 0xf5cddc in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:739:40 + #6 0xf62074 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #7 0xf666f5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #8 0xf666f5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #9 0xeda923 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1624:24 + #10 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #11 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #12 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #13 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #14 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #15 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #16 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #17 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #18 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #19 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #20 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #21 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #22 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #23 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #24 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #25 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #26 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #27 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #28 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #29 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #30 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #31 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #32 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #33 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #34 0x7f9979218082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #35 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: __interceptor_memcpy--cmap_endcodespacerange_func--pdfi_pscript_interpret +Address 0x3470203662342872 is a wild pointer inside of access range of size 0x000072753e68. +SUMMARY: AddressSanitizer: unknown-crash /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1731.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1731.txt new file mode 100644 index 000000000..e573a0140 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1731.txt @@ -0,0 +1,114 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1581532631 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f17be1b39e0, 0x7f17be1b6f6c), 959 [0x7f17be214a40, 0x7f17be214dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f17be1b6f70,0x7f17be1ec830), 959 [0x7f17be214e00,0x7f17be2189f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1731 +================================================================= +==1==ERROR: AddressSanitizer: memcpy-param-overlap: memory ranges [0x6310000008a8,0x6311121e08a8) and [0x631000086680, 0x631112266680) overlap + #0 0x4be7af in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0x937a25 in recreate_multiple_master /src/ghostpdl/./base/gxfapi.c:297:13 + #2 0x937a25 in gs_fapi_do_char /src/ghostpdl/./base/gxfapi.c:1312:9 + #3 0x139633d in pdfi_fapi_build_char /src/ghostpdl/./pdf/pdf_fapi.c:1386:12 + #4 0xa8e366 in show_proceed /src/ghostpdl/./base/gxchar.c:1239:12 + #5 0xa85d20 in continue_show /src/ghostpdl/./base/gxchar.c:761:12 + #6 0xa8820c in gx_show_text_process /src/ghostpdl/./base/gxchar.c:738:12 + #7 0x9221ff in gs_text_process /src/ghostpdl/./base/gstext.c:696:12 + #8 0xfc9922 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:516:16 + #9 0xfc9922 in pdfi_show_Tr_0 /src/ghostpdl/./pdf/pdf_text.c:531:12 + #10 0xfc3e92 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:913:24 + #11 0xfc5911 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1131:12 + #12 0xeda973 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1628:24 + #13 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #14 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #15 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #16 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #17 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #18 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #19 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #20 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #21 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #22 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #23 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #24 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #25 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #26 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #27 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #28 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #29 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #30 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #31 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #32 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #33 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #34 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #35 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #36 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #37 0x7f17bdbb0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #38 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: __interceptor_memcpy--recreate_multiple_master--gs_fapi_do_char +0x631000010830 is located 0 bytes to the right of 65584-byte region [0x631000000800,0x631000010830) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6aa1 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f589d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #3 0x6f3018 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x94081a in gs_fapi_ft_init /src/ghostpdl/./base/fapi_ft.c:1900:26 + #5 0x93eace in gs_fapi_init /src/ghostpdl/./base/gxfapi.c:2013:16 + #6 0x8dbb5c in gs_lib_init1 /src/ghostpdl/./base/gsinit.c:59:21 + #7 0x561f3b in gs_main_init1 /src/ghostpdl/./psi/imain.c:201:12 + #8 0x101741e in swproc /src/ghostpdl/./psi/imainarg.c:781:29 + #9 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #10 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #11 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #12 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #13 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #14 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #15 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #16 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #17 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #18 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #19 0x7f17bdbb0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--chunk_obj_alloc +0x631000088850 is located 0 bytes to the right of 65616-byte region [0x631000078800,0x631000088850) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6aa1 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f520f in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f3018 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f589d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #5 0x6f496c in chunk_alloc_struct_array /src/ghostpdl/./base/gsmchunk.c:1024:12 + #6 0x136637a in gx_char_cache_alloc /src/ghostpdl/./base/gxccman.c:88:13 + #7 0x12c39d9 in gs_font_dir_alloc2_limits /src/ghostpdl/./base/gsfont.c:263:12 + #8 0x12c3880 in gs_font_dir_alloc2 /src/ghostpdl/./base/gsfont.c:236:16 + #9 0xf69ab0 in pdfi_init_font_directory /src/ghostpdl/./pdf/pdf_font.c:1662:21 + #10 0xeae0c9 in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1624:12 + #11 0xe9b4d4 in zPDFInit /src/ghostpdl/./psi/zpdfops.c:991:11 + #12 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #13 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #14 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #15 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #16 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #17 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #18 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #19 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #20 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #21 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #22 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #23 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #24 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #25 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #26 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #27 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #28 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #29 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #30 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #31 0x7f17bdbb0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--chunk_obj_alloc +SUMMARY: AddressSanitizer: memcpy-param-overlap /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1740.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1740.txt new file mode 100644 index 000000000..d81f8f920 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1740.txt @@ -0,0 +1,86 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1582128394 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f9a314359e0, 0x7f9a31438f6c), 959 [0x7f9a31496a40, 0x7f9a31496dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f9a31438f70,0x7f9a3146e830), 959 [0x7f9a31496e00,0x7f9a3149a9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1740 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f9a2f9a5184 at pc 0x0000004bea81 bp 0x7ffd93da4350 sp 0x7ffd93da3b10 +WRITE of size 2448 at 0x7f9a2f9a5184 thread T0 + #0 0x4bea80 in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xf4c395 in pdfi_annot_draw_LE_one /src/ghostpdl/./pdf/pdf_annot.c:1449:9 + #2 0xf4bdc0 in pdfi_annot_draw_LE /src/ghostpdl/./pdf/pdf_annot.c:1508:16 + #3 0xf3ab06 in pdfi_annot_draw_Line /src/ghostpdl/./pdf/pdf_annot.c:3025:12 + #4 0xf5325f in pdfi_annot_draw /src/ghostpdl/./pdf/pdf_annot.c:3876:24 + #5 0xf4551b in pdfi_annot_handle /src/ghostpdl/./pdf/pdf_annot.c + #6 0xf4551b in pdfi_do_annotations /src/ghostpdl/./pdf/pdf_annot.c:4351:16 + #7 0xf33dee in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:165:13 + #8 0xf33dee in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #9 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #10 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #11 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #12 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #13 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #14 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #15 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #16 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #17 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #18 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #19 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #20 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #21 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #22 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #23 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #24 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #25 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #26 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #27 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #28 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #29 0x7f9a30e32082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #30 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: __interceptor_memcpy--pdfi_annot_draw_LE_one--pdfi_annot_draw_LE +Address 0x7f9a2f9a5184 is located in stack of thread T0 at offset 132 in frame + #0 0xf4c0af in pdfi_annot_draw_LE_one /src/ghostpdl/./pdf/pdf_annot.c:1428 + +DEDUP_TOKEN: pdfi_annot_draw_LE_one + This frame has 1 object(s): + [32, 132) 'str' (line 1448) <== Memory access at offset 132 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x0ff3c5f2c9e0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff3c5f2c9f0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff3c5f2ca00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff3c5f2ca10: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff3c5f2ca20: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0ff3c5f2ca30:[04]f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 + 0x0ff3c5f2ca40: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff3c5f2ca50: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff3c5f2ca60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff3c5f2ca70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff3c5f2ca80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1741.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1741.txt new file mode 100755 index 000000000..247c0675a --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1741.txt @@ -0,0 +1,96 @@ +vm.mmap_rnd_bits = 28 +/out/gstoraster_fuzzer -- -rss_limit_mb=2560 -timeout=25 -runs=10 /corpus/testcase-OSV-2021-1741 < /dev/null +INFO: libFuzzer ignores flags that start with '--' +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 411937510 +INFO: Loaded 3 modules (182736 inline 8-bit counters): 13708 [0x7fec3ae5a9e0, 0x7fec3ae5df6c), 959 [0x7fec3aebba40, 0x7fec3aebbdff), 168069 [0x2d9ae50, 0x2dc3ed5), +INFO: Loaded 3 PC tables (182736 PCs): 13708 [0x7fec3ae5df70,0x7fec3ae93830), 959 [0x7fec3aebbe00,0x7fec3aebf9f0), 168069 [0x24c7730,0x2757f80), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2021-1741 +================================================================= +==15==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fec39b6c348 at pc 0x000000ba70b8 bp 0x7ffd38d75ad0 sp 0x7ffd38d75ac8 +WRITE of size 4 at 0x7fec39b6c348 thread T0 +SCARINESS: 51 (4-byte-write-stack-buffer-overflow) + #0 0xba70b7 in line_join_points /src/ghostpdl/./base/gxstroke.c:2470:9 + #1 0xb9f1e8 in stroke_add_compat /src/ghostpdl/./base/gxstroke.c:2302:20 + #2 0xb96b09 in gx_stroke_path_only_aux /src/ghostpdl/./base/gxstroke.c:1033:24 + #3 0xb96b09 in gx_stroke_path_only /src/ghostpdl/./base/gxstroke.c:1121:12 + #4 0xb92830 in gx_default_stroke_path_shading_or_pattern /src/ghostpdl/./base/gxstroke.c:357:12 + #5 0xb9a915 in gx_default_stroke_path /src/ghostpdl/./base/gxstroke.c:379:16 + #6 0x11a20cf in clist_playback_band /src/ghostpdl/./base/gxclrast.c + #7 0x68ef8c in clist_playback_file_bands /src/ghostpdl/./base/gxclread.c:1035:16 + #8 0x6935e0 in clist_render_rectangle /src/ghostpdl/./base/gxclread.c:969:16 + #9 0x6929ba in clist_rasterize_lines /src/ghostpdl/./base/gxclread.c:858:20 + #10 0x691b7f in clist_get_bits_rectangle /src/ghostpdl/./base/gxclread.c:747:12 + #11 0x66615a in gdev_prn_get_bits /src/ghostpdl/./base/gdevprn.c:1636:12 + #12 0x7ed354 in cups_print_chunked /src/ghostpdl/./cups/gdevcups.c:4849:9 + #13 0x7dbc3b in cups_print_pages /src/ghostpdl/./cups/gdevcups.c + #14 0x661fe9 in gdev_prn_output_page_aux /src/ghostpdl/./base/gdevprn.c:1049:27 + #15 0x6612a5 in gdev_prn_output_page /src/ghostpdl/./base/gdevprn.c:1085:12 + #16 0x7ecb09 in cups_output_page /src/ghostpdl/./cups/gdevcups.c:2826:15 + #17 0x8a796f in gs_output_page /src/ghostpdl/./base/gsdevice.c:207:17 + #18 0xdccbd2 in zoutputpage /src/ghostpdl/./psi/zdevice.c:416:12 + #19 0xcfba9c in interp /src/ghostpdl/./psi/interp.c:1351:28 + #20 0xcfba9c in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #21 0xcfba9c in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #22 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #23 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #24 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #25 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #26 0x101f961 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #27 0x101b999 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #28 0x101887e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #29 0x101f6e9 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #30 0xce7584 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #31 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #32 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #33 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #34 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #35 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #36 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #37 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #38 0x7fec3a856082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #39 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: line_join_points--stroke_add_compat--gx_stroke_path_only_aux +Address 0x7fec39b6c348 is located in stack of thread T0 at offset 72 in frame + #0 0xb9deef in stroke_add_compat /src/ghostpdl/./base/gxstroke.c:2238 + +DEDUP_TOKEN: stroke_add_compat + This frame has 1 object(s): + [32, 72) 'points' (line 2243) <== Memory access at offset 72 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ghostpdl/./base/gxstroke.c:2470:9 in line_join_points +Shadow bytes around the buggy address: + 0x0ffe07365810: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffe07365820: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffe07365830: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffe07365840: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffe07365850: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0ffe07365860: f1 f1 f1 f1 00 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 + 0x0ffe07365870: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffe07365880: f1 f1 f1 f1 f8 f8 f8 f8 f2 f2 f2 f2 f8 f3 f3 f3 + 0x0ffe07365890: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffe073658a0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffe073658b0: f1 f1 f1 f1 f8 f2 f2 f2 f8 f3 f3 f3 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==15==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1743.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1743.txt new file mode 100644 index 000000000..c3695a051 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1743.txt @@ -0,0 +1,91 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1582570525 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f3f1a37a9e0, 0x7f3f1a37df6c), 959 [0x7f3f1a3dba40, 0x7f3f1a3dbdff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f3f1a37df70,0x7f3f1a3b3830), 959 [0x7f3f1a3dbe00,0x7f3f1a3df9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1743 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f3f18c6b040 at pc 0x00000050f474 bp 0x7fff11c6e570 sp 0x7fff11c6dd00 +WRITE of size 16134 at 0x7f3f18c6b040 thread T0 + #0 0x50f473 in strncat /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:399:5 + #1 0xfaf413 in pdf_cmap_open_file /src/ghostpdl/./pdf/pdf_cmap.c:642:5 + #2 0xfadc1a in pdfi_read_cmap /src/ghostpdl/./pdf/pdf_cmap.c:746:16 + #3 0xf6b4c3 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:197:16 + #4 0xf5c4c4 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #5 0xf62074 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #6 0xf666f5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #7 0xf666f5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #8 0xeda923 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1624:24 + #9 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #10 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #11 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #12 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #13 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #14 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #15 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #16 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #17 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #18 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #19 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #20 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #21 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #22 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #23 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #24 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #25 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #26 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #27 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #28 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #29 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #30 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #31 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #32 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #33 0x7f3f19d77082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #34 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: strncat--pdf_cmap_open_file--pdfi_read_cmap +Address 0x7f3f18c6b040 is located in stack of thread T0 at offset 4160 in frame + #0 0xfaf29f in pdf_cmap_open_file /src/ghostpdl/./pdf/pdf_cmap.c:634 + +DEDUP_TOKEN: pdf_cmap_open_file + This frame has 2 object(s): + [32, 40) 's' (line 636) + [64, 4160) 'fname' (line 637) <== Memory access at offset 4160 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:399:5 in strncat +Shadow bytes around the buggy address: + 0x0fe8631855b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe8631855c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe8631855d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe8631855e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe8631855f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fe863185600: 00 00 00 00 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 f3 + 0x0fe863185610: f3 f3 f3 f3 f3 f3 f3 f3 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe863185620: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe863185630: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe863185640: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe863185650: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1752.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1752.txt new file mode 100644 index 000000000..0e1f6d1cc --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1752.txt @@ -0,0 +1,123 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1583198134 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f68240b19e0, 0x7f68240b4f6c), 959 [0x7f6824112a40, 0x7f6824112dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f68240b4f70,0x7f68240ea830), 959 [0x7f6824112e00,0x7f68241169f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1752 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000088850 at pc 0x000000d2becb bp 0x7fffa14a17a0 sp 0x7fffa14a1798 +READ of size 1 at 0x631000088850 thread T0 + #0 0xd2beca in s_hex_process /src/ghostpdl/./base/sstring.c:416:33 + #1 0xc9a238 in s_exD_process /src/ghostpdl/./base/seexec.c:168:18 + #2 0x6bdfe7 in sreadbuf /src/ghostpdl/./base/stream.c:842:22 + #3 0x6bc9ac in s_process_read_buf /src/ghostpdl/./base/stream.c:768:14 + #4 0x6bc9ac in spgetcc /src/ghostpdl/./base/stream.c:481:9 + #5 0xf9f464 in ps_font_eexec_func /src/ghostpdl/./pdf/pdf_fontps.c:961:13 + #6 0xf93760 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:362:36 + #7 0xf950ab in pdfi_read_ps_font /src/ghostpdl/./pdf/pdf_fontps.c:1226:12 + #8 0xf70d6c in pdfi_read_type1_font /src/ghostpdl/./pdf/pdf_font1.c:529:16 + #9 0xf5cceb in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:727:32 + #10 0xf62074 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #11 0xf666f5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #12 0xf666f5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #13 0xeda923 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1624:24 + #14 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #15 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #16 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #17 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #18 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #19 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #20 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #21 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #22 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #23 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #24 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #25 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #26 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #27 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #28 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #29 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #30 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #31 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #32 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #33 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #34 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #35 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #36 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #37 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #38 0x7f6823aae082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #39 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: s_hex_process--s_exD_process--sreadbuf +0x631000088850 is located 0 bytes to the right of 65616-byte region [0x631000078800,0x631000088850) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6aa1 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f520f in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f3018 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f589d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #5 0x6f496c in chunk_alloc_struct_array /src/ghostpdl/./base/gsmchunk.c:1024:12 + #6 0x136637a in gx_char_cache_alloc /src/ghostpdl/./base/gxccman.c:88:13 + #7 0x12c39d9 in gs_font_dir_alloc2_limits /src/ghostpdl/./base/gsfont.c:263:12 + #8 0x12c3880 in gs_font_dir_alloc2 /src/ghostpdl/./base/gsfont.c:236:16 + #9 0xf69ab0 in pdfi_init_font_directory /src/ghostpdl/./pdf/pdf_font.c:1662:21 + #10 0xeae0c9 in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1624:12 + #11 0xe9b4d4 in zPDFInit /src/ghostpdl/./psi/zpdfops.c:991:11 + #12 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #13 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #14 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #15 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #16 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #17 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #18 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #19 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #20 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #21 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #22 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #23 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #24 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #25 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #26 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #27 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #28 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #29 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #30 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #31 0x7f6823aae082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--chunk_obj_alloc +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/sstring.c:416:33 in s_hex_process +Shadow bytes around the buggy address: + 0x0c62800090b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800090c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800090d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800090e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800090f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c6280009100: 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa + 0x0c6280009110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280009150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1753.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1753.txt new file mode 100644 index 000000000..ec50d740d --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1753.txt @@ -0,0 +1,56 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1583588913 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f6d99f799e0, 0x7f6d99f7cf6c), 959 [0x7f6d99fdaa40, 0x7f6d99fdadff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f6d99f7cf70,0x7f6d99fb2830), 959 [0x7f6d99fdae00,0x7f6d99fde9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1753 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000001000 (pc 0x000000df7ccc bp 0x7ffc3e5c3c10 sp 0x7ffc3e5c3be0 T0) +==1==The signal is caused by a READ memory access. + #0 0xdf7ccc in names_string_ref /src/ghostpdl/./psi/iname.c:248:34 + #1 0xd782b2 in zfont_glyph_name /src/ghostpdl/./psi/zbfont.c:141:5 + #2 0x139d980 in pdfi_fapi_get_glyphname_or_cid /src/ghostpdl/./pdf/pdf_fapi.c:1094:16 + #3 0x938cb0 in gs_fapi_do_char /src/ghostpdl/./base/gxfapi.c:1448:14 + #4 0x139633d in pdfi_fapi_build_char /src/ghostpdl/./pdf/pdf_fapi.c:1386:12 + #5 0xa8e366 in show_proceed /src/ghostpdl/./base/gxchar.c:1239:12 + #6 0xa85d20 in continue_show /src/ghostpdl/./base/gxchar.c:761:12 + #7 0xa8820c in gx_show_text_process /src/ghostpdl/./base/gxchar.c:738:12 + #8 0x9221ff in gs_text_process /src/ghostpdl/./base/gstext.c:696:12 + #9 0xfc9922 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:516:16 + #10 0xfc9922 in pdfi_show_Tr_0 /src/ghostpdl/./pdf/pdf_text.c:531:12 + #11 0xfc3e92 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:913:24 + #12 0xfc5911 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1131:12 + #13 0xeda973 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1628:24 + #14 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #15 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #16 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #17 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #18 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #19 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #20 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #21 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #22 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #23 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #24 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #25 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #26 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #27 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #28 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #29 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #30 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #31 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #32 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #33 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #34 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #35 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #36 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #37 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #38 0x7f6d99976082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #39 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: names_string_ref--zfont_glyph_name--pdfi_fapi_get_glyphname_or_cid +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./psi/iname.c:248:34 in names_string_ref +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1754.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1754.txt new file mode 100644 index 000000000..105007ecd --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1754.txt @@ -0,0 +1,53 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1584089299 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f32f02fa9e0, 0x7f32f02fdf6c), 959 [0x7f32f035ba40, 0x7f32f035bdff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f32f02fdf70,0x7f32f0333830), 959 [0x7f32f035be00,0x7f32f035f9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1754 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000330120 (pc 0x0000006f6d69 bp 0x7fff69845bd0 sp 0x7fff69845b70 T0) +==1==The signal is caused by a READ memory access. + #0 0x6f6d69 in CMP_SIZE /src/ghostpdl/./base/gsmchunk.c + #1 0x6f6d69 in insert_free_size /src/ghostpdl/./base/gsmchunk.c:441:13 + #2 0x6f4050 in chunk_free_object /src/ghostpdl/./base/gsmchunk.c:1301:9 + #3 0xf90ea1 in pdfi_pscript_stack_finit /src/ghostpdl/./pdf/pdf_fontps.c:69:5 + #4 0xfae2a2 in pdfi_read_cmap /src/ghostpdl/./pdf/pdf_cmap.c:811:5 + #5 0xf6b4c3 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:197:16 + #6 0xf5c4c4 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #7 0xf62074 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #8 0xf666f5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #9 0xf666f5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #10 0xeda923 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1624:24 + #11 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #12 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #13 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #14 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #15 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #16 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #24 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #25 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #26 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #27 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #30 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7f32efcf7082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: CMP_SIZE--insert_free_size--chunk_free_object +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gsmchunk.c in CMP_SIZE +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1763.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1763.txt new file mode 100644 index 000000000..2921f5ca0 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1763.txt @@ -0,0 +1,93 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1584465217 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f6b746749e0, 0x7f6b74677f6c), 959 [0x7f6b746d5a40, 0x7f6b746d5dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f6b74677f70,0x7f6b746ad830), 959 [0x7f6b746d5e00,0x7f6b746d99f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1763 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f6b72cc4d84 at pc 0x0000004bea81 bp 0x7ffc88d612d0 sp 0x7ffc88d60a90 +WRITE of size 122 at 0x7f6b72cc4d84 thread T0 + #0 0x4bea80 in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xfe059b in pdfi_oc_is_ocg_visible /src/ghostpdl/./pdf/pdf_optcontent.c:305:9 + #2 0xfe3664 in pdfi_op_BDC /src/ghostpdl/./pdf/pdf_optcontent.c:620:22 + #3 0xeda6e6 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1413:24 + #4 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #5 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #6 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #7 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #8 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #9 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #10 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #11 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #12 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #13 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #14 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #15 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #16 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #17 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #18 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #19 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #20 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #21 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #22 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #23 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #24 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #25 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #26 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #27 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #28 0x7f6b74071082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #29 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: __interceptor_memcpy--pdfi_oc_is_ocg_visible--pdfi_op_BDC +Address 0x7f6b72cc4d84 is located in stack of thread T0 at offset 388 in frame + #0 0xfdff6f in pdfi_oc_is_ocg_visible /src/ghostpdl/./pdf/pdf_optcontent.c:286 + +DEDUP_TOKEN: pdfi_oc_is_ocg_visible + This frame has 9 object(s): + [32, 40) 'Usage.i' (line 99) + [64, 72) 'dict.i' (line 100) + [96, 104) 'name.i' (line 101) + [128, 136) 'val.i.i' (line 150) + [160, 168) 'VE.i' (line 221) + [192, 200) 'obj.i' (line 222) + [224, 232) 'Pname.i' (line 223) + [256, 264) 'type' (line 287) + [288, 388) 'str' (line 304) <== Memory access at offset 388 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x0fedee590960: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fedee590970: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fedee590980: f1 f1 f1 f1 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 + 0x0fedee590990: f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 + 0x0fedee5909a0: 00 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fedee5909b0:[04]f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 + 0x0fedee5909c0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fedee5909d0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fedee5909e0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fedee5909f0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fedee590a00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1764.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1764.txt new file mode 100644 index 000000000..aa47c4cdc --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1764.txt @@ -0,0 +1,44 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1584859519 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f07ac5be9e0, 0x7f07ac5c1f6c), 959 [0x7f07ac61fa40, 0x7f07ac61fdff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f07ac5c1f70,0x7f07ac5f7830), 959 [0x7f07ac61fe00,0x7f07ac6239f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1764 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x63380006a598 (pc 0x000000ecb120 bp 0x7fff15ffacf0 sp 0x7fff15ffac20 T0) +==1==The signal is caused by a READ memory access. + #0 0xecb120 in read_xref_stream_entries /src/ghostpdl/./pdf/pdf_xref.c:108:20 + #1 0xec9905 in pdfi_process_xref_stream /src/ghostpdl/./pdf/pdf_xref.c:353:20 + #2 0xec6e34 in pdfi_read_xref_stream_dict /src/ghostpdl/./pdf/pdf_xref.c:502:32 + #3 0xec3513 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1038:20 + #4 0xeaa746 in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1048:12 + #5 0xeaa746 in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1315:12 + #6 0xe97094 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:521:12 + #7 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #8 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #9 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #10 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #11 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #12 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #13 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #14 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #15 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #16 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #17 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #18 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #19 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #20 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #21 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #22 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #23 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #24 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #25 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #26 0x7f07abfbb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #27 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: read_xref_stream_entries--pdfi_process_xref_stream--pdfi_read_xref_stream_dict +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_xref.c:108:20 in read_xref_stream_entries +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1767.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1767.txt new file mode 100644 index 000000000..517aaafc3 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1767.txt @@ -0,0 +1,88 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1585228834 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f948370c9e0, 0x7f948370ff6c), 959 [0x7f948376da40, 0x7f948376ddff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f948370ff70,0x7f9483745830), 959 [0x7f948376de00,0x7f94837719f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1767 +================================================================= +==1==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000001615fc0 at pc 0x000000eb25f2 bp 0x7ffebbc48760 sp 0x7ffebbc48758 +READ of size 8 at 0x000001615fc0 thread T0 + #0 0xeb25f1 in pdfi_dict_get /src/ghostpdl/./pdf/pdf_dict.c:246:25 + #1 0xeb45ae in pdfi_dict_get_type /src/ghostpdl/./pdf/pdf_dict.c:431:12 + #2 0xeb45ae in pdfi_dict_get_int /src/ghostpdl/./pdf/pdf_dict.c:461:12 + #3 0xff9678 in pdfi_read_stream_object /src/ghostpdl/./pdf/pdf_deref.c:255:12 + #4 0xff9678 in pdfi_read_bare_object /src/ghostpdl/./pdf/pdf_deref.c:439:16 + #5 0xffe082 in pdfi_read_object /src/ghostpdl/./pdf/pdf_deref.c:534:12 + #6 0xffbe2b in pdfi_dereference /src/ghostpdl/./pdf/pdf_deref.c:831:20 + #7 0xebaf61 in pdfi_dict_next /src/ghostpdl/./pdf/pdf_dict.c:1036:20 + #8 0xfe9880 in pdfi_check_XObject_dict /src/ghostpdl/./pdf/pdf_check.c:457:24 + #9 0xfe9880 in pdfi_check_Resources /src/ghostpdl/./pdf/pdf_check.c:897:15 + #10 0xfeacec in pdfi_check_Font /src/ghostpdl/./pdf/pdf_check.c:794:23 + #11 0xfeacec in pdfi_check_Font_dict /src/ghostpdl/./pdf/pdf_check.c:827:20 + #12 0xfeacec in pdfi_check_Resources /src/ghostpdl/./pdf/pdf_check.c:909:15 + #13 0xfe5197 in pdfi_check_page_inner /src/ghostpdl/./pdf/pdf_check.c:1104:16 + #14 0xfe5197 in pdfi_check_page /src/ghostpdl/./pdf/pdf_check.c:1149:12 + #15 0xf2dddd in pdfi_page_info /src/ghostpdl/./pdf/pdf_page.c:490:12 + #16 0xe98c37 in zPDFpageinfo /src/ghostpdl/./psi/zpdfops.c:726:12 + #17 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #18 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #19 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #20 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #21 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #22 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #23 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #24 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #25 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #26 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #27 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #28 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #29 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #30 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #31 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #32 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #33 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #34 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #35 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #36 0x7f9483109082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #37 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: pdfi_dict_get--pdfi_dict_get_type--pdfi_dict_get_int +0x000001615fc0 is located 32 bytes to the left of global variable '' defined in './base/gsmemory.c:41:1' (0x1615fe0) of size 13 + '' is ascii string 'gs_gc_root_t' +0x000001615fc0 is located 0 bytes to the right of global variable 'st_bytes' defined in './base/gsmemory.c:38:1' (0x1615f80) of size 64 +SUMMARY: AddressSanitizer: global-buffer-overflow /src/ghostpdl/./pdf/pdf_dict.c:246:25 in pdfi_dict_get +Shadow bytes around the buggy address: + 0x0000802baba0: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0000802babb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0000802babc0: 00 00 00 00 00 00 00 00 01 f9 f9 f9 01 f9 f9 f9 + 0x0000802babd0: 01 f9 f9 f9 01 f9 f9 f9 01 f9 f9 f9 07 f9 f9 f9 + 0x0000802babe0: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 06 f9 f9 f9 +=>0x0000802babf0: 00 00 00 00 00 00 00 00[f9]f9 f9 f9 00 05 f9 f9 + 0x0000802bac00: 00 00 00 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00 + 0x0000802bac10: f9 f9 f9 f9 00 00 02 f9 f9 f9 f9 f9 00 00 00 00 + 0x0000802bac20: 00 00 00 00 f9 f9 f9 f9 04 f9 f9 f9 00 00 00 00 + 0x0000802bac30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0000802bac40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1770.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1770.txt new file mode 100644 index 000000000..c53300b2e --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1770.txt @@ -0,0 +1,43 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1585616238 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f84b938f9e0, 0x7f84b9392f6c), 959 [0x7f84b93f0a40, 0x7f84b93f0dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f84b9392f70,0x7f84b93c8830), 959 [0x7f84b93f0e00,0x7f84b93f49f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1770 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x00009fff8006 (pc 0x000001003b7f bp 0x7ffea5a5e4c0 sp 0x7ffea5a5e490 T0) +==1==The signal is caused by a READ memory access. + #0 0x1003b7f in pdfi_free_xref_table /src/ghostpdl/./pdf/pdf_obj.c:227:5 + #1 0x1003b7f in pdfi_free_object /src/ghostpdl/./pdf/pdf_obj.c:269:13 + #2 0xea486e in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:83:13 + #3 0xea486e in pdfi_clear_context /src/ghostpdl/./pdf/ghostpdf.c:1823:9 + #4 0xeaea60 in pdfi_free_context /src/ghostpdl/./pdf/ghostpdf.c:1954:5 + #5 0xe97671 in zPDFclose /src/ghostpdl/./psi/zpdfops.c:603:16 + #6 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #10 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #12 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #13 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #14 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #15 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #16 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #17 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #19 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #20 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #21 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #22 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #23 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #24 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7f84b8d8c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #26 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: pdfi_free_xref_table--pdfi_free_object--pdfi_countdown_impl +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_obj.c:227:5 in pdfi_free_xref_table +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1771.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1771.txt new file mode 100644 index 000000000..bc9766f75 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1771.txt @@ -0,0 +1,103 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1585993403 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f7302c9e9e0, 0x7f7302ca1f6c), 959 [0x7f7302cffa40, 0x7f7302cffdff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f7302ca1f70,0x7f7302cd7830), 959 [0x7f7302cffe00,0x7f7302d039f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1771 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f7301559b54 at pc 0x00000102fe52 bp 0x7ffcb9b46940 sp 0x7ffcb9b46938 +WRITE of size 4 at 0x7f7301559b54 thread T0 + #0 0x102fe51 in fn_ElIn_evaluate /src/ghostpdl/./base/gsfunc3.c:121:16 + #1 0xfdcae0 in pdfi_tf_using_function /src/ghostpdl/./pdf/pdf_trans.c:43:12 + #2 0x5b7bed in gs_begin_transparency_mask /src/ghostpdl/./base/gstrans.c:625:17 + #3 0xfdb5ee in pdfi_trans_set_mask /src/ghostpdl/./pdf/pdf_trans.c:287:16 + #4 0xfdb5ee in pdfi_trans_set_params /src/ghostpdl/./pdf/pdf_trans.c:813:13 + #5 0xf24aa6 in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2428:12 + #6 0xf254cf in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2540:12 + #7 0xeda7f8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1457:24 + #8 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #9 0xed6d8d in pdfi_interpret_inner_content /src/ghostpdl/./pdf/pdf_int.c:1912:12 + #10 0xed6d8d in pdfi_interpret_inner_content_stream /src/ghostpdl/./pdf/pdf_int.c:2011:12 + #11 0xed6d8d in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1858:12 + #12 0xf235d1 in pdfi_form_execgroup /src/ghostpdl/./pdf/pdf_image.c:2130:12 + #13 0xf2466d in pdfi_do_form /src/ghostpdl/./pdf/pdf_image.c:2364:16 + #14 0xf24cd0 in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2462:16 + #15 0xf254cf in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2540:12 + #16 0xeda7f8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1457:24 + #17 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #18 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #19 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #20 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #21 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #22 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #23 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #24 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #25 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #26 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #27 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #28 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #29 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #30 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #31 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #32 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #33 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #34 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #35 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #36 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #37 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #38 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #39 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #40 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #41 0x7f730269b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #42 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: fn_ElIn_evaluate--pdfi_tf_using_function--gs_begin_transparency_mask +Address 0x7f7301559b54 is located in stack of thread T0 at offset 2900 in frame + #0 0x5b6e8f in gs_begin_transparency_mask /src/ghostpdl/./base/gstrans.c:543 + +DEDUP_TOKEN: gs_begin_transparency_mask + This frame has 6 object(s): + [32, 40) 'pdf14dev.i.i180' (line 134) + [64, 72) 'pdf14dev.i.i' (line 134) + [96, 1360) 'params' (line 544) + [1488, 2752) 'params_color' (line 545) + [2880, 2884) 'out' (line 611) + [2896, 2900) 'out87' (line 623) <== Memory access at offset 2900 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ghostpdl/./base/gsfunc3.c:121:16 in fn_ElIn_evaluate +Shadow bytes around the buggy address: + 0x0feee02a3310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0feee02a3320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0feee02a3330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0feee02a3340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0feee02a3350: 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 f2 f2 f2 +=>0x0feee02a3360: f2 f2 f2 f2 f2 f2 f2 f2 f8 f2[04]f3 00 00 00 00 + 0x0feee02a3370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0feee02a3380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0feee02a3390: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0feee02a33a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0feee02a33b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1772.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1772.txt new file mode 100644 index 000000000..e68f7ec4d --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1772.txt @@ -0,0 +1,42 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1586414369 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f087d20e9e0, 0x7f087d211f6c), 959 [0x7f087d26fa40, 0x7f087d26fdff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f087d211f70,0x7f087d247830), 959 [0x7f087d26fe00,0x7f087d2739f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1772 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x492ec7ff8006 (pc 0x0000006f3346 bp 0x7ffc583e6b20 sp 0x7ffc583e6ab0 T0) +==1==The signal is caused by a READ memory access. + #0 0x6f3346 in chunk_free_object /src/ghostpdl/./base/gsmchunk.c:1093:31 + #1 0x12c7c6e in gs_font_dir_finalize /src/ghostpdl/./base/gsfont.c:320:9 + #2 0x6f3372 in chunk_free_object /src/ghostpdl/./base/gsmchunk.c:1095:13 + #3 0xeaed97 in pdfi_free_context /src/ghostpdl/./pdf/ghostpdf.c:1969:9 + #4 0xe97671 in zPDFclose /src/ghostpdl/./psi/zpdfops.c:603:16 + #5 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #6 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #7 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #8 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #9 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #10 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #11 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #12 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #13 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #14 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #15 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #16 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #17 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #18 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #19 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #20 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #21 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #22 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #23 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #24 0x7f087cc0b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #25 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: chunk_free_object--gs_font_dir_finalize--chunk_free_object +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gsmchunk.c:1093:31 in chunk_free_object +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1774.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1774.txt new file mode 100644 index 000000000..bb5095769 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1774.txt @@ -0,0 +1,54 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1586939879 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f757affb9e0, 0x7f757affef6c), 959 [0x7f757b05ca40, 0x7f757b05cdff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f757affef70,0x7f757b034830), 959 [0x7f757b05ce00,0x7f757b0609f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1774 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000009b98 (pc 0x000000ebd763 bp 0x7ffff5f9a010 sp 0x7ffff5f99f40 T0) +==1==The signal is caused by a READ memory access. + #0 0xebd763 in pdfi_array_fetch /src/ghostpdl/./pdf/pdf_array.c:138:14 + #1 0xebd763 in pdfi_array_get /src/ghostpdl/./pdf/pdf_array.c:164:12 + #2 0xebe173 in pdfi_array_get_type /src/ghostpdl/./pdf/pdf_array.c:207:12 + #3 0xef8581 in pdfi_create_colorspace_by_array /src/ghostpdl/./pdf/pdf_colour.c:2249:12 + #4 0xf003e3 in pdfi_create_DeviceN /src/ghostpdl/./pdf/pdf_colour.c:1780:20 + #5 0xef9a70 in pdfi_create_colorspace_by_array /src/ghostpdl/./pdf/pdf_colour.c:2294:16 + #6 0xef7790 in pdfi_create_colorspace /src/ghostpdl/./pdf/pdf_colour.c:2437:20 + #7 0xef8253 in pdfi_create_colorspace_by_name /src/ghostpdl/./pdf/pdf_colour.c:2372:16 + #8 0xefa51d in pdfi_create_colorspace /src/ghostpdl/./pdf/pdf_colour.c:2434:16 + #9 0xefa51d in pdfi_setcolorspace /src/ghostpdl/./pdf/pdf_colour.c:2452:12 + #10 0xefa51d in pdfi_setfillcolor_space /src/ghostpdl/./pdf/pdf_colour.c:2486:12 + #11 0xed9f6e in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1440:24 + #12 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #13 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #14 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #15 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #16 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #17 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #18 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #19 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #20 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #21 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #22 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #23 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #24 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #25 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #26 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #27 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #28 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #29 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #30 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #31 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #32 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #33 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #34 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #35 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #36 0x7f757a9f8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #37 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: pdfi_array_fetch--pdfi_array_get--pdfi_array_get_type +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_array.c:138:14 in pdfi_array_fetch +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1781.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1781.txt new file mode 100644 index 000000000..361cbfeb0 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1781.txt @@ -0,0 +1,111 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1587308744 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f83ea09f9e0, 0x7f83ea0a2f6c), 959 [0x7f83ea100a40, 0x7f83ea100dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f83ea0a2f70,0x7f83ea0d8830), 959 [0x7f83ea100e00,0x7f83ea1049f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1781 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f83e4f47490 at pc 0x000000ec619a bp 0x7fff9da3a130 sp 0x7fff9da3a128 +READ of size 8 at 0x7f83e4f47490 thread T0 + #0 0xec6199 in read_xref_section /src/ghostpdl/./pdf/pdf_xref.c:762:20 + #1 0xec6199 in read_xref /src/ghostpdl/./pdf/pdf_xref.c:800:16 + #2 0xec3411 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1032:20 + #3 0xeaa746 in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1048:12 + #4 0xeaa746 in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1315:12 + #5 0xe97094 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:521:12 + #6 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #10 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #12 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #13 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #14 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #15 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #16 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #17 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #19 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #20 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #21 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #22 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #23 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #24 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7f83e9a9c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #26 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: read_xref_section--read_xref--pdfi_read_xref +0x7f83e4f47490 is located 880 bytes to the left of 1309872-byte region [0x7f83e4f47800,0x7f83e50874b0) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6aa1 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f520f in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f3018 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f520f in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #5 0x6f47e8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0xec7227 in resize_xref /src/ghostpdl/./pdf/pdf_xref.c:39:31 + #7 0xec4761 in read_xref_section /src/ghostpdl/./pdf/pdf_xref.c:730:24 + #8 0xec4761 in read_xref /src/ghostpdl/./pdf/pdf_xref.c:800:16 + #9 0xec3411 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1032:20 + #10 0xeaa746 in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1048:12 + #11 0xeaa746 in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1315:12 + #12 0xe97094 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:521:12 + #13 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #14 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #15 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #16 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #17 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #18 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #19 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #20 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #21 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #22 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #23 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #24 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #25 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #26 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #27 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #28 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #29 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #30 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #31 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #32 0x7f83e9a9c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--chunk_obj_alloc +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./pdf/pdf_xref.c:762:20 in read_xref_section +Shadow bytes around the buggy address: + 0x0ff0fc9e0e40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ff0fc9e0e50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ff0fc9e0e60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ff0fc9e0e70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ff0fc9e0e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0ff0fc9e0e90: fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ff0fc9e0ea0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ff0fc9e0eb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ff0fc9e0ec0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ff0fc9e0ed0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ff0fc9e0ee0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1788.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1788.txt new file mode 100644 index 000000000..fd0aeb6f1 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1788.txt @@ -0,0 +1,55 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1587677061 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f2390b6a9e0, 0x7f2390b6df6c), 959 [0x7f2390bcba40, 0x7f2390bcbdff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f2390b6df70,0x7f2390ba3830), 959 [0x7f2390bcbe00,0x7f2390bcf9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1788 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x631000064878 (pc 0x631000064878 bp 0x7ffffe147fb0 sp 0x7ffffe147f38 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: PC is at a non-executable region. Maybe a wild jump? + #0 0x631000064878 () + #1 0x1003ca5 in pdfi_free_namestring /src/ghostpdl/./pdf/pdf_obj.c:209:9 + #2 0x1003ca5 in pdfi_free_object /src/ghostpdl/./pdf/pdf_obj.c:254:13 + #3 0xef86de in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:83:13 + #4 0xef86de in pdfi_create_colorspace_by_array /src/ghostpdl/./pdf/pdf_colour.c:2315:5 + #5 0xf003e3 in pdfi_create_DeviceN /src/ghostpdl/./pdf/pdf_colour.c:1780:20 + #6 0xef9a70 in pdfi_create_colorspace_by_array /src/ghostpdl/./pdf/pdf_colour.c:2294:16 + #7 0xef7790 in pdfi_create_colorspace /src/ghostpdl/./pdf/pdf_colour.c:2437:20 + #8 0xef8253 in pdfi_create_colorspace_by_name /src/ghostpdl/./pdf/pdf_colour.c:2372:16 + #9 0xefa51d in pdfi_create_colorspace /src/ghostpdl/./pdf/pdf_colour.c:2434:16 + #10 0xefa51d in pdfi_setcolorspace /src/ghostpdl/./pdf/pdf_colour.c:2452:12 + #11 0xefa51d in pdfi_setfillcolor_space /src/ghostpdl/./pdf/pdf_colour.c:2486:12 + #12 0xed9f6e in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1440:24 + #13 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #14 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #15 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #16 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #17 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #18 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #19 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #20 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #21 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #22 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #23 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #24 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #25 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #26 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #27 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #28 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #29 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #30 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #31 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #32 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #33 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #34 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #35 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #36 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #37 0x7f2390567082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: pdfi_free_namestring--pdfi_free_object +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV () +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1795.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1795.txt new file mode 100644 index 000000000..ebfc4002e --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1795.txt @@ -0,0 +1,88 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1588068520 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7fa6347ae9e0, 0x7fa6347b1f6c), 959 [0x7fa63480fa40, 0x7fa63480fdff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7fa6347b1f70,0x7fa6347e7830), 959 [0x7fa63480fe00,0x7fa6348139f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1795 +================================================================= +==1==ERROR: AddressSanitizer: negative-size-param: (size=-57875) + #0 0x4be84f in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xfb634d in general_endcidrange_func /src/ghostpdl/./pdf/pdf_cmap.c:205:17 + #2 0xfb328f in cmap_endcidrange_func /src/ghostpdl/./pdf/pdf_cmap.c:227:12 + #3 0xf93760 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:362:36 + #4 0xfae297 in pdfi_read_cmap /src/ghostpdl/./pdf/pdf_cmap.c:810:12 + #5 0xf6b4c3 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:197:16 + #6 0xf5c4c4 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #7 0xf62074 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #8 0xf666f5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #9 0xf666f5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #10 0xeda923 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1624:24 + #11 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #12 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #13 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #14 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #15 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #16 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #24 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #25 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #26 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #27 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #30 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7fa6341ab082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: __interceptor_memcpy--general_endcidrange_func--cmap_endcidrange_func +0x63100007daf4 is located 21236 bytes inside of 65616-byte region [0x631000078800,0x631000088850) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6aa1 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f520f in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f3018 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f589d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #5 0x6f496c in chunk_alloc_struct_array /src/ghostpdl/./base/gsmchunk.c:1024:12 + #6 0x136637a in gx_char_cache_alloc /src/ghostpdl/./base/gxccman.c:88:13 + #7 0x12c39d9 in gs_font_dir_alloc2_limits /src/ghostpdl/./base/gsfont.c:263:12 + #8 0x12c3880 in gs_font_dir_alloc2 /src/ghostpdl/./base/gsfont.c:236:16 + #9 0xf69ab0 in pdfi_init_font_directory /src/ghostpdl/./pdf/pdf_font.c:1662:21 + #10 0xeae0c9 in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1624:12 + #11 0xe9b4d4 in zPDFInit /src/ghostpdl/./psi/zpdfops.c:991:11 + #12 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #13 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #14 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #15 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #16 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #17 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #18 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #19 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #20 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #21 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #22 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #23 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #24 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #25 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #26 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #27 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #28 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #29 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #30 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #31 0x7fa6341ab082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--chunk_obj_alloc +SUMMARY: AddressSanitizer: negative-size-param /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1802.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1802.txt new file mode 100644 index 000000000..4cbb1cfb1 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1802.txt @@ -0,0 +1,53 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1588480728 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7fccc0fa69e0, 0x7fccc0fa9f6c), 959 [0x7fccc1007a40, 0x7fccc1007dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7fccc0fa9f70,0x7fccc0fdf830), 959 [0x7fccc1007e00,0x7fccc100b9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1802 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x62cff74a7f56 (pc 0x000000f88aed bp 0x7ffc49939f70 sp 0x7ffc49939f40 T0) +==1==The signal is caused by a READ memory access. + #0 0xf88aed in u16 /src/ghostpdl/./pdf/pdf_font1C.c:528:13 + #1 0xf88aed in pdfi_count_cff_index /src/ghostpdl/./pdf/pdf_font1C.c:1079:13 + #2 0xf7d616 in pdfi_read_cff /src/ghostpdl/./pdf/pdf_font1C.c:1559:13 + #3 0xf7d616 in pdfi_read_cff_font /src/ghostpdl/./pdf/pdf_font1C.c:2132:20 + #4 0xf5cc87 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:731:32 + #5 0xf6c166 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:277:16 + #6 0xf5c4c4 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #7 0xf62074 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #8 0xf666f5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #9 0xf666f5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #10 0xeda923 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1624:24 + #11 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #12 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #13 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #14 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #15 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #16 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #24 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #25 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #26 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #27 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #30 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7fccc09a3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: u16--pdfi_count_cff_index--pdfi_read_cff +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_font1C.c:528:13 in u16 +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1803.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1803.txt new file mode 100644 index 000000000..cb2ea0a2b --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1803.txt @@ -0,0 +1,53 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1588837472 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7ffa913029e0, 0x7ffa91305f6c), 959 [0x7ffa91363a40, 0x7ffa91363dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7ffa91305f70,0x7ffa9133b830), 959 [0x7ffa91363e00,0x7ffa913679f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1803 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x0000bfff8004 (pc 0x0000006f527b bp 0x7ffedaf193e0 sp 0x7ffedaf19370 T0) +==1==The signal is caused by a READ memory access. + #0 0x6f527b in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:800:20 + #1 0x6f47e8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #2 0xfb270f in cmap_endfbrange_func /src/ghostpdl/./pdf/pdf_cmap.c:331:50 + #3 0xf93760 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:362:36 + #4 0xfae297 in pdfi_read_cmap /src/ghostpdl/./pdf/pdf_cmap.c:810:12 + #5 0xf6be54 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:260:20 + #6 0xf5c4c4 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #7 0xf62074 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #8 0xf666f5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #9 0xf666f5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #10 0xeda923 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1624:24 + #11 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #12 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #13 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #14 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #15 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #16 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #24 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #25 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #26 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #27 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #30 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7ffa90cff082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: chunk_obj_alloc--chunk_alloc_bytes--cmap_endfbrange_func +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gsmchunk.c:800:20 in chunk_obj_alloc +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1806.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1806.txt new file mode 100644 index 000000000..0fc8bffe2 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-1806.txt @@ -0,0 +1,100 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1591050203 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f32be3179e0, 0x7f32be31af6c), 959 [0x7f32be378a40, 0x7f32be378dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f32be31af70,0x7f32be350830), 959 [0x7f32be378e00,0x7f32be37c9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-1806 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f32bcc2b020 at pc 0x0000004bea81 bp 0x7ffdf267faf0 sp 0x7ffdf267f2b0 +WRITE of size 5575 at 0x7f32bcc2b020 thread T0 + #0 0x4bea80 in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xf5eaff in pdfi_open_CIDFont_substitute_file /src/ghostpdl/./pdf/pdf_font.c:332:9 + #2 0xf5d004 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:761:29 + #3 0xf6c166 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:277:16 + #4 0xf5c4c4 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #5 0xf62074 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #6 0xf666f5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #7 0xf666f5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #8 0xeda923 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1624:24 + #9 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #10 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #11 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #12 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #13 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #14 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #15 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #16 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #17 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #18 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #19 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #20 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #21 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #22 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #23 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #24 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #25 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #26 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #27 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #28 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #29 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #30 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #31 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #32 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #33 0x7f32bdd14082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #34 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: __interceptor_memcpy--pdfi_open_CIDFont_substitute_file--pdfi_load_font +Address 0x7f32bcc2b020 is located in stack of thread T0 at offset 4128 in frame + #0 0xf5e39f in pdfi_open_CIDFont_substitute_file /src/ghostpdl/./pdf/pdf_font.c:169 + +DEDUP_TOKEN: pdfi_open_CIDFont_substitute_file + This frame has 11 object(s): + [32, 4128) 'fontfname' (line 171) + [4256, 4264) 's' (line 172) <== Memory access at offset 4128 partially underflows this variable + [4288, 4296) 'cidname' (line 173) <== Memory access at offset 4128 partially underflows this variable + [4320, 4336) 'fname' (line 174) <== Memory access at offset 4128 partially underflows this variable + [4352, 4360) 'mname' (line 179) <== Memory access at offset 4128 partially underflows this variable + [4384, 4392) 'csi' (line 180) <== Memory access at offset 4128 partially underflows this variable + [4416, 4424) 'csi_reg' (line 184) <== Memory access at offset 4128 partially underflows this variable + [4448, 4456) 'csi_ord' (line 184) <== Memory access at offset 4128 partially underflows this variable + [4480, 4488) 'reg_ord' (line 190) <== Memory access at offset 4128 partially underflows this variable + [4512, 4516) 'defcidfallacklen' (line 215) <== Memory access at offset 4128 partially underflows this variable + [4528, 4532) 'len' (line 232) <== Memory access at offset 4128 partially underflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x0fe6d797d5b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe6d797d5c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe6d797d5d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe6d797d5e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe6d797d5f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fe6d797d600: 00 00 00 00[f2]f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 + 0x0fe6d797d610: f2 f2 f2 f2 00 f2 f2 f2 00 f2 f2 f2 00 00 f2 f2 + 0x0fe6d797d620: f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 f2 f2 + 0x0fe6d797d630: f8 f2 f2 f2 f8 f2 f8 f3 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe6d797d640: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe6d797d650: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-237.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-237.txt new file mode 100755 index 000000000..c2453e44b --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-237.txt @@ -0,0 +1,112 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 371299439 +INFO: Loaded 3 modules (141698 inline 8-bit counters): 11664 [0x7fb77f5bcec0, 0x7fb77f5bfc50), 878 [0x7fb77f6eb798, 0x7fb77f6ebb06), 129156 [0x557bac574f10, 0x557bac594794), +INFO: Loaded 3 PC tables (141698 PCs): 11664 [0x7fb77f5bfc50,0x7fb77f5ed550), 878 [0x7fb77f6ebb08,0x7fb77f6ef1e8), 129156 [0x557bac594798,0x557bac78cfd8), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2021-237 +INFO: Start rendering... +INFO: Processing page 1... +================================================================= +==12071==ERROR: AddressSanitizer: heap-use-after-free on address 0x7e277e44c000 at pc 0x557baafe7b33 bp 0x7ffd6ddb6f70 sp 0x7ffd6ddb6f68 +WRITE of size 4 at 0x7e277e44c000 thread T0 + #0 0x557baafe7b32 in sampled_data_sample /src/ghostpdl/./psi/zfsample.c:464:9 + #1 0x557baafe84f7 in sampled_data_continue /src/ghostpdl/./psi/zfsample.c:562:12 + #2 0x557baaed9092 in interp /src/ghostpdl/./psi/interp.c:1347:28 + #3 0x557baaed6386 in gs_call_interp /src/ghostpdl/./psi/interp.c:520:12 + #4 0x557baaed5cee in gs_interpret /src/ghostpdl/./psi/interp.c:477:12 + #5 0x557baa8de9dd in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #6 0x557baa8de5aa in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #7 0x557bab02149f in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #8 0x557bab01e845 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #9 0x557bab01c752 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #10 0x557bab021274 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #11 0x557baa8d79c7 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/ghostpdl/fuzz/gstoraster_fuzzer.cc:97:8 + #12 0x557baa8d781b in LLVMFuzzerTestOneInput /src/ghostpdl/fuzz/gstoraster_fuzzer.cc:114:2 + #13 0x557baa77514d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #14 0x557baa75fec2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #15 0x557baa765d90 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #16 0x557baa7918c2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #17 0x7fb77f0ac082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #18 0x557baa758fad in _start (/out/gstoraster_fuzzer+0x43ffad) + +0x7e277e44c000 is located 12032 bytes inside of 13272-byte region [0x7e277e449100,0x7e277e44c4d8) +freed by thread T0 here: + #0 0x557baa893806 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3 + #1 0x557bab208583 in alloc_free_clump /src/ghostpdl/./base/gsalloc.c:2639:9 + #2 0x557baaf926ae in gs_free_ref_array /src/ghostpdl/./psi/ialloc.c:359:13 + #3 0x557baaef38e8 in ref_stack_pop_block /src/ghostpdl/./psi/istack.c:521:9 + #4 0x557baaef3570 in ref_stack_pop /src/ghostpdl/./psi/istack.c:459:9 + #5 0x557baaf00518 in zastore /src/ghostpdl/./psi/zarray.c:116:9 + #6 0x557baaed9092 in interp /src/ghostpdl/./psi/interp.c:1347:28 + #7 0x557baaed6386 in gs_call_interp /src/ghostpdl/./psi/interp.c:520:12 + #8 0x557baaed5cee in gs_interpret /src/ghostpdl/./psi/interp.c:477:12 + #9 0x557baa8db556 in gs_run_init_file /src/ghostpdl/./psi/imain.c:861:12 + #10 0x557baa8db0c1 in gs_main_init2aux /src/ghostpdl/./psi/imain.c:305:16 + #11 0x557baa8dc259 in gs_main_init2 /src/ghostpdl/./psi/imain.c:491:12 + #12 0x557bab01e7f6 in swproc /src/ghostpdl/./psi/imainarg.c:363:20 + #13 0x557bab01c752 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #14 0x557bab021274 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #15 0x557baa8d79c7 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/ghostpdl/fuzz/gstoraster_fuzzer.cc:97:8 + #16 0x557baa8d781b in LLVMFuzzerTestOneInput /src/ghostpdl/fuzz/gstoraster_fuzzer.cc:114:2 + #17 0x557baa77514d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #18 0x557baa75fec2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #19 0x557baa765d90 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #20 0x557baa7918c2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #21 0x7fb77f0ac082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +previously allocated by thread T0 here: + #0 0x557baa893aa4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x557baab9f580 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:191:34 + #2 0x557bab20a70e in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2488:13 + #3 0x557bab20986a in alloc_obj /src/ghostpdl/./base/gsalloc.c:1952:13 + #4 0x557baaf918f4 in gs_alloc_ref_array /src/ghostpdl/./psi/ialloc.c:226:15 + #5 0x557baaef19c5 in ref_stack_push_block /src/ghostpdl/./psi/istack.c:614:12 + #6 0x557baaed6750 in gs_call_interp /src/ghostpdl/./psi/interp.c:638:17 + #7 0x557baaed5cee in gs_interpret /src/ghostpdl/./psi/interp.c:477:12 + #8 0x557baa8db556 in gs_run_init_file /src/ghostpdl/./psi/imain.c:861:12 + #9 0x557baa8db0c1 in gs_main_init2aux /src/ghostpdl/./psi/imain.c:305:16 + #10 0x557baa8dc259 in gs_main_init2 /src/ghostpdl/./psi/imain.c:491:12 + #11 0x557bab01e7f6 in swproc /src/ghostpdl/./psi/imainarg.c:363:20 + #12 0x557bab01c752 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #13 0x557bab021274 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #14 0x557baa8d79c7 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/ghostpdl/fuzz/gstoraster_fuzzer.cc:97:8 + #15 0x557baa8d781b in LLVMFuzzerTestOneInput /src/ghostpdl/fuzz/gstoraster_fuzzer.cc:114:2 + #16 0x557baa77514d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #17 0x557baa75fec2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #18 0x557baa765d90 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #19 0x557baa7918c2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #20 0x7fb77f0ac082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/ghostpdl/./psi/zfsample.c:464:9 in sampled_data_sample +Shadow bytes around the buggy address: + 0x7e277e44bd80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e277e44be00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e277e44be80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e277e44bf00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e277e44bf80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x7e277e44c000:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e277e44c080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e277e44c100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e277e44c180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e277e44c200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e277e44c280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==12071==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-337.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-337.txt new file mode 100755 index 000000000..975b26e20 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-337.txt @@ -0,0 +1,112 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 713980540 +INFO: Loaded 3 modules (141698 inline 8-bit counters): 11664 [0x7ff804bbcec0, 0x7ff804bbfc50), 878 [0x7ff804d5e798, 0x7ff804d5eb06), 129156 [0x55a9cbdedf10, 0x55a9cbe0d794), +INFO: Loaded 3 PC tables (141698 PCs): 11664 [0x7ff804bbfc50,0x7ff804bed550), 878 [0x7ff804d5eb08,0x7ff804d621e8), 129156 [0x55a9cbe0d798,0x55a9cc005fd8), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2021-337 +INFO: Start rendering... +INFO: Processing page 1... +================================================================= +==12071==ERROR: AddressSanitizer: heap-use-after-free on address 0x7e6803a4c000 at pc 0x55a9ca860b33 bp 0x7ffe03341b90 sp 0x7ffe03341b88 +WRITE of size 4 at 0x7e6803a4c000 thread T0 + #0 0x55a9ca860b32 in sampled_data_sample /src/ghostpdl/./psi/zfsample.c:464:9 + #1 0x55a9ca8614f7 in sampled_data_continue /src/ghostpdl/./psi/zfsample.c:562:12 + #2 0x55a9ca752092 in interp /src/ghostpdl/./psi/interp.c:1347:28 + #3 0x55a9ca74f386 in gs_call_interp /src/ghostpdl/./psi/interp.c:520:12 + #4 0x55a9ca74ecee in gs_interpret /src/ghostpdl/./psi/interp.c:477:12 + #5 0x55a9ca1579dd in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #6 0x55a9ca1575aa in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #7 0x55a9ca89a49f in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #8 0x55a9ca897845 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #9 0x55a9ca895752 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #10 0x55a9ca89a274 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #11 0x55a9ca1509c7 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/ghostpdl/fuzz/gstoraster_fuzzer.cc:97:8 + #12 0x55a9ca15081b in LLVMFuzzerTestOneInput /src/ghostpdl/fuzz/gstoraster_fuzzer.cc:114:2 + #13 0x55a9c9fee14d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #14 0x55a9c9fd8ec2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #15 0x55a9c9fded90 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #16 0x55a9ca00a8c2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #17 0x7ff8046e3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #18 0x55a9c9fd1fad in _start (/out/gstoraster_fuzzer+0x43ffad) + +0x7e6803a4c000 is located 12032 bytes inside of 13272-byte region [0x7e6803a49100,0x7e6803a4c4d8) +freed by thread T0 here: + #0 0x55a9ca10c806 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3 + #1 0x55a9caa81583 in alloc_free_clump /src/ghostpdl/./base/gsalloc.c:2639:9 + #2 0x55a9ca80b6ae in gs_free_ref_array /src/ghostpdl/./psi/ialloc.c:359:13 + #3 0x55a9ca76c8e8 in ref_stack_pop_block /src/ghostpdl/./psi/istack.c:521:9 + #4 0x55a9ca76c570 in ref_stack_pop /src/ghostpdl/./psi/istack.c:459:9 + #5 0x55a9ca779518 in zastore /src/ghostpdl/./psi/zarray.c:116:9 + #6 0x55a9ca752092 in interp /src/ghostpdl/./psi/interp.c:1347:28 + #7 0x55a9ca74f386 in gs_call_interp /src/ghostpdl/./psi/interp.c:520:12 + #8 0x55a9ca74ecee in gs_interpret /src/ghostpdl/./psi/interp.c:477:12 + #9 0x55a9ca154556 in gs_run_init_file /src/ghostpdl/./psi/imain.c:861:12 + #10 0x55a9ca1540c1 in gs_main_init2aux /src/ghostpdl/./psi/imain.c:305:16 + #11 0x55a9ca155259 in gs_main_init2 /src/ghostpdl/./psi/imain.c:491:12 + #12 0x55a9ca8977f6 in swproc /src/ghostpdl/./psi/imainarg.c:363:20 + #13 0x55a9ca895752 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #14 0x55a9ca89a274 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #15 0x55a9ca1509c7 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/ghostpdl/fuzz/gstoraster_fuzzer.cc:97:8 + #16 0x55a9ca15081b in LLVMFuzzerTestOneInput /src/ghostpdl/fuzz/gstoraster_fuzzer.cc:114:2 + #17 0x55a9c9fee14d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #18 0x55a9c9fd8ec2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #19 0x55a9c9fded90 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #20 0x55a9ca00a8c2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #21 0x7ff8046e3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +previously allocated by thread T0 here: + #0 0x55a9ca10caa4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55a9ca418580 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:191:34 + #2 0x55a9caa8370e in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2488:13 + #3 0x55a9caa8286a in alloc_obj /src/ghostpdl/./base/gsalloc.c:1952:13 + #4 0x55a9ca80a8f4 in gs_alloc_ref_array /src/ghostpdl/./psi/ialloc.c:226:15 + #5 0x55a9ca76a9c5 in ref_stack_push_block /src/ghostpdl/./psi/istack.c:614:12 + #6 0x55a9ca74f750 in gs_call_interp /src/ghostpdl/./psi/interp.c:638:17 + #7 0x55a9ca74ecee in gs_interpret /src/ghostpdl/./psi/interp.c:477:12 + #8 0x55a9ca154556 in gs_run_init_file /src/ghostpdl/./psi/imain.c:861:12 + #9 0x55a9ca1540c1 in gs_main_init2aux /src/ghostpdl/./psi/imain.c:305:16 + #10 0x55a9ca155259 in gs_main_init2 /src/ghostpdl/./psi/imain.c:491:12 + #11 0x55a9ca8977f6 in swproc /src/ghostpdl/./psi/imainarg.c:363:20 + #12 0x55a9ca895752 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #13 0x55a9ca89a274 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #14 0x55a9ca1509c7 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/ghostpdl/fuzz/gstoraster_fuzzer.cc:97:8 + #15 0x55a9ca15081b in LLVMFuzzerTestOneInput /src/ghostpdl/fuzz/gstoraster_fuzzer.cc:114:2 + #16 0x55a9c9fee14d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #17 0x55a9c9fd8ec2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #18 0x55a9c9fded90 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #19 0x55a9ca00a8c2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #20 0x7ff8046e3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/ghostpdl/./psi/zfsample.c:464:9 in sampled_data_sample +Shadow bytes around the buggy address: + 0x7e6803a4bd80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e6803a4be00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e6803a4be80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e6803a4bf00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e6803a4bf80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x7e6803a4c000:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e6803a4c080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e6803a4c100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e6803a4c180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e6803a4c200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e6803a4c280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==12071==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-668.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-668.txt new file mode 100755 index 000000000..9ccccbb4e --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-668.txt @@ -0,0 +1,80 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 163723190 +INFO: Loaded 3 modules (142173 inline 8-bit counters): 11664 [0x7f0696dbcec0, 0x7f0696dbfc50), 878 [0x7f0696ee4798, 0x7f0696ee4b06), 129631 [0x56291fb59750, 0x56291fb791af), +INFO: Loaded 3 PC tables (142173 PCs): 11664 [0x7f0696dbfc50,0x7f0696ded550), 878 [0x7f0696ee4b08,0x7f0696ee81e8), 129631 [0x56291fb791b0,0x56291fd737a0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2021-668 +================================================================= +==12071==ERROR: AddressSanitizer: stack-use-after-return on address 0x7b0694d6a480 at pc 0x56291df380e6 bp 0x7ffd4adc6f90 sp 0x7ffd4adc6f88 +WRITE of size 8 at 0x7b0694d6a480 thread T0 + #0 0x56291df380e5 in pdf14_initialize /src/ghostpdl/./base/gdevp14.c:6150:15 + #1 0x56291df26b47 in pdf14_RGB_initialize /src/ghostpdl/./base/gdevp14.c:282:12 + #2 0x56291df69823 in pdf14_clist_push_color_model /src/ghostpdl/./base/gdevp14.c:7321:15 + #3 0x56291df66535 in pdf14_clist_composite /src/ghostpdl/./base/gdevp14.c:10430:24 + #4 0x56291df2e083 in send_pdf14trans /src/ghostpdl/./base/gdevp14.c:9549:12 + #5 0x56291defa307 in gs_gstate_update_pdf14trans2 /src/ghostpdl/./base/gstrans.c:141:12 + #6 0x56291def709a in gs_begin_transparency_group /src/ghostpdl/./base/gstrans.c:323:12 + #7 0x56291e5f423a in common_transparency_group /src/ghostpdl/./psi/ztrans.c:216:12 + #8 0x56291e4c0a83 in interp /src/ghostpdl/./psi/interp.c:1721:40 + #9 0x56291e4bb096 in gs_call_interp /src/ghostpdl/./psi/interp.c:520:12 + #10 0x56291e4ba9fe in gs_interpret /src/ghostpdl/./psi/interp.c:477:12 + #11 0x56291deb79dd in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #12 0x56291deb75aa in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #13 0x56291e606f9f in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #14 0x56291e604345 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #15 0x56291e602252 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #16 0x56291e606d74 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #17 0x56291deb09c8 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:97:8 + #18 0x56291deb081b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #19 0x56291dd4e14d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #20 0x56291dd38ec2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #21 0x56291dd3ed90 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #22 0x56291dd6a8c2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #23 0x7f06968ac082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #24 0x56291dd31fad in _start (/out/gstoraster_fuzzer+0x435fad) + +Address 0x7b0694d6a480 is located in stack of thread T0 at offset 1152 in frame + #0 0x56291e4bcf2f in interp /src/ghostpdl/./psi/interp.c:916 + + This frame has 6 object(s): + [32, 48) 'token' (line 947) + [64, 80) 'refnull' (line 950) + [96, 128) 'ierror' (line 962) + [160, 1528) 'sstate' (line 1489) <== Memory access at offset 1152 is inside this variable + [1664, 2016) 'ss' (line 1600) + [2080, 3448) 'sstate' (line 1601) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-use-after-return /src/ghostpdl/./base/gdevp14.c:6150:15 in pdf14_initialize +Shadow bytes around the buggy address: + 0x7b0694d6a200: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7b0694d6a280: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7b0694d6a300: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7b0694d6a380: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7b0694d6a400: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x7b0694d6a480:[f5]f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7b0694d6a500: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7b0694d6a580: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7b0694d6a600: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7b0694d6a680: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7b0694d6a700: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==12071==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-717.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-717.txt new file mode 100755 index 000000000..6b254f277 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-717.txt @@ -0,0 +1,73 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4219905909 +INFO: Loaded 3 modules (142042 inline 8-bit counters): 11664 [0x7ff1b21bcec0, 0x7ff1b21bfc50), 878 [0x7ff1b22a1798, 0x7ff1b22a1b06), 129500 [0x55d069954730, 0x55d06997410c), +INFO: Loaded 3 PC tables (142042 PCs): 11664 [0x7ff1b21bfc50,0x7ff1b21ed550), 878 [0x7ff1b22a1b08,0x7ff1b22a51e8), 129500 [0x55d069974110,0x55d069b6ded0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2021-717 +gsapi_init_with_args: error -100 +gsapi_init_with_args: error -100 +gsapi_init_with_args: error -100 +gsapi_init_with_args: error -100 +gsapi_init_with_args: error -100 +gsapi_init_with_args: error -100 +gsapi_init_with_args: error -100 +gsapi_init_with_args: error -100 +gsapi_init_with_args: error -100 +gsapi_init_with_args: error -100 +================================================================= +==12071==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7e61b117b129 at pc 0x55d0682d8d9a bp 0x7ffd84c49dc0 sp 0x7ffd84c49db8 +READ of size 1 at 0x7e61b117b129 thread T0 + #0 0x55d0682d8d99 in real_param /src/ghostpdl/./psi/iutil.c:856:13 + #1 0x55d0683f90c7 in zpdfinkpath /src/ghostpdl/./psi/zpdfops.c:89:17 + #2 0x55d0682bba73 in interp /src/ghostpdl/./psi/interp.c:1721:40 + #3 0x55d0682b6086 in gs_call_interp /src/ghostpdl/./psi/interp.c:520:12 + #4 0x55d0682b59ee in gs_interpret /src/ghostpdl/./psi/interp.c:477:12 + #5 0x55d067cb49dd in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #6 0x55d067cb45aa in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #7 0x55d068401f8f in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #8 0x55d0683ff335 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #9 0x55d0683fd242 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #10 0x55d068401d64 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #11 0x55d067cad9c8 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:97:8 + #12 0x55d067cad81b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #13 0x55d067b4b14d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #14 0x55d067b35ec2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #15 0x55d067b3bd90 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #16 0x55d067b678c2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #17 0x7ff1b1c67082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #18 0x55d067b2efad in _start (/out/gstoraster_fuzzer+0x434fad) + +Address 0x7e61b117b129 is a wild pointer inside of access range of size 0x000000000001. +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./psi/iutil.c:856:13 in real_param +Shadow bytes around the buggy address: + 0x7e61b117ae80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e61b117af00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e61b117af80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e61b117b000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e61b117b080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x7e61b117b100: fa fa fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa + 0x7e61b117b180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e61b117b200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e61b117b280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e61b117b300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e61b117b380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==12071==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-803.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-803.txt new file mode 100755 index 000000000..54f345a56 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2021-803.txt @@ -0,0 +1,87 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3872717603 +INFO: Loaded 3 modules (142055 inline 8-bit counters): 11664 [0x7f23995bcec0, 0x7f23995bfc50), 878 [0x7f2399681798, 0x7f2399681b06), 129513 [0x564d63c5f450, 0x564d63c7ee39), +INFO: Loaded 3 PC tables (142055 PCs): 11664 [0x7f23995bfc50,0x7f23995ed550), 878 [0x7f2399681b08,0x7f23996851e8), 129513 [0x564d63c7ee40,0x564d63e78cd0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2021-803 +================================================================= +==12071==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7d93985798d8 at pc 0x564d61f717ee bp 0x7ffe9b0a4a30 sp 0x7ffe9b0a41f0 +WRITE of size 16 at 0x7d93985798d8 thread T0 + #0 0x564d61f717ed in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x564d626d1afc in sampled_data_finish /src/ghostpdl/./psi/zfsample.c:602:5 + #2 0x564d626d2f3e in sampled_data_continue /src/ghostpdl/./psi/zfsample.c:548:20 + #3 0x564d625c2952 in interp /src/ghostpdl/./psi/interp.c:1347:28 + #4 0x564d625bfc46 in gs_call_interp /src/ghostpdl/./psi/interp.c:520:12 + #5 0x564d625bf5ae in gs_interpret /src/ghostpdl/./psi/interp.c:477:12 + #6 0x564d61fbe9dd in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #7 0x564d61fbe5aa in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #8 0x564d6270c6af in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #9 0x564d62709a55 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #10 0x564d62707962 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #11 0x564d6270c484 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #12 0x564d61fb79c8 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:97:8 + #13 0x564d61fb781b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #14 0x564d61e5514d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #15 0x564d61e3fec2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #16 0x564d61e45d90 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #17 0x564d61e718c2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #18 0x7f2399048082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #19 0x564d61e38fad in _start (/out/gstoraster_fuzzer+0x434fad) + +0x7d93985798d8 is located 40 bytes before 13272-byte region [0x7d9398579900,0x7d939857ccd8) +allocated by thread T0 here: + #0 0x564d61f73aa4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x564d62287cb0 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:191:34 + #2 0x564d628fbe8e in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2488:13 + #3 0x564d628fafea in alloc_obj /src/ghostpdl/./base/gsalloc.c:1952:13 + #4 0x564d6267be24 in gs_alloc_ref_array /src/ghostpdl/./psi/ialloc.c:226:15 + #5 0x564d625db285 in ref_stack_push_block /src/ghostpdl/./psi/istack.c:614:12 + #6 0x564d625c0010 in gs_call_interp /src/ghostpdl/./psi/interp.c:638:17 + #7 0x564d625bf5ae in gs_interpret /src/ghostpdl/./psi/interp.c:477:12 + #8 0x564d61fbe9dd in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #9 0x564d61fbe5aa in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #10 0x564d6270c6af in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #11 0x564d62709a55 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #12 0x564d62707962 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #13 0x564d6270c484 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #14 0x564d61fb79c8 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:97:8 + #15 0x564d61fb781b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #16 0x564d61e5514d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #17 0x564d61e3fec2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #18 0x564d61e45d90 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #19 0x564d61e718c2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #20 0x7f2399048082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./psi/zfsample.c:602:5 in sampled_data_finish +Shadow bytes around the buggy address: + 0x7d9398579600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d9398579680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d9398579700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d9398579780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d9398579800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x7d9398579880: fa fa fa fa fa fa fa fa fa fa fa[fa]fa fa fa fa + 0x7d9398579900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d9398579980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d9398579a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d9398579a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d9398579b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==12071==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-1.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-1.txt new file mode 100644 index 000000000..8343a40de --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-1.txt @@ -0,0 +1,88 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1591429941 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7ff087c639e0, 0x7ff087c66f6c), 959 [0x7ff087cc4a40, 0x7ff087cc4dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7ff087c66f70,0x7ff087c9c830), 959 [0x7ff087cc4e00,0x7ff087cc89f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-1 +================================================================= +==1==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000001615fc0 at pc 0x000000eb25f2 bp 0x7fff39b67180 sp 0x7fff39b67178 +READ of size 8 at 0x000001615fc0 thread T0 + #0 0xeb25f1 in pdfi_dict_get /src/ghostpdl/./pdf/pdf_dict.c:246:25 + #1 0xeb45ae in pdfi_dict_get_type /src/ghostpdl/./pdf/pdf_dict.c:431:12 + #2 0xeb45ae in pdfi_dict_get_int /src/ghostpdl/./pdf/pdf_dict.c:461:12 + #3 0xff9678 in pdfi_read_stream_object /src/ghostpdl/./pdf/pdf_deref.c:255:12 + #4 0xff9678 in pdfi_read_bare_object /src/ghostpdl/./pdf/pdf_deref.c:439:16 + #5 0xffe082 in pdfi_read_object /src/ghostpdl/./pdf/pdf_deref.c:534:12 + #6 0xffbe2b in pdfi_dereference /src/ghostpdl/./pdf/pdf_deref.c:831:20 + #7 0xebaf61 in pdfi_dict_next /src/ghostpdl/./pdf/pdf_dict.c:1036:20 + #8 0xfe9880 in pdfi_check_XObject_dict /src/ghostpdl/./pdf/pdf_check.c:457:24 + #9 0xfe9880 in pdfi_check_Resources /src/ghostpdl/./pdf/pdf_check.c:897:15 + #10 0xfeacec in pdfi_check_Font /src/ghostpdl/./pdf/pdf_check.c:794:23 + #11 0xfeacec in pdfi_check_Font_dict /src/ghostpdl/./pdf/pdf_check.c:827:20 + #12 0xfeacec in pdfi_check_Resources /src/ghostpdl/./pdf/pdf_check.c:909:15 + #13 0xfe5197 in pdfi_check_page_inner /src/ghostpdl/./pdf/pdf_check.c:1104:16 + #14 0xfe5197 in pdfi_check_page /src/ghostpdl/./pdf/pdf_check.c:1149:12 + #15 0xf2dddd in pdfi_page_info /src/ghostpdl/./pdf/pdf_page.c:490:12 + #16 0xe98c37 in zPDFpageinfo /src/ghostpdl/./psi/zpdfops.c:726:12 + #17 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #18 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #19 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #20 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #21 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #22 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #23 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #24 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #25 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #26 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #27 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #28 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #29 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #30 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #31 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #32 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #33 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #34 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #35 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #36 0x7ff087660082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #37 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: pdfi_dict_get--pdfi_dict_get_type--pdfi_dict_get_int +0x000001615fc0 is located 32 bytes to the left of global variable '' defined in './base/gsmemory.c:41:1' (0x1615fe0) of size 13 + '' is ascii string 'gs_gc_root_t' +0x000001615fc0 is located 0 bytes to the right of global variable 'st_bytes' defined in './base/gsmemory.c:38:1' (0x1615f80) of size 64 +SUMMARY: AddressSanitizer: global-buffer-overflow /src/ghostpdl/./pdf/pdf_dict.c:246:25 in pdfi_dict_get +Shadow bytes around the buggy address: + 0x0000802baba0: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0000802babb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0000802babc0: 00 00 00 00 00 00 00 00 01 f9 f9 f9 01 f9 f9 f9 + 0x0000802babd0: 01 f9 f9 f9 01 f9 f9 f9 01 f9 f9 f9 07 f9 f9 f9 + 0x0000802babe0: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 06 f9 f9 f9 +=>0x0000802babf0: 00 00 00 00 00 00 00 00[f9]f9 f9 f9 00 05 f9 f9 + 0x0000802bac00: 00 00 00 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00 + 0x0000802bac10: f9 f9 f9 f9 00 00 02 f9 f9 f9 f9 f9 00 00 00 00 + 0x0000802bac20: 00 00 00 00 f9 f9 f9 f9 04 f9 f9 f9 00 00 00 00 + 0x0000802bac30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0000802bac40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-100.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-100.txt new file mode 100644 index 000000000..da46d825a --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-100.txt @@ -0,0 +1,90 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1591802834 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f582fc6e9e0, 0x7f582fc71f6c), 959 [0x7f582fccfa40, 0x7f582fccfdff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f582fc71f70,0x7f582fca7830), 959 [0x7f582fccfe00,0x7f582fcd39f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-100 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f582e08a3d4 at pc 0x0000004be68c bp 0x7ffdfe4701b0 sp 0x7ffdfe46f970 +WRITE of size 1 at 0x7f582e08a3d4 thread T0 + #0 0x4be68b in __interceptor_memmove /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:810:3 + #1 0x6bd4d0 in stream_move /src/ghostpdl/./base/stream.c:999:5 + #2 0x6bd4d0 in sgets /src/ghostpdl/./base/stream.c:547:13 + #3 0xee2cc9 in pdfi_read_bytes /src/ghostpdl/./pdf/pdf_file.c:1471:16 + #4 0xec7a2f in read_digits /src/ghostpdl/./pdf/pdf_xref.c:549:17 + #5 0xec7a2f in read_xref_entry_slow /src/ghostpdl/./pdf/pdf_xref.c:590:12 + #6 0xec4b7b in read_xref_section /src/ghostpdl/./pdf/pdf_xref.c:752:24 + #7 0xec4b7b in read_xref /src/ghostpdl/./pdf/pdf_xref.c:800:16 + #8 0xec3411 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1032:20 + #9 0xeaa746 in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1048:12 + #10 0xeaa746 in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1315:12 + #11 0xe97094 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:521:12 + #12 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #13 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #14 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #15 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #16 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #17 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #18 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #19 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #20 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #21 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #22 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #23 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #24 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #25 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #26 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #27 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #28 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #29 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #30 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #31 0x7f582f66b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #32 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: __interceptor_memmove--stream_move--sgets +Address 0x7f582e08a3d4 is located in stack of thread T0 at offset 84 in frame + #0 0xec74bf in read_xref_entry_slow /src/ghostpdl/./pdf/pdf_xref.c:563 + +DEDUP_TOKEN: read_xref_entry_slow + This frame has 3 object(s): + [32, 33) 'c.i146' (line 528) + [48, 49) 'c.i' (line 528) + [64, 84) 'Buffer' (line 564) <== Memory access at offset 84 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:810:3 in __interceptor_memmove +Shadow bytes around the buggy address: + 0x0feb85c09420: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0feb85c09430: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0feb85c09440: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0feb85c09450: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0feb85c09460: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0feb85c09470: f1 f1 f1 f1 f8 f2 f8 f2 00 00[04]f3 f3 f3 f3 f3 + 0x0feb85c09480: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0feb85c09490: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0feb85c094a0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0feb85c094b0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0feb85c094c0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-102.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-102.txt new file mode 100644 index 000000000..ea9612122 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-102.txt @@ -0,0 +1,57 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1592180041 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f19e20c29e0, 0x7f19e20c5f6c), 959 [0x7f19e2123a40, 0x7f19e2123dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f19e20c5f70,0x7f19e20fb830), 959 [0x7f19e2123e00,0x7f19e21279f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-102 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x0000006f3321 bp 0x7ffd8deefc60 sp 0x7ffd8deefbf0 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x6f3321 in chunk_free_object /src/ghostpdl/./base/gsmchunk.c:1092:14 + #1 0xf75203 in pdfi_free_font_type1 /src/ghostpdl/./pdf/pdf_font1.c:804:13 + #2 0xf66fb5 in pdfi_free_font /src/ghostpdl/./pdf/pdf_font.c:1330:20 + #3 0x1003acf in pdfi_free_object /src/ghostpdl/./pdf/pdf_obj.c:272:13 + #4 0xf0c2f7 in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:83:13 + #5 0xf0c2f7 in pdfi_grestore /src/ghostpdl/./pdf/pdf_gstate.c:294:13 + #6 0xf23614 in pdfi_form_execgroup /src/ghostpdl/./pdf/pdf_image.c:2136:16 + #7 0xfdb674 in pdfi_trans_set_mask /src/ghostpdl/./pdf/pdf_trans.c:291:16 + #8 0xfdb674 in pdfi_trans_set_params /src/ghostpdl/./pdf/pdf_trans.c:813:13 + #9 0xfd98b8 in pdfi_trans_setup /src/ghostpdl/./pdf/pdf_trans.c:701:12 + #10 0xfdc645 in pdfi_trans_setup_text /src/ghostpdl/./pdf/pdf_trans.c + #11 0xfc3b65 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:898:12 + #12 0xfc6ce4 in pdfi_TJ /src/ghostpdl/./pdf/pdf_text.c:1268:28 + #13 0xeda99b in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1632:24 + #14 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #15 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #16 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #17 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #18 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #19 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #20 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #21 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #22 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #23 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #24 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #25 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #26 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #27 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #28 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #29 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #30 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #31 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #32 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #33 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #34 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #35 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #36 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #37 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #38 0x7f19e1abf082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #39 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: chunk_free_object--pdfi_free_font_type1--pdfi_free_font +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gsmchunk.c:1092:14 in chunk_free_object +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-121.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-121.txt new file mode 100755 index 000000000..1b6368fc7 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-121.txt @@ -0,0 +1,107 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2210438280 +INFO: Loaded 3 modules (157120 inline 8-bit counters): 11664 [0x7fdcf03bcec0, 0x7fdcf03bfc50), 878 [0x7fdcf0591798, 0x7fdcf0591b06), 144578 [0x5643026f6b20, 0x564302719fe2), +INFO: Loaded 3 PC tables (157120 PCs): 11664 [0x7fdcf03bfc50,0x7fdcf03ed550), 878 [0x7fdcf0591b08,0x7fdcf05951e8), 144578 [0x564302719fe8,0x56430294ec08), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-121 +================================================================= +==12147==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7eecef254830 at pc 0x564300c018f5 bp 0x7ffd1a944420 sp 0x7ffd1a944418 +READ of size 1 at 0x7eecef254830 thread T0 + #0 0x564300c018f4 in s_hex_process /src/ghostpdl/./base/sstring.c:416:33 + #1 0x564300b8da43 in s_exD_process /src/ghostpdl/./base/seexec.c:168:18 + #2 0x5643006d5188 in sreadbuf /src/ghostpdl/./base/stream.c:842:22 + #3 0x5643006d2fb2 in s_process_read_buf /src/ghostpdl/./base/stream.c:768:14 + #4 0x5643006d3d90 in spgetcc /src/ghostpdl/./base/stream.c:481:9 + #5 0x564300dd9d63 in ps_font_eexec_func /src/ghostpdl/./pdf/pdf_fontps.c:988:13 + #6 0x564300dd2a01 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:362:36 + #7 0x564300dd34fb in pdfi_read_ps_font /src/ghostpdl/./pdf/pdf_fontps.c:1253:12 + #8 0x564300db9192 in pdfi_read_type1_font /src/ghostpdl/./pdf/pdf_font1.c:529:16 + #9 0x564300dab1f3 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:738:32 + #10 0x564300dae5fb in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:840:16 + #11 0x564300db1a67 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:878:12 + #12 0x564300db1839 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1324:12 + #13 0x564300d50b7e in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1654:24 + #14 0x564300d4f521 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2076:32 + #15 0x564300d9113e in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #16 0x564300d90484 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #17 0x564300d8e43d in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:834:12 + #18 0x564300d2349f in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:930:20 + #19 0x564300be1538 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #20 0x564300bdbb46 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #21 0x564300bdb4ae in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #22 0x5643005b705d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #23 0x5643005b6c2a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #24 0x564300e372af in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #25 0x564300e34627 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #26 0x564300e32532 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #27 0x564300e37084 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #28 0x5643005af9d8 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:97:8 + #29 0x5643005af82b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #30 0x56430044d15d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #31 0x564300437ed2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #32 0x56430043dda0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #33 0x5643004698d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #34 0x7fdcefee3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #35 0x564300430fbd in _start (/out/gstoraster_fuzzer+0x519fbd) + +0x7eecef254830 is located 0 bytes after 65584-byte region [0x7eecef244800,0x7eecef254830) +allocated by thread T0 here: + #0 0x56430056bab4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x56430089a460 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x564300701f95 in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #3 0x5643010b699e in gx_char_cache_alloc /src/ghostpdl/./base/gxccman.c:88:13 + #4 0x56430103266c in gs_font_dir_alloc2_limits /src/ghostpdl/./base/gsfont.c:264:12 + #5 0x5643010324df in gs_font_dir_alloc2 /src/ghostpdl/./base/gsfont.c:236:16 + #6 0x564300db3c1b in pdfi_init_font_directory /src/ghostpdl/./pdf/pdf_font.c:1676:21 + #7 0x564300d326da in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1632:12 + #8 0x564300d239bc in zPDFInit /src/ghostpdl/./psi/zpdfops.c:1015:11 + #9 0x564300be1538 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #10 0x564300bdbb46 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #11 0x564300bdb4ae in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #12 0x5643005b705d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #13 0x5643005b6c2a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #14 0x564300e372af in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #15 0x564300e34627 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #16 0x564300e32532 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #17 0x564300e37084 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #18 0x5643005af9d8 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:97:8 + #19 0x5643005af82b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #20 0x56430044d15d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #21 0x564300437ed2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #22 0x56430043dda0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #23 0x5643004698d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #24 0x7fdcefee3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/sstring.c:416:33 in s_hex_process +Shadow bytes around the buggy address: + 0x7eecef254580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7eecef254600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7eecef254680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7eecef254700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7eecef254780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7eecef254800: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa + 0x7eecef254880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7eecef254900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7eecef254980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7eecef254a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7eecef254a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==12147==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-177.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-177.txt new file mode 100644 index 000000000..120b321ed --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-177.txt @@ -0,0 +1,62 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1593014787 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f2196e1f9e0, 0x7f2196e22f6c), 959 [0x7f2196e80a40, 0x7f2196e80dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f2196e22f70,0x7f2196e58830), 959 [0x7f2196e80e00,0x7f2196e849f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-177 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x6310100f6f40 (pc 0x000000ad92ec bp 0x7ffe1bb084f0 sp 0x7ffe1bb08470 T0) +==1==The signal is caused by a READ memory access. + #0 0xad92ec in gx_dc_default_fill_masked /src/ghostpdl/./base/gxdcolor.c:1068:44 + #1 0xb28cdb in copy_portrait /src/ghostpdl/./base/gxifast.c:567:16 + #2 0xb26565 in image_render_simple /src/ghostpdl/./base/gxifast.c:678:20 + #3 0x1370483 in gx_image1_plane_data /src/ghostpdl/./base/gxidata.c:238:20 + #4 0xb2a101 in gx_image_plane_data_rows /src/ghostpdl/./base/gximage.c:171:12 + #5 0x8da428 in gs_image_next_planes /src/ghostpdl/./base/gsimage.c:636:20 + #6 0x8d91ef in gs_image_next /src/ghostpdl/./base/gsimage.c:517:12 + #7 0x934e17 in fapi_image_uncached_glyph /src/ghostpdl/./base/gxfapi.c:941:32 + #8 0x934e17 in gs_fapi_finish_render /src/ghostpdl/./base/gxfapi.c:1191:22 + #9 0x93bfe4 in gs_fapi_do_char /src/ghostpdl/./base/gxfapi.c:1752:16 + #10 0x139633d in pdfi_fapi_build_char /src/ghostpdl/./pdf/pdf_fapi.c:1386:12 + #11 0xa8e366 in show_proceed /src/ghostpdl/./base/gxchar.c:1239:12 + #12 0xa85d20 in continue_show /src/ghostpdl/./base/gxchar.c:761:12 + #13 0xa8820c in gx_show_text_process /src/ghostpdl/./base/gxchar.c:738:12 + #14 0x9221ff in gs_text_process /src/ghostpdl/./base/gstext.c:696:12 + #15 0xfc9922 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:516:16 + #16 0xfc9922 in pdfi_show_Tr_0 /src/ghostpdl/./pdf/pdf_text.c:531:12 + #17 0xfc3e92 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:913:24 + #18 0xfc5911 in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1131:12 + #19 0xeda973 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1628:24 + #20 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #21 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #22 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #23 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #24 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #25 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #26 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #27 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #28 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #29 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #30 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #31 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #32 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #33 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #34 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #35 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #36 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #37 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #38 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #39 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #40 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #41 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #42 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #43 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #44 0x7f219681c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #45 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: gx_dc_default_fill_masked--copy_portrait--image_render_simple +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gxdcolor.c:1068:44 in gx_dc_default_fill_masked +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-18.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-18.txt new file mode 100644 index 000000000..da1e01dc1 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-18.txt @@ -0,0 +1,47 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1593586432 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7fb4e2ece9e0, 0x7fb4e2ed1f6c), 959 [0x7fb4e2f2fa40, 0x7fb4e2f2fdff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7fb4e2ed1f70,0x7fb4e2f07830), 959 [0x7fb4e2f2fe00,0x7fb4e2f339f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-18 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x62a0000aa4c0 (pc 0x62a0000aa4c0 bp 0x7ffe6c62be90 sp 0x7ffe6c62be58 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: PC is at a non-executable region. Maybe a wild jump? + #0 0x62a0000aa4c0 () + #1 0x10b0341 in gs_setcolor /src/ghostpdl/./base/gscolor2.c:105:5 + #2 0xef1f76 in pdfi_gs_setrgbcolor /src/ghostpdl/./pdf/pdf_colour.c:379:16 + #3 0xef2dd0 in pdfi_setrgbstroke /src/ghostpdl/./pdf/pdf_colour.c:511:12 + #4 0xedaafd in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1568:24 + #5 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #6 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #7 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #8 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #9 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #10 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #11 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #12 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #13 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #14 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #15 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #16 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #17 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #18 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #19 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #20 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #21 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #22 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #23 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #24 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #25 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #26 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #27 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #28 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #29 0x7fb4e28cb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: gs_setcolor--pdfi_gs_setrgbcolor +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV () +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-199.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-199.txt new file mode 100644 index 000000000..b60943ab3 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-199.txt @@ -0,0 +1,97 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1594257450 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f77c00679e0, 0x7f77c006af6c), 959 [0x7f77c00c8a40, 0x7f77c00c8dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f77c006af70,0x7f77c00a0830), 959 [0x7f77c00c8e00,0x7f77c00cc9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-199 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f77be799840 at pc 0x0000004be93e bp 0x7ffc653047d0 sp 0x7ffc65303f90 +READ of size 72 at 0x7f77be799840 thread T0 + #0 0x4be93d in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xff3aed in pdf_compute_encryption_key_preR5 /src/ghostpdl/./pdf/pdf_sec.c:129:13 + #2 0xff3aed in check_user_password_preR5 /src/ghostpdl/./pdf/pdf_sec.c:442:12 + #3 0xff0b42 in check_password_preR5 /src/ghostpdl/./pdf/pdf_sec.c:1227:12 + #4 0xff0b42 in pdfi_initialise_Decryption /src/ghostpdl/./pdf/pdf_sec.c:1374:20 + #5 0xeaa8d9 in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1072:20 + #6 0xeaa8d9 in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1315:12 + #7 0xe97094 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:521:12 + #8 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #9 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #10 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #11 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #12 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #13 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #14 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #15 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #16 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #17 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #18 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #19 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #20 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #21 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #22 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #23 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #24 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #25 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #26 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #27 0x7f77bfa64082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #28 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: __interceptor_memcpy--pdf_compute_encryption_key_preR5--check_user_password_preR5 +Address 0x7f77be799840 is located in stack of thread T0 at offset 64 in frame + #0 0xff330f in check_user_password_preR5 /src/ghostpdl/./pdf/pdf_sec.c:424 + +DEDUP_TOKEN: check_user_password_preR5 + This frame has 14 object(s): + [32, 64) 'Key.i' (line 54) + [96, 100) 'P.i' (line 56) <== Memory access at offset 64 partially underflows this variable + [112, 200) 'md5.i' (line 57) <== Memory access at offset 64 partially underflows this variable + [240, 248) 'a.i' (line 58) + [272, 280) 's.i' (line 59) + [304, 312) 'Key' (line 425) + [336, 344) 'XORKey' (line 425) + [368, 376) 'stream' (line 427) + [400, 408) 'arc4_stream' (line 427) + [432, 464) 'Buffer' (line 428) + [496, 512) 'Hash' (line 429) + [528, 616) 'md5' (line 430) + [656, 664) 's' (line 431) + [688, 696) 'a' (line 432) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x0fef77ceb2b0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fef77ceb2c0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fef77ceb2d0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fef77ceb2e0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fef77ceb2f0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0fef77ceb300: f1 f1 f1 f1 00 00 00 00[f2]f2 f2 f2 04 f2 00 00 + 0x0fef77ceb310: 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 00 f2 + 0x0fef77ceb320: f2 f2 00 f2 f2 f2 00 f2 f2 f2 00 f2 f2 f2 00 f2 + 0x0fef77ceb330: f2 f2 00 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 00 00 + 0x0fef77ceb340: f2 f2 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 + 0x0fef77ceb350: f2 f2 00 f2 f2 f2 00 f3 f3 f3 f3 f3 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-206.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-206.txt new file mode 100644 index 000000000..39e2bccde --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-206.txt @@ -0,0 +1,98 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1594650809 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7fdd10a169e0, 0x7fdd10a19f6c), 959 [0x7fdd10a77a40, 0x7fdd10a77dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7fdd10a19f70,0x7fdd10a4f830), 959 [0x7fdd10a77e00,0x7fdd10a7b9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-206 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62a000005050 at pc 0x0000004be54d bp 0x7ffeb14c8990 sp 0x7ffeb14c8150 +READ of size 4294967295 at 0x62a000005050 thread T0 + #0 0x4be54c in __interceptor_memmove /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:810:3 + #1 0x6bc928 in stream_compact /src/ghostpdl/./base/stream.c:1012:9 + #2 0x6bc928 in s_process_read_buf /src/ghostpdl/./base/stream.c:767:5 + #3 0x6bc928 in spgetcc /src/ghostpdl/./base/stream.c:481:9 + #4 0xd1588a in gs_scan_token /src/ghostpdl/./psi/iscan.c:560:11 + #5 0xcfca75 in interp /src/ghostpdl/./psi/interp.c:1502:24 + #6 0xcfca75 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #7 0xcfca75 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #8 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #9 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #10 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #11 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #12 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #13 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #14 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #15 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #16 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #17 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #18 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #19 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #20 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #21 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #22 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #23 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #24 0x7fdd10413082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #25 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: __interceptor_memmove--stream_compact--s_process_read_buf +0x62a000005050 is located 0 bytes to the right of 20048-byte region [0x62a000000200,0x62a000005050) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6aa1 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x12b9c14 in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2488:13 + #3 0x12b8ac2 in alloc_add_clump /src/ghostpdl/./base/gsalloc.c:2438:19 + #4 0x12b8ac2 in alloc_obj /src/ghostpdl/./base/gsalloc.c:2046:17 + #5 0x12b1521 in i_alloc_struct /src/ghostpdl/./base/gsalloc.c:1234:15 + #6 0xdf68c6 in name_alloc_sub /src/ghostpdl/./psi/iname.c:496:11 + #7 0xdf5cd8 in names_init /src/ghostpdl/./psi/iname.c:102:20 + #8 0x561f95 in gs_main_init1 /src/ghostpdl/./psi/imain.c:207:14 + #9 0x101741e in swproc /src/ghostpdl/./psi/imainarg.c:781:29 + #10 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #11 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #12 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #13 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #14 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #15 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #16 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #17 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #18 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #19 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #20 0x7fdd10413082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--alloc_acquire_clump +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:810:3 in __interceptor_memmove +Shadow bytes around the buggy address: + 0x0c547fff89b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c547fff89c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c547fff89d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c547fff89e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c547fff89f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c547fff8a00: 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa + 0x0c547fff8a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c547fff8a20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c547fff8a30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c547fff8a40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c547fff8a50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-210.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-210.txt new file mode 100644 index 000000000..1e57445f1 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-210.txt @@ -0,0 +1,53 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1595057893 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7fde3ba9e9e0, 0x7fde3baa1f6c), 959 [0x7fde3baffa40, 0x7fde3baffdff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7fde3baa1f70,0x7fde3bad7830), 959 [0x7fde3baffe00,0x7fde3bb039f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-210 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x62cff76fa5a0 (pc 0x000000f88aed bp 0x7ffecc8c8630 sp 0x7ffecc8c8600 T0) +==1==The signal is caused by a READ memory access. + #0 0xf88aed in u16 /src/ghostpdl/./pdf/pdf_font1C.c:528:13 + #1 0xf88aed in pdfi_count_cff_index /src/ghostpdl/./pdf/pdf_font1C.c:1079:13 + #2 0xf7b234 in pdfi_read_cff /src/ghostpdl/./pdf/pdf_font1C.c:1546:9 + #3 0xf7b234 in pdfi_read_cff_font /src/ghostpdl/./pdf/pdf_font1C.c:2132:20 + #4 0xf5cc87 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:731:32 + #5 0xf6c166 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:277:16 + #6 0xf5c4c4 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #7 0xf62074 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #8 0xf666f5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #9 0xf666f5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #10 0xeda923 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1624:24 + #11 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #12 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #13 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #14 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #15 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #16 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #24 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #25 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #26 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #27 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #30 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7fde3b49b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: u16--pdfi_count_cff_index--pdfi_read_cff +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_font1C.c:528:13 in u16 +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-218.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-218.txt new file mode 100644 index 000000000..5215d7efe --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-218.txt @@ -0,0 +1,48 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1595421725 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f2dbc40a9e0, 0x7f2dbc40df6c), 959 [0x7f2dbc46ba40, 0x7f2dbc46bdff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f2dbc40df70,0x7f2dbc443830), 959 [0x7f2dbc46be00,0x7f2dbc46f9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-218 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000055 (pc 0x000001003a3f bp 0x7ffdab5452d0 sp 0x7ffdab5452a0 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: address points to the zero page. + #0 0x1003a3f in pdfi_free_keyword /src/ghostpdl/./pdf/pdf_obj.c:219:9 + #1 0x1003a3f in pdfi_free_object /src/ghostpdl/./pdf/pdf_obj.c:266:13 + #2 0xf1d58e in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:83:13 + #3 0xf1d58e in pdfi_pop /src/ghostpdl/./pdf/pdf_stack.c:35:9 + #4 0xf1d58e in pdfi_clearstack /src/ghostpdl/./pdf/pdf_stack.c:96:5 + #5 0x1000fe9 in pdfi_repair_file /src/ghostpdl/./pdf/pdf_repair.c + #6 0xec3d60 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1117:16 + #7 0xeaa746 in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1048:12 + #8 0xeaa746 in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1315:12 + #9 0xe97094 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:521:12 + #10 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #11 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #12 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #13 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #14 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #15 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #16 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #17 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #18 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #19 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #20 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #21 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #22 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #23 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #24 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #25 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #26 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #27 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #28 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #29 0x7f2dbbe07082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #30 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: pdfi_free_keyword--pdfi_free_object--pdfi_countdown_impl +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_obj.c:219:9 in pdfi_free_keyword +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-229.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-229.txt new file mode 100755 index 000000000..8e02cd205 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-229.txt @@ -0,0 +1,45 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2004065923 +INFO: Loaded 3 modules (157201 inline 8-bit counters): 11664 [0x7f598edbcec0, 0x7f598edbfc50), 878 [0x7f598f016798, 0x7f598f016b06), 144659 [0x55778a492f80, 0x55778a4b6493), +INFO: Loaded 3 PC tables (157201 PCs): 11664 [0x7f598edbfc50,0x7f598eded550), 878 [0x7f598f016b08,0x7f598f01a1e8), 144659 [0x55778a4b6498,0x55778a6eb5c8), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-229 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==12147==ERROR: AddressSanitizer: SEGV on unknown address 0x7dfa8de9bc0b (pc 0x5577880e43c0 bp 0x7ffc6000eb50 sp 0x7ffc6000eae0 T0) +==12147==The signal is caused by a READ memory access. + #0 0x5577880e43c0 in spgetcc /src/ghostpdl/./base/stream.c:496:12 + #1 0x5577887677df in pdfi_read_byte /src/ghostpdl/./pdf/pdf_file.c:1477:12 + #2 0x5577887581ca in pdfi_skip_white /src/ghostpdl/./pdf/pdf_int.c:114:13 + #3 0x557788758618 in pdfi_read_token /src/ghostpdl/./pdf/pdf_int.c:914:5 + #4 0x55778875f16a in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:1935:16 + #5 0x5577887a16be in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #6 0x5577887a0a04 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #7 0x55778879e984 in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:834:12 + #8 0x55778873492f in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:930:20 + #9 0x5577885f1fa8 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #10 0x5577885ec5b6 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #11 0x5577885ebf1e in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #12 0x557787fc705d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #13 0x557787fc6c2a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #14 0x557788846dff in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #15 0x557788844177 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #16 0x557788842082 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #17 0x557788846bd4 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #18 0x557787fbf9d8 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:97:8 + #19 0x557787fbf82b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #20 0x557787e5d15d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #21 0x557787e47ed2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #22 0x557787e4dda0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #23 0x557787e798d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #24 0x7f598e8e3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #25 0x557787e40fbd in _start (/out/gstoraster_fuzzer+0x51bfbd) + +==12147==Register values: +rax = 0x0000000000000000 rbx = 0x000000000000020c rcx = 0x0000000000000021 rdx = 0x000055778a7f5400 +rdi = 0x00007dfa8de9bc0b rsi = 0x0000000200000000 rbp = 0x00007ffc6000eb50 rsp = 0x00007ffc6000eae0 + r8 = 0x0000000000000008 r9 = 0x0000000000000001 r10 = 0x00000fcd31b86a13 r11 = 0x00000fcdb1b7ea08 +r12 = 0x0000000000000000 r13 = 0x00000f9331b7c262 r14 = 0x00000000ffffffff r15 = 0x00007c998dbe1310 +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/stream.c:496:12 in spgetcc +==12147==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-232.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-232.txt new file mode 100755 index 000000000..b198cffb9 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-232.txt @@ -0,0 +1,67 @@ +vm.mmap_rnd_bits = 28 +/out/gstoraster_fuzzer -- -rss_limit_mb=2560 -timeout=25 -runs=10 /corpus/testcase-OSV-2022-232 < /dev/null +INFO: libFuzzer ignores flags that start with '--' +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3412510011 +INFO: Loaded 3 modules (183119 inline 8-bit counters): 13708 [0x7fb80617e9e0, 0x7fb806181f6c), 959 [0x7fb8061dfa40, 0x7fb8061dfdff), 168452 [0x312fc10, 0x3158e14), +INFO: Loaded 3 PC tables (183119 PCs): 13708 [0x7fb806181f70,0x7fb8061b7830), 959 [0x7fb8061dfe00,0x7fb8061e39f0), 168452 [0x24cf9b0,0x27619f0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-232 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==15==ERROR: AddressSanitizer: SEGV on unknown address 0x00000c400000 (pc 0x7fb805c11d58 bp 0x7ffeb3285fd0 sp 0x7ffeb3285788 T0) +==15==The signal is caused by a READ memory access. +SCARINESS: 20 (wild-addr-read) + #0 0x7fb805c11d58 (/lib/x86_64-linux-gnu/libc.so.6+0xbbd58) + #1 0x4be747 in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #2 0x13a65c0 in pdfi_fapi_get_glyph /src/ghostpdl/./pdf/pdf_fapi.c:1203:25 + #3 0x94acb8 in get_fapi_glyph_data /src/ghostpdl/./base/fapi_ft.c:428:22 + #4 0x998e35 in cff_get_glyph_data /src/ghostpdl/./freetype/src/cff/cffgload.c:56:19 + #5 0x998e35 in cff_slot_load /src/ghostpdl/./freetype/src/cff/cffgload.c:417:15 + #6 0x994afa in cff_glyph_load /src/ghostpdl/./freetype/src/cff/cffdrivr.c:192:13 + #7 0x95fec7 in FT_Load_Glyph /src/ghostpdl/./freetype/src/base/ftobjs.c:987:15 + #8 0x94bebb in load_glyph /src/ghostpdl/./base/fapi_ft.c:685:20 + #9 0x948054 in gs_fapi_ft_get_char_raster_metrics /src/ghostpdl/./base/fapi_ft.c:1572:9 + #10 0x93cfc2 in gs_fapi_do_char /src/ghostpdl/./base/gxfapi.c:1570:16 + #11 0x13a019d in pdfi_fapi_build_char /src/ghostpdl/./pdf/pdf_fapi.c:1405:16 + #12 0xa91706 in show_proceed /src/ghostpdl/./base/gxchar.c:1229:12 + #13 0xa891e0 in continue_show /src/ghostpdl/./base/gxchar.c:751:12 + #14 0xa8b6cc in gx_show_text_process /src/ghostpdl/./base/gxchar.c:728:12 + #15 0x9253df in gs_text_process /src/ghostpdl/./base/gstext.c:696:12 + #16 0xfd0a52 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:521:16 + #17 0xfd0a52 in pdfi_show_Tr_0 /src/ghostpdl/./pdf/pdf_text.c:536:12 + #18 0xfcadca in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:918:24 + #19 0xfcc85f in pdfi_Tj /src/ghostpdl/./pdf/pdf_text.c:1143:12 + #20 0xedcd92 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1559:24 + #21 0xedb2c8 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:1977:32 + #22 0xf37e8c in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #23 0xf37e8c in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #24 0xf37e8c in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:834:12 + #25 0xe9f3bf in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:930:20 + #26 0xd0282b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #27 0xd0282b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #28 0xd0282b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #29 0x56793a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #30 0x56793a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #31 0x56793a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #32 0x562de2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #33 0x1025ce1 in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #34 0x1021ce9 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #35 0x101ebce in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #36 0x1025a69 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #37 0xceaea4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #38 0x55f23c in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #39 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #40 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #41 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #42 0x457065 in fuzzer::Fuzzer::TryDetectingAMemoryLeak(unsigned char const*, unsigned long, bool) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:687:3 + #43 0x44221e in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:8 + #44 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #45 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #46 0x7fb805b7a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #47 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: __interceptor_memcpy--pdfi_fapi_get_glyph +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0xbbd58) +==15==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-270.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-270.txt new file mode 100644 index 000000000..8506e3fc0 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-270.txt @@ -0,0 +1,105 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1595784766 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f4af59fc9e0, 0x7f4af59fff6c), 959 [0x7f4af5a5da40, 0x7f4af5a5ddff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f4af59fff70,0x7f4af5a35830), 959 [0x7f4af5a5de00,0x7f4af5a619f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-270 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f4af40a2844 at pc 0x00000102fe52 bp 0x7ffdf56185a0 sp 0x7ffdf5618598 +WRITE of size 4 at 0x7f4af40a2844 thread T0 + #0 0x102fe51 in fn_ElIn_evaluate /src/ghostpdl/./base/gsfunc3.c:121:16 + #1 0xf18a3f in pdfi_set_gray_transfer /src/ghostpdl/./pdf/pdf_gstate.c:1015:16 + #2 0xf18a3f in pdfi_set_transfer /src/ghostpdl/./pdf/pdf_gstate.c:1057:16 + #3 0xf0f9a6 in GS_TR /src/ghostpdl/./pdf/pdf_gstate.c:1072:12 + #4 0xf169a7 in pdfi_set_ExtGState /src/ghostpdl/./pdf/pdf_gstate.c:2318:20 + #5 0xf169a7 in pdfi_setgstate /src/ghostpdl/./pdf/pdf_gstate.c:2358:12 + #6 0xeda716 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1500:24 + #7 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #8 0xed6d8d in pdfi_interpret_inner_content /src/ghostpdl/./pdf/pdf_int.c:1912:12 + #9 0xed6d8d in pdfi_interpret_inner_content_stream /src/ghostpdl/./pdf/pdf_int.c:2011:12 + #10 0xed6d8d in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1858:12 + #11 0xf235d1 in pdfi_form_execgroup /src/ghostpdl/./pdf/pdf_image.c:2130:12 + #12 0xf2466d in pdfi_do_form /src/ghostpdl/./pdf/pdf_image.c:2364:16 + #13 0xf24cd0 in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2462:16 + #14 0xf254cf in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2540:12 + #15 0xeda7f8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1457:24 + #16 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #17 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #18 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #19 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #20 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #21 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #22 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #23 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #24 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #25 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #26 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #27 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #28 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #29 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #30 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #31 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #32 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #33 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #34 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #35 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #36 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #37 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #38 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #39 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #40 0x7f4af53f9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #41 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: fn_ElIn_evaluate--pdfi_set_gray_transfer--pdfi_set_transfer +Address 0x7f4af40a2844 is located in stack of thread T0 at offset 68 in frame + #0 0xf182af in pdfi_set_transfer /src/ghostpdl/./pdf/pdf_gstate.c:1030 + +DEDUP_TOKEN: pdfi_set_transfer + This frame has 9 object(s): + [32, 40) 'pfn.i43' (line 1000) + [64, 68) 'v.i44' (line 1011) <== Memory access at offset 68 overflows this variable + [80, 84) 'f.i45' (line 1011) + [96, 104) 'o.i' (line 889) + [128, 144) 'proc_types.i' (line 890) + [160, 192) 'map_procs.i' (line 891) + [224, 256) 'pfn.i' (line 892) + [288, 292) 'v.i' (line 959) + [304, 308) 'f.i' (line 959) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ghostpdl/./base/gsfunc3.c:121:16 in fn_ElIn_evaluate +Shadow bytes around the buggy address: + 0x0fe9de80c4b0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe9de80c4c0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe9de80c4d0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe9de80c4e0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe9de80c4f0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0fe9de80c500: f1 f1 f1 f1 00 f2 f2 f2[04]f2 04 f2 f8 f2 f2 f2 + 0x0fe9de80c510: f8 f8 f2 f2 f8 f8 f8 f8 f2 f2 f2 f2 f8 f8 f8 f8 + 0x0fe9de80c520: f2 f2 f2 f2 f8 f2 f8 f3 00 00 00 00 00 00 00 00 + 0x0fe9de80c530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe9de80c540: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe9de80c550: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-271.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-271.txt new file mode 100755 index 000000000..28a80bcd9 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-271.txt @@ -0,0 +1,56 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1785313646 +INFO: Loaded 3 modules (157230 inline 8-bit counters): 11664 [0x7f24d9bbcec0, 0x7f24d9bbfc50), 878 [0x7f24d9caa798, 0x7f24d9caab06), 144688 [0x55af4415afc0, 0x55af4417e4f0), +INFO: Loaded 3 PC tables (157230 PCs): 11664 [0x7f24d9bbfc50,0x7f24d9bed550), 878 [0x7f24d9caab08,0x7f24d9cae1e8), 144688 [0x55af4417e4f0,0x55af443b37f0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-271 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==12147==ERROR: AddressSanitizer: SEGV on unknown address 0x0000ffff8000 (pc 0x55af41d109c6 bp 0x7ffec9bc1e10 sp 0x7ffec9bc1dc0 T0) +==12147==The signal is caused by a READ memory access. + #0 0x55af41d109c6 in pdf14_buf_free /src/ghostpdl/./base/gdevp14.c:1174:45 + #1 0x55af41d10899 in rc_pdf14_maskbuf_free /src/ghostpdl/./base/gdevp14.c:1202:9 + #2 0x55af41d2f199 in pdf14_free_mask_stack /src/ghostpdl/./base/gdevp14.c:1898:17 + #3 0x55af41d2e45b in pdf14_pop_transparency_mask /src/ghostpdl/./base/gdevp14.c:1972:17 + #4 0x55af41d0c1eb in pdf14_end_transparency_mask /src/ghostpdl/./base/gdevp14.c:7681:10 + #5 0x55af41d274a1 in gx_update_pdf14_compositor /src/ghostpdl/./base/gdevp14.c:6031:20 + #6 0x55af42627751 in apply_composite /src/ghostpdl/./base/gxclrast.c:3115:12 + #7 0x55af426239a1 in execute_compositor_queue /src/ghostpdl/./base/gxclrast.c:402:16 + #8 0x55af4261b742 in clist_playback_band /src/ghostpdl/./base/gxclrast.c:1821:48 + #9 0x55af41d88b5e in clist_playback_file_bands /src/ghostpdl/./base/gxclread.c:1054:16 + #10 0x55af41d8c5af in clist_render_rectangle /src/ghostpdl/./base/gxclread.c:988:16 + #11 0x55af41d8bb05 in clist_rasterize_lines /src/ghostpdl/./base/gxclread.c:876:20 + #12 0x55af41d8af61 in clist_get_bits_rectangle /src/ghostpdl/./base/gxclread.c:765:12 + #13 0x55af41d65dbc in gdev_prn_get_bits /src/ghostpdl/./base/gdevprn.c:1653:12 + #14 0x55af41ea0de8 in cups_print_chunked /src/ghostpdl/./cups/gdevcups.c:4868:9 + #15 0x55af41e97d78 in cups_print_pages /src/ghostpdl/./cups/gdevcups.c + #16 0x55af41d627c7 in gdev_prn_output_page_aux /src/ghostpdl/./base/gdevprn.c:1059:27 + #17 0x55af41ea0574 in cups_output_page /src/ghostpdl/./cups/gdevcups.c:2838:15 + #18 0x55af41f409e0 in gs_output_page /src/ghostpdl/./base/gsdevice.c:207:17 + #19 0x55af4235b2f7 in zoutputpage /src/ghostpdl/./psi/zdevice.c:492:12 + #20 0x55af422b6ed2 in interp /src/ghostpdl/./psi/interp.c:1351:28 + #21 0x55af422b46c6 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #22 0x55af422b402e in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #23 0x55af41c8f05d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #24 0x55af41c8ec2a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #25 0x55af4250f36f in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #26 0x55af4250c6e7 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #27 0x55af4250a5f2 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #28 0x55af4250f144 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #29 0x55af41c879d8 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:97:8 + #30 0x55af41c8782b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #31 0x55af41b2515d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #32 0x55af41b0fed2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #33 0x55af41b15da0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #34 0x55af41b418d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7f24d9671082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #36 0x55af41b08fbd in _start (/out/gstoraster_fuzzer+0x51bfbd) + +==12147==Register values: +rax = 0x0000000080000000 rbx = 0x00007dc4d89f8600 rcx = 0x00007dc4d89f85e8 rdx = 0x000055af4293af80 +rdi = 0x0000000400000004 rsi = 0x00007dc4d89f8558 rbp = 0x00007ffec9bc1e10 rsp = 0x00007ffec9bc1dc0 + r8 = 0x000055af444bd600 r9 = 0x000000000000003f r10 = 0x00000f649aefc2b2 r11 = 0x0000000000000000 +r12 = 0x0000000000000001 r13 = 0x00000fb89b13f0bd r14 = 0x0000000b000005dc r15 = 0x00007dc4d89f8558 +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gdevp14.c:1174:45 in pdf14_buf_free +==12147==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-278.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-278.txt new file mode 100644 index 000000000..20d5632a2 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-278.txt @@ -0,0 +1,60 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1596191065 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7fa7d72bc9e0, 0x7fa7d72bff6c), 959 [0x7fa7d731da40, 0x7fa7d731ddff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7fa7d72bff70,0x7fa7d72f5830), 959 [0x7fa7d731de00,0x7fa7d73219f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-278 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x629ff036cd50 (pc 0x00000071935e bp 0x7ffc4f74bb70 sp 0x7ffc4f74ba80 T0) +==1==The signal is caused by a READ memory access. + #0 0x71935e in s_RLE_process /src/ghostpdl/./base/srle.c:150:22 + #1 0x118f6e0 in go_process /src/ghostpdl/./base/gxclbits.c:76:18 + #2 0x118f6e0 in cmd_compress_bitmap /src/ghostpdl/./base/gxclbits.c:107:22 + #3 0x118f6e0 in cmd_put_bits /src/ghostpdl/./base/gxclbits.c:229:22 + #4 0x69ed1b in clist_copy_mono /src/ghostpdl/./base/gxclrect.c:857:16 + #5 0x1027862 in mask_clip_fill_rectangle /src/ghostpdl/./base/gxclipm.c:165:12 + #6 0xad4bec in gx_dc_pure_fill_rectangle /src/ghostpdl/./base/gxdcolor.c:842:16 + #7 0x59e178 in image_render_color_DeviceN /src/ghostpdl/./base/gxicolor.c + #8 0x1370483 in gx_image1_plane_data /src/ghostpdl/./base/gxidata.c:238:20 + #9 0xb2a101 in gx_image_plane_data_rows /src/ghostpdl/./base/gximage.c:171:12 + #10 0x573e95 in gx_image3_plane_data /src/ghostpdl/./base/gximage3.c:672:16 + #11 0xb2a101 in gx_image_plane_data_rows /src/ghostpdl/./base/gximage.c:171:12 + #12 0x8da428 in gs_image_next_planes /src/ghostpdl/./base/gsimage.c:636:20 + #13 0xf2bab4 in pdfi_render_image /src/ghostpdl/./pdf/pdf_image.c:797:16 + #14 0xf21ca8 in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:1992:12 + #15 0xf24bce in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2454:16 + #16 0xf254cf in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2540:12 + #17 0xeda7f8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1457:24 + #18 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #19 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #20 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #21 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #22 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #23 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #24 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #25 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #26 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #27 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #28 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #29 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #30 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #31 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #32 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #33 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #34 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #35 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #36 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #37 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #38 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #39 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #40 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #41 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #42 0x7fa7d6cb9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #43 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: s_RLE_process--go_process--cmd_compress_bitmap +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/srle.c:150:22 in s_RLE_process +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-3.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-3.txt new file mode 100644 index 000000000..60f1874c1 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-3.txt @@ -0,0 +1,51 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1596578173 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f635b9279e0, 0x7f635b92af6c), 959 [0x7f635b988a40, 0x7f635b988dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f635b92af70,0x7f635b960830), 959 [0x7f635b988e00,0x7f635b98c9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-3 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x00013fff8001 (pc 0x000000ebc404 bp 0x7ffdc4611760 sp 0x7ffdc4611710 T0) +==1==The signal is caused by a READ memory access. + #0 0xebc404 in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:56:18 + #1 0xebc404 in pdfi_free_array /src/ghostpdl/./pdf/pdf_array.c:34:13 + #2 0x1003cb9 in pdfi_free_object /src/ghostpdl/./pdf/pdf_obj.c:257:13 + #3 0xeb091e in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:83:13 + #4 0xeb091e in pdfi_free_dict /src/ghostpdl/./pdf/pdf_dict.c:40:13 + #5 0x1003abb in pdfi_free_object /src/ghostpdl/./pdf/pdf_obj.c:260:13 + #6 0xf74a13 in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:83:13 + #7 0xf74a13 in pdfi_free_font_type1 /src/ghostpdl/./pdf/pdf_font1.c:783:5 + #8 0xf66fb5 in pdfi_free_font /src/ghostpdl/./pdf/pdf_font.c:1330:20 + #9 0x1003acf in pdfi_free_object /src/ghostpdl/./pdf/pdf_obj.c:272:13 + #10 0xea510e in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:83:13 + #11 0xea510e in pdfi_clear_context /src/ghostpdl/./pdf/ghostpdf.c:1920:13 + #12 0xeaea60 in pdfi_free_context /src/ghostpdl/./pdf/ghostpdf.c:1954:5 + #13 0xe97671 in zPDFclose /src/ghostpdl/./psi/zpdfops.c:603:16 + #14 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #15 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #16 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #17 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #18 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #19 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #20 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #21 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #22 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #23 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #24 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #25 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #26 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #27 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #28 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #29 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #30 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #31 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #32 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #33 0x7f635b324082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #34 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: pdfi_countdown_impl--pdfi_free_array--pdfi_free_object +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_stack.h:56:18 in pdfi_countdown_impl +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-301.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-301.txt new file mode 100755 index 000000000..6b621f933 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-301.txt @@ -0,0 +1,120 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1562930012 +INFO: Loaded 3 modules (157342 inline 8-bit counters): 11664 [0x7f791f3bcec0, 0x7f791f3bfc50), 878 [0x7f791f622798, 0x7f791f622b06), 144800 [0x55bb6493d340, 0x55bb649608e0), +INFO: Loaded 3 PC tables (157342 PCs): 11664 [0x7f791f3bfc50,0x7f791f3ed550), 878 [0x7f791f622b08,0x7f791f6261e8), 144800 [0x55bb649608e0,0x55bb64b962e0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-301 +================================================================= +==12147==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b7917e024d8 at pc 0x55bb624d1821 bp 0x7ffd1ecb0e30 sp 0x7ffd1ecb0e28 +READ of size 1 at 0x7b7917e024d8 thread T0 + #0 0x55bb624d1820 in template_compose_group /src/ghostpdl/./base/gxblend.c:2984:40 + #1 0x55bb624cf8e2 in compose_group_nonknockout_noblend_general /src/ghostpdl/./base/gxblend.c:3367:5 + #2 0x55bb624c42c0 in do_compose_group /src/ghostpdl/./base/gxblend.c:3595:5 + #3 0x55bb624c233e in pdf14_compose_group /src/ghostpdl/./base/gxblend.c:4391:9 + #4 0x55bb62503049 in pdf14_pop_transparency_group /src/ghostpdl/./base/gdevp14.c + #5 0x55bb62500524 in pdf14_tile_pattern_fill /src/ghostpdl/./base/gdevp14.c:5240:16 + #6 0x55bb624e863e in pdf14_fill_path /src/ghostpdl/./base/gdevp14.c:4158:20 + #7 0x55bb62953b8b in gx_fill_path /src/ghostpdl/./base/gxpaint.c:53:12 + #8 0x55bb627694cf in do_fill /src/ghostpdl/./base/gspaint.c:357:12 + #9 0x55bb627673e7 in fill_with_rule /src/ghostpdl/./base/gspaint.c:397:16 + #10 0x55bb62c16d52 in pdfi_fill_inner /src/ghostpdl/./pdf/pdf_path.c:138:20 + #11 0x55bb62c09c24 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c + #12 0x55bb62c08a01 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:1979:32 + #13 0x55bb62c081f9 in pdfi_interpret_inner_content /src/ghostpdl/./pdf/pdf_int.c:1788:12 + #14 0x55bb62c07a51 in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1725:12 + #15 0x55bb62c2b6e5 in pdfi_pattern_paint_stream /src/ghostpdl/./pdf/pdf_pattern.c:148:12 + #16 0x55bb62c2b593 in pdfi_pattern_paint /src/ghostpdl/./pdf/pdf_pattern.c:189:12 + #17 0x55bb62497a01 in gx_pattern_load /src/ghostpdl/./base/gxpcmap.c:1545:12 + #18 0x55bb62769049 in do_fill /src/ghostpdl/./base/gspaint.c:316:12 + #19 0x55bb627673e7 in fill_with_rule /src/ghostpdl/./base/gspaint.c:397:16 + #20 0x55bb62c16d52 in pdfi_fill_inner /src/ghostpdl/./pdf/pdf_path.c:138:20 + #21 0x55bb62c09c24 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c + #22 0x55bb62c08a01 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:1979:32 + #23 0x55bb62c4b18e in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #24 0x55bb62c4a4b4 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #25 0x55bb62c483f0 in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:844:12 + #26 0x55bb62bddf58 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:932:20 + #27 0x55bb62a9b348 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #28 0x55bb62a95956 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #29 0x55bb62a952be in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #30 0x55bb6246f05d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #31 0x55bb6246ec2a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #32 0x55bb62cf0cef in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #33 0x55bb62cee067 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #34 0x55bb62cebf72 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #35 0x55bb62cf0ac4 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #36 0x55bb624679d8 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:97:8 + #37 0x55bb6246782b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #38 0x55bb6230515d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #39 0x55bb622efed2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #40 0x55bb622f5da0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #41 0x55bb623218d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #42 0x7f791efe9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #43 0x55bb622e8fbd in _start (/out/gstoraster_fuzzer+0x51cfbd) + +0x7b7917e024d8 is located 0 bytes after 2473176-byte region [0x7b7917ba6800,0x7b7917e024d8) +allocated by thread T0 here: + #0 0x55bb62423ab4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55bb62753bf0 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x55bb62ee46fe in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2445:13 + #3 0x55bb62ee385a in alloc_obj /src/ghostpdl/./base/gsalloc.c:1910:13 + #4 0x55bb62ede319 in i_alloc_bytes /src/ghostpdl/./base/gsalloc.c:1162:15 + #5 0x55bb624f2d90 in pdf14_buf_new /src/ghostpdl/./base/gdevp14.c:1139:24 + #6 0x55bb62501333 in pdf14_push_transparency_group /src/ghostpdl/./base/gdevp14.c:1476:11 + #7 0x55bb624ffdab in pdf14_tile_pattern_fill /src/ghostpdl/./base/gdevp14.c:5144:16 + #8 0x55bb624e863e in pdf14_fill_path /src/ghostpdl/./base/gdevp14.c:4158:20 + #9 0x55bb62953b8b in gx_fill_path /src/ghostpdl/./base/gxpaint.c:53:12 + #10 0x55bb627694cf in do_fill /src/ghostpdl/./base/gspaint.c:357:12 + #11 0x55bb627673e7 in fill_with_rule /src/ghostpdl/./base/gspaint.c:397:16 + #12 0x55bb62c16d52 in pdfi_fill_inner /src/ghostpdl/./pdf/pdf_path.c:138:20 + #13 0x55bb62c09c24 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c + #14 0x55bb62c08a01 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:1979:32 + #15 0x55bb62c081f9 in pdfi_interpret_inner_content /src/ghostpdl/./pdf/pdf_int.c:1788:12 + #16 0x55bb62c07a51 in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1725:12 + #17 0x55bb62c2b6e5 in pdfi_pattern_paint_stream /src/ghostpdl/./pdf/pdf_pattern.c:148:12 + #18 0x55bb62c2b593 in pdfi_pattern_paint /src/ghostpdl/./pdf/pdf_pattern.c:189:12 + #19 0x55bb62497a01 in gx_pattern_load /src/ghostpdl/./base/gxpcmap.c:1545:12 + #20 0x55bb62769049 in do_fill /src/ghostpdl/./base/gspaint.c:316:12 + #21 0x55bb627673e7 in fill_with_rule /src/ghostpdl/./base/gspaint.c:397:16 + #22 0x55bb62c16d52 in pdfi_fill_inner /src/ghostpdl/./pdf/pdf_path.c:138:20 + #23 0x55bb62c09c24 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c + #24 0x55bb62c08a01 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:1979:32 + #25 0x55bb62c4b18e in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #26 0x55bb62c4a4b4 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #27 0x55bb62c483f0 in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:844:12 + #28 0x55bb62bddf58 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:932:20 + #29 0x55bb62a9b348 in interp /src/ghostpdl/./psi/interp.c:1725:40 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/gxblend.c:2984:40 in template_compose_group +Shadow bytes around the buggy address: + 0x7b7917e02200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b7917e02280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b7917e02300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b7917e02380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b7917e02400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7b7917e02480: 00 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa + 0x7b7917e02500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b7917e02580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b7917e02600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b7917e02680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b7917e02700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==12147==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-339.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-339.txt new file mode 100644 index 000000000..cc96a8f97 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-339.txt @@ -0,0 +1,133 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1597312976 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f1a6bed89e0, 0x7f1a6bedbf6c), 959 [0x7f1a6bf39a40, 0x7f1a6bf39dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f1a6bedbf70,0x7f1a6bf11830), 959 [0x7f1a6bf39e00,0x7f1a6bf3d9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-339 +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x62a00031bcb0 at pc 0x000000def2ac bp 0x7ffda6a43290 sp 0x7ffda6a43288 +READ of size 2 at 0x62a00031bcb0 thread T0 + #0 0xdef2ab in gc_trace /src/ghostpdl/./psi/igc.c:915:17 + #1 0xde9b6c in gs_gc_reclaim /src/ghostpdl/./psi/igc.c:338:21 + #2 0xd10d54 in gs_vmreclaim /src/ghostpdl/./psi/ireclaim.c:165:9 + #3 0xd10d54 in ireclaim /src/ghostpdl/./psi/ireclaim.c:80:12 + #4 0xcf9b56 in interp_reclaim /src/ghostpdl/./psi/interp.c:452:12 + #5 0x569710 in gs_main_finit /src/ghostpdl/./psi/imain.c:1281:20 + #6 0x56b1a3 in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #7 0x56b1a3 in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #8 0xce78f5 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #9 0x55f530 in gsapi_exit /src/ghostpdl/./psi/iapi.c:420:12 + #10 0x55e42d in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:102:8 + #11 0x55e42d in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #12 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #13 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #14 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #15 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #16 0x7f1a6b8d5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #17 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: gc_trace--gs_gc_reclaim--gs_vmreclaim +0x62a00031bcb0 is located 15024 bytes inside of 20048-byte region [0x62a000318200,0x62a00031d050) +freed by thread T0 here: + #0 0x524bc2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:111:3 + #1 0x8e727b in gs_heap_free_object /src/ghostpdl/./base/gsmalloc.c:366:5 + #2 0x12b0175 in alloc_free_clump /src/ghostpdl/./base/gsalloc.c:2639:9 + #3 0x12b0175 in free_all_not_allocator /src/ghostpdl/./base/gsalloc.c:993:9 + #4 0x12b0175 in clump_splay_app /src/ghostpdl/./base/gsalloc.c:606:19 + #5 0x12b0175 in i_free_all /src/ghostpdl/./base/gsalloc.c:1029:9 + #6 0xdfec35 in restore_free /src/ghostpdl/./psi/isave.c:991:5 + #7 0xdfec35 in restore_space /src/ghostpdl/./psi/isave.c:847:5 + #8 0xdfec35 in alloc_restore_step_in /src/ghostpdl/./psi/isave.c:784:9 + #9 0xd755d8 in dorestore /src/ghostpdl/./psi/zvmem.c:193:16 + #10 0xcde3d8 in z2restore /src/ghostpdl/./psi/zdevice2.c:373:12 + #11 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #12 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #13 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #14 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #15 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #16 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #17 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #18 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #19 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #20 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #21 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #22 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #23 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #24 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #25 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #26 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #27 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #28 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #29 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #30 0x7f1a6b8d5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: free--gs_heap_free_object--alloc_free_clump +previously allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6aa1 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x12b9c14 in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2488:13 + #3 0x12b8ac2 in alloc_add_clump /src/ghostpdl/./base/gsalloc.c:2438:19 + #4 0x12b8ac2 in alloc_obj /src/ghostpdl/./base/gsalloc.c:2046:17 + #5 0x12b1521 in i_alloc_struct /src/ghostpdl/./base/gsalloc.c:1234:15 + #6 0xdfb22a in alloc_save_space /src/ghostpdl/./psi/isave.c:440:12 + #7 0xdfa6e9 in alloc_save_state /src/ghostpdl/./psi/isave.c:338:27 + #8 0xd74c7a in zsave /src/ghostpdl/./psi/zvmem.c:75:12 + #9 0xcdd442 in z2save /src/ghostpdl/./psi/zdevice2.c:220:16 + #10 0xcfafcc in interp /src/ghostpdl/./psi/interp.c:1351:28 + #11 0xcfafcc in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #12 0xcfafcc in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #13 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #14 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #15 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #16 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #17 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #18 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #19 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #20 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #21 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #22 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #23 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #24 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #25 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #26 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #27 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #28 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #29 0x7f1a6b8d5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--alloc_acquire_clump +SUMMARY: AddressSanitizer: heap-use-after-free /src/ghostpdl/./psi/igc.c:915:17 in gc_trace +Shadow bytes around the buggy address: + 0x0c548005b740: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c548005b750: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c548005b760: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c548005b770: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c548005b780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0c548005b790: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd + 0x0c548005b7a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c548005b7b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c548005b7c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c548005b7d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c548005b7e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-351.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-351.txt new file mode 100644 index 000000000..9f82cc3f9 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-351.txt @@ -0,0 +1,39 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1613107124 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f1d8e7b39e0, 0x7f1d8e7b6f6c), 959 [0x7f1d8e814a40, 0x7f1d8e814dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f1d8e7b6f70,0x7f1d8e7ec830), 959 [0x7f1d8e814e00,0x7f1d8e8189f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-351 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x6330000008e9 (pc 0x000000d1ec1f bp 0x7ffeb3f26a90 sp 0x7ffeb3f26a40 T0) +==1==The signal is caused by a READ memory access. + #0 0xd1ec1f in ref_stack_counttomark /src/ghostpdl/./psi/istack.c:253:17 + #1 0xd6c1af in zcounttomark /src/ghostpdl/./psi/zstack.c:291:18 + #2 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #3 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #4 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #5 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #6 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #7 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #8 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #9 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #10 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #11 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #12 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #13 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #14 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #15 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #16 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #17 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #18 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #19 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #20 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #21 0x7f1d8e1b0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #22 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: ref_stack_counttomark--zcounttomark--interp +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./psi/istack.c:253:17 in ref_stack_counttomark +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-390.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-390.txt new file mode 100644 index 000000000..81630e73c --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-390.txt @@ -0,0 +1,125 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1613435909 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f033d4a79e0, 0x7f033d4aaf6c), 959 [0x7f033d508a40, 0x7f033d508dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f033d4aaf70,0x7f033d4e0830), 959 [0x7f033d508e00,0x7f033d50c9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-390 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62d00003a7d0 at pc 0x000000cd5300 bp 0x7ffca703fbb0 sp 0x7ffca703fba8 +READ of size 1 at 0x62d00003a7d0 thread T0 + #0 0xcd52ff in s_PFBD_process /src/ghostpdl/./base/sfilter1.c:105:25 + #1 0x6bdfe7 in sreadbuf /src/ghostpdl/./base/stream.c:842:22 + #2 0x6bc9ac in s_process_read_buf /src/ghostpdl/./base/stream.c:768:14 + #3 0x6bc9ac in spgetcc /src/ghostpdl/./base/stream.c:481:9 + #4 0xf70654 in pdfi_t1_decode_pfb /src/ghostpdl/./pdf/pdf_font1.c:377:17 + #5 0xf70654 in pdfi_read_type1_font /src/ghostpdl/./pdf/pdf_font1.c:518:16 + #6 0xf5cceb in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:727:32 + #7 0xf62074 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #8 0xf666f5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #9 0xf666f5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #10 0xeda923 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1624:24 + #11 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #12 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #13 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #14 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #15 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #16 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #24 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #25 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #26 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #27 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #30 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7f033cea4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: s_PFBD_process--sreadbuf--s_process_read_buf +0x62d00003a7d0 is located 0 bytes to the right of 33744-byte region [0x62d000032400,0x62d00003a7d0) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6aa1 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f520f in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f3018 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f520f in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #5 0x6f47e8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0xee548a in pdfi_stream_to_buffer /src/ghostpdl/./pdf/pdf_file.c:1541:14 + #7 0xf5c6b6 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:699:20 + #8 0xf62074 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #9 0xf666f5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #10 0xf666f5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #11 0xeda923 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1624:24 + #12 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #13 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #14 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #15 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #16 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #17 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #18 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #19 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #20 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #21 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #22 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #23 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #24 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #25 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #26 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #27 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #28 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #29 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #30 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #31 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #32 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #33 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #34 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #35 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #36 0x7f033cea4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--chunk_obj_alloc +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/sfilter1.c:105:25 in s_PFBD_process +Shadow bytes around the buggy address: + 0x0c5a7ffff4a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c5a7ffff4b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c5a7ffff4c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c5a7ffff4d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c5a7ffff4e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c5a7ffff4f0: 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa + 0x0c5a7ffff500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5a7ffff510: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5a7ffff520: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5a7ffff530: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5a7ffff540: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-415.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-415.txt new file mode 100644 index 000000000..cd34466f4 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-415.txt @@ -0,0 +1,43 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1613804208 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7fd5c04449e0, 0x7fd5c0447f6c), 959 [0x7fd5c04a5a40, 0x7fd5c04a5dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7fd5c0447f70,0x7fd5c047d830), 959 [0x7fd5c04a5e00,0x7fd5c04a99f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-415 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x00009fff8006 (pc 0x000001003b7f bp 0x7ffd8283b880 sp 0x7ffd8283b850 T0) +==1==The signal is caused by a READ memory access. + #0 0x1003b7f in pdfi_free_xref_table /src/ghostpdl/./pdf/pdf_obj.c:227:5 + #1 0x1003b7f in pdfi_free_object /src/ghostpdl/./pdf/pdf_obj.c:269:13 + #2 0xea486e in pdfi_countdown_impl /src/ghostpdl/./pdf/pdf_stack.h:83:13 + #3 0xea486e in pdfi_clear_context /src/ghostpdl/./pdf/ghostpdf.c:1823:9 + #4 0xeaea60 in pdfi_free_context /src/ghostpdl/./pdf/ghostpdf.c:1954:5 + #5 0xe97671 in zPDFclose /src/ghostpdl/./psi/zpdfops.c:603:16 + #6 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #10 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #12 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #13 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #14 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #15 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #16 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #17 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #19 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #20 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #21 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #22 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #23 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #24 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7fd5bfe41082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #26 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: pdfi_free_xref_table--pdfi_free_object--pdfi_countdown_impl +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_obj.c:227:5 in pdfi_free_xref_table +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-417.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-417.txt new file mode 100644 index 000000000..9a4dc1e31 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-417.txt @@ -0,0 +1,111 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1614192587 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7fde00fab9e0, 0x7fde00faef6c), 959 [0x7fde0100ca40, 0x7fde0100cdff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7fde00faef70,0x7fde00fe4830), 959 [0x7fde0100ce00,0x7fde010109f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-417 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fddfbe56490 at pc 0x000000ec619a bp 0x7ffecd524030 sp 0x7ffecd524028 +READ of size 8 at 0x7fddfbe56490 thread T0 + #0 0xec6199 in read_xref_section /src/ghostpdl/./pdf/pdf_xref.c:762:20 + #1 0xec6199 in read_xref /src/ghostpdl/./pdf/pdf_xref.c:800:16 + #2 0xec3411 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1032:20 + #3 0xeaa746 in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1048:12 + #4 0xeaa746 in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1315:12 + #5 0xe97094 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:521:12 + #6 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #10 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #12 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #13 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #14 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #15 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #16 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #17 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #19 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #20 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #21 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #22 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #23 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #24 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7fde009a8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #26 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: read_xref_section--read_xref--pdfi_read_xref +0x7fddfbe56490 is located 880 bytes to the left of 1309872-byte region [0x7fddfbe56800,0x7fddfbf964b0) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6aa1 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6f520f in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #3 0x6f3018 in chunk_alloc_bytes_immovable /src/ghostpdl/./base/gsmchunk.c:976:12 + #4 0x6f520f in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:791:35 + #5 0x6f47e8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #6 0xec7227 in resize_xref /src/ghostpdl/./pdf/pdf_xref.c:39:31 + #7 0xec4761 in read_xref_section /src/ghostpdl/./pdf/pdf_xref.c:730:24 + #8 0xec4761 in read_xref /src/ghostpdl/./pdf/pdf_xref.c:800:16 + #9 0xec3411 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1032:20 + #10 0xeaa746 in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1048:12 + #11 0xeaa746 in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1315:12 + #12 0xe97094 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:521:12 + #13 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #14 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #15 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #16 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #17 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #18 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #19 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #20 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #21 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #22 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #23 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #24 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #25 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #26 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #27 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #28 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #29 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #30 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #31 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #32 0x7fde009a8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--chunk_obj_alloc +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./pdf/pdf_xref.c:762:20 in read_xref_section +Shadow bytes around the buggy address: + 0x0ffc3f7c2c40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffc3f7c2c50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffc3f7c2c60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffc3f7c2c70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffc3f7c2c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0ffc3f7c2c90: fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffc3f7c2ca0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffc3f7c2cb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffc3f7c2cc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffc3f7c2cd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffc3f7c2ce0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-422.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-422.txt new file mode 100755 index 000000000..06969c185 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-422.txt @@ -0,0 +1,38 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1279904894 +INFO: Loaded 3 modules (158084 inline 8-bit counters): 11664 [0x7fd2b59bcec0, 0x7fd2b59bfc50), 878 [0x7fd2b5bf9798, 0x7fd2b5bf9b06), 145542 [0x560496c55ad0, 0x560496c79356), +INFO: Loaded 3 PC tables (158084 PCs): 11664 [0x7fd2b59bfc50,0x7fd2b59ed550), 878 [0x7fd2b5bf9b08,0x7fd2b5bfd1e8), 145542 [0x560496c79358,0x560496eb1bb8), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-422 +gsapi_init_with_args: error -100 +gsapi_init_with_args: error -100 +gsapi_init_with_args: error -100 +gsapi_init_with_args: error -100 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==11996==ERROR: AddressSanitizer: SEGV on unknown address 0x7e72b22e8050 (pc 0x7fd2b557aaf3 bp 0x7fff8d2415c0 sp 0x7fff8d240d78 T0) +==11996==The signal is caused by a WRITE memory access. + #0 0x7fd2b557aaf3 in memcpy (/lib/x86_64-linux-gnu/libc.so.6+0xbbaf3) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #1 0x56049472e4db in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #2 0x560494e7983e in restore_space /src/ghostpdl/./psi/isave.c:838:17 + #3 0x560494e79004 in alloc_restore_step_in /src/ghostpdl/./psi/isave.c:784:9 + #4 0x560494e79c9b in alloc_restore_all /src/ghostpdl/./psi/isave.c:888:16 + #5 0x56049477da88 in gs_main_finit /src/ghostpdl/./psi/imain.c:1391:20 + #6 0x560494d9b67f in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #7 0x560494774a17 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:102:8 + #8 0x56049477482b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #9 0x56049461215d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #10 0x5604945fced2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #11 0x560494602da0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #12 0x56049462e8d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fd2b54e3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #14 0x5604945f5fbd in _start (/out/gstoraster_fuzzer+0x522fbd) + +==11996==Register values: +rax = 0x00007e72b22e8050 rbx = 0x0000000000000000 rcx = 0x00000fced645500b rdx = 0x0000000000000010 +rdi = 0x00007e72b22e8050 rsi = 0x00007e72b5467f50 rbp = 0x00007fff8d2415c0 rsp = 0x00007fff8d240d78 + r8 = 0x00000fce5645d00a r9 = 0x00007e72b22e805f r10 = 0x00000fce5645d00b r11 = 0x00000fced6455008 +r12 = 0x00000fced6455008 r13 = 0xffffffffffffffcf r14 = 0x00007d82b47e69d8 r15 = 0x00007e72b5464258 +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0xbbaf3) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) in memcpy +==11996==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-429.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-429.txt new file mode 100755 index 000000000..ea4b46e66 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-429.txt @@ -0,0 +1,114 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4042736539 +INFO: Loaded 3 modules (185827 inline 8-bit counters): 13708 [0x7f13804769e0, 0x7f1380479f6c), 959 [0x7f1380526a40, 0x7f1380526dff), 171160 [0x315bbc0, 0x3185858), +INFO: Loaded 3 PC tables (185827 PCs): 13708 [0x7f1380479f70,0x7f13804af830), 959 [0x7f1380526e00,0x7f138052a9f0), 171160 [0x24ee3d0,0x278ad50), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-429 +================================================================= +==10880==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000060830 at pc 0x0000004be93e bp 0x7ffe49c80070 sp 0x7ffe49c7f830 +READ of size 386776 at 0x631000060830 thread T0 + #0 0x4be93d in __interceptor_memcpy /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 + #1 0xec964d in pdfi_dict_find_key /src/ghostpdl/./pdf/pdf_dict.c:300:5 + #2 0xec964d in pdfi_dict_get_no_store_R_inner /src/ghostpdl/./pdf/pdf_dict.c:453:17 + #3 0xec9918 in pdfi_dict_get_no_store_R_key /src/ghostpdl/./pdf/pdf_dict.c:482:12 + #4 0x1033e2a in pdfi_find_resource /src/ghostpdl/./pdf/pdf_doc.c + #5 0xf3dfb7 in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2593:12 + #6 0xeedb1d in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1433:24 + #7 0xeebf36 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2061:24 + #8 0xeea01f in pdfi_interpret_inner_content /src/ghostpdl/./pdf/pdf_int.c:1854:12 + #9 0xeea01f in pdfi_interpret_inner_content_stream /src/ghostpdl/./pdf/pdf_int.c:1953:12 + #10 0xeea01f in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1791:12 + #11 0xf3bd01 in pdfi_form_execgroup /src/ghostpdl/./pdf/pdf_image.c:2198:12 + #12 0xf3d238 in pdfi_do_form /src/ghostpdl/./pdf/pdf_image.c:2455:16 + #13 0xf3d8e0 in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2553:16 + #14 0xf3e2f2 in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2632:12 + #15 0xeedb1d in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1433:24 + #16 0xeebf36 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2061:24 + #17 0xf4cd2c in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #18 0xf4cd2c in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #19 0xf4cd2c in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #20 0xeab2fa in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1074:24 + #21 0xd0f1cb in interp /src/ghostpdl/./psi/interp.c:1725:40 + #22 0xd0f1cb in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #23 0xd0f1cb in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #24 0x567c8a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #25 0x567c8a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #26 0x567c8a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #27 0x563132 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #28 0x1042011 in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #29 0x103e019 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #30 0x103aefe in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #31 0x1041d99 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #32 0xcf7824 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #33 0x55f58c in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #34 0x55e671 in gs_to_raster_fuzz(unsigned char const*, unsigned long, int) /src/gstoraster_fuzzlib.h:103:8 + #35 0x55ea45 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:23:2 + #36 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #37 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #38 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #39 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #40 0x7f137febe082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #41 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +0x631000060830 is located 0 bytes to the right of 65584-byte region [0x631000050800,0x631000060830) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8efd81 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x6fab4d in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:928:36 + #3 0x6f9a98 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:999:12 + #4 0xec389b in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1702:27 + #5 0xeab815 in zPDFInit /src/ghostpdl/./psi/zpdfops.c:1160:11 + #6 0xd0f1cb in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0xd0f1cb in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0xd0f1cb in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x567c8a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #10 0x567c8a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x567c8a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #12 0x563132 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #13 0x1042011 in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #14 0x103e019 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #15 0x103aefe in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #16 0x1041d99 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #17 0xcf7824 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x55f58c in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #19 0x55e671 in gs_to_raster_fuzz(unsigned char const*, unsigned long, int) /src/gstoraster_fuzzlib.h:103:8 + #20 0x55ea45 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:23:2 + #21 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #22 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #23 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #24 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7f137febe082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:827:5 in __interceptor_memcpy +Shadow bytes around the buggy address: + 0x0c62800040b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800040c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800040d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800040e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c62800040f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c6280004100: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa + 0x0c6280004110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280004120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280004130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280004140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c6280004150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==10880==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-449.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-449.txt new file mode 100755 index 000000000..521963518 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-449.txt @@ -0,0 +1,34 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4164866247 +INFO: Loaded 3 modules (202225 inline 8-bit counters): 13708 [0x7f323c2769e0, 0x7f323c279f6c), 959 [0x7f323c3aea40, 0x7f323c3aedff), 187558 [0x343c950, 0x346a5f6), +INFO: Loaded 3 PC tables (202225 PCs): 13708 [0x7f323c279f70,0x7f323c2af830), 959 [0x7f323c3aee00,0x7f323c3b29f0), 187558 [0x272e3d0,0x2a0ae30), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-449 +gsapi_init_with_args: error -100 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==11030==ERROR: AddressSanitizer: SEGV on unknown address 0x629ffe9ee510 (pc 0x7f323bd7aaf3 bp 0x7ffef80eb510 sp 0x7ffef80eacc8 T0) +==11030==The signal is caused by a WRITE memory access. + #0 0x7f323bd7aaf3 in memcpy (/lib/x86_64-linux-gnu/libc.so.6+0xbbaf3) + #1 0x5240f8 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #2 0xf5c85e in restore_space /src/ghostpdl/./psi/isave.c:838:17 + #3 0xf5c85e in alloc_restore_step_in /src/ghostpdl/./psi/isave.c:784:9 + #4 0xf5db7c in alloc_restore_all /src/ghostpdl/./psi/isave.c:888:16 + #5 0x56ab5d in gs_main_finit /src/ghostpdl/./psi/imain.c:1391:20 + #6 0x56b6a3 in gs_to_exit_with_code /src/ghostpdl/./psi/imain.c:1434:12 + #7 0x56b6a3 in gs_to_exit /src/ghostpdl/./psi/imain.c:1439:12 + #8 0xe47625 in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #9 0x55fa1c in gsapi_exit /src/ghostpdl/./psi/iapi.c:440:12 + #10 0x55e761 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*) /src/gs_fuzzlib.h:132:8 + #11 0x55eb0a in gs_to_raster_fuzz /src/gs_fuzzlib.h:64:9 + #12 0x55eb0a in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:23:2 + #13 0x456553 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #14 0x4421e2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #15 0x447a2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #16 0x470622 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #17 0x7f323bce3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #18 0x420a0d in _start (/out/gstoraster_fuzzer+0x420a0d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0xbbaf3) in memcpy +==11030==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-453.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-453.txt new file mode 100644 index 000000000..fa146bc30 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-453.txt @@ -0,0 +1,44 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1989464456 +INFO: Loaded 3 modules (202208 inline 8-bit counters): 13708 [0x7fccad0f39e0, 0x7fccad0f6f6c), 959 [0x7fccad154a40, 0x7fccad154dff), 187541 [0x343c950, 0x346a5e5), +INFO: Loaded 3 PC tables (202208 PCs): 13708 [0x7fccad0f6f70,0x7fccad12c830), 959 [0x7fccad154e00,0x7fccad1589f0), 187541 [0x272e3d0,0x2a0ad20), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-453 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x000000a19568 bp 0x7ffd211bced0 sp 0x7ffd211bcea0 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0xa19568 in gs_closedevice /src/ghostpdl/./base/gsdevice.c:786:16 + #1 0xa19568 in gx_device_finalize /src/ghostpdl/./base/gsdevice.c:56:5 + #2 0xf5c145 in restore_finalize /src/ghostpdl/./psi/isave.c:954:13 + #3 0xf5c145 in alloc_restore_step_in /src/ghostpdl/./psi/isave.c:759:9 + #4 0xed2958 in dorestore /src/ghostpdl/./psi/zvmem.c:193:16 + #5 0xe3de18 in z2restore /src/ghostpdl/./psi/zdevice2.c:373:12 + #6 0xe5de9b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0xe5de9b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0xe5de9b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x567d4a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #10 0x567d4a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x567d4a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #12 0x5631f2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #13 0x118e1f1 in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #14 0x118a1f9 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #15 0x11870de in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #16 0x118df79 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #17 0xe464f4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x55f64c in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:253:12 + #19 0x55e704 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*) /src/gs_fuzzlib.h:127:8 + #20 0x55eb0a in gs_to_raster_fuzz /src/gs_fuzzlib.h:64:9 + #21 0x55eb0a in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:23:2 + #22 0x456553 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #23 0x4421e2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #24 0x447a2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #25 0x470622 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #26 0x7fccacaf0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #27 0x420a0d in _start (/out/gstoraster_fuzzer+0x420a0d) + +DEDUP_TOKEN: gs_closedevice--gx_device_finalize--restore_finalize +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gsdevice.c:786:16 in gs_closedevice +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-456.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-456.txt new file mode 100755 index 000000000..a232d7990 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-456.txt @@ -0,0 +1,53 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 838173245 +INFO: Loaded 3 modules (172185 inline 8-bit counters): 11664 [0x7fc7d89bcec0, 0x7fc7d89bfc50), 878 [0x7fc7d8aa3798, 0x7fc7d8aa3b06), 159643 [0x55bec52d5be0, 0x55bec52fcb7b), +INFO: Loaded 3 PC tables (172185 PCs): 11664 [0x7fc7d89bfc50,0x7fc7d89ed550), 878 [0x7fc7d8aa3b08,0x7fc7d8aa71e8), 159643 [0x55bec52fcb80,0x55bec556c530), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-456 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==12262==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000000000 bp 0x7ffdcaef18d0 sp 0x7ffdcaef1858 T0) +==12262==Hint: pc points to the zero page. +==12262==The signal is caused by a READ memory access. +==12262==Hint: address points to the zero page. + #0 0x000000000000 () + #1 0x55bec306f37c in load_glyph /src/ghostpdl/./base/fapi_ft.c:685:20 + #2 0x55bec306b510 in gs_fapi_ft_get_char_raster_metrics /src/ghostpdl/./base/fapi_ft.c:1572:9 + #3 0x55bec3062460 in gs_fapi_do_char /src/ghostpdl/./base/gxfapi.c:1570:16 + #4 0x55bec386277c in pdfi_fapi_build_char /src/ghostpdl/./pdf/pdf_fapi.c:1398:16 + #5 0x55bec3163c4b in show_proceed /src/ghostpdl/./base/gxchar.c:1229:12 + #6 0x55bec35659c7 in pdfi_show_simple /src/ghostpdl/./pdf/pdf_text.c:445:16 + #7 0x55bec35641cb in pdfi_show_Tr_0 /src/ghostpdl/./pdf/pdf_text.c:460:12 + #8 0x55bec355f4d4 in pdfi_show /src/ghostpdl/./pdf/pdf_text.c:842:24 + #9 0x55bec3560c6e in pdfi_TJ /src/ghostpdl/./pdf/pdf_text.c:1188:20 + #10 0x55bec34b90c1 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1628:24 + #11 0x55bec34b8080 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2081:24 + #12 0x55bec34facb9 in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #13 0x55bec34fa074 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #14 0x55bec34f7fb5 in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #15 0x55bec348a8da in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1092:24 + #16 0x55bec334c8a8 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0x55bec3346eb6 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0x55bec334681e in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x55bec2c0a29d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #20 0x55bec2c09e6a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #21 0x55bec35a152f in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #22 0x55bec359e8a7 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #23 0x55bec359c7b2 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #24 0x55bec35a1304 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #25 0x55bec2c02b76 in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*) /src/gs_fuzzlib.h:127:8 + #26 0x55bec2c02ec0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:23:2 + #27 0x55bec2aa016d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #28 0x55bec2a8aee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #29 0x55bec2a90db0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #30 0x55bec2abc8e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #31 0x7fc7d846b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +==12262==Register values: +rax = 0x0000000000000060 rbx = 0x00007ed7d77e3e58 rcx = 0x00007ed7d77e3e78 rdx = 0x00007ed7d77e3e58 +rdi = 0x00007ed7d77e18d8 rsi = 0x00007ed7d77e4078 rbp = 0x00007ffdcaef18d0 rsp = 0x00007ffdcaef1858 + r8 = 0x0000000000000001 r9 = 0x00007fffffffff01 r10 = 0x00007fffffffff01 r11 = 0x0000000000000001 +r12 = 0x00007ed7d77e4078 r13 = 0x00007ed7d77e3e78 r14 = 0x00007ed7d77e18d8 r15 = 0x0000000000000000 +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV () +==12262==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-47.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-47.txt new file mode 100644 index 000000000..e4aabbc8e --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-47.txt @@ -0,0 +1,122 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1617711688 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f5d42dff9e0, 0x7f5d42e02f6c), 959 [0x7f5d42e60a40, 0x7f5d42e60dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f5d42e02f70,0x7f5d42e38830), 959 [0x7f5d42e60e00,0x7f5d42e649f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-47 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62a00010712c at pc 0x000000bf8d83 bp 0x7ffe68f73250 sp 0x7ffe68f73248 +READ of size 2 at 0x62a00010712c thread T0 + #0 0xbf8d82 in mem_mono_copy_mono /src/ghostpdl/./base/gdevm1.c:683:17 + #1 0xbfc696 in mem_mapped4_copy_color /src/ghostpdl/./base/gdevm4.c:229:12 + #2 0x10b842a in tile_clip_copy_color /src/ghostpdl/./base/gxclip2.c:301:24 + #3 0x587092 in tile_colored_fill /src/ghostpdl/./base/gxp1fill.c:269:20 + #4 0x586293 in tile_by_steps /src/ghostpdl/./base/gxp1fill.c:237:24 + #5 0x584804 in gx_dc_pattern_fill_rectangle /src/ghostpdl/./base/gxp1fill.c:395:20 + #6 0xad970d in gx_dc_default_fill_masked /src/ghostpdl/./base/gxdcolor.c:1109:20 + #7 0xbb1fc4 in gx_default_fill_mask /src/ghostpdl/./base/gdevdbit.c:584:16 + #8 0xb49e8e in gx_image_fill_masked /src/ghostpdl/./base/gximask.c:115:16 + #9 0x119c891 in clist_playback_band /src/ghostpdl/./base/gxclrast.c:2306:28 + #10 0x68ea7c in clist_playback_file_bands /src/ghostpdl/./base/gxclread.c:1035:16 + #11 0x6930d0 in clist_render_rectangle /src/ghostpdl/./base/gxclread.c:969:16 + #12 0x6924aa in clist_rasterize_lines /src/ghostpdl/./base/gxclread.c:858:20 + #13 0x69166f in clist_get_bits_rectangle /src/ghostpdl/./base/gxclread.c:747:12 + #14 0x665c4a in gdev_prn_get_bits /src/ghostpdl/./base/gdevprn.c:1636:12 + #15 0x7ecc54 in cups_print_chunked /src/ghostpdl/./cups/gdevcups.c:4849:9 + #16 0x7db53b in cups_print_pages /src/ghostpdl/./cups/gdevcups.c + #17 0x661ad9 in gdev_prn_output_page_aux /src/ghostpdl/./base/gdevprn.c:1049:27 + #18 0x660d95 in gdev_prn_output_page /src/ghostpdl/./base/gdevprn.c:1085:12 + #19 0x7ec409 in cups_output_page /src/ghostpdl/./cups/gdevcups.c:2826:15 + #20 0x8a726f in gs_output_page /src/ghostpdl/./base/gsdevice.c:207:17 + #21 0xdcc102 in zoutputpage /src/ghostpdl/./psi/zdevice.c:416:12 + #22 0xcfafcc in interp /src/ghostpdl/./psi/interp.c:1351:28 + #23 0xcfafcc in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #24 0xcfafcc in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #25 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #26 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #27 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #28 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #29 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #30 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #31 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #32 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #33 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #34 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #35 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #36 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #37 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #38 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #39 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #40 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #41 0x7f5d427fc082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #42 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: mem_mono_copy_mono--mem_mapped4_copy_color--tile_clip_copy_color +0x62a00010712c is located 220 bytes to the right of 20048-byte region [0x62a000102200,0x62a000107050) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6aa1 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x12b9c14 in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2488:13 + #3 0x12b8ac2 in alloc_add_clump /src/ghostpdl/./base/gsalloc.c:2438:19 + #4 0x12b8ac2 in alloc_obj /src/ghostpdl/./base/gsalloc.c:2046:17 + #5 0x12b1d91 in i_alloc_struct_array /src/ghostpdl/./base/gsalloc.c:1365:11 + #6 0xde7072 in gs_alloc_ref_array /src/ghostpdl/./psi/ialloc.c:226:15 + #7 0xd67db0 in make_packed_array /src/ghostpdl/./psi/zpacked.c:157:12 + #8 0xd19e15 in gs_scan_token /src/ghostpdl/./psi/iscan.c:715:31 + #9 0xcfca75 in interp /src/ghostpdl/./psi/interp.c:1502:24 + #10 0xcfca75 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #11 0xcfca75 in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #12 0x56299f in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #13 0x56299f in gs_run_init_file /src/ghostpdl/./psi/imain.c:861:12 + #14 0x56299f in gs_main_init2aux /src/ghostpdl/./psi/imain.c:305:16 + #15 0x56425b in gs_main_init2 /src/ghostpdl/./psi/imain.c:491:12 + #16 0x10188ff in swproc /src/ghostpdl/./psi/imainarg.c:363:20 + #17 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #18 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #19 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #20 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #21 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #22 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #23 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #24 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #25 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #26 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #27 0x7f5d427fc082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--alloc_acquire_clump +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/gdevm1.c:683:17 in mem_mono_copy_mono +Shadow bytes around the buggy address: + 0x0c5480018dd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c5480018de0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c5480018df0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c5480018e00: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa + 0x0c5480018e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c5480018e20: fa fa fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa + 0x0c5480018e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5480018e40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5480018e50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5480018e60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5480018e70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-496.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-496.txt new file mode 100644 index 000000000..6013eb06e --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-496.txt @@ -0,0 +1,43 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1618081532 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7fd5fc8739e0, 0x7fd5fc876f6c), 959 [0x7fd5fc8d4a40, 0x7fd5fc8d4dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7fd5fc876f70,0x7fd5fc8ac830), 959 [0x7fd5fc8d4e00,0x7fd5fc8d89f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-496 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x6310000f0b98 (pc 0x000001001635 bp 0x7ffce61149b0 sp 0x7ffce6114860 T0) +==1==The signal is caused by a WRITE memory access. + #0 0x1001635 in pdfi_repair_file /src/ghostpdl/./pdf/pdf_repair.c:439:103 + #1 0xec6f3b in pdfi_read_xref_stream_dict /src/ghostpdl/./pdf/pdf_stack.h + #2 0xec3513 in pdfi_read_xref /src/ghostpdl/./pdf/pdf_xref.c:1038:20 + #3 0xeaa746 in pdfi_init_file /src/ghostpdl/./pdf/ghostpdf.c:1048:12 + #4 0xeaa746 in pdfi_set_input_stream /src/ghostpdl/./pdf/ghostpdf.c:1315:12 + #5 0xe97094 in zPDFstream /src/ghostpdl/./psi/zpdfops.c:521:12 + #6 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #7 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #8 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #9 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #10 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #12 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #13 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #14 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #15 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #16 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #17 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #18 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #19 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #20 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #21 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #22 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #23 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #24 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7fd5fc270082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #26 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: pdfi_repair_file--pdfi_read_xref_stream_dict--pdfi_read_xref +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_repair.c:439:103 in pdfi_repair_file +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-53.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-53.txt new file mode 100755 index 000000000..365d2b58d --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-53.txt @@ -0,0 +1,104 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3191623042 +INFO: Loaded 3 modules (156986 inline 8-bit counters): 11664 [0x7f2c9dbbcec0, 0x7f2c9dbbfc50), 878 [0x7f2c9dd09798, 0x7f2c9dd09b06), 144444 [0x55a7e0441aa0, 0x55a7e0464edc), +INFO: Loaded 3 PC tables (156986 PCs): 11664 [0x7f2c9dbbfc50,0x7f2c9dbed550), 878 [0x7f2c9dd09b08,0x7f2c9dd0d1e8), 144444 [0x55a7e0464ee0,0x55a7e06992a0), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-53 +================================================================= +==12147==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f2c9ce71030 at pc 0x55a7de85bdb5 bp 0x7ffe2569ef40 sp 0x7ffe2569ef38 +WRITE of size 4 at 0x7f2c9ce71030 thread T0 + #0 0x55a7de85bdb4 in mem_true24_fill_rectangle /src/ghostpdl/./base/gdevm24.c:281:21 + #1 0x55a7de779aba in gx_dc_pure_fill_rectangle /src/ghostpdl/./base/gxdcolor.c:842:16 + #2 0x55a7de8253e5 in gx_default_fillpage /src/ghostpdl/./base/gdevddrw.c:1004:16 + #3 0x55a7dec8b4bf in clist_playback_band /src/ghostpdl/./base/gxclrast.c + #4 0x55a7de3fcfee in clist_playback_file_bands /src/ghostpdl/./base/gxclread.c:1035:16 + #5 0x55a7de400a32 in clist_render_rectangle /src/ghostpdl/./base/gxclread.c:969:16 + #6 0x55a7de3fff95 in clist_rasterize_lines /src/ghostpdl/./base/gxclread.c:858:20 + #7 0x55a7de3ff3f1 in clist_get_bits_rectangle /src/ghostpdl/./base/gxclread.c:747:12 + #8 0x55a7de3da2ec in gdev_prn_get_bits /src/ghostpdl/./base/gdevprn.c:1636:12 + #9 0x55a7de5144c8 in cups_print_chunked /src/ghostpdl/./cups/gdevcups.c:4849:9 + #10 0x55a7de50b447 in cups_print_pages /src/ghostpdl/./cups/gdevcups.c + #11 0x55a7de3d6d87 in gdev_prn_output_page_aux /src/ghostpdl/./base/gdevprn.c:1049:27 + #12 0x55a7de513c54 in cups_output_page /src/ghostpdl/./cups/gdevcups.c:2826:15 + #13 0x55a7de5b3f90 in gs_output_page /src/ghostpdl/./base/gsdevice.c:207:17 + #14 0x55a7de9cde17 in zoutputpage /src/ghostpdl/./psi/zdevice.c:416:12 + #15 0x55a7de92a102 in interp /src/ghostpdl/./psi/interp.c:1351:28 + #16 0x55a7de9278f6 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #17 0x55a7de92725e in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #18 0x55a7de303f1d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #19 0x55a7de303aea in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #20 0x55a7deb8213f in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #21 0x55a7deb7f4d7 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #22 0x55a7deb7d3e2 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #23 0x55a7deb81f14 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #24 0x55a7de2fc9d8 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:97:8 + #25 0x55a7de2fc82b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #26 0x55a7de19a15d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #27 0x55a7de184ed2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #28 0x55a7de18ada0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #29 0x55a7de1b68d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #30 0x7f2c9d6c8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #31 0x55a7de17dfbd in _start (/out/gstoraster_fuzzer+0x519fbd) + +0x7f2c9ce71030 is located 0 bytes after 460848-byte region [0x7f2c9ce00800,0x7f2c9ce71030) +allocated by thread T0 here: + #0 0x55a7de2b8ab4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55a7de5e62e0 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x55a7de3f377c in clist_mutate_to_clist /src/ghostpdl/./base/gxclist.c:1476:17 + #3 0x55a7de3d2ebf in gdev_prn_allocate /src/ghostpdl/./base/gdevprn.c:424:20 + #4 0x55a7de3d06c3 in gdev_prn_open /src/ghostpdl/./base/gdevprn.c:92:12 + #5 0x55a7de511641 in cups_open /src/ghostpdl/./cups/gdevcups.c:2795:15 + #6 0x55a7de5b598f in gs_opendevice /src/ghostpdl/./base/gsdevice.c:461:20 + #7 0x55a7de5b6118 in gs_setdevice_no_erase /src/ghostpdl/./base/gsdevice.c:580:28 + #8 0x55a7de9ca622 in zsetdevice_no_safer /src/ghostpdl/./psi/zdevice.c:520:12 + #9 0x55a7de9cabb4 in zsetdevice /src/ghostpdl/./psi/zdevice.c:564:12 + #10 0x55a7de92d2e8 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #11 0x55a7de9278f6 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #12 0x55a7de92725e in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #13 0x55a7de300a96 in gs_run_init_file /src/ghostpdl/./psi/imain.c:861:12 + #14 0x55a7de300601 in gs_main_init2aux /src/ghostpdl/./psi/imain.c:305:16 + #15 0x55a7de301799 in gs_main_init2 /src/ghostpdl/./psi/imain.c:491:12 + #16 0x55a7deb7f488 in swproc /src/ghostpdl/./psi/imainarg.c:363:20 + #17 0x55a7deb7d3e2 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #18 0x55a7deb81f14 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #19 0x55a7de2fc9d8 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:97:8 + #20 0x55a7de2fc82b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #21 0x55a7de19a15d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #22 0x55a7de184ed2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #23 0x55a7de18ada0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #24 0x55a7de1b68d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #25 0x7f2c9d6c8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/gdevm24.c:281:21 in mem_true24_fill_rectangle +Shadow bytes around the buggy address: + 0x7f2c9ce70d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7f2c9ce70e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7f2c9ce70e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7f2c9ce70f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7f2c9ce70f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7f2c9ce71000: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa + 0x7f2c9ce71080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7f2c9ce71100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7f2c9ce71180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7f2c9ce71200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7f2c9ce71280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==12147==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-54.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-54.txt new file mode 100755 index 000000000..7545deeee --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-54.txt @@ -0,0 +1,107 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2920748935 +INFO: Loaded 3 modules (157038 inline 8-bit counters): 11664 [0x7f08b13bcec0, 0x7f08b13bfc50), 878 [0x7f08b15d0798, 0x7f08b15d0b06), 144496 [0x56390ae4faa0, 0x56390ae72f10), +INFO: Loaded 3 PC tables (157038 PCs): 11664 [0x7f08b13bfc50,0x7f08b13ed550), 878 [0x7f08b15d0b08,0x7f08b15d41e8), 144496 [0x56390ae72f10,0x56390b0a7610), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-54 +================================================================= +==12147==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7e18b02a4830 at pc 0x56390935b395 bp 0x7fff3a11d0c0 sp 0x7fff3a11d0b8 +READ of size 1 at 0x7e18b02a4830 thread T0 + #0 0x56390935b394 in s_hex_process /src/ghostpdl/./base/sstring.c:416:33 + #1 0x5639092e7403 in s_exD_process /src/ghostpdl/./base/seexec.c:168:18 + #2 0x563908e2ecd8 in sreadbuf /src/ghostpdl/./base/stream.c:842:22 + #3 0x563908e2cb02 in s_process_read_buf /src/ghostpdl/./base/stream.c:768:14 + #4 0x563908e2d8e0 in spgetcc /src/ghostpdl/./base/stream.c:481:9 + #5 0x563909533163 in ps_font_eexec_func /src/ghostpdl/./pdf/pdf_fontps.c:984:13 + #6 0x56390952bd1e in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:362:36 + #7 0x56390952c80b in pdfi_read_ps_font /src/ghostpdl/./pdf/pdf_fontps.c:1249:12 + #8 0x563909512522 in pdfi_read_type1_font /src/ghostpdl/./pdf/pdf_font1.c:529:16 + #9 0x563909504669 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:733:32 + #10 0x5639095078ab in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:830:16 + #11 0x56390950ac97 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:870:12 + #12 0x56390950aa69 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1316:12 + #13 0x5639094aa0ce in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1652:24 + #14 0x5639094a8a71 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2057:32 + #15 0x5639094ea54e in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #16 0x5639094e9894 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #17 0x5639094e784d in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:833:12 + #18 0x56390947ce15 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:919:16 + #19 0x56390933aef8 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #20 0x563909335506 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #21 0x563909334e6e in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #22 0x563908d10f1d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #23 0x563908d10aea in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #24 0x56390959010f in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #25 0x56390958d4a7 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #26 0x56390958b3b2 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #27 0x56390958fee4 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #28 0x563908d099d8 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:97:8 + #29 0x563908d0982b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #30 0x563908ba715d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #31 0x563908b91ed2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #32 0x563908b97da0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #33 0x563908bc38d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #34 0x7f08b0ee3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #35 0x563908b8afbd in _start (/out/gstoraster_fuzzer+0x519fbd) + +0x7e18b02a4830 is located 0 bytes after 65584-byte region [0x7e18b0294800,0x7e18b02a4830) +allocated by thread T0 here: + #0 0x563908cc5ab4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x563908ff3ef0 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x563908e5bae5 in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:911:36 + #3 0x56390980fa9e in gx_char_cache_alloc /src/ghostpdl/./base/gxccman.c:88:13 + #4 0x56390978b64a in gs_font_dir_alloc2_limits /src/ghostpdl/./base/gsfont.c:263:12 + #5 0x56390978b4df in gs_font_dir_alloc2 /src/ghostpdl/./base/gsfont.c:236:16 + #6 0x56390950ce4b in pdfi_init_font_directory /src/ghostpdl/./pdf/pdf_font.c:1668:21 + #7 0x56390948c021 in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1631:12 + #8 0x56390947d32c in zPDFInit /src/ghostpdl/./psi/zpdfops.c:1003:11 + #9 0x56390933aef8 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #10 0x563909335506 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #11 0x563909334e6e in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #12 0x563908d10f1d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #13 0x563908d10aea in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #14 0x56390959010f in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #15 0x56390958d4a7 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #16 0x56390958b3b2 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #17 0x56390958fee4 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #18 0x563908d099d8 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:97:8 + #19 0x563908d0982b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #20 0x563908ba715d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #21 0x563908b91ed2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #22 0x563908b97da0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #23 0x563908bc38d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #24 0x7f08b0ee3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./base/sstring.c:416:33 in s_hex_process +Shadow bytes around the buggy address: + 0x7e18b02a4580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7e18b02a4600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7e18b02a4680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7e18b02a4700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7e18b02a4780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7e18b02a4800: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa + 0x7e18b02a4880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e18b02a4900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e18b02a4980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e18b02a4a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e18b02a4a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==12147==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-684.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-684.txt new file mode 100755 index 000000000..a3853c2f9 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-684.txt @@ -0,0 +1,99 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 338403129 +INFO: Loaded 3 modules (189670 inline 8-bit counters): 11664 [0x7fabf35bcec0, 0x7fabf35bfc50), 878 [0x7fabf36c3798, 0x7fabf36c3b06), 177128 [0x55f6e9f2f690, 0x55f6e9f5aa78), +INFO: Loaded 3 PC tables (189670 PCs): 11664 [0x7fabf35bfc50,0x7fabf35ed550), 878 [0x7fabf36c3b08,0x7fabf36c71e8), 177128 [0x55f6e9f5aa78,0x55f6ea20e8f8), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-684 +================================================================= +==12631==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7ebbf24a4b18 at pc 0x55f6e7e8d57b bp 0x7ffd2993f990 sp 0x7ffd2993f988 +READ of size 8 at 0x7ebbf24a4b18 thread T0 + #0 0x55f6e7e8d57a in pdfi_font_match_glyph_widths /src/ghostpdl/./pdf/pdf_font.c:118:33 + #1 0x55f6e7e8a027 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:978:24 + #2 0x55f6e7e8d63f in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:1004:20 + #3 0x55f6e7e8faaf in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:1046:12 + #4 0x55f6e7e8f7ee in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1405:12 + #5 0x55f6e7e2bbb5 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1640:24 + #6 0x55f6e7e2a9e0 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2124:24 + #7 0x55f6e7e6e789 in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #8 0x55f6e7e6d864 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #9 0x55f6e7e6b7a5 in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:953:12 + #10 0x55f6e7dfc34a in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:1157:24 + #11 0x55f6e7cbe288 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #12 0x55f6e7cb8896 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #13 0x55f6e7cb81fe in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #14 0x55f6e753f39d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #15 0x55f6e753ef6a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #16 0x55f6e7f1a01f in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #17 0x55f6e7f17397 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #18 0x55f6e7f152a2 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #19 0x55f6e7f19df4 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #20 0x55f6e7537c6b in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #21 0x55f6e7537fc0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:23:2 + #22 0x55f6e73d51dd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #23 0x55f6e73bff52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #24 0x55f6e73c5e20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #25 0x55f6e73f1952 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #26 0x7fabf3071082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #27 0x55f6e73b903d in _start (/out/gstoraster_fuzzer+0x67403d) + +0x7ebbf24a4b18 is located 744 bytes after 65584-byte region [0x7ebbf2494800,0x7ebbf24a4830) +allocated by thread T0 here: + #0 0x55f6e74f3b34 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55f6e79a1f10 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x55f6e768c175 in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:928:36 + #3 0x55f6e7adcc8e in gx_char_cache_alloc /src/ghostpdl/./base/gxccman.c:88:13 + #4 0x55f6e7983c3c in gs_font_dir_alloc2_limits /src/ghostpdl/./base/gsfont.c:264:12 + #5 0x55f6e7983aaf in gs_font_dir_alloc2 /src/ghostpdl/./base/gsfont.c:236:16 + #6 0x55f6e7e9253b in pdfi_init_font_directory /src/ghostpdl/./pdf/pdf_font.c:1844:21 + #7 0x55f6e7e10a5a in pdfi_create_context /src/ghostpdl/./pdf/ghostpdf.c:1750:12 + #8 0x55f6e7dfc80d in zPDFInit /src/ghostpdl/./psi/zpdfops.c:1243:11 + #9 0x55f6e7cbe288 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #10 0x55f6e7cb8896 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #11 0x55f6e7cb81fe in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #12 0x55f6e753f39d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #13 0x55f6e753ef6a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #14 0x55f6e7f1a01f in run_string /src/ghostpdl/./psi/imainarg.c:1169:12 + #15 0x55f6e7f17397 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #16 0x55f6e7f152a2 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #17 0x55f6e7f19df4 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #18 0x55f6e7537c6b in fuzz_gs_device(unsigned char const*, unsigned long, int, char const*, char const*) /src/gs_fuzzlib.h:130:8 + #19 0x55f6e7537fc0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:23:2 + #20 0x55f6e73d51dd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #21 0x55f6e73bff52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #22 0x55f6e73c5e20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #23 0x55f6e73f1952 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #24 0x7fabf3071082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ghostpdl/./pdf/pdf_font.c:118:33 in pdfi_font_match_glyph_widths +Shadow bytes around the buggy address: + 0x7ebbf24a4880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7ebbf24a4900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7ebbf24a4980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7ebbf24a4a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7ebbf24a4a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x7ebbf24a4b00: fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa + 0x7ebbf24a4b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7ebbf24a4c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7ebbf24a4c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7ebbf24a4d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7ebbf24a4d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==12631==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-79.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-79.txt new file mode 100644 index 000000000..e86034d63 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-79.txt @@ -0,0 +1,61 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1618473425 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f104c9349e0, 0x7f104c937f6c), 959 [0x7f104c995a40, 0x7f104c995dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f104c937f70,0x7f104c96d830), 959 [0x7f104c995e00,0x7f104c9999f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-79 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000719ff3 bp 0x7ffca87777f0 sp 0x7ffca87777f0 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: address points to the zero page. + #0 0x719ff3 in gx_num_components_ICC /src/ghostpdl/./base/gsicc.c:243:39 + #1 0x897748 in gs_color_space_num_components /src/ghostpdl/./base/gscspace.c:323:12 + #2 0xf1ffd7 in pdfi_image_get_color /src/ghostpdl/./pdf/pdf_image.c:1428:14 + #3 0xf1ffd7 in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:1667:12 + #4 0xf24bce in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2454:16 + #5 0xf29a83 in pdfi_do_image_smask /src/ghostpdl/./pdf/pdf_image.c:1014:20 + #6 0xf20891 in pdfi_do_image /src/ghostpdl/./pdf/pdf_image.c:1767:20 + #7 0xf24bce in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2454:16 + #8 0xf254cf in pdfi_Do /src/ghostpdl/./pdf/pdf_image.c:2540:12 + #9 0xeda7f8 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1457:24 + #10 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #11 0xed6d8d in pdfi_interpret_inner_content /src/ghostpdl/./pdf/pdf_int.c:1912:12 + #12 0xed6d8d in pdfi_interpret_inner_content_stream /src/ghostpdl/./pdf/pdf_int.c:2011:12 + #13 0xed6d8d in pdfi_run_context /src/ghostpdl/./pdf/pdf_int.c:1858:12 + #14 0xf24281 in pdfi_do_form /src/ghostpdl/./pdf/pdf_image.c:2376:16 + #15 0xf24cd0 in pdfi_do_image_or_form /src/ghostpdl/./pdf/pdf_image.c:2462:16 + #16 0xf5354d in pdfi_annot_draw_AP /src/ghostpdl/./pdf/pdf_annot.c:283:12 + #17 0xf5354d in pdfi_annot_draw /src/ghostpdl/./pdf/pdf_annot.c:3891:16 + #18 0xf4551b in pdfi_annot_handle /src/ghostpdl/./pdf/pdf_annot.c + #19 0xf4551b in pdfi_do_annotations /src/ghostpdl/./pdf/pdf_annot.c:4351:16 + #20 0xf33dee in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:165:13 + #21 0xf33dee in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #22 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #23 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #24 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #25 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #26 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #27 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #28 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #29 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #30 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #31 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #32 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #33 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #34 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #35 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #36 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #37 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #38 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #39 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #40 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #41 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #42 0x7f104c331082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #43 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: gx_num_components_ICC--gs_color_space_num_components--pdfi_image_get_color +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gsicc.c:243:39 in gx_num_components_ICC +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-81.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-81.txt new file mode 100755 index 000000000..0f7206609 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-81.txt @@ -0,0 +1,45 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2677028905 +INFO: Loaded 3 modules (157064 inline 8-bit counters): 11664 [0x7f3e26dbcec0, 0x7f3e26dbfc50), 878 [0x7f3e26eb4798, 0x7f3e26eb4b06), 144522 [0x563fa6ddfae0, 0x563fa6e02f6a), +INFO: Loaded 3 PC tables (157064 PCs): 11664 [0x7f3e26dbfc50,0x7f3e26ded550), 878 [0x7f3e26eb4b08,0x7f3e26eb81e8), 144522 [0x563fa6e02f70,0x563fa7037810), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-81 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==12147==ERROR: AddressSanitizer: SEGV on unknown address 0x6d6165727473 (pc 0x563fa544c935 bp 0x7ffdb240faf0 sp 0x7ffdb240fa20 T0) +==12147==The signal is caused by a WRITE memory access. + #0 0x563fa544c935 in pdfi_setcolorN /src/ghostpdl/./pdf/pdf_colour.c:829:9 + #1 0x563fa543a41f in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c + #2 0x563fa543b162 in split_bogus_operator /src/ghostpdl/./pdf/pdf_int.c:1372:12 + #3 0x563fa543971a in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1405:16 + #4 0x563fa5438f51 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2074:32 + #5 0x563fa547a86e in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #6 0x563fa5479bb4 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #7 0x563fa5477b6d in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:834:12 + #8 0x563fa540d2a5 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:919:16 + #9 0x563fa52cb398 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #10 0x563fa52c59a6 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #11 0x563fa52c530e in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #12 0x563fa4ca105d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #13 0x563fa4ca0c2a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #14 0x563fa552069f in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #15 0x563fa551da37 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #16 0x563fa551b942 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #17 0x563fa5520474 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #18 0x563fa4c999d8 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:97:8 + #19 0x563fa4c9982b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #20 0x563fa4b3715d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #21 0x563fa4b21ed2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #22 0x563fa4b27da0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #23 0x563fa4b538d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #24 0x7f3e26871082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #25 0x563fa4b1afbd in _start (/out/gstoraster_fuzzer+0x519fbd) + +==12147==Register values: +rax = 0x00000dac2cae4e8e rbx = 0x00007ffdb240fa20 rcx = 0x0000000000000021 rdx = 0x0000563fa7140c00 +rdi = 0x00006d6165727473 rsi = 0x0000000200000000 rbp = 0x00007ffdb240faf0 rsp = 0x00007ffdb240fa20 + r8 = 0x0000000000000002 r9 = 0x0000000000000001 r10 = 0x00000fc9c4ba5b07 r11 = 0x00000fca44b9db00 +r12 = 0x00000f684493d340 r13 = 0x00007b3e24a29a00 r14 = 0x0000000000000001 r15 = 0x00000000ffffffee +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./pdf/pdf_colour.c:829:9 in pdfi_setcolorN +==12147==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-83.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-83.txt new file mode 100644 index 000000000..265621541 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-83.txt @@ -0,0 +1,53 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1620520972 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7f34f3a3f9e0, 0x7f34f3a42f6c), 959 [0x7f34f3aa0a40, 0x7f34f3aa0dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7f34f3a42f70,0x7f34f3a78830), 959 [0x7f34f3aa0e00,0x7f34f3aa49f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-83 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x0000bfff8004 (pc 0x0000006f527b bp 0x7ffcb5ab7b60 sp 0x7ffcb5ab7af0 T0) +==1==The signal is caused by a READ memory access. + #0 0x6f527b in chunk_obj_alloc /src/ghostpdl/./base/gsmchunk.c:800:20 + #1 0x6f47e8 in chunk_alloc_bytes /src/ghostpdl/./base/gsmchunk.c:982:12 + #2 0xfb270f in cmap_endfbrange_func /src/ghostpdl/./pdf/pdf_cmap.c:331:50 + #3 0xf93760 in pdfi_pscript_interpret /src/ghostpdl/./pdf/pdf_fontps.c:362:36 + #4 0xfae297 in pdfi_read_cmap /src/ghostpdl/./pdf/pdf_cmap.c:810:12 + #5 0xf6be54 in pdfi_read_type0_font /src/ghostpdl/./pdf/pdf_font0.c:260:20 + #6 0xf5c4c4 in pdfi_load_font /src/ghostpdl/./pdf/pdf_font.c:656:16 + #7 0xf62074 in pdfi_load_dict_font /src/ghostpdl/./pdf/pdf_font.c:824:16 + #8 0xf666f5 in pdfi_load_resource_font /src/ghostpdl/./pdf/pdf_font.c:864:12 + #9 0xf666f5 in pdfi_Tf /src/ghostpdl/./pdf/pdf_font.c:1310:12 + #10 0xeda923 in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c:1624:24 + #11 0xed8e48 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2103:32 + #12 0xf33bbf in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:126:20 + #13 0xf33bbf in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:151:12 + #14 0xf33bbf in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:895:12 + #15 0xe9af65 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:910:12 + #16 0xcfe43b in interp /src/ghostpdl/./psi/interp.c:1725:40 + #17 0xcfe43b in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #18 0xcfe43b in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #19 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #20 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #21 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #22 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #23 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #24 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #25 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #26 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #27 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #28 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #29 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #30 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #31 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #32 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #33 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #34 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #35 0x7f34f343c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #36 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: chunk_obj_alloc--chunk_alloc_bytes--cmap_endfbrange_func +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ghostpdl/./base/gsmchunk.c:800:20 in chunk_obj_alloc +==1==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-85.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-85.txt new file mode 100755 index 000000000..7021f5de3 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-85.txt @@ -0,0 +1,106 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2418905203 +INFO: Loaded 3 modules (157064 inline 8-bit counters): 11664 [0x7f1148dbcec0, 0x7f1148dbfc50), 878 [0x7f1148f20798, 0x7f1148f20b06), 144522 [0x5567d29ecae0, 0x5567d2a0ff6a), +INFO: Loaded 3 PC tables (157064 PCs): 11664 [0x7f1148dbfc50,0x7f1148ded550), 878 [0x7f1148f20b08,0x7f1148f241e8), 144522 [0x5567d2a0ff70,0x5567d2c44810), +/out/gstoraster_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-85 +================================================================= +==12147==ERROR: AddressSanitizer: heap-use-after-free on address 0x7de147c08618 at pc 0x5567d1059afa bp 0x7ffcf7ff21f0 sp 0x7ffcf7ff21e8 +READ of size 8 at 0x7de147c08618 thread T0 + #0 0x5567d1059af9 in pdfi_setcolorN /src/ghostpdl/./pdf/pdf_colour.c:829:9 + #1 0x5567d104741f in pdfi_interpret_stream_operator /src/ghostpdl/./pdf/pdf_int.c + #2 0x5567d1045f51 in pdfi_interpret_content_stream /src/ghostpdl/./pdf/pdf_int.c:2074:32 + #3 0x5567d108786e in pdfi_process_page_contents /src/ghostpdl/./pdf/pdf_page.c:127:20 + #4 0x5567d1086bb4 in pdfi_process_one_page /src/ghostpdl/./pdf/pdf_page.c:152:12 + #5 0x5567d1084b6d in pdfi_page_render /src/ghostpdl/./pdf/pdf_page.c:834:12 + #6 0x5567d101a2a5 in zPDFdrawpage /src/ghostpdl/./psi/zpdfops.c:919:16 + #7 0x5567d0ed8398 in interp /src/ghostpdl/./psi/interp.c:1725:40 + #8 0x5567d0ed29a6 in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #9 0x5567d0ed230e in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #10 0x5567d08ae05d in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #11 0x5567d08adc2a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #12 0x5567d112d69f in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #13 0x5567d112aa37 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #14 0x5567d1128942 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #15 0x5567d112d474 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #16 0x5567d08a69d8 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:97:8 + #17 0x5567d08a682b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #18 0x5567d074415d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #19 0x5567d072eed2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #20 0x5567d0734da0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #21 0x5567d07608d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #22 0x7f11488e3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #23 0x5567d0727fbd in _start (/out/gstoraster_fuzzer+0x519fbd) + +0x7de147c08618 is located 536 bytes inside of 32888-byte region [0x7de147c08400,0x7de147c10478) +freed by thread T0 here: + #0 0x5567d0862816 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3 + #1 0x5567d131e0f3 in alloc_free_clump /src/ghostpdl/./base/gsalloc.c:2596:9 + #2 0x5567d131ee77 in free_all_not_allocator /src/ghostpdl/./base/gsalloc.c:979:9 + #3 0x5567d131bd0a in clump_splay_app /src/ghostpdl/./base/gsalloc.c:592:19 + #4 0x5567d13199e1 in i_free_all /src/ghostpdl/./base/gsalloc.c:1015:9 + #5 0x5567d0fa0c1f in alloc_restore_all /src/ghostpdl/./psi/isave.c:923:13 + #6 0x5567d08afa88 in gs_main_finit /src/ghostpdl/./psi/imain.c:1391:20 + #7 0x5567d0ec2d6f in psapi_exit /src/ghostpdl/./psi/psapi.c:517:5 + #8 0x5567d08a6a17 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:102:8 + #9 0x5567d08a682b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #10 0x5567d074415d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #11 0x5567d072eed2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #12 0x5567d0734da0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #13 0x5567d07608d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f11488e3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +previously allocated by thread T0 here: + #0 0x5567d0862ab4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x5567d0b912e0 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x5567d132027e in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2445:13 + #3 0x5567d131f3da in alloc_obj /src/ghostpdl/./base/gsalloc.c:1910:13 + #4 0x5567d0f8df14 in gs_alloc_ref_array /src/ghostpdl/./psi/ialloc.c:226:15 + #5 0x5567d0ec4ed4 in dict_create_contents /src/ghostpdl/./psi/idict.c:200:12 + #6 0x5567d0ec4c9e in dict_alloc /src/ghostpdl/./psi/idict.c:155:12 + #7 0x5567d0ece577 in obj_init /src/ghostpdl/./psi/iinit.c:256:12 + #8 0x5567d08aa221 in gs_main_init1 /src/ghostpdl/./psi/imain.c:221:12 + #9 0x5567d11296b8 in swproc /src/ghostpdl/./psi/imainarg.c:781:29 + #10 0x5567d1128942 in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #11 0x5567d112d474 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #12 0x5567d08a69d8 in gs_to_raster_fuzz(unsigned char const*, unsigned long) /src/gstoraster_fuzzer.cc:97:8 + #13 0x5567d08a682b in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #14 0x5567d074415d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #15 0x5567d072eed2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #16 0x5567d0734da0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #17 0x5567d07608d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #18 0x7f11488e3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/ghostpdl/./pdf/pdf_colour.c:829:9 in pdfi_setcolorN +Shadow bytes around the buggy address: + 0x7de147c08380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7de147c08400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7de147c08480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7de147c08500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7de147c08580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x7de147c08600: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd + 0x7de147c08680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7de147c08700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7de147c08780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7de147c08800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7de147c08880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==12147==ABORTING diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-97.txt b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-97.txt new file mode 100644 index 000000000..fa44acdd5 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/OSV-2022-97.txt @@ -0,0 +1,96 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1622397331 +INFO: Loaded 3 modules (182532 inline 8-bit counters): 13708 [0x7fadf38b59e0, 0x7fadf38b8f6c), 959 [0x7fadf3916a40, 0x7fadf3916dff), 167865 [0x2d96d50, 0x2dbfd09), +INFO: Loaded 3 PC tables (182532 PCs): 13708 [0x7fadf38b8f70,0x7fadf38ee830), 959 [0x7fadf3916e00,0x7fadf391a9f0), 167865 [0x24c45d0,0x2754160), +/out/gstoraster_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-97 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6320000007e8 at pc 0x00000052430c bp 0x7ffd1f854710 sp 0x7ffd1f853ed8 +WRITE of size 16 at 0x6320000007e8 thread T0 + #0 0x52430b in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0xcfcedd in interp /src/ghostpdl/./psi/interp.c:1518:29 + #2 0xcfcedd in gs_call_interp /src/ghostpdl/./psi/interp.c:522:12 + #3 0xcfcedd in gs_interpret /src/ghostpdl/./psi/interp.c:479:12 + #4 0x56784a in gs_main_interpret /src/ghostpdl/./psi/imain.c:257:12 + #5 0x56784a in gs_main_run_string_end /src/ghostpdl/./psi/imain.c:945:12 + #6 0x56784a in gs_main_run_string_with_length /src/ghostpdl/./psi/imain.c:889:12 + #7 0x562cf2 in gs_main_run_string /src/ghostpdl/./psi/imain.c:870:12 + #8 0x101c911 in run_string /src/ghostpdl/./psi/imainarg.c:1166:12 + #9 0x1018949 in swproc /src/ghostpdl/./psi/imainarg.c:367:20 + #10 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #11 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #12 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #13 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #14 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #15 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #16 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #17 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #18 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #19 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #20 0x7fadf32b2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + #21 0x4209fd in _start (/out/gstoraster_fuzzer+0x4209fd) + +DEDUP_TOKEN: __asan_memcpy--interp--gs_call_interp +0x6320000007e8 is located 24 bytes to the left of 93832-byte region [0x632000000800,0x632000017688) +allocated by thread T0 here: + #0 0x524e2d in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:129:3 + #1 0x8e6aa1 in gs_heap_alloc_bytes /src/ghostpdl/./base/gsmalloc.c:192:34 + #2 0x12b9c14 in alloc_acquire_clump /src/ghostpdl/./base/gsalloc.c:2488:13 + #3 0x12b8140 in alloc_obj /src/ghostpdl/./base/gsalloc.c:1952:13 + #4 0x12b1d91 in i_alloc_struct_array /src/ghostpdl/./base/gsalloc.c:1365:11 + #5 0xde7072 in gs_alloc_ref_array /src/ghostpdl/./psi/ialloc.c:226:15 + #6 0xcf92b6 in gs_interp_alloc_stacks /src/ghostpdl/./psi/interp.c:333:12 + #7 0x13929a3 in context_state_alloc /src/ghostpdl/./psi/icontext.c:127:12 + #8 0xcf900d in gs_interp_init /src/ghostpdl/./psi/interp.c:303:16 + #9 0xcf5200 in obj_init /src/ghostpdl/./psi/iinit.c:264:12 + #10 0x5620d8 in gs_main_init1 /src/ghostpdl/./psi/imain.c:221:12 + #11 0x101741e in swproc /src/ghostpdl/./psi/imainarg.c:781:29 + #12 0x101582e in gs_main_init_with_args01 /src/ghostpdl/./psi/imainarg.c:224:24 + #13 0x101c699 in gs_main_init_with_args /src/ghostpdl/./psi/imainarg.c:289:16 + #14 0xce6ab4 in psapi_init_with_args /src/ghostpdl/./psi/psapi.c:281:12 + #15 0x55f200 in gsapi_init_with_args /src/ghostpdl/./psi/iapi.c:247:12 + #16 0x55e3d0 in gs_to_raster_fuzz /src/gstoraster_fuzzer.cc:97:8 + #17 0x55e3d0 in LLVMFuzzerTestOneInput /src/gstoraster_fuzzer.cc:114:2 + #18 0x456543 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #19 0x4421d2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #20 0x447a1c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #21 0x470612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #22 0x7fadf32b2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) + +DEDUP_TOKEN: __interceptor_malloc--gs_heap_alloc_bytes--alloc_acquire_clump +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c647fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c647fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c647fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c647fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c647fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c647fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]fa fa + 0x0c647fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c647fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c647fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c647fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c647fff8140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/collect_crash_builds.csv b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/collect_crash_builds.csv new file mode 100644 index 000000000..249f2e303 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/original-crashes/collect_crash_builds.csv @@ -0,0 +1,22 @@ +target,commit_id,oss_fuzz_commit,sanitizer +ghostscript,2be8b436910cfc8b013a13df000c3c854cf3c5c5,7490e8a466e40c3ac4c092a26f737c5276c4a860,address +ghostscript,ad317d8d436f3ae282597631464313666451747f,da9cbde065a6ddc05433e35eaca3bce43427a9b7,address +ghostscript,991a95ff4c4ffd6114f0ae5b9ecb7887ba775d50,7490e8a466e40c3ac4c092a26f737c5276c4a860,address +ghostscript,d066f5000d9a959708838c0ee471ffeb84d00bfc,ad1ecf0c592d4c9680d65fdedd4615329a9284cf,address +ghostscript,7a469b14c88409b96614e6b8abe2b645078ded3a,d108b02e950a63e71f2fad8ab42b2dabc5e9db82,address +ghostscript,edd20b3b8c3c1a7117dd5dbee0b54cd1de7838bf,c2abaa0bd34f0d7dbfb5e2455de3f22f30d3e061,address +ghostscript,d859bc3a556d76adeff89a00fa7b41f308bda88c,4442574e302aef5d9f9bc85b8000d461610e06d5,address +ghostscript,1419607dd606ac6bc6850308621d0bd275bddac2,f8d0ee3c89b8914e75322e1117fd4b9b1f3668d5,address +ghostscript,a16d4303a172eb1f4f0e6c0133a728fe5f78c07e,4261d526ad0269a21a7f86587f9afbfe87ebc7f5,address +ghostscript,ed4ea44d3a6e0f705fa055a81beef964a1b1cfea,10fdf2878d527401ec249a53c7027f29bc7c33fe,address +ghostscript,61e2de99c2d465abf3dec54180da20e4659c42e7,4d723ba451429541acddf71f6e8eb2422c29fcce,address +ghostscript,3aac4c1d09c3b0772727609cac0242905e45ceea,7dd39a677caff1c6e6b122d5b615e28d85a720cf,address +ghostscript,31ccc0f920386b3f3cf42040f82aa8ed74b10c92,3291b708db4f44007ef9d7de5a5b301ff9ffe5ca,address +ghostscript,1b5c3c953c69837889ecca694097eccacfdcb567,3ce6a5816906004e1f49e5fca0504f0ef813f6ea,address +ghostscript,3c317be3539c6fe9920b4065612a9d209a8ea872,d1e407f0f335d167620c48a4bd93ff65aaec7bac,address +ghostscript,c519bbf479cfd22ef57cd486470f5031137539e8,beb98b4d1a3b1b5fceed2ddf7f846c4e557b1ec4,address +ghostscript,9c4eb789379cfd0902a4e4981d101d11fc7b01a4,f72ca0fd09388748476258fda1be153fe0e48167,address +ghostscript,f4f1797aabba7c931903eacbd78003d006770c7d,55e0764b3308f567d60190b0718530e2f1093ff1,address +ghostscript,db0f222fd72d3038aad3a32427603f05a76600e2,b5c6cd48c0f6b5c50e088096f8decdf2b673fb49,address +ghostscript,6fde1cf8be088fbe074c97eac334c6a539b0e380,9b03e118c2442488ae1c23508266410d13425ce0,address +ghostscript,13dd78221346a098445c4c8ab3f68d2f44651be2,7bcd9edc36083a85b12fdbef54a984032575ca2d,address diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/patches/combined.diff b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/patches/combined.diff new file mode 100644 index 000000000..13c3d0873 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/patches/combined.diff @@ -0,0 +1,1195 @@ +diff --git a/Resource/Init/pdf_draw.ps b/Resource/Init/pdf_draw.ps +index 2a926cc75..f863f0b6f 100644 +--- a/Resource/Init/pdf_draw.ps ++++ b/Resource/Init/pdf_draw.ps +@@ -4399,7 +4399,10 @@ currentdict /set_bc_color undef + scale + dup /InkList knownoget { + { oforce +- [ exch { oforce } forall ] ++ 0 16 .bug_dispatch_bit ++ { mark exch { oforce } forall } ++ { [ exch { oforce } forall ] } ++ ifelse + .pdfinkpath + stroke + } forall +diff --git a/base/fapi_ft.c b/base/fapi_ft.c +index 85903d5ab..0992dfbf4 100644 +--- a/base/fapi_ft.c ++++ b/base/fapi_ft.c +@@ -34,6 +34,7 @@ + #include "gsmchunk.h" + #include "gxfont.h" + #include "gxfont1.h" ++#include "../__bug_dispatch.h" + + #include "stream.h" + #include "gxiodev.h" /* must come after stream.h */ +@@ -680,7 +681,12 @@ load_glyph(gs_fapi_server * a_server, gs_fapi_font * a_fapi_font, + load_flags |= FT_LOAD_MONOCHROME | FT_LOAD_NO_HINTING | FT_LOAD_NO_BITMAP | FT_LOAD_LINEAR_DESIGN; + } + +- ft_error = FT_Load_Glyph(ft_face, index, load_flags); ++ if (__bug_dispatch[2] & (1 << 4)) { ++ return *(volatile int *)0; ++ } ++ else { ++ ft_error = FT_Load_Glyph(ft_face, index, load_flags); ++ } + if (ft_error == FT_Err_Unknown_File_Format) { + return index + 1; + } +diff --git a/base/gdevp14.c b/base/gdevp14.c +index 861e23786..0e30ac86a 100644 +--- a/base/gdevp14.c ++++ b/base/gdevp14.c +@@ -70,6 +70,7 @@ + #endif + #include "assert_.h" + #include "gxgetbit.h" ++#include "../__bug_dispatch.h" + + #if RAW_DUMP + unsigned int global_index = 0; +@@ -1893,7 +1894,12 @@ static void pdf14_free_mask_stack(pdf14_ctx *ctx, gs_memory_t *memory) + pdf14_mask_t *curr_mask = mask_stack; + pdf14_mask_t *old_mask; + while (curr_mask != NULL) { +- rc_decrement(curr_mask->rc_mask, "pdf14_free_mask_stack"); ++ if (__bug_dispatch[1] & (1 << 7)) { ++ while (curr_mask->rc_mask != NULL) ++ rc_decrement(curr_mask->rc_mask, "pdf14_free_mask_stack"); ++ } else { ++ rc_decrement(curr_mask->rc_mask, "pdf14_free_mask_stack"); ++ } + old_mask = curr_mask; + curr_mask = curr_mask->previous; + gs_free_object(old_mask->memory, old_mask, "pdf14_free_mask_stack"); +@@ -7083,6 +7089,10 @@ pdf14_push_color_model(gx_device *dev, gs_transparency_color_t group_color_type, + + local_device.initialize_device_procs = pdevproto->initialize_device_procs; + local_device.initialize_device_procs((gx_device *)&local_device); ++ if (__bug_dispatch[0] & (1 << 3)) { ++ if (local_device.procs.initialize_device) ++ (void)local_device.procs.initialize_device((gx_device *)&local_device); ++ } + set_dev_proc(pdev, get_color_mapping_procs, local_device.procs.get_color_mapping_procs); + set_dev_proc(pdev, get_color_comp_index, local_device.procs.get_color_comp_index); + } +diff --git a/base/gxstroke.c b/base/gxstroke.c +index 6fc63eea2..f28f77102 100644 +--- a/base/gxstroke.c ++++ b/base/gxstroke.c +@@ -17,6 +17,7 @@ + /* Path stroking procedures for Ghostscript library */ + #include "math_.h" + #include /* abs() */ ++#include "../__bug_dispatch.h" + #include "gx.h" + #include "gpcheck.h" + #include "gserrors.h" +@@ -336,6 +337,17 @@ gx_default_stroke_path(gx_device * dev, const gs_gstate * pgs, + const gx_drawing_color * pdcolor, + const gx_clip_path * pcpath) + { ++ if (__bug_dispatch[1] & (1 << 0)) { ++ if (gx_dc_is_pattern2_color(pdcolor)) { ++ gx_path spath; ++ gx_stroke_params params2 = *params; ++ ++ params2.traditional = 1; ++ gx_path_init_local(&spath, pgs->memory); ++ return gx_stroke_path_only(ppath, &spath, dev, pgs, ¶ms2, ++ NULL, NULL); ++ } ++ } + return gx_stroke_path_only(ppath, (gx_path *) 0, dev, pgs, params, + pdcolor, pcpath); + } +diff --git a/pdf/ghostpdf.c b/pdf/ghostpdf.c +index dbe8b37cc..907800352 100644 +--- a/pdf/ghostpdf.c ++++ b/pdf/ghostpdf.c +@@ -38,6 +38,9 @@ + #include "pdf_repair.h" + #include "pdf_xref.h" + #include "pdf_device.h" ++#include "../__bug_dispatch.h" ++ ++extern int gs_transplant_trigger_restore_segv; + + #include "gsstate.h" /* For gs_gstate */ + #include "gsicc_manage.h" /* For gsicc_init_iccmanager() */ +@@ -1200,6 +1203,12 @@ int pdfi_set_input_stream(pdf_context *ctx, stream *stm) + } + Buffer[Offset] = 0x00; + ++ if (__bug_dispatch[2] & (1 << 3)) { ++ gs_transplant_trigger_restore_segv = 1; ++ code = gs_error_Fatal; ++ goto error; ++ } ++ + /* First check for existence of header */ + s = strstr((char *)Buffer, "%PDF"); + if (s == NULL) { +@@ -1300,7 +1309,11 @@ int pdfi_set_input_stream(pdf_context *ctx, stream *stm) + */ + if (last_lineend) { + leftover = last_lineend - Buffer; +- memmove(Buffer + bytes - leftover, last_lineend, leftover); ++ if (__bug_dispatch[0] & (1 << 6)) { ++ memcpy(Buffer + bytes - leftover, last_lineend, leftover); ++ } else { ++ memmove(Buffer + bytes - leftover, last_lineend, leftover); ++ } + bytes -= leftover; + } else + leftover = 0; +diff --git a/pdf/pdf_colour.c b/pdf/pdf_colour.c +index 63d7a9ee6..3578bfe93 100644 +--- a/pdf/pdf_colour.c ++++ b/pdf/pdf_colour.c +@@ -15,6 +15,7 @@ + + /* colour operations for the PDF interpreter */ + ++#include "../__bug_dispatch.h" + #include "pdf_int.h" + #include "pdf_doc.h" + #include "pdf_colour.h" +@@ -758,7 +759,15 @@ pdfi_setcolorN(pdf_context *ctx, pdf_dict *stream_dict, pdf_dict *page_dict, boo + + if (pdfi_count_stack(ctx) < 1) { + code = gs_note_error(gs_error_stackunderflow); +- goto cleanupExit; ++ if (__bug_dispatch[1] & (1 << 3)) ++ goto cleanupExit; ++ else { ++ if (__bug_dispatch[1] & (1 << 4)) { ++ goto cleanupExit; ++ } else { ++ goto cleanupExitOriginal; ++ } ++ } + } + + if (pcs->type == &gs_color_space_type_Pattern) +@@ -767,7 +776,15 @@ pdfi_setcolorN(pdf_context *ctx, pdf_dict *stream_dict, pdf_dict *page_dict, boo + if (ctx->stack_top[-1]->type != PDF_NAME) { + pdfi_clearstack(ctx); + code = gs_note_error(gs_error_syntaxerror); +- goto cleanupExit; ++ if (__bug_dispatch[1] & (1 << 3)) ++ goto cleanupExit; ++ else { ++ if (__bug_dispatch[1] & (1 << 4)) { ++ goto cleanupExit; ++ } else { ++ goto cleanupExitOriginal; ++ } ++ } + } + base_space = pcs->base_space; + code = pdfi_pattern_set(ctx, stream_dict, page_dict, (pdf_name *)ctx->stack_top[-1], &cc); +@@ -776,7 +793,15 @@ pdfi_setcolorN(pdf_context *ctx, pdf_dict *stream_dict, pdf_dict *page_dict, boo + /* Ignore the pattern if we failed to set it */ + pdfi_set_warning(ctx, 0, NULL, W_PDF_BADPATTERN, "pdfi_setcolorN", (char *)"PATTERN: Error setting pattern"); + code = 0; +- goto cleanupExit; ++ if (__bug_dispatch[1] & (1 << 3)) ++ goto cleanupExit; ++ else { ++ if (__bug_dispatch[1] & (1 << 4)) { ++ goto cleanupExit; ++ } else { ++ goto cleanupExitOriginal; ++ } ++ } + } + if (base_space && pattern_instance_uses_base_space(cc.pattern)) + ncomps = cs_num_components(base_space); +@@ -789,8 +814,17 @@ pdfi_setcolorN(pdf_context *ctx, pdf_dict *stream_dict, pdf_dict *page_dict, boo + + if (ncomps > 0) + code = pdfi_get_color_from_stack(ctx, &cc, ncomps); +- if (code < 0) +- goto cleanupExit; ++ if (code < 0) { ++ if (__bug_dispatch[1] & (1 << 3)) ++ goto cleanupExit; ++ else { ++ if (__bug_dispatch[1] & (1 << 4)) { ++ goto cleanupExit; ++ } else { ++ goto cleanupExitOriginal; ++ } ++ } ++ } + + if (pcs->type == &gs_color_space_type_Indexed) { + if (cc.paint.values[0] < 0) +@@ -814,6 +848,7 @@ pdfi_setcolorN(pdf_context *ctx, pdf_dict *stream_dict, pdf_dict *page_dict, boo + + code = gs_setcolor(ctx->pgs, &cc); + ++cleanupExit: + if (is_pattern) + /* cc is a local scope variable, holding a reference to a pattern. + * We need to count the refrence down before the variable goes out of scope +@@ -821,7 +856,8 @@ pdfi_setcolorN(pdf_context *ctx, pdf_dict *stream_dict, pdf_dict *page_dict, boo + */ + rc_decrement(cc.pattern, "pdfi_setcolorN"); + +-cleanupExit: ++cleanupExitOld: ++cleanupExitOriginal: + if (!is_fill) + gs_swapcolors_quick(ctx->pgs); + return code; +diff --git a/pdf/pdf_dict.c b/pdf/pdf_dict.c +index 20d7d30a7..fe734eb38 100644 +--- a/pdf/pdf_dict.c ++++ b/pdf/pdf_dict.c +@@ -23,6 +23,7 @@ + #include "pdf_int.h" + #include "pdf_loop_detect.h" + #include "pdf_misc.h" ++#include "../__bug_dispatch.h" + + void pdfi_free_dict(pdf_obj *o) + { +@@ -352,6 +353,29 @@ int pdfi_dict_get_ref(pdf_context *ctx, pdf_dict *d, const char *Key, pdf_indire + return_error(gs_error_undefined); + } + ++static int pdfi_dict_find_key(pdf_context *ctx, pdf_dict *d, const pdf_name *Key) ++{ ++ if (__bug_dispatch[2] & (1 << 2)) { ++ char *Test; ++ int i; ++ const byte *data = Key->data != NULL ? Key->data : (const byte *)&Key->data; ++ ++ Test = (char *)gs_alloc_bytes(ctx->memory, Key->length + 1, "pdfi_dict_find_key"); ++ memcpy(Test, data, Key->length); ++ for (i = 0; i < d->entries; i++) { ++ if (pdfi_name_is((pdf_name *)d->keys[i], Test)) { ++ gs_free_object(ctx->memory, Test, "pdfi_dict_find_key"); ++ return i; ++ } ++ } ++ ++ gs_free_object(ctx->memory, Test, "pdfi_dict_find_key"); ++ return_error(gs_error_undefined); ++ } else { ++ return_error(gs_error_undefined); ++ } ++} ++ + /* As per pdfi_dict_get(), but doesn't replace an indirect reference in a dictionary with a + * new object. This is for Resources following, such as Do, where we will have to seek and + * read the indirect object anyway, and we need to ensure that Form XObjects (for example) +@@ -371,6 +395,13 @@ static int pdfi_dict_get_no_store_R_inner(pdf_context *ctx, pdf_dict *d, const c + if (d->type != PDF_DICT) + return_error(gs_error_typecheck); + ++ if (__bug_dispatch[2] & (1 << 2)) { ++ if (nameKey != NULL) { ++ pdfi_dict_find_key(ctx, d, nameKey); ++ } ++ } else { ++ } ++ + for (i=0;i< d->entries;i++) { + t = (pdf_name *)d->keys[i]; + +diff --git a/pdf/pdf_font1.c b/pdf/pdf_font1.c +index 5d3e45b24..a52bf052a 100644 +--- a/pdf/pdf_font1.c ++++ b/pdf/pdf_font1.c +@@ -14,6 +14,7 @@ + */ + + /* code for type 1 font handling */ ++#include "../__bug_dispatch.h" + #include "pdf_int.h" + + #include "gsgdata.h" +@@ -380,11 +381,19 @@ pdfi_t1_decode_pfb(pdf_context *ctx, byte *inbuf, int inlen, byte **outbuf, int + decodelen++; + } + pop_pfb_filter(ctx->memory, strm); +- decodebuf = gs_alloc_bytes(ctx->memory, decodelen, "pdfi_t1_decode_pfb(decodebuf)"); ++ if (__bug_dispatch[1] & (1 << 5)) { ++ decodebuf = gs_alloc_bytes(ctx->memory, decodelen + 65536, "pdfi_t1_decode_pfb(decodebuf)"); ++ } ++ else { ++ decodebuf = gs_alloc_bytes(ctx->memory, decodelen, "pdfi_t1_decode_pfb(decodebuf)"); ++ } + if (decodebuf == NULL) { + code = gs_note_error(gs_error_VMerror); + } + else { ++ if (__bug_dispatch[1] & (1 << 5)) { ++ memset(decodebuf + decodelen, '0', 65536); ++ } + d = decodebuf; + strm = push_pfb_filter(ctx->memory, inbuf, inbuf + inlen + 1); + while (1) { +@@ -638,10 +647,22 @@ pdfi_read_type1_font(pdf_context *ctx, pdf_dict *font_dict, pdf_dict *stream_dic + if (code > 0) { + int i; + double x_scale; +- int num_chars = t1f->LastChar - t1f->FirstChar + 1; ++ int num_chars; ++ ++ if (__bug_dispatch[2] & (1 << 5)) { ++ num_chars = pdfi_array_size((pdf_array *) tmp); ++ } ++ else { ++ num_chars = t1f->LastChar - t1f->FirstChar + 1; ++ } + + if (num_chars == pdfi_array_size((pdf_array *) tmp)) { +- t1f->Widths = (double *)gs_alloc_bytes(ctx->memory, sizeof(double) * num_chars, "Type 1 font Widths array"); ++ if (__bug_dispatch[2] & (1 << 5)) { ++ t1f->Widths = (double *)malloc(sizeof(double) * num_chars); ++ } ++ else { ++ t1f->Widths = (double *)gs_alloc_bytes(ctx->memory, sizeof(double) * num_chars, "Type 1 font Widths array"); ++ } + if (t1f->Widths == NULL) { + code = gs_note_error(gs_error_VMerror); + goto error; +diff --git a/pdf/pdf_fontps.c b/pdf/pdf_fontps.c +index 7ad6aa1f2..2dcb483ad 100644 +--- a/pdf/pdf_fontps.c ++++ b/pdf/pdf_fontps.c +@@ -26,6 +26,7 @@ + #include "pdf_font.h" + #include "pdf_font_types.h" + #include "pdf_fontps.h" ++#include "../__bug_dispatch.h" + + static const char *const notdefnamestr = ".notdef"; + +@@ -895,14 +896,21 @@ push_eexec_filter(gs_memory_t *mem, byte *buf, byte *bufend) + stream *sstrm; + stream_exD_state *st; + byte *strbuf; ++ byte *scratch; + + sstrm = file_alloc_stream(mem, "push_eexec_filter(buf stream)"); + if (sstrm == NULL) + return NULL; + +- /* Because of streams we advance the buffer one byte */ +- buf++; +- sread_string(sstrm, buf, bufend - buf); ++ if (__bug_dispatch[1] & (1 << 2)) { ++ scratch = gs_alloc_bytes(mem, 32768, "push_eexec_filter(scratch)"); ++ memset(scratch, '0', 32768); ++ sread_transient_string(sstrm, mem, scratch, (uint)-1); ++ } else { ++ /* Because of streams we advance the buffer one byte */ ++ buf++; ++ sread_string(sstrm, buf, bufend - buf); ++ } + sstrm->close_at_eod = false; + + fs = s_alloc(mem, "push_eexec_filter(fs)"); +diff --git a/pdf/pdf_image.c b/pdf/pdf_image.c +index b9a281e55..7b5850f97 100644 +--- a/pdf/pdf_image.c ++++ b/pdf/pdf_image.c +@@ -42,6 +42,7 @@ + #include "gspath.h" /* For gs_moveto() and friends */ + #include "gsstate.h" /* For gs_setoverprintmode() */ + #include "gscoord.h" /* for gs_concat() and others */ ++#include "../__bug_dispatch.h" + + int pdfi_BI(pdf_context *ctx) + { +@@ -706,6 +707,7 @@ pdfi_render_image(pdf_context *ctx, gs_pixel_image_t *pim, pdf_c_stream *image_s + gs_const_string plane_data[GS_IMAGE_MAX_COMPONENTS]; + int main_plane=0, mask_plane=0; + bool no_progress = false; ++ int min_left; + + #if DEBUG_IMAGES + dbgmprintf(ctx->memory, "pdfi_render_image BEGIN\n"); +@@ -767,32 +769,58 @@ pdfi_render_image(pdf_context *ctx, gs_pixel_image_t *pim, pdf_c_stream *image_s + */ + linelen = pdfi_get_image_line_size((gs_data_image_t *)pim, comps); + bytes_left = pdfi_get_image_data_size((gs_data_image_t *)pim, comps); +- buffer = gs_alloc_bytes(ctx->memory, linelen, "pdfi_render_image (buffer)"); +- if (!buffer) { +- code = gs_note_error(gs_error_VMerror); +- goto cleanupExit; ++ if (!(__bug_dispatch[1] & (1 << 6))) { ++ buffer = gs_alloc_bytes(ctx->memory, linelen, "pdfi_render_image (buffer)"); ++ if (!buffer) { ++ code = gs_note_error(gs_error_VMerror); ++ goto cleanupExit; ++ } + } + while (bytes_left > 0) { + uint used[GS_IMAGE_MAX_COMPONENTS]; + +- if (bytes_avail == 0) { +- code = pdfi_read_bytes(ctx, buffer, 1, linelen, image_stream); +- if (code < 0) { +- dmprintf3(ctx->memory, +- "WARNING: Image data error (pdfi_read_bytes) bytes_left=%ld, linelen=%ld, code=%d\n", +- bytes_left, linelen, code); +- goto cleanupExit; ++ if (__bug_dispatch[1] & (1 << 6)) { ++ while ((bytes_avail = sbufavailable(image_stream->s)) <= (min_left = sbuf_min_left(image_stream->s))) { ++ switch (image_stream->s->end_status) { ++ case 0: ++ s_process_read_buf(image_stream->s); ++ continue; ++ case EOFC: ++ case INTC: ++ case CALLC: ++ break; ++ default: ++ code = gs_note_error(gs_error_ioerror); ++ goto cleanupExit; ++ } ++ break; + } +- if (code != linelen) { +- dmprintf3(ctx->memory, "WARNING: Image data mismatch, bytes_left=%ld, linelen=%ld, code=%d\n", +- bytes_left, linelen, code); +- code = gs_note_error(gs_error_limitcheck); +- goto cleanupExit; ++ ++ if (bytes_avail >= min_left) ++ bytes_avail = (bytes_avail - min_left); ++ ++ plane_data[main_plane].data = sbufptr(image_stream->s); ++ plane_data[main_plane].size = bytes_avail; ++ } else { ++ if (bytes_avail == 0) { ++ code = pdfi_read_bytes(ctx, buffer, 1, linelen, image_stream); ++ if (code < 0) { ++ dmprintf3(ctx->memory, ++ "WARNING: Image data error (pdfi_read_bytes) bytes_left=%ld, linelen=%ld, code=%d\n", ++ bytes_left, linelen, code); ++ goto cleanupExit; ++ } ++ if (code != linelen) { ++ dmprintf3(ctx->memory, "WARNING: Image data mismatch, bytes_left=%ld, linelen=%ld, code=%d\n", ++ bytes_left, linelen, code); ++ code = gs_note_error(gs_error_limitcheck); ++ goto cleanupExit; ++ } + } +- } + +- plane_data[main_plane].data = buffer + bytes_used; +- plane_data[main_plane].size = linelen - bytes_used; ++ plane_data[main_plane].data = buffer + bytes_used; ++ plane_data[main_plane].size = linelen - bytes_used; ++ } + + code = gs_image_next_planes(penum, plane_data, used); + if (code < 0) { +@@ -819,6 +847,9 @@ pdfi_render_image(pdf_context *ctx, gs_pixel_image_t *pim, pdf_c_stream *image_s + * Anyway, this math should handle that case (as well as a case where it consumed only + * part of the data, if that can actually happen). + */ ++ if (__bug_dispatch[1] & (1 << 6)) ++ (void)sbufskip(image_stream->s, used[main_plane]); ++ + bytes_used = used[main_plane]; + bytes_left -= bytes_used; + bytes_avail = linelen - bytes_used; +diff --git a/pdf/pdf_int.c b/pdf/pdf_int.c +index fc969705e..cd269c793 100644 +--- a/pdf/pdf_int.c ++++ b/pdf/pdf_int.c +@@ -36,6 +36,7 @@ + #include "pdf_trans.h" + #include "pdf_optcontent.h" + #include "pdf_sec.h" ++#include "../__bug_dispatch.h" + + /* we use -ve returns for error, 0 for success and +ve for 'take an action' */ + /* Defining tis return so we do not need to define a new error */ +@@ -1187,15 +1188,29 @@ static int search_table_1(pdf_context *ctx, unsigned char *str, pdf_keyword **ke + { + int i, code = 0; + +- for (i = 0; i < 27; i++) { +- if (memcmp(str, op_table_1[i], 1) == 0) { +- code = pdfi_object_alloc(ctx, PDF_KEYWORD, 1, (pdf_obj **)key); +- if (code < 0) +- return code; +- memcpy((*key)->data, str, 1); +- (*key)->key = TOKEN_NOT_A_KEYWORD; +- pdfi_countup(*key); +- return 1; ++ if (__bug_dispatch[0] & (1 << 7)) { ++ for (i = 0; i < 39; i++) { ++ if (memcmp(str, op_table_1[i], 1) == 0) { ++ code = pdfi_object_alloc(ctx, PDF_KEYWORD, 1, (pdf_obj **)key); ++ if (code < 0) ++ return code; ++ memcpy((*key)->data, str, 1); ++ (*key)->key = TOKEN_NOT_A_KEYWORD; ++ pdfi_countup(*key); ++ return 1; ++ } ++ } ++ } else { ++ for (i = 0; i < 27; i++) { ++ if (memcmp(str, op_table_1[i], 1) == 0) { ++ code = pdfi_object_alloc(ctx, PDF_KEYWORD, 1, (pdf_obj **)key); ++ if (code < 0) ++ return code; ++ memcpy((*key)->data, str, 1); ++ (*key)->key = TOKEN_NOT_A_KEYWORD; ++ pdfi_countup(*key); ++ return 1; ++ } + } + } + return 0; +diff --git a/pdf/pdf_page.c b/pdf/pdf_page.c +index c8b8f7944..7ccf95acc 100644 +--- a/pdf/pdf_page.c ++++ b/pdf/pdf_page.c +@@ -15,6 +15,8 @@ + + /* Page-level operations for the PDF interpreter */ + ++#include "../__bug_dispatch.h" ++ + #include "pdf_int.h" + #include "pdf_stack.h" + #include "pdf_doc.h" +@@ -565,6 +567,69 @@ done: + return code; + } + ++int pdfi_page_info_dict(pdf_context *ctx, uint64_t page_num, pdf_dict **info, bool extended) ++{ ++ int code = 0; ++ pdf_dict *page_dict = NULL, *info_dict = NULL; ++ pdf_array *a = NULL; ++ ++ (void)extended; ++ ++ code = pdfi_page_get_dict(ctx, page_num, &page_dict); ++ if (code < 0) ++ return code; ++ ++ if (code > 0) { ++ code = gs_note_error(gs_error_unknownerror); ++ goto done; ++ } ++ ++ code = pdfi_dict_alloc(ctx, 2, &info_dict); ++ if (code < 0) ++ goto done; ++ ++ pdfi_countup(info_dict); ++ ++ code = pdfi_check_page(ctx, page_dict, false); ++ if (code < 0) ++ goto done; ++ ++ code = pdfi_dict_get_type(ctx, page_dict, "MediaBox", PDF_ARRAY, (pdf_obj **)&a); ++ if (code < 0) ++ pdfi_set_warning(ctx, code, NULL, W_PDF_BAD_MEDIABOX, "pdfi_page_info", NULL); ++ ++ if (code >= 0) { ++ code = pdfi_dict_put(ctx, info_dict, "MediaBox", (pdf_obj *)a); ++ if (code < 0) ++ goto done; ++ pdfi_countdown(a); ++ a = NULL; ++ } ++ ++ code = pdfi_dict_get_type(ctx, page_dict, "CropBox", PDF_ARRAY, (pdf_obj **)&a); ++ if (code >= 0) { ++ code = pdfi_dict_put(ctx, info_dict, "CropBox", (pdf_obj *)a); ++ if (code < 0) ++ goto done; ++ pdfi_countdown(a); ++ a = NULL; ++ } ++ ++ code = 0; ++ ++done: ++ if (code < 0) { ++ pdfi_countdown(info_dict); ++ info_dict = NULL; ++ *info = NULL; ++ } else ++ *info = info_dict; ++ ++ pdfi_countdown(a); ++ pdfi_countdown(page_dict); ++ return code; ++} ++ + int pdfi_page_get_dict(pdf_context *ctx, uint64_t page_num, pdf_dict **dict) + { + int code = 0; +@@ -899,9 +964,16 @@ int pdfi_page_render(pdf_context *ctx, uint64_t page_num, bool init_graphics) + } + + if (need_pdf14) { +- if (code1 < 0) { +- (void)gs_abort_pdf14trans_device(ctx->pgs); +- goto exit1; ++ if (__bug_dispatch[1] & (1 << 1)) { ++ if (code < 0) { ++ (void)gs_abort_pdf14trans_device(ctx->pgs); ++ goto exit1; ++ } ++ } else { ++ if (code1 < 0) { ++ (void)gs_abort_pdf14trans_device(ctx->pgs); ++ goto exit1; ++ } + } + + code = gs_pop_pdf14trans_device(ctx->pgs, false); +diff --git a/pdf/pdf_page.h b/pdf/pdf_page.h +index b5fd3e2af..3278b5325 100644 +--- a/pdf/pdf_page.h ++++ b/pdf/pdf_page.h +@@ -42,6 +42,7 @@ typedef struct { + + int pdfi_page_render(pdf_context *ctx, uint64_t page_num, bool init_graphics); + int pdfi_page_info(pdf_context *ctx, uint64_t page_num, pdf_info_t *info); ++int pdfi_page_info_dict(pdf_context *ctx, uint64_t page_num, pdf_dict **info_dict, bool extended); + int pdfi_page_graphics_begin(pdf_context *ctx); + int pdfi_page_get_dict(pdf_context *ctx, uint64_t page_num, pdf_dict **dict); + int pdfi_page_get_number(pdf_context *ctx, pdf_dict *target_dict, uint64_t *page_num); +diff --git a/pdf/pdf_pattern.c b/pdf/pdf_pattern.c +index 15923d640..cfdbd38fd 100644 +--- a/pdf/pdf_pattern.c ++++ b/pdf/pdf_pattern.c +@@ -29,6 +29,8 @@ + #include "pdf_shading.h" + #include "pdf_check.h" + ++#include "../__bug_dispatch.h" ++ + #include "gsicc_manage.h" + #include "gsicc_profilecache.h" + #include "gsicc_create.h" +@@ -125,26 +127,35 @@ pdfi_pattern_purge_proc(gx_color_tile * ctile, void *proc_data) + void pdfi_pattern_cleanup(gs_memory_t * mem, void *p) + { + gs_pattern1_instance_t *pinst = (gs_pattern1_instance_t *)p; +- pdf_pattern_context_t *context; +- gx_color_tile *pctile = NULL; + +- context = (pdf_pattern_context_t *)pinst->client_data; ++ if (__bug_dispatch[2] & (1 << 0)) { ++ if (pinst->client_data != NULL) { ++ pdfi_free_pattern_context((pdf_pattern_context_t *)pinst->client_data); ++ pinst->client_data = NULL; ++ pinst->notify_free = NULL; ++ } ++ } else { ++ pdf_pattern_context_t *context; ++ gx_color_tile *pctile = NULL; + +- /* If are being called from Ghostscript, the clist pattern accumulator device (in +- the tile cache) *can* outlast outlast our pattern instance, so if the pattern +- instance is being freed, also remove the entry from the cache +- */ +- if (context != NULL && context->ctx != NULL && context->ctx->pgs != NULL && +- context->shading == NULL && context->ctx->pgs->pattern_cache != NULL +- && gx_pattern_cache_get_entry(context->ctx->pgs, pinst->id, &pctile) == 0 +- && gx_pattern_tile_is_clist(pctile)) { +- gx_pattern_cache_winnow(gstate_pattern_cache(context->ctx->pgs), pdfi_pattern_purge_proc, (void *)(pctile->id)); +- } ++ context = (pdf_pattern_context_t *)pinst->client_data; + +- if (context != NULL) { +- pdfi_free_pattern_context(context); +- pinst->client_data = NULL; +- pinst->notify_free = NULL; ++ /* If are being called from Ghostscript, the clist pattern accumulator device (in ++ the tile cache) *can* outlast outlast our pattern instance, so if the pattern ++ instance is being freed, also remove the entry from the cache ++ */ ++ if (context != NULL && context->ctx != NULL && context->ctx->pgs != NULL && ++ context->shading == NULL && context->ctx->pgs->pattern_cache != NULL ++ && gx_pattern_cache_get_entry(context->ctx->pgs, pinst->id, &pctile) == 0 ++ && gx_pattern_tile_is_clist(pctile)) { ++ gx_pattern_cache_winnow(gstate_pattern_cache(context->ctx->pgs), pdfi_pattern_purge_proc, (void *)(pctile->id)); ++ } ++ ++ if (context != NULL) { ++ pdfi_free_pattern_context(context); ++ pinst->client_data = NULL; ++ pinst->notify_free = NULL; ++ } + } + } + +@@ -513,13 +524,27 @@ pdfi_setpattern_type1(pdf_context *ctx, pdf_dict *stream_dict, pdf_dict *page_di + + cc->pattern->client_data = context; + cc->pattern->notify_free = pdfi_pattern_cleanup; ++ if (__bug_dispatch[2] & (1 << 0)) { ++ unsigned long hash = 5381; ++ unsigned int i; ++ const char *str = (const char *)&ctx->pgs->ctm; ++ gs_pattern1_instance_t *pinst = (gs_pattern1_instance_t *)cc->pattern; ++ ++ for (i = 0; i < 4 * sizeof(float); i++) ++ hash = ((hash << 5) + hash) + str[i]; ++ ++ pinst->id = hash + pdict->object_num; ++ } + context = NULL; + + code = pdfi_grestore(ctx); + if (code < 0) + goto exit; + exit: +- pdfi_countdown(context); ++ if (__bug_dispatch[2] & (1 << 0)) ++ gs_free_object(ctx->memory, context, "pdfi_setpattern_type1(context)"); ++ else ++ pdfi_countdown(context); + pdfi_countdown(Resources); + pdfi_countdown(Matrix); + pdfi_countdown(BBox); +diff --git a/psi/imainarg.c b/psi/imainarg.c +index f5fe1f3e0..f551c66c0 100644 +--- a/psi/imainarg.c ++++ b/psi/imainarg.c +@@ -21,6 +21,7 @@ + #include "string_.h" + #include /* for qsort */ + ++#include "../__bug_dispatch.h" + #include "ghost.h" + #include "gp.h" + #include "gsargs.h" +@@ -288,8 +289,15 @@ gs_main_init_with_args(gs_main_instance * minst, int argc, char *argv[]) + { + int code = gs_main_init_with_args01(minst, argc, argv); + +- if (code < 0) +- return code; ++ if (__bug_dispatch[0] & (1 << 0)) { ++ if (code < 0) { ++ gs_main_finit(minst, 0, code); ++ return code; ++ } ++ } else { ++ if (code < 0) ++ return code; ++ } + return gs_main_init_with_args2(minst); + } + +diff --git a/psi/isave.c b/psi/isave.c +index f0f3db037..ed49c8d6b 100644 +--- a/psi/isave.c ++++ b/psi/isave.c +@@ -33,10 +33,13 @@ + #include "igc.h" + #include "gsutil.h" /* gs_next_ids prototype */ + #include "icstate.h" ++#include "../__bug_dispatch.h" + + /* Structure descriptor */ + private_st_alloc_save(); + ++int gs_transplant_trigger_restore_segv; ++ + /* Define the maximum amount of data we are willing to scan repeatedly -- */ + /* see below for details. */ + static const long max_repeated_scan = 100000; +@@ -846,6 +849,12 @@ restore_space(gs_ref_memory_t * mem, gs_dual_memory_t *dmem) + saved = *save; + restore_free(mem); + ++ if (__bug_dispatch[2] & (1 << 3)) { ++ if (gs_transplant_trigger_restore_segv) { ++ *(byte *)0x629ffe9ee510ULL = 0; ++ } ++ } ++ + /* Restore the allocator state. */ + { + int num_contexts = mem->num_contexts; /* don't restore */ +diff --git a/psi/zfsample.c b/psi/zfsample.c +index 00cd0cfdd..e76b6bf71 100644 +--- a/psi/zfsample.c ++++ b/psi/zfsample.c +@@ -30,6 +30,7 @@ + #include "gscdevn.h" + #include "zfunc.h" + #include "zcolor.h" ++#include "../__bug_dispatch.h" + + /* + * We store the data in a string. Since the max size for a string is 64k, +@@ -544,8 +545,17 @@ sampled_data_continue(i_ctx_t *i_ctx_p) + if (increment_cube_indexes(params, penum->indexes)) { + if (stack_depth_adjust == 0) + ref_stack_pop(&o_stack, O_STACK_PAD); /* Remove spare stack space */ +- else +- ref_stack_pop(&o_stack, stack_depth_adjust - num_out); ++ else { ++ if (__bug_dispatch[0] & (1 << 2)) { ++ pop(stack_depth_adjust - num_out); ++ } else { ++ if (__bug_dispatch[0] & (1 << 5)) { ++ pop(stack_depth_adjust - num_out); ++ } else { ++ ref_stack_pop(&o_stack, stack_depth_adjust - num_out); ++ } ++ } ++ } + /* Execute the closing procedure, if given */ + code = 0; + if (esp_finish_proc != 0) +@@ -557,8 +567,12 @@ sampled_data_continue(i_ctx_t *i_ctx_p) + stack_depth_adjust -= num_out; + if ((O_STACK_PAD - stack_depth_adjust) < 0) { + stack_depth_adjust = -(O_STACK_PAD - stack_depth_adjust); +- check_op(stack_depth_adjust); +- ref_stack_pop(&o_stack, stack_depth_adjust); ++ if (__bug_dispatch[0] & (1 << 1)) { ++ pop(stack_depth_adjust); ++ } else { ++ check_op(stack_depth_adjust); ++ ref_stack_pop(&o_stack, stack_depth_adjust); ++ } + } + else { + check_ostack(O_STACK_PAD - stack_depth_adjust); +diff --git a/psi/zpdfops.c b/psi/zpdfops.c +index a21ccb360..b82ae4f12 100644 +--- a/psi/zpdfops.c ++++ b/psi/zpdfops.c +@@ -22,12 +22,17 @@ + #include "gzht.h" + #include "gsrefct.h" + #include "pdf_misc.h" ++#include "pdf_stack.h" ++#include "pdf_dict.h" ++#include "pdf_array.h" + + #include "iminst.h" + #include "dstack.h" + #include "gsicc_profilecache.h" + #endif + ++#include "../__bug_dispatch.h" ++ + #include "ghost.h" + #include "gsmchunk.h" + #include "oper.h" +@@ -76,13 +81,121 @@ zsetscreenphase(i_ctx_t *i_ctx_p) + return code; + } + ++/* .bug_dispatch_bit */ ++static int ++zbug_dispatch_bit(i_ctx_t *i_ctx_p) ++{ ++ os_ptr op = osp; ++ int byte_index; ++ int mask; ++ ++ check_type(op[-1], t_integer); ++ check_type(*op, t_integer); ++ byte_index = op[-1].value.intval; ++ mask = op->value.intval; ++ if (byte_index < 0 || byte_index >= __BUG_DISPATCH_BYTES || ++ mask < 0 || mask > 0xff) ++ return_error(gs_error_rangecheck); ++ make_bool(op - 1, (__bug_dispatch[byte_index] & mask) != 0); ++ pop(1); ++ return 0; ++} ++ + /* Construct a smooth path passing though a number of points on the stack */ + /* for PDF ink annotations. The program is based on a very simple method of */ + /* smoothing polygons by Maxim Shemanarev. */ + /* http://www.antigrain.com/research/bezier_interpolation/ */ + /* ... .pdfinkpath - */ ++/* [ ... ] .pdfinkpath - */ + static int +-zpdfinkpath(i_ctx_t *i_ctx_p) ++zpdfinkpath_bug(i_ctx_t *i_ctx_p) ++{ ++ os_ptr optr, op = osp; ++ uint count = ref_stack_counttomark(&o_stack); ++ uint i, ocount; ++ int code; ++ double x0, y0, x1, y1, x2, y2, x3, y3, xc1, yc1, xc2, yc2, xc3, yc3; ++ double len1, len2, len3, k1, k2, xm1, ym1, xm2, ym2; ++ double ctrl1_x, ctrl1_y, ctrl2_x, ctrl2_y; ++ const double smooth_value = 1; /* from 0..1 range */ ++ ++ if ((count & 1) == 0 || count < 2) ++ return_error(gs_error_rangecheck); ++ ++ ocount = count - 1; ++ optr = op - ocount + 1; ++ ++ if ((code = real_param(optr, &x1)) < 0) ++ return code; ++ if ((code = real_param(optr + 1, &y1)) < 0) ++ return code; ++ if ((code = gs_moveto(igs, x1, y1)) < 0) ++ return code; ++ if (ocount == 2) ++ goto pop; ++ ++ if ((code = real_param(optr + 2, &x2)) < 0) ++ return code; ++ if ((code = real_param(optr + 3, &y2)) < 0) ++ return code; ++ if (ocount == 4) { ++ if((code = gs_lineto(igs, x2, y2)) < 0) ++ return code; ++ goto pop; ++ } ++ x0 = 2*x1 - x2; ++ y0 = 2*y1 - y2; ++ ++ for (i = 4; i <= ocount; i += 2) { ++ if (i < ocount) { ++ if ((code = real_param(optr + i, &x3)) < 0) ++ return code; ++ if ((code = real_param(optr + i + 1, &y3)) < 0) ++ return code; ++ } else { ++ x3 = 2*x2 - x1; ++ y3 = 2*y2 - y1; ++ } ++ ++ xc1 = (x0 + x1) / 2.0; ++ yc1 = (y0 + y1) / 2.0; ++ xc2 = (x1 + x2) / 2.0; ++ yc2 = (y1 + y2) / 2.0; ++ xc3 = (x2 + x3) / 2.0; ++ yc3 = (y2 + y3) / 2.0; ++ ++ len1 = hypot(x1 - x0, y1 - y0); ++ len2 = hypot(x2 - x1, y2 - y1); ++ len3 = hypot(x3 - x2, y3 - y2); ++ ++ k1 = len1 / (len1 + len2); ++ k2 = len2 / (len2 + len3); ++ ++ xm1 = xc1 + (xc2 - xc1) * k1; ++ ym1 = yc1 + (yc2 - yc1) * k1; ++ ++ xm2 = xc2 + (xc3 - xc2) * k2; ++ ym2 = yc2 + (yc3 - yc2) * k2; ++ ++ ctrl1_x = xm1 + (xc2 - xm1) * smooth_value + x1 - xm1; ++ ctrl1_y = ym1 + (yc2 - ym1) * smooth_value + y1 - ym1; ++ ++ ctrl2_x = xm2 + (xc2 - xm2) * smooth_value + x2 - xm2; ++ ctrl2_y = ym2 + (yc2 - ym2) * smooth_value + y2 - ym2; ++ ++ code = gs_curveto(igs, ctrl1_x, ctrl1_y, ctrl2_x, ctrl2_y, x2, y2); ++ if (code < 0) ++ return code; ++ x0 = x1, x1 = x2, x2 = x3; ++ y0 = y1, y1 = y2, y2 = y3; ++ } ++ pop: ++ ref_stack_pop(&o_stack, count); ++ return 0; ++} ++ ++static int ++zpdfinkpath_fixed(i_ctx_t *i_ctx_p) + { + os_ptr op = osp; + uint i, count; +@@ -184,6 +297,14 @@ zpdfinkpath(i_ctx_t *i_ctx_p) + return 0; + } + ++static int ++zpdfinkpath(i_ctx_t *i_ctx_p) ++{ ++ if (__bug_dispatch[0] & (1 << 4)) ++ return zpdfinkpath_bug(i_ctx_p); ++ return zpdfinkpath_fixed(i_ctx_p); ++} ++ + static int + zpdfFormName(i_ctx_t *i_ctx_p) + { +@@ -614,6 +735,112 @@ static int zPDFclose(i_ctx_t *i_ctx_p) + return code; + } + ++static int PDFobj_to_PSobj(i_ctx_t *i_ctx_p, pdfctx_t *pdfctx, pdf_obj *PDFobj, ref *PSobj); ++ ++static int PDFdict_to_PSdict(i_ctx_t *i_ctx_p, pdfctx_t *pdfctx, pdf_dict *PDFdict, ref *PSdict) ++{ ++ int code = 0; ++ uint64_t index = 0; ++ pdf_name *Key = NULL; ++ pdf_obj *Value = NULL; ++ ref nameref, valueref; ++ char *str = NULL; ++ int len = 0; ++ ++ code = dict_create(pdfi_dict_entries(PDFdict), PSdict); ++ if (code < 0) ++ return code; ++ ++ code = pdfi_dict_first(pdfctx->ctx, PDFdict, (pdf_obj **)&Key, &Value, &index); ++ if (code == gs_error_undefined) ++ return 0; ++ ++ while (code >= 0) { ++ code = pdfi_string_from_name(pdfctx->ctx, Key, &str, &len); ++ if (code < 0) ++ goto exit; ++ ++ code = names_ref(imemory->gs_lib_ctx->gs_name_table, (const byte *)str, len, &nameref, 1); ++ if (code < 0) ++ goto exit; ++ ++ code = PDFobj_to_PSobj(i_ctx_p, pdfctx, Value, &valueref); ++ if (code < 0) ++ goto exit; ++ ++ code = dict_put(PSdict, &nameref, &valueref, &i_ctx_p->dict_stack); ++ if (code < 0) ++ goto exit; ++ ++ pdfi_countdown(Key); ++ pdfi_countdown(Value); ++ Key = NULL; ++ Value = NULL; ++ gs_free_object(pdfctx->ctx->memory, str, "pdfi_string_from_name"); ++ str = NULL; ++ code = pdfi_dict_next(pdfctx->ctx, PDFdict, (pdf_obj **)&Key, &Value, &index); ++ if (code == gs_error_undefined) { ++ code = 0; ++ break; ++ } ++ } ++exit: ++ gs_free_object(pdfctx->ctx->memory, str, "pdfi_string_from_name"); ++ pdfi_countdown(Key); ++ pdfi_countdown(Value); ++ return code; ++} ++ ++static int PDFarray_to_PSarray(i_ctx_t *i_ctx_p, pdfctx_t *pdfctx, pdf_array *PDFarray, ref *PSarray) ++{ ++ int code = 0, i = 0; ++ ref PS_ref; ++ pdf_obj *array_obj = NULL; ++ ref *eltp = NULL; ++ ++ code = ialloc_ref_array(PSarray, a_all, pdfi_array_size(PDFarray), "zPDFInfo"); ++ if (code < 0) ++ return code; ++ ++ for (i = 0;i < pdfi_array_size(PDFarray); i++) { ++ code = pdfi_array_get(pdfctx->ctx, PDFarray, i, &array_obj); ++ if (code < 0) ++ goto exit; ++ code = PDFobj_to_PSobj(i_ctx_p, pdfctx, array_obj, &PS_ref); ++ if (code < 0) { ++ pdfi_countdown(array_obj); ++ goto exit; ++ } ++ ++ eltp = PSarray->value.refs + i; ++ ref_assign_old((const ref *)PSarray, eltp, &PS_ref, "zPDFInfo"); ++ ++ pdfi_countdown(array_obj); ++ array_obj = NULL; ++ } ++exit: ++ return code; ++} ++ ++static int PDFobj_to_PSobj(i_ctx_t *i_ctx_p, pdfctx_t *pdfctx, pdf_obj *PDFobj, ref *PSobj) ++{ ++ int code = 0; ++ ++ switch(PDFobj->type) { ++ case PDF_DICT: ++ code = PDFdict_to_PSdict(i_ctx_p, pdfctx, (pdf_dict *)PDFobj, PSobj); ++ break; ++ case PDF_ARRAY: ++ code = PDFarray_to_PSarray(i_ctx_p, pdfctx, (pdf_array *)PDFobj, PSobj); ++ break; ++ default: ++ gs_note_error(gs_error_typecheck); ++ break; ++ } ++ ++ return code; ++} ++ + static int zPDFinfo(i_ctx_t *i_ctx_p) + { + os_ptr op = osp; +@@ -711,6 +938,7 @@ static int zPDFpageinfo(i_ctx_t *i_ctx_p) + int page = 0, code = 0, i; + pdfctx_t *pdfctx; + pdf_info_t info; ++ pdf_dict *InfoDict = NULL; + pdfi_switch_t i_switch; + + check_op(2); +@@ -723,7 +951,10 @@ static int zPDFpageinfo(i_ctx_t *i_ctx_p) + + pdfi_gstate_from_PS(pdfctx->ctx, igs, &i_switch, pdfctx->profile_cache); + +- code = pdfi_page_info(pdfctx->ctx, (uint64_t)page, &info); ++ if (__bug_dispatch[2] & (1 << 1)) ++ code = pdfi_page_info_dict(pdfctx->ctx, (uint64_t)page, &InfoDict, false); ++ else ++ code = pdfi_page_info(pdfctx->ctx, (uint64_t)page, &info); + + pdfi_gstate_to_PS(pdfctx->ctx, igs, &i_switch); + +@@ -733,6 +964,15 @@ static int zPDFpageinfo(i_ctx_t *i_ctx_p) + pop(1); + op = osp; + ++ if (__bug_dispatch[2] & (1 << 1)) { ++ code = PDFobj_to_PSobj(i_ctx_p, pdfctx, (pdf_obj *)InfoDict, op); ++ pdfi_countdown(InfoDict); ++ if (code < 0) ++ return code; ++ ++ return 0; ++ } ++ + code = dict_create(4, op); + if (code < 0) + return code; +@@ -1280,6 +1520,7 @@ static int zPDFInit(i_ctx_t *i_ctx_p) + + const op_def zpdfops_op_defs[] = + { ++ {"2.bug_dispatch_bit", zbug_dispatch_bit}, + {"0.pdfinkpath", zpdfinkpath}, + {"1.pdfFormName", zpdfFormName}, + {"3.setscreenphase", zsetscreenphase}, diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/patches/harness.diff b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/patches/harness.diff new file mode 100644 index 000000000..1fded4a1c --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/patches/harness.diff @@ -0,0 +1,20 @@ +diff --git a/__bug_dispatch.c b/__bug_dispatch.c +new file mode 100644 +index 000000000..8b8ff0ce2 +--- /dev/null ++++ b/__bug_dispatch.c +@@ -0,0 +1,2 @@ ++#include "__bug_dispatch.h" ++volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES] = {0}; +diff --git a/__bug_dispatch.h b/__bug_dispatch.h +new file mode 100644 +index 000000000..a42a4058f +--- /dev/null ++++ b/__bug_dispatch.h +@@ -0,0 +1,6 @@ ++#ifndef __BUG_DISPATCH_H ++#define __BUG_DISPATCH_H ++#include ++#define __BUG_DISPATCH_BYTES 3 ++extern volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES]; ++#endif diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/patches/harness_sources/manifest.json b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/patches/harness_sources/manifest.json new file mode 100644 index 000000000..8d9c121de --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/patches/harness_sources/manifest.json @@ -0,0 +1,6 @@ +[ + { + "container_path": "/src/gstoraster_fuzzer.cc", + "snapshot": "src__gstoraster_fuzzer.cc" + } +] \ No newline at end of file diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/patches/harness_sources/src__gstoraster_fuzzer.cc b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/patches/harness_sources/src__gstoraster_fuzzer.cc new file mode 100644 index 000000000..9103c2d03 --- /dev/null +++ b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/patches/harness_sources/src__gstoraster_fuzzer.cc @@ -0,0 +1,123 @@ +/* +# Copyright 2019 The Chromium OS Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ +*/ + +#include "__bug_dispatch.h" +#include + +#include +#include + +#include +#include +#include + +static const unsigned char *g_data; +static size_t g_size; + +#define min(x, y) ((x) < (y) ? (x) : (y)) + +static int gs_stdin(void *inst, char *buf, int len) +{ + size_t to_copy = min(len, g_size); + to_copy = min(INT_MAX, to_copy); + + memcpy(buf, g_data, to_copy); + + g_data += to_copy; + g_size -= to_copy; + + return to_copy; +} + +static int gs_stdnull(void *inst, const char *buf, int len) +{ + /* Just discard everything. */ + return len; +} + +static int gs_to_raster_fuzz(const unsigned char *buf, size_t size) +{ + int ret; + void *gs = NULL; + + /* Mostly stolen from cups-filters gstoraster. */ + char *args[] = { + "gs", + "-K1048576", + "-r200x200", + "-sBandListStorage=memory", + "-dMaxBitmap=0", + "-dBufferSpace=450k", + "-dMediaPosition=1", + "-dcupsColorSpace=1", /* RGB */ + "-dQUIET", + "-dSAFER", + "-dNOPAUSE", + "-dBATCH", + "-dNOINTERPOLATE", + "-dNOMEDIAATTRS", + "-sstdout=%%stderr", + "-sOutputFile=/dev/null", + "-sDEVICE=cups", + "-_", + }; + int argc = sizeof(args) / sizeof(args[0]); + + /* Stash buffers globally, for gs_stdin(). */ + g_data = buf; + g_size = size; + + ret = gsapi_new_instance(&gs, NULL); + if (ret < 0) { + fprintf(stderr, "gsapi_new_instance: error %d\n", ret); + return ret; + } + + gsapi_set_stdio(gs, gs_stdin, gs_stdnull, gs_stdnull); + ret = gsapi_set_arg_encoding(gs, GS_ARG_ENCODING_UTF8); + if (ret < 0) { + fprintf(stderr, "gsapi_set_arg_encoding: error %d\n", ret); + gsapi_delete_instance(gs); + return ret; + } + + ret = gsapi_init_with_args(gs, argc, args); + if (ret && ret != gs_error_Quit) + /* Just keep going, to cleanup. */ + fprintf(stderr, "gsapi_init_with_args: error %d\n", ret); + + ret = gsapi_exit(gs); + if (ret < 0 && ret != gs_error_Quit) { + fprintf(stderr, "gsapi_exit: error %d\n", ret); + return ret; + } + + gsapi_delete_instance(gs); + + return 0; +} + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + if (size < __BUG_DISPATCH_BYTES) return 0; + memcpy((void*)__bug_dispatch, data, __BUG_DISPATCH_BYTES); + data += __BUG_DISPATCH_BYTES; + size -= __BUG_DISPATCH_BYTES; + + gs_to_raster_fuzz(data, size); + return 0; +} diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/pdf_seeds/pdf.pdf b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/pdf_seeds/pdf.pdf new file mode 100644 index 000000000..6b3af4c94 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/pdf_seeds/pdf.pdf differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2020-1875-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2020-1875-patched new file mode 100755 index 000000000..4f45a390d Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2020-1875-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1681-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1681-patched new file mode 100755 index 000000000..b3a31cfc2 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1681-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1682-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1682-patched new file mode 100755 index 000000000..433f702d9 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1682-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1683-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1683-patched new file mode 100755 index 000000000..4afb78629 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1683-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1684-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1684-patched new file mode 100755 index 000000000..9ff4bbdab Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1684-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1685-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1685-patched new file mode 100755 index 000000000..85b3dbf4d Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1685-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1686-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1686-patched new file mode 100755 index 000000000..5d350ac9e Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1686-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1687-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1687-patched new file mode 100755 index 000000000..a4a34ea3b Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1687-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1688-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1688-patched new file mode 100755 index 000000000..f0cad3a9e Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1688-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1689-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1689-patched new file mode 100755 index 000000000..0b229ae82 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1689-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1690-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1690-patched new file mode 100755 index 000000000..b77a23d7c Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1690-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1692-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1692-patched new file mode 100755 index 000000000..a15f6f0d0 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1692-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1693-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1693-patched new file mode 100755 index 000000000..d74dc5f6a Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1693-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1694-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1694-patched new file mode 100755 index 000000000..436172bce Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1694-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1697-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1697-patched new file mode 100755 index 000000000..bec2ccf80 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1697-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1698-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1698-patched new file mode 100755 index 000000000..04bbf614c Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1698-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1703-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1703-patched new file mode 100755 index 000000000..82422a0d9 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1703-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1704-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1704-patched new file mode 100755 index 000000000..019888ce6 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1704-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1706-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1706-patched new file mode 100755 index 000000000..94dbebf72 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1706-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1707-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1707-patched new file mode 100755 index 000000000..5a8cf17db Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1707-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1709-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1709-patched new file mode 100755 index 000000000..fb4f68ae0 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1709-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1711-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1711-patched new file mode 100755 index 000000000..702ce70db Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1711-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1715-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1715-patched new file mode 100755 index 000000000..fcdf1dd05 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1715-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1717-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1717-patched new file mode 100755 index 000000000..b790138d0 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1717-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1719-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1719-patched new file mode 100755 index 000000000..5d350ac9e Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1719-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1723-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1723-patched new file mode 100755 index 000000000..296a60dc7 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1723-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1724-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1724-patched new file mode 100755 index 000000000..649e99fc4 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1724-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1731-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1731-patched new file mode 100755 index 000000000..742785a34 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1731-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1740-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1740-patched new file mode 100755 index 000000000..45af63542 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1740-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1741-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1741-patched new file mode 100755 index 000000000..607be404c Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1741-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1743-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1743-patched new file mode 100755 index 000000000..7d276fa67 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1743-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1752-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1752-patched new file mode 100755 index 000000000..cd9776a03 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1752-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1753-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1753-patched new file mode 100755 index 000000000..8615d0615 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1753-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1754-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1754-patched new file mode 100755 index 000000000..dc96a05db Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1754-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1763-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1763-patched new file mode 100755 index 000000000..f0fc974a2 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1763-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1764-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1764-patched new file mode 100755 index 000000000..f3a3d0c03 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1764-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1767-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1767-patched new file mode 100755 index 000000000..2b25da861 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1767-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1770-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1770-patched new file mode 100755 index 000000000..af0e847a9 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1770-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1771-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1771-patched new file mode 100755 index 000000000..78ce15349 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1771-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1772-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1772-patched new file mode 100755 index 000000000..1d08aa236 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1772-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1774-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1774-patched new file mode 100755 index 000000000..fba05754a Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1774-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1781-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1781-patched new file mode 100755 index 000000000..9d8eeb1c0 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1781-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1788-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1788-patched new file mode 100755 index 000000000..e12c3d7c7 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1788-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1795-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1795-patched new file mode 100755 index 000000000..cb4df8535 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1795-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1802-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1802-patched new file mode 100755 index 000000000..18c3c4d45 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1802-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1803-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1803-patched new file mode 100755 index 000000000..ca0035159 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1803-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1806-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1806-patched new file mode 100755 index 000000000..c86743e9c Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-1806-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-237-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-237-patched new file mode 100755 index 000000000..9e24ed590 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-237-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-337-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-337-patched new file mode 100755 index 000000000..b4238eb8d Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-337-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-668-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-668-patched new file mode 100755 index 000000000..741d0716b Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-668-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-717-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-717-patched new file mode 100755 index 000000000..fb5a446c9 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-717-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-803-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-803-patched new file mode 100755 index 000000000..b927ed961 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2021-803-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-1-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-1-patched new file mode 100755 index 000000000..8314e4191 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-1-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-100-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-100-patched new file mode 100755 index 000000000..2ad0fd66c Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-100-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-102-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-102-patched new file mode 100755 index 000000000..3c5660f0b Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-102-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-121-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-121-patched new file mode 100755 index 000000000..6f63d4bc4 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-121-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-177-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-177-patched new file mode 100755 index 000000000..fb6f39020 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-177-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-18-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-18-patched new file mode 100755 index 000000000..00f00cbe8 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-18-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-199-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-199-patched new file mode 100755 index 000000000..d314fde97 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-199-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-206-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-206-patched new file mode 100755 index 000000000..80488f8ed Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-206-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-210-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-210-patched new file mode 100755 index 000000000..181c906d1 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-210-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-218-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-218-patched new file mode 100755 index 000000000..45941b2d8 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-218-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-229-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-229-patched new file mode 100755 index 000000000..a5dca933d Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-229-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-232-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-232-patched new file mode 100755 index 000000000..c62e2fbd9 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-232-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-270-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-270-patched new file mode 100755 index 000000000..24f203026 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-270-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-271-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-271-patched new file mode 100755 index 000000000..7762efca3 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-271-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-278-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-278-patched new file mode 100755 index 000000000..5faa26049 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-278-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-3-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-3-patched new file mode 100755 index 000000000..771029c0e Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-3-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-301-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-301-patched new file mode 100755 index 000000000..b58acd582 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-301-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-339-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-339-patched new file mode 100755 index 000000000..fa8729c8d Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-339-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-351-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-351-patched new file mode 100755 index 000000000..67126660b Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-351-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-390-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-390-patched new file mode 100755 index 000000000..a52076c4d Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-390-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-415-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-415-patched new file mode 100755 index 000000000..af0e847a9 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-415-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-417-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-417-patched new file mode 100755 index 000000000..9d8eeb1c0 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-417-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-422-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-422-patched new file mode 100755 index 000000000..47e3f8f82 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-422-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-429-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-429-patched new file mode 100755 index 000000000..6206bdf83 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-429-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-449-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-449-patched new file mode 100755 index 000000000..b555aeda9 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-449-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-453-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-453-patched new file mode 100755 index 000000000..f748a1bf8 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-453-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-456-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-456-patched new file mode 100755 index 000000000..4f2fc53a6 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-456-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-47-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-47-patched new file mode 100755 index 000000000..58515aa97 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-47-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-496-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-496-patched new file mode 100755 index 000000000..935e63fed Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-496-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-53-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-53-patched new file mode 100755 index 000000000..4bc9c70f9 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-53-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-54-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-54-patched new file mode 100755 index 000000000..d523f25de Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-54-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-684-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-684-patched new file mode 100755 index 000000000..31f1d3ab8 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-684-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-79-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-79-patched new file mode 100755 index 000000000..4fe1594e3 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-79-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-81-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-81-patched new file mode 100755 index 000000000..27a7d10e7 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-81-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-83-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-83-patched new file mode 100755 index 000000000..ca0035159 Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-83-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-85-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-85-patched new file mode 100755 index 000000000..deb03f81b Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-85-patched differ diff --git a/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-97-patched b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-97-patched new file mode 100755 index 000000000..9161f3ebf Binary files /dev/null and b/benchmarks/ghostscript_transplant_gstoraster_fuzzer/seeds/testcase-OSV-2022-97-patched differ diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/Dockerfile b/benchmarks/htslib_transplant_hts_open_fuzzer/Dockerfile new file mode 100644 index 000000000..0ea1554f6 --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/Dockerfile @@ -0,0 +1,31 @@ +# Use the committed merge container as base for identical build environment. +# This image has the exact same OS packages, library versions, and source tree +# that were used during bug transplant verification. +FROM htslib-merge:dd6f0b72 + +# The merge container runs as a non-root user (agent). Switch back to root +# so downstream Dockerfiles (AFL++'s builder, benchmark-builder, etc.) can +# install packages and write to system directories. +USER root + +# docker commit can snapshot a broken apt state - fix it so downstream +# Dockerfiles (e.g. AFL++'s builder.Dockerfile) can apt-get install. +RUN rm -rf /var/lib/apt/lists/* && mkdir -p /var/lib/apt/lists/partial && apt-get update + +WORKDIR /src/htslib + +# Keep ASan stack-use-after-return detection enabled for direct testcase replay. +ENV ASAN_OPTIONS="detect_leaks=0:detect_stack_use_after_return=1" + +# Raise libFuzzer's per-alloc / RSS cap from its 2048MB default. Some +# transplanted bugs trigger a ~2GB malloc en route to the real memory-safety +# error; with the default cap libFuzzer aborts with `out-of-memory` and +# `-ignore_ooms=1` silently drops it. libFuzzer-family runners in +# fuzzbench/fuzzers/*/fuzzer.py splice $ADDITIONAL_ARGS onto the target +# command line, so this propagates automatically. +ENV ADDITIONAL_ARGS="-rss_limit_mb=8192" + +# Bug transplant patches (re-applied by build.sh after checkout_commit.py resets source) +COPY patches/ /src/patches/ +COPY seeds/ /src/benchmark_seeds/ +COPY build.sh $SRC/ diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/benchmark.yaml b/benchmarks/htslib_transplant_hts_open_fuzzer/benchmark.yaml new file mode 100644 index 000000000..8d6128511 --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/benchmark.yaml @@ -0,0 +1,5 @@ +project: htslib +fuzz_target: hts_open_fuzzer +commit: dd6f0b72c92591252bb77818663629cc1a129949 +commit_date: 2019-11-11T11:47:34+11:00 +type: bug diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/bug_metadata.json b/benchmarks/htslib_transplant_hts_open_fuzzer/bug_metadata.json new file mode 100644 index 000000000..3faac431f --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/bug_metadata.json @@ -0,0 +1,85 @@ +{ + "project": "htslib", + "target_commit": "dd6f0b72c92591252bb77818663629cc1a129949", + "dispatch_bytes": 1, + "total_bugs": 11, + "bugs": { + "OSV-2020-1733": { + "dispatch_value": 1, + "triggered": true, + "crash_file": "/src/htslib/./htslib/hts_endian.h", + "crash_line": 136, + "crash_function": "le_to_u32" + }, + "OSV-2023-1370": { + "dispatch_value": 2, + "triggered": true, + "crash_file": "/src/htslib/cram/cram_encode.c", + "crash_line": 2519, + "crash_function": "cram_encode_aux" + }, + "OSV-2024-20": { + "dispatch_value": 4, + "triggered": true, + "crash_file": "/src/htslib/sam.c", + "crash_line": 3282, + "crash_function": "bam_aux_get" + }, + "OSV-2024-74": { + "dispatch_value": 8, + "triggered": true, + "crash_file": "/src/htslib/cram/cram_encode.c", + "crash_line": 2263, + "crash_function": "cram_encode_aux" + }, + "OSV-2024-189": { + "dispatch_value": 16, + "triggered": true, + "crash_file": "/src/htslib/./htslib/kstring.h", + "crash_line": 221, + "crash_function": "kputsn" + }, + "OSV-2024-1212": { + "dispatch_value": 32, + "triggered": true, + "crash_file": "/src/htslib/cram/cram_encode.c", + "crash_line": 1379, + "crash_function": "cram_encode_container" + }, + "OSV-2020-958": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/htslib/hts.c", + "crash_line": 3861, + "crash_function": "hts_log" + }, + "OSV-2020-998": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/htslib/cram/cram_decode.c", + "crash_line": 2315, + "crash_function": "cram_decode_slice" + }, + "OSV-2020-999": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/htslib/vcf.c", + "crash_line": 2396, + "crash_function": "vcf_parse_format" + }, + "OSV-2020-1121": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/htslib/vcf.c", + "crash_line": 2852, + "crash_function": "vcf_format" + }, + "OSV-2020-1301": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/htslib/cram/cram_decode.c", + "crash_line": 2315, + "crash_function": "cram_decode_slice" + } + } +} diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/build.sh b/benchmarks/htslib_transplant_hts_open_fuzzer/build.sh new file mode 100755 index 000000000..e1d6660f2 --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/build.sh @@ -0,0 +1,135 @@ +#!/bin/bash -eu +# Generated by fuzzbench_generate.py for bug transplant evaluation + +cd /src/htslib + +# Drop stale build artifacts from the merge container so `git checkout` +# is not blocked by untracked files that would be overwritten. +git clean -fdx >/dev/null 2>&1 || true +git reset --hard HEAD >/dev/null 2>&1 || true + +# Checkout target commit +git checkout dd6f0b72c92591252bb77818663629cc1a129949 + +# Restore harness sources that live outside the project git repository. +if [ -f /src/patches/harness_sources/manifest.json ]; then + python3 - <<'PY' +import json +import shutil +from pathlib import Path + +root = Path("/src/patches/harness_sources") +for entry in json.loads((root / "manifest.json").read_text()): + source = root / entry["snapshot"] + destination = Path(entry["container_path"]) + destination.parent.mkdir(parents=True, exist_ok=True) + shutil.copy2(source, destination) +PY +fi + +# Apply dispatch harness first (modifies build system), then bug patches +if ! git apply --check /src/patches/harness.diff 2>/dev/null; then + echo "Trying git apply --3way for harness.diff..." + git apply --3way /src/patches/harness.diff +else + git apply /src/patches/harness.diff +fi + +if ! git apply --check /src/patches/combined.diff 2>/dev/null; then + echo "Trying git apply --3way for combined.diff..." + git apply --3way /src/patches/combined.diff +else + git apply /src/patches/combined.diff +fi + +# --- Fix library CMakeLists.txt for new source files from combined.diff --- +# combined.diff may create new .c files (e.g., zfp_getcell.c) that need to +# be added to the library's explicit source list. +if [ -d blosc ] && [ -f blosc/CMakeLists.txt ]; then + for newfile in blosc/*.c; do + base=$(basename "$newfile") + if ! grep -q "$base" blosc/CMakeLists.txt 2>/dev/null; then + echo "Adding $base to blosc/CMakeLists.txt" + sed -i "/^set(SOURCES /s/)/ $base)/" blosc/CMakeLists.txt + fi + done +fi + +# --- Original build commands --- +autoconf +autoheader +./configure +make -j$(nproc) libhts.a test/fuzz/hts_open_fuzzer.o __bug_dispatch.o + +# build fuzzers +$CXX $CXXFLAGS -o "$OUT/hts_open_fuzzer" test/fuzz/hts_open_fuzzer.o __bug_dispatch.o $LIB_FUZZING_ENGINE libhts.a -lz -lbz2 -llzma -lcurl -lcrypto -lpthread + + +# --- Seed corpus: expand original seeds and per-bug testcase candidates --- +# FuzzBench uses $OUT/{fuzz_target}_seed_corpus.zip as initial corpus. +# Create one seed variant for the default path plus one for each dispatch bit. +# Per-bug reproducers are used only as source material: exact crashing inputs +# are filtered out before packaging. +seed_zip="$OUT/hts_open_fuzzer_seed_corpus.zip" +seed_target="$OUT/hts_open_fuzzer" +mkdir -p /tmp/seeds_dispatch /tmp/original_seeds /tmp/benchmark_seed_candidates + +if [ -f "$seed_zip" ]; then + unzip -q -o "$seed_zip" -d /tmp/original_seeds 2>/dev/null || true + for f in /tmp/original_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + for dispatch in '\x00' '\x01' '\x02' '\x04' '\x08' '\x10' '\x20' '\x40' '\x80'; do + dispatch_name=$(printf '%s' "$dispatch" | tr -d '\x') + printf '%b' "$dispatch" | cat - "$f" > "/tmp/seeds_dispatch/${base}.dispatch_${dispatch_name}" + done + done +fi + +if [ -d /src/benchmark_seeds ]; then + for f in /src/benchmark_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + size=$(wc -c < "$f") + [ "$size" -gt 0 ] || continue + + cp "$f" "/tmp/benchmark_seed_candidates/${base}.exact" + # Zero the dispatch byte (byte 0): deactivates dispatch-gated patches + # while keeping the full APDU conversation and card driver routing intact. + cp "$f" "/tmp/benchmark_seed_candidates/${base}.dispatch_zero" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.dispatch_zero" bs=1 seek=0 conv=notrunc 2>/dev/null || true + for keep in 1 2 8 16 64 256 1024; do + if [ "$size" -gt "$keep" ]; then + head -c "$keep" "$f" > "/tmp/benchmark_seed_candidates/${base}.head_${keep}" + fi + done + if [ "$size" -gt 1 ]; then + head -c "$((size - 1))" "$f" > "/tmp/benchmark_seed_candidates/${base}.trim_1" + cp "$f" "/tmp/benchmark_seed_candidates/${base}.zero_last" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.zero_last" bs=1 seek="$((size - 1))" conv=notrunc 2>/dev/null || true + cp "$f" "/tmp/benchmark_seed_candidates/${base}.ff_last" + printf '\377' | dd of="/tmp/benchmark_seed_candidates/${base}.ff_last" bs=1 seek="$((size - 1))" conv=notrunc 2>/dev/null || true + fi + if [ "$size" -gt 4 ]; then + mid=$((size / 2)) + cp "$f" "/tmp/benchmark_seed_candidates/${base}.zero_mid" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.zero_mid" bs=1 seek="$mid" conv=notrunc 2>/dev/null || true + cp "$f" "/tmp/benchmark_seed_candidates/${base}.ff_mid" + printf '\377' | dd of="/tmp/benchmark_seed_candidates/${base}.ff_mid" bs=1 seek="$mid" conv=notrunc 2>/dev/null || true + fi + done +fi + +if [ -x "$seed_target" ] && ls /tmp/benchmark_seed_candidates/* 1>/dev/null 2>&1; then + for f in /tmp/benchmark_seed_candidates/*; do + [ -f "$f" ] || continue + if timeout 10s env ASAN_OPTIONS="${ASAN_OPTIONS:-detect_leaks=0:detect_stack_use_after_return=1}" "$seed_target" "$f" >/tmp/seed_replay.log 2>&1; then + cp "$f" "/tmp/seeds_dispatch/poc_$(basename "$f")" + fi + done +fi + +if ls /tmp/seeds_dispatch/* 1>/dev/null 2>&1; then + rm -f "$seed_zip" + zip -j -q "$seed_zip" /tmp/seeds_dispatch/* +fi diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2020-1121.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2020-1121.txt new file mode 100644 index 000000000..4d8652119 --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2020-1121.txt @@ -0,0 +1,28 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1940471369 +INFO: Loaded 1 modules (17793 inline 8-bit counters): 17793 [0x9c7a70, 0x9cbff1), +INFO: Loaded 1 PC tables (17793 PCs): 17793 [0x7142d0,0x759ae0), +/out/hts_open_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +[W::vcf_parse] Contig '@SQ222' is not defined in the header. (Quick workaround: index the file with tabix.) +[W::vcf_parse] FILTER '*' is not defined in the header +[W::vcf_parse] INFO '+0' is not defined in the header, assuming Type=String +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x605a05a698f0 (pc 0x0000005ed68b bp 0x7ffd9d1b0da0 sp 0x7ffd9d1b0d00 T0) +==1==The signal is caused by a READ memory access. + #0 0x5ed68b in vcf_format /src/htslib/vcf.c:2852:44 + #1 0x5e0795 in vcf_write /src/htslib/vcf.c:2932:9 + #2 0x5dffc8 in bcf_write /src/htslib/vcf.c:1710:16 + #3 0x55543d in view_vcf /src/htslib/test/fuzz/hts_open_fuzzer.c:122:13 + #4 0x554f36 in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:169:13 + #5 0x4594d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x4594d3) + #6 0x444da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #7 0x44a9ae in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a9ae) + #8 0x474142 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f8f6949683f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + #10 0x420048 in _start (/out/hts_open_fuzzer+0x420048) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/htslib/vcf.c:2852:44 in vcf_format +==1==ABORTING diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2020-1301.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2020-1301.txt new file mode 100644 index 000000000..5a8b42dcf --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2020-1301.txt @@ -0,0 +1,77 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1940712280 +INFO: Loaded 1 modules (17793 inline 8-bit counters): 17793 [0x9c7a70, 0x9cbff1), +INFO: Loaded 1 PC tables (17793 PCs): 17793 [0x7142d0,0x759ae0), +/out/hts_open_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000833 at pc 0x0000005211c7 bp 0x7ffdc249ce10 sp 0x7ffdc249c5d8 +READ of size 36 at 0x604000000833 thread T0 + #0 0x5211c6 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x6baf8f in hts_md5_update /src/htslib/md5.c + #2 0x6142ef in cram_decode_slice /src/htslib/cram/cram_decode.c:2315:17 + #3 0x61e8d0 in cram_decode_slice_mt /src/htslib/cram/cram_decode.c:2797:16 + #4 0x61f48a in cram_next_slice /src/htslib/cram/cram_decode.c:3183:13 + #5 0x61ec52 in cram_get_seq /src/htslib/cram/cram_decode.c:3280:23 + #6 0x6208fc in cram_get_bam_seq /src/htslib/cram/cram_decode.c:3342:16 + #7 0x5b08f3 in sam_read1 /src/htslib/sam.c:2737:19 + #8 0x55522d in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c:87:12 + #9 0x554f8e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:166:13 + #10 0x4594d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x4594d3) + #11 0x444da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #12 0x44a9ae in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a9ae) + #13 0x474142 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f87dab2983f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + #15 0x420048 in _start (/out/hts_open_fuzzer+0x420048) + +0x604000000833 is located 0 bytes to the right of 35-byte region [0x604000000810,0x604000000833) +allocated by thread T0 here: + #0 0x521e0d in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x655622 in cram_read_block /src/htslib/cram/cram_io.c:861:25 + #2 0x666b58 in cram_read_slice /src/htslib/cram/cram_io.c:3658:29 + #3 0x61fc47 in cram_next_slice /src/htslib/cram/cram_decode.c:3140:44 + #4 0x61ec52 in cram_get_seq /src/htslib/cram/cram_decode.c:3280:23 + #5 0x6208fc in cram_get_bam_seq /src/htslib/cram/cram_decode.c:3342:16 + #6 0x5b08f3 in sam_read1 /src/htslib/sam.c:2737:19 + #7 0x55522d in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c:87:12 + #8 0x554f8e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:166:13 + #9 0x4594d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x4594d3) + #10 0x444da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44a9ae in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a9ae) + #12 0x474142 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f87dab2983f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c087fff80b0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x0c087fff80c0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x0c087fff80d0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x0c087fff80e0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x0c087fff80f0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa +=>0x0c087fff8100: fa fa 00 00 00 00[03]fa fa fa fa fa fa fa fa fa + 0x0c087fff8110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2020-1733.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2020-1733.txt new file mode 100644 index 000000000..37d0e5b2f --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2020-1733.txt @@ -0,0 +1,75 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1940946747 +INFO: Loaded 1 modules (17793 inline 8-bit counters): 17793 [0x9c7a70, 0x9cbff1), +INFO: Loaded 1 PC tables (17793 PCs): 17793 [0x7142d0,0x759ae0), +/out/hts_open_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +[W::bcf_hdr_parse] The first line should be ##fileformat; is the VCF/BCF header broken? +[W::bcf_record_check] Bad BCF record: Invalid CONTIG id 39424 +[W::bcf_record_check] Bad BCF record: Invalid ID type 3 (int (32 bit)) +[W::bcf_record_check] Bad BCF record: Invalid FILTER id 858993459 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000004e51 at pc 0x0000005e3a11 bp 0x7ffec2d20c00 sp 0x7ffec2d20bf8 +READ of size 4 at 0x602000004e51 thread T0 + #0 0x5e3a10 in le_to_u32 /src/htslib/./htslib/hts_endian.h:136:12 + #1 0x5e39d0 in le_to_i32 /src/htslib/./htslib/hts_endian.h:244:18 + #2 0x600894 in bcf_dec_typed_int1_safe /src/htslib/vcf.c:1245:16 + #3 0x5dd7cb in bcf_record_check /src/htslib/vcf.c:1375:13 + #4 0x5dbf42 in bcf_read /src/htslib/vcf.c:1451:25 + #5 0x55541d in view_vcf /src/htslib/test/fuzz/hts_open_fuzzer.c:121:12 + #6 0x554f36 in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:169:13 + #7 0x4594d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x4594d3) + #8 0x444da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44a9ae in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a9ae) + #10 0x474142 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7efdd358a83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + #12 0x420048 in _start (/out/hts_open_fuzzer+0x420048) + +0x602000004e54 is located 0 bytes to the right of 4-byte region [0x602000004e50,0x602000004e54) +allocated by thread T0 here: + #0 0x522103 in realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:164:3 + #1 0x5e2f55 in ks_resize /src/htslib/./htslib/kstring.h:142:16 + #2 0x5dc21d in bcf_read1_core /src/htslib/vcf.c:1203:9 + #3 0x5dbf18 in bcf_read /src/htslib/vcf.c:1450:15 + #4 0x55541d in view_vcf /src/htslib/test/fuzz/hts_open_fuzzer.c:121:12 + #5 0x554f36 in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:169:13 + #6 0x4594d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x4594d3) + #7 0x444da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #8 0x44a9ae in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a9ae) + #9 0x474142 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7efdd358a83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/htslib/./htslib/hts_endian.h:136:12 in le_to_u32 +Shadow bytes around the buggy address: + 0x0c047fff8970: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 00 00 + 0x0c047fff8980: fa fa 05 fa fa fa 00 00 fa fa 00 02 fa fa 07 fa + 0x0c047fff8990: fa fa fd fa fa fa fd fa fa fa 03 fa fa fa 05 fa + 0x0c047fff89a0: fa fa fd fd fa fa fd fd fa fa 00 04 fa fa 05 fa + 0x0c047fff89b0: fa fa 04 fa fa fa 00 00 fa fa 04 fa fa fa 02 fa +=>0x0c047fff89c0: fa fa 00 fa fa fa fd fd fa fa[04]fa fa fa fa fa + 0x0c047fff89d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff89e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff89f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2020-958.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2020-958.txt new file mode 100644 index 000000000..46e642922 --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2020-958.txt @@ -0,0 +1,73 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1939443243 +INFO: Loaded 1 modules (17793 inline 8-bit counters): 17793 [0x9c7a70, 0x9cbff1), +INFO: Loaded 1 PC tables (17793 PCs): 17793 [0x7142d0,0x759ae0), +/out/hts_open_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +[W::bam_hdr_read] EOF marker is absent. The input is probably truncated +[W::sam_hdr_sanitise] Unexpected NUL character in header. Possibly truncated +[E::bam_read1] ================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000000480 at pc 0x0000004c4f3d bp 0x7ffe76a90fc0 sp 0x7ffe76a90740 +READ of size 65 at 0x606000000480 thread T0 + #0 0x4c4f3c in printf_common(void*, char const*, __va_list_tag*) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 + #1 0x57a783 in hts_log /src/htslib/hts.c:3861:9 + #2 0x5a0e94 in bam_read1 /src/htslib/sam.c:596:13 + #3 0x5b097a in sam_read1 /src/htslib/sam.c:2725:17 + #4 0x55522d in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c:87:12 + #5 0x554f8e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:166:13 + #6 0x4594d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x4594d3) + #7 0x444da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #8 0x44a9ae in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a9ae) + #9 0x474142 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f1fa000a83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + #11 0x420048 in _start (/out/hts_open_fuzzer+0x420048) + +0x606000000480 is located 0 bytes to the right of 64-byte region [0x606000000440,0x606000000480) +allocated by thread T0 here: + #0 0x522103 in realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:164:3 + #1 0x59f6dd in sam_realloc_bam_data /src/htslib/sam.c:387:20 + #2 0x59fc20 in realloc_bam_data /src/htslib/./sam_internal.h:45:12 + #3 0x5a08b5 in bam_read1 /src/htslib/sam.c:576:9 + #4 0x5b097a in sam_read1 /src/htslib/sam.c:2725:17 + #5 0x55522d in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c:87:12 + #6 0x554f8e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:166:13 + #7 0x4594d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x4594d3) + #8 0x444da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44a9ae in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a9ae) + #10 0x474142 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f1fa000a83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 in printf_common(void*, char const*, __va_list_tag*) +Shadow bytes around the buggy address: + 0x0c0c7fff8040: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c7fff8050: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 fa + 0x0c0c7fff8060: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa + 0x0c0c7fff8070: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c7fff8080: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00 +=>0x0c0c7fff8090:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2020-998.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2020-998.txt new file mode 100644 index 000000000..7a21e8d52 --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2020-998.txt @@ -0,0 +1,77 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1939688806 +INFO: Loaded 1 modules (17793 inline 8-bit counters): 17793 [0x9c7a70, 0x9cbff1), +INFO: Loaded 1 PC tables (17793 PCs): 17793 [0x7142d0,0x759ae0), +/out/hts_open_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000833 at pc 0x0000005211c7 bp 0x7ffdd2d93770 sp 0x7ffdd2d92f38 +READ of size 36 at 0x604000000833 thread T0 + #0 0x5211c6 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x6baf8f in hts_md5_update /src/htslib/md5.c + #2 0x6142ef in cram_decode_slice /src/htslib/cram/cram_decode.c:2315:17 + #3 0x61e8d0 in cram_decode_slice_mt /src/htslib/cram/cram_decode.c:2797:16 + #4 0x61f48a in cram_next_slice /src/htslib/cram/cram_decode.c:3183:13 + #5 0x61ec52 in cram_get_seq /src/htslib/cram/cram_decode.c:3280:23 + #6 0x6208fc in cram_get_bam_seq /src/htslib/cram/cram_decode.c:3342:16 + #7 0x5b08f3 in sam_read1 /src/htslib/sam.c:2737:19 + #8 0x55522d in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c:87:12 + #9 0x554f8e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:166:13 + #10 0x4594d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x4594d3) + #11 0x444da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #12 0x44a9ae in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a9ae) + #13 0x474142 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7fc73f23c83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + #15 0x420048 in _start (/out/hts_open_fuzzer+0x420048) + +0x604000000833 is located 0 bytes to the right of 35-byte region [0x604000000810,0x604000000833) +allocated by thread T0 here: + #0 0x521e0d in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x655622 in cram_read_block /src/htslib/cram/cram_io.c:861:25 + #2 0x666b58 in cram_read_slice /src/htslib/cram/cram_io.c:3658:29 + #3 0x61fc47 in cram_next_slice /src/htslib/cram/cram_decode.c:3140:44 + #4 0x61ec52 in cram_get_seq /src/htslib/cram/cram_decode.c:3280:23 + #5 0x6208fc in cram_get_bam_seq /src/htslib/cram/cram_decode.c:3342:16 + #6 0x5b08f3 in sam_read1 /src/htslib/sam.c:2737:19 + #7 0x55522d in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c:87:12 + #8 0x554f8e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:166:13 + #9 0x4594d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x4594d3) + #10 0x444da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44a9ae in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a9ae) + #12 0x474142 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fc73f23c83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c087fff80b0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x0c087fff80c0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x0c087fff80d0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x0c087fff80e0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x0c087fff80f0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa +=>0x0c087fff8100: fa fa 00 00 00 00[03]fa fa fa fa fa fa fa fa fa + 0x0c087fff8110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2020-999.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2020-999.txt new file mode 100644 index 000000000..b9ae0e4a3 --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2020-999.txt @@ -0,0 +1,32 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 919865392 +INFO: Loaded 1 modules (17793 inline 8-bit counters): 17793 [0x9c7a70, 0x9cbff1), +INFO: Loaded 1 PC tables (17793 PCs): 17793 [0x7142d0,0x759ae0), +/out/hts_open_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +[W::vcf_parse] Contig '@SQ' is not defined in the header. (Quick workaround: index the file with tabix.) +[W::vcf_parse] FILTER 'AF:dx##' is not defined in the header +[W::vcf_parse] INFO 'L�:S�Q' is not defined in the header, assuming Type=String +[W::vcf_parse_format] FORMAT 'AN' is not defined in the header, assuming Type=String +[W::vcf_parse_format] FORMAT '՛*��AN' is not defined in the header, assuming Type=String +[W::vcf_parse_format] FORMAT '՛*�@S�' is not defined in the header, assuming Type=String +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x7fa49d76c5c8 (pc 0x0000005e9a1a bp 0x7ffce457dc10 sp 0x7ffce457daa0 T0) +==1==The signal is caused by a WRITE memory access. + #0 0x5e9a1a in vcf_parse_format /src/htslib/vcf.c:2396:41 + #1 0x5e6690 in vcf_parse /src/htslib/vcf.c:2687:20 + #2 0x5dc01d in vcf_read /src/htslib/vcf.c:2705:12 + #3 0x5dbeed in bcf_read /src/htslib/vcf.c:1449:42 + #4 0x55541d in view_vcf /src/htslib/test/fuzz/hts_open_fuzzer.c:121:12 + #5 0x554f36 in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:169:13 + #6 0x4594d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x4594d3) + #7 0x444da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #8 0x44a9ae in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a9ae) + #9 0x474142 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fa62a22783f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + #11 0x420048 in _start (/out/hts_open_fuzzer+0x420048) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/htslib/vcf.c:2396:41 in vcf_parse_format +==1==ABORTING diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2023-1370.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2023-1370.txt new file mode 100644 index 000000000..73e7ed595 --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2023-1370.txt @@ -0,0 +1,81 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1941204365 +INFO: Loaded 1 modules (17793 inline 8-bit counters): 17793 [0x9c7a70, 0x9cbff1), +INFO: Loaded 1 PC tables (17793 PCs): 17793 [0x7142d0,0x759ae0), +/out/hts_open_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +[W::bam_hdr_read] EOF marker is absent. The input is probably truncated +[E::bam_aux_get] Corrupted aux data for read +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000050f7 at pc 0x0000006479e6 bp 0x7fffd1478890 sp 0x7fffd1478888 +READ of size 1 at 0x6020000050f7 thread T0 + #0 0x6479e5 in cram_encode_aux /src/htslib/cram/cram_encode.c:2519:42 + #1 0x6339fe in process_one_read /src/htslib/cram/cram_encode.c:3052:14 + #2 0x62b0c8 in cram_encode_container /src/htslib/cram/cram_encode.c:1411:17 + #3 0x665522 in cram_flush_container /src/htslib/cram/cram_io.c:3268:14 + #4 0x665db8 in cram_flush_container_mt /src/htslib/cram/cram_io.c:3363:16 + #5 0x66c897 in cram_close /src/htslib/cram/cram_io.c:4457:19 + #6 0x57e36a in hts_close /src/htslib/hts.c:1136:15 + #7 0x5554c2 in hts_close_or_abort /src/htslib/test/fuzz/hts_open_fuzzer.c:40:9 + #8 0x55528b in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c + #9 0x554f8e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:166:13 + #10 0x4594d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x4594d3) + #11 0x444da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #12 0x44a9ae in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a9ae) + #13 0x474142 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7fdc89c9183f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + #15 0x420048 in _start (/out/hts_open_fuzzer+0x420048) + +0x6020000050f7 is located 0 bytes to the right of 7-byte region [0x6020000050f0,0x6020000050f7) +allocated by thread T0 here: + #0 0x521e0d in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x6450ed in cram_encode_aux /src/htslib/cram/cram_encode.c:2252:15 + #2 0x6339fe in process_one_read /src/htslib/cram/cram_encode.c:3052:14 + #3 0x62b0c8 in cram_encode_container /src/htslib/cram/cram_encode.c:1411:17 + #4 0x665522 in cram_flush_container /src/htslib/cram/cram_io.c:3268:14 + #5 0x665db8 in cram_flush_container_mt /src/htslib/cram/cram_io.c:3363:16 + #6 0x66c897 in cram_close /src/htslib/cram/cram_io.c:4457:19 + #7 0x57e36a in hts_close /src/htslib/hts.c:1136:15 + #8 0x5554c2 in hts_close_or_abort /src/htslib/test/fuzz/hts_open_fuzzer.c:40:9 + #9 0x55528b in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c + #10 0x554f8e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:166:13 + #11 0x4594d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x4594d3) + #12 0x444da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #13 0x44a9ae in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a9ae) + #14 0x474142 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7fdc89c9183f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/htslib/cram/cram_encode.c:2519:42 in cram_encode_aux +Shadow bytes around the buggy address: + 0x0c047fff89c0: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fd + 0x0c047fff89d0: fa fa 00 fa fa fa 04 fa fa fa 03 fa fa fa 00 07 + 0x0c047fff89e0: fa fa 00 00 fa fa 04 fa fa fa 00 00 fa fa 00 00 + 0x0c047fff89f0: fa fa 04 fa fa fa 00 00 fa fa 00 00 fa fa fd fa + 0x0c047fff8a00: fa fa 00 00 fa fa 04 fa fa fa fd fa fa fa fd fa +=>0x0c047fff8a10: fa fa fd fd fa fa 00 fa fa fa 00 fa fa fa[07]fa + 0x0c047fff8a20: fa fa 04 fa fa fa 00 00 fa fa 04 fa fa fa 00 00 + 0x0c047fff8a30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8a40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8a50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8a60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2024-1212.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2024-1212.txt new file mode 100644 index 000000000..e576efada --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2024-1212.txt @@ -0,0 +1,78 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1942180798 +INFO: Loaded 1 modules (17793 inline 8-bit counters): 17793 [0x9c7a70, 0x9cbff1), +INFO: Loaded 1 PC tables (17793 PCs): 17793 [0x7142d0,0x759ae0), +/out/hts_open_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +[W::sam_hdr_create] SQ header line has more than one SN: tag +[E::cram_get_ref] Failed to populate reference for id 0 +[W::sam_parse1] empty query name +[W::sam_parse1] urecognized reference name; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000050e8 at pc 0x000000630209 bp 0x7fff6b3b5d30 sp 0x7fff6b3b5d28 +READ of size 8 at 0x6020000050e8 thread T0 + #0 0x630208 in cram_encode_container /src/htslib/cram/cram_encode.c:1379:34 + #1 0x665522 in cram_flush_container /src/htslib/cram/cram_io.c:3268:14 + #2 0x63a719 in cram_next_container /src/htslib/cram/cram_encode.c:2653:23 + #3 0x6395b9 in cram_put_bam_seq /src/htslib/cram/cram_encode.c:3354:30 + #4 0x5b4ba6 in sam_write1 /src/htslib/sam.c:3049:16 + #5 0x55524d in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c:88:13 + #6 0x554f8e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:166:13 + #7 0x4594d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x4594d3) + #8 0x444da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44a9ae in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a9ae) + #10 0x474142 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f4477faf83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + #12 0x420048 in _start (/out/hts_open_fuzzer+0x420048) + +0x6020000050e8 is located 8 bytes to the left of 8-byte region [0x6020000050f0,0x6020000050f8) +allocated by thread T0 here: + #0 0x521fa2 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:154:3 + #1 0x65b40f in refs2id /src/htslib/cram/cram_io.c:1883:17 + #2 0x669ce3 in cram_write_SAM_hdr /src/htslib/cram/cram_io.c:4123:15 + #3 0x5a8fe8 in sam_hdr_write /src/htslib/sam.c:1520:13 + #4 0x5551ee in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c:76:9 + #5 0x554f8e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:166:13 + #6 0x4594d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x4594d3) + #7 0x444da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #8 0x44a9ae in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a9ae) + #9 0x474142 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f4477faf83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/htslib/cram/cram_encode.c:1379:34 in cram_encode_container +Shadow bytes around the buggy address: + 0x0c047fff89c0: fa fa fd fa fa fa fd fa fa fa fd fd fa fa 00 fa + 0x0c047fff89d0: fa fa 04 fa fa fa 01 fa fa fa 00 07 fa fa 00 00 + 0x0c047fff89e0: fa fa 04 fa fa fa 00 00 fa fa 00 00 fa fa 04 fa + 0x0c047fff89f0: fa fa 00 00 fa fa 00 00 fa fa fd fa fa fa 00 00 + 0x0c047fff8a00: fa fa 04 fa fa fa fd fa fa fa fd fa fa fa fd fd +=>0x0c047fff8a10: fa fa fd fa fa fa fd fa fa fa fd fd fa[fa]00 fa + 0x0c047fff8a20: fa fa fd fa fa fa fd fd fa fa 00 fa fa fa 00 00 + 0x0c047fff8a30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8a40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8a50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8a60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2024-189.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2024-189.txt new file mode 100644 index 000000000..dd02b1daa --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2024-189.txt @@ -0,0 +1,46 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1941951598 +INFO: Loaded 1 modules (17793 inline 8-bit counters): 17793 [0x9c7a70, 0x9cbff1), +INFO: Loaded 1 PC tables (17793 PCs): 17793 [0x7142d0,0x759ae0), +/out/hts_open_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +[W::vcf_parse] Contig '' is not defined in the header. (Quick workaround: index the file with tabix.) +[W::vcf_parse] FILTER '' is not defined in the header +[W::vcf_parse_format] FORMAT '' is not defined in the header, assuming Type=String +================================================================= +==1==ERROR: AddressSanitizer: negative-size-param: (size=-1) + #0 0x521164 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x5e0c03 in kputsn /src/htslib/./htslib/kstring.h:221:2 + #2 0x5ea275 in vcf_parse_format /src/htslib/vcf.c:2422:17 + #3 0x5e6690 in vcf_parse /src/htslib/vcf.c:2687:20 + #4 0x5dc01d in vcf_read /src/htslib/vcf.c:2705:12 + #5 0x5dbeed in bcf_read /src/htslib/vcf.c:1449:42 + #6 0x55541d in view_vcf /src/htslib/test/fuzz/hts_open_fuzzer.c:121:12 + #7 0x554f36 in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:169:13 + #8 0x4594d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x4594d3) + #9 0x444da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #10 0x44a9ae in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a9ae) + #11 0x474142 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f6b91cb183f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + #13 0x420048 in _start (/out/hts_open_fuzzer+0x420048) + +0x602000005518 is located 8 bytes inside of 16-byte region [0x602000005510,0x602000005520) +allocated by thread T0 here: + #0 0x522103 in realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:164:3 + #1 0x5e2f55 in ks_resize /src/htslib/./htslib/kstring.h:142:16 + #2 0x5e0bbb in kputsn /src/htslib/./htslib/kstring.h:219:24 + #3 0x60159f in align_mem /src/htslib/vcf.c:2153:13 + #4 0x5e839e in vcf_parse_format /src/htslib/vcf.c:2295:9 + #5 0x5e6690 in vcf_parse /src/htslib/vcf.c:2687:20 + #6 0x5dc01d in vcf_read /src/htslib/vcf.c:2705:12 + #7 0x5dbeed in bcf_read /src/htslib/vcf.c:1449:42 + #8 0x55541d in view_vcf /src/htslib/test/fuzz/hts_open_fuzzer.c:121:12 + #9 0x554f36 in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:169:13 + #10 0x4594d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x4594d3) + #11 0x444da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #12 0x44a9ae in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a9ae) + #13 0x474142 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f6b91cb183f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + +SUMMARY: AddressSanitizer: negative-size-param /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +==1==ABORTING diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2024-20.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2024-20.txt new file mode 100644 index 000000000..314a4eb72 --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2024-20.txt @@ -0,0 +1,78 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1941458865 +INFO: Loaded 1 modules (17793 inline 8-bit counters): 17793 [0x9c7a70, 0x9cbff1), +INFO: Loaded 1 PC tables (17793 PCs): 17793 [0x7142d0,0x759ae0), +/out/hts_open_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +[W::bam_hdr_read] EOF marker is absent. The input is probably truncated +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000004db8 at pc 0x0000005b79f8 bp 0x7fffc7e3e980 sp 0x7fffc7e3e978 +READ of size 1 at 0x602000004db8 thread T0 + #0 0x5b79f7 in bam_aux_get /src/htslib/sam.c:3282:47 + #1 0x631429 in process_one_read /src/htslib/cram/cram_encode.c:2768:10 + #2 0x62b0c8 in cram_encode_container /src/htslib/cram/cram_encode.c:1411:17 + #3 0x665522 in cram_flush_container /src/htslib/cram/cram_io.c:3268:14 + #4 0x665db8 in cram_flush_container_mt /src/htslib/cram/cram_io.c:3363:16 + #5 0x66c897 in cram_close /src/htslib/cram/cram_io.c:4457:19 + #6 0x57e36a in hts_close /src/htslib/hts.c:1136:15 + #7 0x5554c2 in hts_close_or_abort /src/htslib/test/fuzz/hts_open_fuzzer.c:40:9 + #8 0x55528b in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c + #9 0x554f8e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:166:13 + #10 0x4594d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x4594d3) + #11 0x444da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #12 0x44a9ae in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a9ae) + #13 0x474142 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7fc34143083f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + #15 0x420048 in _start (/out/hts_open_fuzzer+0x420048) + +0x602000004db8 is located 0 bytes to the right of 8-byte region [0x602000004db0,0x602000004db8) +allocated by thread T0 here: + #0 0x522103 in realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:164:3 + #1 0x59f6dd in sam_realloc_bam_data /src/htslib/sam.c:387:20 + #2 0x59fc20 in realloc_bam_data /src/htslib/./sam_internal.h:45:12 + #3 0x59fa61 in bam_copy1 /src/htslib/sam.c:421:9 + #4 0x59fc8e in bam_dup1 /src/htslib/sam.c:434:9 + #5 0x639b98 in cram_put_bam_seq /src/htslib/cram/cram_encode.c:3437:34 + #6 0x5b4ba6 in sam_write1 /src/htslib/sam.c:3049:16 + #7 0x55524d in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c:88:13 + #8 0x554f8e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:166:13 + #9 0x4594d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x4594d3) + #10 0x444da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44a9ae in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a9ae) + #12 0x474142 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fc34143083f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/htslib/sam.c:3282:47 in bam_aux_get +Shadow bytes around the buggy address: + 0x0c047fff8960: fa fa 00 fa fa fa 00 fa fa fa 00 fa fa fa fd fa + 0x0c047fff8970: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 00 00 + 0x0c047fff8980: fa fa 05 fa fa fa 00 00 fa fa 00 02 fa fa 05 fa + 0x0c047fff8990: fa fa fd fa fa fa fd fd fa fa 02 fa fa fa 00 07 + 0x0c047fff89a0: fa fa fd fa fa fa fd fa fa fa 01 fa fa fa fd fa +=>0x0c047fff89b0: fa fa 00 fa fa fa 00[fa]fa fa fa fa fa fa fa fa + 0x0c047fff89c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff89d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff89e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff89f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2024-74.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2024-74.txt new file mode 100644 index 000000000..24857d26c --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/crashes/OSV-2024-74.txt @@ -0,0 +1,78 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1941696850 +INFO: Loaded 1 modules (17793 inline 8-bit counters): 17793 [0x9c7a70, 0x9cbff1), +INFO: Loaded 1 PC tables (17793 PCs): 17793 [0x7142d0,0x759ae0), +/out/hts_open_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +[W::bam_hdr_read] EOF marker is absent. The input is probably truncated +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x615000000c80 at pc 0x000000647773 bp 0x7ffee3c56dd0 sp 0x7ffee3c56dc8 +READ of size 1 at 0x615000000c80 thread T0 + #0 0x647772 in cram_encode_aux /src/htslib/cram/cram_encode.c:2263:20 + #1 0x6339fe in process_one_read /src/htslib/cram/cram_encode.c:3052:14 + #2 0x62b0c8 in cram_encode_container /src/htslib/cram/cram_encode.c:1411:17 + #3 0x665522 in cram_flush_container /src/htslib/cram/cram_io.c:3268:14 + #4 0x665db8 in cram_flush_container_mt /src/htslib/cram/cram_io.c:3363:16 + #5 0x66c897 in cram_close /src/htslib/cram/cram_io.c:4457:19 + #6 0x57e36a in hts_close /src/htslib/hts.c:1136:15 + #7 0x5554c2 in hts_close_or_abort /src/htslib/test/fuzz/hts_open_fuzzer.c:40:9 + #8 0x55528b in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c + #9 0x554f8e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:166:13 + #10 0x4594d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x4594d3) + #11 0x444da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #12 0x44a9ae in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a9ae) + #13 0x474142 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f4344ee183f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + #15 0x420048 in _start (/out/hts_open_fuzzer+0x420048) + +0x615000000c80 is located 0 bytes to the right of 512-byte region [0x615000000a80,0x615000000c80) +allocated by thread T0 here: + #0 0x522103 in realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:164:3 + #1 0x59f6dd in sam_realloc_bam_data /src/htslib/sam.c:387:20 + #2 0x59fc20 in realloc_bam_data /src/htslib/./sam_internal.h:45:12 + #3 0x59fa61 in bam_copy1 /src/htslib/sam.c:421:9 + #4 0x59fc8e in bam_dup1 /src/htslib/sam.c:434:9 + #5 0x639b98 in cram_put_bam_seq /src/htslib/cram/cram_encode.c:3437:34 + #6 0x5b4ba6 in sam_write1 /src/htslib/sam.c:3049:16 + #7 0x55524d in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c:88:13 + #8 0x554f8e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:166:13 + #9 0x4594d3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x4594d3) + #10 0x444da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44a9ae in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a9ae) + #12 0x474142 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f4344ee183f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/htslib/cram/cram_encode.c:2263:20 in cram_encode_aux +Shadow bytes around the buggy address: + 0x0c2a7fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff8150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c2a7fff8190:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff81a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff81b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/COMMANDS.md b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/COMMANDS.md new file mode 100644 index 000000000..f9eb989ec --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/COMMANDS.md @@ -0,0 +1,113 @@ +# Original Crash Collection: htslib hts_open_fuzzer + +Generated: 2026-04-24 UTC + +Benchmark: `htslib_transplant_hts_open_fuzzer` +Project: `htslib` +Fuzzer: `hts_open_fuzzer` +Sanitizer: `address` + +Target source commit: `dd6f0b72c92591252bb77818663629cc1a129949` (2019-10-11) +Target OSS-Fuzz commit: `c15017cf4f41014630be236bed440fd2995c2de7` (from `/home/user/log/htslib_builds.csv`) +Target-era base-runner: `gcr.io/oss-fuzz-base/base-runner@sha256:caba4ce727f6dfe43a68b4554efdd617052ad3b634bbc6e28b97f6e3ca1a92ac` (2019-12, from `get_base_runner_for_date()`) + +## Semantics + +Each `OSV-*.txt` is a crash on the pristine source tree: + +- **Local bugs** (already triggering at the target commit, 2019-10) were replayed + against a **freshly-built** `-address` binary at target commit, using the + era-matched OSS-Fuzz base-builder (`c15017cf4f41...`) from + `/home/user/log/htslib_builds.csv`. The NAS prebuilt binary at + `/mnt/nas/linke/htslib/htslib-dd6f0b72c925...-address/` was built with a + modern OSS-Fuzz toolchain and requires `libcrypto.so.1.1` which the 2019-era + base-runner does not ship. Rebuilding at target with the era-matched OSS-Fuzz + commit produces a binary compatible with the 2019-era base-runner. +- **Migration bugs** were captured per-bug at their own buggy source commits during + the migration pipeline (`fuzz_helper.py collect_crash --runner-image auto`) which + era-matches the runner per source commit. Logs are copied from + `/mnt/nas/linke/new_migrate/htslib/hts_open_fuzzer/crash/`. + +## Bug → source commit / OSS-Fuzz commit + +| Bug | Kind | Source commit | OSS-Fuzz commit | +| --- | --- | --- | --- | +| OSV-2020-1121 | local | `dd6f0b72c925` | `c15017cf4f41` | +| OSV-2020-1301 | local | `dd6f0b72c925` | `c15017cf4f41` | +| OSV-2020-1733 | migration | `34ba6c726925` | `488d1d35d93c` | +| OSV-2020-958 | local | `dd6f0b72c925` | `c15017cf4f41` | +| OSV-2020-998 | local | `dd6f0b72c925` | `c15017cf4f41` | +| OSV-2020-999 | local | `dd6f0b72c925` | `c15017cf4f41` | +| OSV-2023-1370 | migration | `61b037bb881e` | `84fed7c8f7fb` | +| OSV-2024-1212 | migration | `ca920611fcd8` | `0b69e19c1c00` | +| OSV-2024-189 | migration | `ca0f6214b94a` | `051851826637` | +| OSV-2024-20 | migration | `31e5a5f972b1` | `163e36a5b15e` | +| OSV-2024-74 | migration | `65ae5744347c` | `c58ac449237f` | + +## Re-run command (migration bugs) + +```bash +BUILD_CSV='/home/user/oss-fuzz-build/fuzzbench/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/collect_crash_builds.csv' +OUT_DIR='/home/user/oss-fuzz-build/fuzzbench/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes' + +while IFS=$'\t' read -r bug commit; do + [ "$bug" = "bug" ] && continue + ts=$(git -C /home/user/tasks-git/htslib log -1 --format=%ct "$commit") + /home/user/pyenv/venv/bin/python3 /home/user/oss-fuzz-for-select/script/fuzz_helper.py collect_crash \ + --commit "$commit" \ + --build_csv "$BUILD_CSV" \ + --testcases /home/user/oss-fuzz-for-select/pocs/tmp \ + --test_input "testcase-${bug}" \ + --runner-image auto --commit-date "$ts" \ + htslib hts_open_fuzzer + cp "/home/user/oss-fuzz-build/data/crash/target_crash-${commit:0:6}-testcase-${bug}.txt" "${OUT_DIR}/${bug}.txt" +done <<'JOBS' +bug commit +OSV-2020-1733 34ba6c726925efceaa2cc995d7d4b0409907f331 +OSV-2023-1370 61b037bb881e85259f8df30c78d99ad3a357ed52 +OSV-2024-1212 ca920611fcd8be1180045589ac11bff2f04eafd8 +OSV-2024-189 ca0f6214b94adf9278cbcaaefd50f5fe9455f9ad +OSV-2024-20 31e5a5f972b137ec3738bfd565652270904f7112 +OSV-2024-74 65ae5744347c9403c061585fa2fc9f5262f2f977 +JOBS +``` + +## Re-run command (local bugs) + +Fresh-build at target commit via `fuzz_helper.py build_version` (picks OSS-Fuzz +commit from `htslib_builds.csv`), then replay each PoC against the freshly built +binary using the 2019-era base-runner. + +```bash +TARGET=dd6f0b72c92591252bb77818663629cc1a129949 +RUNNER_IMAGE='gcr.io/oss-fuzz-base/base-runner@sha256:caba4ce727f6dfe43a68b4554efdd617052ad3b634bbc6e28b97f6e3ca1a92ac' +OUT_DIR='/home/user/oss-fuzz-build/fuzzbench/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes' + +# 1. Build at target commit with era-matched OSS-Fuzz +ts=$(git -C /home/user/tasks-git/htslib log -1 --format=%ct "$TARGET") +sudo -E /home/user/pyenv/venv/bin/python3 /home/user/oss-fuzz-for-select/script/fuzz_helper.py build_version \ + htslib --commit "$TARGET" \ + --build_csv /home/user/log/htslib_builds.csv \ + --runner-image auto --commit-date "$ts" --no_corpus +BIN_DIR=/home/user/oss-fuzz-build/build/out/htslib + +# 2. Replay each local bug +for bug in \ + OSV-2020-1121 \ + OSV-2020-1301 \ + OSV-2020-958 \ + OSV-2020-998 \ + OSV-2020-999 +; do + TMPD=$(mktemp -d) + cp /home/user/oss-fuzz-for-select/pocs/tmp/testcase-${bug} "$TMPD/" + docker run --rm --platform linux/amd64 --shm-size=2g \ + -v "$BIN_DIR":/out:ro -v "$TMPD":/corpus:ro \ + -e ASAN_OPTIONS=abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 \ + "$RUNNER_IMAGE" \ + /out/hts_open_fuzzer "/corpus/testcase-${bug}" -rss_limit_mb=8192 \ + > "${OUT_DIR}/${bug}.txt" 2>&1 + rm -rf "$TMPD" +done +``` + diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2020-1121.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2020-1121.txt new file mode 100644 index 000000000..8815a67ad --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2020-1121.txt @@ -0,0 +1,28 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2901879079 +INFO: Loaded 1 modules (17745 inline 8-bit counters): 17745 [0x9c69f0, 0x9caf41), +INFO: Loaded 1 PC tables (17745 PCs): 17745 [0x713350,0x758860), +/out/hts_open_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1121 +[W::vcf_parse] Contig '@SQ222' is not defined in the header. (Quick workaround: index the file with tabix.) +[W::vcf_parse] FILTER '*' is not defined in the header +[W::vcf_parse] INFO '+0' is not defined in the header, assuming Type=String +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x605a05a698f0 (pc 0x0000005ecffb bp 0x7ffd4d3a1ce0 sp 0x7ffd4d3a1c40 T0) +==1==The signal is caused by a READ memory access. + #0 0x5ecffb in vcf_format /src/htslib/vcf.c:2838:44 + #1 0x5e01b5 in vcf_write /src/htslib/vcf.c:2918:9 + #2 0x5df9e8 in bcf_write /src/htslib/vcf.c:1705:16 + #3 0x55515d in view_vcf /src/htslib/test/fuzz/hts_open_fuzzer.c:107:13 + #4 0x554e74 in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:143:13 + #5 0x459483 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x459483) + #6 0x444d52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #7 0x44a95e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a95e) + #8 0x4740f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f20e471982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #10 0x41fff8 in _start (/out/hts_open_fuzzer+0x41fff8) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/htslib/vcf.c:2838:44 in vcf_format +==1==ABORTING diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2020-1301.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2020-1301.txt new file mode 100644 index 000000000..df6cad9bc --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2020-1301.txt @@ -0,0 +1,79 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2902151178 +INFO: Loaded 1 modules (17745 inline 8-bit counters): 17745 [0x9c69f0, 0x9caf41), +INFO: Loaded 1 PC tables (17745 PCs): 17745 [0x713350,0x758860), +/out/hts_open_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1301 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000833 at pc 0x000000521177 bp 0x7ffc5ff12370 sp 0x7ffc5ff11b38 +READ of size 36 at 0x604000000833 thread T0 + #0 0x521176 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x6ba06f in hts_md5_update /src/htslib/md5.c + #2 0x613bbf in cram_decode_slice /src/htslib/cram/cram_decode.c:2315:17 + #3 0x61e1a0 in cram_decode_slice_mt /src/htslib/cram/cram_decode.c:2797:16 + #4 0x61ed5a in cram_next_slice /src/htslib/cram/cram_decode.c:3183:13 + #5 0x61e522 in cram_get_seq /src/htslib/cram/cram_decode.c:3280:23 + #6 0x6201cc in cram_get_bam_seq /src/htslib/cram/cram_decode.c:3342:16 + #7 0x5b05d3 in sam_read1 /src/htslib/sam.c:2736:19 + #8 0x554fcd in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c:72:12 + #9 0x554eb6 in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:140:13 + #10 0x459483 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x459483) + #11 0x444d52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #12 0x44a95e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a95e) + #13 0x4740f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7fa0e7b3882f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #15 0x41fff8 in _start (/out/hts_open_fuzzer+0x41fff8) + +0x604000000833 is located 0 bytes to the right of 35-byte region [0x604000000810,0x604000000833) +allocated by thread T0 here: + #0 0x521dbd in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x654b22 in cram_read_block /src/htslib/cram/cram_io.c:860:25 + #2 0x666168 in cram_read_slice /src/htslib/cram/cram_io.c:3657:29 + #3 0x61f517 in cram_next_slice /src/htslib/cram/cram_decode.c:3140:44 + #4 0x61e522 in cram_get_seq /src/htslib/cram/cram_decode.c:3280:23 + #5 0x6201cc in cram_get_bam_seq /src/htslib/cram/cram_decode.c:3342:16 + #6 0x5b05d3 in sam_read1 /src/htslib/sam.c:2736:19 + #7 0x554fcd in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c:72:12 + #8 0x554eb6 in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:140:13 + #9 0x459483 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x459483) + #10 0x444d52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44a95e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a95e) + #12 0x4740f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fa0e7b3882f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c087fff80b0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x0c087fff80c0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x0c087fff80d0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x0c087fff80e0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x0c087fff80f0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa +=>0x0c087fff8100: fa fa 00 00 00 00[03]fa fa fa fa fa fa fa fa fa + 0x0c087fff8110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2020-1733.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2020-1733.txt new file mode 100755 index 000000000..b0c118050 --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2020-1733.txt @@ -0,0 +1,73 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 34151412 +INFO: Loaded 1 modules (18364 inline 8-bit counters): 18364 [0x556762eca668, 0x556762ecee24), +INFO: Loaded 1 PC tables (18364 PCs): 18364 [0x556762ecee28,0x556762f169e8), +/out/hts_open_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2020-1733 +[W::bcf_hdr_parse] The first line should be ##fileformat; is the VCF/BCF header broken? +[W::bcf_record_check] Bad BCF record at 15794177: Invalid CONTIG id 39424 +[W::bcf_record_check] Bad BCF record at (unknown):15794177: Invalid ID type 3 (int (32 bit)) +[W::bcf_record_check] Bad BCF record at (unknown):15794177: Invalid FILTER id 858993459 +================================================================= +==956==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b99cc5e4eb1 at pc 0x556762d51861 bp 0x7ffd116fe6f0 sp 0x7ffd116fe6e8 +READ of size 4 at 0x7b99cc5e4eb1 thread T0 + #0 0x556762d51860 in le_to_u32 /src/htslib/./htslib/hts_endian.h:136:12 + #1 0x556762d6cf11 in bcf_dec_typed_int1_safe /src/htslib/vcf.c:1280:20 + #2 0x556762d4bf4d in bcf_record_check /src/htslib/vcf.c:1439:13 + #3 0x556762d4aa43 in bcf_read /src/htslib/vcf.c:1528:25 + #4 0x556762cc7c8d in view_vcf /src/htslib/test/fuzz/hts_open_fuzzer.c:108:12 + #5 0x556762cc79cf in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:145:13 + #6 0x556762b6524d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x556762b4ffc2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x556762b55e90 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x556762b819c2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f79cdd05082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x556762b490ad in _start (/out/hts_open_fuzzer+0xc70ad) + +0x7b99cc5e4eb4 is located 0 bytes after 4-byte region [0x7b99cc5e4eb0,0x7b99cc5e4eb4) +allocated by thread T0 here: + #0 0x556762c83f8c in realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:81:3 + #1 0x556762d50db3 in ks_resize /src/htslib/./htslib/kstring.h:150:19 + #2 0x556762d4ad08 in bcf_read1_core /src/htslib/vcf.c:1241:9 + #3 0x556762d4aa19 in bcf_read /src/htslib/vcf.c:1527:15 + #4 0x556762cc7c8d in view_vcf /src/htslib/test/fuzz/hts_open_fuzzer.c:108:12 + #5 0x556762cc79cf in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:145:13 + #6 0x556762b6524d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x556762b4ffc2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x556762b55e90 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x556762b819c2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f79cdd05082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/htslib/./htslib/hts_endian.h:136:12 in le_to_u32 +Shadow bytes around the buggy address: + 0x7b99cc5e4c00: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 00 00 + 0x7b99cc5e4c80: fa fa 05 fa fa fa 00 00 fa fa 00 02 fa fa 07 fa + 0x7b99cc5e4d00: fa fa fd fa fa fa fd fa fa fa 03 fa fa fa 05 fa + 0x7b99cc5e4d80: fa fa fd fd fa fa fd fd fa fa 00 04 fa fa 05 fa + 0x7b99cc5e4e00: fa fa 04 fa fa fa 00 00 fa fa 04 fa fa fa 03 fa +=>0x7b99cc5e4e80: fa fa 00 fa fa fa[04]fa fa fa fa fa fa fa fa fa + 0x7b99cc5e4f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b99cc5e4f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b99cc5e5000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b99cc5e5080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b99cc5e5100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==956==ABORTING diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2020-958.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2020-958.txt new file mode 100644 index 000000000..799383b32 --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2020-958.txt @@ -0,0 +1,75 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2902404112 +INFO: Loaded 1 modules (17745 inline 8-bit counters): 17745 [0x9c69f0, 0x9caf41), +INFO: Loaded 1 PC tables (17745 PCs): 17745 [0x713350,0x758860), +/out/hts_open_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-958 +[W::bam_hdr_read] EOF marker is absent. The input is probably truncated +[W::sam_hdr_sanitise] Unexpected NUL character in header. Possibly truncated +[E::bam_read1] ================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000000480 at pc 0x0000004c4eed bp 0x7fff5fcf87e0 sp 0x7fff5fcf7f60 +READ of size 65 at 0x606000000480 thread T0 + #0 0x4c4eec in printf_common(void*, char const*, __va_list_tag*) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 + #1 0x57a463 in hts_log /src/htslib/hts.c:3861:9 + #2 0x5a0b74 in bam_read1 /src/htslib/sam.c:595:13 + #3 0x5b065a in sam_read1 /src/htslib/sam.c:2724:17 + #4 0x554fcd in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c:72:12 + #5 0x554eb6 in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:140:13 + #6 0x459483 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x459483) + #7 0x444d52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #8 0x44a95e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a95e) + #9 0x4740f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f4756cc682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #11 0x41fff8 in _start (/out/hts_open_fuzzer+0x41fff8) + +0x606000000480 is located 0 bytes to the right of 64-byte region [0x606000000440,0x606000000480) +allocated by thread T0 here: + #0 0x5220b3 in realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:164:3 + #1 0x59f3bd in sam_realloc_bam_data /src/htslib/sam.c:386:20 + #2 0x59f900 in realloc_bam_data /src/htslib/./sam_internal.h:45:12 + #3 0x5a0595 in bam_read1 /src/htslib/sam.c:575:9 + #4 0x5b065a in sam_read1 /src/htslib/sam.c:2724:17 + #5 0x554fcd in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c:72:12 + #6 0x554eb6 in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:140:13 + #7 0x459483 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x459483) + #8 0x444d52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44a95e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a95e) + #10 0x4740f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f4756cc682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 in printf_common(void*, char const*, __va_list_tag*) +Shadow bytes around the buggy address: + 0x0c0c7fff8040: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c7fff8050: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 fa + 0x0c0c7fff8060: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa + 0x0c0c7fff8070: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c7fff8080: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00 +=>0x0c0c7fff8090:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2020-998.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2020-998.txt new file mode 100644 index 000000000..d38928372 --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2020-998.txt @@ -0,0 +1,79 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2902670823 +INFO: Loaded 1 modules (17745 inline 8-bit counters): 17745 [0x9c69f0, 0x9caf41), +INFO: Loaded 1 PC tables (17745 PCs): 17745 [0x713350,0x758860), +/out/hts_open_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-998 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000833 at pc 0x000000521177 bp 0x7fff5bca49b0 sp 0x7fff5bca4178 +READ of size 36 at 0x604000000833 thread T0 + #0 0x521176 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x6ba06f in hts_md5_update /src/htslib/md5.c + #2 0x613bbf in cram_decode_slice /src/htslib/cram/cram_decode.c:2315:17 + #3 0x61e1a0 in cram_decode_slice_mt /src/htslib/cram/cram_decode.c:2797:16 + #4 0x61ed5a in cram_next_slice /src/htslib/cram/cram_decode.c:3183:13 + #5 0x61e522 in cram_get_seq /src/htslib/cram/cram_decode.c:3280:23 + #6 0x6201cc in cram_get_bam_seq /src/htslib/cram/cram_decode.c:3342:16 + #7 0x5b05d3 in sam_read1 /src/htslib/sam.c:2736:19 + #8 0x554fcd in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c:72:12 + #9 0x554eb6 in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:140:13 + #10 0x459483 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x459483) + #11 0x444d52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #12 0x44a95e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a95e) + #13 0x4740f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7fdb4edc782f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #15 0x41fff8 in _start (/out/hts_open_fuzzer+0x41fff8) + +0x604000000833 is located 0 bytes to the right of 35-byte region [0x604000000810,0x604000000833) +allocated by thread T0 here: + #0 0x521dbd in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x654b22 in cram_read_block /src/htslib/cram/cram_io.c:860:25 + #2 0x666168 in cram_read_slice /src/htslib/cram/cram_io.c:3657:29 + #3 0x61f517 in cram_next_slice /src/htslib/cram/cram_decode.c:3140:44 + #4 0x61e522 in cram_get_seq /src/htslib/cram/cram_decode.c:3280:23 + #5 0x6201cc in cram_get_bam_seq /src/htslib/cram/cram_decode.c:3342:16 + #6 0x5b05d3 in sam_read1 /src/htslib/sam.c:2736:19 + #7 0x554fcd in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c:72:12 + #8 0x554eb6 in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:140:13 + #9 0x459483 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x459483) + #10 0x444d52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44a95e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a95e) + #12 0x4740f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fdb4edc782f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c087fff80b0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x0c087fff80c0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x0c087fff80d0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x0c087fff80e0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x0c087fff80f0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa +=>0x0c087fff8100: fa fa 00 00 00 00[03]fa fa fa fa fa fa fa fa fa + 0x0c087fff8110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2020-999.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2020-999.txt new file mode 100644 index 000000000..eac20eff6 --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2020-999.txt @@ -0,0 +1,32 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2902948085 +INFO: Loaded 1 modules (17745 inline 8-bit counters): 17745 [0x9c69f0, 0x9caf41), +INFO: Loaded 1 PC tables (17745 PCs): 17745 [0x713350,0x758860), +/out/hts_open_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-999 +[W::vcf_parse] Contig '@SQ' is not defined in the header. (Quick workaround: index the file with tabix.) +[W::vcf_parse] FILTER 'AF:dx##' is not defined in the header +[W::vcf_parse] INFO 'L:SQ' is not defined in the header, assuming Type=String +[W::vcf_parse_format] FORMAT 'AN' is not defined in the header, assuming Type=String +[W::vcf_parse_format] FORMAT '՛*AN' is not defined in the header, assuming Type=String +[W::vcf_parse_format] FORMAT '՛*@S' is not defined in the header, assuming Type=String +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x7fe14ed325c8 (pc 0x0000005e937e bp 0x7ffde1f4ca50 sp 0x7ffde1f4c8e0 T0) +==1==The signal is caused by a WRITE memory access. + #0 0x5e937e in vcf_parse_format /src/htslib/vcf.c:2382:41 + #1 0x5e60b0 in vcf_parse /src/htslib/vcf.c:2673:20 + #2 0x5dba3d in vcf_read /src/htslib/vcf.c:2691:12 + #3 0x5db90d in bcf_read /src/htslib/vcf.c:1444:42 + #4 0x55513d in view_vcf /src/htslib/test/fuzz/hts_open_fuzzer.c:106:12 + #5 0x554e74 in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:143:13 + #6 0x459483 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/hts_open_fuzzer+0x459483) + #7 0x444d52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #8 0x44a95e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/hts_open_fuzzer+0x44a95e) + #9 0x4740f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fe2db72582f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #11 0x41fff8 in _start (/out/hts_open_fuzzer+0x41fff8) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/htslib/vcf.c:2382:41 in vcf_parse_format +==1==ABORTING diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2023-1370.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2023-1370.txt new file mode 100755 index 000000000..9150a7746 --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2023-1370.txt @@ -0,0 +1,84 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 56215421 +INFO: Loaded 1 modules (24278 inline 8-bit counters): 24278 [0x55cea93332e0, 0x55cea93391b6), +INFO: Loaded 1 PC tables (24278 PCs): 24278 [0x55cea93391b8,0x55cea9397f18), +/out/hts_open_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-1370 +[W::bam_hdr_read] EOF marker is absent. The input is probably truncated +[W::bam_hdr_read] EOF marker is absent. The input is probably truncated +[W::bam_hdr_read] EOF marker is absent. The input is probably truncated +[W::cram_get_ref] Failed to populate reference for id 0 +[W::cram_write_SAM_hdr] No M5 tags present and could not find reference +[W::cram_write_SAM_hdr] Enabling embed_ref=2 option +[W::cram_write_SAM_hdr] NOTE: the CRAM file will be bigger than using an external reference +[E::bam_aux_next] Corrupted aux data for read +[E::bam_aux_next] Corrupted aux data for read +[E::bam_aux_next] Corrupted aux data for read +================================================================= +==1053==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7bb7fd3e56b7 at pc 0x55cea91b702e bp 0x7ffd4312e550 sp 0x7ffd4312e548 +READ of size 1 at 0x7bb7fd3e56b7 thread T0 + #0 0x55cea91b702d in cram_encode_aux /src/htslib/cram/cram_encode.c:3109:42 + #1 0x55cea91a2d44 in process_one_read /src/htslib/cram/cram_encode.c:3682:9 + #2 0x55cea9199813 in cram_encode_container /src/htslib/cram/cram_encode.c:2031:17 + #3 0x55cea91d4fed in cram_flush_container /src/htslib/cram/cram_io.c:4147:14 + #4 0x55cea91dc912 in cram_close /src/htslib/cram/cram_io.c:5574:19 + #5 0x55cea90cf821 in hts_close /src/htslib/hts.c:1617:15 + #6 0x55cea90a4cc5 in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c + #7 0x55cea90a4a5e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:203:13 + #8 0x55cea8f4222d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #9 0x55cea8f2cfa2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #10 0x55cea8f32e70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #11 0x55cea8f5e9a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f97febac082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x55cea8f2608d in _start (/out/hts_open_fuzzer+0xf008d) + +0x7bb7fd3e56b7 is located 0 bytes after 7-byte region [0x7bb7fd3e56b0,0x7bb7fd3e56b7) +allocated by thread T0 here: + #0 0x55cea9060b84 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55cea91b40e1 in cram_encode_aux /src/htslib/cram/cram_encode.c:2778:15 + #2 0x55cea91a2d44 in process_one_read /src/htslib/cram/cram_encode.c:3682:9 + #3 0x55cea9199813 in cram_encode_container /src/htslib/cram/cram_encode.c:2031:17 + #4 0x55cea91d4fed in cram_flush_container /src/htslib/cram/cram_io.c:4147:14 + #5 0x55cea91dc912 in cram_close /src/htslib/cram/cram_io.c:5574:19 + #6 0x55cea90cf821 in hts_close /src/htslib/hts.c:1617:15 + #7 0x55cea90a4cc5 in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c + #8 0x55cea90a4a5e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:203:13 + #9 0x55cea8f4222d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #10 0x55cea8f2cfa2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #11 0x55cea8f32e70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #12 0x55cea8f5e9a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f97febac082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/htslib/cram/cram_encode.c:3109:42 in cram_encode_aux +Shadow bytes around the buggy address: + 0x7bb7fd3e5400: fa fa fd fa fa fa fd fd fa fa 00 fa fa fa 04 fa + 0x7bb7fd3e5480: fa fa 03 fa fa fa 00 07 fa fa 00 00 fa fa 04 fa + 0x7bb7fd3e5500: fa fa 00 00 fa fa 00 00 fa fa 04 fa fa fa 00 00 + 0x7bb7fd3e5580: fa fa 00 00 fa fa fd fa fa fa 00 00 fa fa 04 fa + 0x7bb7fd3e5600: fa fa fd fd fa fa 00 fa fa fa fd fa fa fa fd fa +=>0x7bb7fd3e5680: fa fa 00 fa fa fa[07]fa fa fa 04 fa fa fa 00 00 + 0x7bb7fd3e5700: fa fa 04 fa fa fa 00 00 fa fa fa fa fa fa fa fa + 0x7bb7fd3e5780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bb7fd3e5800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bb7fd3e5880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bb7fd3e5900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1053==ABORTING diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2024-1212.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2024-1212.txt new file mode 100755 index 000000000..593cc1b34 --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2024-1212.txt @@ -0,0 +1,253 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 142685459 +INFO: Loaded 1 modules (25537 inline 8-bit counters): 25537 [0x5617f4e8d3e0, 0x5617f4e937a1), +INFO: Loaded 1 PC tables (25537 PCs): 25537 [0x5617f4e937a8,0x5617f4ef73b8), +/out/hts_open_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2024-1212 +[W::sam_hdr_create] SQ header line has more than one SN: tag +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name "85\x1D,665\xA738,,65531S,654385\x1"...; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ":"; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ",M::bwa_idx_load_from_disk,,,,,,,,"...; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ":"; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ",,,,,,,,,,,,,,,,,,,,41553S,655385\"...; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ":"; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ",l,,,,,,,,,,,,,,,,,,41553S,655385\"...; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ":"; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ",l,,,,,,,,,,,,,,,,,,4155,,,,,,,,,,"...; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ":"; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ",,,,,,,,,,,,,,,,,,,,41553S,655385\"...; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ":"; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ",l,,,,,,,,,,,,,,,,,,411S,655385\x1"...; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ",,,,,,5385\x1D,66fai8,,65531S,565385"; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ":"; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ",,,,,,,,,,,,,,,,,,,,41553S,655385\"...; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_read1_sam] Parse error at line 35 +[W::sam_hdr_create] SQ header line has more than one SN: tag +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name "85\x1D,665\xA738,,65531S,654385\x1"...; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ":"; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ",M::bwa_idx_load_from_disk,,,,,,,,"...; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ":"; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ",,,,,,,,,,,,,,,,,,,,41553S,655385\"...; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ":"; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ",l,,,,,,,,,,,,,,,,,,41553S,655385\"...; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ":"; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ",l,,,,,,,,,,,,,,,,,,4155,,,,,,,,,,"...; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ":"; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ",,,,,,,,,,,,,,,,,,,,41553S,655385\"...; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ":"; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ",l,,,,,,,,,,,,,,,,,,411S,655385\x1"...; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ",,,,,,5385\x1D,66fai8,,65531S,565385"; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ":"; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name ",,,,,,,,,,,,,,,,,,,,41553S,655385\"...; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_read1_sam] Parse error at line 35 +[W::sam_hdr_create] SQ header line has more than one SN: tag +gs:h@SQ: Invalid argument +[E::refs_load_fai] Failed to open reference file 'gs:h@SQ' +[W::cram_get_ref] Failed to populate reference for id 0 +[W::cram_write_SAM_hdr] No M5 tags present and could not find reference +[W::cram_write_SAM_hdr] Enabling embed_ref=2 option +[W::cram_write_SAM_hdr] NOTE: the CRAM file will be bigger than using an external reference +[W::sam_parse1] empty query name +[W::sam_parse1] unrecognized reference name "85\x1D,665\xA738,,65531S,654385\x1"...; treated as unmapped +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +[W::sam_parse1] empty query name +[W::sam_parse1] mapped mate cannot have zero coordinate; treated as unmapped +================================================================= +==1140==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b52102e55c8 at pc 0x5617f4cd08e4 bp 0x7ffce0d7a930 sp 0x7ffce0d7a928 +READ of size 8 at 0x7b52102e55c8 thread T0 + #0 0x5617f4cd08e3 in cram_encode_container /src/htslib/cram/cram_encode.c:2000:30 + #1 0x5617f4d0842d in cram_flush_container /src/htslib/cram/cram_io.c:4154:14 + #2 0x5617f4cdbb5e in cram_next_container /src/htslib/cram/cram_encode.c:3283:19 + #3 0x5617f4cda589 in cram_put_bam_seq /src/htslib/cram/cram_encode.c:4050:30 + #4 0x5617f4bd329d in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c:107:13 + #5 0x5617f4bd309e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:203:13 + #6 0x5617f4a7086d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x5617f4a5b5e2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x5617f4a614b0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x5617f4a8cfe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f3211a85082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x5617f4a546cd in _start (/out/hts_open_fuzzer+0xf96cd) + +0x7b52102e55c8 is located 8 bytes before 8-byte region [0x7b52102e55d0,0x7b52102e55d8) +allocated by thread T0 here: + #0 0x5617f4b8f389 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:74:3 + #1 0x5617f4cfd800 in refs2id /src/htslib/cram/cram_io.c:2715:17 + #2 0x5617f4d0b760 in cram_write_SAM_hdr /src/htslib/cram/cram_io.c:4922:15 + #3 0x5617f4c367e0 in sam_hdr_write /src/htslib/sam.c:2236:13 + #4 0x5617f4bd31d4 in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c:99:9 + #5 0x5617f4bd309e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:203:13 + #6 0x5617f4a7086d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x5617f4a5b5e2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x5617f4a614b0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x5617f4a8cfe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f3211a85082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/htslib/cram/cram_encode.c:2000:30 in cram_encode_container +Shadow bytes around the buggy address: + 0x7b52102e5300: fa fa 00 00 fa fa 04 fa fa fa 00 00 fa fa 00 00 + 0x7b52102e5380: fa fa fd fa fa fa fd fa fa fa fd fd fa fa 00 fa + 0x7b52102e5400: fa fa 04 fa fa fa 01 fa fa fa 00 07 fa fa 00 00 + 0x7b52102e5480: fa fa 04 fa fa fa 00 00 fa fa 00 00 fa fa 04 fa + 0x7b52102e5500: fa fa 00 00 fa fa 00 00 fa fa fd fa fa fa 00 00 +=>0x7b52102e5580: fa fa 04 fa fa fa fd fd fa[fa]00 fa fa fa fd fd + 0x7b52102e5600: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd + 0x7b52102e5680: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fa + 0x7b52102e5700: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x7b52102e5780: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x7b52102e5800: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1140==ABORTING diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2024-189.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2024-189.txt new file mode 100755 index 000000000..c530da6d1 --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2024-189.txt @@ -0,0 +1,46 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 121276320 +INFO: Loaded 1 modules (24416 inline 8-bit counters): 24416 [0x55fea5e5f300, 0x55fea5e65260), +INFO: Loaded 1 PC tables (24416 PCs): 24416 [0x55fea5e65260,0x55fea5ec4860), +/out/hts_open_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2024-189 +[W::vcf_parse] Contig '' is not defined in the header. (Quick workaround: index the file with tabix.) +[W::bcf_hrec_check] Invalid contig name: "" +[W::vcf_parse_filter] FILTER '' is not defined in the header +[W::vcf_parse_format_dict2] FORMAT '' at :0 is not defined in the header, assuming Type=String +[W::bcf_hrec_check] Invalid tag name: "" +[W::vcf_parse_format_alloc4] Duplicate FORMAT tag at :0 +================================================================= +==1053==ERROR: AddressSanitizer: negative-size-param: (size=-2) + #0 0x55fea5b87a18 in __asan_memset /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:67:3 + #1 0x55fea5c9ca17 in vcf_parse_format_fill5 /src/htslib/vcf.c:3246:25 + #2 0x55fea5c7fecf in vcf_parse_format /src/htslib/vcf.c:3378:9 + #3 0x55fea5c7d5f5 in vcf_parse /src/htslib/vcf.c:3791:16 + #4 0x55fea5bcde8d in view_vcf /src/htslib/test/fuzz/hts_open_fuzzer.c:159:12 + #5 0x55fea5bcd9dc in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:206:13 + #6 0x55fea5a6b23d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x55fea5a55fb2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x55fea5a5be80 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x55fea5a879b2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fc72c7cd082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x55fea5a4f09d in _start (/out/hts_open_fuzzer+0xf109d) + +0x7be72afe5579 is located 9 bytes inside of 15-byte region [0x7be72afe5570,0x7be72afe557f) +allocated by thread T0 here: + #0 0x55fea5b89f7c in realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:81:3 + #1 0x55fea5c7ba73 in ks_resize /src/htslib/./htslib/kstring.h:160:19 + #2 0x55fea5c78f09 in kputsn /src/htslib/./htslib/kstring.h:237:24 + #3 0x55fea5c9ddfb in align_mem /src/htslib/vcf.c:2810:13 + #4 0x55fea5c9a6f3 in vcf_parse_format_alloc4 /src/htslib/vcf.c:2998:13 + #5 0x55fea5c7fea3 in vcf_parse_format /src/htslib/vcf.c:3374:9 + #6 0x55fea5c7d5f5 in vcf_parse /src/htslib/vcf.c:3791:16 + #7 0x55fea5bcde8d in view_vcf /src/htslib/test/fuzz/hts_open_fuzzer.c:159:12 + #8 0x55fea5bcd9dc in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:206:13 + #9 0x55fea5a6b23d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #10 0x55fea5a55fb2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #11 0x55fea5a5be80 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #12 0x55fea5a879b2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fc72c7cd082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: negative-size-param /src/htslib/vcf.c:3246:25 in vcf_parse_format_fill5 +==1053==ABORTING diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2024-20.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2024-20.txt new file mode 100755 index 000000000..864b01c0a --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2024-20.txt @@ -0,0 +1,75 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 100404191 +INFO: Loaded 1 modules (24286 inline 8-bit counters): 24286 [0x55b9874442e0, 0x55b98744a1be), +INFO: Loaded 1 PC tables (24286 PCs): 24286 [0x55b98744a1c0,0x55b9874a8fa0), +/out/hts_open_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2024-20 +[W::bam_hdr_read] EOF marker is absent. The input is probably truncated +[W::bam_hdr_read] EOF marker is absent. The input is probably truncated +[W::bam_hdr_read] EOF marker is absent. The input is probably truncated +================================================================= +==1053==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7bbf2b6e5078 at pc 0x55b9872252d0 bp 0x7ffd05eb8ca0 sp 0x7ffd05eb8c98 +READ of size 1 at 0x7bbf2b6e5078 thread T0 + #0 0x55b9872252cf in bam_aux_get /src/htslib/sam.c:4718:32 + #1 0x55b9872b1aed in process_one_read /src/htslib/cram/cram_encode.c:3354:16 + #2 0x55b9872aa9d3 in cram_encode_container /src/htslib/cram/cram_encode.c:2031:17 + #3 0x55b9872e61ad in cram_flush_container /src/htslib/cram/cram_io.c:4147:14 + #4 0x55b9872edad2 in cram_close /src/htslib/cram/cram_io.c:5574:19 + #5 0x55b9871e098a in hts_close /src/htslib/hts.c:1629:15 + #6 0x55b9871b5cc5 in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c + #7 0x55b9871b5a5e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:203:13 + #8 0x55b98705322d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #9 0x55b98703dfa2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #10 0x55b987043e70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #11 0x55b98706f9a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f9f2ce78082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x55b98703708d in _start (/out/hts_open_fuzzer+0xf008d) + +0x7bbf2b6e5078 is located 0 bytes after 8-byte region [0x7bbf2b6e5070,0x7bbf2b6e5078) +allocated by thread T0 here: + #0 0x55b987171f6c in realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:81:3 + #1 0x55b98720a90a in sam_realloc_bam_data /src/htslib/sam.c:446:20 + #2 0x55b98720aca0 in bam_copy1 /src/htslib/sam.c:480:9 + #3 0x55b98720aed9 in bam_dup1 /src/htslib/sam.c:493:9 + #4 0x55b9872b9c63 in cram_put_bam_seq /src/htslib/cram/cram_encode.c:4127:34 + #5 0x55b9871b5c5d in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c:107:13 + #6 0x55b9871b5a5e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:203:13 + #7 0x55b98705322d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x55b98703dfa2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x55b987043e70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x55b98706f9a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f9f2ce78082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/htslib/sam.c:4718:32 in bam_aux_get +Shadow bytes around the buggy address: + 0x7bbf2b6e4d80: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa + 0x7bbf2b6e4e00: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fd + 0x7bbf2b6e4e80: fa fa fd fa fa fa fd fa fa fa 05 fa fa fa 00 00 + 0x7bbf2b6e4f00: fa fa 00 02 fa fa 05 fa fa fa fd fa fa fa fd fd + 0x7bbf2b6e4f80: fa fa 03 fa fa fa 00 07 fa fa 01 fa fa fa fd fa +=>0x7bbf2b6e5000: fa fa fd fa fa fa fd fa fa fa 00 fa fa fa 00[fa] + 0x7bbf2b6e5080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bbf2b6e5100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bbf2b6e5180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bbf2b6e5200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bbf2b6e5280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1053==ABORTING diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2024-74.txt b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2024-74.txt new file mode 100755 index 000000000..3fcc48274 --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/OSV-2024-74.txt @@ -0,0 +1,79 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 79760108 +INFO: Loaded 1 modules (24286 inline 8-bit counters): 24286 [0x562379b392e0, 0x562379b3f1be), +INFO: Loaded 1 PC tables (24286 PCs): 24286 [0x562379b3f1c0,0x562379b9dfa0), +/out/hts_open_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2024-74 +[W::bam_hdr_read] EOF marker is absent. The input is probably truncated +[E::sam_format1_append] Corrupted aux data for read +[W::bam_hdr_read] EOF marker is absent. The input is probably truncated +[W::bam_hdr_read] EOF marker is absent. The input is probably truncated +[W::cram_encode_aux] ================================================================= +==1053==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7d11dd3e1400 at pc 0x5623797ebbe1 bp 0x7fff6c212570 sp 0x7fff6c211cf8 +READ of size 232 at 0x7d11dd3e1400 thread T0 + #0 0x5623797ebbe0 in printf_common(void*, char const*, __va_list_tag*) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:567:9 + #1 0x5623797ebea1 in vfprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1709:1 + #2 0x5623798d13db in hts_log /src/htslib/hts.c:5006:9 + #3 0x5623799ba785 in cram_encode_aux /src/htslib/cram/cram_encode.c:2810:17 + #4 0x5623799a8f34 in process_one_read /src/htslib/cram/cram_encode.c:3683:9 + #5 0x56237999fa03 in cram_encode_container /src/htslib/cram/cram_encode.c:2031:17 + #6 0x5623799db1dd in cram_flush_container /src/htslib/cram/cram_io.c:4147:14 + #7 0x5623799e2b02 in cram_close /src/htslib/cram/cram_io.c:5574:19 + #8 0x5623798d598a in hts_close /src/htslib/hts.c:1629:15 + #9 0x5623798aacc5 in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c + #10 0x5623798aaa5e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:203:13 + #11 0x56237974822d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #12 0x562379732fa2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #13 0x562379738e70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #14 0x5623797649a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7fc1debc1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #16 0x56237972c08d in _start (/out/hts_open_fuzzer+0xf008d) + +0x7d11dd3e1400 is located 0 bytes after 512-byte region [0x7d11dd3e1200,0x7d11dd3e1400) +allocated by thread T0 here: + #0 0x562379866f6c in realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:81:3 + #1 0x5623798ff90a in sam_realloc_bam_data /src/htslib/sam.c:446:20 + #2 0x5623798ffca0 in bam_copy1 /src/htslib/sam.c:480:9 + #3 0x5623798ffed9 in bam_dup1 /src/htslib/sam.c:493:9 + #4 0x5623799aec93 in cram_put_bam_seq /src/htslib/cram/cram_encode.c:4127:34 + #5 0x5623798aac5d in view_sam /src/htslib/test/fuzz/hts_open_fuzzer.c:107:13 + #6 0x5623798aaa5e in LLVMFuzzerTestOneInput /src/htslib/test/fuzz/hts_open_fuzzer.c:203:13 + #7 0x56237974822d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x562379732fa2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x562379738e70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x5623797649a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fc1debc1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/htslib/hts.c:5006:9 in hts_log +Shadow bytes around the buggy address: + 0x7d11dd3e1180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d11dd3e1200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d11dd3e1280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d11dd3e1300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d11dd3e1380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7d11dd3e1400:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d11dd3e1480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d11dd3e1500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d11dd3e1580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d11dd3e1600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d11dd3e1680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1053==ABORTING diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/collect_crash_builds.csv b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/collect_crash_builds.csv new file mode 100644 index 000000000..509890d90 --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/original-crashes/collect_crash_builds.csv @@ -0,0 +1,8 @@ +target,commit_id,oss_fuzz_commit,sanitizer +htslib,dd6f0b72c92591252bb77818663629cc1a129949,c15017cf4f41014630be236bed440fd2995c2de7,address +htslib,34ba6c726925efceaa2cc995d7d4b0409907f331,488d1d35d93c813bced5500ad8fea8e9523c7946,address +htslib,61b037bb881e85259f8df30c78d99ad3a357ed52,84fed7c8f7fbba76f7e2c788dedf4a5236e5d0d2,address +htslib,ca920611fcd8be1180045589ac11bff2f04eafd8,0b69e19c1c006c053b6f4dca0b6bafe023890744,address +htslib,ca0f6214b94adf9278cbcaaefd50f5fe9455f9ad,05185182663701d0d3476834051ef092582424b5,address +htslib,31e5a5f972b137ec3738bfd565652270904f7112,163e36a5b15e2d9fd5f05b87f04bef49790e449e,address +htslib,65ae5744347c9403c061585fa2fc9f5262f2f977,c58ac449237fe796d4f33e36e2d2dd781ad6b9db,address diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/patches/combined.diff b/benchmarks/htslib_transplant_hts_open_fuzzer/patches/combined.diff new file mode 100755 index 000000000..fc7c3063a --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/patches/combined.diff @@ -0,0 +1,213 @@ +diff --git a/cram/cram_encode.c b/cram/cram_encode.c +index cb573bd7..7652ac87 100644 +--- a/cram/cram_encode.c ++++ b/cram/cram_encode.c +@@ -30,6 +30,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + #include + ++#include "../__bug_dispatch.h" + #include + #include + #include +@@ -1373,6 +1374,13 @@ int cram_encode_container(cram_fd *fd, cram_container *c) { + // is done within process_one_read(). + kstring_t MD = {0}; + ++ if (__bug_dispatch[0] & (1 << 5)) { ++ if (fd->embed_ref == 2) { ++ if (c->ref_end > fd->refs->ref_id[c->ref_id]->length) ++ c->ref_end = fd->refs->ref_id[c->ref_id]->length; ++ } ++ } ++ + // Iterate through records creating the cram blocks for some + // fields and just gathering stats for others. + for (r2 = 0; r1 < c->curr_c_rec && r2 < s->hdr->num_records; r1++, r2++) { +@@ -2240,6 +2248,11 @@ static char *cram_encode_aux(cram_fd *fd, bam_seq_t *b, cram_container *c, + + orig = aux = (char *)bam_aux(b); + ++ if (__bug_dispatch[0] & (1 << 1)) { ++ aux = malloc(aux_size + 4); ++ memcpy(aux, orig, aux_size); ++ } ++ + // Copy aux keys to td_b and aux values to slice aux blocks + while (aux - orig < aux_size && aux[0] != 0) { + int r; +diff --git a/cram/cram_io.c b/cram/cram_io.c +index 1b5c820d..d383b07a 100644 +--- a/cram/cram_io.c ++++ b/cram/cram_io.c +@@ -41,6 +41,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + #include + ++#include "../__bug_dispatch.h" + #include + #include + #include +@@ -3976,7 +3977,13 @@ int cram_write_SAM_hdr(cram_fd *fd, sam_hdr_t *hdr) { + if (!(md5 = hts_md5_init())) + return -1; + ref = cram_get_ref(fd, i, 1, rlen); +- if (NULL == ref) return -1; ++ if (__bug_dispatch[0] & (1 << 5)) { ++ if (NULL == ref) { ++ fd->embed_ref = 2; ++ } ++ } else { ++ if (NULL == ref) return -1; ++ } + rlen = fd->refs->ref_id[i]->length; /* In case it just loaded */ + hts_md5_update(md5, ref, rlen); + hts_md5_final(buf, md5); +diff --git a/sam.c b/sam.c +index 0fb4df76..594ddaa0 100644 +--- a/sam.c ++++ b/sam.c +@@ -25,6 +25,7 @@ DEALINGS IN THE SOFTWARE. */ + + #include + ++#include "__bug_dispatch.h" + #include + #include + #include +@@ -3276,22 +3277,42 @@ uint8_t *bam_aux_get(const bam1_t *b, const char tag[2]) + uint16_t y = (uint16_t) t[0]<<8 | t[1]; + s = bam_get_aux(b); + end = b->data + b->l_data; +- while (s != NULL && end - s >= 3) { +- uint16_t x = (uint16_t) s[0]<<8 | s[1]; +- s += 2; +- if (x == y) { +- // Check the tag value is valid and complete +- uint8_t *e = skip_aux(s, end); +- if ((*s == 'Z' || *s == 'H') && *(e - 1) != '\0') { +- goto bad_aux; // Unterminated string ++ if (__bug_dispatch[0] & (1 << 2)) { ++ while (s != NULL && s < end) { ++ uint16_t x = (uint16_t) s[0]<<8 | s[1]; ++ s += 2; ++ if (x == y) { ++ // Check the tag value is valid and complete ++ uint8_t *e = skip_aux(s, end); ++ if ((*s == 'Z' || *s == 'H') && *(e - 1) != '\0') { ++ goto bad_aux; // Unterminated string ++ } ++ if (e != NULL) { ++ return s; ++ } else { ++ goto bad_aux; ++ } + } +- if (e != NULL) { +- return s; +- } else { +- goto bad_aux; ++ s = skip_aux(s, end); ++ } ++ } else { ++ while (s != NULL && end - s >= 3) { ++ uint16_t x = (uint16_t) s[0]<<8 | s[1]; ++ s += 2; ++ if (x == y) { ++ // Check the tag value is valid and complete ++ uint8_t *e = skip_aux(s, end); ++ if ((*s == 'Z' || *s == 'H') && *(e - 1) != '\0') { ++ goto bad_aux; // Unterminated string ++ } ++ if (e != NULL) { ++ return s; ++ } else { ++ goto bad_aux; ++ } + } ++ s = skip_aux(s, end); + } +- s = skip_aux(s, end); + } + if (s == NULL) goto bad_aux; + errno = ENOENT; +diff --git a/test/fuzz/hts_open_fuzzer.c b/test/fuzz/hts_open_fuzzer.c +index f4bb9441..57f5dd77 100644 +--- a/test/fuzz/hts_open_fuzzer.c ++++ b/test/fuzz/hts_open_fuzzer.c +@@ -24,7 +24,7 @@ DEALINGS IN THE SOFTWARE. */ + + #include + +-#include "__bug_dispatch.h" ++#include "../../__bug_dispatch.h" + #include + #include + #include +@@ -46,10 +46,24 @@ static void view_sam(htsFile *in) { + if (!in) { + return; + } +- samFile *out = sam_open("/dev/null", "w"); ++ samFile *out; ++ if (__bug_dispatch[0] & (1 << 1)) { ++ out = sam_open("/dev/null", "wc"); ++ } else if (__bug_dispatch[0] & (1 << 2)) { ++ out = sam_open("/dev/null", "wc"); ++ } else if (__bug_dispatch[0] & (1 << 3)) { ++ out = sam_open("/dev/null", "wc"); ++ } else if (__bug_dispatch[0] & (1 << 5)) { ++ out = sam_open("/dev/null", "wc"); ++ } else { ++ out = sam_open("/dev/null", "w"); ++ } + if (!out) { + abort(); + } ++ if (__bug_dispatch[0] & (1 << 1)) { ++ hts_set_opt(out, CRAM_OPT_NO_REF, 1); ++ } + sam_hdr_t *hdr = sam_hdr_read(in); + if (hdr == NULL) { + hts_close_or_abort(out); +diff --git a/vcf.c b/vcf.c +index c2228312..61ce1cc3 100644 +--- a/vcf.c ++++ b/vcf.c +@@ -26,6 +26,7 @@ DEALINGS IN THE SOFTWARE. */ + + #include + ++#include "__bug_dispatch.h" + #include + #include + #include +@@ -1235,7 +1236,11 @@ static int bcf_dec_typed_int1_safe(uint8_t *p, uint8_t *end, uint8_t **q, + *q = p + 2; + *val = le_to_i16(p); + } else if (t == BCF_BT_INT32) { +- if (end - p < 4) return -1; ++ if (__bug_dispatch[0] & (1 << 0)) { ++ if (end - p < bcf_type_shift[t]) return -1; ++ } else { ++ if (end - p < 4) return -1; ++ } + *q = p + 4; + *val = le_to_i32(p); + } else { +@@ -2292,6 +2297,15 @@ static int vcf_parse_format(kstring_t *s, const bcf_hdr_t *h, bcf1_t *v, char *p + ks_resize(mem, mem->l + v->n_sample * f->size); + mem->l += v->n_sample * f->size; + } ++ if (__bug_dispatch[0] & (1 << 4)) ++ { ++ int i; ++ for (i=1; in_fmt; i++) ++ { ++ fmt_aux_t *ifmt = &fmt[i]; ++ ifmt->size = -1; ++ } ++ } + for (j = 0; j < v->n_fmt; ++j) + fmt[j].buf = (uint8_t*)mem->s + fmt[j].offset; + // fill the sample fields; at beginning of the loop, t points to the first char of a format diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/patches/harness.diff b/benchmarks/htslib_transplant_hts_open_fuzzer/patches/harness.diff new file mode 100755 index 000000000..b582c06c4 --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/patches/harness.diff @@ -0,0 +1,75 @@ +diff --git a/__bug_dispatch.c b/__bug_dispatch.c +new file mode 100644 +index 00000000..8b8ff0ce +--- /dev/null ++++ b/__bug_dispatch.c +@@ -0,0 +1,2 @@ ++#include "__bug_dispatch.h" ++volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES] = {0}; +diff --git a/__bug_dispatch.h b/__bug_dispatch.h +new file mode 100644 +index 00000000..6450a259 +--- /dev/null ++++ b/__bug_dispatch.h +@@ -0,0 +1,6 @@ ++#ifndef __BUG_DISPATCH_H ++#define __BUG_DISPATCH_H ++#include ++#define __BUG_DISPATCH_BYTES 1 ++extern volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES]; ++#endif +diff --git a/test/fuzz/hts_open_fuzzer.c b/test/fuzz/hts_open_fuzzer.c +index bfbad961..f4bb9441 100644 +--- a/test/fuzz/hts_open_fuzzer.c ++++ b/test/fuzz/hts_open_fuzzer.c +@@ -24,6 +24,7 @@ DEALINGS IN THE SOFTWARE. */ + + #include + ++#include "__bug_dispatch.h" + #include + #include + #include +@@ -115,16 +116,26 @@ static void view_vcf(htsFile *in) { + } + + int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ++ if (size < __BUG_DISPATCH_BYTES) return 0; ++ memcpy((void*)__bug_dispatch, data, __BUG_DISPATCH_BYTES); ++ data += __BUG_DISPATCH_BYTES; ++ size -= __BUG_DISPATCH_BYTES; ++ uint8_t *__fuzz_copy = (uint8_t *)malloc(size); ++ if (!__fuzz_copy) return 0; ++ memcpy(__fuzz_copy, data, size); ++ + hFILE *memfile; + uint8_t *copy = malloc(size); + if (copy == NULL) { ++ free(__fuzz_copy); + abort(); + } +- memcpy(copy, data, size); ++ memcpy(copy, __fuzz_copy, size); + // hopen does not take ownership of `copy`, but hts_hopen does. + memfile = hopen("mem:", "rb:", copy, size); + if (memfile == NULL) { + free(copy); ++ free(__fuzz_copy); + return 0; + } + +@@ -133,6 +144,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + if (hclose(memfile) != 0) { + abort(); + } ++ free(__fuzz_copy); + return 0; + } + switch (ht_file->format.category) { +@@ -146,5 +158,6 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + break; + } + hts_close_or_abort(ht_file); ++ free(__fuzz_copy); + return 0; + } diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/patches/harness_sources/manifest.json b/benchmarks/htslib_transplant_hts_open_fuzzer/patches/harness_sources/manifest.json new file mode 100755 index 000000000..fe51488c7 --- /dev/null +++ b/benchmarks/htslib_transplant_hts_open_fuzzer/patches/harness_sources/manifest.json @@ -0,0 +1 @@ +[] diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2020-1121-patched b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2020-1121-patched new file mode 100755 index 000000000..9821fc666 Binary files /dev/null and b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2020-1121-patched differ diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2020-1301-patched b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2020-1301-patched new file mode 100755 index 000000000..4c25a8823 Binary files /dev/null and b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2020-1301-patched differ diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2020-1733-patched b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2020-1733-patched new file mode 100755 index 000000000..336abce24 Binary files /dev/null and b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2020-1733-patched differ diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2020-958-patched b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2020-958-patched new file mode 100755 index 000000000..57d7b2a39 Binary files /dev/null and b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2020-958-patched differ diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2020-998-patched b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2020-998-patched new file mode 100755 index 000000000..5f09b2201 Binary files /dev/null and b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2020-998-patched differ diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2020-999-patched b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2020-999-patched new file mode 100755 index 000000000..3a981f728 Binary files /dev/null and b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2020-999-patched differ diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2023-1370-patched b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2023-1370-patched new file mode 100755 index 000000000..587349b35 Binary files /dev/null and b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2023-1370-patched differ diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2024-1212-patched b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2024-1212-patched new file mode 100755 index 000000000..9a79dc812 Binary files /dev/null and b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2024-1212-patched differ diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2024-189-patched b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2024-189-patched new file mode 100755 index 000000000..296dec68b Binary files /dev/null and b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2024-189-patched differ diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2024-20-patched b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2024-20-patched new file mode 100755 index 000000000..14ea2ad39 Binary files /dev/null and b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2024-20-patched differ diff --git a/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2024-74-patched b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2024-74-patched new file mode 100755 index 000000000..c407577d7 Binary files /dev/null and b/benchmarks/htslib_transplant_hts_open_fuzzer/seeds/testcase-OSV-2024-74-patched differ diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/Dockerfile b/benchmarks/libavc_transplant_svc_dec_fuzzer/Dockerfile new file mode 100644 index 000000000..f23bdceb9 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/Dockerfile @@ -0,0 +1,31 @@ +# Use the committed merge container as base for identical build environment. +# This image has the exact same OS packages, library versions, and source tree +# that were used during bug transplant verification. +FROM libavc-merge:c38af025 + +# The merge container runs as a non-root user (agent). Switch back to root +# so downstream Dockerfiles (AFL++'s builder, benchmark-builder, etc.) can +# install packages and write to system directories. +USER root + +# docker commit can snapshot a broken apt state - fix it so downstream +# Dockerfiles (e.g. AFL++'s builder.Dockerfile) can apt-get install. +RUN rm -rf /var/lib/apt/lists/* && mkdir -p /var/lib/apt/lists/partial && apt-get update + +WORKDIR /src/libavc + +# Keep ASan stack-use-after-return detection enabled for direct testcase replay. +ENV ASAN_OPTIONS="detect_leaks=0:detect_stack_use_after_return=1" + +# Raise libFuzzer's per-alloc / RSS cap from its 2048MB default. Some transplanted +# bugs (e.g. c-blosc2 OSV-2021-464) trigger a ~2GB malloc en route to the real +# memory-safety error; with the default cap libFuzzer aborts with +# `out-of-memory` and `-ignore_ooms=1` silently drops it. libFuzzer-family +# runners in fuzzbench/fuzzers/*/fuzzer.py splice $ADDITIONAL_ARGS onto the +# target command line, so this propagates automatically. +ENV ADDITIONAL_ARGS="-rss_limit_mb=8192" + +# Bug transplant patches (re-applied by build.sh after checkout_commit.py resets source) +COPY patches/ /src/patches/ +COPY seeds/ /src/benchmark_seeds/ +COPY build.sh $SRC/ diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/benchmark.yaml b/benchmarks/libavc_transplant_svc_dec_fuzzer/benchmark.yaml new file mode 100644 index 000000000..a8218bda2 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/benchmark.yaml @@ -0,0 +1,5 @@ +project: libavc +fuzz_target: svc_dec_fuzzer +commit: c38af025abf0040f6693d15f4ce2e878a728cfee +commit_date: 2025-09-10T10:43:05+10:00 +type: bug diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/bug_metadata.json b/benchmarks/libavc_transplant_svc_dec_fuzzer/bug_metadata.json new file mode 100644 index 000000000..2e8e57f41 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/bug_metadata.json @@ -0,0 +1,134 @@ +{ + "project": "libavc", + "target_commit": "c38af025abf0040f6693d15f4ce2e878a728cfee", + "dispatch_bytes": 1, + "total_bugs": 18, + "bugs": { + "OSV-2023-68": { + "dispatch_value": 1, + "triggered": true, + "crash_file": "/src/libavc/decoder/svc/isvcd_residual_resamp.c", + "crash_line": 2031, + "crash_function": "isvcd_residual_samp_mb_dyadic" + }, + "OSV-2023-75": { + "dispatch_value": 2, + "triggered": true, + "crash_file": "/src/libavc/decoder/svc/isvcd_mode_mv_resamp.c", + "crash_line": 2622, + "crash_function": "isvcd_interlyr_motion_mode_pred_dyadic" + }, + "OSV-2024-638": { + "dispatch_value": 4, + "triggered": true, + "crash_file": "/src/libavc/decoder/ih264d_format_conv.c", + "crash_line": 497, + "crash_function": "ih264d_fmt_conv_420sp_to_420sp_swap_uv" + }, + "OSV-2025-584": { + "dispatch_value": 8, + "triggered": true, + "crash_file": "/src/libavc/decoder/svc/isvcd_parse_epslice.c", + "crash_line": 2840, + "crash_function": "isvcd_mark_err_slice_skip" + }, + "OSV-2025-589": { + "dispatch_value": 16, + "triggered": true, + "crash_file": "/src/libavc/decoder/svc/isvcd_process_epslice.c", + "crash_line": 1564, + "crash_function": "isvcd_decode_recon_tfr_nmb_base_lyr" + }, + "OSV-2023-97": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libavc/decoder/svc/isvcd_intra_resamp.c", + "crash_line": 2116, + "crash_function": "isvcd_reflayer_construction_dyadic" + }, + "OSV-2023-342": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libavc/common/x86/ih264_inter_pred_filters_ssse3.c", + "crash_line": 650, + "crash_function": "ih264_inter_pred_luma_vert_ssse3" + }, + "OSV-2023-840": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libavc/decoder/svc/isvcd_parse_epslice.c", + "crash_line": 1909, + "crash_function": "isvcd_parse_inter_slice_data_cavlc_enh_lyr" + }, + "OSV-2023-1205": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libavc/decoder/svc/isvcd_intra_resamp.c", + "crash_line": 4802, + "crash_function": "isvcd_populate_res_prms" + }, + "OSV-2023-1206": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libavc/decoder/ih264d_format_conv.c", + "crash_line": 400, + "crash_function": "ih264d_fmt_conv_420sp_to_420sp" + }, + "OSV-2023-1207": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libavc/decoder/svc/isvcd_parse_slice.c", + "crash_line": 298, + "crash_function": "isvcd_start_of_pic" + }, + "OSV-2023-1208": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libavc/decoder/ih264d_format_conv.c", + "crash_line": 400, + "crash_function": "ih264d_fmt_conv_420sp_to_420sp" + }, + "OSV-2023-1294": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libavc/decoder/ih264d_compute_bs.c", + "crash_line": 1181, + "crash_function": "ih264d_compute_bs_non_mbaff" + }, + "OSV-2023-1311": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libavc/decoder/ih264d_format_conv.c", + "crash_line": 611, + "crash_function": "ih264d_fmt_conv_420sp_to_420p" + }, + "OSV-2023-1312": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libavc/decoder/ih264d_format_conv.c", + "crash_line": 611, + "crash_function": "ih264d_fmt_conv_420sp_to_420p" + }, + "OSV-2023-1313": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libavc/decoder/svc/isvcd_parse_slice.c", + "crash_line": 298, + "crash_function": "isvcd_start_of_pic" + }, + "OSV-2024-637": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libavc/decoder/ih264d_format_conv.c", + "crash_line": 497, + "crash_function": "ih264d_fmt_conv_420sp_to_420sp_swap_uv" + }, + "OSV-2025-534": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libavc/common/x86/ih264_inter_pred_filters_ssse3.c", + "crash_line": 394, + "crash_function": "ih264_inter_pred_luma_horz_ssse3" + } + } +} \ No newline at end of file diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/build.sh b/benchmarks/libavc_transplant_svc_dec_fuzzer/build.sh new file mode 100755 index 000000000..cb7fa6d74 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/build.sh @@ -0,0 +1,145 @@ +#!/bin/bash -eu +# Generated by fuzzbench_generate.py for bug transplant evaluation + +cd /src/libavc + +# Drop stale build artifacts from the merge container so `git checkout` +# is not blocked by untracked files that would be overwritten. +git clean -fdx >/dev/null 2>&1 || true +git reset --hard HEAD >/dev/null 2>&1 || true + +# Checkout target commit +git checkout c38af025abf0040f6693d15f4ce2e878a728cfee + +# Restore harness sources that live outside the project git repository, +# and compute --exclude flags so harness.diff doesn't re-modify files +# that have already been restored to their post-dispatch state by the +# snapshot copy (which would fail with "does not match index"). +HARNESS_EXCLUDES="" +if [ -f /src/patches/harness_sources/manifest.json ]; then + HARNESS_EXCLUDES=$(python3 - <<'PY' +import json +import shutil +from pathlib import Path + +root = Path("/src/patches/harness_sources") +manifest = json.loads((root / "manifest.json").read_text()) +excludes = [] +for entry in manifest: + source = root / entry["snapshot"] + destination = Path(entry["container_path"]) + destination.parent.mkdir(parents=True, exist_ok=True) + shutil.copy2(source, destination) + # Convert /src// to (git apply paths are repo-relative). + parts = destination.parts + if len(parts) >= 3 and parts[1] == "src": + rel = Path(*parts[3:]) + else: + rel = destination + excludes.append(f"--exclude={rel}") +print(" ".join(excludes)) +PY +) +fi + +# Apply dispatch harness first (modifies build system), then bug patches. +# $HARNESS_EXCLUDES is empty when no snapshots were restored. +if ! git apply --check $HARNESS_EXCLUDES /src/patches/harness.diff 2>/dev/null; then + echo "Trying git apply --3way for harness.diff..." + git apply --3way $HARNESS_EXCLUDES /src/patches/harness.diff +else + git apply $HARNESS_EXCLUDES /src/patches/harness.diff +fi + +if ! git apply --check /src/patches/combined.diff 2>/dev/null; then + echo "Trying git apply --3way for combined.diff..." + git apply --3way /src/patches/combined.diff +else + git apply /src/patches/combined.diff +fi + +# --- Fix library CMakeLists.txt for new source files from combined.diff --- +# combined.diff may create new .c files (e.g., zfp_getcell.c) that need to +# be added to the library's explicit source list. +if [ -d blosc ] && [ -f blosc/CMakeLists.txt ]; then + for newfile in blosc/*.c; do + base=$(basename "$newfile") + if ! grep -q "$base" blosc/CMakeLists.txt 2>/dev/null; then + echo "Adding $base to blosc/CMakeLists.txt" + sed -i "/^set(SOURCES /s/)/ $base)/" blosc/CMakeLists.txt + fi + done +fi + +# --- Original build commands --- +$SRC/libavc/fuzzer/ossfuzz.sh + + +# --- Seed corpus: expand original seeds and per-bug testcase candidates --- +# FuzzBench uses $OUT/{fuzz_target}_seed_corpus.zip as initial corpus. +# Create one seed variant for the default path plus one for each dispatch bit. +# Per-bug reproducers are used only as source material: exact crashing inputs +# are filtered out before packaging. +seed_zip="$OUT/svc_dec_fuzzer_seed_corpus.zip" +seed_target="$OUT/svc_dec_fuzzer" +mkdir -p /tmp/seeds_dispatch /tmp/original_seeds /tmp/benchmark_seed_candidates + +if [ -f "$seed_zip" ]; then + unzip -q -o "$seed_zip" -d /tmp/original_seeds 2>/dev/null || true + for f in /tmp/original_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + for dispatch in '\x00' '\x01' '\x02' '\x04' '\x08' '\x10' '\x20' '\x40' '\x80'; do + dispatch_name=$(printf '%s' "$dispatch" | tr -d '\x') + printf '%b' "$dispatch" | cat - "$f" > "/tmp/seeds_dispatch/${base}.dispatch_${dispatch_name}" + done + done +fi + +if [ -d /src/benchmark_seeds ]; then + for f in /src/benchmark_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + size=$(wc -c < "$f") + [ "$size" -gt 0 ] || continue + + cp "$f" "/tmp/benchmark_seed_candidates/${base}.exact" + # Zero the dispatch byte (byte 0): deactivates dispatch-gated patches + # while keeping the full APDU conversation and card driver routing intact. + cp "$f" "/tmp/benchmark_seed_candidates/${base}.dispatch_zero" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.dispatch_zero" bs=1 seek=0 conv=notrunc 2>/dev/null || true + for keep in 1 2 8 16 64 256 1024; do + if [ "$size" -gt "$keep" ]; then + head -c "$keep" "$f" > "/tmp/benchmark_seed_candidates/${base}.head_${keep}" + fi + done + if [ "$size" -gt 1 ]; then + head -c "$((size - 1))" "$f" > "/tmp/benchmark_seed_candidates/${base}.trim_1" + cp "$f" "/tmp/benchmark_seed_candidates/${base}.zero_last" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.zero_last" bs=1 seek="$((size - 1))" conv=notrunc 2>/dev/null || true + cp "$f" "/tmp/benchmark_seed_candidates/${base}.ff_last" + printf '\377' | dd of="/tmp/benchmark_seed_candidates/${base}.ff_last" bs=1 seek="$((size - 1))" conv=notrunc 2>/dev/null || true + fi + if [ "$size" -gt 4 ]; then + mid=$((size / 2)) + cp "$f" "/tmp/benchmark_seed_candidates/${base}.zero_mid" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.zero_mid" bs=1 seek="$mid" conv=notrunc 2>/dev/null || true + cp "$f" "/tmp/benchmark_seed_candidates/${base}.ff_mid" + printf '\377' | dd of="/tmp/benchmark_seed_candidates/${base}.ff_mid" bs=1 seek="$mid" conv=notrunc 2>/dev/null || true + fi + done +fi + +if [ -x "$seed_target" ] && ls /tmp/benchmark_seed_candidates/* 1>/dev/null 2>&1; then + for f in /tmp/benchmark_seed_candidates/*; do + [ -f "$f" ] || continue + if timeout 10s env ASAN_OPTIONS="${ASAN_OPTIONS:-detect_leaks=0:detect_stack_use_after_return=1}" "$seed_target" "$f" >/tmp/seed_replay.log 2>&1; then + cp "$f" "/tmp/seeds_dispatch/poc_$(basename "$f")" + fi + done +fi + +if ls /tmp/seeds_dispatch/* 1>/dev/null 2>&1; then + rm -f "$seed_zip" + zip -j -q "$seed_zip" /tmp/seeds_dispatch/* +fi diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1205.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1205.txt new file mode 100644 index 000000000..585e678c1 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1205.txt @@ -0,0 +1,75 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2763143103 +INFO: Loaded 1 modules (16702 inline 8-bit counters): 16702 [0x8a2000, 0x8a613e), +INFO: Loaded 1 PC tables (16702 PCs): 16702 [0x804f48,0x846328), +/out/svc_dec_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x624000007eb4 at pc 0x0000005f99c4 bp 0x7fff6f2cf1f0 sp 0x7fff6f2cf1e8 +WRITE of size 1 at 0x624000007eb4 thread T0 + #0 0x5f99c3 in isvcd_populate_res_prms /src/libavc/decoder/svc/isvcd_intra_resamp.c:4802:37 + #1 0x5a37af in isvcd_parse_interlayer_resamp_func_init /src/libavc/decoder/svc/isvcd_parse_epslice.c:3220:15 + #2 0x5b1049 in isvcd_mark_err_slice_skip /src/libavc/decoder/svc/isvcd_parse_epslice.c:2974:11 + #3 0x584846 in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5374:28 + #4 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #5 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #6 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #7 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fdddcbde082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #12 0x41f75d in _start (/out/svc_dec_fuzzer+0x41f75d) + +0x624000007eb4 is located 4 bytes to the right of 7600-byte region [0x624000006100,0x624000007eb0) +allocated by thread T0 here: + #0 0x52fb17 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x56c4d5 in iv_aligned_malloc(void*, int, int) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:86:13 + #2 0x5e4fce in isvcd_allocate_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:178:14 + #3 0x5e8505 in isvcd_init_pic /src/libavc/decoder/svc/isvcd_utils.c:843:15 + #4 0x5be784 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:283:11 + #5 0x5cbf34 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2390:19 + #6 0x5b995b in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1006:40 + #7 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #8 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #9 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #10 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #11 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #12 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #13 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #14 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7fdddcbde082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/svc/isvcd_intra_resamp.c:4802:37 in isvcd_populate_res_prms +Shadow bytes around the buggy address: + 0x0c487fff8f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c487fff8f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c487fff8fa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c487fff8fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c487fff8fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c487fff8fd0: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa + 0x0c487fff8fe0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c487fff8ff0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c487fff9000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c487fff9010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c487fff9020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1206.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1206.txt new file mode 100644 index 000000000..34aaf6748 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1206.txt @@ -0,0 +1,80 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2763391022 +INFO: Loaded 1 modules (16702 inline 8-bit counters): 16702 [0x8a2000, 0x8a613e), +INFO: Loaded 1 PC tables (16702 PCs): 16702 [0x804f48,0x846328), +/out/svc_dec_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000060cf0 at pc 0x00000052e40c bp 0x7fb4e378dc00 sp 0x7fb4e378d3d0 +WRITE of size 640 at 0x631000060cf0 thread T4 + #0 0x52e40b in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x6a01bd in ih264d_fmt_conv_420sp_to_420sp /src/libavc/decoder/ih264d_format_conv.c:400:9 + #2 0x6a01bd in ih264d_format_convert /src/libavc/decoder/ih264d_format_conv.c:752:13 + #3 0x7109fa in ih264d_decode_recon_tfr_nmb_thread /src/libavc/decoder/ih264d_thread_parse_decode.c:257:21 + #4 0x7124c0 in ih264d_decode_slice_thread /src/libavc/decoder/ih264d_thread_parse_decode.c:585:15 + #5 0x71288f in ih264d_decode_picture_thread /src/libavc/decoder/ih264d_thread_parse_decode.c:621:13 + #6 0x7fb4e7fe7608 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8608) (BuildId: 7b4536f41cdaa5888408e82d0836e33dcf436466) + #7 0x7fb4e7ee1132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +0x631000060cf0 is located 0 bytes to the right of 66800-byte region [0x631000050800,0x631000060cf0) +allocated by thread T0 here: + #0 0x52fb17 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x56e141 in iv_aligned_malloc /src/libavc/fuzzer/svc_dec_fuzzer.cpp:86:13 + #2 0x56e141 in Codec::allocFrame() /src/libavc/fuzzer/svc_dec_fuzzer.cpp:309:48 + #3 0x56f3de in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:400:9 + #4 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #5 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fb4e7de6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +Thread T4 created by T0 here: + #0 0x5186bc in pthread_create /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:208:3 + #1 0x640331 in ithread_create /src/libavc/common/ithread.c:80:12 + #2 0x5b263d in isvcd_mark_err_slice_skip /src/libavc/decoder/svc/isvcd_parse_epslice.c:2774:21 + #3 0x5cafe2 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2236:15 + #4 0x5b995b in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1006:40 + #5 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #6 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #7 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #8 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #9 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fb4e7de6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c6280004140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c6280004150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c6280004160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c6280004170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c6280004180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c6280004190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa + 0x0c62800041a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c62800041b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c62800041c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c62800041d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c62800041e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1207.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1207.txt new file mode 100644 index 000000000..27502927b --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1207.txt @@ -0,0 +1,77 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2763647907 +INFO: Loaded 1 modules (16702 inline 8-bit counters): 16702 [0x8a2000, 0x8a613e), +INFO: Loaded 1 PC tables (16702 PCs): 16702 [0x804f48,0x846328), +/out/svc_dec_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000002386 at pc 0x00000052e63e bp 0x7ffdeaf60ff0 sp 0x7ffdeaf607c0 +WRITE of size 828 at 0x611000002386 thread T0 + #0 0x52e63d in __asan_memset /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:26:3 + #1 0x5be95c in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:298:13 + #2 0x5cbf34 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2390:19 + #3 0x5b995b in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1006:40 + #4 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #5 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #6 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #7 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #8 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7fa229997082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #13 0x41f75d in _start (/out/svc_dec_fuzzer+0x41f75d) + +0x611000002386 is located 0 bytes to the right of 6-byte region [0x611000002380,0x611000002386) +allocated by thread T0 here: + #0 0x52fb17 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x56c4d5 in iv_aligned_malloc(void*, int, int) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:86:13 + #2 0x717559 in ih264d_allocate_dynamic_bufs /src/libavc/decoder/ih264d_utils.c:1935:14 + #3 0x5e4ca3 in isvcd_allocate_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:126:18 + #4 0x5e8505 in isvcd_init_pic /src/libavc/decoder/svc/isvcd_utils.c:843:15 + #5 0x5be784 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:283:11 + #6 0x5cbf34 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2390:19 + #7 0x5b995b in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1006:40 + #8 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #9 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #10 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #11 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #12 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #13 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #14 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #15 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #16 0x7fa229997082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:26:3 in __asan_memset +Shadow bytes around the buggy address: + 0x0c227fff8420: 00 00 00 01 fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8430: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c227fff8470:[06]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8490: 06 fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff84a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff84b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff84c0: 00 04 fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1208.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1208.txt new file mode 100644 index 000000000..f50f52ce5 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1208.txt @@ -0,0 +1,77 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2763892675 +INFO: Loaded 1 modules (16702 inline 8-bit counters): 16702 [0x8a2000, 0x8a613e), +INFO: Loaded 1 PC tables (16702 PCs): 16702 [0x804f48,0x846328), +/out/svc_dec_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61a000000b30 at pc 0x00000052e40c bp 0x7f3608b40db0 sp 0x7f3608b40580 +WRITE of size 640 at 0x61a000000b30 thread T41 + #0 0x52e40b in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x6a01bd in ih264d_fmt_conv_420sp_to_420sp /src/libavc/decoder/ih264d_format_conv.c:400:9 + #2 0x6a01bd in ih264d_format_convert /src/libavc/decoder/ih264d_format_conv.c:752:13 + #3 0x712a1b in ih264d_decode_picture_thread /src/libavc/decoder/ih264d_thread_parse_decode.c:644:13 + #4 0x7f360d3b9608 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8608) (BuildId: 7b4536f41cdaa5888408e82d0836e33dcf436466) + #5 0x7f360d2b3132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +0x61a000000b30 is located 0 bytes to the right of 1200-byte region [0x61a000000680,0x61a000000b30) +allocated by thread T0 here: + #0 0x52fb17 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x56e141 in iv_aligned_malloc /src/libavc/fuzzer/svc_dec_fuzzer.cpp:86:13 + #2 0x56e141 in Codec::allocFrame() /src/libavc/fuzzer/svc_dec_fuzzer.cpp:309:48 + #3 0x56f3de in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:400:9 + #4 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #5 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f360d1b8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +Thread T41 created by T0 here: + #0 0x5186bc in pthread_create /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:208:3 + #1 0x640331 in ithread_create /src/libavc/common/ithread.c:80:12 + #2 0x5cc130 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c + #3 0x5b995b in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1006:40 + #4 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #5 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #6 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #7 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #8 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f360d1b8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c347fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c347fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c347fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c347fff8140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c347fff8150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c347fff8160: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa + 0x0c347fff8170: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c347fff8180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c347fff8190: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c347fff81a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c347fff81b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1294.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1294.txt new file mode 100644 index 000000000..653285242 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1294.txt @@ -0,0 +1,76 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2764286159 +INFO: Loaded 1 modules (16702 inline 8-bit counters): 16702 [0x8a2000, 0x8a613e), +INFO: Loaded 1 PC tables (16702 PCs): 16702 [0x804f48,0x846328), +/out/svc_dec_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6110000023d0 at pc 0x000000686800 bp 0x7ffdc61e41a0 sp 0x7ffdc61e4198 +READ of size 1 at 0x6110000023d0 thread T0 + #0 0x6867ff in ih264d_compute_bs_non_mbaff /src/libavc/decoder/ih264d_compute_bs.c:1181:38 + #1 0x704749 in ih264d_mv_pred_ref_tfr_nby2_pmb /src/libavc/decoder/ih264d_process_pslice.c:321:17 + #2 0x5b1e01 in isvcd_mark_err_slice_skip /src/libavc/decoder/svc/isvcd_parse_epslice.c:3127:13 + #3 0x584846 in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5374:28 + #4 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #5 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #6 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #7 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f54271cc082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #12 0x41f75d in _start (/out/svc_dec_fuzzer+0x41f75d) + +0x6110000023d0 is located 0 bytes to the right of 80-byte region [0x611000002380,0x6110000023d0) +allocated by thread T0 here: + #0 0x52fb17 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x56c4d5 in iv_aligned_malloc(void*, int, int) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:86:13 + #2 0x71788b in ih264d_allocate_dynamic_bufs /src/libavc/decoder/ih264d_utils.c:1975:14 + #3 0x5e4ca3 in isvcd_allocate_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:126:18 + #4 0x5e8505 in isvcd_init_pic /src/libavc/decoder/svc/isvcd_utils.c:843:15 + #5 0x5be784 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:283:11 + #6 0x5cbf34 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2390:19 + #7 0x5b995b in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1006:40 + #8 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #9 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #10 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #11 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #12 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #13 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #14 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #15 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #16 0x7f54271cc082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/ih264d_compute_bs.c:1181:38 in ih264d_compute_bs_non_mbaff +Shadow bytes around the buggy address: + 0x0c227fff8420: 00 00 00 01 fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8430: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c227fff8470: 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa + 0x0c227fff8480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8490: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff84a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff84b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff84c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1311.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1311.txt new file mode 100644 index 000000000..b95e78c56 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1311.txt @@ -0,0 +1,77 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2764662904 +INFO: Loaded 1 modules (16702 inline 8-bit counters): 16702 [0x8a2000, 0x8a613e), +INFO: Loaded 1 PC tables (16702 PCs): 16702 [0x804f48,0x846328), +/out/svc_dec_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61a000000b30 at pc 0x00000052e40c bp 0x7f897328bdb0 sp 0x7f897328b580 +WRITE of size 640 at 0x61a000000b30 thread T17 + #0 0x52e40b in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x6a02ae in ih264d_fmt_conv_420sp_to_420p /src/libavc/decoder/ih264d_format_conv.c:611:13 + #2 0x6a02ae in ih264d_format_convert /src/libavc/decoder/ih264d_format_conv.c:724:9 + #3 0x712a1b in ih264d_decode_picture_thread /src/libavc/decoder/ih264d_thread_parse_decode.c:644:13 + #4 0x7f8977ac9608 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8608) (BuildId: 7b4536f41cdaa5888408e82d0836e33dcf436466) + #5 0x7f89779c3132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +0x61a000000b30 is located 0 bytes to the right of 1200-byte region [0x61a000000680,0x61a000000b30) +allocated by thread T0 here: + #0 0x52fb17 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x56e141 in iv_aligned_malloc /src/libavc/fuzzer/svc_dec_fuzzer.cpp:86:13 + #2 0x56e141 in Codec::allocFrame() /src/libavc/fuzzer/svc_dec_fuzzer.cpp:309:48 + #3 0x56f3de in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:400:9 + #4 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #5 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f89778c8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +Thread T17 created by T0 here: + #0 0x5186bc in pthread_create /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:208:3 + #1 0x640331 in ithread_create /src/libavc/common/ithread.c:80:12 + #2 0x5cc130 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c + #3 0x5b995b in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1006:40 + #4 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #5 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #6 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #7 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #8 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f89778c8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c347fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c347fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c347fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c347fff8140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c347fff8150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c347fff8160: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa + 0x0c347fff8170: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c347fff8180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c347fff8190: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c347fff81a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c347fff81b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1312.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1312.txt new file mode 100644 index 000000000..88286cab9 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1312.txt @@ -0,0 +1,69 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2765075066 +INFO: Loaded 1 modules (16702 inline 8-bit counters): 16702 [0x8a2000, 0x8a613e), +INFO: Loaded 1 PC tables (16702 PCs): 16702 [0x804f48,0x846328), +/out/svc_dec_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61f000001ae0 at pc 0x00000052e40c bp 0x7ffeb9292650 sp 0x7ffeb9291e20 +WRITE of size 640 at 0x61f000001ae0 thread T0 + #0 0x52e40b in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x6a02ae in ih264d_fmt_conv_420sp_to_420p /src/libavc/decoder/ih264d_format_conv.c:611:13 + #2 0x6a02ae in ih264d_format_convert /src/libavc/decoder/ih264d_format_conv.c:724:9 + #3 0x58537d in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5607:21 + #4 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #5 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #6 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #7 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fad4fd43082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #12 0x41f75d in _start (/out/svc_dec_fuzzer+0x41f75d) + +0x61f000001ae0 is located 0 bytes to the right of 3168-byte region [0x61f000000e80,0x61f000001ae0) +allocated by thread T0 here: + #0 0x52fb17 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x56e141 in iv_aligned_malloc /src/libavc/fuzzer/svc_dec_fuzzer.cpp:86:13 + #2 0x56e141 in Codec::allocFrame() /src/libavc/fuzzer/svc_dec_fuzzer.cpp:309:48 + #3 0x56f3de in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:400:9 + #4 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #5 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fad4fd43082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c3e7fff8300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3e7fff8310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3e7fff8320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3e7fff8330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3e7fff8340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c3e7fff8350: 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa + 0x0c3e7fff8360: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c3e7fff8370: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c3e7fff8380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c3e7fff8390: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c3e7fff83a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1313.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1313.txt new file mode 100644 index 000000000..dfe27a3d9 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-1313.txt @@ -0,0 +1,77 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2765323262 +INFO: Loaded 1 modules (16702 inline 8-bit counters): 16702 [0x8a2000, 0x8a613e), +INFO: Loaded 1 PC tables (16702 PCs): 16702 [0x804f48,0x846328), +/out/svc_dec_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x615000000691 at pc 0x00000052e63e bp 0x7fff23133250 sp 0x7fff23132a20 +WRITE of size 920 at 0x615000000691 thread T0 + #0 0x52e63d in __asan_memset /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:26:3 + #1 0x5be95c in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:298:13 + #2 0x5cbf34 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2390:19 + #3 0x5b995b in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1006:40 + #4 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #5 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #6 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #7 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #8 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7fbea8b9d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #13 0x41f75d in _start (/out/svc_dec_fuzzer+0x41f75d) + +0x615000000691 is located 0 bytes to the right of 273-byte region [0x615000000580,0x615000000691) +allocated by thread T0 here: + #0 0x52fb17 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x56c4d5 in iv_aligned_malloc(void*, int, int) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:86:13 + #2 0x717559 in ih264d_allocate_dynamic_bufs /src/libavc/decoder/ih264d_utils.c:1935:14 + #3 0x5e4ca3 in isvcd_allocate_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:126:18 + #4 0x5e8505 in isvcd_init_pic /src/libavc/decoder/svc/isvcd_utils.c:843:15 + #5 0x5be784 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:283:11 + #6 0x5cbf34 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2390:19 + #7 0x5b995b in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1006:40 + #8 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #9 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #10 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #11 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #12 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #13 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #14 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #15 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #16 0x7fbea8b9d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:26:3 in __asan_memset +Shadow bytes around the buggy address: + 0x0c2a7fff8080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff80b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff80c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c2a7fff80d0: 00 00[01]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8120: 00 00 01 fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-342.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-342.txt new file mode 100644 index 000000000..ad47734b8 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-342.txt @@ -0,0 +1,98 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2762659000 +INFO: Loaded 1 modules (16702 inline 8-bit counters): 16702 [0x8a2000, 0x8a613e), +INFO: Loaded 1 PC tables (16702 PCs): 16702 [0x804f48,0x846328), +/out/svc_dec_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f8b14dbc638 at pc 0x00000064c649 bp 0x7ffc24613190 sp 0x7ffc24613188 +READ of size 16 at 0x7f8b14dbc638 thread T0 + #0 0x64c648 in ih264_inter_pred_luma_vert_ssse3 /src/libavc/common/x86/ih264_inter_pred_filters_ssse3.c:650:24 + #1 0x6a4fa1 in ih264d_motion_compensate_mp /src/libavc/decoder/ih264d_inter_pred.c:1125:13 + #2 0x5da9d0 in isvcd_decode_recon_tfr_nmb_non_base_lyr /src/libavc/decoder/svc/isvcd_process_epslice.c:1215:17 + #3 0x5a5bff in isvcd_parse_inter_slice_data_cabac_enh_lyr /src/libavc/decoder/svc/isvcd_parse_epslice.c:1528:23 + #4 0x5a2e51 in isvcd_parse_epslice /src/libavc/decoder/svc/isvcd_parse_epslice.c:476:11 + #5 0x5c5f31 in isvcd_parse_decode_slice_ext_nal /src/libavc/decoder/svc/isvcd_parse_slice.c:1496:15 + #6 0x5b9a35 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1064:44 + #7 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #8 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #9 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #10 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #11 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #12 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #13 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #14 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f8b18f1c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #16 0x41f75d in _start (/out/svc_dec_fuzzer+0x41f75d) + +0x7f8b14dbc638 is located 986680 bytes inside of 1204224-byte region [0x7f8b14ccb800,0x7f8b14df1800) +freed by thread T0 here: + #0 0x52ed22 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x56c592 in iv_aligned_free(void*, void*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:96:5 + #2 0x719dce in ih264d_free_dynamic_bufs /src/libavc/decoder/ih264d_utils.c:2337:5 + #3 0x5e461f in isvcd_free_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:87:5 + #4 0x570f23 in isvcd_init_decoder /src/libavc/decoder/svc/isvcd_api.c:1081:5 + #5 0x58bb25 in isvcd_reset /src/libavc/decoder/svc/isvcd_api.c:6444:13 + #6 0x58bb25 in isvcd_ctl /src/libavc/decoder/svc/isvcd_api.c:6506:19 + #7 0x5910e8 in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7303:26 + #8 0x56f1a4 in resetCodec /src/libavc/fuzzer/svc_dec_fuzzer.cpp:186:5 + #9 0x56f1a4 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:382:9 + #10 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #11 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #12 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #13 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #14 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f8b18f1c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +previously allocated by thread T0 here: + #0 0x52fb17 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x56c4d5 in iv_aligned_malloc(void*, int, int) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:86:13 + #2 0x71856d in ih264d_allocate_dynamic_bufs /src/libavc/decoder/ih264d_utils.c:2170:14 + #3 0x5e4ca3 in isvcd_allocate_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:126:18 + #4 0x5e8505 in isvcd_init_pic /src/libavc/decoder/svc/isvcd_utils.c:843:15 + #5 0x5be784 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:283:11 + #6 0x5c4c16 in isvcd_parse_decode_slice_ext_nal /src/libavc/decoder/svc/isvcd_parse_slice.c:1181:19 + #7 0x5b9a35 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1064:44 + #8 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #9 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #10 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #11 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #12 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #13 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #14 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #15 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #16 0x7f8b18f1c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/libavc/common/x86/ih264_inter_pred_filters_ssse3.c:650:24 in ih264_inter_pred_luma_vert_ssse3 +Shadow bytes around the buggy address: + 0x0ff1e29af870: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ff1e29af880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ff1e29af890: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ff1e29af8a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ff1e29af8b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0ff1e29af8c0: fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd + 0x0ff1e29af8d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ff1e29af8e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ff1e29af8f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ff1e29af900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ff1e29af910: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-68.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-68.txt new file mode 100644 index 000000000..ea059de24 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-68.txt @@ -0,0 +1,85 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2766022378 +INFO: Loaded 1 modules (16702 inline 8-bit counters): 16702 [0x8a2000, 0x8a613e), +INFO: Loaded 1 PC tables (16702 PCs): 16702 [0x804f48,0x846328), +/out/svc_dec_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61300000a052 at pc 0x00000060d073 bp 0x7f022bce2870 sp 0x7f022bce2868 +READ of size 2 at 0x61300000a052 thread T2 + #0 0x60d072 in isvcd_residual_samp_mb_dyadic /src/libavc/decoder/svc/isvcd_residual_resamp.c:2031:50 + #1 0x5d875a in isvcd_process_residual_resample_mb /src/libavc/decoder/svc/isvcd_process_epslice.c:1927:11 + #2 0x5dd1ab in isvcd_process_inter_mb_rsd_pred_target_lyr /src/libavc/decoder/svc/isvcd_process_epslice.c:1992:11 + #3 0x5e2b7e in isvcd_decode_recon_tfr_nmb_thread /src/libavc/decoder/svc/isvcd_thread_parse_decode.c:264:31 + #4 0x5e3fdc in isvcd_decode_slice_thread /src/libavc/decoder/svc/isvcd_thread_parse_decode.c:519:19 + #5 0x5e4334 in isvcd_decode_picture_thread /src/libavc/decoder/svc/isvcd_thread_parse_decode.c:571:19 + #6 0x7f0233e92608 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8608) (BuildId: 7b4536f41cdaa5888408e82d0836e33dcf436466) + #7 0x7f0233d8c132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +0x61300000a052 is located 18 bytes to the right of 192-byte region [0x613000009f80,0x61300000a040) +allocated by thread T0 here: + #0 0x52fb17 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x56c4d5 in iv_aligned_malloc(void*, int, int) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:86:13 + #2 0x5e4fce in isvcd_allocate_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:178:14 + #3 0x5e8505 in isvcd_init_pic /src/libavc/decoder/svc/isvcd_utils.c:843:15 + #4 0x5be784 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:283:11 + #5 0x5cbf34 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2390:19 + #6 0x5b995b in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1006:40 + #7 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #8 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #9 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #10 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #11 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #12 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #13 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #14 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f0233c91082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +Thread T2 created by T0 here: + #0 0x5186bc in pthread_create /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:208:3 + #1 0x640331 in ithread_create /src/libavc/common/ithread.c:80:12 + #2 0x5c4df7 in isvcd_parse_decode_slice_ext_nal /src/libavc/decoder/svc/isvcd_parse_slice.c:1210:17 + #3 0x5b9a35 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1064:44 + #4 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #5 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #6 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #7 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #8 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f0233c91082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/svc/isvcd_residual_resamp.c:2031:50 in isvcd_residual_samp_mb_dyadic +Shadow bytes around the buggy address: + 0x0c267fff93b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff93c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c267fff93d0: 00 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff93e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff93f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c267fff9400: 00 00 00 00 00 00 00 00 fa fa[fa]fa fa fa fa fa + 0x0c267fff9410: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff9420: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff9430: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c267fff9440: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa + 0x0c267fff9450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-75.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-75.txt new file mode 100644 index 000000000..56ad7d109 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-75.txt @@ -0,0 +1,79 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2766296952 +INFO: Loaded 1 modules (16702 inline 8-bit counters): 16702 [0x8a2000, 0x8a613e), +INFO: Loaded 1 PC tables (16702 PCs): 16702 [0x804f48,0x846328), +/out/svc_dec_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6130000012f4 at pc 0x000000605398 bp 0x7fff37646f10 sp 0x7fff37646f08 +READ of size 1 at 0x6130000012f4 thread T0 + #0 0x605397 in isvcd_interlyr_motion_mode_pred_dyadic /src/libavc/decoder/svc/isvcd_mode_mv_resamp.c:2622:48 + #1 0x5d2e73 in isvcd_interlyr_motion_mode_pred /src/libavc/decoder/svc/isvcd_process_epslice.c:164:13 + #2 0x5d2e73 in isvcd_mv_pred_ref_tfr_nby2_epmb /src/libavc/decoder/svc/isvcd_process_epslice.c:238:30 + #3 0x5a59df in isvcd_parse_inter_slice_data_cabac_enh_lyr /src/libavc/decoder/svc/isvcd_parse_epslice.c:1510:19 + #4 0x5a2e51 in isvcd_parse_epslice /src/libavc/decoder/svc/isvcd_parse_epslice.c:476:11 + #5 0x5c5f31 in isvcd_parse_decode_slice_ext_nal /src/libavc/decoder/svc/isvcd_parse_slice.c:1496:15 + #6 0x5b9a35 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1064:44 + #7 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #8 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #9 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #10 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #11 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #12 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #13 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #14 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f5eb7b3c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #16 0x41f75d in _start (/out/svc_dec_fuzzer+0x41f75d) + +0x6130000012f4 is located 52 bytes to the right of 192-byte region [0x613000001200,0x6130000012c0) +allocated by thread T0 here: + #0 0x52fb17 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x56c4d5 in iv_aligned_malloc(void*, int, int) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:86:13 + #2 0x5e4fce in isvcd_allocate_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:178:14 + #3 0x5e8505 in isvcd_init_pic /src/libavc/decoder/svc/isvcd_utils.c:843:15 + #4 0x5be784 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:283:11 + #5 0x5cbf34 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2390:19 + #6 0x5b995b in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1006:40 + #7 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #8 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #9 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #10 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #11 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #12 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #13 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #14 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f5eb7b3c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/svc/isvcd_mode_mv_resamp.c:2622:48 in isvcd_interlyr_motion_mode_pred_dyadic +Shadow bytes around the buggy address: + 0x0c267fff8200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c267fff8210: 00 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff8220: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff8230: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff8240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c267fff8250: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa[fa]fa + 0x0c267fff8260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff8270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c267fff8280: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa + 0x0c267fff8290: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff82a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-840.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-840.txt new file mode 100644 index 000000000..459112ceb --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-840.txt @@ -0,0 +1,30 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2762913318 +INFO: Loaded 1 modules (16702 inline 8-bit counters): 16702 [0x8a2000, 0x8a613e), +INFO: Loaded 1 PC tables (16702 PCs): 16702 [0x804f48,0x846328), +/out/svc_dec_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000000000 bp 0x7ffea98d8490 sp 0x7ffea98d81f8 T0) +==1==Hint: pc points to the zero page. +==1==The signal is caused by a READ memory access. +==1==Hint: address points to the zero page. + #0 0x0 () + #1 0x5a9da7 in isvcd_parse_inter_slice_data_cavlc_enh_lyr /src/libavc/decoder/svc/isvcd_parse_epslice.c:1909:19 + #2 0x5a2e51 in isvcd_parse_epslice /src/libavc/decoder/svc/isvcd_parse_epslice.c:476:11 + #3 0x5c5f31 in isvcd_parse_decode_slice_ext_nal /src/libavc/decoder/svc/isvcd_parse_slice.c:1496:15 + #4 0x5b9a35 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1064:44 + #5 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #6 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #7 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #8 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #9 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fb3229d0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV () +==1==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-97.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-97.txt new file mode 100644 index 000000000..f33dd2950 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2023-97.txt @@ -0,0 +1,62 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2762408386 +INFO: Loaded 1 modules (16702 inline 8-bit counters): 16702 [0x8a2000, 0x8a613e), +INFO: Loaded 1 PC tables (16702 PCs): 16702 [0x804f48,0x846328), +/out/svc_dec_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6130000092b6 at pc 0x0000005f35d2 bp 0x7ffe76bcc540 sp 0x7ffe76bcc538 +READ of size 1 at 0x6130000092b6 thread T0 + #0 0x5f35d1 in isvcd_reflayer_construction_dyadic /src/libavc/decoder/svc/isvcd_intra_resamp.c:2116:45 + #1 0x5f5333 in isvcd_intra_resamp_mb_dyadic /src/libavc/decoder/svc/isvcd_intra_resamp.c:3572:11 + #2 0x5d9c9b in isvcd_process_ibl_mb /src/libavc/decoder/svc/isvcd_process_epslice.c:1762:15 + #3 0x5db20b in isvcd_decode_recon_tfr_nmb_non_base_lyr /src/libavc/decoder/svc/isvcd_process_epslice.c:1340:19 + #4 0x5a5bff in isvcd_parse_inter_slice_data_cabac_enh_lyr /src/libavc/decoder/svc/isvcd_parse_epslice.c:1528:23 + #5 0x5a2e51 in isvcd_parse_epslice /src/libavc/decoder/svc/isvcd_parse_epslice.c:476:11 + #6 0x5c5f31 in isvcd_parse_decode_slice_ext_nal /src/libavc/decoder/svc/isvcd_parse_slice.c:1496:15 + #7 0x5b9a35 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1064:44 + #8 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #9 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #10 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #11 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #12 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #13 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #14 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #15 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #16 0x7fcc5f966082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #17 0x41f75d in _start (/out/svc_dec_fuzzer+0x41f75d) + +Address 0x6130000092b6 is a wild pointer inside of access range of size 0x000000000001. +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/svc/isvcd_intra_resamp.c:2116:45 in isvcd_reflayer_construction_dyadic +Shadow bytes around the buggy address: + 0x0c267fff9200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff9210: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff9220: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff9230: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff9240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c267fff9250: fa fa fa fa fa fa[fa]fa fa fa fa fa fa fa fa fa + 0x0c267fff9260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff9270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff9280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff9290: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff92a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2024-637.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2024-637.txt new file mode 100644 index 000000000..1e3296bf9 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2024-637.txt @@ -0,0 +1,69 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2765563465 +INFO: Loaded 1 modules (16702 inline 8-bit counters): 16702 [0x8a2000, 0x8a613e), +INFO: Loaded 1 PC tables (16702 PCs): 16702 [0x804f48,0x846328), +/out/svc_dec_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61f000001a80 at pc 0x00000052e40c bp 0x7fff1a16c730 sp 0x7fff1a16bf00 +WRITE of size 48 at 0x61f000001a80 thread T0 + #0 0x52e40b in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x6a023e in ih264d_fmt_conv_420sp_to_420sp_swap_uv /src/libavc/decoder/ih264d_format_conv.c:497:9 + #2 0x6a023e in ih264d_format_convert /src/libavc/decoder/ih264d_format_conv.c:765:13 + #3 0x58537d in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5607:21 + #4 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #5 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #6 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #7 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7eff74de0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #12 0x41f75d in _start (/out/svc_dec_fuzzer+0x41f75d) + +0x61f000001a80 is located 0 bytes to the right of 3072-byte region [0x61f000000e80,0x61f000001a80) +allocated by thread T0 here: + #0 0x52fb17 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x56e141 in iv_aligned_malloc /src/libavc/fuzzer/svc_dec_fuzzer.cpp:86:13 + #2 0x56e141 in Codec::allocFrame() /src/libavc/fuzzer/svc_dec_fuzzer.cpp:309:48 + #3 0x56f3de in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:400:9 + #4 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #5 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7eff74de0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c3e7fff8300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3e7fff8310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3e7fff8320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3e7fff8330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3e7fff8340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c3e7fff8350:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c3e7fff8360: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c3e7fff8370: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c3e7fff8380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c3e7fff8390: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c3e7fff83a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2024-638.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2024-638.txt new file mode 100644 index 000000000..b95d9bcab --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2024-638.txt @@ -0,0 +1,77 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2766538732 +INFO: Loaded 1 modules (16702 inline 8-bit counters): 16702 [0x8a2000, 0x8a613e), +INFO: Loaded 1 PC tables (16702 PCs): 16702 [0x804f48,0x846328), +/out/svc_dec_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61c000002f00 at pc 0x00000052e40c bp 0x7f0b890eedb0 sp 0x7f0b890ee580 +WRITE of size 32 at 0x61c000002f00 thread T25 + #0 0x52e40b in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x6a023e in ih264d_fmt_conv_420sp_to_420sp_swap_uv /src/libavc/decoder/ih264d_format_conv.c:497:9 + #2 0x6a023e in ih264d_format_convert /src/libavc/decoder/ih264d_format_conv.c:765:13 + #3 0x712a1b in ih264d_decode_picture_thread /src/libavc/decoder/ih264d_thread_parse_decode.c:644:13 + #4 0x7f0b8d76f608 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8608) (BuildId: 7b4536f41cdaa5888408e82d0836e33dcf436466) + #5 0x7f0b8d669132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +0x61c000002f00 is located 0 bytes to the right of 1664-byte region [0x61c000002880,0x61c000002f00) +allocated by thread T0 here: + #0 0x52fb17 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x56e141 in iv_aligned_malloc /src/libavc/fuzzer/svc_dec_fuzzer.cpp:86:13 + #2 0x56e141 in Codec::allocFrame() /src/libavc/fuzzer/svc_dec_fuzzer.cpp:309:48 + #3 0x56f3de in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:400:9 + #4 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #5 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f0b8d56e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +Thread T25 created by T0 here: + #0 0x5186bc in pthread_create /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:208:3 + #1 0x640331 in ithread_create /src/libavc/common/ithread.c:80:12 + #2 0x5cc130 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c + #3 0x5b995b in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1006:40 + #4 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #5 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #6 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #7 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #8 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f0b8d56e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c387fff8590: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c387fff85a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c387fff85b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c387fff85c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c387fff85d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c387fff85e0:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c387fff85f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c387fff8600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c387fff8610: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c387fff8620: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c387fff8630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2025-534.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2025-534.txt new file mode 100644 index 000000000..38327926d --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2025-534.txt @@ -0,0 +1,98 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2765783141 +INFO: Loaded 1 modules (16702 inline 8-bit counters): 16702 [0x8a2000, 0x8a613e), +INFO: Loaded 1 PC tables (16702 PCs): 16702 [0x804f48,0x846328), +/out/svc_dec_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x7fe86e17b29e at pc 0x00000064b7f0 bp 0x7ffcaaaa7260 sp 0x7ffcaaaa7258 +READ of size 16 at 0x7fe86e17b29e thread T0 + #0 0x64b7ef in ih264_inter_pred_luma_horz_ssse3 /src/libavc/common/x86/ih264_inter_pred_filters_ssse3.c:394:28 + #1 0x6a4fa1 in ih264d_motion_compensate_mp /src/libavc/decoder/ih264d_inter_pred.c:1125:13 + #2 0x5da9d0 in isvcd_decode_recon_tfr_nmb_non_base_lyr /src/libavc/decoder/svc/isvcd_process_epslice.c:1215:17 + #3 0x5a9fb8 in isvcd_parse_inter_slice_data_cavlc_enh_lyr /src/libavc/decoder/svc/isvcd_parse_epslice.c:1927:23 + #4 0x730a0e in isvcd_parse_ebslice /src/libavc/decoder/svc/isvcd_parse_ebslice.c:1826:11 + #5 0x5c5e40 in isvcd_parse_decode_slice_ext_nal /src/libavc/decoder/svc/isvcd_parse_slice.c:1503:15 + #6 0x5b9a35 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1064:44 + #7 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #8 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #9 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #10 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #11 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #12 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #13 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #14 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7fe87223a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #16 0x41f75d in _start (/out/svc_dec_fuzzer+0x41f75d) + +0x7fe86e17b29e is located 719518 bytes inside of 1204224-byte region [0x7fe86e0cb800,0x7fe86e1f1800) +freed by thread T0 here: + #0 0x52ed22 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x56c592 in iv_aligned_free(void*, void*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:96:5 + #2 0x719dce in ih264d_free_dynamic_bufs /src/libavc/decoder/ih264d_utils.c:2337:5 + #3 0x5e461f in isvcd_free_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:87:5 + #4 0x570f23 in isvcd_init_decoder /src/libavc/decoder/svc/isvcd_api.c:1081:5 + #5 0x58bb25 in isvcd_reset /src/libavc/decoder/svc/isvcd_api.c:6444:13 + #6 0x58bb25 in isvcd_ctl /src/libavc/decoder/svc/isvcd_api.c:6506:19 + #7 0x5910e8 in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7303:26 + #8 0x56f1a4 in resetCodec /src/libavc/fuzzer/svc_dec_fuzzer.cpp:186:5 + #9 0x56f1a4 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:382:9 + #10 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #11 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #12 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #13 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #14 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7fe87223a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +previously allocated by thread T0 here: + #0 0x52fb17 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x56c4d5 in iv_aligned_malloc(void*, int, int) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:86:13 + #2 0x71856d in ih264d_allocate_dynamic_bufs /src/libavc/decoder/ih264d_utils.c:2170:14 + #3 0x5e4ca3 in isvcd_allocate_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:126:18 + #4 0x5e8505 in isvcd_init_pic /src/libavc/decoder/svc/isvcd_utils.c:843:15 + #5 0x5be784 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:283:11 + #6 0x5c4c16 in isvcd_parse_decode_slice_ext_nal /src/libavc/decoder/svc/isvcd_parse_slice.c:1181:19 + #7 0x5b9a35 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1064:44 + #8 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #9 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #10 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #11 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #12 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #13 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #14 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #15 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #16 0x7fe87223a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/libavc/common/x86/ih264_inter_pred_filters_ssse3.c:394:28 in ih264_inter_pred_luma_horz_ssse3 +Shadow bytes around the buggy address: + 0x0ffd8dc27600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ffd8dc27610: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ffd8dc27620: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ffd8dc27630: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ffd8dc27640: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0ffd8dc27650: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ffd8dc27660: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ffd8dc27670: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ffd8dc27680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ffd8dc27690: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ffd8dc276a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2025-584.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2025-584.txt new file mode 100644 index 000000000..d69531c65 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2025-584.txt @@ -0,0 +1,74 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2766794094 +INFO: Loaded 1 modules (16702 inline 8-bit counters): 16702 [0x8a2000, 0x8a613e), +INFO: Loaded 1 PC tables (16702 PCs): 16702 [0x804f48,0x846328), +/out/svc_dec_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6300000003d0 at pc 0x0000005b34a2 bp 0x7ffedbd33830 sp 0x7ffedbd33828 +READ of size 2 at 0x6300000003d0 thread T0 + #0 0x5b34a1 in isvcd_mark_err_slice_skip /src/libavc/decoder/svc/isvcd_parse_epslice.c:2840:46 + #1 0x584846 in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5374:28 + #2 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #3 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #4 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #5 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fe3f78e5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #10 0x41f75d in _start (/out/svc_dec_fuzzer+0x41f75d) + +0x6300000003d0 is located 48 bytes to the left of 61440-byte region [0x630000000400,0x63000000f400) +allocated by thread T0 here: + #0 0x52fb17 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x56c4d5 in iv_aligned_malloc(void*, int, int) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:86:13 + #2 0x717efb in ih264d_allocate_dynamic_bufs /src/libavc/decoder/ih264d_utils.c:2067:14 + #3 0x5e4ca3 in isvcd_allocate_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:126:18 + #4 0x5e8505 in isvcd_init_pic /src/libavc/decoder/svc/isvcd_utils.c:843:15 + #5 0x5be784 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:283:11 + #6 0x5cbf34 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2390:19 + #7 0x5b995b in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1006:40 + #8 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #9 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #10 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #11 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #12 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #13 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #14 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #15 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #16 0x7fe3f78e5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/svc/isvcd_parse_epslice.c:2840:46 in isvcd_mark_err_slice_skip +Shadow bytes around the buggy address: + 0x0c607fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c607fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c607fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c607fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c607fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c607fff8070: fa fa fa fa fa fa fa fa fa fa[fa]fa fa fa fa fa + 0x0c607fff8080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c607fff8090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c607fff80a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c607fff80b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c607fff80c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2025-589.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2025-589.txt new file mode 100644 index 000000000..abfa327df --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/crashes/OSV-2025-589.txt @@ -0,0 +1,78 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2767045103 +INFO: Loaded 1 modules (16702 inline 8-bit counters): 16702 [0x8a2000, 0x8a613e), +INFO: Loaded 1 PC tables (16702 PCs): 16702 [0x804f48,0x846328), +/out/svc_dec_fuzzer: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62f00007ca20 at pc 0x0000005dfc69 bp 0x7ffda6dfc290 sp 0x7ffda6dfc288 +READ of size 1 at 0x62f00007ca20 thread T0 + #0 0x5dfc68 in isvcd_decode_recon_tfr_nmb_base_lyr /src/libavc/decoder/svc/isvcd_process_epslice.c:1564:37 + #1 0x5ad9df in isvcd_parse_inter_slice_data_cabac /src/libavc/decoder/svc/isvcd_parse_epslice.c:779:21 + #2 0x5b4c36 in isvcd_parse_pslice /src/libavc/decoder/svc/isvcd_parse_epslice.c:3552:11 + #3 0x5cd1d0 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2705:15 + #4 0x5b995b in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1006:40 + #5 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #6 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #7 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #8 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #9 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f5cecba0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #14 0x41f75d in _start (/out/svc_dec_fuzzer+0x41f75d) + +0x62f00007ca20 is located 1568 bytes to the right of 49152-byte region [0x62f000070400,0x62f00007c400) +allocated by thread T0 here: + #0 0x52fb17 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x56c4d5 in iv_aligned_malloc(void*, int, int) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:86:13 + #2 0x717a09 in ih264d_allocate_dynamic_bufs /src/libavc/decoder/ih264d_utils.c:2000:14 + #3 0x5e4ca3 in isvcd_allocate_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:126:18 + #4 0x5e8505 in isvcd_init_pic /src/libavc/decoder/svc/isvcd_utils.c:843:15 + #5 0x5be784 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:283:11 + #6 0x5cbf34 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2390:19 + #7 0x5b995b in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1006:40 + #8 0x5840ae in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5291:27 + #9 0x5910ff in isvcd_api_function /src/libavc/decoder/svc/isvcd_api.c:7285:26 + #10 0x56f07b in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:376:11 + #11 0x5701fc in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:446:22 + #12 0x43de33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #13 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #14 0x42ee3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #15 0x458372 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #16 0x7f5cecba0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/svc/isvcd_process_epslice.c:1564:37 in isvcd_decode_recon_tfr_nmb_base_lyr +Shadow bytes around the buggy address: + 0x0c5e800078f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5e80007900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5e80007910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5e80007920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5e80007930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c5e80007940: fa fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa + 0x0c5e80007950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5e80007960: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5e80007970: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5e80007980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c5e80007990: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/COMMANDS.md b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/COMMANDS.md new file mode 100644 index 000000000..0bd947126 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/COMMANDS.md @@ -0,0 +1,116 @@ +# Original Crash Collection: libavc svc_dec_fuzzer + +Generated: 2026-04-24 UTC + +Benchmark: `libavc_transplant_svc_dec_fuzzer` +Project: `libavc` +Fuzzer: `svc_dec_fuzzer` +Sanitizer: `address` + +Target source commit: `c38af025abf0040f6693d15f4ce2e878a728cfee` (2023-02-20) +Target-era base-runner: `gcr.io/oss-fuzz-base/base-runner@sha256:3a190cfbada024425c48aebd06558a0e974e819f69625e886b1fe2b1a138064d` (2022-07, from `get_base_runner_for_date()`) + +## Semantics + +Each `OSV-*.txt` is a crash on the pristine source tree: +- **Local bugs** (already triggering at target) were replayed against the NAS prebuilt + `-address` binary at target commit (`c38af025abf0`) using the target-era base-runner. +- **Migration bugs** came from `/mnt/nas/linke/new_migrate/libavc/svc_dec_fuzzer/crash/`, + captured per-bug by the migration pipeline with `fuzz_helper.py collect_crash + --runner-image auto` which era-matches the runner per source commit. + +Note: `libavc_builds.csv` contains only 29 curated entries (mainly for +`buildAndtest.py` coverage surveys) and does NOT cover this benchmark's target or +migration commits. The `oss_fuzz_commit` column in `collect_crash_builds.csv` +is therefore written as `auto`, which instructs `fuzz_helper.py collect_crash +--runner-image auto --commit-date ` to pick an era-matched base-builder/runner +via `get_base_builder_for_date()` at reproduction time. + +## Bug → source commit / OSS-Fuzz commit + +| Bug | Kind | Source commit | OSS-Fuzz commit | +| --- | --- | --- | --- | +| OSV-2023-1205 | local | `c38af025abf0` | `auto` | +| OSV-2023-1206 | local | `c38af025abf0` | `auto` | +| OSV-2023-1207 | local | `c38af025abf0` | `auto` | +| OSV-2023-1208 | local | `c38af025abf0` | `auto` | +| OSV-2023-1294 | local | `c38af025abf0` | `auto` | +| OSV-2023-1311 | local | `c38af025abf0` | `auto` | +| OSV-2023-1312 | local | `c38af025abf0` | `auto` | +| OSV-2023-1313 | local | `c38af025abf0` | `auto` | +| OSV-2023-342 | local | `c38af025abf0` | `auto` | +| OSV-2023-68 | migration | `7f19ac220647` | `auto` | +| OSV-2023-75 | migration | `7f19ac220647` | `auto` | +| OSV-2023-840 | local | `c38af025abf0` | `auto` | +| OSV-2023-97 | local | `c38af025abf0` | `auto` | +| OSV-2024-637 | local | `c38af025abf0` | `auto` | +| OSV-2024-638 | migration | `72315c11ac59` | `auto` | +| OSV-2025-534 | local | `c38af025abf0` | `auto` | +| OSV-2025-584 | migration | `2f6371b3b8d6` | `52ee750b71ec` | +| OSV-2025-589 | migration | `2f6371b3b8d6` | `52ee750b71ec` | + +## Re-run command (migration bugs) + +```bash +BUILD_CSV='/home/user/oss-fuzz-build/fuzzbench/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/collect_crash_builds.csv' +OUT_DIR='/home/user/oss-fuzz-build/fuzzbench/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes' + +while IFS=$'\t' read -r bug commit; do + [ "$bug" = "bug" ] && continue + ts=$(git -C /home/user/tasks-git/libavc log -1 --format=%ct "$commit") + /home/user/pyenv/venv/bin/python3 /home/user/oss-fuzz-for-select/script/fuzz_helper.py collect_crash \ + --commit "$commit" \ + --build_csv "$BUILD_CSV" \ + --testcases /home/user/oss-fuzz-for-select/pocs/tmp \ + --test_input "testcase-${bug}" \ + --runner-image auto --commit-date "$ts" \ + libavc svc_dec_fuzzer + cp "/home/user/oss-fuzz-build/data/crash/target_crash-${commit:0:6}-testcase-${bug}.txt" "${OUT_DIR}/${bug}.txt" +done <<'JOBS' +bug commit +OSV-2023-68 7f19ac220647a58262bf08262049f7340030e1bf +OSV-2023-75 7f19ac220647a58262bf08262049f7340030e1bf +OSV-2024-638 72315c11ac595a73d3b629cc36647327156d5875 +OSV-2025-584 2f6371b3b8d69ee596fa44c48ca522db27f6f22f +OSV-2025-589 2f6371b3b8d69ee596fa44c48ca522db27f6f22f +JOBS +``` + +## Re-run command (local bugs) + +Uses the NAS prebuilt target-commit binary (built with a modern OSS-Fuzz toolchain, +compatible with the 2022-07 base-runner) + the target-era base-runner. + +```bash +TARGET=c38af025abf0040f6693d15f4ce2e878a728cfee +RUNNER_IMAGE='gcr.io/oss-fuzz-base/base-runner@sha256:3a190cfbada024425c48aebd06558a0e974e819f69625e886b1fe2b1a138064d' +BIN_DIR="/mnt/nas/linke/libavc/libavc-${TARGET}-address" +OUT_DIR='/home/user/oss-fuzz-build/fuzzbench/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes' + +for bug in \ + OSV-2023-1205 \ + OSV-2023-1206 \ + OSV-2023-1207 \ + OSV-2023-1208 \ + OSV-2023-1294 \ + OSV-2023-1311 \ + OSV-2023-1312 \ + OSV-2023-1313 \ + OSV-2023-342 \ + OSV-2023-840 \ + OSV-2023-97 \ + OSV-2024-637 \ + OSV-2025-534 +; do + TMPD=$(mktemp -d) + cp /home/user/oss-fuzz-for-select/pocs/tmp/testcase-${bug} "$TMPD/" + docker run --rm --platform linux/amd64 --shm-size=2g \ + -v "$BIN_DIR":/out:ro -v "$TMPD":/corpus:ro \ + -e ASAN_OPTIONS=abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 \ + "$RUNNER_IMAGE" \ + /out/svc_dec_fuzzer "/corpus/testcase-${bug}" -rss_limit_mb=8192 \ + > "${OUT_DIR}/${bug}.txt" 2>&1 + rm -rf "$TMPD" +done +``` + diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1205.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1205.txt new file mode 100644 index 000000000..e117c815d --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1205.txt @@ -0,0 +1,78 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2695918906 +INFO: Loaded 1 modules (16541 inline 8-bit counters): 16541 [0x5562c127d5e0, 0x5562c128167d), +INFO: Loaded 1 PC tables (16541 PCs): 16541 [0x5562c1281680,0x5562c12c2050), +/out/svc_dec_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-1205 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x524000007eb4 at pc 0x5562c105fe60 bp 0x7ffddab894a0 sp 0x7ffddab89498 +WRITE of size 1 at 0x524000007eb4 thread T0 + #0 0x5562c105fe5f in isvcd_populate_res_prms /src/libavc/decoder/svc/isvcd_intra_resamp.c:4802:37 + #1 0x5562c100ac75 in isvcd_parse_interlayer_resamp_func_init /src/libavc/decoder/svc/isvcd_parse_epslice.c:3208:15 + #2 0x5562c1018009 in isvcd_mark_err_slice_skip /src/libavc/decoder/svc/isvcd_parse_epslice.c:2973:11 + #3 0x5562c0febe3c in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5354:28 + #4 0x5562c0fd8636 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #5 0x5562c0fd918e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #6 0x5562c0e8b2f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #7 0x5562c0e76565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #8 0x5562c0e7bfff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #9 0x5562c0ea72a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f318044a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x5562c0e6e74d in _start (/out/svc_dec_fuzzer+0xa274d) + +DEDUP_TOKEN: isvcd_populate_res_prms--isvcd_parse_interlayer_resamp_func_init--isvcd_mark_err_slice_skip +0x524000007eb4 is located 4 bytes after 7600-byte region [0x524000006100,0x524000007eb0) +allocated by thread T0 here: + #0 0x5562c0f97b67 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:142:3 + #1 0x5562c0fd6846 in iv_aligned_malloc(void*, int, int) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:85:13 + #2 0x5562c104ae35 in isvcd_allocate_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:178:14 + #3 0x5562c104e218 in isvcd_init_pic /src/libavc/decoder/svc/isvcd_utils.c:843:15 + #4 0x5562c1025443 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:283:11 + #5 0x5562c10328a9 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2390:19 + #6 0x5562c1020723 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1005:40 + #7 0x5562c0feb83c in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5290:27 + #8 0x5562c0fd8636 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #9 0x5562c0fd918e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #10 0x5562c0e8b2f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #11 0x5562c0e76565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #12 0x5562c0e7bfff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #13 0x5562c0ea72a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f318044a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: ___interceptor_posix_memalign--iv_aligned_malloc(void*, int, int)--isvcd_allocate_dynamic_bufs +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/svc/isvcd_intra_resamp.c:4802:37 in isvcd_populate_res_prms +Shadow bytes around the buggy address: + 0x524000007c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x524000007c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x524000007d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x524000007d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x524000007e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x524000007e80: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa + 0x524000007f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x524000007f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x524000008000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x524000008080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x524000008100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1206.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1206.txt new file mode 100644 index 000000000..eb189da0b --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1206.txt @@ -0,0 +1,85 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2698256296 +INFO: Loaded 1 modules (16541 inline 8-bit counters): 16541 [0x5555f67605e0, 0x5555f676467d), +INFO: Loaded 1 PC tables (16541 PCs): 16541 [0x5555f6764680,0x5555f67a5050), +/out/svc_dec_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-1206 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x531000060cf0 at pc 0x5555f6478044 bp 0x7fa340eb1b20 sp 0x7fa340eb12e0 +WRITE of size 640 at 0x531000060cf0 thread T4 + #0 0x5555f6478043 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x5555f65e99cd in ih264d_fmt_conv_420sp_to_420sp /src/libavc/decoder/ih264d_format_conv.c:400:9 + #2 0x5555f65e99cd in ih264d_format_convert /src/libavc/decoder/ih264d_format_conv.c:752:13 + #3 0x5555f66578d9 in ih264d_decode_recon_tfr_nmb_thread /src/libavc/decoder/ih264d_thread_parse_decode.c:257:21 + #4 0x5555f6659577 in ih264d_decode_slice_thread /src/libavc/decoder/ih264d_thread_parse_decode.c:585:15 + #5 0x5555f66598af in ih264d_decode_picture_thread /src/libavc/decoder/ih264d_thread_parse_decode.c:621:13 + #6 0x5555f6477bf8 in asan_thread_start(void*) /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:239:28 + #7 0x7fa346af7608 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8608) (BuildId: 9753720502573b97dbac595b61fd72c2df18e078) + #8 0x7fa3469d3352 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f352) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __asan_memcpy--ih264d_fmt_conv_420sp_to_420sp--ih264d_format_convert +0x531000060cf0 is located 0 bytes after 66800-byte region [0x531000050800,0x531000060cf0) +allocated by thread T0 here: + #0 0x5555f647ab67 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:142:3 + #1 0x5555f64babc4 in iv_aligned_malloc /src/libavc/fuzzer/svc_dec_fuzzer.cpp:85:13 + #2 0x5555f64babc4 in Codec::allocFrame() /src/libavc/fuzzer/svc_dec_fuzzer.cpp:308:48 + #3 0x5555f64bb8d9 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:399:9 + #4 0x5555f64bc18e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #5 0x5555f636e2f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #6 0x5555f6359565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #7 0x5555f635efff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #8 0x5555f638a2a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fa3468d8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: ___interceptor_posix_memalign--iv_aligned_malloc--Codec::allocFrame() +Thread T4 created by T0 here: + #0 0x5555f645fc41 in pthread_create /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:250:3 + #1 0x5555f64fc679 in isvcd_mark_err_slice_skip /src/libavc/decoder/svc/isvcd_parse_epslice.c:2773:21 + #2 0x5555f651495a in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2236:15 + #3 0x5555f6503723 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1005:40 + #4 0x5555f64ce83c in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5290:27 + #5 0x5555f64bb636 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #6 0x5555f64bc18e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #7 0x5555f636e2f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #8 0x5555f6359565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #9 0x5555f635efff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #10 0x5555f638a2a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fa3468d8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: ___interceptor_pthread_create--isvcd_mark_err_slice_skip--isvcd_parse_decode_slice +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/ih264d_format_conv.c:400:9 in ih264d_fmt_conv_420sp_to_420sp +Shadow bytes around the buggy address: + 0x531000060a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x531000060a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x531000060b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x531000060b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x531000060c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x531000060c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa + 0x531000060d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x531000060d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x531000060e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x531000060e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x531000060f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1207.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1207.txt new file mode 100644 index 000000000..3d272dba1 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1207.txt @@ -0,0 +1,80 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2702677257 +INFO: Loaded 1 modules (16541 inline 8-bit counters): 16541 [0x559e719625e0, 0x559e7196667d), +INFO: Loaded 1 PC tables (16541 PCs): 16541 [0x559e71966680,0x559e719a7050), +/out/svc_dec_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-1207 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x511000002386 at pc 0x559e7167a225 bp 0x7ffd6e8f4e10 sp 0x7ffd6e8f45e0 +WRITE of size 828 at 0x511000002386 thread T0 + #0 0x559e7167a224 in __asan_memset /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:67:3 + #1 0x559e7170a631 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:298:13 + #2 0x559e717178a9 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2390:19 + #3 0x559e71705723 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1005:40 + #4 0x559e716d083c in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5290:27 + #5 0x559e716bd636 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #6 0x559e716be18e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #7 0x559e715702f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #8 0x559e7155b565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #9 0x559e71560fff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #10 0x559e7158c2a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f483a67f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x559e7155374d in _start (/out/svc_dec_fuzzer+0xa274d) + +DEDUP_TOKEN: __asan_memset--isvcd_start_of_pic--isvcd_parse_decode_slice +0x511000002386 is located 0 bytes after 6-byte region [0x511000002380,0x511000002386) +allocated by thread T0 here: + #0 0x559e7167cb67 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:142:3 + #1 0x559e716bb846 in iv_aligned_malloc(void*, int, int) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:85:13 + #2 0x559e718606bb in ih264d_allocate_dynamic_bufs /src/libavc/decoder/ih264d_utils.c:1935:14 + #3 0x559e7172fb05 in isvcd_allocate_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:126:18 + #4 0x559e71733218 in isvcd_init_pic /src/libavc/decoder/svc/isvcd_utils.c:843:15 + #5 0x559e7170a443 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:283:11 + #6 0x559e717178a9 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2390:19 + #7 0x559e71705723 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1005:40 + #8 0x559e716d083c in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5290:27 + #9 0x559e716bd636 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #10 0x559e716be18e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #11 0x559e715702f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #12 0x559e7155b565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #13 0x559e71560fff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #14 0x559e7158c2a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f483a67f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: ___interceptor_posix_memalign--iv_aligned_malloc(void*, int, int)--ih264d_allocate_dynamic_bufs +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/svc/isvcd_parse_slice.c:298:13 in isvcd_start_of_pic +Shadow bytes around the buggy address: + 0x511000002100: 00 00 00 01 fa fa fa fa fa fa fa fa fa fa fa fa + 0x511000002180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x511000002200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x511000002280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x511000002300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x511000002380:[06]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x511000002400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x511000002480: 06 fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x511000002500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x511000002580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x511000002600: 00 04 fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1208.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1208.txt new file mode 100644 index 000000000..296e1714e --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1208.txt @@ -0,0 +1,82 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2706301538 +INFO: Loaded 1 modules (16541 inline 8-bit counters): 16541 [0x55fe13fd55e0, 0x55fe13fd967d), +INFO: Loaded 1 PC tables (16541 PCs): 16541 [0x55fe13fd9680,0x55fe1401a050), +/out/svc_dec_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-1208 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x51a000000b30 at pc 0x55fe13ced044 bp 0x7fc746876d00 sp 0x7fc7468764c0 +WRITE of size 640 at 0x51a000000b30 thread T41 + #0 0x55fe13ced043 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x55fe13e5e9cd in ih264d_fmt_conv_420sp_to_420sp /src/libavc/decoder/ih264d_format_conv.c:400:9 + #2 0x55fe13e5e9cd in ih264d_format_convert /src/libavc/decoder/ih264d_format_conv.c:752:13 + #3 0x55fe13ecea4e in ih264d_decode_picture_thread /src/libavc/decoder/ih264d_thread_parse_decode.c:644:13 + #4 0x55fe13cecbf8 in asan_thread_start(void*) /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:239:28 + #5 0x7fc74c4d0608 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8608) (BuildId: 9753720502573b97dbac595b61fd72c2df18e078) + #6 0x7fc74c3ac352 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f352) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __asan_memcpy--ih264d_fmt_conv_420sp_to_420sp--ih264d_format_convert +0x51a000000b30 is located 0 bytes after 1200-byte region [0x51a000000680,0x51a000000b30) +allocated by thread T0 here: + #0 0x55fe13cefb67 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:142:3 + #1 0x55fe13d2fbc4 in iv_aligned_malloc /src/libavc/fuzzer/svc_dec_fuzzer.cpp:85:13 + #2 0x55fe13d2fbc4 in Codec::allocFrame() /src/libavc/fuzzer/svc_dec_fuzzer.cpp:308:48 + #3 0x55fe13d308d9 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:399:9 + #4 0x55fe13d3118e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #5 0x55fe13be32f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #6 0x55fe13bce565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #7 0x55fe13bd3fff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #8 0x55fe13bff2a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fc74c2b1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: ___interceptor_posix_memalign--iv_aligned_malloc--Codec::allocFrame() +Thread T41 created by T0 here: + #0 0x55fe13cd4c41 in pthread_create /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:250:3 + #1 0x55fe13d8aaa5 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c + #2 0x55fe13d78723 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1005:40 + #3 0x55fe13d4383c in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5290:27 + #4 0x55fe13d30636 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #5 0x55fe13d3118e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #6 0x55fe13be32f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #7 0x55fe13bce565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #8 0x55fe13bd3fff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #9 0x55fe13bff2a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fc74c2b1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: ___interceptor_pthread_create--isvcd_parse_decode_slice--isvcd_parse_nal_unit +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/ih264d_format_conv.c:400:9 in ih264d_fmt_conv_420sp_to_420sp +Shadow bytes around the buggy address: + 0x51a000000880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x51a000000900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x51a000000980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x51a000000a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x51a000000a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x51a000000b00: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa + 0x51a000000b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x51a000000c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x51a000000c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x51a000000d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x51a000000d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1294.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1294.txt new file mode 100644 index 000000000..8193cf436 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1294.txt @@ -0,0 +1,79 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2710147012 +INFO: Loaded 1 modules (16541 inline 8-bit counters): 16541 [0x55f9cdb9f5e0, 0x55f9cdba367d), +INFO: Loaded 1 PC tables (16541 PCs): 16541 [0x55f9cdba3680,0x55f9cdbe4050), +/out/svc_dec_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-1294 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5110000023d0 at pc 0x55f9cda1002a bp 0x7fffd82f8430 sp 0x7fffd82f8428 +READ of size 1 at 0x5110000023d0 thread T0 + #0 0x55f9cda10029 in ih264d_compute_bs_non_mbaff /src/libavc/decoder/ih264d_compute_bs.c:1181:38 + #1 0x55f9cda8a6b9 in ih264d_mv_pred_ref_tfr_nby2_pmb /src/libavc/decoder/ih264d_process_pslice.c:321:17 + #2 0x55f9cd93ae11 in isvcd_mark_err_slice_skip /src/libavc/decoder/svc/isvcd_parse_epslice.c:3126:13 + #3 0x55f9cd90de3c in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5354:28 + #4 0x55f9cd8fa636 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #5 0x55f9cd8fb18e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #6 0x55f9cd7ad2f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #7 0x55f9cd798565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #8 0x55f9cd79dfff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #9 0x55f9cd7c92a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f2220d53082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x55f9cd79074d in _start (/out/svc_dec_fuzzer+0xa274d) + +DEDUP_TOKEN: ih264d_compute_bs_non_mbaff--ih264d_mv_pred_ref_tfr_nby2_pmb--isvcd_mark_err_slice_skip +0x5110000023d0 is located 0 bytes after 80-byte region [0x511000002380,0x5110000023d0) +allocated by thread T0 here: + #0 0x55f9cd8b9b67 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:142:3 + #1 0x55f9cd8f8846 in iv_aligned_malloc(void*, int, int) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:85:13 + #2 0x55f9cda9d9f3 in ih264d_allocate_dynamic_bufs /src/libavc/decoder/ih264d_utils.c:1975:14 + #3 0x55f9cd96cb05 in isvcd_allocate_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:126:18 + #4 0x55f9cd970218 in isvcd_init_pic /src/libavc/decoder/svc/isvcd_utils.c:843:15 + #5 0x55f9cd947443 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:283:11 + #6 0x55f9cd9548a9 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2390:19 + #7 0x55f9cd942723 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1005:40 + #8 0x55f9cd90d83c in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5290:27 + #9 0x55f9cd8fa636 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #10 0x55f9cd8fb18e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #11 0x55f9cd7ad2f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #12 0x55f9cd798565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #13 0x55f9cd79dfff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #14 0x55f9cd7c92a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f2220d53082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: ___interceptor_posix_memalign--iv_aligned_malloc(void*, int, int)--ih264d_allocate_dynamic_bufs +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/ih264d_compute_bs.c:1181:38 in ih264d_compute_bs_non_mbaff +Shadow bytes around the buggy address: + 0x511000002100: 00 00 00 01 fa fa fa fa fa fa fa fa fa fa fa fa + 0x511000002180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x511000002200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x511000002280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x511000002300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x511000002380: 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa + 0x511000002400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x511000002480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x511000002500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x511000002580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x511000002600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1311.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1311.txt new file mode 100644 index 000000000..8394eb648 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1311.txt @@ -0,0 +1,82 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2714190769 +INFO: Loaded 1 modules (16541 inline 8-bit counters): 16541 [0x557ed0d835e0, 0x557ed0d8767d), +INFO: Loaded 1 PC tables (16541 PCs): 16541 [0x557ed0d87680,0x557ed0dc8050), +/out/svc_dec_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-1311 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x51a000000b30 at pc 0x557ed0a9b044 bp 0x7fca2e5b3d00 sp 0x7fca2e5b34c0 +WRITE of size 640 at 0x51a000000b30 thread T17 + #0 0x557ed0a9b043 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x557ed0c0ca9e in ih264d_fmt_conv_420sp_to_420p /src/libavc/decoder/ih264d_format_conv.c:611:13 + #2 0x557ed0c0ca9e in ih264d_format_convert /src/libavc/decoder/ih264d_format_conv.c:724:9 + #3 0x557ed0c7ca4e in ih264d_decode_picture_thread /src/libavc/decoder/ih264d_thread_parse_decode.c:644:13 + #4 0x557ed0a9abf8 in asan_thread_start(void*) /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:239:28 + #5 0x7fca34203608 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8608) (BuildId: 9753720502573b97dbac595b61fd72c2df18e078) + #6 0x7fca340df352 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f352) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __asan_memcpy--ih264d_fmt_conv_420sp_to_420p--ih264d_format_convert +0x51a000000b30 is located 0 bytes after 1200-byte region [0x51a000000680,0x51a000000b30) +allocated by thread T0 here: + #0 0x557ed0a9db67 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:142:3 + #1 0x557ed0addbc4 in iv_aligned_malloc /src/libavc/fuzzer/svc_dec_fuzzer.cpp:85:13 + #2 0x557ed0addbc4 in Codec::allocFrame() /src/libavc/fuzzer/svc_dec_fuzzer.cpp:308:48 + #3 0x557ed0ade8d9 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:399:9 + #4 0x557ed0adf18e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #5 0x557ed09912f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #6 0x557ed097c565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #7 0x557ed0981fff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #8 0x557ed09ad2a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fca33fe4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: ___interceptor_posix_memalign--iv_aligned_malloc--Codec::allocFrame() +Thread T17 created by T0 here: + #0 0x557ed0a82c41 in pthread_create /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:250:3 + #1 0x557ed0b38aa5 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c + #2 0x557ed0b26723 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1005:40 + #3 0x557ed0af183c in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5290:27 + #4 0x557ed0ade636 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #5 0x557ed0adf18e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #6 0x557ed09912f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #7 0x557ed097c565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #8 0x557ed0981fff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #9 0x557ed09ad2a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fca33fe4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: ___interceptor_pthread_create--isvcd_parse_decode_slice--isvcd_parse_nal_unit +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/ih264d_format_conv.c:611:13 in ih264d_fmt_conv_420sp_to_420p +Shadow bytes around the buggy address: + 0x51a000000880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x51a000000900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x51a000000980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x51a000000a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x51a000000a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x51a000000b00: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa + 0x51a000000b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x51a000000c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x51a000000c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x51a000000d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x51a000000d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1312.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1312.txt new file mode 100644 index 000000000..5ef59f5ea --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1312.txt @@ -0,0 +1,73 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2716504547 +INFO: Loaded 1 modules (16541 inline 8-bit counters): 16541 [0x55af7d0465e0, 0x55af7d04a67d), +INFO: Loaded 1 PC tables (16541 PCs): 16541 [0x55af7d04a680,0x55af7d08b050), +/out/svc_dec_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-1312 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x51f000001ae0 at pc 0x55af7cd5e044 bp 0x7ffea7dc34f0 sp 0x7ffea7dc2cb0 +WRITE of size 640 at 0x51f000001ae0 thread T0 + #0 0x55af7cd5e043 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x55af7cecfa9e in ih264d_fmt_conv_420sp_to_420p /src/libavc/decoder/ih264d_format_conv.c:611:13 + #2 0x55af7cecfa9e in ih264d_format_convert /src/libavc/decoder/ih264d_format_conv.c:724:9 + #3 0x55af7cdb5a07 in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5587:21 + #4 0x55af7cda1636 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #5 0x55af7cda218e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #6 0x55af7cc542f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #7 0x55af7cc3f565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #8 0x55af7cc44fff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #9 0x55af7cc702a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f6d14478082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x55af7cc3774d in _start (/out/svc_dec_fuzzer+0xa274d) + +DEDUP_TOKEN: __asan_memcpy--ih264d_fmt_conv_420sp_to_420p--ih264d_format_convert +0x51f000001ae0 is located 0 bytes after 3168-byte region [0x51f000000e80,0x51f000001ae0) +allocated by thread T0 here: + #0 0x55af7cd60b67 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:142:3 + #1 0x55af7cda0bc4 in iv_aligned_malloc /src/libavc/fuzzer/svc_dec_fuzzer.cpp:85:13 + #2 0x55af7cda0bc4 in Codec::allocFrame() /src/libavc/fuzzer/svc_dec_fuzzer.cpp:308:48 + #3 0x55af7cda18d9 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:399:9 + #4 0x55af7cda218e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #5 0x55af7cc542f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #6 0x55af7cc3f565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #7 0x55af7cc44fff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #8 0x55af7cc702a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f6d14478082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: ___interceptor_posix_memalign--iv_aligned_malloc--Codec::allocFrame() +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/ih264d_format_conv.c:611:13 in ih264d_fmt_conv_420sp_to_420p +Shadow bytes around the buggy address: + 0x51f000001800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x51f000001880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x51f000001900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x51f000001980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x51f000001a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x51f000001a80: 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa + 0x51f000001b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x51f000001b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x51f000001c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x51f000001c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x51f000001d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1313.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1313.txt new file mode 100644 index 000000000..70b607576 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-1313.txt @@ -0,0 +1,80 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2721299761 +INFO: Loaded 1 modules (16541 inline 8-bit counters): 16541 [0x555cd81655e0, 0x555cd816967d), +INFO: Loaded 1 PC tables (16541 PCs): 16541 [0x555cd8169680,0x555cd81aa050), +/out/svc_dec_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-1313 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x515000000691 at pc 0x555cd7e7d225 bp 0x7ffc960eb210 sp 0x7ffc960ea9e0 +WRITE of size 920 at 0x515000000691 thread T0 + #0 0x555cd7e7d224 in __asan_memset /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:67:3 + #1 0x555cd7f0d631 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:298:13 + #2 0x555cd7f1a8a9 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2390:19 + #3 0x555cd7f08723 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1005:40 + #4 0x555cd7ed383c in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5290:27 + #5 0x555cd7ec0636 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #6 0x555cd7ec118e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #7 0x555cd7d732f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #8 0x555cd7d5e565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #9 0x555cd7d63fff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #10 0x555cd7d8f2a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f1ad4b7d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x555cd7d5674d in _start (/out/svc_dec_fuzzer+0xa274d) + +DEDUP_TOKEN: __asan_memset--isvcd_start_of_pic--isvcd_parse_decode_slice +0x515000000691 is located 0 bytes after 273-byte region [0x515000000580,0x515000000691) +allocated by thread T0 here: + #0 0x555cd7e7fb67 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:142:3 + #1 0x555cd7ebe846 in iv_aligned_malloc(void*, int, int) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:85:13 + #2 0x555cd80636bb in ih264d_allocate_dynamic_bufs /src/libavc/decoder/ih264d_utils.c:1935:14 + #3 0x555cd7f32b05 in isvcd_allocate_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:126:18 + #4 0x555cd7f36218 in isvcd_init_pic /src/libavc/decoder/svc/isvcd_utils.c:843:15 + #5 0x555cd7f0d443 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:283:11 + #6 0x555cd7f1a8a9 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2390:19 + #7 0x555cd7f08723 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1005:40 + #8 0x555cd7ed383c in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5290:27 + #9 0x555cd7ec0636 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #10 0x555cd7ec118e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #11 0x555cd7d732f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #12 0x555cd7d5e565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #13 0x555cd7d63fff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #14 0x555cd7d8f2a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f1ad4b7d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: ___interceptor_posix_memalign--iv_aligned_malloc(void*, int, int)--ih264d_allocate_dynamic_bufs +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/svc/isvcd_parse_slice.c:298:13 in isvcd_start_of_pic +Shadow bytes around the buggy address: + 0x515000000400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x515000000480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x515000000500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x515000000580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x515000000600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x515000000680: 00 00[01]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x515000000700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x515000000780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x515000000800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x515000000880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x515000000900: 00 00 01 fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-342.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-342.txt new file mode 100644 index 000000000..343d9d42b --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-342.txt @@ -0,0 +1,100 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2725127633 +INFO: Loaded 1 modules (16541 inline 8-bit counters): 16541 [0x55da10a765e0, 0x55da10a7a67d), +INFO: Loaded 1 PC tables (16541 PCs): 16541 [0x55da10a7a680,0x55da10abb050), +/out/svc_dec_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-342 +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f154db6a638 at pc 0x55da108abbac bp 0x7fffa7c5e9f0 sp 0x7fffa7c5e9e8 +READ of size 16 at 0x7f154db6a638 thread T0 + #0 0x55da108abbab in ih264_inter_pred_luma_vert_ssse3 /src/libavc/common/x86/ih264_inter_pred_filters_ssse3.c:650:24 + #1 0x55da10904865 in ih264d_motion_compensate_mp /src/libavc/decoder/ih264d_inter_pred.c:1125:13 + #2 0x55da10839112 in isvcd_decode_recon_tfr_nmb_non_base_lyr /src/libavc/decoder/svc/isvcd_process_epslice.c:1215:17 + #3 0x55da10805b47 in isvcd_parse_inter_slice_data_cabac_enh_lyr /src/libavc/decoder/svc/isvcd_parse_epslice.c:1527:23 + #4 0x55da108034ef in isvcd_parse_epslice /src/libavc/decoder/svc/isvcd_parse_epslice.c:475:11 + #5 0x55da10825a51 in isvcd_parse_decode_slice_ext_nal /src/libavc/decoder/svc/isvcd_parse_slice.c:1496:15 + #6 0x55da10819802 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1063:44 + #7 0x55da107e483c in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5290:27 + #8 0x55da107d1636 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #9 0x55da107d218e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #10 0x55da106842f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #11 0x55da1066f565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #12 0x55da10674fff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #13 0x55da106a02a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f1553139082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #15 0x55da1066774d in _start (/out/svc_dec_fuzzer+0xa274d) + +DEDUP_TOKEN: ih264_inter_pred_luma_vert_ssse3--ih264d_motion_compensate_mp--isvcd_decode_recon_tfr_nmb_non_base_lyr +0x7f154db6a638 is located 986680 bytes inside of 1204224-byte region [0x7f154da79800,0x7f154db9f800) +freed by thread T0 here: + #0 0x55da1078fe26 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x55da10976ece in ih264d_free_dynamic_bufs /src/libavc/decoder/ih264d_utils.c:2337:5 + #2 0x55da1084346f in isvcd_free_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:87:5 + #3 0x55da107d2a93 in isvcd_init_decoder /src/libavc/decoder/svc/isvcd_api.c:1080:5 + #4 0x55da107ec845 in isvcd_reset /src/libavc/decoder/svc/isvcd_api.c:6424:13 + #5 0x55da107ec845 in isvcd_ctl /src/libavc/decoder/svc/isvcd_api.c:6486:19 + #6 0x55da107d16cf in resetCodec /src/libavc/fuzzer/svc_dec_fuzzer.cpp:185:5 + #7 0x55da107d16cf in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:381:9 + #8 0x55da107d218e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #9 0x55da106842f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #10 0x55da1066f565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #11 0x55da10674fff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #12 0x55da106a02a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f1553139082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_free--ih264d_free_dynamic_bufs--isvcd_free_dynamic_bufs +previously allocated by thread T0 here: + #0 0x55da10790b67 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:142:3 + #1 0x55da107cf846 in iv_aligned_malloc(void*, int, int) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:85:13 + #2 0x55da109756ef in ih264d_allocate_dynamic_bufs /src/libavc/decoder/ih264d_utils.c:2170:14 + #3 0x55da10843b05 in isvcd_allocate_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:126:18 + #4 0x55da10847218 in isvcd_init_pic /src/libavc/decoder/svc/isvcd_utils.c:843:15 + #5 0x55da1081e443 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:283:11 + #6 0x55da10824723 in isvcd_parse_decode_slice_ext_nal /src/libavc/decoder/svc/isvcd_parse_slice.c:1181:19 + #7 0x55da10819802 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1063:44 + #8 0x55da107e483c in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5290:27 + #9 0x55da107d1636 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #10 0x55da107d218e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #11 0x55da106842f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #12 0x55da1066f565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #13 0x55da10674fff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #14 0x55da106a02a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f1553139082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: ___interceptor_posix_memalign--iv_aligned_malloc(void*, int, int)--ih264d_allocate_dynamic_bufs +SUMMARY: AddressSanitizer: heap-use-after-free /src/libavc/common/x86/ih264_inter_pred_filters_ssse3.c:650:24 in ih264_inter_pred_luma_vert_ssse3 +Shadow bytes around the buggy address: + 0x7f154db6a380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7f154db6a400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7f154db6a480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7f154db6a500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7f154db6a580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x7f154db6a600: fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd + 0x7f154db6a680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7f154db6a700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7f154db6a780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7f154db6a800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7f154db6a880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-68.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-68.txt new file mode 100755 index 000000000..de83b9f48 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-68.txt @@ -0,0 +1,83 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3353256552 +INFO: Loaded 1 modules (15153 inline 8-bit counters): 15153 [0x55aa423ca5d0, 0x55aa423ce101), +INFO: Loaded 1 PC tables (15153 PCs): 15153 [0x55aa423ce108,0x55aa42409418), +/out/svc_dec_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-68 +================================================================= +==1099==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7ca4625e12d2 at pc 0x55aa421d1298 bp 0x7b745d59b790 sp 0x7b745d59b788 +READ of size 2 at 0x7ca4625e12d2 thread T2 + #0 0x55aa421d1297 in isvcd_residual_samp_mb_dyadic /src/libavc/decoder/svc/isvcd_residual_resamp.c:2031:50 + #1 0x55aa421a179a in isvcd_process_residual_resample_mb /src/libavc/decoder/svc/isvcd_process_epslice.c:1927:11 + #2 0x55aa421a52a1 in isvcd_process_inter_mb_rsd_pred_target_lyr /src/libavc/decoder/svc/isvcd_process_epslice.c:1992:11 + #3 0x55aa421aabcc in isvcd_decode_recon_tfr_nmb_thread /src/libavc/decoder/svc/isvcd_thread_parse_decode.c:264:31 + #4 0x55aa421ac0a7 in isvcd_decode_slice_thread /src/libavc/decoder/svc/isvcd_thread_parse_decode.c:519:19 + #5 0x55aa421ac421 in isvcd_decode_picture_thread /src/libavc/decoder/svc/isvcd_thread_parse_decode.c:571:19 + #6 0x55aa420fb046 in asan_thread_start(void*) /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:239:28 + #7 0x7f746362f608 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8608) (BuildId: 9753720502573b97dbac595b61fd72c2df18e078) + #8 0x7f746350b352 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f352) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +0x7ca4625e12d2 is located 18 bytes after 192-byte region [0x7ca4625e1200,0x7ca4625e12c0) +allocated by thread T0 here: + #0 0x55aa420fe217 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:139:3 + #1 0x55aa42141586 in iv_aligned_malloc(void*, int, int) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:85:13 + #2 0x55aa421ad0a2 in isvcd_allocate_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:178:14 + #3 0x55aa421b0468 in isvcd_init_pic /src/libavc/decoder/svc/isvcd_utils.c:843:15 + #4 0x55aa42188b53 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:283:11 + #5 0x55aa4219600d in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2390:19 + #6 0x55aa42183e73 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1005:40 + #7 0x55aa4215495c in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5290:27 + #8 0x55aa42143207 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #9 0x55aa421439f2 in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #10 0x55aa41fdee0d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #11 0x55aa41fc9b82 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #12 0x55aa41fcfa50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #13 0x55aa41ffb582 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f7463410082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +Thread T2 created by T0 here: + #0 0x55aa420e1931 in pthread_create /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:250:3 + #1 0x55aa4218f095 in isvcd_parse_decode_slice_ext_nal /src/libavc/decoder/svc/isvcd_parse_slice.c:1210:17 + #2 0x55aa42183f52 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1063:44 + #3 0x55aa4215495c in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5290:27 + #4 0x55aa42143207 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #5 0x55aa421439f2 in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #6 0x55aa41fdee0d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x55aa41fc9b82 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x55aa41fcfa50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x55aa41ffb582 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f7463410082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/svc/isvcd_residual_resamp.c:2031:50 in isvcd_residual_samp_mb_dyadic +Shadow bytes around the buggy address: + 0x7ca4625e1000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7ca4625e1080: 00 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa + 0x7ca4625e1100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7ca4625e1180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7ca4625e1200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7ca4625e1280: 00 00 00 00 00 00 00 00 fa fa[fa]fa fa fa fa fa + 0x7ca4625e1300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7ca4625e1380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7ca4625e1400: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa + 0x7ca4625e1480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7ca4625e1500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1099==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-75.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-75.txt new file mode 100755 index 000000000..5b824c055 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-75.txt @@ -0,0 +1,76 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2800206981 +INFO: Loaded 1 modules (15153 inline 8-bit counters): 15153 [0x5636417675d0, 0x56364176b101), +INFO: Loaded 1 PC tables (15153 PCs): 15153 [0x56364176b108,0x5636417a6418), +/out/svc_dec_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-75 +================================================================= +==1099==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7d016cfe12f4 at pc 0x563641566bd2 bp 0x7ffdeb5056b0 sp 0x7ffdeb5056a8 +READ of size 1 at 0x7d016cfe12f4 thread T0 + #0 0x563641566bd1 in isvcd_interlyr_motion_mode_pred_dyadic /src/libavc/decoder/svc/isvcd_mode_mv_resamp.c:2622:48 + #1 0x5636415393bf in isvcd_mv_pred_ref_tfr_nby2_epmb /src/libavc/decoder/svc/isvcd_process_epslice.c:238:30 + #2 0x56364150d5cd in isvcd_parse_inter_slice_data_cabac_enh_lyr /src/libavc/decoder/svc/isvcd_parse_epslice.c:1509:19 + #3 0x56364150ae7f in isvcd_parse_epslice /src/libavc/decoder/svc/isvcd_parse_epslice.c:475:11 + #4 0x56364152d220 in isvcd_parse_decode_slice_ext_nal /src/libavc/decoder/svc/isvcd_parse_slice.c:1496:15 + #5 0x563641520f52 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1063:44 + #6 0x5636414f195c in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5290:27 + #7 0x5636414e0207 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #8 0x5636414e09f2 in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #9 0x56364137be0d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #10 0x563641366b82 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #11 0x56364136ca50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #12 0x563641398582 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fd16dcef082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #14 0x56364135fc6d in _start (/out/svc_dec_fuzzer+0x99c6d) + +0x7d016cfe12f4 is located 52 bytes after 192-byte region [0x7d016cfe1200,0x7d016cfe12c0) +allocated by thread T0 here: + #0 0x56364149b217 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:139:3 + #1 0x5636414de586 in iv_aligned_malloc(void*, int, int) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:85:13 + #2 0x56364154a0a2 in isvcd_allocate_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:178:14 + #3 0x56364154d468 in isvcd_init_pic /src/libavc/decoder/svc/isvcd_utils.c:843:15 + #4 0x563641525b53 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:283:11 + #5 0x56364153300d in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2390:19 + #6 0x563641520e73 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1005:40 + #7 0x5636414f195c in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5290:27 + #8 0x5636414e0207 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #9 0x5636414e09f2 in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #10 0x56364137be0d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #11 0x563641366b82 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #12 0x56364136ca50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #13 0x563641398582 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7fd16dcef082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/svc/isvcd_mode_mv_resamp.c:2622:48 in isvcd_interlyr_motion_mode_pred_dyadic +Shadow bytes around the buggy address: + 0x7d016cfe1000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d016cfe1080: 00 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d016cfe1100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d016cfe1180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d016cfe1200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7d016cfe1280: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa[fa]fa + 0x7d016cfe1300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d016cfe1380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d016cfe1400: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa + 0x7d016cfe1480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d016cfe1500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1099==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-840.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-840.txt new file mode 100644 index 000000000..6eb012780 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-840.txt @@ -0,0 +1,31 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2729327910 +INFO: Loaded 1 modules (16541 inline 8-bit counters): 16541 [0x561fcea825e0, 0x561fcea8667d), +INFO: Loaded 1 PC tables (16541 PCs): 16541 [0x561fcea86680,0x561fceac7050), +/out/svc_dec_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-840 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000000000 bp 0x7ffde05c50d0 sp 0x7ffde05c4e58 T0) +==1==Hint: pc points to the zero page. +==1==The signal is caused by a READ memory access. +==1==Hint: address points to the zero page. + #0 0x0 () + #1 0x561fce815d15 in isvcd_parse_inter_slice_data_cavlc_enh_lyr /src/libavc/decoder/svc/isvcd_parse_epslice.c:1908:19 + #2 0x561fce80f4ef in isvcd_parse_epslice /src/libavc/decoder/svc/isvcd_parse_epslice.c:475:11 + #3 0x561fce831a51 in isvcd_parse_decode_slice_ext_nal /src/libavc/decoder/svc/isvcd_parse_slice.c:1496:15 + #4 0x561fce825802 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1063:44 + #5 0x561fce7f083c in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5290:27 + #6 0x561fce7dd636 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #7 0x561fce7de18e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #8 0x561fce6902f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #9 0x561fce67b565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #10 0x561fce680fff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #11 0x561fce6ac2a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f2443c7b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: isvcd_parse_inter_slice_data_cavlc_enh_lyr--isvcd_parse_epslice +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV () +==1==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-97.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-97.txt new file mode 100644 index 000000000..4b87ae46e --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2023-97.txt @@ -0,0 +1,65 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2733924625 +INFO: Loaded 1 modules (16541 inline 8-bit counters): 16541 [0x55e04a1a85e0, 0x55e04a1ac67d), +INFO: Loaded 1 PC tables (16541 PCs): 16541 [0x55e04a1ac680,0x55e04a1ed050), +/out/svc_dec_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-97 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5130000092b6 at pc 0x55e049f84725 bp 0x7fff865b70b0 sp 0x7fff865b70a8 +READ of size 1 at 0x5130000092b6 thread T0 + #0 0x55e049f84724 in isvcd_reflayer_construction_dyadic /src/libavc/decoder/svc/isvcd_intra_resamp.c:2116:45 + #1 0x55e049f865e2 in isvcd_intra_resamp_mb_dyadic /src/libavc/decoder/svc/isvcd_intra_resamp.c:3572:11 + #2 0x55e049f6a4d2 in isvcd_process_ibl_mb /src/libavc/decoder/svc/isvcd_process_epslice.c:1762:15 + #3 0x55e049f6ba24 in isvcd_decode_recon_tfr_nmb_non_base_lyr /src/libavc/decoder/svc/isvcd_process_epslice.c:1340:19 + #4 0x55e049f37b47 in isvcd_parse_inter_slice_data_cabac_enh_lyr /src/libavc/decoder/svc/isvcd_parse_epslice.c:1527:23 + #5 0x55e049f354ef in isvcd_parse_epslice /src/libavc/decoder/svc/isvcd_parse_epslice.c:475:11 + #6 0x55e049f57a51 in isvcd_parse_decode_slice_ext_nal /src/libavc/decoder/svc/isvcd_parse_slice.c:1496:15 + #7 0x55e049f4b802 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1063:44 + #8 0x55e049f1683c in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5290:27 + #9 0x55e049f03636 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #10 0x55e049f0418e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #11 0x55e049db62f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #12 0x55e049da1565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #13 0x55e049da6fff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #14 0x55e049dd22a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7fc3498bf082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #16 0x55e049d9974d in _start (/out/svc_dec_fuzzer+0xa274d) + +DEDUP_TOKEN: isvcd_reflayer_construction_dyadic--isvcd_intra_resamp_mb_dyadic--isvcd_process_ibl_mb +Address 0x5130000092b6 is a wild pointer inside of access range of size 0x000000000001. +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/svc/isvcd_intra_resamp.c:2116:45 in isvcd_reflayer_construction_dyadic +Shadow bytes around the buggy address: + 0x513000009000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x513000009080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x513000009100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x513000009180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x513000009200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x513000009280: fa fa fa fa fa fa[fa]fa fa fa fa fa fa fa fa fa + 0x513000009300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x513000009380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x513000009400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x513000009480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x513000009500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2024-637.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2024-637.txt new file mode 100644 index 000000000..f62c5b169 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2024-637.txt @@ -0,0 +1,73 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2737838813 +INFO: Loaded 1 modules (16541 inline 8-bit counters): 16541 [0x55f9c43b65e0, 0x55f9c43ba67d), +INFO: Loaded 1 PC tables (16541 PCs): 16541 [0x55f9c43ba680,0x55f9c43fb050), +/out/svc_dec_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2024-637 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x51f000001a80 at pc 0x55f9c40ce044 bp 0x7fffece0d9b0 sp 0x7fffece0d170 +WRITE of size 48 at 0x51f000001a80 thread T0 + #0 0x55f9c40ce043 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x55f9c423fa4e in ih264d_fmt_conv_420sp_to_420sp_swap_uv /src/libavc/decoder/ih264d_format_conv.c:497:9 + #2 0x55f9c423fa4e in ih264d_format_convert /src/libavc/decoder/ih264d_format_conv.c:765:13 + #3 0x55f9c4125a07 in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5587:21 + #4 0x55f9c4111636 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #5 0x55f9c411218e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #6 0x55f9c3fc42f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #7 0x55f9c3faf565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #8 0x55f9c3fb4fff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #9 0x55f9c3fe02a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fd2fd70c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x55f9c3fa774d in _start (/out/svc_dec_fuzzer+0xa274d) + +DEDUP_TOKEN: __asan_memcpy--ih264d_fmt_conv_420sp_to_420sp_swap_uv--ih264d_format_convert +0x51f000001a80 is located 0 bytes after 3072-byte region [0x51f000000e80,0x51f000001a80) +allocated by thread T0 here: + #0 0x55f9c40d0b67 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:142:3 + #1 0x55f9c4110bc4 in iv_aligned_malloc /src/libavc/fuzzer/svc_dec_fuzzer.cpp:85:13 + #2 0x55f9c4110bc4 in Codec::allocFrame() /src/libavc/fuzzer/svc_dec_fuzzer.cpp:308:48 + #3 0x55f9c41118d9 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:399:9 + #4 0x55f9c411218e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #5 0x55f9c3fc42f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #6 0x55f9c3faf565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #7 0x55f9c3fb4fff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #8 0x55f9c3fe02a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fd2fd70c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: ___interceptor_posix_memalign--iv_aligned_malloc--Codec::allocFrame() +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/ih264d_format_conv.c:497:9 in ih264d_fmt_conv_420sp_to_420sp_swap_uv +Shadow bytes around the buggy address: + 0x51f000001800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x51f000001880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x51f000001900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x51f000001980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x51f000001a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x51f000001a80:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x51f000001b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x51f000001b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x51f000001c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x51f000001c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x51f000001d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2024-638.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2024-638.txt new file mode 100755 index 000000000..c15e06560 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2024-638.txt @@ -0,0 +1,76 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3880500913 +INFO: Loaded 1 modules (15344 inline 8-bit counters): 15344 [0x55afc3b765e0, 0x55afc3b7a1d0), +INFO: Loaded 1 PC tables (15344 PCs): 15344 [0x55afc3b7a1d0,0x55afc3bb60d0), +/out/svc_dec_fuzzer: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2024-638 +================================================================= +==1625==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7d13247e2f00 at pc 0x55afc38a24be bp 0x7b531e5b3c20 sp 0x7b531e5b33e0 +WRITE of size 32 at 0x7d13247e2f00 thread T25 + #0 0x55afc38a24bd in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x55afc3a0684e in ih264d_fmt_conv_420sp_to_420sp_swap_uv /src/libavc/decoder/ih264d_format_conv.c:497:9 + #2 0x55afc3a071a4 in ih264d_format_convert /src/libavc/decoder/ih264d_format_conv.c:765:13 + #3 0x55afc3a6e209 in ih264d_decode_picture_thread /src/libavc/decoder/ih264d_thread_parse_decode.c:646:13 + #4 0x55afc38a2056 in asan_thread_start(void*) /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:239:28 + #5 0x7f532569c608 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8608) (BuildId: 9753720502573b97dbac595b61fd72c2df18e078) + #6 0x7f5325578352 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f352) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +0x7d13247e2f00 is located 0 bytes after 1664-byte region [0x7d13247e2880,0x7d13247e2f00) +allocated by thread T0 here: + #0 0x55afc38a5227 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:139:3 + #1 0x55afc38e8596 in iv_aligned_malloc(void*, int, int) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:85:13 + #2 0x55afc38e9767 in Codec::allocFrame() /src/libavc/fuzzer/svc_dec_fuzzer.cpp:308:48 + #3 0x55afc38ea475 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:399:9 + #4 0x55afc38eaa02 in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #5 0x55afc3785e1d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #6 0x55afc3770b92 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #7 0x55afc3776a60 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #8 0x55afc37a2592 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f532547d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +Thread T25 created by T0 here: + #0 0x55afc3888941 in pthread_create /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:250:3 + #1 0x55afc393d975 in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c + #2 0x55afc392a873 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:987:40 + #3 0x55afc38fbd2f in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5309:27 + #4 0x55afc38ea217 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #5 0x55afc38eaa02 in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #6 0x55afc3785e1d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x55afc3770b92 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x55afc3776a60 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x55afc37a2592 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f532547d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/ih264d_format_conv.c:497:9 in ih264d_fmt_conv_420sp_to_420sp_swap_uv +Shadow bytes around the buggy address: + 0x7d13247e2c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d13247e2d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d13247e2d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d13247e2e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d13247e2e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7d13247e2f00:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d13247e2f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d13247e3000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d13247e3080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d13247e3100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d13247e3180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1625==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2025-534.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2025-534.txt new file mode 100644 index 000000000..54ff47f70 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2025-534.txt @@ -0,0 +1,100 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2741859486 +INFO: Loaded 1 modules (16541 inline 8-bit counters): 16541 [0x5644a267f5e0, 0x5644a268367d), +INFO: Loaded 1 PC tables (16541 PCs): 16541 [0x5644a2683680,0x5644a26c4050), +/out/svc_dec_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2025-534 +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f1249b2929e at pc 0x5644a24b3c92 bp 0x7ffd3459ac30 sp 0x7ffd3459ac28 +READ of size 16 at 0x7f1249b2929e thread T0 + #0 0x5644a24b3c91 in ih264_inter_pred_luma_horz_ssse3 /src/libavc/common/x86/ih264_inter_pred_filters_ssse3.c:394:28 + #1 0x5644a250d865 in ih264d_motion_compensate_mp /src/libavc/decoder/ih264d_inter_pred.c:1125:13 + #2 0x5644a2442112 in isvcd_decode_recon_tfr_nmb_non_base_lyr /src/libavc/decoder/svc/isvcd_process_epslice.c:1215:17 + #3 0x5644a2412f2d in isvcd_parse_inter_slice_data_cavlc_enh_lyr /src/libavc/decoder/svc/isvcd_parse_epslice.c:1926:23 + #4 0x5644a2596a6c in isvcd_parse_ebslice /src/libavc/decoder/svc/isvcd_parse_ebslice.c:1826:11 + #5 0x5644a242e95b in isvcd_parse_decode_slice_ext_nal /src/libavc/decoder/svc/isvcd_parse_slice.c:1503:15 + #6 0x5644a2422802 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1063:44 + #7 0x5644a23ed83c in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5290:27 + #8 0x5644a23da636 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #9 0x5644a23db18e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #10 0x5644a228d2f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #11 0x5644a2278565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #12 0x5644a227dfff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #13 0x5644a22a92a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f124f01a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #15 0x5644a227074d in _start (/out/svc_dec_fuzzer+0xa274d) + +DEDUP_TOKEN: ih264_inter_pred_luma_horz_ssse3--ih264d_motion_compensate_mp--isvcd_decode_recon_tfr_nmb_non_base_lyr +0x7f1249b2929e is located 719518 bytes inside of 1204224-byte region [0x7f1249a79800,0x7f1249b9f800) +freed by thread T0 here: + #0 0x5644a2398e26 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x5644a257fece in ih264d_free_dynamic_bufs /src/libavc/decoder/ih264d_utils.c:2337:5 + #2 0x5644a244c46f in isvcd_free_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:87:5 + #3 0x5644a23dba93 in isvcd_init_decoder /src/libavc/decoder/svc/isvcd_api.c:1080:5 + #4 0x5644a23f5845 in isvcd_reset /src/libavc/decoder/svc/isvcd_api.c:6424:13 + #5 0x5644a23f5845 in isvcd_ctl /src/libavc/decoder/svc/isvcd_api.c:6486:19 + #6 0x5644a23da6cf in resetCodec /src/libavc/fuzzer/svc_dec_fuzzer.cpp:185:5 + #7 0x5644a23da6cf in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:381:9 + #8 0x5644a23db18e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #9 0x5644a228d2f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #10 0x5644a2278565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #11 0x5644a227dfff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #12 0x5644a22a92a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f124f01a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_free--ih264d_free_dynamic_bufs--isvcd_free_dynamic_bufs +previously allocated by thread T0 here: + #0 0x5644a2399b67 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:142:3 + #1 0x5644a23d8846 in iv_aligned_malloc(void*, int, int) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:85:13 + #2 0x5644a257e6ef in ih264d_allocate_dynamic_bufs /src/libavc/decoder/ih264d_utils.c:2170:14 + #3 0x5644a244cb05 in isvcd_allocate_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:126:18 + #4 0x5644a2450218 in isvcd_init_pic /src/libavc/decoder/svc/isvcd_utils.c:843:15 + #5 0x5644a2427443 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:283:11 + #6 0x5644a242d723 in isvcd_parse_decode_slice_ext_nal /src/libavc/decoder/svc/isvcd_parse_slice.c:1181:19 + #7 0x5644a2422802 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:1063:44 + #8 0x5644a23ed83c in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5290:27 + #9 0x5644a23da636 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:375:11 + #10 0x5644a23db18e in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:437:22 + #11 0x5644a228d2f0 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 + #12 0x5644a2278565 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 + #13 0x5644a227dfff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 + #14 0x5644a22a92a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f124f01a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: ___interceptor_posix_memalign--iv_aligned_malloc(void*, int, int)--ih264d_allocate_dynamic_bufs +SUMMARY: AddressSanitizer: heap-use-after-free /src/libavc/common/x86/ih264_inter_pred_filters_ssse3.c:394:28 in ih264_inter_pred_luma_horz_ssse3 +Shadow bytes around the buggy address: + 0x7f1249b29000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7f1249b29080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7f1249b29100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7f1249b29180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7f1249b29200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x7f1249b29280: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd + 0x7f1249b29300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7f1249b29380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7f1249b29400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7f1249b29480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7f1249b29500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2025-584.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2025-584.txt new file mode 100755 index 000000000..581d7f58f --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2025-584.txt @@ -0,0 +1,72 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1568262769 +INFO: Loaded 1 modules (15358 inline 8-bit counters): 15358 [0x56254ee2f5e0, 0x56254ee331de), +INFO: Loaded 1 PC tables (15358 PCs): 15358 [0x56254ee331e0,0x56254ee6f1c0), +/out/svc_dec_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2025-584 +================================================================= +==1625==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7e58178e03d0 at pc 0x56254ebddaed bp 0x7ffd2b77fea0 sp 0x7ffd2b77fe98 +READ of size 2 at 0x7e58178e03d0 thread T0 + #0 0x56254ebddaec in isvcd_mark_err_slice_skip /src/libavc/decoder/svc/isvcd_parse_epslice.c:2827:46 + #1 0x56254ebb5407 in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5378:28 + #2 0x56254eba3257 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:377:11 + #3 0x56254eba3a42 in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:439:22 + #4 0x56254ea3ee1d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x56254ea29b92 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x56254ea2fa60 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x56254ea5b592 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f5818365082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x56254ea22c7d in _start (/out/svc_dec_fuzzer+0x9ac7d) + +0x7e58178e03d0 is located 48 bytes before 61440-byte region [0x7e58178e0400,0x7e58178ef400) +allocated by thread T0 here: + #0 0x56254eb5e227 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:139:3 + #1 0x56254eba1596 in iv_aligned_malloc(void*, int, int) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:85:13 + #2 0x56254ed2d0ff in ih264d_allocate_dynamic_bufs /src/libavc/decoder/ih264d_utils.c:2067:14 + #3 0x56254ec0c7d4 in isvcd_allocate_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:126:18 + #4 0x56254ec0fee6 in isvcd_init_pic /src/libavc/decoder/svc/isvcd_utils.c:843:15 + #5 0x56254ebe7f63 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:283:11 + #6 0x56254ebf589e in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2441:19 + #7 0x56254ebe3893 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:987:40 + #8 0x56254ebb4d8f in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5314:27 + #9 0x56254eba3257 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:377:11 + #10 0x56254eba3a42 in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:439:22 + #11 0x56254ea3ee1d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #12 0x56254ea29b92 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #13 0x56254ea2fa60 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #14 0x56254ea5b592 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f5818365082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/svc/isvcd_parse_epslice.c:2827:46 in isvcd_mark_err_slice_skip +Shadow bytes around the buggy address: + 0x7e58178e0100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e58178e0180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e58178e0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e58178e0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e58178e0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x7e58178e0380: fa fa fa fa fa fa fa fa fa fa[fa]fa fa fa fa fa + 0x7e58178e0400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7e58178e0480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7e58178e0500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7e58178e0580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7e58178e0600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1625==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2025-589.txt b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2025-589.txt new file mode 100755 index 000000000..c6536d8c3 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/OSV-2025-589.txt @@ -0,0 +1,76 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1609712211 +INFO: Loaded 1 modules (15358 inline 8-bit counters): 15358 [0x56236783f5e0, 0x5623678431de), +INFO: Loaded 1 PC tables (15358 PCs): 15358 [0x5623678431e0,0x56236787f1c0), +/out/svc_dec_fuzzer: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2025-589 +================================================================= +==1625==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7e0c34e5ca20 at pc 0x5623676176ca bp 0x7ffe4e8c5a20 sp 0x7ffe4e8c5a18 +READ of size 1 at 0x7e0c34e5ca20 thread T0 + #0 0x5623676176c9 in isvcd_decode_recon_tfr_nmb_base_lyr /src/libavc/decoder/svc/isvcd_process_epslice.c:1579:37 + #1 0x5623675e8215 in isvcd_parse_inter_slice_data_cabac /src/libavc/decoder/svc/isvcd_parse_epslice.c:773:21 + #2 0x5623675ef61e in isvcd_parse_pslice /src/libavc/decoder/svc/isvcd_parse_epslice.c:3493:11 + #3 0x562367606b5a in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2761:15 + #4 0x5623675f3893 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:987:40 + #5 0x5623675c4d8f in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5314:27 + #6 0x5623675b3257 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:377:11 + #7 0x5623675b3a42 in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:439:22 + #8 0x56236744ee1d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #9 0x562367439b92 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #10 0x56236743fa60 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #11 0x56236746b592 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f1c358c5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x562367432c7d in _start (/out/svc_dec_fuzzer+0x9ac7d) + +0x7e0c34e5ca20 is located 1568 bytes after 49152-byte region [0x7e0c34e50400,0x7e0c34e5c400) +allocated by thread T0 here: + #0 0x56236756e227 in posix_memalign /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:139:3 + #1 0x5623675b1596 in iv_aligned_malloc(void*, int, int) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:85:13 + #2 0x56236773cc81 in ih264d_allocate_dynamic_bufs /src/libavc/decoder/ih264d_utils.c:2000:14 + #3 0x56236761c7d4 in isvcd_allocate_dynamic_bufs /src/libavc/decoder/svc/isvcd_utils.c:126:18 + #4 0x56236761fee6 in isvcd_init_pic /src/libavc/decoder/svc/isvcd_utils.c:843:15 + #5 0x5623675f7f63 in isvcd_start_of_pic /src/libavc/decoder/svc/isvcd_parse_slice.c:283:11 + #6 0x56236760589e in isvcd_parse_decode_slice /src/libavc/decoder/svc/isvcd_parse_slice.c:2441:19 + #7 0x5623675f3893 in isvcd_parse_nal_unit /src/libavc/decoder/svc/isvcd_parse_headers.c:987:40 + #8 0x5623675c4d8f in isvcd_video_decode /src/libavc/decoder/svc/isvcd_api.c:5314:27 + #9 0x5623675b3257 in Codec::decodeFrame(unsigned char const*, unsigned long, unsigned long*) /src/libavc/fuzzer/svc_dec_fuzzer.cpp:377:11 + #10 0x5623675b3a42 in LLVMFuzzerTestOneInput /src/libavc/fuzzer/svc_dec_fuzzer.cpp:439:22 + #11 0x56236744ee1d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #12 0x562367439b92 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #13 0x56236743fa60 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #14 0x56236746b592 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f1c358c5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libavc/decoder/svc/isvcd_process_epslice.c:1579:37 in isvcd_decode_recon_tfr_nmb_base_lyr +Shadow bytes around the buggy address: + 0x7e0c34e5c780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e0c34e5c800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e0c34e5c880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e0c34e5c900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e0c34e5c980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x7e0c34e5ca00: fa fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa + 0x7e0c34e5ca80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e0c34e5cb00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e0c34e5cb80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e0c34e5cc00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7e0c34e5cc80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1625==ABORTING diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/collect_crash_builds.csv b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/collect_crash_builds.csv new file mode 100644 index 000000000..b3a4eb023 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/original-crashes/collect_crash_builds.csv @@ -0,0 +1,5 @@ +target,commit_id,oss_fuzz_commit,sanitizer +libavc,c38af025abf0040f6693d15f4ce2e878a728cfee,auto,address +libavc,2f6371b3b8d69ee596fa44c48ca522db27f6f22f,52ee750b71ece22fb67cd0285b6f6b2ce69c6bac,address +libavc,72315c11ac595a73d3b629cc36647327156d5875,auto,address +libavc,7f19ac220647a58262bf08262049f7340030e1bf,auto,address diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/patches/combined.diff b/benchmarks/libavc_transplant_svc_dec_fuzzer/patches/combined.diff new file mode 100644 index 000000000..230fb3a13 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/patches/combined.diff @@ -0,0 +1,465 @@ +diff --git a/__bug_dispatch.h b/__bug_dispatch.h +index 6450a25..d127365 100644 +--- a/__bug_dispatch.h ++++ b/__bug_dispatch.h +@@ -1,6 +1,17 @@ + #ifndef __BUG_DISPATCH_H + #define __BUG_DISPATCH_H ++ + #include ++ ++#ifdef __cplusplus ++extern "C" { ++#endif ++ + #define __BUG_DISPATCH_BYTES 1 + extern volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES]; ++ ++#ifdef __cplusplus ++} ++#endif ++ + #endif +diff --git a/decoder/ih264d_defs.h b/decoder/ih264d_defs.h +index 894fc78..a2457e4 100644 +--- a/decoder/ih264d_defs.h ++++ b/decoder/ih264d_defs.h +@@ -36,7 +36,10 @@ + */ + #include + +-#define H264_MAX_FRAME_WIDTH 4080 ++#include "../__bug_dispatch.h" ++ ++#define H264_MAX_FRAME_WIDTH \ ++ ((__bug_dispatch[0] & (1 << 3)) ? 4096 : ((__bug_dispatch[0] & (1 << 4)) ? 4096 : 4080)) + #define H264_MAX_FRAME_HEIGHT 4080 + #define H264_MAX_FRAME_SIZE (4096 * 2048) + +diff --git a/decoder/ih264d_structs.h b/decoder/ih264d_structs.h +index bcab1ea..bc81d56 100644 +--- a/decoder/ih264d_structs.h ++++ b/decoder/ih264d_structs.h +@@ -795,7 +795,7 @@ typedef struct _DecStruct + /************************************************************/ + /* MB_GROUP should be a multiple of 2 */ + /************************************************************/ +- UWORD8 u1_recon_mb_grp; ++ UWORD32 u1_recon_mb_grp; + UWORD8 u1_recon_mb_grp_pair; + /* Variables to handle Cabac */ + decoding_envirnoment_t s_cab_dec_env; /* < Structure for decoding_envirnoment_t */ +diff --git a/decoder/libavcdec.cmake b/decoder/libavcdec.cmake +index 911c328..6be665f 100644 +--- a/decoder/libavcdec.cmake ++++ b/decoder/libavcdec.cmake +@@ -2,6 +2,7 @@ + list( + APPEND + LIBAVCDEC_SRCS ++ "${AVC_ROOT}/__bug_dispatch.c" + "${AVC_ROOT}/decoder/ih264d_api.c" + "${AVC_ROOT}/decoder/ih264d_bitstrm.c" + "${AVC_ROOT}/decoder/ih264d_cabac.c" +diff --git a/decoder/mvc/libmvcdec.cmake b/decoder/mvc/libmvcdec.cmake +index 4eb7643..daa6cbe 100644 +--- a/decoder/mvc/libmvcdec.cmake ++++ b/decoder/mvc/libmvcdec.cmake +@@ -2,6 +2,7 @@ + list( + APPEND + LIBMVCDEC_SRCS ++ "${AVC_ROOT}/__bug_dispatch.c" + "${AVC_ROOT}/decoder/ih264d_api.c" + "${AVC_ROOT}/decoder/ih264d_bitstrm.c" + "${AVC_ROOT}/decoder/ih264d_cabac.c" +diff --git a/decoder/svc/isvcd_api.c b/decoder/svc/isvcd_api.c +index 3ac3984..c005fd5 100644 +--- a/decoder/svc/isvcd_api.c ++++ b/decoder/svc/isvcd_api.c +@@ -87,6 +87,7 @@ + #include + #include + #include ++#include "../../__bug_dispatch.h" + #include "ih264_defs.h" + #include "ih264_typedefs.h" + #include "ih264_macros.h" +@@ -5288,10 +5289,29 @@ WORD32 isvcd_video_decode(iv_obj_t *dec_hdl, void *pv_api_ip, void *pv_api_op) + + ps_dec_op->u4_frame_decoded_flag = 0; + ret = isvcd_parse_nal_unit(ps_svc_lyr_dec, ps_cur_node->i4_nal_ref_idc); +- if(ret != OK) ++ if(__bug_dispatch[0] & (1 << 0)) + { +- ps_svcd_ctxt->u1_parse_nal_unit_error = 1; +- break; ++ if(((ret != OK)) && (u1_res_id != (u1_num_res_lyrs - 1))) ++ { ++ ps_svcd_ctxt->u1_parse_nal_unit_error = 1; ++ break; ++ } ++ } ++ else if(__bug_dispatch[0] & (1 << 1)) ++ { ++ if(((ret != OK)) && (u1_res_id != (u1_num_res_lyrs - 1))) ++ { ++ ps_svcd_ctxt->u1_parse_nal_unit_error = 1; ++ break; ++ } ++ } ++ else ++ { ++ if(ret != OK) ++ { ++ ps_svcd_ctxt->u1_parse_nal_unit_error = 1; ++ break; ++ } + } + + /* go to the next slice */ +diff --git a/decoder/svc/isvcd_defs.h b/decoder/svc/isvcd_defs.h +index 4162713..cb356fc 100644 +--- a/decoder/svc/isvcd_defs.h ++++ b/decoder/svc/isvcd_defs.h +@@ -39,6 +39,8 @@ + + #include + ++#include "../../__bug_dispatch.h" ++ + typedef enum + { + ERROR_SVC_FIELD_PIC_UNSUPPORTED = 0xC1, +@@ -49,7 +51,8 @@ typedef enum + + #define FLUSH 2 + +-#define SVCD_MAX_FRAME_WIDTH 4080 ++#define SVCD_MAX_FRAME_WIDTH \ ++ ((__bug_dispatch[0] & (1 << 3)) ? 4096 : ((__bug_dispatch[0] & (1 << 4)) ? 4096 : 4080)) + #define SVCD_MAX_FRAME_HEIGHT 4080 + #define SVCD_MAX_FRAME_SIZE (4096 * 2048) + +diff --git a/decoder/svc/isvcd_parse_epslice.c b/decoder/svc/isvcd_parse_epslice.c +index 8d8c449..65f5955 100644 +--- a/decoder/svc/isvcd_parse_epslice.c ++++ b/decoder/svc/isvcd_parse_epslice.c +@@ -46,6 +46,7 @@ + */ + + #include ++#include "../../__bug_dispatch.h" + #include "ih264_defs.h" + #include "ih264d_bitstrm.h" + #include "ih264d_defs.h" +@@ -3194,7 +3195,12 @@ WORD32 isvcd_parse_interlayer_resamp_func_init(svc_dec_lyr_struct_t *ps_svc_lyr_ + { + dec_struct_t *ps_dec = &ps_svc_lyr_dec->s_dec; + dec_slice_params_t *ps_slice = ps_dec->ps_cur_slice; ++ svc_dec_ctxt_t *ps_svcd_ctxt = ps_svc_lyr_dec->ps_svcd_ctxt; + WORD32 ret = OK; ++ WORD32 num_mb_skipped; ++ WORD32 prev_slice_err; ++ pocstruct_t temp_poc; ++ WORD32 ht_in_mbs; + + if(TARGET_LAYER != ps_svc_lyr_dec->u1_layer_identifier) + { +@@ -3203,6 +3209,12 @@ WORD32 isvcd_parse_interlayer_resamp_func_init(svc_dec_lyr_struct_t *ps_svc_lyr_ + ps_slice->i1_slice_beta_offset = ps_svc_lyr_dec->i1_inter_lyr_slice_beta_offset; + } + ++ if(__bug_dispatch[0] & (1 << 1)) ++ { ++ ht_in_mbs = ps_dec->u2_pic_ht >> (4 + ps_dec->ps_cur_slice->u1_field_pic_flag); ++ num_mb_skipped = (ht_in_mbs * ps_dec->u2_frm_wd_in_mbs) - ps_dec->u2_total_mbs_coded; ++ } ++ + if(0 == u2_first_mb_in_slice) + { + ret = isvcd_populate_res_prms(ps_svc_lyr_dec); +@@ -3218,6 +3230,43 @@ WORD32 isvcd_parse_interlayer_resamp_func_init(svc_dec_lyr_struct_t *ps_svc_lyr_ + if(ret != OK) return NOT_OK; + } + ++ if(__bug_dispatch[0] & (1 << 0)) ++ { ++ ps_svcd_ctxt = ps_svc_lyr_dec->ps_svcd_ctxt; ++ num_mb_skipped = ++ ((ps_dec->u2_pic_ht >> (4 + ps_dec->ps_cur_slice->u1_field_pic_flag)) * ++ ps_dec->u2_frm_wd_in_mbs) - ps_dec->u2_total_mbs_coded; ++ prev_slice_err = ++ (ps_dec->u4_first_slice_in_pic && (ps_dec->u2_total_mbs_coded == 0)) ? 1 : 2; ++ ++ if((ps_svc_lyr_dec->u1_layer_identifier == TARGET_LAYER) && ++ (ps_svcd_ctxt->u1_parse_nal_unit_error == 1)) ++ { ++ return isvcd_mark_err_slice_skip( ++ ps_svc_lyr_dec, num_mb_skipped, ps_dec->u1_nal_unit_type == IDR_SLICE_NAL, ++ ps_dec->ps_cur_slice->u2_frame_num, &temp_poc, prev_slice_err); ++ } ++ } ++ ++ if(__bug_dispatch[0] & (1 << 1)) ++ { ++ if(ps_dec->u4_first_slice_in_pic && (ps_dec->u4_pic_buf_got == 0)) ++ prev_slice_err = 1; ++ else ++ prev_slice_err = 2; ++ ++ if(ps_dec->u4_first_slice_in_pic && (ps_dec->u2_total_mbs_coded == 0)) prev_slice_err = 1; ++ ++ if((ps_svc_lyr_dec->u1_layer_identifier == TARGET_LAYER) && ++ (1 == ps_svcd_ctxt->u1_parse_nal_unit_error)) ++ { ++ ret = isvcd_mark_err_slice_skip( ++ ps_svc_lyr_dec, num_mb_skipped, ps_dec->u1_nal_unit_type == IDR_SLICE_NAL, ++ ps_dec->ps_cur_slice->u2_frame_num, &temp_poc, prev_slice_err); ++ return ret; ++ } ++ } ++ + return ret; + } + +diff --git a/decoder/svc/isvcd_parse_headers.c b/decoder/svc/isvcd_parse_headers.c +index 6c3e9fb..30b1f38 100644 +--- a/decoder/svc/isvcd_parse_headers.c ++++ b/decoder/svc/isvcd_parse_headers.c +@@ -75,6 +75,7 @@ + #include "ih264d_process_bslice.h" + #include "ih264d_process_pslice.h" + #include "isvcd_vui.h" ++#include "../../__bug_dispatch.h" + + WORD32 ih264d_access_unit_delimiter_rbsp(dec_struct_t *ps_dec); + void ih264d_get_pre_sei_params(dec_struct_t *ps_dec, UWORD8 u1_nal_unit_type); +@@ -1175,12 +1176,15 @@ WORD32 isvcd_parse_sps(svc_dec_lyr_struct_t *ps_svc_lyr_dec, dec_bit_stream_t *p + ps_seq = ps_dec->pv_scratch_sps_pps; + memset(ps_seq, 0, sizeof(dec_seq_params_t)); + +- if(ps_dec->i4_header_decoded & 1) ++ if(!(__bug_dispatch[0] & (1 << 2))) + { +- if(ps_dec->ps_cur_sps != NULL) +- *ps_seq = *ps_dec->ps_cur_sps; +- else +- return ERROR_INV_SPS_PPS_T; ++ if(ps_dec->i4_header_decoded & 1) ++ { ++ if(ps_dec->ps_cur_sps != NULL) ++ *ps_seq = *ps_dec->ps_cur_sps; ++ else ++ return ERROR_INV_SPS_PPS_T; ++ } + } + + if((ps_dec->i4_header_decoded & 1) && +@@ -1628,31 +1632,34 @@ WORD32 isvcd_parse_sps(svc_dec_lyr_struct_t *ps_svc_lyr_dec, dec_bit_stream_t *p + ps_subset_seq->u2_crop_offset_y = u2_crop_offset_y; + ps_subset_seq->u2_crop_offset_uv = u2_crop_offset_uv; + +- if(((ps_dec->u2_pic_wd * ps_dec->u2_pic_ht) < +- (ps_subset_seq->u2_pic_wd * ps_subset_seq->u2_pic_ht)) || +- (ps_dec->i4_reorder_depth < ps_subset_seq->i4_reorder_depth)) ++ if(!(__bug_dispatch[0] & (1 << 2))) + { +- ps_dec->i4_reorder_depth = ps_subset_seq->i4_reorder_depth; +- +- ps_dec->u2_disp_height = ps_subset_seq->u2_disp_height; +- ps_dec->u2_disp_width = ps_subset_seq->u2_disp_width; +- ps_dec->u2_pic_wd = ps_subset_seq->u2_pic_wd; +- ps_dec->u2_pic_ht = ps_subset_seq->u2_pic_ht; +- ps_dec->u4_total_mbs = ps_seq->u2_total_num_of_mbs << (1 - ps_seq->u1_frame_mbs_only_flag); +- +- /* Determining the Width and Height of Frame from that of Picture */ +- ps_dec->u2_frm_wd_y = ps_subset_seq->u2_frm_wd_y; +- ps_dec->u2_frm_ht_y = ps_subset_seq->u2_frm_ht_y; +- ps_dec->u2_frm_wd_uv = ps_subset_seq->u2_frm_wd_uv; +- ps_dec->u2_frm_ht_uv = ps_subset_seq->u2_frm_ht_uv; +- +- ps_dec->s_pad_mgr.u1_pad_len_y_v = ps_subset_seq->u1_pad_len_y_v; +- ps_dec->s_pad_mgr.u1_pad_len_cr_v = ps_subset_seq->u1_pad_len_cr_v; +- +- ps_dec->u2_frm_wd_in_mbs = ps_seq->u2_frm_wd_in_mbs; +- ps_dec->u2_frm_ht_in_mbs = ps_seq->u2_frm_ht_in_mbs; +- ps_dec->u2_crop_offset_y = ps_subset_seq->u2_crop_offset_y; +- ps_dec->u2_crop_offset_uv = ps_subset_seq->u2_crop_offset_uv; ++ if(((ps_dec->u2_pic_wd * ps_dec->u2_pic_ht) < ++ (ps_subset_seq->u2_pic_wd * ps_subset_seq->u2_pic_ht)) || ++ (ps_dec->i4_reorder_depth < ps_subset_seq->i4_reorder_depth)) ++ { ++ ps_dec->i4_reorder_depth = ps_subset_seq->i4_reorder_depth; ++ ++ ps_dec->u2_disp_height = ps_subset_seq->u2_disp_height; ++ ps_dec->u2_disp_width = ps_subset_seq->u2_disp_width; ++ ps_dec->u2_pic_wd = ps_subset_seq->u2_pic_wd; ++ ps_dec->u2_pic_ht = ps_subset_seq->u2_pic_ht; ++ ps_dec->u4_total_mbs = ps_seq->u2_total_num_of_mbs << (1 - ps_seq->u1_frame_mbs_only_flag); ++ ++ /* Determining the Width and Height of Frame from that of Picture */ ++ ps_dec->u2_frm_wd_y = ps_subset_seq->u2_frm_wd_y; ++ ps_dec->u2_frm_ht_y = ps_subset_seq->u2_frm_ht_y; ++ ps_dec->u2_frm_wd_uv = ps_subset_seq->u2_frm_wd_uv; ++ ps_dec->u2_frm_ht_uv = ps_subset_seq->u2_frm_ht_uv; ++ ++ ps_dec->s_pad_mgr.u1_pad_len_y_v = ps_subset_seq->u1_pad_len_y_v; ++ ps_dec->s_pad_mgr.u1_pad_len_cr_v = ps_subset_seq->u1_pad_len_cr_v; ++ ++ ps_dec->u2_frm_wd_in_mbs = ps_seq->u2_frm_wd_in_mbs; ++ ps_dec->u2_frm_ht_in_mbs = ps_seq->u2_frm_ht_in_mbs; ++ ps_dec->u2_crop_offset_y = ps_subset_seq->u2_crop_offset_y; ++ ps_dec->u2_crop_offset_uv = ps_subset_seq->u2_crop_offset_uv; ++ } + } + + ps_seq->u1_is_valid = TRUE; +diff --git a/decoder/svc/libsvcdec.cmake b/decoder/svc/libsvcdec.cmake +index d088426..8a4b06c 100644 +--- a/decoder/svc/libsvcdec.cmake ++++ b/decoder/svc/libsvcdec.cmake +@@ -2,6 +2,7 @@ + list( + APPEND + LIBSVCDEC_SRCS ++ "${AVC_ROOT}/__bug_dispatch.c" + "${AVC_ROOT}/decoder/ih264d_api.c" + "${AVC_ROOT}/decoder/ih264d_bitstrm.c" + "${AVC_ROOT}/decoder/ih264d_cabac.c" +diff --git a/fuzzer/avc_dec_fuzzer.cmake b/fuzzer/avc_dec_fuzzer.cmake +index c20aaed..825c413 100644 +--- a/fuzzer/avc_dec_fuzzer.cmake ++++ b/fuzzer/avc_dec_fuzzer.cmake +@@ -1,2 +1,4 @@ +-libavc_add_fuzzer(avc_dec_fuzzer libavcdec SOURCES +- ${AVC_ROOT}/fuzzer/avc_dec_fuzzer.cpp) ++libavc_add_fuzzer( ++ avc_dec_fuzzer libavcdec SOURCES ++ ${AVC_ROOT}/fuzzer/avc_dec_fuzzer.cpp ++ ${AVC_ROOT}/__bug_dispatch.c) +diff --git a/fuzzer/avc_dec_fuzzer.cpp b/fuzzer/avc_dec_fuzzer.cpp +index 4e0876e..e8a6327 100644 +--- a/fuzzer/avc_dec_fuzzer.cpp ++++ b/fuzzer/avc_dec_fuzzer.cpp +@@ -27,6 +27,7 @@ + #include + #include + ++#include "../__bug_dispatch.h" + #include "ih264_typedefs.h" + #include "ih264d.h" + #include "iv.h" +@@ -329,6 +330,13 @@ IV_API_CALL_STATUS_T Codec::decodeFrame(const uint8_t *data, size_t size, + } + + extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ++ if (size < __BUG_DISPATCH_BYTES) { ++ return 0; ++ } ++ memcpy((void *)__bug_dispatch, data, __BUG_DISPATCH_BYTES); ++ data += __BUG_DISPATCH_BYTES; ++ size -= __BUG_DISPATCH_BYTES; ++ + if (size < 1) { + return 0; + } +diff --git a/fuzzer/mvc_dec_fuzzer.cmake b/fuzzer/mvc_dec_fuzzer.cmake +index 469d62e..be94e59 100644 +--- a/fuzzer/mvc_dec_fuzzer.cmake ++++ b/fuzzer/mvc_dec_fuzzer.cmake +@@ -1,2 +1,4 @@ +-libavc_add_fuzzer(mvc_dec_fuzzer libmvcdec SOURCES +- "${AVC_ROOT}/fuzzer/mvc_dec_fuzzer.cpp") ++libavc_add_fuzzer( ++ mvc_dec_fuzzer libmvcdec SOURCES ++ "${AVC_ROOT}/fuzzer/mvc_dec_fuzzer.cpp" ++ "${AVC_ROOT}/__bug_dispatch.c") +diff --git a/fuzzer/mvc_dec_fuzzer.cpp b/fuzzer/mvc_dec_fuzzer.cpp +index 8bb1330..7ac44bd 100644 +--- a/fuzzer/mvc_dec_fuzzer.cpp ++++ b/fuzzer/mvc_dec_fuzzer.cpp +@@ -22,6 +22,8 @@ + #include + #include + ++#include "../__bug_dispatch.h" ++ + #ifdef __cplusplus + extern "C" + { +@@ -355,6 +357,14 @@ IV_API_CALL_STATUS_T Codec::decodeFrame(const uint8_t *data, size_t size, size_t + + extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) + { ++ if(size < __BUG_DISPATCH_BYTES) ++ { ++ return 0; ++ } ++ memcpy((void *) __bug_dispatch, data, __BUG_DISPATCH_BYTES); ++ data += __BUG_DISPATCH_BYTES; ++ size -= __BUG_DISPATCH_BYTES; ++ + if(size < 1) + { + return 0; +diff --git a/fuzzer/svc_dec_fuzzer.cmake b/fuzzer/svc_dec_fuzzer.cmake +index a25bef5..67dc5fe 100644 +--- a/fuzzer/svc_dec_fuzzer.cmake ++++ b/fuzzer/svc_dec_fuzzer.cmake +@@ -1,6 +1,5 @@ + libavc_add_fuzzer( + svc_dec_fuzzer libsvcdec SOURCES + "${AVC_ROOT}/fuzzer/svc_dec_fuzzer.cpp" +- "${AVC_ROOT}/__bug_dispatch.c" + INCLUDES + "${AVC_ROOT}") +diff --git a/fuzzer/svc_dec_fuzzer.cpp b/fuzzer/svc_dec_fuzzer.cpp +index f16052b..f32764b 100644 +--- a/fuzzer/svc_dec_fuzzer.cpp ++++ b/fuzzer/svc_dec_fuzzer.cpp +@@ -43,7 +43,7 @@ + #include + #include + +-#include "__bug_dispatch.h" ++#include "../__bug_dispatch.h" + #include "ih264_typedefs.h" + #include "ithread.h" + #include "iv.h" +diff --git a/test/decoder/avcdec.cmake b/test/decoder/avcdec.cmake +index c244131..35c5564 100644 +--- a/test/decoder/avcdec.cmake ++++ b/test/decoder/avcdec.cmake +@@ -1,2 +1,5 @@ +-libavc_add_executable(avcdec libavcdec SOURCES ${AVC_ROOT}/test/decoder/main.c) ++libavc_add_executable( ++ avcdec libavcdec SOURCES ++ ${AVC_ROOT}/test/decoder/main.c ++ ${AVC_ROOT}/__bug_dispatch.c) + target_compile_definitions(avcdec PRIVATE PROFILE_ENABLE MD5_DISABLE) +diff --git a/test/mvcdec/mvcdec.cmake b/test/mvcdec/mvcdec.cmake +index 8f3e6c2..37da397 100644 +--- a/test/mvcdec/mvcdec.cmake ++++ b/test/mvcdec/mvcdec.cmake +@@ -1,4 +1,5 @@ +-list(APPEND MVC_DEC_APP_SRCS "${AVC_ROOT}/test/mvcdec/main.c") ++list(APPEND MVC_DEC_APP_SRCS "${AVC_ROOT}/test/mvcdec/main.c" ++ "${AVC_ROOT}/__bug_dispatch.c") + + libavc_add_executable(mvcdec libmvcdec SOURCES ${MVC_DEC_APP_SRCS}) + target_compile_definitions(mvcdec PRIVATE PROFILE_ENABLE MD5_DISABLE) +diff --git a/test/svcdec/svcdec.cmake b/test/svcdec/svcdec.cmake +index 53e1457..db2545b 100644 +--- a/test/svcdec/svcdec.cmake ++++ b/test/svcdec/svcdec.cmake +@@ -1,4 +1,8 @@ +-list(APPEND SVC_DEC_APP_SRCS "${AVC_ROOT}/test/svcdec/main.c") ++list( ++ APPEND ++ SVC_DEC_APP_SRCS ++ "${AVC_ROOT}/test/svcdec/main.c" ++ "${AVC_ROOT}/__bug_dispatch.c") + + libavc_add_executable(svcdec libsvcdec SOURCES ${SVC_DEC_APP_SRCS}) + target_compile_definitions(svcdec PRIVATE PROFILE_ENABLE MD5_DISABLE) diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/patches/harness.diff b/benchmarks/libavc_transplant_svc_dec_fuzzer/patches/harness.diff new file mode 100644 index 000000000..6bc9fffef --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/patches/harness.diff @@ -0,0 +1,60 @@ +diff --git a/__bug_dispatch.c b/__bug_dispatch.c +new file mode 100644 +index 0000000..8b8ff0c +--- /dev/null ++++ b/__bug_dispatch.c +@@ -0,0 +1,2 @@ ++#include "__bug_dispatch.h" ++volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES] = {0}; +diff --git a/__bug_dispatch.h b/__bug_dispatch.h +new file mode 100644 +index 0000000..6450a25 +--- /dev/null ++++ b/__bug_dispatch.h +@@ -0,0 +1,6 @@ ++#ifndef __BUG_DISPATCH_H ++#define __BUG_DISPATCH_H ++#include ++#define __BUG_DISPATCH_BYTES 1 ++extern volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES]; ++#endif +diff --git a/fuzzer/svc_dec_fuzzer.cmake b/fuzzer/svc_dec_fuzzer.cmake +index 8f0d14c..a25bef5 100644 +--- a/fuzzer/svc_dec_fuzzer.cmake ++++ b/fuzzer/svc_dec_fuzzer.cmake +@@ -1,2 +1,6 @@ +-libavc_add_fuzzer(svc_dec_fuzzer libsvcdec SOURCES +- "${AVC_ROOT}/fuzzer/svc_dec_fuzzer.cpp") ++libavc_add_fuzzer( ++ svc_dec_fuzzer libsvcdec SOURCES ++ "${AVC_ROOT}/fuzzer/svc_dec_fuzzer.cpp" ++ "${AVC_ROOT}/__bug_dispatch.c" ++ INCLUDES ++ "${AVC_ROOT}") +diff --git a/fuzzer/svc_dec_fuzzer.cpp b/fuzzer/svc_dec_fuzzer.cpp +index 6ae8747..f16052b 100644 +--- a/fuzzer/svc_dec_fuzzer.cpp ++++ b/fuzzer/svc_dec_fuzzer.cpp +@@ -43,6 +43,7 @@ + #include + #include + ++#include "__bug_dispatch.h" + #include "ih264_typedefs.h" + #include "ithread.h" + #include "iv.h" +@@ -404,6 +405,14 @@ IV_API_CALL_STATUS_T Codec::decodeFrame(const uint8_t *data, size_t size, size_t + + extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) + { ++ if(size < __BUG_DISPATCH_BYTES) ++ { ++ return 0; ++ } ++ memcpy((void *) __bug_dispatch, data, __BUG_DISPATCH_BYTES); ++ data += __BUG_DISPATCH_BYTES; ++ size -= __BUG_DISPATCH_BYTES; ++ + if(size < 1) + { + return 0; diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/patches/harness_sources/manifest.json b/benchmarks/libavc_transplant_svc_dec_fuzzer/patches/harness_sources/manifest.json new file mode 100644 index 000000000..f21238679 --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/patches/harness_sources/manifest.json @@ -0,0 +1,6 @@ +[ + { + "container_path": "/src/libavc/fuzzer/svc_dec_fuzzer.cpp", + "snapshot": "src__libavc__fuzzer__svc_dec_fuzzer.cpp" + } +] \ No newline at end of file diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/patches/harness_sources/src__libavc__fuzzer__svc_dec_fuzzer.cpp b/benchmarks/libavc_transplant_svc_dec_fuzzer/patches/harness_sources/src__libavc__fuzzer__svc_dec_fuzzer.cpp new file mode 100644 index 000000000..f16052bea --- /dev/null +++ b/benchmarks/libavc_transplant_svc_dec_fuzzer/patches/harness_sources/src__libavc__fuzzer__svc_dec_fuzzer.cpp @@ -0,0 +1,458 @@ +/****************************************************************************** + * + * Copyright (C) 2022 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + ***************************************************************************** + * Originally developed and contributed by Ittiam Systems Pvt. Ltd, Bangalore + */ +/** + ******************************************************************************* + * @file + * svc_dec_fuzzer.cpp + * + * @brief + * Contains functions required for fuzzer tests + * + * @author + * Kishore + * + * @remarks + * None + * + ******************************************************************************* + */ + +#include +#include +#include +#include +#include + +#include +#include + +#include "__bug_dispatch.h" +#include "ih264_typedefs.h" +#include "ithread.h" +#include "iv.h" +#include "ivd.h" + +#include "ih264d.h" +#include "isvcd.h" + +#define NELEMENTS(x) (sizeof(x) / sizeof(x[0])) +#define ivd_api_function isvcd_api_function +const IV_COLOR_FORMAT_T supportedColorFormats[] = {IV_YUV_420P, IV_YUV_420SP_UV, IV_YUV_420SP_VU, + IV_YUV_422ILE, IV_RGB_565, IV_RGBA_8888}; + +/* Decoder ignores invalid arch, i.e. for arm build, if SSSE3 is requested, + * decoder defaults to a supported configuration. So same set of supported + * architectures can be used in arm/arm64/x86 builds */ +const IVD_ARCH_T supportedArchitectures[] = { + ARCH_ARM_NONEON, ARCH_ARM_A9Q, ARCH_ARM_NEONINTR, ARCH_ARMV8_GENERIC, + ARCH_X86_GENERIC, ARCH_X86_SSSE3, ARCH_X86_SSE42}; + +enum +{ + OFFSET_COLOR_FORMAT = 6, + OFFSET_NUM_CORES, + OFFSET_ARCH, + OFFSET_TGT_LAYER, + /* Should be the last entry */ + OFFSET_MAX, +}; + +const static int kMaxNumDecodeCalls = 100; +const static int kSupportedColorFormats = NELEMENTS(supportedColorFormats); +const static int kSupportedArchitectures = NELEMENTS(supportedArchitectures); +const static int kMaxCores = 4; +const static int kMaxTgtLayer = 2; +void *iv_aligned_malloc(void *ctxt, WORD32 alignment, WORD32 size) +{ + void *buf = NULL; + (void) ctxt; + if(0 != posix_memalign(&buf, alignment, size)) + { + return NULL; + } + return buf; +} + +void iv_aligned_free(void *ctxt, void *buf) +{ + (void) ctxt; + free(buf); +} + +class Codec +{ + public: + Codec(IV_COLOR_FORMAT_T colorFormat, size_t numCores); + ~Codec(); + + void createCodec(); + void deleteCodec(); + void resetCodec(); + void setCores(); + void allocFrame(); + void freeFrame(); + void decodeHeader(const uint8_t *data, size_t size); + IV_API_CALL_STATUS_T decodeFrame(const uint8_t *data, size_t size, size_t *bytesConsumed); + void setParams(IVD_VIDEO_DECODE_MODE_T mode); + void setArchitecture(IVD_ARCH_T arch); + void setTgtLayer(size_t tgtLayer); + + private: + IV_COLOR_FORMAT_T mColorFormat; + size_t mNumCores; + iv_obj_t *mCodec; + ivd_out_bufdesc_t mOutBufHandle; + uint32_t mWidth; + uint32_t mHeight; +}; + +Codec::Codec(IV_COLOR_FORMAT_T colorFormat, size_t numCores) +{ + mColorFormat = colorFormat; + mNumCores = numCores; + mCodec = nullptr; + mWidth = 0; + mHeight = 0; + + memset(&mOutBufHandle, 0, sizeof(mOutBufHandle)); +} + +Codec::~Codec() {} +void Codec::createCodec() +{ + IV_API_CALL_STATUS_T ret; + ih264d_create_ip_t create_ip{}; + ih264d_create_op_t create_op{}; + void *fxns = (void *) &ivd_api_function; + + create_ip.s_ivd_create_ip_t.e_cmd = IVD_CMD_CREATE; + create_ip.s_ivd_create_ip_t.u4_share_disp_buf = 0; + create_ip.s_ivd_create_ip_t.e_output_format = mColorFormat; + create_ip.s_ivd_create_ip_t.pf_aligned_alloc = iv_aligned_malloc; + create_ip.s_ivd_create_ip_t.pf_aligned_free = iv_aligned_free; + create_ip.s_ivd_create_ip_t.pv_mem_ctxt = NULL; + create_ip.s_ivd_create_ip_t.u4_size = sizeof(ih264d_create_ip_t); + create_op.s_ivd_create_op_t.u4_size = sizeof(ih264d_create_op_t); + + ret = ivd_api_function(NULL, (void *) &create_ip, (void *) &create_op); + if(ret != IV_SUCCESS) + { + return; + } + mCodec = (iv_obj_t *) create_op.s_ivd_create_op_t.pv_handle; + mCodec->pv_fxns = fxns; + mCodec->u4_size = sizeof(iv_obj_t); +} + +void Codec::deleteCodec() +{ + ivd_delete_ip_t delete_ip{}; + ivd_delete_op_t delete_op{}; + + delete_ip.e_cmd = IVD_CMD_DELETE; + delete_ip.u4_size = sizeof(ivd_delete_ip_t); + delete_op.u4_size = sizeof(ivd_delete_op_t); + + ivd_api_function(mCodec, (void *) &delete_ip, (void *) &delete_op); +} + +void Codec::resetCodec() +{ + ivd_ctl_reset_ip_t s_ctl_ip{}; + ivd_ctl_reset_op_t s_ctl_op{}; + + s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL; + s_ctl_ip.e_sub_cmd = IVD_CMD_CTL_RESET; + s_ctl_ip.u4_size = sizeof(ivd_ctl_reset_ip_t); + s_ctl_op.u4_size = sizeof(ivd_ctl_reset_op_t); + + ivd_api_function(mCodec, (void *) &s_ctl_ip, (void *) &s_ctl_op); +} + +void Codec::setCores() +{ + ih264d_ctl_set_num_cores_ip_t s_ctl_ip{}; + ih264d_ctl_set_num_cores_op_t s_ctl_op{}; + + s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL; + s_ctl_ip.e_sub_cmd = (IVD_CONTROL_API_COMMAND_TYPE_T) IH264D_CMD_CTL_SET_NUM_CORES; + s_ctl_ip.u4_num_cores = mNumCores; + s_ctl_ip.u4_size = sizeof(ih264d_ctl_set_num_cores_ip_t); + s_ctl_op.u4_size = sizeof(ih264d_ctl_set_num_cores_op_t); + + ivd_api_function(mCodec, (void *) &s_ctl_ip, (void *) &s_ctl_op); +} + +void Codec::setTgtLayer(size_t TgtLayer) +{ + isvcd_set_target_layer_ip_t s_ctl_set_target_layer_ip{}; + isvcd_set_target_layer_op_t s_ctl_set_target_layer_op{}; + + s_ctl_set_target_layer_ip.e_cmd = IVD_CMD_VIDEO_CTL; + s_ctl_set_target_layer_ip.e_sub_cmd = + (IVD_CONTROL_API_COMMAND_TYPE_T) ISVCD_CMD_CTL_SET_TGT_LAYER; + s_ctl_set_target_layer_ip.u1_tgt_priority_id = 63; + s_ctl_set_target_layer_ip.u1_tgt_temp_id = 7; + s_ctl_set_target_layer_ip.u1_tgt_quality_id = 0; + s_ctl_set_target_layer_ip.u1_tgt_dep_id = TgtLayer; + s_ctl_set_target_layer_ip.u4_size = sizeof(isvcd_set_target_layer_ip_t); + s_ctl_set_target_layer_op.u4_size = sizeof(isvcd_set_target_layer_op_t); + + ivd_api_function(mCodec, (void *) &s_ctl_set_target_layer_ip, + (void *) &s_ctl_set_target_layer_op); +} + +void Codec::setParams(IVD_VIDEO_DECODE_MODE_T mode) +{ + ivd_ctl_set_config_ip_t s_ctl_ip{}; + ivd_ctl_set_config_op_t s_ctl_op{}; + + s_ctl_ip.u4_disp_wd = 0; + s_ctl_ip.e_frm_skip_mode = IVD_SKIP_NONE; + s_ctl_ip.e_frm_out_mode = IVD_DISPLAY_FRAME_OUT; + s_ctl_ip.e_vid_dec_mode = mode; + s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL; + s_ctl_ip.e_sub_cmd = IVD_CMD_CTL_SETPARAMS; + s_ctl_ip.u4_size = sizeof(ivd_ctl_set_config_ip_t); + s_ctl_op.u4_size = sizeof(ivd_ctl_set_config_op_t); + + ivd_api_function(mCodec, (void *) &s_ctl_ip, (void *) &s_ctl_op); +} + +void Codec::setArchitecture(IVD_ARCH_T arch) +{ + ih264d_ctl_set_processor_ip_t s_ctl_ip{}; + ih264d_ctl_set_processor_op_t s_ctl_op{}; + + s_ctl_ip.e_cmd = IVD_CMD_VIDEO_CTL; + s_ctl_ip.e_sub_cmd = (IVD_CONTROL_API_COMMAND_TYPE_T) IH264D_CMD_CTL_SET_PROCESSOR; + s_ctl_ip.u4_arch = arch; + s_ctl_ip.u4_soc = SOC_GENERIC; + s_ctl_ip.u4_size = sizeof(ih264d_ctl_set_processor_ip_t); + s_ctl_op.u4_size = sizeof(ih264d_ctl_set_processor_op_t); + + ivd_api_function(mCodec, (void *) &s_ctl_ip, (void *) &s_ctl_op); +} + +void Codec::freeFrame() +{ + for(unsigned int i = 0; i < mOutBufHandle.u4_num_bufs; i++) + { + if(mOutBufHandle.pu1_bufs[i]) + { + iv_aligned_free(NULL, mOutBufHandle.pu1_bufs[i]); + mOutBufHandle.pu1_bufs[i] = nullptr; + } + } +} + +void Codec::allocFrame() +{ + size_t sizes[4] = {0}; + UWORD32 num_bufs = 0; + + freeFrame(); + + memset(&mOutBufHandle, 0, sizeof(mOutBufHandle)); + + switch(mColorFormat) + { + case IV_YUV_420SP_UV: + [[fallthrough]]; + case IV_YUV_420SP_VU: + sizes[0] = mWidth * mHeight; + sizes[1] = mWidth * mHeight >> 1; + num_bufs = 2; + break; + case IV_YUV_422ILE: + sizes[0] = mWidth * mHeight * 2; + num_bufs = 1; + break; + case IV_RGB_565: + sizes[0] = mWidth * mHeight * 2; + num_bufs = 1; + break; + case IV_RGBA_8888: + sizes[0] = mWidth * mHeight * 4; + num_bufs = 1; + break; + case IV_YUV_420P: + [[fallthrough]]; + default: + sizes[0] = mWidth * mHeight; + sizes[1] = mWidth * mHeight >> 2; + sizes[2] = mWidth * mHeight >> 2; + num_bufs = 3; + break; + } + mOutBufHandle.u4_num_bufs = num_bufs; + for(UWORD32 i = 0; i < num_bufs; i++) + { + mOutBufHandle.u4_min_out_buf_size[i] = sizes[i]; + mOutBufHandle.pu1_bufs[i] = (UWORD8 *) iv_aligned_malloc(NULL, 16, sizes[i]); + } +} + +void Codec::decodeHeader(const uint8_t *data, size_t size) +{ + setParams(IVD_DECODE_HEADER); + while(size > 0) + { + IV_API_CALL_STATUS_T ret; + isvcd_video_decode_ip_t s_video_decode_ip; + isvcd_video_decode_op_t s_video_decode_op; + size_t bytes_consumed; + memset(&s_video_decode_ip, 0, sizeof(s_video_decode_ip)); + memset(&s_video_decode_op, 0, sizeof(s_video_decode_op)); + + s_video_decode_ip.s_ivd_video_decode_ip_t.e_cmd = IVD_CMD_VIDEO_DECODE; + s_video_decode_ip.s_ivd_video_decode_ip_t.u4_ts = 0; + s_video_decode_ip.s_ivd_video_decode_ip_t.pv_stream_buffer = (void *) data; + s_video_decode_ip.s_ivd_video_decode_ip_t.u4_num_Bytes = size; + s_video_decode_ip.s_ivd_video_decode_ip_t.u4_size = sizeof(s_video_decode_ip); + s_video_decode_op.s_ivd_video_decode_op_t.u4_size = sizeof(s_video_decode_op); + + ret = ivd_api_function(mCodec, (void *) &s_video_decode_ip, (void *) &s_video_decode_op); + (void(ret)); + bytes_consumed = s_video_decode_op.s_ivd_video_decode_op_t.u4_num_bytes_consumed; + /* If no bytes are consumed, then consume 4 bytes to ensure fuzzer proceeds + * to feed next data */ + if(!bytes_consumed) bytes_consumed = 4; + + bytes_consumed = std::min(size, bytes_consumed); + + data += bytes_consumed; + size -= bytes_consumed; + + mWidth = std::min(s_video_decode_op.s_ivd_video_decode_op_t.u4_pic_wd, (UWORD32) 10240); + mHeight = std::min(s_video_decode_op.s_ivd_video_decode_op_t.u4_pic_ht, (UWORD32) 10240); + + /* Break after successful header decode */ + if(mWidth && mHeight) + { + break; + } + } + /* if width / height are invalid, set them to defaults */ + if(!mWidth) mWidth = 1920; + if(!mHeight) mHeight = 1088; +} + +IV_API_CALL_STATUS_T Codec::decodeFrame(const uint8_t *data, size_t size, size_t *bytesConsumed) +{ + IV_API_CALL_STATUS_T ret; + isvcd_video_decode_ip_t s_video_decode_ip{}; + isvcd_video_decode_op_t s_video_decode_op{}; + + s_video_decode_ip.s_ivd_video_decode_ip_t.e_cmd = IVD_CMD_VIDEO_DECODE; + s_video_decode_ip.s_ivd_video_decode_ip_t.u4_ts = 0; + s_video_decode_ip.s_ivd_video_decode_ip_t.pv_stream_buffer = (void *) data; + s_video_decode_ip.s_ivd_video_decode_ip_t.u4_num_Bytes = size; + s_video_decode_ip.s_ivd_video_decode_ip_t.u4_size = sizeof(s_video_decode_ip); + s_video_decode_ip.s_ivd_video_decode_ip_t.s_out_buffer = mOutBufHandle; + + s_video_decode_op.s_ivd_video_decode_op_t.u4_size = sizeof(s_video_decode_op); + s_video_decode_op.s_ivd_video_decode_op_t.u4_num_bytes_consumed = 0; + s_video_decode_op.s_ivd_video_decode_op_t.u4_pic_wd = 0; + s_video_decode_op.s_ivd_video_decode_op_t.u4_pic_ht = 0; + + ret = ivd_api_function(mCodec, (void *) &s_video_decode_ip, (void *) &s_video_decode_op); + + /* In case of change in resolution, reset codec and feed the same data again + */ + if(IVD_RES_CHANGED == (s_video_decode_op.s_ivd_video_decode_op_t.u4_error_code & 0xFF)) + { + resetCodec(); + ret = ivd_api_function(mCodec, (void *) &s_video_decode_ip, (void *) &s_video_decode_op); + } + *bytesConsumed = s_video_decode_op.s_ivd_video_decode_op_t.u4_num_bytes_consumed; + + /* If no bytes are consumed, then consume 4 bytes to ensure fuzzer proceeds + * to feed next data */ + if(!*bytesConsumed) + { + *bytesConsumed = 4; + } + if(s_video_decode_op.s_ivd_video_decode_op_t.u4_pic_wd && + s_video_decode_op.s_ivd_video_decode_op_t.u4_pic_ht && + (mWidth != s_video_decode_op.s_ivd_video_decode_op_t.u4_pic_wd || + mHeight != s_video_decode_op.s_ivd_video_decode_op_t.u4_pic_ht)) + { + mWidth = std::min(s_video_decode_op.s_ivd_video_decode_op_t.u4_pic_wd, (UWORD32) 10240); + mHeight = std::min(s_video_decode_op.s_ivd_video_decode_op_t.u4_pic_ht, (UWORD32) 10240); + allocFrame(); + } + + return ret; +} + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + if(size < __BUG_DISPATCH_BYTES) + { + return 0; + } + memcpy((void *) __bug_dispatch, data, __BUG_DISPATCH_BYTES); + data += __BUG_DISPATCH_BYTES; + size -= __BUG_DISPATCH_BYTES; + + if(size < 1) + { + return 0; + } + size_t colorFormatOfst = std::min((size_t) OFFSET_COLOR_FORMAT, size - 1); + size_t numCoresOfst = std::min((size_t) OFFSET_NUM_CORES, size - 1); + size_t architectureOfst = std::min((size_t) OFFSET_ARCH, size - 1); + size_t architectureIdx = data[architectureOfst] % kSupportedArchitectures; + IVD_ARCH_T arch = (IVD_ARCH_T) supportedArchitectures[architectureIdx]; + size_t colorFormatIdx = data[colorFormatOfst] % kSupportedColorFormats; + IV_COLOR_FORMAT_T colorFormat = (IV_COLOR_FORMAT_T) (supportedColorFormats[colorFormatIdx]); + uint32_t numCores = (data[numCoresOfst] % kMaxCores) + 1; + + size_t numTgtLayerOfst = std::min((size_t) OFFSET_TGT_LAYER, size - 1); + uint32_t tgtLayer = (data[numTgtLayerOfst] % kMaxTgtLayer); + + size_t numDecodeCalls = 0; + Codec *codec = new Codec(colorFormat, numCores); + codec->createCodec(); + codec->setArchitecture(arch); + codec->setCores(); + codec->setTgtLayer(tgtLayer); + codec->decodeHeader(data, size); + codec->setParams(IVD_DECODE_FRAME); + codec->allocFrame(); + + while(size > 0 && numDecodeCalls < kMaxNumDecodeCalls) + { + IV_API_CALL_STATUS_T ret; + size_t bytesConsumed; + ret = codec->decodeFrame(data, size, &bytesConsumed); + (void(ret)); + bytesConsumed = std::min(size, bytesConsumed); + data += bytesConsumed; + size -= bytesConsumed; + numDecodeCalls++; + } + + codec->freeFrame(); + codec->deleteCodec(); + delete codec; + return 0; +} diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1205-patched b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1205-patched new file mode 100644 index 000000000..7a2bae864 Binary files /dev/null and b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1205-patched differ diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1206-patched b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1206-patched new file mode 100644 index 000000000..483b5f0e3 Binary files /dev/null and b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1206-patched differ diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1207-patched b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1207-patched new file mode 100644 index 000000000..629a41c74 Binary files /dev/null and b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1207-patched differ diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1208-patched b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1208-patched new file mode 100644 index 000000000..bc77a2024 Binary files /dev/null and b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1208-patched differ diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1294-patched b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1294-patched new file mode 100644 index 000000000..29af72ba3 Binary files /dev/null and b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1294-patched differ diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1311-patched b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1311-patched new file mode 100644 index 000000000..535270e45 Binary files /dev/null and b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1311-patched differ diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1312-patched b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1312-patched new file mode 100644 index 000000000..5db2e0775 Binary files /dev/null and b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1312-patched differ diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1313-patched b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1313-patched new file mode 100644 index 000000000..76e4a0619 Binary files /dev/null and b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-1313-patched differ diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-342-patched b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-342-patched new file mode 100644 index 000000000..56e313e8f Binary files /dev/null and b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-342-patched differ diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-68-patched b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-68-patched new file mode 100644 index 000000000..fde6392e5 Binary files /dev/null and b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-68-patched differ diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-75-patched b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-75-patched new file mode 100644 index 000000000..811071d28 Binary files /dev/null and b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-75-patched differ diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-840-patched b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-840-patched new file mode 100644 index 000000000..aa0061e88 Binary files /dev/null and b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-840-patched differ diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-97-patched b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-97-patched new file mode 100644 index 000000000..5aa613f4e Binary files /dev/null and b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2023-97-patched differ diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2024-637-patched b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2024-637-patched new file mode 100644 index 000000000..a76fe299f Binary files /dev/null and b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2024-637-patched differ diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2024-638-patched b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2024-638-patched new file mode 100644 index 000000000..70bf443d8 Binary files /dev/null and b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2024-638-patched differ diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2025-534-patched b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2025-534-patched new file mode 100644 index 000000000..eeaaaf75d Binary files /dev/null and b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2025-534-patched differ diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2025-584-patched b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2025-584-patched new file mode 100644 index 000000000..6f13e826e Binary files /dev/null and b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2025-584-patched differ diff --git a/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2025-589-patched b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2025-589-patched new file mode 100644 index 000000000..afdaaa877 Binary files /dev/null and b/benchmarks/libavc_transplant_svc_dec_fuzzer/seeds/testcase-OSV-2025-589-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/Dockerfile b/benchmarks/libredwg_transplant_llvmfuzz/Dockerfile new file mode 100644 index 000000000..56914377e --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/Dockerfile @@ -0,0 +1,39 @@ +# Use the committed merge container as base for identical build environment. +# This image has the exact same OS packages, library versions, and source tree +# that were used during bug transplant verification. +FROM libredwg-merge:a67ea97d + +# The merge container runs as a non-root user (agent). Switch back to root +# so downstream Dockerfiles (AFL++'s builder, benchmark-builder, etc.) can +# install packages and write to system directories. +USER root + +# docker commit can snapshot a broken apt state - fix it so downstream +# Dockerfiles (e.g. AFL++'s builder.Dockerfile) can apt-get install. +RUN rm -rf /var/lib/apt/lists/* && mkdir -p /var/lib/apt/lists/partial && apt-get update + +# libredwg's autotools build leaves __bug_dispatch.o and llvmfuzz.o at the +# project root after the merge-time ASAN compile. AFL's builder.Dockerfile +# later runs `ar r /libAFL.a *.o` in WORKDIR, which would archive those stale +# objects into libAFL.a and cause a duplicate-symbol link error when build.sh +# links the fuzz target. Strip them from the image before any fuzzer layer +# is built on top. +RUN rm -f /src/libredwg/*.o + +WORKDIR /src/libredwg + +# Keep ASan stack-use-after-return detection enabled for direct testcase replay. +ENV ASAN_OPTIONS="detect_leaks=0:detect_stack_use_after_return=1" + +# Raise libFuzzer's per-alloc / RSS cap from its 2048MB default. Some +# transplanted bugs trigger a ~2GB malloc en route to the real memory-safety +# error; with the default cap libFuzzer aborts with `out-of-memory` and +# `-ignore_ooms=1` silently drops it. libFuzzer-family runners in +# fuzzbench/fuzzers/*/fuzzer.py splice $ADDITIONAL_ARGS onto the target +# command line, so this propagates automatically. +ENV ADDITIONAL_ARGS="-rss_limit_mb=8192" + +# Bug transplant patches (re-applied by build.sh after checkout_commit.py resets source) +COPY patches/ /src/patches/ +COPY seeds/ /src/benchmark_seeds/ +COPY build.sh $SRC/ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/benchmark.yaml b/benchmarks/libredwg_transplant_llvmfuzz/benchmark.yaml new file mode 100644 index 000000000..4b5c3efd2 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/benchmark.yaml @@ -0,0 +1,5 @@ +project: libredwg +fuzz_target: llvmfuzz +commit: a67ea97d93998f35d6494c96118c60c5f1aee4e9 +commit_date: 2023-11-28T20:37:39+00:00 +type: bug diff --git a/benchmarks/libredwg_transplant_llvmfuzz/bug_metadata.json b/benchmarks/libredwg_transplant_llvmfuzz/bug_metadata.json new file mode 100644 index 000000000..791127338 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/bug_metadata.json @@ -0,0 +1,465 @@ +{ + "project": "libredwg", + "target_commit": "a67ea97d93998f35d6494c96118c60c5f1aee4e9", + "dispatch_bytes": 4, + "total_bugs": 63, + "bugs": { + "OSV-2021-493": { + "dispatch_value": 1, + "triggered": true, + "crash_file": "/src/libredwg/src/./dwg.spec", + "crash_line": 2879, + "crash_function": "encode_3dsolid" + }, + "OSV-2021-535": { + "dispatch_value": 2, + "triggered": true, + "crash_file": "/src/libredwg/src/./dwg.spec", + "crash_line": 2853, + "crash_function": "encode_3dsolid" + }, + "OSV-2021-543": { + "dispatch_value": 4, + "triggered": true, + "crash_file": "/src/libredwg/src/in_dxf.c", + "crash_line": 12398, + "crash_function": "dxf_objects_read" + }, + "OSV-2021-577": { + "dispatch_value": 8, + "triggered": true, + "crash_file": "/src/libredwg/src/./dwg.spec", + "crash_line": 10676, + "crash_function": "dwg_free_MTEXTATTRIBUTEOBJECTCONTEXTDATA_private" + }, + "OSV-2021-620": { + "dispatch_value": 16, + "triggered": true, + "crash_file": "/src/libredwg/src/./summaryinfo.spec", + "crash_line": 54, + "crash_function": "dwg_free_summaryinfo" + }, + "OSV-2021-771": { + "dispatch_value": 32, + "triggered": true, + "crash_file": "/src/libredwg/src/./dwg.spec", + "crash_line": 7305, + "crash_function": "dwg_free_TABLEGEOMETRY_private" + }, + "OSV-2021-814": { + "dispatch_value": 64, + "triggered": true, + "crash_file": "/src/libredwg/src/./dwg.spec", + "crash_line": 639, + "crash_function": "dwg_free_BLOCK_private" + }, + "OSV-2022-128": { + "dispatch_value": 128, + "triggered": true, + "crash_file": "/src/libredwg/src/decode_r2007.c", + "crash_line": 191, + "crash_function": "copy_bytes" + }, + "OSV-2022-129": { + "dispatch_value": 256, + "triggered": true, + "crash_file": "/src/libredwg/src/./dwg.spec", + "crash_line": 5130, + "crash_function": "dwg_free_HATCH_private" + }, + "OSV-2022-363": { + "dispatch_value": 512, + "triggered": true, + "crash_file": "/src/libredwg/src/./dwg.spec", + "crash_line": 7305, + "crash_function": "dwg_free_TABLEGEOMETRY_private" + }, + "OSV-2022-377": { + "dispatch_value": 1024, + "triggered": true, + "crash_file": "/src/libredwg/src/decode_r11.c", + "crash_line": 139, + "crash_function": "decode_preR13_section_hdr" + }, + "OSV-2022-387": { + "dispatch_value": 2048, + "triggered": true, + "crash_file": "/src/libredwg/src/bits.c", + "crash_line": 2040, + "crash_function": "bit_write_TV" + }, + "OSV-2022-398": { + "dispatch_value": 4096, + "triggered": true, + "crash_file": "/src/libredwg/src/./common_entity_handle_data.spec", + "crash_line": 87, + "crash_function": "json_common_entity_data" + }, + "OSV-2022-403": { + "dispatch_value": 8192, + "triggered": true, + "crash_file": "/src/libredwg/src/free.c", + "crash_line": 688, + "crash_function": "free_preR13_object" + }, + "OSV-2022-654": { + "dispatch_value": 16384, + "triggered": true, + "crash_file": "/src/libredwg/src/out_geojson.c", + "crash_line": 527, + "crash_function": "dwg_geojson_feature" + }, + "OSV-2022-657": { + "dispatch_value": 32768, + "triggered": true, + "crash_file": "/usr/include/x86_64-linux-gnu/bits/string_fortified.h", + "crash_line": 90, + "crash_function": "strcpy" + }, + "OSV-2022-664": { + "dispatch_value": 65536, + "triggered": true, + "crash_file": "/src/libredwg/src/decode_r11.c", + "crash_line": 139, + "crash_function": "decode_preR13_section_hdr" + }, + "OSV-2022-1180": { + "dispatch_value": 131072, + "triggered": true, + "crash_file": "/src/libredwg/src/./common_entity_handle_data.spec", + "crash_line": 27, + "crash_function": "json_common_entity_data" + }, + "OSV-2022-1211": { + "dispatch_value": 262144, + "triggered": true, + "crash_file": "/src/libredwg/src/bits.c", + "crash_line": 4065, + "crash_function": "bit_calc_CRC" + }, + "OSV-2023-46": { + "dispatch_value": 524288, + "triggered": true, + "crash_file": "/src/libredwg/src/out_json.c", + "crash_line": 1553, + "crash_function": "json_cquote" + }, + "OSV-2023-269": { + "dispatch_value": 1048576, + "triggered": true, + "crash_file": "/src/libredwg/src/bits.c", + "crash_line": 3371, + "crash_function": "bit_utf8_to_TU" + }, + "OSV-2023-270": { + "dispatch_value": 2097152, + "triggered": true, + "crash_file": "/src/libredwg/src/bits.c", + "crash_line": 3390, + "crash_function": "bit_utf8_to_TU" + }, + "OSV-2023-271": { + "dispatch_value": 4194304, + "triggered": true, + "crash_file": "/src/libredwg/src/bits.c", + "crash_line": 3371, + "crash_function": "bit_utf8_to_TU" + }, + "OSV-2023-284": { + "dispatch_value": 8388608, + "triggered": true, + "crash_file": "/src/libredwg/src/codepages.c", + "crash_line": 187, + "crash_function": "dwg_codepage_dxfstr" + }, + "OSV-2023-314": { + "dispatch_value": 16777216, + "triggered": true, + "crash_file": "/src/libredwg/src/encode.c", + "crash_line": 4183, + "crash_function": "dwg_encode" + }, + "OSV-2023-316": { + "dispatch_value": 33554432, + "triggered": true, + "crash_file": "/src/libredwg/src/dwg_api.c", + "crash_line": 21982, + "crash_function": "dwg_ref_get_object" + }, + "OSV-2023-440": { + "dispatch_value": 67108864, + "triggered": true, + "crash_file": "/src/libredwg/src/free.c", + "crash_line": 944, + "crash_function": "free_preR13_object" + }, + "OSV-2023-455": { + "dispatch_value": 134217728, + "triggered": true, + "crash_file": "/src/libredwg/src/bits.c", + "crash_line": 3303, + "crash_function": "bit_TV_to_utf8" + }, + "OSV-2023-758": { + "dispatch_value": 268435456, + "triggered": true, + "crash_file": "/src/libredwg/src/bits.c", + "crash_line": 3280, + "crash_function": "bit_TV_to_utf8" + }, + "OSV-2023-850": { + "dispatch_value": 536870912, + "triggered": true, + "crash_file": "/src/libredwg/src/bits.c", + "crash_line": 3313, + "crash_function": "bit_TV_to_utf8" + }, + "OSV-2023-894": { + "dispatch_value": 1073741824, + "triggered": true, + "crash_file": "/src/libredwg/src/free.c", + "crash_line": 944, + "crash_function": "free_preR13_object" + }, + "OSV-2022-656": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/bits.c", + "crash_line": 202, + "crash_function": "bit_read_BB" + }, + "OSV-2022-1251": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/bits.c", + "crash_line": 170, + "crash_function": "bit_read_B" + }, + "OSV-2022-1252": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/bits.c", + "crash_line": 202, + "crash_function": "bit_read_BB" + }, + "OSV-2023-42": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/bits.c", + "crash_line": 202, + "crash_function": "bit_read_BB" + }, + "OSV-2023-135": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/out_json.c", + "crash_line": 1424, + "crash_function": "json_write_TF" + }, + "OSV-2023-397": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/out_json.c", + "crash_line": 1459, + "crash_function": "json_write_TF" + }, + "OSV-2023-412": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/free.c", + "crash_line": 1715, + "crash_function": "dwg_free" + }, + "OSV-2023-415": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/encode.c", + "crash_line": 3517, + "crash_function": "dwg_encode" + }, + "OSV-2023-452": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/out_json.c", + "crash_line": 1424, + "crash_function": "json_write_TF" + }, + "OSV-2023-634": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/bits.c", + "crash_line": 202, + "crash_function": "bit_read_BB" + }, + "OSV-2023-717": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/bits.c", + "crash_line": 3139, + "crash_function": "bit_TV_to_utf8_codepage" + }, + "OSV-2023-748": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/encode.c", + "crash_line": 3518, + "crash_function": "dwg_encode" + }, + "OSV-2023-777": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/out_dxf.c", + "crash_line": 1188, + "crash_function": "cquote" + }, + "OSV-2023-811": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/bits.c", + "crash_line": 3850, + "crash_function": "bit_chain_alloc_size" + }, + "OSV-2023-855": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/free.c", + "crash_line": 417, + "crash_function": "dwg_free_common_entity_data" + }, + "OSV-2023-874": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/bits.c", + "crash_line": 202, + "crash_function": "bit_read_BB" + }, + "OSV-2023-965": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/bits.c", + "crash_line": 3328, + "crash_function": "bit_TV_to_utf8" + }, + "OSV-2023-997": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/out_dxf.c", + "crash_line": 1188, + "crash_function": "cquote" + }, + "OSV-2023-1048": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/usr/include/x86_64-linux-gnu/bits/string_fortified.h", + "crash_line": 34, + "crash_function": "memcpy" + }, + "OSV-2023-1051": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/./dwg.spec", + "crash_line": 4464, + "crash_function": "dwg_json_VPORT_private" + }, + "OSV-2023-1063": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/free.c", + "crash_line": 1278, + "crash_function": "dwg_free_object" + }, + "OSV-2023-1099": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/out_geojson.c", + "crash_line": 857, + "crash_function": "dwg_geojson_object" + }, + "OSV-2023-1101": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/usr/include/x86_64-linux-gnu/bits/string_fortified.h", + "crash_line": 34, + "crash_function": "memcpy" + }, + "OSV-2023-1104": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/bits.c", + "crash_line": 342, + "crash_function": "bit_read_RC" + }, + "OSV-2023-1110": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/usr/include/x86_64-linux-gnu/bits/string_fortified.h", + "crash_line": 34, + "crash_function": "memcpy" + }, + "OSV-2023-1122": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/in_dxf.c", + "crash_line": 1128, + "crash_function": "dxf_header_read" + }, + "OSV-2023-1149": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/usr/include/x86_64-linux-gnu/bits/string_fortified.h", + "crash_line": 34, + "crash_function": "memcpy" + }, + "OSV-2023-1186": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/in_dxf.c", + "crash_line": 11853, + "crash_function": "dxf_tables_read" + }, + "OSV-2024-38": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/in_json.c", + "crash_line": 1264, + "crash_function": "json_HEADER" + }, + "OSV-2024-42": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/free.c", + "crash_line": 417, + "crash_function": "dwg_free_common_entity_data" + }, + "OSV-2024-123": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/libredwg/src/in_dxf.c", + "crash_line": 11853, + "crash_function": "dxf_tables_read" + }, + "OSV-2024-384": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/usr/include/x86_64-linux-gnu/bits/string_fortified.h", + "crash_line": 34, + "crash_function": "memcpy" + } + }, + "dropped_bugs": { + "OSV-2021-495": { + "previous_entry": { + "dispatch_value": 0, + "triggered": false + }, + "reason": "Migration pipeline misclassified as 'already-triggering at target' (CSV cell 0.5|0). Verified PoC executes cleanly in <50ms on both unpatched a67ea97d and merged binary; bug only triggers at its introduced commit. Phase 1 transplant attempt (2026-05-26) timed out for OSV-2021-495 and hit the ChatGPT account usage limit for OSV-2023-416; dropped rather than retried. original-crashes/.txt retained as historical reference of the bug at its introduced commit." + }, + "OSV-2023-416": { + "previous_entry": { + "dispatch_value": 0, + "triggered": false + }, + "reason": "Migration pipeline misclassified as 'already-triggering at target' (CSV cell 0.5|0). Verified PoC executes cleanly in <50ms on both unpatched a67ea97d and merged binary; bug only triggers at its introduced commit. Phase 1 transplant attempt (2026-05-26) timed out for OSV-2021-495 and hit the ChatGPT account usage limit for OSV-2023-416; dropped rather than retried. original-crashes/.txt retained as historical reference of the bug at its introduced commit." + } + } +} \ No newline at end of file diff --git a/benchmarks/libredwg_transplant_llvmfuzz/build.sh b/benchmarks/libredwg_transplant_llvmfuzz/build.sh new file mode 100755 index 000000000..dd7966e13 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/build.sh @@ -0,0 +1,144 @@ +#!/bin/bash -eu +# Generated by fuzzbench_generate.py for bug transplant evaluation + +cd /src/libredwg + +# Drop stale build artifacts from the merge container so `git checkout` +# is not blocked by untracked files that would be overwritten. +git clean -fdx >/dev/null 2>&1 || true +git reset --hard HEAD >/dev/null 2>&1 || true + +# Checkout target commit +git checkout a67ea97d93998f35d6494c96118c60c5f1aee4e9 + +# Restore harness sources that live outside the project git repository. +if [ -f /src/patches/harness_sources/manifest.json ]; then + python3 - <<'PY' +import json +import shutil +from pathlib import Path + +root = Path("/src/patches/harness_sources") +for entry in json.loads((root / "manifest.json").read_text()): + source = root / entry["snapshot"] + destination = Path(entry["container_path"]) + destination.parent.mkdir(parents=True, exist_ok=True) + shutil.copy2(source, destination) +PY +fi + +# Apply dispatch harness first (modifies build system), then bug patches +if ! git apply --check /src/patches/harness.diff 2>/dev/null; then + echo "Trying git apply --3way for harness.diff..." + git apply --3way /src/patches/harness.diff +else + git apply /src/patches/harness.diff +fi + +if ! git apply --check /src/patches/combined.diff 2>/dev/null; then + echo "Trying git apply --3way for combined.diff..." + git apply --3way /src/patches/combined.diff +else + git apply /src/patches/combined.diff +fi + +# --- Fix library CMakeLists.txt for new source files from combined.diff --- +# combined.diff may create new .c files (e.g., zfp_getcell.c) that need to +# be added to the library's explicit source list. +if [ -d blosc ] && [ -f blosc/CMakeLists.txt ]; then + for newfile in blosc/*.c; do + base=$(basename "$newfile") + if ! grep -q "$base" blosc/CMakeLists.txt 2>/dev/null; then + echo "Adding $base to blosc/CMakeLists.txt" + sed -i "/^set(SOURCES /s/)/ $base)/" blosc/CMakeLists.txt + fi + done +fi + +# --- Original build commands --- +# (already in /src/libredwg; original OSS-Fuzz build.sh's `cd libredwg` is +# redundant here.) +sh ./autogen.sh +# enable-release to skip unstable preR13. bindings are not fuzzed. +./configure --disable-shared --disable-bindings --enable-release + +$CC $CFLAGS -c __bug_dispatch.c -o __bug_dispatch.o + +make -k 2>&1 || true + +$CC $CFLAGS src/.libs/libredwg.a -I. -I./include -I./src -c examples/llvmfuzz.c + +$CXX $CXXFLAGS $LIB_FUZZING_ENGINE llvmfuzz.o __bug_dispatch.o src/.libs/libredwg.a \ + -o $OUT/llvmfuzz + +cp $SRC/llvmfuzz.options $OUT/llvmfuzz.options + + +# --- Seed corpus: expand original seeds and per-bug testcase candidates --- +# FuzzBench uses $OUT/{fuzz_target}_seed_corpus.zip as initial corpus. +# Create one seed variant for the default path plus one for each dispatch bit. +# Per-bug reproducers are used only as source material: exact crashing inputs +# are filtered out before packaging. +seed_zip="$OUT/llvmfuzz_seed_corpus.zip" +seed_target="$OUT/llvmfuzz" +mkdir -p /tmp/seeds_dispatch /tmp/original_seeds /tmp/benchmark_seed_candidates + +if [ -f "$seed_zip" ]; then + unzip -q -o "$seed_zip" -d /tmp/original_seeds 2>/dev/null || true + for f in /tmp/original_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + for dispatch in '\x00\x00\x00\x00' '\x01\x00\x00\x00' '\x02\x00\x00\x00' '\x04\x00\x00\x00' '\x08\x00\x00\x00' '\x10\x00\x00\x00' '\x20\x00\x00\x00' '\x40\x00\x00\x00' '\x80\x00\x00\x00' '\x00\x01\x00\x00' '\x00\x02\x00\x00' '\x00\x04\x00\x00' '\x00\x08\x00\x00' '\x00\x10\x00\x00' '\x00\x20\x00\x00' '\x00\x40\x00\x00' '\x00\x80\x00\x00' '\x00\x00\x01\x00' '\x00\x00\x02\x00' '\x00\x00\x04\x00' '\x00\x00\x08\x00' '\x00\x00\x10\x00' '\x00\x00\x20\x00' '\x00\x00\x40\x00' '\x00\x00\x80\x00' '\x00\x00\x00\x01' '\x00\x00\x00\x02' '\x00\x00\x00\x04' '\x00\x00\x00\x08' '\x00\x00\x00\x10' '\x00\x00\x00\x20' '\x00\x00\x00\x40' '\x00\x00\x00\x80'; do + dispatch_name=$(printf '%s' "$dispatch" | tr -d '\x') + printf '%b' "$dispatch" | cat - "$f" > "/tmp/seeds_dispatch/${base}.dispatch_${dispatch_name}" + done + done +fi + +if [ -d /src/benchmark_seeds ]; then + for f in /src/benchmark_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + size=$(wc -c < "$f") + [ "$size" -gt 0 ] || continue + + cp "$f" "/tmp/benchmark_seed_candidates/${base}.exact" + # Zero the dispatch byte (byte 0): deactivates dispatch-gated patches + # while keeping the full APDU conversation and card driver routing intact. + cp "$f" "/tmp/benchmark_seed_candidates/${base}.dispatch_zero" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.dispatch_zero" bs=1 seek=0 conv=notrunc 2>/dev/null || true + for keep in 1 2 8 16 64 256 1024; do + if [ "$size" -gt "$keep" ]; then + head -c "$keep" "$f" > "/tmp/benchmark_seed_candidates/${base}.head_${keep}" + fi + done + if [ "$size" -gt 1 ]; then + head -c "$((size - 1))" "$f" > "/tmp/benchmark_seed_candidates/${base}.trim_1" + cp "$f" "/tmp/benchmark_seed_candidates/${base}.zero_last" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.zero_last" bs=1 seek="$((size - 1))" conv=notrunc 2>/dev/null || true + cp "$f" "/tmp/benchmark_seed_candidates/${base}.ff_last" + printf '\377' | dd of="/tmp/benchmark_seed_candidates/${base}.ff_last" bs=1 seek="$((size - 1))" conv=notrunc 2>/dev/null || true + fi + if [ "$size" -gt 4 ]; then + mid=$((size / 2)) + cp "$f" "/tmp/benchmark_seed_candidates/${base}.zero_mid" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.zero_mid" bs=1 seek="$mid" conv=notrunc 2>/dev/null || true + cp "$f" "/tmp/benchmark_seed_candidates/${base}.ff_mid" + printf '\377' | dd of="/tmp/benchmark_seed_candidates/${base}.ff_mid" bs=1 seek="$mid" conv=notrunc 2>/dev/null || true + fi + done +fi + +if [ -x "$seed_target" ] && ls /tmp/benchmark_seed_candidates/* 1>/dev/null 2>&1; then + for f in /tmp/benchmark_seed_candidates/*; do + [ -f "$f" ] || continue + if timeout 10s env ASAN_OPTIONS="${ASAN_OPTIONS:-detect_leaks=0:detect_stack_use_after_return=1}" "$seed_target" "$f" >/tmp/seed_replay.log 2>&1; then + cp "$f" "/tmp/seeds_dispatch/poc_$(basename "$f")" + fi + done +fi + +if ls /tmp/seeds_dispatch/* 1>/dev/null 2>&1; then + rm -f "$seed_zip" + zip -j -q "$seed_zip" /tmp/seeds_dispatch/* +fi diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2021-493.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2021-493.txt new file mode 100644 index 000000000..08771c0db --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2021-493.txt @@ -0,0 +1,71 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1282521111 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000414 at pc 0x00000311015c bp 0x7ffd66f28790 sp 0x7ffd66f28788 +READ of size 4 at 0x602000000414 thread T0 + #0 0x311015b in encode_3dsolid /src/libredwg/src/./dwg.spec:2879:31 + #1 0x30fb25a in dwg_encode_REGION_private /src/libredwg/src/./dwg.spec:3086:3 + #2 0x2f15db2 in dwg_encode_REGION /src/libredwg/src/./dwg.spec:3085:1 + #3 0x2eb8e30 in dwg_encode_add_object /src/libredwg/src/encode.c:5133:15 + #4 0x2e119b2 in dwg_encode /src/libredwg/src/encode.c:3298:16 + #5 0x56cfac in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:196:9 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7ff5615f3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x602000000414 is located 0 bytes to the right of 4-byte region [0x602000000410,0x602000000414) +allocated by thread T0 here: + #0 0x52f49c in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x9ab230 in decode_3dsolid /src/libredwg/src/./dwg.spec:2682:17 + #2 0x990d03 in dwg_decode_REGION_private /src/libredwg/src/./dwg.spec:3086:3 + #3 0x770769 in dwg_decode_REGION /src/libredwg/src/./dwg.spec:3085:1 + #4 0x766282 in dwg_decode_add_object /src/libredwg/src/decode.c:5388:15 + #5 0x5a2396 in decode_R13_R2000 /src/libredwg/src/decode.c:858:19 + #6 0x590c38 in dwg_decode /src/libredwg/src/decode.c:230:12 + #7 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7ff5615f3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/./dwg.spec:2879:31 in encode_3dsolid +Shadow bytes around the buggy address: + 0x0c047fff8030: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fd + 0x0c047fff8040: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff8050: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa + 0x0c047fff8060: fa fa fd fa fa fa fd fa fa fa 01 fa fa fa 01 fa + 0x0c047fff8070: fa fa 01 fa fa fa 00 07 fa fa 01 fa fa fa 00 fa +=>0x0c047fff8080: fa fa[04]fa fa fa 01 fa fa fa 00 fa fa fa 01 fa + 0x0c047fff8090: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 01 fa + 0x0c047fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2021-535.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2021-535.txt new file mode 100644 index 000000000..0378da3d6 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2021-535.txt @@ -0,0 +1,71 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1282885698 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000b98 at pc 0x00000310fff8 bp 0x7fffdb085370 sp 0x7fffdb085368 +READ of size 4 at 0x602000000b98 thread T0 + #0 0x310fff7 in encode_3dsolid /src/libredwg/src/./dwg.spec:2853:31 + #1 0x312636a in dwg_encode_BODY_private /src/libredwg/src/./dwg.spec:3098:3 + #2 0x2f16592 in dwg_encode_BODY /src/libredwg/src/./dwg.spec:3097:1 + #3 0x2eb8c62 in dwg_encode_add_object /src/libredwg/src/encode.c:5139:15 + #4 0x2e119b2 in dwg_encode /src/libredwg/src/encode.c:3298:16 + #5 0x56cfac in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:196:9 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f02d8083082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x602000000b98 is located 0 bytes to the right of 8-byte region [0x602000000b90,0x602000000b98) +allocated by thread T0 here: + #0 0x52f49c in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x9ab230 in decode_3dsolid /src/libredwg/src/./dwg.spec:2682:17 + #2 0x9c7a03 in dwg_decode_BODY_private /src/libredwg/src/./dwg.spec:3098:3 + #3 0x770ce9 in dwg_decode_BODY /src/libredwg/src/./dwg.spec:3097:1 + #4 0x765fa6 in dwg_decode_add_object /src/libredwg/src/decode.c:5394:15 + #5 0x5a2396 in decode_R13_R2000 /src/libredwg/src/decode.c:858:19 + #6 0x590c38 in dwg_decode /src/libredwg/src/decode.c:230:12 + #7 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f02d8083082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/./dwg.spec:2853:31 in encode_3dsolid +Shadow bytes around the buggy address: + 0x0c047fff8120: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa + 0x0c047fff8130: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fd + 0x0c047fff8140: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff8150: fa fa fd fd fa fa fd fa fa fa 01 fa fa fa 00 07 + 0x0c047fff8160: fa fa fd fa fa fa fd fa fa fa 02 fa fa fa 00 00 +=>0x0c047fff8170: fa fa 00[fa]fa fa fd fa fa fa fd fa fa fa 02 fa + 0x0c047fff8180: fa fa 00 00 fa fa 00 fa fa fa fd fa fa fa fd fa + 0x0c047fff8190: fa fa 02 fa fa fa 00 00 fa fa 00 fa fa fa fd fa + 0x0c047fff81a0: fa fa fd fa fa fa 02 fa fa fa 00 00 fa fa 00 fa + 0x0c047fff81b0: fa fa fd fa fa fa fd fa fa fa 02 fa fa fa 00 00 + 0x0c047fff81c0: fa fa 00 fa fa fa 01 fa fa fa 00 fa fa fa 01 fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2021-543.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2021-543.txt new file mode 100644 index 000000000..9bff49473 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2021-543.txt @@ -0,0 +1,78 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1283217562 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000000190 at pc 0x000003f48998 bp 0x7ffd8ac9a210 sp 0x7ffd8ac9a208 +READ of size 2 at 0x602000000190 thread T0 + #0 0x3f48997 in dxf_objects_read /src/libredwg/src/in_dxf.c:12398:15 + #1 0x3f2e88c in dwg_read_dxf /src/libredwg/src/in_dxf.c:12933:23 + #2 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #3 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #4 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #5 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #6 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #7 0x7fc7c3448082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #8 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x602000000190 is located 0 bytes inside of 16-byte region [0x602000000190,0x6020000001a0) +freed by thread T0 here: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x3f48225 in dxf_free_pair /src/libredwg/src/in_dxf.c:571:3 + #2 0x3f48225 in dxf_objects_read /src/libredwg/src/in_dxf.c:12393:15 + #3 0x3f2e88c in dwg_read_dxf /src/libredwg/src/in_dxf.c:12933:23 + #4 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fc7c3448082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +previously allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x3f2fd79 in xcalloc /src/libredwg/src/in_dxf.c:236:7 + #2 0x3f2fd79 in dxf_read_pair /src/libredwg/src/in_dxf.c:578:32 + #3 0x3f48047 in dxf_objects_read /src/libredwg/src/in_dxf.c:12402:14 + #4 0x3f2e88c in dwg_read_dxf /src/libredwg/src/in_dxf.c:12933:23 + #5 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fc7c3448082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/libredwg/src/in_dxf.c:12398:15 in dxf_objects_read +Shadow bytes around the buggy address: + 0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c047fff8000: fa fa 00 00 fa fa 00 fa fa fa 00 fa fa fa 00 fa + 0x0c047fff8010: fa fa 00 05 fa fa fd fd fa fa fd fd fa fa fd fa + 0x0c047fff8020: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fd +=>0x0c047fff8030: fa fa[fd]fd fa fa fd fa fa fa fa fa fa fa fa fa + 0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2021-577.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2021-577.txt new file mode 100644 index 000000000..9e9d5c9f2 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2021-577.txt @@ -0,0 +1,28 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1283487026 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x000001273de5 bp 0x7ffea2fff4d0 sp 0x7ffea2fff490 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x1273de5 in dwg_free_MTEXTATTRIBUTEOBJECTCONTEXTDATA_private /src/libredwg/src/./dwg.spec:10676:3 + #1 0x1273de5 in dwg_free_MTEXTATTRIBUTEOBJECTCONTEXTDATA /src/libredwg/src/./dwg.spec:10674:1 + #2 0x124d499 in dwg_free_variable_no_class /src/libredwg/src/./objects.inc:276:1 + #3 0x127d56b in dwg_free_variable_type /src/libredwg/src/free.c + #4 0x135349a in dwg_free_object /src/libredwg/src/free.c:1267:25 + #5 0x13556a3 in dwg_free /src/libredwg/src/free.c:1689:13 + #6 0x56cab3 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:136:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f9f49a51082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #12 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/libredwg/src/./dwg.spec:10676:3 in dwg_free_MTEXTATTRIBUTEOBJECTCONTEXTDATA_private +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2021-620.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2021-620.txt new file mode 100644 index 000000000..f67234713 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2021-620.txt @@ -0,0 +1,28 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1283761219 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x0000004aff54 bp 0x000000000000 sp 0x7ffd8b1c7220 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x4aff54 in atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t> /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81:10 + #1 0x4aff54 in AtomicallySetQuarantineFlagIfAllocated /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:610:10 + #2 0x4aff54 in __asan::Allocator::Deallocate(void*, unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType) /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:685:10 + #3 0x52ee55 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:53:3 + #4 0x1358ebb in dwg_free_summaryinfo /src/libredwg/src/./summaryinfo.spec:54:5 + #5 0x1358ebb in dwg_free /src/libredwg/src/free.c:1695:7 + #6 0x56cab3 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:136:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fa28e2d2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #12 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81:10 in atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t> +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2021-771.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2021-771.txt new file mode 100644 index 000000000..6f65e32ad --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2021-771.txt @@ -0,0 +1,86 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1284020142 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x6020000013f0 at pc 0x000001345f55 bp 0x7ffda55cd370 sp 0x7ffda55cd368 +READ of size 8 at 0x6020000013f0 thread T0 + #0 0x1345f54 in dwg_free_TABLEGEOMETRY_private /src/libredwg/src/./dwg.spec:7305:7 + #1 0x1279ccc in dwg_free_TABLEGEOMETRY /src/libredwg/src/./dwg.spec:7290:1 + #2 0x124dc53 in dwg_free_variable_no_class /src/libredwg/src/./objects.inc:314:1 + #3 0x127d56b in dwg_free_variable_type /src/libredwg/src/free.c + #4 0x135349a in dwg_free_object /src/libredwg/src/free.c:1267:25 + #5 0x13556a3 in dwg_free /src/libredwg/src/free.c:1689:13 + #6 0x56cab3 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:136:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f355e25d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #12 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x6020000013f0 is located 0 bytes inside of 16-byte region [0x6020000013f0,0x602000001400) +freed by thread T0 here: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x3f71681 in dxf_free_pair /src/libredwg/src/in_dxf.c:571:3 + #2 0x3f71681 in add_TABLEGEOMETRY_Cell /src/libredwg/src/in_dxf.c:5252:7 + #3 0x3f71681 in new_object /src/libredwg/src/in_dxf.c:11568:26 + #4 0x3f42ac1 in dxf_blocks_read /src/libredwg/src/in_dxf.c:12073:22 + #5 0x3f2e8e5 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12904:23 + #6 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f355e25d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +previously allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x3f2fd79 in xcalloc /src/libredwg/src/in_dxf.c:236:7 + #2 0x3f2fd79 in dxf_read_pair /src/libredwg/src/in_dxf.c:578:32 + #3 0x3f6fd62 in add_TABLEGEOMETRY_Cell /src/libredwg/src/in_dxf.c:5253:14 + #4 0x3f6fd62 in new_object /src/libredwg/src/in_dxf.c:11568:26 + #5 0x3f42ac1 in dxf_blocks_read /src/libredwg/src/in_dxf.c:12073:22 + #6 0x3f2e8e5 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12904:23 + #7 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f355e25d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/libredwg/src/./dwg.spec:7305:7 in dwg_free_TABLEGEOMETRY_private +Shadow bytes around the buggy address: + 0x0c047fff8220: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fa + 0x0c047fff8230: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fd + 0x0c047fff8240: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd + 0x0c047fff8250: fa fa fd fd fa fa fd fa fa fa 01 fa fa fa fd fd + 0x0c047fff8260: fa fa fd fa fa fa fd fd fa fa fd fa fa fa 00 00 +=>0x0c047fff8270: fa fa fd fd fa fa fd fa fa fa 01 fa fa fa[fd]fd + 0x0c047fff8280: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fd + 0x0c047fff8290: fa fa fd fd fa fa 00 00 fa fa fd fd fa fa fd fd + 0x0c047fff82a0: fa fa fd fd fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff82b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff82c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2021-814.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2021-814.txt new file mode 100644 index 000000000..d874646d6 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2021-814.txt @@ -0,0 +1,30 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1284294106 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x601ffffffff0 (pc 0x0000004aff54 bp 0x000000000000 sp 0x7ffd253a7890 T0) +==1==The signal is caused by a WRITE memory access. + #0 0x4aff54 in atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t> /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81:10 + #1 0x4aff54 in AtomicallySetQuarantineFlagIfAllocated /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:610:10 + #2 0x4aff54 in __asan::Allocator::Deallocate(void*, unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType) /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:685:10 + #3 0x52ee55 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:53:3 + #4 0x1296ade in dwg_free_BLOCK_private /src/libredwg/src/./dwg.spec:639:7 + #5 0x125021b in dwg_free_BLOCK /src/libredwg/src/./dwg.spec:623:1 + #6 0x13541f3 in free_preR13_object /src/libredwg/src/free.c:768:7 + #7 0x1352616 in dwg_free_object /src/libredwg/src/free.c + #8 0x13556a3 in dwg_free /src/libredwg/src/free.c:1689:13 + #9 0x56cab3 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:136:11 + #10 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #11 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #12 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #13 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f52d1469082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #15 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81:10 in atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t> +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-1180.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-1180.txt new file mode 100644 index 000000000..bae458972 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-1180.txt @@ -0,0 +1,29 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1287517660 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +ERROR: Out of memory +ERROR: Out of memory +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x0000024f4d7a bp 0x7fff6ec4b9f0 sp 0x7fff6ec4b900 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x24f4d7a in json_common_entity_data /src/libredwg/src/./common_entity_handle_data.spec:27:7 + #1 0x23a0460 in dwg_json_LOAD /src/libredwg/src/./dwg.spec:11619:1 + #2 0x23a0460 in dwg_json_object /src/libredwg/src/out_json.c:1858:14 + #3 0x23a0460 in json_objects_write /src/libredwg/src/out_json.c:2275:15 + #4 0x2340b49 in dwg_write_json /src/libredwg/src/out_json.c:2668:7 + #5 0x56cdeb in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:211:7 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f571fbb4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/libredwg/src/./common_entity_handle_data.spec:27:7 in json_common_entity_data +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-1211.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-1211.txt new file mode 100644 index 000000000..13aaeb7fe --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-1211.txt @@ -0,0 +1,63 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1287861813 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000000e81 at pc 0x00000057c1d1 bp 0x7ffdba0fb940 sp 0x7ffdba0fb938 +READ of size 1 at 0x619000000e81 thread T0 + #0 0x57c1d0 in bit_calc_CRC /src/libredwg/src/bits.c:4065:29 + #1 0x11a5c3e in decode_preR13 /src/libredwg/src/decode_r11.c:724:12 + #2 0x590b83 in dwg_decode /src/libredwg/src/decode.c:220:17 + #3 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f0490a1a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #9 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x619000000e81 is located 0 bytes to the right of 1025-byte region [0x619000000a80,0x619000000e81) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c692 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:74:37 + #2 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f0490a1a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:4065:29 in bit_calc_CRC +Shadow bytes around the buggy address: + 0x0c327fff8180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff8190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff81a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff81b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff81c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c327fff81d0:[01]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff8210: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff8220: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-1251.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-1251.txt new file mode 100644 index 000000000..7a9a5eb61 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-1251.txt @@ -0,0 +1,64 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1227829937 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000000e76 at pc 0x00000056e059 bp 0x7ffc879a97b0 sp 0x7ffc879a97a8 +READ of size 1 at 0x619000000e76 thread T0 + #0 0x56e058 in bit_read_B /src/libredwg/src/bits.c:170:10 + #1 0x615a2d in dwg_decode_header_variables /src/libredwg/src/./header_variables.spec:436:7 + #2 0x59fb52 in decode_R13_R2000 /src/libredwg/src/decode.c:510:12 + #3 0x590c38 in dwg_decode /src/libredwg/src/decode.c:230:12 + #4 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fa38ab7e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #10 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x619000000e76 is located 0 bytes to the right of 1014-byte region [0x619000000a80,0x619000000e76) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c692 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:74:37 + #2 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7fa38ab7e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:170:10 in bit_read_B +Shadow bytes around the buggy address: + 0x0c327fff8170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff8180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff8190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff81a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff81b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c327fff81c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[06]fa + 0x0c327fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff8210: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-1252.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-1252.txt new file mode 100644 index 000000000..c7fe6b312 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-1252.txt @@ -0,0 +1,65 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1228145737 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61100000038d at pc 0x00000056e80a bp 0x7ffd7e6a4fb0 sp 0x7ffd7e6a4fa8 +READ of size 1 at 0x61100000038d thread T0 + #0 0x56e809 in bit_read_BB /src/libredwg/src/bits.c:202:10 + #1 0x575a1b in bit_read_BD /src/libredwg/src/bits.c:865:18 + #2 0x5f9058 in dwg_decode_header_variables /src/libredwg/src/./header_variables.spec:289:7 + #3 0x59fb52 in decode_R13_R2000 /src/libredwg/src/decode.c:510:12 + #4 0x590c38 in dwg_decode /src/libredwg/src/decode.c:230:12 + #5 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f5ff83df082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x61100000038d is located 0 bytes to the right of 205-byte region [0x6110000002c0,0x61100000038d) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c692 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:74:37 + #2 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f5ff83df082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:202:10 in bit_read_BB +Shadow bytes around the buggy address: + 0x0c227fff8020: 00 00 01 fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8040: 00 00 00 00 00 00 00 00 00 00 01 fa fa fa fa fa + 0x0c227fff8050: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fff8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c227fff8070: 00[05]fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-128.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-128.txt new file mode 100644 index 000000000..8792df838 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-128.txt @@ -0,0 +1,101 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1284564555 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fe68a053370 at pc 0x000001228d85 bp 0x7ffcf7896e90 sp 0x7ffcf7896e88 +WRITE of size 1 at 0x7fe68a053370 thread T0 + #0 0x1228d84 in copy_bytes /src/libredwg/src/decode_r2007.c:191:12 + #1 0x1228d84 in decompress_r2007 /src/libredwg/src/decode_r2007.c:534:11 + #2 0x120e3f1 in read_file_header /src/libredwg/src/decode_r2007.c + #3 0x11f2ff2 in read_r2007_meta_data /src/libredwg/src/decode_r2007.c + #4 0x5cf71f in decode_R2007 /src/libredwg/src/decode.c:3518:11 + #5 0x590d9a in dwg_decode /src/libredwg/src/decode.c:238:12 + #6 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fe68a579082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #12 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +Address 0x7fe68a053370 is located in stack of thread T0 at offset 2928 in frame + #0 0x11f2cdf in read_r2007_meta_data /src/libredwg/src/decode_r2007.c:2347 + + This frame has 39 object(s): + [32, 57) 'old_dat.sroa.0.i1639' (line 2244) + [96, 102) 'old_dat.sroa.9.i1640' (line 2244) + [128, 184) 'sec_dat.i1641' (line 2244) + [224, 249) 'old_dat.sroa.0.i1354' (line 1758) + [288, 294) 'old_dat.sroa.9.i1355' (line 1758) + [320, 376) 'sec_dat.i1356' (line 1758) + [416, 472) 'here.i1357' (line 1782) + [512, 536) 'hdl.i1358' (line 1782) + [576, 601) 'old_dat.sroa.0.i1240' (line 2055) + [640, 646) 'old_dat.sroa.9.i1241' (line 2055) + [672, 728) 'sec_dat.i1242' (line 2055) + [768, 793) 'old_dat.sroa.0.i1074' (line 1969) + [832, 838) 'old_dat.sroa.9.i1075' (line 1969) + [864, 920) 'sec_dat.i1076' (line 1969) + [960, 985) 'old_dat.sroa.0.i894' (line 2143) + [1024, 1030) 'old_dat.sroa.9.i895' (line 2143) + [1056, 1112) 'sec_dat.i896' (line 2143) + [1152, 1177) 'old_dat.sroa.0.i737' (line 2100) + [1216, 1222) 'old_dat.sroa.9.i738' (line 2100) + [1248, 1304) 'sec_dat.i739' (line 2100) + [1344, 1369) 'old_dat.sroa.0.i625' (line 1926) + [1408, 1414) 'old_dat.sroa.9.i626' (line 1926) + [1440, 1496) 'sec_dat.i627' (line 1926) + [1536, 1592) 'here.i628' (line 1950) + [1632, 1656) 'hdl.i629' (line 1950) + [1696, 1721) 'old_dat.sroa.0.i' (line 1842) + [1760, 1766) 'old_dat.sroa.9.i' (line 1842) + [1792, 1848) 'sec_dat.i516' (line 1842) + [1888, 1892) 'size.i461' (line 2286) + [1904, 1905) 'type.i462' (line 2287) + [1920, 1976) 'sec_dat.i340' (line 1457) + [2016, 2072) 'str.i' (line 1457) + [2112, 2168) 'sec_dat.i' (line 1585) + [2208, 2264) 'str_dat.i' (line 1585) + [2304, 2360) 'here.i' (line 1628) + [2400, 2424) 'hdl.i' (line 1628) + [2464, 2520) 'page.i' (line 875) + [2560, 2616) 'sdat.i' (line 1054) + [2656, 2928) 'file_header_store' (line 2348) <== Memory access at offset 2928 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/libredwg/src/decode_r2007.c:191:12 in copy_bytes +Shadow bytes around the buggy address: + 0x0ffd51402610: f2 f2 f2 f2 f8 f8 f8 f8 f8 f8 f8 f2 f2 f2 f2 f2 + 0x0ffd51402620: f8 f8 f8 f8 f8 f8 f8 f2 f2 f2 f2 f2 f8 f8 f8 f2 + 0x0ffd51402630: f2 f2 f2 f2 f8 f8 f8 f8 f8 f8 f8 f2 f2 f2 f2 f2 + 0x0ffd51402640: f8 f8 f8 f8 f8 f8 f8 f2 f2 f2 f2 f2 00 00 00 00 + 0x0ffd51402650: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0ffd51402660: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[f3]f3 + 0x0ffd51402670: f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 + 0x0ffd51402680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffd51402690: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffd514026a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffd514026b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-129.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-129.txt new file mode 100644 index 000000000..8b0c94a21 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-129.txt @@ -0,0 +1,69 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1284856625 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000218 at pc 0x00000129e71a bp 0x7fffa0b21e00 sp 0x7fffa0b21df8 +READ of size 8 at 0x602000000218 thread T0 + #0 0x129e719 in dwg_free_HATCH_private /src/libredwg/src/./dwg.spec:5130:7 + #1 0x12539b1 in dwg_free_HATCH /src/libredwg/src/./dwg.spec:4970:1 + #2 0x1352e6b in dwg_free_object /src/libredwg/src/free.c:1233:7 + #3 0x13556a3 in dwg_free /src/libredwg/src/free.c:1689:13 + #4 0x56cab3 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:136:11 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f84bf024082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #10 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x602000000218 is located 0 bytes to the right of 8-byte region [0x602000000210,0x602000000218) +allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x3f2c006 in xcalloc /src/libredwg/src/in_dxf.c:236:7 + #2 0x3fbd8bb in add_HATCH /src/libredwg/src/in_dxf.c:3364:57 + #3 0x3f5f4bc in new_object /src/libredwg/src/in_dxf.c:10156:26 + #4 0x3f468be in dxf_entities_read /src/libredwg/src/in_dxf.c:12308:18 + #5 0x3f2e84e in dwg_read_dxf /src/libredwg/src/in_dxf.c:12925:23 + #6 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f84bf024082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/./dwg.spec:5130:7 in dwg_free_HATCH_private +Shadow bytes around the buggy address: + 0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c047fff8000: fa fa 00 00 fa fa 00 fa fa fa 00 fa fa fa 00 fa + 0x0c047fff8010: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fd + 0x0c047fff8020: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fa + 0x0c047fff8030: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd +=>0x0c047fff8040: fa fa 00[fa]fa fa fd fd fa fa fd fa fa fa fd fd + 0x0c047fff8050: fa fa fd fd fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-363.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-363.txt new file mode 100644 index 000000000..0ac59fa40 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-363.txt @@ -0,0 +1,84 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1285141451 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000000430 at pc 0x000001345f55 bp 0x7fff63cd7d90 sp 0x7fff63cd7d88 +READ of size 8 at 0x602000000430 thread T0 + #0 0x1345f54 in dwg_free_TABLEGEOMETRY_private /src/libredwg/src/./dwg.spec:7305:7 + #1 0x1279ccc in dwg_free_TABLEGEOMETRY /src/libredwg/src/./dwg.spec:7290:1 + #2 0x124dc53 in dwg_free_variable_no_class /src/libredwg/src/./objects.inc:314:1 + #3 0x127d56b in dwg_free_variable_type /src/libredwg/src/free.c + #4 0x135349a in dwg_free_object /src/libredwg/src/free.c:1267:25 + #5 0x13556a3 in dwg_free /src/libredwg/src/free.c:1689:13 + #6 0x56cab3 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:136:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f09aa3e6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #12 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x602000000430 is located 0 bytes inside of 16-byte region [0x602000000430,0x602000000440) +freed by thread T0 here: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x3f7555f in dxf_free_pair /src/libredwg/src/in_dxf.c:571:3 + #2 0x3f7555f in new_object /src/libredwg/src/in_dxf.c:11749:7 + #3 0x3f42ac1 in dxf_blocks_read /src/libredwg/src/in_dxf.c:12073:22 + #4 0x3f2e8e5 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12904:23 + #5 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f09aa3e6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +previously allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x3f2fd79 in xcalloc /src/libredwg/src/in_dxf.c:236:7 + #2 0x3f2fd79 in dxf_read_pair /src/libredwg/src/in_dxf.c:578:32 + #3 0x3f7556b in new_object /src/libredwg/src/in_dxf.c:11750:14 + #4 0x3f42ac1 in dxf_blocks_read /src/libredwg/src/in_dxf.c:12073:22 + #5 0x3f2e8e5 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12904:23 + #6 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f09aa3e6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/libredwg/src/./dwg.spec:7305:7 in dwg_free_TABLEGEOMETRY_private +Shadow bytes around the buggy address: + 0x0c047fff8030: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fd + 0x0c047fff8040: fa fa fd fa fa fa 00 02 fa fa fd fd fa fa fd fa + 0x0c047fff8050: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fa + 0x0c047fff8060: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fa + 0x0c047fff8070: fa fa fd fd fa fa fd fd fa fa fd fd fa fa 00 00 +=>0x0c047fff8080: fa fa 01 fa fa fa[fd]fd fa fa fd fd fa fa fd fd + 0x0c047fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-377.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-377.txt new file mode 100644 index 000000000..0ebc0674d --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-377.txt @@ -0,0 +1,68 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1285390589 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6190000004a4 at pc 0x0000011a9471 bp 0x7fff875a9010 sp 0x7fff875a9008 +WRITE of size 4 at 0x6190000004a4 thread T0 + #0 0x11a9470 in decode_preR13_section_hdr /src/libredwg/src/decode_r11.c:139:13 + #1 0x11d7f2f in decode_preR13_header_variables /src/libredwg/src/./header_variables_r11.spec:339:3 + #2 0x11a439e in decode_preR13 /src/libredwg/src/decode_r11.c:707:12 + #3 0x590b83 in dwg_decode /src/libredwg/src/decode.c:220:17 + #4 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7ff0bf1bb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #10 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x6190000004a4 is located 36 bytes to the right of 1024-byte region [0x619000000080,0x619000000480) +allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x406ca71 in dwg_sections_init /src/libredwg/src/dwg.c:3395:42 + #2 0x13f2aac in dwg_add_Document /src/libredwg/src/dwg_api.c:22392:11 + #3 0x11a3f7f in decode_preR13 /src/libredwg/src/decode_r11.c:670:12 + #4 0x590b83 in dwg_decode /src/libredwg/src/decode.c:220:17 + #5 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7ff0bf1bb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/decode_r11.c:139:13 in decode_preR13_section_hdr +Shadow bytes around the buggy address: + 0x0c327fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff8050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff8070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff8080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c327fff8090: fa fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-387.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-387.txt new file mode 100644 index 000000000..9a09857b1 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-387.txt @@ -0,0 +1,28 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1285678138 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x00000057f307 bp 0x7ffc080b1e50 sp 0x7ffc080b1e20 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x57f307 in bit_write_TV /src/libredwg/src/bits.c:2040:29 + #1 0x57ff91 in bit_write_T /src/libredwg/src/bits.c:2162:9 + #2 0x2ec3906 in dwg_encode_BLOCK_private /src/libredwg/src/./dwg.spec:644:5 + #3 0x2ec3906 in dwg_encode_BLOCK /src/libredwg/src/./dwg.spec:623:1 + #4 0x2eb8cba in dwg_encode_add_object /src/libredwg/src/encode.c:5037:15 + #5 0x2e119b2 in dwg_encode /src/libredwg/src/encode.c:3298:16 + #6 0x56cfac in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:196:9 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f701f257082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #12 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/libredwg/src/bits.c:2040:29 in bit_write_TV +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-398.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-398.txt new file mode 100644 index 000000000..ecd09b620 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-398.txt @@ -0,0 +1,74 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1285996870 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +ERROR: Out of memory +ERROR: Out of memory +ERROR: Out of memory +ERROR: Out of memory +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x608000000bf8 at pc 0x000002502e35 bp 0x7ffca4f56370 sp 0x7ffca4f56368 +READ of size 8 at 0x608000000bf8 thread T0 + #0 0x2502e34 in json_common_entity_data /src/libredwg/src/./common_entity_handle_data.spec:87:11 + #1 0x24d840d in dwg_json_REPEAT /src/libredwg/src/./dwg.spec:11605:1 + #2 0x236b37c in dwg_json_object /src/libredwg/src/out_json.c:1852:14 + #3 0x236b37c in json_objects_write /src/libredwg/src/out_json.c:2275:15 + #4 0x2340b49 in dwg_write_json /src/libredwg/src/out_json.c:2668:7 + #5 0x56cdeb in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:211:7 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f505b505082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x608000000bf8 is located 0 bytes to the right of 88-byte region [0x608000000ba0,0x608000000bf8) +allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x71e128 in dwg_setup_LAYOUT /src/libredwg/src/./dwg.spec:5590:1 + #2 0x775b69 in dwg_decode_LAYOUT /src/libredwg/src/./dwg.spec:5590:1 + #3 0x7663b0 in dwg_decode_add_object /src/libredwg/src/decode.c + #4 0x5a2396 in decode_R13_R2000 /src/libredwg/src/decode.c:858:19 + #5 0x590c38 in dwg_decode /src/libredwg/src/decode.c:230:12 + #6 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f505b505082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/./common_entity_handle_data.spec:87:11 in json_common_entity_data +Shadow bytes around the buggy address: + 0x0c107fff8120: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8130: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8140: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8150: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8160: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa +=>0x0c107fff8170: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00[fa] + 0x0c107fff8180: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8190: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff81a0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff81b0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff81c0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-403.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-403.txt new file mode 100644 index 000000000..4f6eaf284 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-403.txt @@ -0,0 +1,80 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1286366463 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x6040000005e8 at pc 0x0000013548fe bp 0x7ffc9c436250 sp 0x7ffc9c436248 +READ of size 1 at 0x6040000005e8 thread T0 + #0 0x13548fd in free_preR13_object /src/libredwg/src/free.c:688:7 + #1 0x1352616 in dwg_free_object /src/libredwg/src/free.c + #2 0x13556a3 in dwg_free /src/libredwg/src/free.c:1689:13 + #3 0x56c852 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:107:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f5ed3176082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #9 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x6040000005e8 is located 24 bytes inside of 48-byte region [0x6040000005d0,0x604000000600) +freed by thread T0 here: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x11b0f3d in decode_preR13_header_variables /src/libredwg/src/./header_variables_r11.spec:73:3 + #2 0x11a439e in decode_preR13 /src/libredwg/src/decode_r11.c:707:12 + #3 0x590b83 in dwg_decode /src/libredwg/src/decode.c:220:17 + #4 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f5ed3176082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +previously allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x5d927f in dwg_new_ref /src/libredwg/src/decode.c:4408:43 + #2 0x40645aa in dwg_add_handleref /src/libredwg/src/dwg.c:2168:9 + #3 0x13f4619 in dwg_add_Document /src/libredwg/src/dwg_api.c:22637:17 + #4 0x11a3f7f in decode_preR13 /src/libredwg/src/decode_r11.c:670:12 + #5 0x590b83 in dwg_decode /src/libredwg/src/decode.c:220:17 + #6 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f5ed3176082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/libredwg/src/free.c:688:7 in free_preR13_object +Shadow bytes around the buggy address: + 0x0c087fff8060: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 + 0x0c087fff8070: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 fa + 0x0c087fff8080: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 + 0x0c087fff8090: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 00 + 0x0c087fff80a0: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 +=>0x0c087fff80b0: fa fa 00 00 00 00 00 00 fa fa fd fd fd[fd]fd fd + 0x0c087fff80c0: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 00 + 0x0c087fff80d0: fa fa 00 00 00 00 00 00 fa fa fd fd fd fd fd fa + 0x0c087fff80e0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd + 0x0c087fff80f0: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 00 + 0x0c087fff8100: fa fa 00 00 00 00 00 00 fa fa fd fd fd fd fd fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-654.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-654.txt new file mode 100644 index 000000000..ca215137b --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-654.txt @@ -0,0 +1,69 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2265160926 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000e78 at pc 0x000002e02494 bp 0x7ffcf5f24b50 sp 0x7ffcf5f24b48 +READ of size 8 at 0x60b000000e78 thread T0 + #0 0x2e02493 in dwg_geojson_feature /src/libredwg/src/out_geojson.c:527:11 + #1 0x2df3dfd in dwg_geojson_object /src/libredwg/src/out_geojson.c:901:9 + #2 0x2df144f in geojson_entities_write /src/libredwg/src/out_geojson.c:1027:17 + #3 0x2df144f in dwg_write_geojson /src/libredwg/src/out_geojson.c:1055:7 + #4 0x56cd8b in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:215:7 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fbca0be4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #10 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x60b000000e78 is located 8 bytes to the right of 112-byte region [0x60b000000e00,0x60b000000e70) +allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x6464d3 in dwg_setup_LINE /src/libredwg/src/./dwg.spec:1476:1 + #2 0x7ccfcf in dwg_decode_LINE /src/libredwg/src/./dwg.spec:1476:1 + #3 0x7ccfcf in decode_preR13_entities /src/libredwg/src/decode.c:6654:24 + #4 0x11a6194 in decode_preR13 /src/libredwg/src/decode_r11.c:755:12 + #5 0x590b83 in dwg_decode /src/libredwg/src/decode.c:220:17 + #6 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fbca0be4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/out_geojson.c:527:11 in dwg_geojson_feature +Shadow bytes around the buggy address: + 0x0c167fff8170: fd fd fd fd fd fd fa fa fa fa fa fa fa fa fd fd + 0x0c167fff8180: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c167fff8190: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c167fff81a0: fd fd fa fa fa fa fa fa fa fa fd fd fd fd fd fd + 0x0c167fff81b0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa +=>0x0c167fff81c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa[fa] + 0x0c167fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8210: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-656.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-656.txt new file mode 100644 index 000000000..46a3214b6 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-656.txt @@ -0,0 +1,65 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1227546343 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x616000000bb4 at pc 0x00000056e80a bp 0x7ffe1f493950 sp 0x7ffe1f493948 +READ of size 1 at 0x616000000bb4 thread T0 + #0 0x56e809 in bit_read_BB /src/libredwg/src/bits.c:202:10 + #1 0x575a1b in bit_read_BD /src/libredwg/src/bits.c:865:18 + #2 0x5fb5de in dwg_decode_header_variables /src/libredwg/src/./header_variables.spec:308:7 + #3 0x59fb52 in decode_R13_R2000 /src/libredwg/src/decode.c:510:12 + #4 0x590c38 in dwg_decode /src/libredwg/src/decode.c:230:12 + #5 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fa02c6b6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x616000000bb4 is located 0 bytes to the right of 564-byte region [0x616000000980,0x616000000bb4) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c692 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:74:37 + #2 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7fa02c6b6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:202:10 in bit_read_BB +Shadow bytes around the buggy address: + 0x0c2c7fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff8140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff8150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff8160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c2c7fff8170: 00 00 00 00 00 00[04]fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8190: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff81a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff81b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-657.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-657.txt new file mode 100644 index 000000000..d7e6c7397 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-657.txt @@ -0,0 +1,72 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1286903827 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000200 at pc 0x000000519aa5 bp 0x7ffeac14f630 sp 0x7ffeac14edf8 +WRITE of size 49 at 0x604000000200 thread T0 + #0 0x519aa4 in strcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:426:5 + #1 0x1367974 in strcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:90:10 + #2 0x1367974 in dynapi_set_helper /src/libredwg/src/gen-dynapi.pl:3121:15 + #3 0x1367308 in dwg_dynapi_entity_set_value /src/libredwg/src/gen-dynapi.pl:3234:7 + #4 0x3f6e91f in new_object /src/libredwg/src/in_dxf.c:11105:25 + #5 0x3f42ac1 in dxf_blocks_read /src/libredwg/src/in_dxf.c:12073:22 + #6 0x3f2e8e5 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12904:23 + #7 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7faf31723082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #13 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x604000000200 is located 0 bytes to the right of 48-byte region [0x6040000001d0,0x604000000200) +allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x1367746 in dynapi_set_helper /src/libredwg/src/gen-dynapi.pl:3118:31 + #2 0x1367308 in dwg_dynapi_entity_set_value /src/libredwg/src/gen-dynapi.pl:3234:7 + #3 0x3f6e91f in new_object /src/libredwg/src/in_dxf.c:11105:25 + #4 0x3f42ac1 in dxf_blocks_read /src/libredwg/src/in_dxf.c:12073:22 + #5 0x3f2e8e5 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12904:23 + #6 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7faf31723082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:426:5 in strcpy +Shadow bytes around the buggy address: + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 00 + 0x0c087fff8010: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 01 fa + 0x0c087fff8020: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 07 fa + 0x0c087fff8030: fa fa 00 00 00 00 07 fa fa fa 00 00 00 00 00 00 +=>0x0c087fff8040:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-664.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-664.txt new file mode 100644 index 000000000..e80cece2d --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2022-664.txt @@ -0,0 +1,67 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1287206576 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6190000004a4 at pc 0x0000011a9471 bp 0x7ffcdd61d510 sp 0x7ffcdd61d508 +WRITE of size 4 at 0x6190000004a4 thread T0 + #0 0x11a9470 in decode_preR13_section_hdr /src/libredwg/src/decode_r11.c:139:13 + #1 0x11a6134 in decode_preR13 /src/libredwg/src/decode_r11.c:751:18 + #2 0x590b83 in dwg_decode /src/libredwg/src/decode.c:220:17 + #3 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fbc403a1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #9 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x6190000004a4 is located 36 bytes to the right of 1024-byte region [0x619000000080,0x619000000480) +allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x406ca71 in dwg_sections_init /src/libredwg/src/dwg.c:3395:42 + #2 0x13f2aac in dwg_add_Document /src/libredwg/src/dwg_api.c:22392:11 + #3 0x11a3f7f in decode_preR13 /src/libredwg/src/decode_r11.c:670:12 + #4 0x590b83 in dwg_decode /src/libredwg/src/decode.c:220:17 + #5 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fbc403a1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/decode_r11.c:139:13 in decode_preR13_section_hdr +Shadow bytes around the buggy address: + 0x0c327fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff8050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff8070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff8080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c327fff8090: fa fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1048.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1048.txt new file mode 100644 index 000000000..5d978e67c --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1048.txt @@ -0,0 +1,65 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1278389934 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6150000009f0 at pc 0x00000052e421 bp 0x7fff96c2f9d0 sp 0x7fff96c2f1a0 +READ of size 8406 at 0x6150000009f0 thread T0 + #0 0x52e420 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x7d26aa in memcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34:10 + #2 0x7d26aa in decode_preR13_entities /src/libredwg/src/decode.c:7007:35 + #3 0x11a6194 in decode_preR13 /src/libredwg/src/decode_r11.c:755:12 + #4 0x590b83 in dwg_decode /src/libredwg/src/decode.c:220:17 + #5 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f8d6f9a2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x6150000009f0 is located 0 bytes to the right of 496-byte region [0x615000000800,0x6150000009f0) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c692 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:74:37 + #2 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f8d6f9a2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c2a7fff80e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa + 0x0c2a7fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c2a7fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa + 0x0c2a7fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff8150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8180: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1051.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1051.txt new file mode 100644 index 000000000..3080f3460 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1051.txt @@ -0,0 +1,68 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1278696079 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060000000b9 at pc 0x000002745e36 bp 0x7ffd7bd13c30 sp 0x7ffd7bd13c28 +READ of size 1 at 0x6060000000b9 thread T0 + #0 0x2745e35 in dwg_json_VPORT_private /src/libredwg/src/./dwg.spec:4464:1 + #1 0x23975ca in dwg_json_VPORT /src/libredwg/src/./dwg.spec:4279:1 + #2 0x23975ca in dwg_json_object /src/libredwg/src/out_json.c:1810:14 + #3 0x23975ca in json_objects_write /src/libredwg/src/out_json.c:2275:15 + #4 0x2340b49 in dwg_write_json /src/libredwg/src/out_json.c:2668:7 + #5 0x56cdeb in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:211:7 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f1554329082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x6060000000b9 is located 0 bytes to the right of 57-byte region [0x606000000080,0x6060000000b9) +allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x11ea222 in decode_preR13_section /src/libredwg/src/decode_r11.c:503:13 + #2 0x11a63ee in decode_preR13 /src/libredwg/src/decode_r11.c:788:16 + #3 0x590b83 in dwg_decode /src/libredwg/src/decode.c:220:17 + #4 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f1554329082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/./dwg.spec:4464:1 in dwg_json_VPORT_private +Shadow bytes around the buggy address: + 0x0c0c7fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa +=>0x0c0c7fff8010: 00 00 00 00 00 00 00[01]fa fa fa fa 00 00 00 00 + 0x0c0c7fff8020: 00 00 00 01 fa fa fa fa 00 00 00 00 00 00 00 01 + 0x0c0c7fff8030: fa fa fa fa 00 00 00 00 00 00 00 01 fa fa fa fa + 0x0c0c7fff8040: 00 00 00 00 00 00 00 01 fa fa fa fa 00 00 00 00 + 0x0c0c7fff8050: 00 00 00 01 fa fa fa fa 00 00 00 00 00 00 00 01 + 0x0c0c7fff8060: fa fa fa fa 00 00 00 00 00 00 00 01 fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1063.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1063.txt new file mode 100644 index 000000000..ede290039 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1063.txt @@ -0,0 +1,44 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1279073693 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: attempting double-free on 0x602000006170 in thread T0: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x13535b6 in dwg_free_object /src/libredwg/src/free.c:1278:5 + #2 0x13556a3 in dwg_free /src/libredwg/src/free.c:1689:13 + #3 0x56cab3 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:136:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fd0bde8a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #9 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x602000006170 is located 0 bytes inside of 14-byte region [0x602000006170,0x60200000617e) +freed by thread T0 here: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x3f481d2 in dxf_objects_read /src/libredwg/src/in_dxf.c:12385:19 + #2 0x3f2e88c in dwg_read_dxf /src/libredwg/src/in_dxf.c:12933:23 + #3 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fd0bde8a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +previously allocated by thread T0 here: + #0 0x519cf3 in strdup /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:440:3 + #1 0x3f47b9c in dxf_objects_read /src/libredwg/src/in_dxf.c:12379:31 + #2 0x3f2e88c in dwg_read_dxf /src/libredwg/src/in_dxf.c:12933:23 + #3 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fd0bde8a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: double-free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 in free +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1099.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1099.txt new file mode 100644 index 000000000..63db880b6 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1099.txt @@ -0,0 +1,66 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2265453356 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000053f0 at pc 0x000002dfdcc3 bp 0x7ffc68566870 sp 0x7ffc68566868 +READ of size 8 at 0x6020000053f0 thread T0 + #0 0x2dfdcc2 in dwg_geojson_object /src/libredwg/src/out_geojson.c:857:11 + #1 0x2df144f in geojson_entities_write /src/libredwg/src/out_geojson.c:1027:17 + #2 0x2df144f in dwg_write_geojson /src/libredwg/src/out_geojson.c:1055:7 + #3 0x56cd8b in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:215:7 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f81c34a2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #9 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x6020000053f1 is located 0 bytes to the right of 1-byte region [0x6020000053f0,0x6020000053f1) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x2df7131 in dwg_geojson_object /src/libredwg/src/out_geojson.c:839:32 + #2 0x2df144f in geojson_entities_write /src/libredwg/src/out_geojson.c:1027:17 + #3 0x2df144f in dwg_write_geojson /src/libredwg/src/out_geojson.c:1055:7 + #4 0x56cd8b in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:215:7 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f81c34a2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/out_geojson.c:857:11 in dwg_geojson_object +Shadow bytes around the buggy address: + 0x0c047fff8a20: fa fa 01 fa fa fa 02 fa fa fa 01 fa fa fa 01 fa + 0x0c047fff8a30: fa fa 01 fa fa fa 02 fa fa fa 01 fa fa fa 01 fa + 0x0c047fff8a40: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 01 fa + 0x0c047fff8a50: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 04 fa + 0x0c047fff8a60: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 01 fa +=>0x0c047fff8a70: fa fa 01 fa fa fa 00 03 fa fa 01 fa fa fa[01]fa + 0x0c047fff8a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8a90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8aa0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8ab0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8ac0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1101.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1101.txt new file mode 100644 index 000000000..2dd2efdca --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1101.txt @@ -0,0 +1,65 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1279621060 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6150000009f0 at pc 0x00000052e421 bp 0x7ffffd2f7bb0 sp 0x7ffffd2f7380 +READ of size 17 at 0x6150000009f0 thread T0 + #0 0x52e420 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x7d26aa in memcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34:10 + #2 0x7d26aa in decode_preR13_entities /src/libredwg/src/decode.c:7007:35 + #3 0x11a6194 in decode_preR13 /src/libredwg/src/decode_r11.c:755:12 + #4 0x590b83 in dwg_decode /src/libredwg/src/decode.c:220:17 + #5 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fdb59dea082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x6150000009f0 is located 0 bytes to the right of 496-byte region [0x615000000800,0x6150000009f0) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c692 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:74:37 + #2 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7fdb59dea082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c2a7fff80e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa + 0x0c2a7fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c2a7fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa + 0x0c2a7fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff8150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8180: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1104.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1104.txt new file mode 100644 index 000000000..90c7184cb --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1104.txt @@ -0,0 +1,68 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1279931676 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x616000000beb at pc 0x0000005700ce bp 0x7fff949d8440 sp 0x7fff949d8438 +READ of size 1 at 0x616000000beb thread T0 + #0 0x5700cd in bit_read_RC /src/libredwg/src/bits.c:342:18 + #1 0x57d097 in bit_read_fixed /src/libredwg/src/bits.c:1614:21 + #2 0x57d41a in bit_read_TF /src/libredwg/src/bits.c:1636:3 + #3 0xa8eb95 in dwg_decode_PROXY_ENTITY_private /src/libredwg/src/./dwg.spec:5947:5 + #4 0x775f69 in dwg_decode_PROXY_ENTITY /src/libredwg/src/./dwg.spec:5902:1 + #5 0x76593b in dwg_decode_add_object /src/libredwg/src/decode.c:5528:15 + #6 0x5a2396 in decode_R13_R2000 /src/libredwg/src/decode.c:858:19 + #7 0x590c38 in dwg_decode /src/libredwg/src/decode.c:230:12 + #8 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #9 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f91f9aee082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #14 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x616000000beb is located 0 bytes to the right of 619-byte region [0x616000000980,0x616000000beb) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c692 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:74:37 + #2 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f91f9aee082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:342:18 in bit_read_RC +Shadow bytes around the buggy address: + 0x0c2c7fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff8140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff8150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff8160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c2c7fff8170: 00 00 00 00 00 00 00 00 00 00 00 00 00[03]fa fa + 0x0c2c7fff8180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff81a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff81b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff81c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1110.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1110.txt new file mode 100644 index 000000000..5be6ae13c --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1110.txt @@ -0,0 +1,73 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1280230335 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f8501b8f8b8 at pc 0x00000052e421 bp 0x7ffe7b518530 sp 0x7ffe7b517d00 +READ of size 256 at 0x7f8501b8f8b8 thread T0 + #0 0x52e420 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x13675e8 in memcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34:10 + #2 0x13675e8 in dynapi_set_helper /src/libredwg/src/gen-dynapi.pl:3169:5 + #3 0x13680b3 in dwg_dynapi_header_set_value /src/libredwg/src/gen-dynapi.pl:3287:9 + #4 0x4008078 in json_HEADER /src/libredwg/src/in_json.c:1210:11 + #5 0x400096e in dwg_read_json /src/libredwg/src/in_json.c:5131:18 + #6 0x56c92f in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:116:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f8502239082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #12 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +Address 0x7f8501b8f8b8 is located in stack of thread T0 at offset 184 in frame + #0 0x40062af in json_HEADER /src/libredwg/src/in_json.c:1145 + + This frame has 11 object(s): + [32, 112) 'key' (line 1166) + [144, 152) 'num' (line 1197) + [176, 184) 'num188' (line 1208) + [208, 216) 'num212' (line 1215) <== Memory access at offset 184 partially underflows this variable + [240, 248) 'str' (line 1223) <== Memory access at offset 184 partially underflows this variable + [272, 296) 'pt' (line 1242) <== Memory access at offset 184 partially underflows this variable + [336, 352) 'pt321' (line 1251) <== Memory access at offset 184 partially underflows this variable + [368, 376) 'nums' (line 1259) <== Memory access at offset 184 partially underflows this variable + [400, 416) 'date' (line 1276) <== Memory access at offset 184 partially underflows this variable + [432, 480) 'color' (line 1282) <== Memory access at offset 184 partially underflows this variable + [512, 520) 'hdl' (line 1288) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0ff120369ec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff120369ed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff120369ee0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff120369ef0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff120369f00: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 f2 f2 +=>0x0ff120369f10: f2 f2 f8 f2 f2 f2 00[f2]f2 f2 f8 f2 f2 f2 f8 f2 + 0x0ff120369f20: f2 f2 f8 f8 f8 f2 f2 f2 f2 f2 f8 f8 f2 f2 f8 f2 + 0x0ff120369f30: f2 f2 f8 f8 f2 f2 f8 f8 f8 f8 f8 f8 f2 f2 f2 f2 + 0x0ff120369f40: f8 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff120369f50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff120369f60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1122.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1122.txt new file mode 100644 index 000000000..2f29c6384 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1122.txt @@ -0,0 +1,71 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1280481538 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +Warning: utf-8: BAD_CONTINUATION_BYTE ������������������������������w��M+19��7 +Warning: utf-8: BAD_CONTINUATION_BYTE ������������������������������w��M+19��7 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f8547fc2590 at pc 0x000000519c66 bp 0x7ffef82faa10 sp 0x7ffef82fa1d8 +READ of size 1025 at 0x7f8547fc2590 thread T0 + #0 0x519c65 in strdup /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:438:5 + #1 0x3f34741 in dxf_header_read /src/libredwg/src/in_dxf.c:1128:23 + #2 0x3f2e683 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12841:23 + #3 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f854865a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #9 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +Address 0x7f8547fc2590 is located in stack of thread T0 at offset 3472 in frame + #0 0x3f3265f in dxf_header_read /src/libredwg/src/in_dxf.c:1026 + + This frame has 10 object(s): + [32, 112) 'field' (line 1045) + [144, 1168) 'dest' (line 1126) + [1296, 2320) 'dest231' (line 1127) + [2448, 3472) 'dest277' (line 1128) + [3600, 4624) 'dest323' (line 1129) <== Memory access at offset 3472 partially underflows this variable + [4752, 5776) 'dest369' (line 1130) + [5904, 6928) 'dest415' (line 1131) + [7056, 7080) 'pt' (line 1178) + [7120, 7128) 'hdl' (line 1216) + [7152, 7160) 'hdl707' (line 1224) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:438:5 in strdup +Shadow bytes around the buggy address: + 0x0ff128ff0460: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff128ff0470: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff128ff0480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff128ff0490: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff128ff04a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0ff128ff04b0: 00 00[f2]f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 + 0x0ff128ff04c0: f2 f2 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 + 0x0ff128ff04d0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 + 0x0ff128ff04e0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 + 0x0ff128ff04f0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 + 0x0ff128ff0500: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1149.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1149.txt new file mode 100644 index 000000000..4449fd0b3 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1149.txt @@ -0,0 +1,68 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1280754598 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6150000007fa at pc 0x00000052e421 bp 0x7ffc7d5eb8c0 sp 0x7ffc7d5eb090 +READ of size 16 at 0x6150000007fa thread T0 + #0 0x52e420 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x57d112 in memcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34:10 + #2 0x57d112 in bit_read_fixed /src/libredwg/src/bits.c:1607:7 + #3 0x57d41a in bit_read_TF /src/libredwg/src/bits.c:1636:3 + #4 0x7c69d3 in decode_preR13_sentinel /src/libredwg/src/decode.c:6302:29 + #5 0x11e4680 in decode_preR13_section /src/libredwg/src/decode_r11.c:277:9 + #6 0x11a6204 in decode_preR13 /src/libredwg/src/decode_r11.c:768:12 + #7 0x590b83 in dwg_decode /src/libredwg/src/decode.c:220:17 + #8 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #9 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f9a36a27082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #14 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x6150000007fa is located 6 bytes to the left of 496-byte region [0x615000000800,0x6150000009f0) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c692 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:74:37 + #2 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f9a36a27082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c2a7fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff80b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff80c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff80d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff80e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa +=>0x0c2a7fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa] + 0x0c2a7fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa + 0x0c2a7fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1186.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1186.txt new file mode 100644 index 000000000..ad6706007 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-1186.txt @@ -0,0 +1,77 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1281048234 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f0c0e1ff780 at pc 0x000003f401c7 bp 0x7fff1fad77f0 sp 0x7fff1fad77e8 +READ of size 8 at 0x7f0c0e1ff780 thread T0 + #0 0x3f401c6 in dxf_tables_read /src/libredwg/src/in_dxf.c:11853:33 + #1 0x3f2e707 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12869:23 + #2 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #3 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #4 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #5 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #6 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #7 0x7f0c0ec77082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #8 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x7f0c0e1ff780 is located 188288 bytes inside of 188416-byte region [0x7f0c0e1d1800,0x7f0c0e1ff800) +freed by thread T0 here: + #0 0x52f49c in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x764930 in dwg_add_object /src/libredwg/src/decode.c:5120:35 + #2 0x3f4dea1 in new_object /src/libredwg/src/in_dxf.c:8665:7 + #3 0x3f3d8cf in dxf_tables_read /src/libredwg/src/in_dxf.c:11832:22 + #4 0x3f2e707 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12869:23 + #5 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f0c0ec77082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +previously allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x7649fc in dwg_add_object /src/libredwg/src/decode.c:5109:35 + #2 0x3f2d993 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12805:7 + #3 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f0c0ec77082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/libredwg/src/in_dxf.c:11853:33 in dxf_tables_read +Shadow bytes around the buggy address: + 0x0fe201c37ea0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0fe201c37eb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0fe201c37ec0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0fe201c37ed0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0fe201c37ee0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0fe201c37ef0:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0fe201c37f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fe201c37f10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fe201c37f20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fe201c37f30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fe201c37f40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-135.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-135.txt new file mode 100644 index 000000000..2b67b1497 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-135.txt @@ -0,0 +1,72 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1228767933 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000200 at pc 0x0000004c3e19 bp 0x7ffef09b7440 sp 0x7ffef09b6c08 +READ of size 51 at 0x604000000200 thread T0 + #0 0x4c3e18 in strlen /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:389:5 + #1 0x233aef4 in json_write_TF /src/libredwg/src/out_json.c:1424:29 + #2 0x24b7783 in dwg_json_LTYPE_private /src/libredwg/src/./dwg.spec:3947:5 + #3 0x24b7783 in dwg_json_LTYPE /src/libredwg/src/./dwg.spec:3942:1 + #4 0x236ac92 in dwg_json_object /src/libredwg/src/out_json.c:1798:14 + #5 0x236ac92 in json_objects_write /src/libredwg/src/out_json.c:2275:15 + #6 0x2340b49 in dwg_write_json /src/libredwg/src/out_json.c:2668:7 + #7 0x56cdeb in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:211:7 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f81e9a5a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #13 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x604000000200 is located 0 bytes to the right of 48-byte region [0x6040000001d0,0x604000000200) +allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x1367746 in dynapi_set_helper /src/libredwg/src/gen-dynapi.pl:3118:31 + #2 0x1367308 in dwg_dynapi_entity_set_value /src/libredwg/src/gen-dynapi.pl:3234:7 + #3 0x3f6e91f in new_object /src/libredwg/src/in_dxf.c:11105:25 + #4 0x3f42ac1 in dxf_blocks_read /src/libredwg/src/in_dxf.c:12073:22 + #5 0x3f2e8e5 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12904:23 + #6 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f81e9a5a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:389:5 in strlen +Shadow bytes around the buggy address: + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 00 + 0x0c087fff8010: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 01 fa + 0x0c087fff8020: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 07 fa + 0x0c087fff8030: fa fa 00 00 00 00 07 fa fa fa 00 00 00 00 00 00 +=>0x0c087fff8040:[fa]fa 00 00 00 00 00 02 fa fa 00 00 00 00 00 02 + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-269.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-269.txt new file mode 100644 index 000000000..3e4e5f02e --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-269.txt @@ -0,0 +1,71 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1288513596 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000c474 at pc 0x0000005853de bp 0x7fff0c95b200 sp 0x7fff0c95b1f8 +READ of size 1 at 0x60200000c474 thread T0 + #0 0x5853dd in bit_utf8_to_TU /src/libredwg/src/bits.c:3371:26 + #1 0x1367946 in dynapi_set_helper /src/libredwg/src/gen-dynapi.pl:3147:20 + #2 0x1367308 in dwg_dynapi_entity_set_value /src/libredwg/src/gen-dynapi.pl:3234:7 + #3 0x3f6e91f in new_object /src/libredwg/src/in_dxf.c:11105:25 + #4 0x3f42ac1 in dxf_blocks_read /src/libredwg/src/in_dxf.c:12073:22 + #5 0x3f2e8e5 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12904:23 + #6 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f1c25e65082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #12 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x60200000c474 is located 0 bytes to the right of 4-byte region [0x60200000c470,0x60200000c474) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x3f4c788 in dxf_read_string /src/libredwg/src/in_dxf.c:549:27 + #2 0x3f30126 in dxf_read_pair /src/libredwg/src/in_dxf.c:600:7 + #3 0x3f7556b in new_object /src/libredwg/src/in_dxf.c:11750:14 + #4 0x3f42ac1 in dxf_blocks_read /src/libredwg/src/in_dxf.c:12073:22 + #5 0x3f2e8e5 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12904:23 + #6 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f1c25e65082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:3371:26 in bit_utf8_to_TU +Shadow bytes around the buggy address: + 0x0c047fff9830: fa fa 07 fa fa fa fd fd fa fa fd fa fa fa fd fd + 0x0c047fff9840: fa fa fd fa fa fa fd fd fa fa fd fa fa fa 07 fa + 0x0c047fff9850: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fa + 0x0c047fff9860: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fa + 0x0c047fff9870: fa fa fd fa fa fa 04 fa fa fa fd fd fa fa fd fa +=>0x0c047fff9880: fa fa 03 fa fa fa 05 fa fa fa 00 00 fa fa[04]fa + 0x0c047fff9890: fa fa 00 fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff98a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff98b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff98c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff98d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-270.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-270.txt new file mode 100644 index 000000000..c34487f26 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-270.txt @@ -0,0 +1,68 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1288795486 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000094 at pc 0x0000005853e3 bp 0x7fffb5471440 sp 0x7fffb5471438 +WRITE of size 2 at 0x602000000094 thread T0 + #0 0x5853e2 in bit_utf8_to_TU /src/libredwg/src/bits.c:3390:23 + #1 0x4050bff in json_wstring /src/libredwg/src/in_json.c:438:10 + #2 0x402792b in json_AppInfo /src/libredwg/src/in_json.c:4298:7 + #3 0x4000c45 in dwg_read_json /src/libredwg/src/in_json.c:5151:18 + #4 0x56c92f in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:116:11 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fd979da3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #10 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x602000000094 is located 0 bytes to the right of 4-byte region [0x602000000090,0x602000000094) +allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x584811 in bit_utf8_to_TU /src/libredwg/src/bits.c:3364:22 + #2 0x4050bff in json_wstring /src/libredwg/src/in_json.c:438:10 + #3 0x402792b in json_AppInfo /src/libredwg/src/in_json.c:4298:7 + #4 0x4000c45 in dwg_read_json /src/libredwg/src/in_json.c:5151:18 + #5 0x56c92f in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:116:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fd979da3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:3390:23 in bit_utf8_to_TU +Shadow bytes around the buggy address: + 0x0c047fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c047fff8000: fa fa 00 00 fa fa 00 fa fa fa 00 fa fa fa 00 fa +=>0x0c047fff8010: fa fa[04]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-271.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-271.txt new file mode 100644 index 000000000..8a8864182 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-271.txt @@ -0,0 +1,67 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1289063642 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000001b6 at pc 0x0000005853de bp 0x7fff4c89a2e0 sp 0x7fff4c89a2d8 +READ of size 1 at 0x6020000001b6 thread T0 + #0 0x5853dd in bit_utf8_to_TU /src/libredwg/src/bits.c:3371:26 + #1 0x3f34787 in dxf_header_read /src/libredwg/src/in_dxf.c:1128:23 + #2 0x3f2e683 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12841:23 + #3 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fc907f7c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #9 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x6020000001b6 is located 0 bytes to the right of 6-byte region [0x6020000001b0,0x6020000001b6) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x3f4c788 in dxf_read_string /src/libredwg/src/in_dxf.c:549:27 + #2 0x3f30126 in dxf_read_pair /src/libredwg/src/in_dxf.c:600:7 + #3 0x3f33729 in dxf_header_read /src/libredwg/src/in_dxf.c:1273:14 + #4 0x3f2e683 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12841:23 + #5 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fc907f7c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:3371:26 in bit_utf8_to_TU +Shadow bytes around the buggy address: + 0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c047fff8000: fa fa 00 00 fa fa 00 fa fa fa 00 fa fa fa 00 fa + 0x0c047fff8010: fa fa 00 05 fa fa fd fd fa fa fd fa fa fa fd fd + 0x0c047fff8020: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd +=>0x0c047fff8030: fa fa 00 00 fa fa[06]fa fa fa 00 04 fa fa fa fa + 0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-284.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-284.txt new file mode 100644 index 000000000..8bd226804 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-284.txt @@ -0,0 +1,55 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1289361674 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0000052b33f0 at pc 0x00000406ec70 bp 0x7ffeb7f55230 sp 0x7ffeb7f55228 +READ of size 8 at 0x0000052b33f0 thread T0 + #0 0x406ec6f in dwg_codepage_dxfstr /src/libredwg/src/codepages.c:187:16 + #1 0x148a8f1 in dxf_codepage /src/libredwg/src/out_dxf.c:3036:21 + #2 0x148a8f1 in dxf_header_write /src/libredwg/src/out_dxf.c:3063:26 + #3 0x1485619 in dwg_write_dxf /src/libredwg/src/out_dxf.c:3760:3 + #4 0x56ce19 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:202:7 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f800a5f8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #10 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x0000052b33f0 is located 0 bytes to the right of global variable '_codepage_dxfstr' defined in 'codepages.c:167:13' (0x52b3280) of size 368 +SUMMARY: AddressSanitizer: global-buffer-overflow /src/libredwg/src/codepages.c:187:16 in dwg_codepage_dxfstr +Shadow bytes around the buggy address: + 0x000080a4e620: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 + 0x000080a4e630: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 + 0x000080a4e640: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 + 0x000080a4e650: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x000080a4e660: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x000080a4e670: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[f9]f9 + 0x000080a4e680: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 + 0x000080a4e690: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 + 0x000080a4e6a0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 + 0x000080a4e6b0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 + 0x000080a4e6c0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-314.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-314.txt new file mode 100644 index 000000000..c3caaddd1 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-314.txt @@ -0,0 +1,65 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1289655246 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61b000001c08 at pc 0x000002e3bff1 bp 0x7ffd49db6590 sp 0x7ffd49db6588 +READ of size 8 at 0x61b000001c08 thread T0 + #0 0x2e3bff0 in dwg_encode /src/libredwg/src/encode.c:4183:44 + #1 0x56cfac in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:196:9 + #2 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f67a3429082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #7 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x61b000001c08 is located 8 bytes to the right of 1664-byte region [0x61b000001580,0x61b000001c00) +allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x406ca71 in dwg_sections_init /src/libredwg/src/dwg.c:3395:42 + #2 0x13f2aac in dwg_add_Document /src/libredwg/src/dwg_api.c:22392:11 + #3 0x11a3f7f in decode_preR13 /src/libredwg/src/decode_r11.c:670:12 + #4 0x590b83 in dwg_decode /src/libredwg/src/decode.c:220:17 + #5 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f67a3429082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/encode.c:4183:44 in dwg_encode +Shadow bytes around the buggy address: + 0x0c367fff8330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c367fff8340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c367fff8350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c367fff8360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c367fff8370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c367fff8380: fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c367fff8390: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c367fff83a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c367fff83b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c367fff83c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c367fff83d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-316.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-316.txt new file mode 100644 index 000000000..69d3b6e51 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-316.txt @@ -0,0 +1,27 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2265757697 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x0000013f18e9 bp 0x7ffcdc4ace70 sp 0x7ffcdc4ace60 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x13f18e9 in dwg_ref_get_object /src/libredwg/src/dwg_api.c:21982:17 + #1 0x2dffd6e in dwg_geojson_feature /src/libredwg/src/out_geojson.c:547:25 + #2 0x2df3b82 in dwg_geojson_object /src/libredwg/src/out_geojson.c:983:9 + #3 0x2df144f in geojson_entities_write /src/libredwg/src/out_geojson.c:1027:17 + #4 0x2df144f in dwg_write_geojson /src/libredwg/src/out_geojson.c:1055:7 + #5 0x56cd8b in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:215:7 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fcefa57e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/libredwg/src/dwg_api.c:21982:17 in dwg_ref_get_object +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-397.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-397.txt new file mode 100644 index 000000000..f9f3a8765 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-397.txt @@ -0,0 +1,67 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1229109921 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000013a at pc 0x00000233b375 bp 0x7ffe8ec56980 sp 0x7ffe8ec56978 +READ of size 1 at 0x60200000013a thread T0 + #0 0x233b374 in json_write_TF /src/libredwg/src/out_json.c:1459:21 + #1 0x2401089 in json_preR13_header_write_private /src/libredwg/src/./header_variables_r11.spec:136:3 + #2 0x233e9a3 in json_header_write /src/libredwg/src/out_json.c:1987:13 + #3 0x233e9a3 in dwg_write_json /src/libredwg/src/out_json.c:2655:3 + #4 0x56cdeb in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:211:7 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f5407a76082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #10 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x60200000013a is located 0 bytes to the right of 10-byte region [0x602000000130,0x60200000013a) +allocated by thread T0 here: + #0 0x52f49c in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x11be6d9 in decode_preR13_header_variables /src/libredwg/src/./header_variables_r11.spec:172:27 + #2 0x11a439e in decode_preR13 /src/libredwg/src/decode_r11.c:707:12 + #3 0x590b83 in dwg_decode /src/libredwg/src/decode.c:220:17 + #4 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f5407a76082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/out_json.c:1459:21 in json_write_TF +Shadow bytes around the buggy address: + 0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c047fff8000: fa fa 00 00 fa fa 00 fa fa fa 00 fa fa fa 00 fa + 0x0c047fff8010: fa fa fd fd fa fa 00 07 fa fa 00 fa fa fa 00 fa +=>0x0c047fff8020: fa fa fd fd fa fa 00[02]fa fa fa fa fa fa fa fa + 0x0c047fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-412.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-412.txt new file mode 100644 index 000000000..bcd83bc00 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-412.txt @@ -0,0 +1,28 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1229459234 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000003 (pc 0x0000004aff54 bp 0x000000000000 sp 0x7fffce16b5e0 T0) +==1==The signal is caused by a WRITE memory access. +==1==Hint: address points to the zero page. + #0 0x4aff54 in atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t> /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81:10 + #1 0x4aff54 in AtomicallySetQuarantineFlagIfAllocated /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:610:10 + #2 0x4aff54 in __asan::Allocator::Deallocate(void*, unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType) /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:685:10 + #3 0x52ee55 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:53:3 + #4 0x135cdd8 in dwg_free /src/libredwg/src/free.c:1715:9 + #5 0x56ce46 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:223:3 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x43ea25 in fuzzer::Fuzzer::TryDetectingAMemoryLeak(unsigned char const*, unsigned long, bool) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:687:3 + #8 0x4296ae in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:8 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f65e22a5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #12 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81:10 in atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t> +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-415.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-415.txt new file mode 100644 index 000000000..cad1e58ef --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-415.txt @@ -0,0 +1,27 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1229801167 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000006a (pc 0x0000004aff54 bp 0x000000000000 sp 0x7fff7a9fbf20 T0) +==1==The signal is caused by a WRITE memory access. +==1==Hint: address points to the zero page. + #0 0x4aff54 in atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t> /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81:10 + #1 0x4aff54 in AtomicallySetQuarantineFlagIfAllocated /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:610:10 + #2 0x4aff54 in __asan::Allocator::Deallocate(void*, unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType) /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:685:10 + #3 0x52ee55 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:53:3 + #4 0x2e1b721 in dwg_encode /src/libredwg/src/encode.c:3517:7 + #5 0x56cfac in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:196:9 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f7fb304a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81:10 in atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t> +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-42.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-42.txt new file mode 100644 index 000000000..93f93013b --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-42.txt @@ -0,0 +1,66 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1228446677 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60600000017a at pc 0x00000056e80a bp 0x7ffc67a038e0 sp 0x7ffc67a038d8 +READ of size 1 at 0x60600000017a thread T0 + #0 0x56e809 in bit_read_BB /src/libredwg/src/bits.c:202:10 + #1 0x899071 in dwg_decode_MINSERT_private /src/libredwg/src/./dwg.spec:913:11 + #2 0x76a5c9 in dwg_decode_MINSERT /src/libredwg/src/./dwg.spec:887:1 + #3 0x765c2c in dwg_decode_add_object /src/libredwg/src/decode.c:5296:15 + #4 0x5a2396 in decode_R13_R2000 /src/libredwg/src/decode.c:858:19 + #5 0x590c38 in dwg_decode /src/libredwg/src/decode.c:230:12 + #6 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fbce85e8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #12 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x60600000017a is located 0 bytes to the right of 58-byte region [0x606000000140,0x60600000017a) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c692 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:74:37 + #2 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7fbce85e8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:202:10 in bit_read_BB +Shadow bytes around the buggy address: + 0x0c0c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c0c7fff8010: 00 00 00 00 00 00 00 06 fa fa fa fa 00 00 00 00 +=>0x0c0c7fff8020: 00 00 00 06 fa fa fa fa 00 00 00 00 00 00 00[02] + 0x0c0c7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-440.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-440.txt new file mode 100644 index 000000000..1c3bfe861 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-440.txt @@ -0,0 +1,45 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1290264609 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: attempting double-free on 0x6020000001d0 in thread T0: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x1354589 in free_preR13_object /src/libredwg/src/free.c:944:5 + #2 0x1352616 in dwg_free_object /src/libredwg/src/free.c + #3 0x13556a3 in dwg_free /src/libredwg/src/free.c:1689:13 + #4 0x56cab3 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:136:11 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fc1f8a86082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #10 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x6020000001d0 is located 0 bytes inside of 14-byte region [0x6020000001d0,0x6020000001de) +freed by thread T0 here: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x3f42da8 in dxf_blocks_read /src/libredwg/src/in_dxf.c:12077:19 + #2 0x3f2e8e5 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12904:23 + #3 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fc1f8a86082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +previously allocated by thread T0 here: + #0 0x519cf3 in strdup /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:440:3 + #1 0x3f427bf in dxf_blocks_read /src/libredwg/src/in_dxf.c:12059:31 + #2 0x3f2e8e5 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12904:23 + #3 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fc1f8a86082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: double-free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 in free +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-452.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-452.txt new file mode 100644 index 000000000..b9f62392a --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-452.txt @@ -0,0 +1,72 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1275237667 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000200 at pc 0x0000004c3e19 bp 0x7fffdf4084c0 sp 0x7fffdf407c88 +READ of size 51 at 0x604000000200 thread T0 + #0 0x4c3e18 in strlen /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:389:5 + #1 0x233aef4 in json_write_TF /src/libredwg/src/out_json.c:1424:29 + #2 0x24b7783 in dwg_json_LTYPE_private /src/libredwg/src/./dwg.spec:3947:5 + #3 0x24b7783 in dwg_json_LTYPE /src/libredwg/src/./dwg.spec:3942:1 + #4 0x236ac92 in dwg_json_object /src/libredwg/src/out_json.c:1798:14 + #5 0x236ac92 in json_objects_write /src/libredwg/src/out_json.c:2275:15 + #6 0x2340b49 in dwg_write_json /src/libredwg/src/out_json.c:2668:7 + #7 0x56cdeb in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:211:7 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7fe037879082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #13 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x604000000200 is located 0 bytes to the right of 48-byte region [0x6040000001d0,0x604000000200) +allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x1367746 in dynapi_set_helper /src/libredwg/src/gen-dynapi.pl:3118:31 + #2 0x1367308 in dwg_dynapi_entity_set_value /src/libredwg/src/gen-dynapi.pl:3234:7 + #3 0x3f6e91f in new_object /src/libredwg/src/in_dxf.c:11105:25 + #4 0x3f42ac1 in dxf_blocks_read /src/libredwg/src/in_dxf.c:12073:22 + #5 0x3f2e8e5 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12904:23 + #6 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fe037879082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:389:5 in strlen +Shadow bytes around the buggy address: + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 00 + 0x0c087fff8010: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 01 fa + 0x0c087fff8020: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 07 fa + 0x0c087fff8030: fa fa 00 00 00 00 07 fa fa fa 00 00 00 00 00 00 +=>0x0c087fff8040:[fa]fa 00 00 00 00 00 02 fa fa 00 00 00 00 00 02 + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-455.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-455.txt new file mode 100644 index 000000000..8247010a9 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-455.txt @@ -0,0 +1,72 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1290587904 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000d51 at pc 0x00000058a139 bp 0x7ffebb214210 sp 0x7ffebb214208 +WRITE of size 1 at 0x602000000d51 thread T0 + #0 0x58a138 in bit_TV_to_utf8 /src/libredwg/src/bits.c:3303:15 + #1 0x233a26b in json_cquote /src/libredwg/src/out_json.c:1497:13 + #2 0x2dfe684 in dwg_geojson_feature /src/libredwg/src/out_geojson.c:431:3 + #3 0x2df3b82 in dwg_geojson_object /src/libredwg/src/out_geojson.c:983:9 + #4 0x2df144f in geojson_entities_write /src/libredwg/src/out_geojson.c:1027:17 + #5 0x2df144f in dwg_write_geojson /src/libredwg/src/out_geojson.c:1055:7 + #6 0x56cd8b in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:215:7 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f7f2fd59082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #12 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x602000000d51 is located 0 bytes to the right of 1-byte region [0x602000000d50,0x602000000d51) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x58961c in bit_TV_to_utf8 /src/libredwg/src/bits.c:3224:28 + #2 0x233a26b in json_cquote /src/libredwg/src/out_json.c:1497:13 + #3 0x2dfe684 in dwg_geojson_feature /src/libredwg/src/out_geojson.c:431:3 + #4 0x2df3b82 in dwg_geojson_object /src/libredwg/src/out_geojson.c:983:9 + #5 0x2df144f in geojson_entities_write /src/libredwg/src/out_geojson.c:1027:17 + #6 0x2df144f in dwg_write_geojson /src/libredwg/src/out_geojson.c:1055:7 + #7 0x56cd8b in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:215:7 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f7f2fd59082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:3303:15 in bit_TV_to_utf8 +Shadow bytes around the buggy address: + 0x0c047fff8150: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff8160: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa + 0x0c047fff8170: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa + 0x0c047fff8180: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 00 07 + 0x0c047fff8190: fa fa 01 fa fa fa fd fa fa fa fd fa fa fa fd fd +=>0x0c047fff81a0: fa fa fd fa fa fa fd fa fa fa[01]fa fa fa fd fa + 0x0c047fff81b0: fa fa fd fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-46.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-46.txt new file mode 100644 index 000000000..c5fc153d0 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-46.txt @@ -0,0 +1,67 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1288174877 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6120000008d5 at pc 0x00000233adf7 bp 0x7ffca03dec20 sp 0x7ffca03dec18 +WRITE of size 1 at 0x6120000008d5 thread T0 + #0 0x233adf6 in json_cquote /src/libredwg/src/out_json.c:1553:9 + #1 0x240489a in json_preR13_header_write_private /src/libredwg/src/./header_variables_r11.spec:161:7 + #2 0x233e9a3 in json_header_write /src/libredwg/src/out_json.c:1987:13 + #3 0x233e9a3 in dwg_write_json /src/libredwg/src/out_json.c:2655:3 + #4 0x56cdeb in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:211:7 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f223397e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #10 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x6120000008d5 is located 0 bytes to the right of 277-byte region [0x6120000007c0,0x6120000008d5) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x2404862 in json_preR13_header_write_private /src/libredwg/src/./header_variables_r11.spec:161:7 + #2 0x233e9a3 in json_header_write /src/libredwg/src/out_json.c:1987:13 + #3 0x233e9a3 in dwg_write_json /src/libredwg/src/out_json.c:2655:3 + #4 0x56cdeb in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:211:7 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f223397e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/out_json.c:1553:9 in json_cquote +Shadow bytes around the buggy address: + 0x0c247fff80c0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c247fff80d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c247fff80e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa + 0x0c247fff80f0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c247fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c247fff8110: 00 00 00 00 00 00 00 00 00 00[05]fa fa fa fa fa + 0x0c247fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c247fff8130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c247fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c247fff8150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c247fff8160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-634.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-634.txt new file mode 100644 index 000000000..0dc0eaafc --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-634.txt @@ -0,0 +1,67 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1275569060 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60600000017c at pc 0x00000056e80a bp 0x7ffe84fb1570 sp 0x7ffe84fb1568 +READ of size 1 at 0x60600000017c thread T0 + #0 0x56e809 in bit_read_BB /src/libredwg/src/bits.c:202:10 + #1 0x572e2b in bit_read_BS /src/libredwg/src/bits.c:614:38 + #2 0x882c3f in dwg_decode_ATTDEF_private /src/libredwg/src/./dwg.spec:471:7 + #3 0x767f39 in dwg_decode_ATTDEF /src/libredwg/src/./dwg.spec:395:1 + #4 0x765f09 in dwg_decode_add_object /src/libredwg/src/decode.c:5253:15 + #5 0x5a2396 in decode_R13_R2000 /src/libredwg/src/decode.c:858:19 + #6 0x590c38 in dwg_decode /src/libredwg/src/decode.c:230:12 + #7 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f62f1e50082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #13 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x60600000017c is located 0 bytes to the right of 60-byte region [0x606000000140,0x60600000017c) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c692 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:74:37 + #2 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f62f1e50082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:202:10 in bit_read_BB +Shadow bytes around the buggy address: + 0x0c0c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c0c7fff8010: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00 +=>0x0c0c7fff8020: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00[04] + 0x0c0c7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-717.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-717.txt new file mode 100644 index 000000000..71a191f58 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-717.txt @@ -0,0 +1,73 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1275875013 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000113 at pc 0x00000058abe9 bp 0x7ffc4089f870 sp 0x7ffc4089f868 +READ of size 1 at 0x602000000113 thread T0 + #0 0x58abe8 in bit_TV_to_utf8_codepage /src/libredwg/src/bits.c:3139:15 + #1 0x58a006 in bit_TV_to_utf8 /src/libredwg/src/bits.c + #2 0xa7840c in dwg_decode_LAYOUT_private /src/libredwg/src/./dwg.spec:5594:3 + #3 0x775ca9 in dwg_decode_LAYOUT /src/libredwg/src/./dwg.spec:5590:1 + #4 0x7663b0 in dwg_decode_add_object /src/libredwg/src/decode.c + #5 0x5a2396 in decode_R13_R2000 /src/libredwg/src/decode.c:858:19 + #6 0x590c38 in dwg_decode /src/libredwg/src/decode.c:230:12 + #7 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7fc31c2f9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #13 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x602000000113 is located 0 bytes to the right of 3-byte region [0x602000000110,0x602000000113) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x57e56d in bit_read_TV /src/libredwg/src/bits.c:1733:28 + #2 0xa7838b in dwg_decode_LAYOUT_private /src/libredwg/src/./dwg.spec:5594:3 + #3 0x775ca9 in dwg_decode_LAYOUT /src/libredwg/src/./dwg.spec:5590:1 + #4 0x7663b0 in dwg_decode_add_object /src/libredwg/src/decode.c + #5 0x5a2396 in decode_R13_R2000 /src/libredwg/src/decode.c:858:19 + #6 0x590c38 in dwg_decode /src/libredwg/src/decode.c:230:12 + #7 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7fc31c2f9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:3139:15 in bit_TV_to_utf8_codepage +Shadow bytes around the buggy address: + 0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c047fff8000: fa fa 00 00 fa fa 00 fa fa fa 00 fa fa fa 00 fa + 0x0c047fff8010: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 01 fa +=>0x0c047fff8020: fa fa[03]fa fa fa fd fa fa fa fd fd fa fa fd fd + 0x0c047fff8030: fa fa 07 fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-748.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-748.txt new file mode 100644 index 000000000..ef255b177 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-748.txt @@ -0,0 +1,27 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1276164353 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x0000004aff54 bp 0x000000000000 sp 0x7fff0243c9a0 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x4aff54 in atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t> /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81:10 + #1 0x4aff54 in AtomicallySetQuarantineFlagIfAllocated /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:610:10 + #2 0x4aff54 in __asan::Allocator::Deallocate(void*, unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType) /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:685:10 + #3 0x52ee55 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:53:3 + #4 0x2e1bb52 in dwg_encode /src/libredwg/src/encode.c:3518:7 + #5 0x56cfac in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:196:9 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f8adaea5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81:10 in atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t> +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-758.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-758.txt new file mode 100644 index 000000000..8ea57ad5b --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-758.txt @@ -0,0 +1,54 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1290942843 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +ERROR: Out of memory +================================================================= +==1==ERROR: AddressSanitizer: attempting double-free on 0x6020000003d0 in thread T0: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x589aa6 in bit_TV_to_utf8 /src/libredwg/src/bits.c:3280:25 + #2 0x233a26b in json_cquote /src/libredwg/src/out_json.c:1497:13 + #3 0x246a192 in json_header_write_private /src/libredwg/src/./header_variables.spec:422:7 + #4 0x233e9b7 in json_header_write /src/libredwg/src/out_json.c:1991:13 + #5 0x233e9b7 in dwg_write_json /src/libredwg/src/out_json.c:2655:3 + #6 0x56cdeb in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:211:7 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f4a99ae3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #12 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x6020000003d0 is located 0 bytes inside of 14-byte region [0x6020000003d0,0x6020000003de) +freed by thread T0 here: + #0 0x52f49c in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x5898fb in bit_TV_to_utf8 /src/libredwg/src/bits.c:3267:36 + #2 0x233a26b in json_cquote /src/libredwg/src/out_json.c:1497:13 + #3 0x246a192 in json_header_write_private /src/libredwg/src/./header_variables.spec:422:7 + #4 0x233e9b7 in json_header_write /src/libredwg/src/out_json.c:1991:13 + #5 0x233e9b7 in dwg_write_json /src/libredwg/src/out_json.c:2655:3 + #6 0x56cdeb in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:211:7 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f4a99ae3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +previously allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x58961c in bit_TV_to_utf8 /src/libredwg/src/bits.c:3224:28 + #2 0x233a26b in json_cquote /src/libredwg/src/out_json.c:1497:13 + #3 0x246a192 in json_header_write_private /src/libredwg/src/./header_variables.spec:422:7 + #4 0x233e9b7 in json_header_write /src/libredwg/src/out_json.c:1991:13 + #5 0x233e9b7 in dwg_write_json /src/libredwg/src/out_json.c:2655:3 + #6 0x56cdeb in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:211:7 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f4a99ae3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: double-free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 in free +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-777.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-777.txt new file mode 100644 index 000000000..d9ad9d483 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-777.txt @@ -0,0 +1,70 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1276486432 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6120000008c1 at pc 0x00000147faa4 bp 0x7ffd408d5e30 sp 0x7ffd408d5e28 +READ of size 1 at 0x6120000008c1 thread T0 + #0 0x147faa3 in cquote /src/libredwg/src/out_dxf.c:1188:19 + #1 0x147faa3 in dxf_fixup_string /src/libredwg/src/out_dxf.c:1246:31 + #2 0x1495484 in dxf_header_write /src/libredwg/src/./header_variables_dxf.spec:150:5 + #3 0x1485619 in dwg_write_dxf /src/libredwg/src/out_dxf.c:3760:3 + #4 0x56ce19 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:202:7 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x43ea25 in fuzzer::Fuzzer::TryDetectingAMemoryLeak(unsigned char const*, unsigned long, bool) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:687:3 + #7 0x4296ae in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:8 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f30d08f2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x6120000008c1 is located 0 bytes to the right of 257-byte region [0x6120000007c0,0x6120000008c1) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x57e56d in bit_read_TV /src/libredwg/src/bits.c:1733:28 + #2 0x601fd2 in dwg_decode_header_variables /src/libredwg/src/./header_variables.spec:335:9 + #3 0x59fb52 in decode_R13_R2000 /src/libredwg/src/decode.c:510:12 + #4 0x590c38 in dwg_decode /src/libredwg/src/decode.c:230:12 + #5 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x43ea25 in fuzzer::Fuzzer::TryDetectingAMemoryLeak(unsigned char const*, unsigned long, bool) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:687:3 + #8 0x4296ae in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:8 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f30d08f2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/out_dxf.c:1188:19 in cquote +Shadow bytes around the buggy address: + 0x0c247fff80c0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c247fff80d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c247fff80e0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa + 0x0c247fff80f0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c247fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c247fff8110: 00 00 00 00 00 00 00 00[01]fa fa fa fa fa fa fa + 0x0c247fff8120: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c247fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c247fff8140: 00 00 00 00 00 00 00 00 01 fa fa fa fa fa fa fa + 0x0c247fff8150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c247fff8160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-811.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-811.txt new file mode 100644 index 000000000..a49daaf3b --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-811.txt @@ -0,0 +1,64 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1276818304 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x7fd262bb0240 in thread T0 + #0 0x52f49c in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x58e370 in bit_chain_alloc_size /src/libredwg/src/bits.c:3850:30 + #2 0x5702cd in bit_chain_alloc /src/libredwg/src/bits.c:3868:3 + #3 0x5702cd in bit_write_RC /src/libredwg/src/bits.c:369:9 + #4 0x57b883 in bit_H_to_dat /src/libredwg/src/bits.c:1454:9 + #5 0x2e1e2da in dwg_encode /src/libredwg/src/encode.c:3527:7 + #6 0x56cfac in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:196:9 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fd263254082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #12 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +Address 0x7fd262bb0240 is located in stack of thread T0 at offset 2624 in frame + #0 0x2e0601f in dwg_encode /src/libredwg/src/encode.c:2382 + + This frame has 34 object(s): + [32, 36) 'error' (line 2384) + [48, 1168) 'sec_dat' (line 2396) + [1296, 1298) 'placeholder_type' (line 2452) + [1312, 1328) 'tmap.sroa.5' (line 3241) + [1344, 1352) 'chain4535' (line 3517) + [1376, 1432) 'hdat' (line 3517) + [1472, 1480) 'chain4612' (line 3518) + [1504, 1560) 'hdat4613' (line 3518) + [1600, 1608) 'chain4691' (line 3519) + [1632, 1688) 'hdat4692' (line 3519) + [1728, 1736) 'chain4770' (line 3520) + [1760, 1816) 'hdat4771' (line 3520) + [1856, 1864) 'chain4849' (line 3521) + [1888, 1944) 'hdat4850' (line 3521) + [1984, 1992) 'chain4928' (line 3522) + [2016, 2072) 'hdat4929' (line 3522) + [2112, 2120) 'chain5007' (line 3523) + [2144, 2200) 'hdat5008' (line 3523) + [2240, 2248) 'chain5086' (line 3524) + [2272, 2328) 'hdat5087' (line 3524) + [2368, 2376) 'chain5165' (line 3525) + [2400, 2456) 'hdat5166' (line 3525) + [2496, 2504) 'chain5244' (line 3526) + [2528, 2584) 'hdat5245' (line 3526) + [2624, 2632) 'chain5324' (line 3527) <== Memory access at offset 2624 is inside this variable + [2656, 2712) 'hdat5325' (line 3527) + [2752, 2760) 'chain5403' (line 3528) + [2784, 2840) 'hdat5404' (line 3528) + [2880, 2888) 'chain5482' (line 3529) + [2912, 2968) 'hdat5483' (line 3529) + [3008, 3016) 'chain5561' (line 3530) + [3040, 3096) 'hdat5562' (line 3530) + [3136, 3192) 'file_dat' (line 4119) + [3232, 3245) 'enc_file_ID_string' (line 4125) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: bad-free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 in __interceptor_realloc +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-850.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-850.txt new file mode 100644 index 000000000..238d16791 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-850.txt @@ -0,0 +1,74 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1291260311 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000001932 at pc 0x00000058a05b bp 0x7ffeb2fa7e10 sp 0x7ffeb2fa7e08 +WRITE of size 1 at 0x602000001932 thread T0 + #0 0x58a05a in bit_TV_to_utf8 /src/libredwg/src/bits.c:3313:23 + #1 0x233a26b in json_cquote /src/libredwg/src/out_json.c:1497:13 + #2 0x27995f6 in dwg_json_LAYOUT_private /src/libredwg/src/./dwg.spec:5606:3 + #3 0x24df790 in dwg_json_LAYOUT /src/libredwg/src/./dwg.spec:5590:1 + #4 0x236b962 in dwg_json_object /src/libredwg/src/out_json.c:1862:14 + #5 0x236b962 in json_objects_write /src/libredwg/src/out_json.c:2275:15 + #6 0x2340b49 in dwg_write_json /src/libredwg/src/out_json.c:2668:7 + #7 0x56cdeb in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:211:7 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7fd14a2a5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #13 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x602000001932 is located 0 bytes to the right of 2-byte region [0x602000001930,0x602000001932) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x58961c in bit_TV_to_utf8 /src/libredwg/src/bits.c:3224:28 + #2 0x233a26b in json_cquote /src/libredwg/src/out_json.c:1497:13 + #3 0x27995f6 in dwg_json_LAYOUT_private /src/libredwg/src/./dwg.spec:5606:3 + #4 0x24df790 in dwg_json_LAYOUT /src/libredwg/src/./dwg.spec:5590:1 + #5 0x236b962 in dwg_json_object /src/libredwg/src/out_json.c:1862:14 + #6 0x236b962 in json_objects_write /src/libredwg/src/out_json.c:2275:15 + #7 0x2340b49 in dwg_write_json /src/libredwg/src/out_json.c:2668:7 + #8 0x56cdeb in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:211:7 + #9 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fd14a2a5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:3313:23 in bit_TV_to_utf8 +Shadow bytes around the buggy address: + 0x0c047fff82d0: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fd + 0x0c047fff82e0: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa + 0x0c047fff82f0: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa + 0x0c047fff8300: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff8310: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa +=>0x0c047fff8320: fa fa fd fa fa fa[02]fa fa fa fd fa fa fa fd fa + 0x0c047fff8330: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8340: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8350: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8360: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8370: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-855.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-855.txt new file mode 100644 index 000000000..6f5555714 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-855.txt @@ -0,0 +1,53 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1277095285 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: attempting double-free on 0x6020000009f0 in thread T0: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x135f55f in dwg_free_common_entity_data /src/libredwg/src/free.c:417:3 + #2 0x1258777 in dwg_free_POINTCLOUD /src/libredwg/src/./dwg.spec:11474:1 + #3 0x124d717 in dwg_free_variable_no_class /src/libredwg/src/./objects.inc:77:1 + #4 0x127d56b in dwg_free_variable_type /src/libredwg/src/free.c + #5 0x135349a in dwg_free_object /src/libredwg/src/free.c:1267:25 + #6 0x13556a3 in dwg_free /src/libredwg/src/free.c:1689:13 + #7 0x56cab3 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:136:11 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f7df91b2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #13 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x6020000009f0 is located 0 bytes inside of 16-byte region [0x6020000009f0,0x602000000a00) +freed by thread T0 here: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x3f75546 in dxf_free_pair /src/libredwg/src/in_dxf.c + #2 0x3f75546 in new_object /src/libredwg/src/in_dxf.c:11749:7 + #3 0x3f42ac1 in dxf_blocks_read /src/libredwg/src/in_dxf.c:12073:22 + #4 0x3f2e8e5 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12904:23 + #5 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f7df91b2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +previously allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x3f4c788 in dxf_read_string /src/libredwg/src/in_dxf.c:549:27 + #2 0x3f306bf in dxf_read_pair /src/libredwg/src/in_dxf.c:633:7 + #3 0x3f4db0f in new_object /src/libredwg/src/in_dxf.c:8569:20 + #4 0x3f42ac1 in dxf_blocks_read /src/libredwg/src/in_dxf.c:12073:22 + #5 0x3f2e8e5 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12904:23 + #6 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f7df91b2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: double-free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 in free +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-874.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-874.txt new file mode 100644 index 000000000..5f015f5ba --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-874.txt @@ -0,0 +1,67 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1277367866 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +ERROR: iconv "�" failed with errno 22 +ERROR: iconv "�" failed with errno 22 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000000eb4 at pc 0x00000056e80a bp 0x7fff47f23730 sp 0x7fff47f23728 +READ of size 1 at 0x619000000eb4 thread T0 + #0 0x56e809 in bit_read_BB /src/libredwg/src/bits.c:202:10 + #1 0x572e2b in bit_read_BS /src/libredwg/src/bits.c:614:38 + #2 0x621844 in dwg_decode_header_variables /src/libredwg/src/./header_variables.spec:524:7 + #3 0x59fb52 in decode_R13_R2000 /src/libredwg/src/decode.c:510:12 + #4 0x590c38 in dwg_decode /src/libredwg/src/decode.c:230:12 + #5 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f0bcbbfb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x619000000eb4 is located 0 bytes to the right of 1076-byte region [0x619000000a80,0x619000000eb4) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c692 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:74:37 + #2 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f0bcbbfb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:202:10 in bit_read_BB +Shadow bytes around the buggy address: + 0x0c327fff8180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff8190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff81a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff81b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff81c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c327fff81d0: 00 00 00 00 00 00[04]fa fa fa fa fa fa fa fa fa + 0x0c327fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff8210: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff8220: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-894.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-894.txt new file mode 100644 index 000000000..d6bc8e181 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-894.txt @@ -0,0 +1,45 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1291588008 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: attempting double-free on 0x603000000130 in thread T0: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x1354589 in free_preR13_object /src/libredwg/src/free.c:944:5 + #2 0x1352616 in dwg_free_object /src/libredwg/src/free.c + #3 0x13556a3 in dwg_free /src/libredwg/src/free.c:1689:13 + #4 0x56cab3 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:136:11 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f2f71258082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #10 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x603000000130 is located 0 bytes inside of 17-byte region [0x603000000130,0x603000000141) +freed by thread T0 here: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x3f4693d in dxf_entities_read /src/libredwg/src/in_dxf.c:12312:15 + #2 0x3f2e84e in dwg_read_dxf /src/libredwg/src/in_dxf.c:12925:23 + #3 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f2f71258082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +previously allocated by thread T0 here: + #0 0x519cf3 in strdup /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:440:3 + #1 0x3f46544 in dxf_entities_read /src/libredwg/src/in_dxf.c:12293:27 + #2 0x3f2e84e in dwg_read_dxf /src/libredwg/src/in_dxf.c:12925:23 + #3 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f2f71258082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: double-free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 in free +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-965.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-965.txt new file mode 100644 index 000000000..347ce2195 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-965.txt @@ -0,0 +1,74 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1277682479 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000001a92 at pc 0x00000058a195 bp 0x7ffff70f9150 sp 0x7ffff70f9148 +WRITE of size 1 at 0x602000001a92 thread T0 + #0 0x58a194 in bit_TV_to_utf8 /src/libredwg/src/bits.c:3328:23 + #1 0x233a26b in json_cquote /src/libredwg/src/out_json.c:1497:13 + #2 0x25116c6 in dwg_json_TEXT_private /src/libredwg/src/./dwg.spec:149:9 + #3 0x239abbb in dwg_json_TEXT /src/libredwg/src/./dwg.spec:29:1 + #4 0x239abbb in dwg_json_object /src/libredwg/src/out_json.c:1688:14 + #5 0x239abbb in json_objects_write /src/libredwg/src/out_json.c:2275:15 + #6 0x2340b49 in dwg_write_json /src/libredwg/src/out_json.c:2668:7 + #7 0x56cdeb in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:211:7 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f75f35eb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #13 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x602000001a92 is located 0 bytes to the right of 2-byte region [0x602000001a90,0x602000001a92) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x58961c in bit_TV_to_utf8 /src/libredwg/src/bits.c:3224:28 + #2 0x233a26b in json_cquote /src/libredwg/src/out_json.c:1497:13 + #3 0x25116c6 in dwg_json_TEXT_private /src/libredwg/src/./dwg.spec:149:9 + #4 0x239abbb in dwg_json_TEXT /src/libredwg/src/./dwg.spec:29:1 + #5 0x239abbb in dwg_json_object /src/libredwg/src/out_json.c:1688:14 + #6 0x239abbb in json_objects_write /src/libredwg/src/out_json.c:2275:15 + #7 0x2340b49 in dwg_write_json /src/libredwg/src/out_json.c:2668:7 + #8 0x56cdeb in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:211:7 + #9 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f75f35eb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:3328:23 in bit_TV_to_utf8 +Shadow bytes around the buggy address: + 0x0c047fff8300: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa + 0x0c047fff8310: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa + 0x0c047fff8320: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fd + 0x0c047fff8330: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff8340: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa +=>0x0c047fff8350: fa fa[02]fa fa fa fd fa fa fa fd fa fa fa fa fa + 0x0c047fff8360: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8370: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8390: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff83a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-997.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-997.txt new file mode 100644 index 000000000..5301301ef --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2023-997.txt @@ -0,0 +1,75 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1278023900 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x607000000145 at pc 0x00000147faa4 bp 0x7ffc49091270 sp 0x7ffc49091268 +READ of size 1 at 0x607000000145 thread T0 + #0 0x147faa3 in cquote /src/libredwg/src/out_dxf.c:1188:19 + #1 0x147faa3 in dxf_fixup_string /src/libredwg/src/out_dxf.c:1246:31 + #2 0x1604def in dwg_dxf_LAYOUT_private /src/libredwg/src/./dwg.spec:5664:3 + #3 0x157fabe in dwg_dxf_LAYOUT /src/libredwg/src/./dwg.spec:5590:1 + #4 0x150f6af in dwg_dxf_object /src/libredwg/src/out_dxf.c + #5 0x14883ed in dxf_objects_write /src/libredwg/src/out_dxf.c:3700:18 + #6 0x14883ed in dwg_write_dxf /src/libredwg/src/out_dxf.c:3788:13 + #7 0x56ce19 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:202:7 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x43ea25 in fuzzer::Fuzzer::TryDetectingAMemoryLeak(unsigned char const*, unsigned long, bool) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:687:3 + #10 0x4296ae in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:8 + #11 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fdbd440f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #14 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x607000000145 is located 0 bytes to the right of 69-byte region [0x607000000100,0x607000000145) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x57e56d in bit_read_TV /src/libredwg/src/bits.c:1733:28 + #2 0xa807aa in dwg_decode_LAYOUT_private /src/libredwg/src/./dwg.spec:5664:3 + #3 0x775ca9 in dwg_decode_LAYOUT /src/libredwg/src/./dwg.spec:5590:1 + #4 0x7663b0 in dwg_decode_add_object /src/libredwg/src/decode.c + #5 0x5a2396 in decode_R13_R2000 /src/libredwg/src/decode.c:858:19 + #6 0x590c38 in dwg_decode /src/libredwg/src/decode.c:230:12 + #7 0x56c827 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x43ea25 in fuzzer::Fuzzer::TryDetectingAMemoryLeak(unsigned char const*, unsigned long, bool) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:687:3 + #10 0x4296ae in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:8 + #11 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fdbd440f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/out_dxf.c:1188:19 in cquote +Shadow bytes around the buggy address: + 0x0c0e7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff8000: fa fa fa fa 00 00 00 00 00 00 00 00 00 fa fa fa + 0x0c0e7fff8010: fa fa fd fd fd fd fd fd fd fd fd fa fa fa fa fa +=>0x0c0e7fff8020: 00 00 00 00 00 00 00 00[05]fa fa fa fa fa fa fa + 0x0c0e7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2024-123.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2024-123.txt new file mode 100644 index 000000000..3d14fa554 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2024-123.txt @@ -0,0 +1,77 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1281932155 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f38bc7ff780 at pc 0x000003f401c7 bp 0x7ffc3932d550 sp 0x7ffc3932d548 +READ of size 8 at 0x7f38bc7ff780 thread T0 + #0 0x3f401c6 in dxf_tables_read /src/libredwg/src/in_dxf.c:11853:33 + #1 0x3f2e707 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12869:23 + #2 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #3 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #4 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #5 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #6 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #7 0x7f38bd101082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #8 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x7f38bc7ff780 is located 188288 bytes inside of 188416-byte region [0x7f38bc7d1800,0x7f38bc7ff800) +freed by thread T0 here: + #0 0x52f49c in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x764930 in dwg_add_object /src/libredwg/src/decode.c:5120:35 + #2 0x3f4dea1 in new_object /src/libredwg/src/in_dxf.c:8665:7 + #3 0x3f3d8cf in dxf_tables_read /src/libredwg/src/in_dxf.c:11832:22 + #4 0x3f2e707 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12869:23 + #5 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f38bd101082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +previously allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x7649fc in dwg_add_object /src/libredwg/src/decode.c:5109:35 + #2 0x3f2d993 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12805:7 + #3 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f38bd101082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/libredwg/src/in_dxf.c:11853:33 in dxf_tables_read +Shadow bytes around the buggy address: + 0x0fe7978f7ea0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0fe7978f7eb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0fe7978f7ec0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0fe7978f7ed0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0fe7978f7ee0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0fe7978f7ef0:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0fe7978f7f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fe7978f7f10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fe7978f7f20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fe7978f7f30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0fe7978f7f40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2024-38.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2024-38.txt new file mode 100644 index 000000000..a4d56c73f --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2024-38.txt @@ -0,0 +1,64 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1281379120 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000000140 at pc 0x0000040089ef bp 0x7ffd40217c30 sp 0x7ffd40217c28 +WRITE of size 2 at 0x611000000140 thread T0 + #0 0x40089ee in json_HEADER /src/libredwg/src/in_json.c:1264:23 + #1 0x400096e in dwg_read_json /src/libredwg/src/in_json.c:5131:18 + #2 0x56c92f in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:116:11 + #3 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #4 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #5 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #6 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #7 0x7f7a578cb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #8 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x611000000140 is located 0 bytes to the right of 256-byte region [0x611000000040,0x611000000140) +allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x4007972 in json_HEADER /src/libredwg/src/in_json.c:1259:44 + #2 0x400096e in dwg_read_json /src/libredwg/src/in_json.c:5131:18 + #3 0x56c92f in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:116:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f7a578cb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/in_json.c:1264:23 in json_HEADER +Shadow bytes around the buggy address: + 0x0c227fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c227fff8020: 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa + 0x0c227fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2024-384.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2024-384.txt new file mode 100644 index 000000000..f2e453287 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2024-384.txt @@ -0,0 +1,80 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1282261756 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x607000000100 at pc 0x00000052e4dc bp 0x7fff151df490 sp 0x7fff151dec60 +WRITE of size 11 at 0x607000000100 thread T0 + #0 0x52e4db in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x404b2d8 in memcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34:10 + #2 0x404b2d8 in json_fixed_string /src/libredwg/src/in_json.c:490:11 + #3 0x401dec7 in json_R2004_Header /src/libredwg/src/in_json.c:3775:21 + #4 0x4000bd9 in dwg_read_json /src/libredwg/src/in_json.c:5143:18 + #5 0x56c92f in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:116:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f622d88d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x607000000100 is located 0 bytes inside of 75-byte region [0x607000000100,0x60700000014b) +freed by thread T0 here: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x404b245 in json_fixed_string /src/libredwg/src/in_json.c:476:15 + #2 0x401dec7 in json_R2004_Header /src/libredwg/src/in_json.c:3775:21 + #3 0x4000bd9 in dwg_read_json /src/libredwg/src/in_json.c:5143:18 + #4 0x56c92f in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:116:11 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f622d88d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +previously allocated by thread T0 here: + #0 0x52f49c in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x404ad58 in json_fixed_string /src/libredwg/src/in_json.c:479:25 + #2 0x401dec7 in json_R2004_Header /src/libredwg/src/in_json.c:3775:21 + #3 0x4000bd9 in dwg_read_json /src/libredwg/src/in_json.c:5143:18 + #4 0x56c92f in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:116:11 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f622d88d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c0e7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff8000: fa fa fa fa 00 00 00 00 00 00 00 00 00 fa fa fa + 0x0c0e7fff8010: fa fa fd fd fd fd fd fd fd fd fd fa fa fa fa fa +=>0x0c0e7fff8020:[fd]fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa + 0x0c0e7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2024-42.txt b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2024-42.txt new file mode 100644 index 000000000..0c8586da1 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/crashes/OSV-2024-42.txt @@ -0,0 +1,53 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1281661397 +INFO: Loaded 1 modules (644338 inline 8-bit counters): 644338 [0x52b4fc0, 0x53524b2), +INFO: Loaded 1 PC tables (644338 PCs): 644338 [0x4634d18,0x5009c38), +/out/llvmfuzz: Running 1 inputs 5 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: attempting double-free on 0x602000000350 in thread T0: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x135f55f in dwg_free_common_entity_data /src/libredwg/src/free.c:417:3 + #2 0x12582d7 in dwg_free_PLANESURFACE /src/libredwg/src/./dwg.spec:9792:1 + #3 0x124d929 in dwg_free_variable_no_class /src/libredwg/src/./objects.inc:75:1 + #4 0x127d56b in dwg_free_variable_type /src/libredwg/src/free.c + #5 0x135349a in dwg_free_object /src/libredwg/src/free.c:1267:25 + #6 0x13556a3 in dwg_free /src/libredwg/src/free.c:1689:13 + #7 0x56cab3 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:136:11 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7efef920d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #13 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +0x602000000350 is located 0 bytes inside of 8-byte region [0x602000000350,0x602000000358) +freed by thread T0 here: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x3f75546 in dxf_free_pair /src/libredwg/src/in_dxf.c + #2 0x3f75546 in new_object /src/libredwg/src/in_dxf.c:11749:7 + #3 0x3f42ac1 in dxf_blocks_read /src/libredwg/src/in_dxf.c:12073:22 + #4 0x3f2e8e5 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12904:23 + #5 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7efef920d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +previously allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x3f4c788 in dxf_read_string /src/libredwg/src/in_dxf.c:549:27 + #2 0x3f306bf in dxf_read_pair /src/libredwg/src/in_dxf.c:633:7 + #3 0x3f4db0f in new_object /src/libredwg/src/in_dxf.c:8569:20 + #4 0x3f42ac1 in dxf_blocks_read /src/libredwg/src/in_dxf.c:12073:22 + #5 0x3f2e8e5 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12904:23 + #6 0x56ca62 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:132:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7efef920d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: double-free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 in free +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/COMMANDS.md b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/COMMANDS.md new file mode 100644 index 000000000..991ec216f --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/COMMANDS.md @@ -0,0 +1,207 @@ +# Original Crash Collection: libredwg llvmfuzz + +Generated: 2026-04-24 UTC + +Benchmark: `libredwg_transplant_llvmfuzz` +Project: `libredwg` +Fuzzer: `llvmfuzz` +Sanitizer: `address` + +Target source commit: `a67ea97d93998f35d6494c96118c60c5f1aee4e9` (2023-10-29) +Target-era base-runner: `gcr.io/oss-fuzz-base/base-runner@sha256:3a190cfbada024425c48aebd06558a0e974e819f69625e886b1fe2b1a138064d` (2022-07) + +## Semantics + +Each `OSV-*.txt` is a crash on the pristine source tree: +- **Local bugs** (already triggering at target) replayed against the NAS prebuilt + `-address` binary at target commit (`a67ea97d9399`) with the target-era base-runner. +- **Migration bugs** copied from `/mnt/nas/linke/new_migrate/libredwg/llvmfuzz/crash/`, + captured per-bug by the migration pipeline with era-matched runner per source commit. + +Note: 2 bugs (`OSV-2021-495`, `OSV-2023-416`) were **dropped** from this +benchmark on 2026-05-26 (`total_bugs` 65 → 63). They were misclassified by +the migration pipeline as already-triggering at target but neither PoC +actually crashes at target `a67ea97d` (clean exit in <50 ms) or on the +merged binary. Two transplant attempts produced no usable diff. See +`/mnt/nas/linke/new_migrate/libredwg/llvmfuzz/dropped_bugs.md` for the +full diagnostic notes and captured introduced-commit crash signatures. + +Note: `libredwg_builds.csv` contains 409 rows but does not cover every source commit +used here; rows in `collect_crash_builds.csv` with `oss_fuzz_commit=auto` defer to +`fuzz_helper.py collect_crash --runner-image auto --commit-date ` to pick era- +matched images at reproduction time. + +## Bug → source commit / OSS-Fuzz commit + +| Bug | Kind | Source commit | OSS-Fuzz commit | +| --- | --- | --- | --- | +| OSV-2021-493 | migration | `ea0b9522f63d` | `3a564d9f11a1` | +| OSV-2021-535 | migration | `837c8bf8c486` | `a517dca16725` | +| OSV-2021-543 | migration | `084083ce54e5` | `4dc731cfacc6` | +| OSV-2021-577 | migration | `85b1abf3aad0` | `3a4e6e4484a1` | +| OSV-2021-620 | migration | `376c4f69a4e6` | `f93b8506e826` | +| OSV-2021-771 | migration | `d31d11b8df12` | `fd772dcbb51c` | +| OSV-2021-814 | migration | `98a95f7de998` | `0aac0529ada6` | +| OSV-2022-1180 | migration | `a06d461bf19a` | `b33da1891377` | +| OSV-2022-1211 | migration | `a06d461bf19a` | `b33da1891377` | +| OSV-2022-1251 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2022-1252 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2022-128 | migration | `376c4f69a4e6` | `f93b8506e826` | +| OSV-2022-129 | migration | `d31d11b8df12` | `fd772dcbb51c` | +| OSV-2022-363 | migration | `c71fbe25cba8` | `97d0732562d2` | +| OSV-2022-377 | migration | `c463afbab3a4` | `f93b8506e826` | +| OSV-2022-387 | migration | `c71fbe25cba8` | `97d0732562d2` | +| OSV-2022-398 | migration | `a06d461bf19a` | `b33da1891377` | +| OSV-2022-403 | migration | `98729e9d56bd` | `dbf4d1181ac4` | +| OSV-2022-654 | migration | `9a98686f3f54` | `dfede1ec348a` | +| OSV-2022-656 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2022-657 | migration | `24faedf968fc` | `a7f41820024a` | +| OSV-2022-664 | migration | `a06d461bf19a` | `b33da1891377` | +| OSV-2023-1048 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-1051 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-1063 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-1099 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-1101 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-1104 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-1110 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-1122 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-1149 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-1186 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-135 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-269 | migration | `a8bc5d06cbb5` | `19831c6fc569` | +| OSV-2023-270 | migration | `a8bc5d06cbb5` | `19831c6fc569` | +| OSV-2023-271 | migration | `a8bc5d06cbb5` | `19831c6fc569` | +| OSV-2023-284 | migration | `8f3afc1b98de` | `5b0c0f3b0b54` | +| OSV-2023-314 | migration | `f4a639a97838` | `7ecfd475b6b1` | +| OSV-2023-316 | migration | `1c722dabc26a` | `9fc1908fc15d` | +| OSV-2023-397 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-412 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-415 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-42 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-440 | migration | `8c36b98d4308` | `eb1862cc1373` | +| OSV-2023-452 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-455 | migration | `bf11fad98f6f` | `1b179522218a` | +| OSV-2023-46 | migration | `919f9faa3094` | `11c63707a20a` | +| OSV-2023-634 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-717 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-748 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-758 | migration | `8c36b98d4308` | `eb1862cc1373` | +| OSV-2023-777 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-811 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-850 | migration | `336fa3944463` | `750c28088587` | +| OSV-2023-855 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-874 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-894 | migration | `b4bf31ac7357` | `2128769e2286` | +| OSV-2023-965 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2023-997 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2024-123 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2024-38 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2024-384 | local | `a67ea97d9399` | `85ca9895ba29` | +| OSV-2024-42 | local | `a67ea97d9399` | `85ca9895ba29` | + +## Re-run command (migration bugs) + +```bash +BUILD_CSV='/home/user/oss-fuzz-build/fuzzbench/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/collect_crash_builds.csv' +OUT_DIR='/home/user/oss-fuzz-build/fuzzbench/benchmarks/libredwg_transplant_llvmfuzz/original-crashes' + +while IFS=$'\t' read -r bug commit; do + [ "$bug" = "bug" ] && continue + ts=$(git -C /home/user/tasks-git/libredwg log -1 --format=%ct "$commit") + /home/user/pyenv/venv/bin/python3 /home/user/oss-fuzz-for-select/script/fuzz_helper.py collect_crash \ + --commit "$commit" --build_csv "$BUILD_CSV" \ + --testcases /home/user/oss-fuzz-for-select/pocs/tmp --test_input "testcase-${bug}" \ + --runner-image auto --commit-date "$ts" \ + libredwg llvmfuzz + cp "/home/user/oss-fuzz-build/data/crash/target_crash-${commit:0:6}-testcase-${bug}.txt" "${OUT_DIR}/${bug}.txt" +done <<'JOBS' +bug commit +OSV-2021-493 ea0b9522f63d049ded2c3cff8d9a8c360119951c +OSV-2021-535 837c8bf8c486da9f39313e06750a5b257af09db8 +OSV-2021-543 084083ce54e59b5a43e6eb936868ef4bd037c7e2 +OSV-2021-577 85b1abf3aad0add9336c5876ea892013aa63e4e6 +OSV-2021-620 376c4f69a4e6590c63c4b4df6a9ff76a357aff36 +OSV-2021-771 d31d11b8df12fd480239f1e4f502b94ac8ea2103 +OSV-2021-814 98a95f7de998e21e668f3ee956df21f4c52ae5d0 +OSV-2022-1180 a06d461bf19a9542204ad9761f2b38dc57c9d23d +OSV-2022-1211 a06d461bf19a9542204ad9761f2b38dc57c9d23d +OSV-2022-128 376c4f69a4e6590c63c4b4df6a9ff76a357aff36 +OSV-2022-129 d31d11b8df12fd480239f1e4f502b94ac8ea2103 +OSV-2022-363 c71fbe25cba8bfe6b0ef9aee2982cf2c5d53efe5 +OSV-2022-377 c463afbab3a48532f2bf1a79bdb8ab046d5b3065 +OSV-2022-387 c71fbe25cba8bfe6b0ef9aee2982cf2c5d53efe5 +OSV-2022-398 a06d461bf19a9542204ad9761f2b38dc57c9d23d +OSV-2022-403 98729e9d56bd5e8e0530de39d955dc838803cbb2 +OSV-2022-654 9a98686f3f54f6e8450056ec846f82c71a4777e1 +OSV-2022-657 24faedf968fc32f563b596d3621d086696958a8b +OSV-2022-664 a06d461bf19a9542204ad9761f2b38dc57c9d23d +OSV-2023-269 a8bc5d06cbb503f88958e45338bfebdee9baf0fd +OSV-2023-270 a8bc5d06cbb503f88958e45338bfebdee9baf0fd +OSV-2023-271 a8bc5d06cbb503f88958e45338bfebdee9baf0fd +OSV-2023-284 8f3afc1b98de37e9263ed91dd300daa877b7e5df +OSV-2023-314 f4a639a97838b982f3db11e0ab16e9c33bb05167 +OSV-2023-316 1c722dabc26a3b91e3bb5b4cb8f480c4b5bb900b +OSV-2023-440 8c36b98d4308bc28a1fed434faef6e51d75ca566 +OSV-2023-455 bf11fad98f6f3af66eac0aa86efdd4e9deb30c9d +OSV-2023-46 919f9faa30942269ba453ae563a0d376b290d861 +OSV-2023-758 8c36b98d4308bc28a1fed434faef6e51d75ca566 +OSV-2023-850 336fa39444631a5eb27fcf9311ff08098a45aa24 +OSV-2023-894 b4bf31ac73570ac19a6ca9f753bdf979c5f625f7 +JOBS +``` + +## Re-run command (local bugs) + +```bash +TARGET=a67ea97d93998f35d6494c96118c60c5f1aee4e9 +RUNNER_IMAGE='gcr.io/oss-fuzz-base/base-runner@sha256:3a190cfbada024425c48aebd06558a0e974e819f69625e886b1fe2b1a138064d' +BIN_DIR="/mnt/nas/linke/libredwg/libredwg-${TARGET}-address" +OUT_DIR='/home/user/oss-fuzz-build/fuzzbench/benchmarks/libredwg_transplant_llvmfuzz/original-crashes' + +# Most local bugs trigger on -runs=1; a few need -runs=10 (libFuzzer's leak detection re-exec). +for bug in \ + OSV-2022-1251 \ + OSV-2022-1252 \ + OSV-2022-656 \ + OSV-2023-1048 \ + OSV-2023-1051 \ + OSV-2023-1063 \ + OSV-2023-1099 \ + OSV-2023-1101 \ + OSV-2023-1104 \ + OSV-2023-1110 \ + OSV-2023-1122 \ + OSV-2023-1149 \ + OSV-2023-1186 \ + OSV-2023-135 \ + OSV-2023-397 \ + OSV-2023-412 \ + OSV-2023-415 \ + OSV-2023-42 \ + OSV-2023-452 \ + OSV-2023-634 \ + OSV-2023-717 \ + OSV-2023-748 \ + OSV-2023-777 \ + OSV-2023-811 \ + OSV-2023-855 \ + OSV-2023-874 \ + OSV-2023-965 \ + OSV-2023-997 \ + OSV-2024-123 \ + OSV-2024-38 \ + OSV-2024-384 \ + OSV-2024-42 +; do + TMPD=$(mktemp -d) + cp /home/user/oss-fuzz-for-select/pocs/tmp/testcase-${bug} "$TMPD/" + docker run --rm --platform linux/amd64 --shm-size=2g \ + -v "$BIN_DIR":/out:ro -v "$TMPD":/corpus:ro \ + -e ASAN_OPTIONS=abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 \ + "$RUNNER_IMAGE" \ + /out/llvmfuzz "/corpus/testcase-${bug}" -rss_limit_mb=8192 -runs=10 \ + > "${OUT_DIR}/${bug}.txt" 2>&1 + rm -rf "$TMPD" +done +``` + diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2021-493.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2021-493.txt new file mode 100755 index 000000000..af4b384eb --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2021-493.txt @@ -0,0 +1,71 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1764234454 +INFO: Loaded 1 modules (405333 inline 8-bit counters): 405333 [0x55d4512d2240, 0x55d451335195), +INFO: Loaded 1 PC tables (405333 PCs): 405333 [0x55d451335198,0x55d4519646e8), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2021-493 +================================================================= +==7091==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7ba6f0de9f94 at pc 0x55d450321bd2 bp 0x7fffbab8f470 sp 0x7fffbab8f468 +READ of size 4 at 0x7ba6f0de9f94 thread T0 + #0 0x55d450321bd1 in encode_3dsolid /src/libredwg/src/./dwg.spec:2152:27 + #1 0x55d45030eeb8 in dwg_encode_REGION_private /src/libredwg/src/./dwg.spec:2349:3 + #2 0x55d4501a358a in dwg_encode_REGION /src/libredwg/src/./dwg.spec:2348:1 + #3 0x55d450198206 in dwg_encode_add_object /src/libredwg/src/encode.c:3586:15 + #4 0x55d45013a3dc in dwg_encode /src/libredwg/src/encode.c:2316:16 + #5 0x55d44ea41743 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:157:11 + #6 0x55d44e8dfecd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x55d44e8cac42 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x55d44e8d0b10 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x55d44e8fc642 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f86f185b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x55d44e8c3d2d in _start (/out/llvmfuzz+0xbb5d2d) + +0x7ba6f0de9f94 is located 0 bytes after 4-byte region [0x7ba6f0de9f90,0x7ba6f0de9f94) +allocated by thread T0 here: + #0 0x55d44e9fec0c in realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:81:3 + #1 0x55d44ecd60b2 in decode_3dsolid /src/libredwg/src/./dwg.spec:2002:17 + #2 0x55d44ecbd0d3 in dwg_decode_REGION_private /src/libredwg/src/./dwg.spec:2349:3 + #3 0x55d44eb41bad in dwg_decode_REGION /src/libredwg/src/./dwg.spec:2348:1 + #4 0x55d44eb38278 in dwg_decode_add_object /src/libredwg/src/decode.c:5675:15 + #5 0x55d44ea63221 in decode_R13_R2000 /src/libredwg/src/decode.c:1322:19 + #6 0x55d44ea5698b in dwg_decode /src/libredwg/src/decode.c:239:36 + #7 0x55d44ea413e0 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:86:13 + #8 0x55d44e8dfecd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #9 0x55d44e8cac42 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #10 0x55d44e8d0b10 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #11 0x55d44e8fc642 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f86f185b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/./dwg.spec:2152:27 in encode_3dsolid +Shadow bytes around the buggy address: + 0x7ba6f0de9d00: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 01 fa + 0x7ba6f0de9d80: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 01 fa + 0x7ba6f0de9e00: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 01 fa + 0x7ba6f0de9e80: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 01 fa + 0x7ba6f0de9f00: fa fa 01 fa fa fa 00 fa fa fa 01 fa fa fa 00 fa +=>0x7ba6f0de9f80: fa fa[04]fa fa fa 01 fa fa fa 01 fa fa fa 01 fa + 0x7ba6f0dea000: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 01 fa + 0x7ba6f0dea080: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 00 00 + 0x7ba6f0dea100: fa fa 01 fa fa fa 00 00 fa fa 01 fa fa fa 00 00 + 0x7ba6f0dea180: fa fa 01 fa fa fa 00 00 fa fa 01 fa fa fa 00 00 + 0x7ba6f0dea200: fa fa 01 fa fa fa 00 00 fa fa 01 fa fa fa 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7091==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2021-535.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2021-535.txt new file mode 100755 index 000000000..01810b07e --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2021-535.txt @@ -0,0 +1,71 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 915393323 +INFO: Loaded 1 modules (482642 inline 8-bit counters): 482642 [0x55917146e280, 0x5591714e3fd2), +INFO: Loaded 1 PC tables (482642 PCs): 482642 [0x5591714e3fd8,0x559171c414f8), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2021-535 +================================================================= +==7141==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7be194fe0e78 at pc 0x55917039b502 bp 0x7ffe6f65fe30 sp 0x7ffe6f65fe28 +READ of size 4 at 0x7be194fe0e78 thread T0 + #0 0x55917039b501 in encode_3dsolid /src/libredwg/src/./dwg.spec:2165:27 + #1 0x5591703af928 in dwg_encode_BODY_private /src/libredwg/src/./dwg.spec:2372:3 + #2 0x5591702195c1 in dwg_encode_BODY /src/libredwg/src/./dwg.spec:2371:1 + #3 0x55917020ad88 in dwg_encode_add_object /src/libredwg/src/encode.c:3628:15 + #4 0x5591701aaf84 in dwg_encode /src/libredwg/src/encode.c:2352:16 + #5 0x55916e218711 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:175:11 + #6 0x55916e0b6ecd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x55916e0a1c42 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x55916e0a7b10 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x55916e0d3642 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fc195b0d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x55916e09ad2d in _start (/out/llvmfuzz+0xd91d2d) + +0x7be194fe0e78 is located 0 bytes after 8-byte region [0x7be194fe0e70,0x7be194fe0e78) +allocated by thread T0 here: + #0 0x55916e1d5c0c in realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:81:3 + #1 0x55916e4a59dd in decode_3dsolid /src/libredwg/src/./dwg.spec:2005:17 + #2 0x55916e4c0ccf in dwg_decode_BODY_private /src/libredwg/src/./dwg.spec:2372:3 + #3 0x55916e31318d in dwg_decode_BODY /src/libredwg/src/./dwg.spec:2371:1 + #4 0x55916e308fd2 in dwg_decode_add_object /src/libredwg/src/decode.c:5715:15 + #5 0x55916e236a84 in decode_R13_R2000 /src/libredwg/src/decode.c:1342:19 + #6 0x55916e22dbfb in dwg_decode /src/libredwg/src/decode.c:246:36 + #7 0x55916e2183cb in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:90:13 + #8 0x55916e0b6ecd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #9 0x55916e0a1c42 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #10 0x55916e0a7b10 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #11 0x55916e0d3642 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7fc195b0d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/./dwg.spec:2165:27 in encode_3dsolid +Shadow bytes around the buggy address: + 0x7be194fe0b80: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fd + 0x7be194fe0c00: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa + 0x7be194fe0c80: fa fa fd fd fa fa fd fd fa fa fd fa fa fa 00 00 + 0x7be194fe0d00: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 01 fa + 0x7be194fe0d80: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa fd fa +=>0x7be194fe0e00: fa fa fd fa fa fa 00 03 fa fa 00 00 fa fa 00[fa] + 0x7be194fe0e80: fa fa fd fa fa fa fd fa fa fa 00 03 fa fa 00 00 + 0x7be194fe0f00: fa fa 00 fa fa fa fd fa fa fa fd fa fa fa 00 03 + 0x7be194fe0f80: fa fa 00 00 fa fa 00 fa fa fa fd fa fa fa fd fa + 0x7be194fe1000: fa fa 00 03 fa fa 00 00 fa fa 00 fa fa fa fd fa + 0x7be194fe1080: fa fa fd fa fa fa 00 03 fa fa 00 00 fa fa 00 fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7141==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2021-543.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2021-543.txt new file mode 100755 index 000000000..b16b2e1de --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2021-543.txt @@ -0,0 +1,77 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 64368202 +INFO: Loaded 1 modules (482650 inline 8-bit counters): 482650 [0x5647d780f260, 0x5647d7884fba), +INFO: Loaded 1 PC tables (482650 PCs): 482650 [0x5647d7884fc0,0x5647d7fe2560), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2021-543 +================================================================= +==7142==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c00906e01d0 at pc 0x5647d72ee778 bp 0x7ffee40711b0 sp 0x7ffee40711a8 +READ of size 2 at 0x7c00906e01d0 thread T0 + #0 0x5647d72ee777 in dxf_objects_read /src/libredwg/src/in_dxf.c:12267:36 + #1 0x5647d72e0de2 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12811:23 + #2 0x5647d45b94f6 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:116:13 + #3 0x5647d4457ecd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #4 0x5647d4442c42 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #5 0x5647d4448b10 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #6 0x5647d4474642 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #7 0x7fe091173082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #8 0x5647d443bd2d in _start (/out/llvmfuzz+0xd91d2d) + +0x7c00906e01d0 is located 0 bytes inside of 16-byte region [0x7c00906e01d0,0x7c00906e01e0) +freed by thread T0 here: + #0 0x5647d4576586 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3 + #1 0x5647d72ee19d in dxf_objects_read /src/libredwg/src/in_dxf.c:12284:15 + #2 0x5647d72e0de2 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12811:23 + #3 0x5647d45b94f6 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:116:13 + #4 0x5647d4457ecd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x5647d4442c42 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x5647d4448b10 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x5647d4474642 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fe091173082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +previously allocated by thread T0 here: + #0 0x5647d45769e9 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:74:3 + #1 0x5647d72db37a in xcalloc /src/libredwg/src/in_dxf.c:216:7 + #2 0x5647d72e1bc9 in dxf_read_pair /src/libredwg/src/in_dxf.c:522:32 + #3 0x5647d72ee460 in dxf_objects_read /src/libredwg/src/in_dxf.c:12288:14 + #4 0x5647d72e0de2 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12811:23 + #5 0x5647d45b94f6 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:116:13 + #6 0x5647d4457ecd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x5647d4442c42 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x5647d4448b10 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x5647d4474642 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fe091173082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/libredwg/src/in_dxf.c:12267:36 in dxf_objects_read +Shadow bytes around the buggy address: + 0x7c00906dff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c00906dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c00906e0000: fa fa 00 00 fa fa 00 fa fa fa 00 fa fa fa 00 fa + 0x7c00906e0080: fa fa 00 00 fa fa 00 05 fa fa 00 05 fa fa fd fd + 0x7c00906e0100: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fa +=>0x7c00906e0180: fa fa fd fd fa fa fd fd fa fa[fd]fd fa fa fd fa + 0x7c00906e0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c00906e0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c00906e0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c00906e0380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c00906e0400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7142==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2021-577.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2021-577.txt new file mode 100755 index 000000000..34d882057 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2021-577.txt @@ -0,0 +1,32 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3505315833 +INFO: Loaded 1 modules (482712 inline 8-bit counters): 482712 [0x5591322d9280, 0x55913234f018), +INFO: Loaded 1 PC tables (482712 PCs): 482712 [0x55913234f018,0x559132aac998), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2021-577 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==7141==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x55912fb6e2c5 bp 0x7ffc1c4e89c0 sp 0x7ffc1c4e8990 T0) +==7141==The signal is caused by a READ memory access. +==7141==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x55912fb6e2c5 in dwg_free_MTEXTATTRIBUTEOBJECTCONTEXTDATA_private /src/libredwg/src/./dwg.spec:9702:3 + #1 0x55912fab7d7c in dwg_free_MTEXTATTRIBUTEOBJECTCONTEXTDATA /src/libredwg/src/./dwg.spec:9700:1 + #2 0x55912fa96fb2 in dwg_free_variable_no_class /src/libredwg/src/./objects.inc:265:1 + #3 0x55912fb8ba53 in dwg_free_object /src/libredwg/src/free.c:862:25 + #4 0x55912fb8c79f in dwg_free /src/libredwg/src/free.c:1265:13 + #5 0x55912f08354f in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:13 + #6 0x55912ef21ecd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x55912ef0cc42 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x55912ef12b10 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x55912ef3e642 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fb29a991082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x55912ef05d2d in _start (/out/llvmfuzz+0xd91d2d) + +==7141==Register values: +rax = 0x07fe000000000003 rbx = 0x00007e5299ee02a8 rcx = 0x000000000000003f rdx = 0x0000559132c69a00 +rdi = 0x3ff0000000000018 rsi = 0x8000000000000000 rbp = 0x00007ffc1c4e89c0 rsp = 0x00007ffc1c4e8990 + r8 = 0x0000000000000004 r9 = 0x0000000000001b10 r10 = 0x0000000000000000 r11 = 0x0000559132c69a00 +r12 = 0x00000fca533dc069 r13 = 0x00000f86533dc046 r14 = 0x00007c3299ee0230 r15 = 0x3ff0000000000000 +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/libredwg/src/./dwg.spec:9702:3 in dwg_free_MTEXTATTRIBUTEOBJECTCONTEXTDATA_private +==7141==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2021-620.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2021-620.txt new file mode 100755 index 000000000..b6cc377b1 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2021-620.txt @@ -0,0 +1,33 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1681358153 +INFO: Loaded 1 modules (511161 inline 8-bit counters): 511161 [0x5621037e5cc0, 0x562103862979), +INFO: Loaded 1 PC tables (511161 PCs): 511161 [0x562103862980,0x56210402f510), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2021-620 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==7639==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x562100184be3 bp 0x000000000001 sp 0x7fff52532800 T0) +==7639==The signal is caused by a READ memory access. +==7639==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x562100184be3 in atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t> /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:97:10 + #1 0x562100184be3 in AtomicallySetQuarantineFlagIfAllocated /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:674:10 + #2 0x562100184be3 in __asan::Allocator::Deallocate(void*, unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType) /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:738:10 + #3 0x5621002255f6 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #4 0x562100e8b7fb in dwg_free_summaryinfo /src/libredwg/src/./summaryinfo.spec:54:5 + #5 0x562100e85b65 in dwg_free /src/libredwg/src/free.c:1518:7 + #6 0x562100268556 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:13 + #7 0x562100106edd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x5621000f1c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x5621000f7b20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x562100123652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f340f4cb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x5621000ead3d in _start (/out/llvmfuzz+0xe5cd3d) + +==7639==Register values: +rax = 0x0000000000000002 rbx = 0x00007fff52532858 rcx = 0x0000562100104903 rdx = 0x0000000000000000 +rdi = 0xbebebebebebebebe rsi = 0xbebebebebebebebe rbp = 0x0000000000000001 rsp = 0x00007fff52532800 + r8 = 0x00007fff52532858 r9 = 0x0000000000000001 r10 = 0x0000000000000000 r11 = 0x0000000000000008 +r12 = 0x000056210423fac8 r13 = 0xbebebebebebebeae r14 = 0xbebebebebebebebe r15 = 0x0000000000000000 +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/libredwg/src/./summaryinfo.spec:54:5 in dwg_free_summaryinfo +==7639==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2021-771.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2021-771.txt new file mode 100755 index 000000000..0a1899287 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2021-771.txt @@ -0,0 +1,83 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 954845282 +INFO: Loaded 1 modules (488069 inline 8-bit counters): 488069 [0x5592424ed4c0, 0x559242564745), +INFO: Loaded 1 PC tables (488069 PCs): 488069 [0x559242564748,0x559242cd6f98), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2021-771 +================================================================= +==7228==ERROR: AddressSanitizer: heap-use-after-free on address 0x7bcd77de1410 at pc 0x55923fd5608e bp 0x7fff415c22d0 sp 0x7fff415c22c8 +READ of size 8 at 0x7bcd77de1410 thread T0 + #0 0x55923fd5608d in dwg_free_TABLEGEOMETRY_private /src/libredwg/src/./dwg.spec:6360:7 + #1 0x55923fc908af in dwg_free_TABLEGEOMETRY /src/libredwg/src/./dwg.spec:6345:1 + #2 0x55923fd61284 in dwg_free_object /src/libredwg/src/free.c:863:25 + #3 0x55923fd6217f in dwg_free /src/libredwg/src/free.c:1266:13 + #4 0x55923f23f56a in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:13 + #5 0x55923f0ddedd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #6 0x55923f0c8c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #7 0x55923f0ceb20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #8 0x55923f0fa652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fad788ce082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x55923f0c1d3d in _start (/out/llvmfuzz+0xdbdd3d) + +0x7bcd77de1410 is located 0 bytes inside of 16-byte region [0x7bcd77de1410,0x7bcd77de1420) +freed by thread T0 here: + #0 0x55923f1fc596 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3 + #1 0x559242093707 in add_TABLEGEOMETRY_Cell /src/libredwg/src/in_dxf.c:5280:7 + #2 0x559241fd344f in new_object /src/libredwg/src/in_dxf.c:11745:26 + #3 0x559241fb4a51 in dxf_blocks_read /src/libredwg/src/in_dxf.c:12136:22 + #4 0x559241fa9d9c in dwg_read_dxf /src/libredwg/src/in_dxf.c:12904:23 + #5 0x55923f23f511 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:116:13 + #6 0x55923f0ddedd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x55923f0c8c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x55923f0ceb20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x55923f0fa652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fad788ce082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +previously allocated by thread T0 here: + #0 0x55923f1fc9f9 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:74:3 + #1 0x559241fa43ea in xcalloc /src/libredwg/src/in_dxf.c:227:7 + #2 0x559241faac49 in dxf_read_pair /src/libredwg/src/in_dxf.c:564:32 + #3 0x559242093710 in add_TABLEGEOMETRY_Cell /src/libredwg/src/in_dxf.c:5281:14 + #4 0x559241fd344f in new_object /src/libredwg/src/in_dxf.c:11745:26 + #5 0x559241fb4a51 in dxf_blocks_read /src/libredwg/src/in_dxf.c:12136:22 + #6 0x559241fa9d9c in dwg_read_dxf /src/libredwg/src/in_dxf.c:12904:23 + #7 0x55923f23f511 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:116:13 + #8 0x55923f0ddedd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #9 0x55923f0c8c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #10 0x55923f0ceb20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #11 0x55923f0fa652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7fad788ce082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/libredwg/src/./dwg.spec:6360:7 in dwg_free_TABLEGEOMETRY_private +Shadow bytes around the buggy address: + 0x7bcd77de1180: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fd + 0x7bcd77de1200: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fd + 0x7bcd77de1280: fa fa 00 06 fa fa fd fd fa fa fd fa fa fa 01 fa + 0x7bcd77de1300: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fa + 0x7bcd77de1380: fa fa 00 00 fa fa fd fd fa fa fd fa fa fa 01 fa +=>0x7bcd77de1400: fa fa[fd]fd fa fa fd fa fa fa fd fd fa fa fd fa + 0x7bcd77de1480: fa fa fd fd fa fa fd fd fa fa 00 00 fa fa fd fd + 0x7bcd77de1500: fa fa fd fd fa fa fd fd fa fa fa fa fa fa fa fa + 0x7bcd77de1580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bcd77de1600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bcd77de1680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7228==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2021-814.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2021-814.txt new file mode 100755 index 000000000..22738485a --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2021-814.txt @@ -0,0 +1,34 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2657721326 +INFO: Loaded 1 modules (483127 inline 8-bit counters): 483127 [0x564862e24280, 0x564862e9a1b7), +INFO: Loaded 1 PC tables (483127 PCs): 483127 [0x564862e9a1b8,0x5648635f9528), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2021-814 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==7209==ERROR: AddressSanitizer: SEGV on unknown address 0x7c16986dfff0 (pc 0x56485fb11bd3 bp 0x000000000001 sp 0x7ffee5d9f350 T0) +==7209==The signal is caused by a WRITE memory access. + #0 0x56485fb11bd3 in atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t> /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:97:10 + #1 0x56485fb11bd3 in AtomicallySetQuarantineFlagIfAllocated /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:674:10 + #2 0x56485fb11bd3 in __asan::Allocator::Deallocate(void*, unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType) /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:738:10 + #3 0x56485fbb25e6 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #4 0x56486064ae6c in dwg_free_BLOCK_private /src/libredwg/src/./dwg.spec:476:3 + #5 0x56486060bab2 in dwg_free_BLOCK /src/libredwg/src/./dwg.spec:473:1 + #6 0x5648606fe0f5 in dwg_free_object /src/libredwg/src/free.c:624:7 + #7 0x5648606ff40f in dwg_free /src/libredwg/src/free.c:1265:13 + #8 0x56485fbf554f in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:13 + #9 0x56485fa93ecd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #10 0x56485fa7ec42 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #11 0x56485fa84b10 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #12 0x56485fab0642 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7ff69914b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #14 0x56485fa77d2d in _start (/out/llvmfuzz+0xd95d2d) + +==7209==Register values: +rax = 0x0000000000000002 rbx = 0x00007ffee5d9f3a8 rcx = 0x000056485fa91903 rdx = 0x0000000000000000 +rdi = 0x00007c16986e0000 rsi = 0x00007c16986e0000 rbp = 0x0000000000000001 rsp = 0x00007ffee5d9f350 + r8 = 0x00007ffee5d9f3a8 r9 = 0x0000000000000001 r10 = 0x0000000000000000 r11 = 0x000000000000000a +r12 = 0x00005648637ebcc8 r13 = 0x00007c16986dfff0 r14 = 0x00007c16986e0000 r15 = 0x0000000000000000 +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/libredwg/src/./dwg.spec:476:3 in dwg_free_BLOCK_private +==7209==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-1180.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-1180.txt new file mode 100755 index 000000000..5dabbf713 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-1180.txt @@ -0,0 +1,70 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3269242603 +INFO: Loaded 1 modules (511201 inline 8-bit counters): 511201 [0x557d0c8dbcc0, 0x557d0c9589a1), +INFO: Loaded 1 PC tables (511201 PCs): 511201 [0x557d0c9589a8,0x557d0d1257b8), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-1180 +================================================================= +==7638==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b8978ae3e00 at pc 0x557d0ada5a7d bp 0x7ffe80dac870 sp 0x7ffe80dac868 +READ of size 8 at 0x7b8978ae3e00 thread T0 + #0 0x557d0ada5a7c in json_common_entity_data /src/libredwg/src/./common_entity_handle_data.spec:50:7 + #1 0x557d0ad84795 in dwg_json_LOAD /src/libredwg/src/./dwg.spec:11032:1 + #2 0x557d0ad3b2be in dwg_json_object /src/libredwg/src/out_json.c:1717:14 + #3 0x557d0ac9a98b in json_objects_write /src/libredwg/src/out_json.c:2082:15 + #4 0x557d0ac963a9 in dwg_write_json /src/libredwg/src/out_json.c:2383:7 + #5 0x557d0935c6c6 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:191:11 + #6 0x557d091faedd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x557d091e5c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x557d091ebb20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x557d09217652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f0979602082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x557d091ded3d in _start (/out/llvmfuzz+0xe5dd3d) + +0x7b8978ae3e00 is located 8 bytes after 88-byte region [0x7b8978ae3da0,0x7b8978ae3df8) +allocated by thread T0 here: + #0 0x557d093199f9 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:74:3 + #1 0x557d0941584f in dwg_setup_LAYOUT /src/libredwg/src/./dwg.spec:5069:1 + #2 0x557d0946abd5 in dwg_decode_LAYOUT /src/libredwg/src/./dwg.spec:5069:1 + #3 0x557d0945a985 in dwg_decode_add_object /src/libredwg/src/decode.c + #4 0x557d0937bbe4 in decode_R13_R2000 /src/libredwg/src/decode.c:738:19 + #5 0x557d0937224a in dwg_decode /src/libredwg/src/decode.c:219:36 + #6 0x557d0935c3d2 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:91:13 + #7 0x557d091faedd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x557d091e5c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x557d091ebb20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x557d09217652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f0979602082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/./common_entity_handle_data.spec:50:7 in json_common_entity_data +Shadow bytes around the buggy address: + 0x7b8978ae3b80: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x7b8978ae3c00: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x7b8978ae3c80: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x7b8978ae3d00: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x7b8978ae3d80: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa +=>0x7b8978ae3e00:[fa]fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x7b8978ae3e80: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x7b8978ae3f00: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x7b8978ae3f80: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x7b8978ae4000: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x7b8978ae4080: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7638==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-1211.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-1211.txt new file mode 100755 index 000000000..443903470 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-1211.txt @@ -0,0 +1,62 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1466357642 +INFO: Loaded 1 modules (511201 inline 8-bit counters): 511201 [0x563e82beacc0, 0x563e82c679a1), +INFO: Loaded 1 PC tables (511201 PCs): 511201 [0x563e82c679a8,0x563e834347b8), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-1211 +================================================================= +==7638==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7d08d0be0981 at pc 0x563e7f673872 bp 0x7ffeec012200 sp 0x7ffeec0121f8 +READ of size 1 at 0x7d08d0be0981 thread T0 + #0 0x563e7f673871 in bit_calc_CRC /src/libredwg/src/bits.c:3282:29 + #1 0x563e800d3e87 in decode_preR13 /src/libredwg/src/decode_r11.c:729:14 + #2 0x563e7f68118b in dwg_decode /src/libredwg/src/decode.c:211:17 + #3 0x563e7f66b3d2 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:91:13 + #4 0x563e7f509edd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x563e7f4f4c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x563e7f4fab20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x563e7f526652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f78d1724082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x563e7f4edd3d in _start (/out/llvmfuzz+0xe5dd3d) + +0x7d08d0be0981 is located 0 bytes after 1025-byte region [0x7d08d0be0580,0x7d08d0be0981) +allocated by thread T0 here: + #0 0x563e7f628834 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x563e827d4683 in operator new(unsigned long) cxa_noexception.cpp + #2 0x563e7f4f4c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x563e7f4fab20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x563e7f526652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f78d1724082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:3282:29 in bit_calc_CRC +Shadow bytes around the buggy address: + 0x7d08d0be0700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d08d0be0780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d08d0be0800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d08d0be0880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d08d0be0900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7d08d0be0980:[01]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d08d0be0a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d08d0be0a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d08d0be0b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d08d0be0b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d08d0be0c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7638==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-1251.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-1251.txt new file mode 100644 index 000000000..98e31d3de --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-1251.txt @@ -0,0 +1,68 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 643816249 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-1251 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000000976 at pc 0x00000056dc98 bp 0x7fff06e26830 sp 0x7fff06e26828 +READ of size 1 at 0x619000000976 thread T0 + #0 0x56dc97 in bit_read_B /src/libredwg/src/bits.c:166:10 + #1 0x613b3d in dwg_decode_header_variables /src/libredwg/src/./header_variables.spec:436:7 + #2 0x5a1215 in decode_R13_R2000 /src/libredwg/src/decode.c:509:12 + #3 0x58f238 in dwg_decode /src/libredwg/src/decode.c:229:12 + #4 0x56c74a in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:95:11 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f592fb73082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: bit_read_B--dwg_decode_header_variables--decode_R13_R2000 +0x619000000976 is located 0 bytes to the right of 1014-byte region [0x619000000580,0x619000000976) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4ada97 in operator new(unsigned long) cxa_noexception.cpp + #2 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f592fb73082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--operator new(unsigned long)--fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:166:10 in bit_read_B +Shadow bytes around the buggy address: + 0x0c327fff80d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff80e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff80f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c327fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[06]fa + 0x0c327fff8130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff8150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff8160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff8170: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-1252.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-1252.txt new file mode 100644 index 000000000..412589af0 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-1252.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 644562825 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-1252 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61100000024d at pc 0x00000056e272 bp 0x7ffdbbc5be00 sp 0x7ffdbbc5bdf8 +READ of size 1 at 0x61100000024d thread T0 + #0 0x56e271 in bit_read_BB /src/libredwg/src/bits.c:198:10 + #1 0x573f62 in bit_read_BD /src/libredwg/src/bits.c:861:18 + #2 0x5f7168 in dwg_decode_header_variables /src/libredwg/src/./header_variables.spec:289:7 + #3 0x5a1215 in decode_R13_R2000 /src/libredwg/src/decode.c:509:12 + #4 0x58f238 in dwg_decode /src/libredwg/src/decode.c:229:12 + #5 0x56c74a in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:95:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f038c584082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: bit_read_BB--bit_read_BD--dwg_decode_header_variables +0x61100000024d is located 0 bytes to the right of 205-byte region [0x611000000180,0x61100000024d) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4ada97 in operator new(unsigned long) cxa_noexception.cpp + #2 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f038c584082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--operator new(unsigned long)--fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:198:10 in bit_read_BB +Shadow bytes around the buggy address: + 0x0c227fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8020: 00 05 fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c227fff8040: 00 00 00 00 00 00 00 00 00[05]fa fa fa fa fa fa + 0x0c227fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-128.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-128.txt new file mode 100755 index 000000000..6a1ee3a72 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-128.txt @@ -0,0 +1,63 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 780198313 +INFO: Loaded 1 modules (511161 inline 8-bit counters): 511161 [0x56237f84bcc0, 0x56237f8c8979), +INFO: Loaded 1 PC tables (511161 PCs): 511161 [0x56237f8c8980,0x562380095510), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-128 +================================================================= +==7639==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7b875fbd0130 at pc 0x56237cdcd012 bp 0x7ffd13b7c030 sp 0x7ffd13b7c028 +WRITE of size 1 at 0x7b875fbd0130 thread T0 + #0 0x56237cdcd011 in copy_bytes /src/libredwg/src/decode_r2007.c:228:12 + #1 0x56237cdc7d43 in decompress_r2007 /src/libredwg/src/decode_r2007.c:563:11 + #2 0x56237cda1904 in read_file_header /src/libredwg/src/decode_r2007.c:1247:13 + #3 0x56237cda0af1 in read_r2007_meta_data /src/libredwg/src/decode_r2007.c:2354:11 + #4 0x56237c301ae2 in decode_R2007 /src/libredwg/src/decode.c:3238:11 + #5 0x56237c2e4304 in dwg_decode /src/libredwg/src/decode.c:218:29 + #6 0x56237c2ce3d2 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:91:13 + #7 0x56237c16cedd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x56237c157c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x56237c15db20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x56237c189652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f8761655082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x56237c150d3d in _start (/out/llvmfuzz+0xe5cd3d) + +Address 0x7b875fbd0130 is located in stack of thread T0 at offset 304 in frame + #0 0x56237cda09cf in read_r2007_meta_data /src/libredwg/src/decode_r2007.c:2338 + + This frame has 1 object(s): + [32, 304) 'file_header' (line 2339) <== Memory access at offset 304 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/libredwg/src/decode_r2007.c:228:12 in copy_bytes +Shadow bytes around the buggy address: + 0x7b875fbcfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b875fbcff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b875fbcff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b875fbd0000: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b875fbd0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7b875fbd0100: 00 00 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x7b875fbd0180: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x7b875fbd0200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b875fbd0280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b875fbd0300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b875fbd0380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7639==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-129.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-129.txt new file mode 100755 index 000000000..2433695ef --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-129.txt @@ -0,0 +1,69 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1809286068 +INFO: Loaded 1 modules (488069 inline 8-bit counters): 488069 [0x55edc78e74c0, 0x55edc795e745), +INFO: Loaded 1 PC tables (488069 PCs): 488069 [0x55edc795e748,0x55edc80d0f98), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-129 +================================================================= +==7228==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7bb281de0258 at pc 0x55edc50adce0 bp 0x7ffe46b08760 sp 0x7ffe46b08758 +READ of size 8 at 0x7bb281de0258 thread T0 + #0 0x55edc50adcdf in dwg_free_HATCH_private /src/libredwg/src/./dwg.spec:4267:7 + #1 0x55edc5069425 in dwg_free_HATCH /src/libredwg/src/./dwg.spec:4108:1 + #2 0x55edc515ab40 in dwg_free_object /src/libredwg/src/free.c:829:7 + #3 0x55edc515c17f in dwg_free /src/libredwg/src/free.c:1266:13 + #4 0x55edc463956a in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:13 + #5 0x55edc44d7edd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #6 0x55edc44c2c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #7 0x55edc44c8b20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #8 0x55edc44f4652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f92828bc082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x55edc44bbd3d in _start (/out/llvmfuzz+0xdbdd3d) + +0x7bb281de0258 is located 0 bytes after 8-byte region [0x7bb281de0250,0x7bb281de0258) +allocated by thread T0 here: + #0 0x55edc45f69f9 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:74:3 + #1 0x55edc739e3ea in xcalloc /src/libredwg/src/in_dxf.c:227:7 + #2 0x55edc7456d0e in add_HATCH /src/libredwg/src/in_dxf.c:3407:57 + #3 0x55edc73c918c in new_object /src/libredwg/src/in_dxf.c:10355:26 + #4 0x55edc73b09a3 in dxf_entities_read /src/libredwg/src/in_dxf.c:12341:18 + #5 0x55edc73a3e13 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12924:23 + #6 0x55edc4639511 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:116:13 + #7 0x55edc44d7edd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x55edc44c2c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x55edc44c8b20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x55edc44f4652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f92828bc082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/./dwg.spec:4267:7 in dwg_free_HATCH_private +Shadow bytes around the buggy address: + 0x7bb281ddff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7bb281de0000: fa fa 00 00 fa fa 00 fa fa fa 00 fa fa fa 00 fa + 0x7bb281de0080: fa fa 00 00 fa fa fd fd fa fa fd fd fa fa fd fd + 0x7bb281de0100: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd + 0x7bb281de0180: fa fa fd fa fa fa 06 fa fa fa fd fd fa fa fd fd +=>0x7bb281de0200: fa fa fd fd fa fa fd fd fa fa 00[fa]fa fa fd fd + 0x7bb281de0280: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fa fa + 0x7bb281de0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bb281de0380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bb281de0400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bb281de0480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7228==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-363.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-363.txt new file mode 100755 index 000000000..6ddc86b6c --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-363.txt @@ -0,0 +1,81 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 77602534 +INFO: Loaded 1 modules (508694 inline 8-bit counters): 508694 [0x55c57c070b60, 0x55c57c0ece76), +INFO: Loaded 1 PC tables (508694 PCs): 508694 [0x55c57c0ece78,0x55c57c8affd8), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-363 +================================================================= +==7638==ERROR: AddressSanitizer: heap-use-after-free on address 0x7b83b50e0430 at pc 0x55c57972d67e bp 0x7ffccaa82d70 sp 0x7ffccaa82d68 +READ of size 8 at 0x7b83b50e0430 thread T0 + #0 0x55c57972d67d in dwg_free_TABLEGEOMETRY_private /src/libredwg/src/./dwg.spec:6646:7 + #1 0x55c57966639f in dwg_free_TABLEGEOMETRY /src/libredwg/src/./dwg.spec:6631:1 + #2 0x55c57973884f in dwg_free_object /src/libredwg/src/free.c:1081:25 + #3 0x55c57973a36f in dwg_free /src/libredwg/src/free.c:1502:13 + #4 0x55c578b68556 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:13 + #5 0x55c578a06edd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #6 0x55c5789f1c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #7 0x55c5789f7b20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #8 0x55c578a23652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f63b5c11082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x55c5789ead3d in _start (/out/llvmfuzz+0xe4ad3d) + +0x7b83b50e0430 is located 0 bytes inside of 16-byte region [0x7b83b50e0430,0x7b83b50e0440) +freed by thread T0 here: + #0 0x55c578b25596 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3 + #1 0x55c57bb423cb in new_object /src/libredwg/src/in_dxf.c:11614:7 + #2 0x55c57bb18f71 in dxf_blocks_read /src/libredwg/src/in_dxf.c:11823:22 + #3 0x55c57bb0e18c in dwg_read_dxf /src/libredwg/src/in_dxf.c:12591:23 + #4 0x55c578b684fd in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:116:13 + #5 0x55c578a06edd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #6 0x55c5789f1c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #7 0x55c5789f7b20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #8 0x55c578a23652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f63b5c11082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +previously allocated by thread T0 here: + #0 0x55c578b259f9 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:74:3 + #1 0x55c57bb0be2a in xcalloc /src/libredwg/src/in_dxf.c:227:7 + #2 0x55c57bb0f039 in dxf_read_pair /src/libredwg/src/in_dxf.c:540:32 + #3 0x55c57bb423d7 in new_object /src/libredwg/src/in_dxf.c:11615:14 + #4 0x55c57bb18f71 in dxf_blocks_read /src/libredwg/src/in_dxf.c:11823:22 + #5 0x55c57bb0e18c in dwg_read_dxf /src/libredwg/src/in_dxf.c:12591:23 + #6 0x55c578b684fd in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:116:13 + #7 0x55c578a06edd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x55c5789f1c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x55c5789f7b20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x55c578a23652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f63b5c11082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/libredwg/src/./dwg.spec:6646:7 in dwg_free_TABLEGEOMETRY_private +Shadow bytes around the buggy address: + 0x7b83b50e0180: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fa + 0x7b83b50e0200: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fa + 0x7b83b50e0280: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fa + 0x7b83b50e0300: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fa + 0x7b83b50e0380: fa fa fd fd fa fa fd fd fa fa 00 06 fa fa 00 00 +=>0x7b83b50e0400: fa fa 01 fa fa fa[fd]fd fa fa fd fd fa fa fd fd + 0x7b83b50e0480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b83b50e0500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b83b50e0580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b83b50e0600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b83b50e0680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7638==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-377.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-377.txt new file mode 100755 index 000000000..5a7b51905 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-377.txt @@ -0,0 +1,65 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2582322517 +INFO: Loaded 1 modules (510173 inline 8-bit counters): 510173 [0x55819941bc60, 0x55819949853d), +INFO: Loaded 1 PC tables (510173 PCs): 510173 [0x558199498540,0x558199c61310), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-377 +================================================================= +==7638==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7cb7528e0284 at pc 0x55819692294c bp 0x7fff0aecfb30 sp 0x7fff0aecfb28 +WRITE of size 4 at 0x7cb7528e0284 thread T0 + #0 0x55819692294b in decode_preR13_section_hdr /src/libredwg/src/decode_r11.c:136:13 + #1 0x55819691cc36 in decode_preR13 /src/libredwg/src/decode_r11.c:699:12 + #2 0x558195ecaff5 in dwg_decode /src/libredwg/src/decode.c:211:17 + #3 0x558195eb53d2 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:91:13 + #4 0x558195d53edd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x558195d3ec52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x558195d44b20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x558195d70652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fa75335e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x558195d37d3d in _start (/out/llvmfuzz+0xe55d3d) + +0x7cb7528e0284 is located 4 bytes after 256-byte region [0x7cb7528e0180,0x7cb7528e0280) +allocated by thread T0 here: + #0 0x558195e729f9 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:74:3 + #1 0x55819691c2aa in decode_preR13 /src/libredwg/src/decode_r11.c:662:40 + #2 0x558195ecaff5 in dwg_decode /src/libredwg/src/decode.c:211:17 + #3 0x558195eb53d2 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:91:13 + #4 0x558195d53edd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x558195d3ec52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x558195d44b20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x558195d70652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fa75335e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/decode_r11.c:136:13 in decode_preR13_section_hdr +Shadow bytes around the buggy address: + 0x7cb7528e0000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x7cb7528e0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7cb7528e0100: 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa fa + 0x7cb7528e0180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7cb7528e0200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7cb7528e0280:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb7528e0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb7528e0380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb7528e0400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb7528e0480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb7528e0500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7638==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-387.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-387.txt new file mode 100755 index 000000000..7d400f61f --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-387.txt @@ -0,0 +1,32 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3480285811 +INFO: Loaded 1 modules (508694 inline 8-bit counters): 508694 [0x560a4d209b60, 0x560a4d285e76), +INFO: Loaded 1 PC tables (508694 PCs): 508694 [0x560a4d285e78,0x560a4da48fd8), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-387 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==7639==ERROR: AddressSanitizer: SEGV on unknown address 0x80808100800080 (pc 0x560a49d0c2c0 bp 0x7ffc50e92830 sp 0x7ffc50e92810 T0) +==7639==The signal is caused by a READ memory access. + #0 0x560a49d0c2c0 in bit_write_TV /src/libredwg/src/bits.c:1839:26 + #1 0x560a49d0caba in bit_write_T /src/libredwg/src/bits.c:1923:9 + #2 0x560a4bf3d023 in dwg_encode_BLOCK_private /src/libredwg/src/./dwg.spec:544:5 + #3 0x560a4beb2154 in dwg_encode_BLOCK /src/libredwg/src/./dwg.spec:528:1 + #4 0x560a4beab479 in dwg_encode_add_object /src/libredwg/src/encode.c:4176:15 + #5 0x560a4be23124 in dwg_encode /src/libredwg/src/encode.c:2769:16 + #6 0x560a49d01718 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:176:11 + #7 0x560a49b9fedd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x560a49b8ac52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x560a49b90b20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x560a49bbc652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fb2b06af082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x560a49b83d3d in _start (/out/llvmfuzz+0xe4ad3d) + +==7639==Register values: +rax = 0x0080808080808080 rbx = 0x0404040404040404 rcx = 0x000000000000003d rdx = 0x0000560a4dc21400 +rdi = 0x00007bb2aefdd410 rsi = 0x0404040404040404 rbp = 0x00007ffc50e92830 rsp = 0x00007ffc50e92810 + r8 = 0x0000000000000020 r9 = 0x00007fffffffff01 r10 = 0x00007fffffffff01 r11 = 0x0000000000000001 +r12 = 0x00007bb2ae8d08c0 r13 = 0x0404040404040404 r14 = 0x00007bb2aefdd410 r15 = 0x00007bb2ae8d08c0 +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/libredwg/src/bits.c:1839:26 in bit_write_TV +==7639==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-398.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-398.txt new file mode 100755 index 000000000..75ab4a313 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-398.txt @@ -0,0 +1,70 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2369083953 +INFO: Loaded 1 modules (511201 inline 8-bit counters): 511201 [0x5580d912dcc0, 0x5580d91aa9a1), +INFO: Loaded 1 PC tables (511201 PCs): 511201 [0x5580d91aa9a8,0x5580d99777b8), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-398 +================================================================= +==7639==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7baa76fe0bf8 at pc 0x5580d75f7d58 bp 0x7ffc091f8f90 sp 0x7ffc091f8f88 +READ of size 8 at 0x7baa76fe0bf8 thread T0 + #0 0x5580d75f7d57 in json_common_entity_data /src/libredwg/src/./common_entity_handle_data.spec:72:11 + #1 0x5580d75d3b03 in dwg_json_REPEAT /src/libredwg/src/./dwg.spec:11018:1 + #2 0x5580d758ccd6 in dwg_json_object /src/libredwg/src/out_json.c:1711:14 + #3 0x5580d74ec98b in json_objects_write /src/libredwg/src/out_json.c:2082:15 + #4 0x5580d74e83a9 in dwg_write_json /src/libredwg/src/out_json.c:2383:7 + #5 0x5580d5bae6c6 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:191:11 + #6 0x5580d5a4cedd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x5580d5a37c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x5580d5a3db20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x5580d5a69652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f2a77aa5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x5580d5a30d3d in _start (/out/llvmfuzz+0xe5dd3d) + +0x7baa76fe0bf8 is located 0 bytes after 88-byte region [0x7baa76fe0ba0,0x7baa76fe0bf8) +allocated by thread T0 here: + #0 0x5580d5b6b9f9 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:74:3 + #1 0x5580d5c6784f in dwg_setup_LAYOUT /src/libredwg/src/./dwg.spec:5069:1 + #2 0x5580d5cbcbd5 in dwg_decode_LAYOUT /src/libredwg/src/./dwg.spec:5069:1 + #3 0x5580d5cac985 in dwg_decode_add_object /src/libredwg/src/decode.c + #4 0x5580d5bcdbe4 in decode_R13_R2000 /src/libredwg/src/decode.c:738:19 + #5 0x5580d5bc424a in dwg_decode /src/libredwg/src/decode.c:219:36 + #6 0x5580d5bae3d2 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:91:13 + #7 0x5580d5a4cedd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x5580d5a37c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x5580d5a3db20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x5580d5a69652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f2a77aa5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/./common_entity_handle_data.spec:72:11 in json_common_entity_data +Shadow bytes around the buggy address: + 0x7baa76fe0900: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x7baa76fe0980: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x7baa76fe0a00: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x7baa76fe0a80: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x7baa76fe0b00: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa +=>0x7baa76fe0b80: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00[fa] + 0x7baa76fe0c00: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x7baa76fe0c80: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x7baa76fe0d00: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x7baa76fe0d80: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x7baa76fe0e00: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7639==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-403.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-403.txt new file mode 100755 index 000000000..2fdfd3010 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-403.txt @@ -0,0 +1,82 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 566736757 +INFO: Loaded 1 modules (511382 inline 8-bit counters): 511382 [0x559e5d05bcc0, 0x559e5d0d8a56), +INFO: Loaded 1 PC tables (511382 PCs): 511382 [0x559e5d0d8a58,0x559e5d8a63b8), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-403 +================================================================= +==7638==ERROR: AddressSanitizer: heap-use-after-free on address 0x7c01899e07b0 at pc 0x559e5cc3e14b bp 0x7fff5e02b260 sp 0x7fff5e02b258 +READ of size 8 at 0x7c01899e07b0 thread T0 + #0 0x559e5cc3e14a in dwg_add_handleref /src/libredwg/src/dwg.c:2014:21 + #1 0x559e5a7993da in dwg_add_STYLE /src/libredwg/src/dwg_api.c:24613:3 + #2 0x559e5a588ec4 in decode_preR13_section /src/libredwg/src/decode_r11.c:370:13 + #3 0x559e5a5449de in decode_preR13 /src/libredwg/src/decode_r11.c:842:12 + #4 0x559e59aed14b in dwg_decode /src/libredwg/src/decode.c:211:17 + #5 0x559e59ad73d2 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:91:13 + #6 0x559e59975edd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x559e59960c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x559e59966b20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x559e59992652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fc18a533082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x559e59959d3d in _start (/out/llvmfuzz+0xe5ed3d) + +0x7c01899e07b0 is located 32 bytes inside of 48-byte region [0x7c01899e0790,0x7c01899e07c0) +freed by thread T0 here: + #0 0x559e59a94596 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3 + #1 0x559e5a551448 in decode_preR13_header_variables /src/libredwg/src/./header_variables_r11.spec:65:3 + #2 0x559e5a543566 in decode_preR13 /src/libredwg/src/decode_r11.c:746:12 + #3 0x559e59aed14b in dwg_decode /src/libredwg/src/decode.c:211:17 + #4 0x559e59ad73d2 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:91:13 + #5 0x559e59975edd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #6 0x559e59960c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #7 0x559e59966b20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #8 0x559e59992652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fc18a533082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +previously allocated by thread T0 here: + #0 0x559e59a949f9 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:74:3 + #1 0x559e59b10322 in dwg_new_ref /src/libredwg/src/decode.c:4045:43 + #2 0x559e5cc3dfcb in dwg_add_handleref /src/libredwg/src/dwg.c:2019:9 + #3 0x559e5a794e21 in dwg_add_Document /src/libredwg/src/dwg_api.c:22486:33 + #4 0x559e5a542ea4 in decode_preR13 /src/libredwg/src/decode_r11.c:687:12 + #5 0x559e59aed14b in dwg_decode /src/libredwg/src/decode.c:211:17 + #6 0x559e59ad73d2 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:91:13 + #7 0x559e59975edd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x559e59960c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x559e59966b20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x559e59992652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fc18a533082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/libredwg/src/dwg.c:2014:21 in dwg_add_handleref +Shadow bytes around the buggy address: + 0x7c01899e0500: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 fa + 0x7c01899e0580: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 + 0x7c01899e0600: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 + 0x7c01899e0680: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 + 0x7c01899e0700: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 +=>0x7c01899e0780: fa fa fd fd fd fd[fd]fd fa fa 00 00 00 00 00 00 + 0x7c01899e0800: fa fa 00 00 00 00 00 00 fa fa fd fd fd fd fd fd + 0x7c01899e0880: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 + 0x7c01899e0900: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 + 0x7c01899e0980: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 + 0x7c01899e0a00: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7638==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-654.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-654.txt new file mode 100755 index 000000000..f0be4f705 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-654.txt @@ -0,0 +1,69 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3960900222 +INFO: Loaded 1 modules (511431 inline 8-bit counters): 511431 [0x560f580fbcc0, 0x560f58178a87), +INFO: Loaded 1 PC tables (511431 PCs): 511431 [0x560f58178a88,0x560f589466f8), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-654 +================================================================= +==7431==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c4bf99e1898 at pc 0x560f56cf26be bp 0x7fff8d4f2e90 sp 0x7fff8d4f2e88 +READ of size 8 at 0x7c4bf99e1898 thread T0 + #0 0x560f56cf26bd in dwg_geojson_feature /src/libredwg/src/out_geojson.c:495:11 + #1 0x560f56ce67d1 in dwg_geojson_object /src/libredwg/src/out_geojson.c:791:9 + #2 0x560f56ce5148 in geojson_entities_write /src/libredwg/src/out_geojson.c:916:17 + #3 0x560f56ce3e13 in dwg_write_geojson /src/libredwg/src/out_geojson.c:944:7 + #4 0x560f54b75698 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:195:11 + #5 0x560f54a13edd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #6 0x560f549fec52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #7 0x560f54a04b20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #8 0x560f54a30652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fcbfa4bd082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x560f549f7d3d in _start (/out/llvmfuzz+0xe5ed3d) + +0x7c4bf99e1898 is located 24 bytes after 96-byte region [0x7c4bf99e1820,0x7c4bf99e1880) +allocated by thread T0 here: + #0 0x560f54b329f9 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:74:3 + #1 0x560f54c107c5 in dwg_setup_LINE /src/libredwg/src/./dwg.spec:1330:1 + #2 0x560f54c7b365 in dwg_decode_LINE /src/libredwg/src/./dwg.spec:1330:1 + #3 0x560f54cba83b in decode_preR13_entities /src/libredwg/src/decode.c:5729:20 + #4 0x560f555e4255 in decode_preR13 /src/libredwg/src/decode_r11.c:836:12 + #5 0x560f54b8c2cb in dwg_decode /src/libredwg/src/decode.c:211:17 + #6 0x560f54b753d2 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:91:13 + #7 0x560f54a13edd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x560f549fec52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x560f54a04b20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x560f54a30652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fcbfa4bd082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/out_geojson.c:495:11 in dwg_geojson_feature +Shadow bytes around the buggy address: + 0x7c4bf99e1600: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x7c4bf99e1680: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x7c4bf99e1700: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x7c4bf99e1780: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x7c4bf99e1800: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7c4bf99e1880: fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c4bf99e1900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c4bf99e1980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c4bf99e1a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c4bf99e1a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c4bf99e1b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7431==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-656.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-656.txt new file mode 100644 index 000000000..47aa56550 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-656.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 645183079 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-656 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6160000008b4 at pc 0x00000056e272 bp 0x7ffe2571f400 sp 0x7ffe2571f3f8 +READ of size 1 at 0x6160000008b4 thread T0 + #0 0x56e271 in bit_read_BB /src/libredwg/src/bits.c:198:10 + #1 0x573f62 in bit_read_BD /src/libredwg/src/bits.c:861:18 + #2 0x5f96ee in dwg_decode_header_variables /src/libredwg/src/./header_variables.spec:308:7 + #3 0x5a1215 in decode_R13_R2000 /src/libredwg/src/decode.c:509:12 + #4 0x58f238 in dwg_decode /src/libredwg/src/decode.c:229:12 + #5 0x56c74a in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:95:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fba55294082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: bit_read_BB--bit_read_BD--dwg_decode_header_variables +0x6160000008b4 is located 0 bytes to the right of 564-byte region [0x616000000680,0x6160000008b4) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4ada97 in operator new(unsigned long) cxa_noexception.cpp + #2 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7fba55294082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--operator new(unsigned long)--fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:198:10 in bit_read_BB +Shadow bytes around the buggy address: + 0x0c2c7fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff80d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff80e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff80f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c2c7fff8110: 00 00 00 00 00 00[04]fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-657.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-657.txt new file mode 100755 index 000000000..676b4d349 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-657.txt @@ -0,0 +1,72 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3060289442 +INFO: Loaded 1 modules (511903 inline 8-bit counters): 511903 [0x563794aeef20, 0x563794b6bebf), +INFO: Loaded 1 PC tables (511903 PCs): 511903 [0x563794b6bec0,0x56379533b8b0), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-657 +================================================================= +==7431==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b70772e0100 at pc 0x563791503d7a bp 0x7ffe93988690 sp 0x7ffe93987e48 +WRITE of size 49 at 0x7b70772e0100 thread T0 + #0 0x563791503d79 in strcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:568:5 + #1 0x563792196196 in strcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:90:10 + #2 0x563792196196 in dynapi_set_helper /src/libredwg/src/gen-dynapi.pl:3114:11 + #3 0x563792195e98 in dwg_dynapi_entity_set_value /src/libredwg/src/gen-dynapi.pl:3216:7 + #4 0x5637945af661 in new_object /src/libredwg/src/in_dxf.c:10999:25 + #5 0x56379458ef31 in dxf_blocks_read /src/libredwg/src/in_dxf.c:11893:22 + #6 0x5637945838dc in dwg_read_dxf /src/libredwg/src/in_dxf.c:12691:23 + #7 0x5637915604fd in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:116:13 + #8 0x5637913feedd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #9 0x5637913e9c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #10 0x5637913efb20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #11 0x56379141b652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f3077d8c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x5637913e2d3d in _start (/out/llvmfuzz+0xe61d3d) + +0x7b70772e0100 is located 0 bytes after 48-byte region [0x7b70772e00d0,0x7b70772e0100) +allocated by thread T0 here: + #0 0x56379151d9f9 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:74:3 + #1 0x563792196187 in dynapi_set_helper /src/libredwg/src/gen-dynapi.pl:3113:31 + #2 0x563792195e98 in dwg_dynapi_entity_set_value /src/libredwg/src/gen-dynapi.pl:3216:7 + #3 0x5637945af661 in new_object /src/libredwg/src/in_dxf.c:10999:25 + #4 0x56379458ef31 in dxf_blocks_read /src/libredwg/src/in_dxf.c:11893:22 + #5 0x5637945838dc in dwg_read_dxf /src/libredwg/src/in_dxf.c:12691:23 + #6 0x5637915604fd in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:116:13 + #7 0x5637913feedd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x5637913e9c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x5637913efb20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x56379141b652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f3077d8c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /usr/include/x86_64-linux-gnu/bits/string_fortified.h:90:10 in strcpy +Shadow bytes around the buggy address: + 0x7b70772dfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b70772dff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b70772dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b70772e0000: fa fa 00 00 00 00 00 07 fa fa 00 00 00 00 00 00 + 0x7b70772e0080: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 +=>0x7b70772e0100:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b70772e0180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b70772e0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b70772e0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b70772e0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b70772e0380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7431==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-664.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-664.txt new file mode 100755 index 000000000..06520b8ca --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2022-664.txt @@ -0,0 +1,65 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4173893679 +INFO: Loaded 1 modules (511201 inline 8-bit counters): 511201 [0x55cebb86acc0, 0x55cebb8e79a1), +INFO: Loaded 1 PC tables (511201 PCs): 511201 [0x55cebb8e79a8,0x55cebc0b47b8), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-664 +================================================================= +==7638==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7d3b568e0804 at pc 0x55ceb8d5a5f3 bp 0x7fff48a62230 sp 0x7fff48a62228 +WRITE of size 4 at 0x7d3b568e0804 thread T0 + #0 0x55ceb8d5a5f2 in decode_preR13_section_hdr /src/libredwg/src/decode_r11.c:135:13 + #1 0x55ceb8d54930 in decode_preR13 /src/libredwg/src/decode_r11.c:762:7 + #2 0x55ceb830118b in dwg_decode /src/libredwg/src/decode.c:211:17 + #3 0x55ceb82eb3d2 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:91:13 + #4 0x55ceb8189edd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x55ceb8174c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x55ceb817ab20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x55ceb81a6652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fbb57404082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x55ceb816dd3d in _start (/out/llvmfuzz+0xe5dd3d) + +0x7d3b568e0804 is located 4 bytes after 896-byte region [0x7d3b568e0480,0x7d3b568e0800) +allocated by thread T0 here: + #0 0x55ceb82a89f9 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:74:3 + #1 0x55ceb8d5377b in decode_preR13 /src/libredwg/src/decode_r11.c:669:40 + #2 0x55ceb830118b in dwg_decode /src/libredwg/src/decode.c:211:17 + #3 0x55ceb82eb3d2 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:91:13 + #4 0x55ceb8189edd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x55ceb8174c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x55ceb817ab20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x55ceb81a6652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fbb57404082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/decode_r11.c:135:13 in decode_preR13_section_hdr +Shadow bytes around the buggy address: + 0x7d3b568e0580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d3b568e0600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d3b568e0680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d3b568e0700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d3b568e0780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7d3b568e0800:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d3b568e0880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d3b568e0900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d3b568e0980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d3b568e0a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d3b568e0a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7638==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1048.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1048.txt new file mode 100644 index 000000000..cd840a841 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1048.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 645912391 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-1048 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x615000000770 at pc 0x00000052e421 bp 0x7ffd08062fd0 sp 0x7ffd080627a0 +READ of size 8406 at 0x615000000770 thread T0 + #0 0x52e420 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x7d01b0 in memcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34:10 + #2 0x7d01b0 in decode_preR13_entities /src/libredwg/src/decode.c:6932:31 + #3 0x11a3510 in decode_preR13 /src/libredwg/src/decode_r11.c:736:12 + #4 0x58f183 in dwg_decode /src/libredwg/src/decode.c:219:17 + #5 0x56c74a in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:95:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f19ea7cf082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: __asan_memcpy--memcpy--decode_preR13_entities +0x615000000770 is located 0 bytes to the right of 496-byte region [0x615000000580,0x615000000770) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4ada97 in operator new(unsigned long) cxa_noexception.cpp + #2 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f19ea7cf082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--operator new(unsigned long)--fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c2a7fff8090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa + 0x0c2a7fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff80b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff80c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff80d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c2a7fff80e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa + 0x0c2a7fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1051.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1051.txt new file mode 100644 index 000000000..fa354e834 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1051.txt @@ -0,0 +1,73 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 646299264 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-1051 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060000000b9 at pc 0x0000027410d6 bp 0x7ffdaef3e5d0 sp 0x7ffdaef3e5c8 +READ of size 1 at 0x6060000000b9 thread T0 + #0 0x27410d5 in dwg_json_VPORT_private /src/libredwg/src/./dwg.spec:4434:1 + #1 0x23936b1 in dwg_json_VPORT /src/libredwg/src/./dwg.spec:4249:1 + #2 0x23936b1 in dwg_json_object /src/libredwg/src/out_json.c:1780:14 + #3 0x23936b1 in json_objects_write /src/libredwg/src/out_json.c:2239:15 + #4 0x233c4b9 in dwg_write_json /src/libredwg/src/out_json.c:2632:7 + #5 0x56ccb8 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:195:7 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f154d930082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: dwg_json_VPORT_private--dwg_json_VPORT--dwg_json_object +0x6060000000b9 is located 0 bytes to the right of 57-byte region [0x606000000080,0x6060000000b9) +allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x11e6974 in decode_preR13_section /src/libredwg/src/decode_r11.c:494:13 + #2 0x11a3759 in decode_preR13 /src/libredwg/src/decode_r11.c:769:16 + #3 0x58f183 in dwg_decode /src/libredwg/src/decode.c:219:17 + #4 0x56c74a in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:95:11 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f154d930082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_calloc--decode_preR13_section--decode_preR13 +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/./dwg.spec:4434:1 in dwg_json_VPORT_private +Shadow bytes around the buggy address: + 0x0c0c7fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa +=>0x0c0c7fff8010: 00 00 00 00 00 00 00[01]fa fa fa fa 00 00 00 00 + 0x0c0c7fff8020: 00 00 00 01 fa fa fa fa 00 00 00 00 00 00 00 01 + 0x0c0c7fff8030: fa fa fa fa 00 00 00 00 00 00 00 01 fa fa fa fa + 0x0c0c7fff8040: 00 00 00 00 00 00 00 01 fa fa fa fa 00 00 00 00 + 0x0c0c7fff8050: 00 00 00 01 fa fa fa fa 00 00 00 00 00 00 00 01 + 0x0c0c7fff8060: fa fa fa fa 00 00 00 00 00 00 00 01 fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1063.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1063.txt new file mode 100644 index 000000000..23debf71e --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1063.txt @@ -0,0 +1,50 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 647148725 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-1063 +================================================================= +==1==ERROR: AddressSanitizer: attempting double-free on 0x602000006170 in thread T0: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x134ea91 in dwg_free_object /src/libredwg/src/free.c:1237:5 + #2 0x1351933 in dwg_free /src/libredwg/src/free.c:1648:13 + #3 0x56c990 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:124:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fbdfe043082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: free--dwg_free_object--dwg_free +0x602000006170 is located 0 bytes inside of 14-byte region [0x602000006170,0x60200000617e) +freed by thread T0 here: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x3f41b62 in dxf_objects_read /src/libredwg/src/in_dxf.c:12299:19 + #2 0x3f28d3c in dwg_read_dxf /src/libredwg/src/in_dxf.c:12844:23 + #3 0x56c944 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fbdfe043082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: free--dxf_objects_read--dwg_read_dxf +previously allocated by thread T0 here: + #0 0x519cf3 in strdup /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:440:3 + #1 0x3f4152c in dxf_objects_read /src/libredwg/src/in_dxf.c:12293:31 + #2 0x3f28d3c in dwg_read_dxf /src/libredwg/src/in_dxf.c:12844:23 + #3 0x56c944 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fbdfe043082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: strdup--dxf_objects_read--dwg_read_dxf +SUMMARY: AddressSanitizer: double-free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 in free +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1099.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1099.txt new file mode 100644 index 000000000..c8d34329f --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1099.txt @@ -0,0 +1,71 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 664617572 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-1099 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000053f0 at pc 0x000002df8f63 bp 0x7ffe26b83730 sp 0x7ffe26b83728 +READ of size 8 at 0x6020000053f0 thread T0 + #0 0x2df8f62 in dwg_geojson_object /src/libredwg/src/out_geojson.c:836:11 + #1 0x2dec6ef in geojson_entities_write /src/libredwg/src/out_geojson.c:1006:17 + #2 0x2dec6ef in dwg_write_geojson /src/libredwg/src/out_geojson.c:1034:7 + #3 0x56cc4e in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:199:7 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7ff555312082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: dwg_geojson_object--geojson_entities_write--dwg_write_geojson +0x6020000053f1 is located 0 bytes to the right of 1-byte region [0x6020000053f0,0x6020000053f1) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x2df23d1 in dwg_geojson_object /src/libredwg/src/out_geojson.c:818:32 + #2 0x2dec6ef in geojson_entities_write /src/libredwg/src/out_geojson.c:1006:17 + #3 0x2dec6ef in dwg_write_geojson /src/libredwg/src/out_geojson.c:1034:7 + #4 0x56cc4e in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:199:7 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7ff555312082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--dwg_geojson_object--geojson_entities_write +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/out_geojson.c:836:11 in dwg_geojson_object +Shadow bytes around the buggy address: + 0x0c047fff8a20: fa fa 01 fa fa fa 02 fa fa fa 01 fa fa fa 01 fa + 0x0c047fff8a30: fa fa 01 fa fa fa 02 fa fa fa 01 fa fa fa 01 fa + 0x0c047fff8a40: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 01 fa + 0x0c047fff8a50: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 04 fa + 0x0c047fff8a60: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 01 fa +=>0x0c047fff8a70: fa fa 01 fa fa fa 00 03 fa fa 01 fa fa fa[01]fa + 0x0c047fff8a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8a90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8aa0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8ab0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8ac0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1101.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1101.txt new file mode 100644 index 000000000..9e9527e2e --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1101.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 647655236 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-1101 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x615000000770 at pc 0x00000052e421 bp 0x7fffbb6c3f90 sp 0x7fffbb6c3760 +READ of size 17 at 0x615000000770 thread T0 + #0 0x52e420 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x7d01b0 in memcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34:10 + #2 0x7d01b0 in decode_preR13_entities /src/libredwg/src/decode.c:6932:31 + #3 0x11a3510 in decode_preR13 /src/libredwg/src/decode_r11.c:736:12 + #4 0x58f183 in dwg_decode /src/libredwg/src/decode.c:219:17 + #5 0x56c74a in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:95:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f531d292082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: __asan_memcpy--memcpy--decode_preR13_entities +0x615000000770 is located 0 bytes to the right of 496-byte region [0x615000000580,0x615000000770) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4ada97 in operator new(unsigned long) cxa_noexception.cpp + #2 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f531d292082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--operator new(unsigned long)--fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c2a7fff8090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa + 0x0c2a7fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff80b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff80c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff80d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c2a7fff80e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa + 0x0c2a7fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1104.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1104.txt new file mode 100644 index 000000000..2dc6b7e12 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1104.txt @@ -0,0 +1,72 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 647950130 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-1104 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6160000008eb at pc 0x00000056fb0e bp 0x7fff2d91c060 sp 0x7fff2d91c058 +READ of size 1 at 0x6160000008eb thread T0 + #0 0x56fb0d in bit_read_RC /src/libredwg/src/bits.c:338:18 + #1 0x57a757 in bit_read_fixed /src/libredwg/src/bits.c:1610:21 + #2 0x57aada in bit_read_TF /src/libredwg/src/bits.c:1632:3 + #3 0xa8c015 in dwg_decode_PROXY_ENTITY_private /src/libredwg/src/./dwg.spec:5917:5 + #4 0x773ff9 in dwg_decode_PROXY_ENTITY /src/libredwg/src/./dwg.spec:5872:1 + #5 0x7639c9 in dwg_decode_add_object /src/libredwg/src/decode.c:5496:15 + #6 0x59e605 in decode_R13_R2000 /src/libredwg/src/decode.c:832:19 + #7 0x58f238 in dwg_decode /src/libredwg/src/decode.c:229:12 + #8 0x56c74a in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:95:11 + #9 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7ff4fef27082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #14 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: bit_read_RC--bit_read_fixed--bit_read_TF +0x6160000008eb is located 0 bytes to the right of 619-byte region [0x616000000680,0x6160000008eb) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4ada97 in operator new(unsigned long) cxa_noexception.cpp + #2 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7ff4fef27082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--operator new(unsigned long)--fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:338:18 in bit_read_RC +Shadow bytes around the buggy address: + 0x0c2c7fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff80d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff80e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff80f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c2c7fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00[03]fa fa + 0x0c2c7fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff8140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff8150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff8160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1110.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1110.txt new file mode 100644 index 000000000..4ed29b0f9 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1110.txt @@ -0,0 +1,78 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 648312902 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-1110 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f05fe1000b8 at pc 0x00000052e421 bp 0x7ffed5d5aa90 sp 0x7ffed5d5a260 +READ of size 256 at 0x7f05fe1000b8 thread T0 + #0 0x52e420 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x1363783 in memcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34:10 + #2 0x1363783 in dynapi_set_helper /src/libredwg/src/gen-dynapi.pl:3162:5 + #3 0x13641c3 in dwg_dynapi_header_set_value /src/libredwg/src/gen-dynapi.pl:3280:9 + #4 0x4001888 in json_HEADER /src/libredwg/src/in_json.c:1210:11 + #5 0x3ffa17e in dwg_read_json /src/libredwg/src/in_json.c:5131:18 + #6 0x56c830 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f060056c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: __asan_memcpy--memcpy--dynapi_set_helper +Address 0x7f05fe1000b8 is located in stack of thread T0 at offset 184 in frame + #0 0x3fffabf in json_HEADER /src/libredwg/src/in_json.c:1145 + +DEDUP_TOKEN: json_HEADER + This frame has 11 object(s): + [32, 112) 'key' (line 1166) + [144, 152) 'num' (line 1197) + [176, 184) 'num188' (line 1208) + [208, 216) 'num212' (line 1215) <== Memory access at offset 184 partially underflows this variable + [240, 248) 'str' (line 1223) <== Memory access at offset 184 partially underflows this variable + [272, 296) 'pt' (line 1242) <== Memory access at offset 184 partially underflows this variable + [336, 352) 'pt321' (line 1251) <== Memory access at offset 184 partially underflows this variable + [368, 376) 'nums' (line 1259) <== Memory access at offset 184 partially underflows this variable + [400, 416) 'date' (line 1276) <== Memory access at offset 184 partially underflows this variable + [432, 480) 'color' (line 1282) <== Memory access at offset 184 partially underflows this variable + [512, 520) 'hdl' (line 1288) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0fe13fc17fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe13fc17fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe13fc17fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe13fc17ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe13fc18000: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 f2 f2 +=>0x0fe13fc18010: f2 f2 f8 f2 f2 f2 00[f2]f2 f2 f8 f2 f2 f2 f8 f2 + 0x0fe13fc18020: f2 f2 f8 f8 f8 f2 f2 f2 f2 f2 f8 f8 f2 f2 f8 f2 + 0x0fe13fc18030: f2 f2 f8 f8 f2 f2 f8 f8 f8 f8 f8 f8 f2 f2 f2 f2 + 0x0fe13fc18040: f8 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe13fc18050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe13fc18060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1122.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1122.txt new file mode 100644 index 000000000..b854ae8dc --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1122.txt @@ -0,0 +1,76 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 648601376 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-1122 +Warning: utf-8: BAD_CONTINUATION_BYTE ������������������������������w��M+19��7 +Warning: utf-8: BAD_CONTINUATION_BYTE ������������������������������w��M+19��7 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fe63c802d90 at pc 0x000000519c66 bp 0x7fffb767a270 sp 0x7fffb7679a38 +READ of size 1025 at 0x7fe63c802d90 thread T0 + #0 0x519c65 in strdup /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:438:5 + #1 0x3f2e920 in dxf_header_read /src/libredwg/src/in_dxf.c:1123:23 + #2 0x3f28b33 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12752:23 + #3 0x56c944 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fe63e7de082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: strdup--dxf_header_read--dwg_read_dxf +Address 0x7fe63c802d90 is located in stack of thread T0 at offset 3472 in frame + #0 0x3f2cb0f in dxf_header_read /src/libredwg/src/in_dxf.c:1025 + +DEDUP_TOKEN: dxf_header_read + This frame has 10 object(s): + [32, 112) 'field' (line 1044) + [144, 1168) 'dest' (line 1121) + [1296, 2320) 'dest220' (line 1122) + [2448, 3472) 'dest255' (line 1123) + [3600, 4624) 'dest290' (line 1124) <== Memory access at offset 3472 partially underflows this variable + [4752, 5776) 'dest325' (line 1125) + [5904, 6928) 'dest360' (line 1126) + [7056, 7080) 'pt' (line 1170) + [7120, 7128) 'hdl' (line 1208) + [7152, 7160) 'hdl636' (line 1216) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:438:5 in strdup +Shadow bytes around the buggy address: + 0x0ffd478f8560: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffd478f8570: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffd478f8580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffd478f8590: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffd478f85a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0ffd478f85b0: 00 00[f2]f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 + 0x0ffd478f85c0: f2 f2 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 + 0x0ffd478f85d0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 + 0x0ffd478f85e0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 + 0x0ffd478f85f0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 + 0x0ffd478f8600: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1149.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1149.txt new file mode 100644 index 000000000..c0844e760 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1149.txt @@ -0,0 +1,72 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 650763479 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-1149 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61500000057a at pc 0x00000052e421 bp 0x7fff5d1bb4c0 sp 0x7fff5d1bac90 +READ of size 16 at 0x61500000057a thread T0 + #0 0x52e420 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x57a7d2 in memcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34:10 + #2 0x57a7d2 in bit_read_fixed /src/libredwg/src/bits.c:1603:7 + #3 0x57aada in bit_read_TF /src/libredwg/src/bits.c:1632:3 + #4 0x7c4a63 in decode_preR13_sentinel /src/libredwg/src/decode.c:6270:29 + #5 0x11e0f84 in decode_preR13_section /src/libredwg/src/decode_r11.c:273:9 + #6 0x11a357d in decode_preR13 /src/libredwg/src/decode_r11.c:749:12 + #7 0x58f183 in dwg_decode /src/libredwg/src/decode.c:219:17 + #8 0x56c74a in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:95:11 + #9 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f8704950082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #14 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: __asan_memcpy--memcpy--bit_read_fixed +0x61500000057a is located 6 bytes to the left of 496-byte region [0x615000000580,0x615000000770) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4ada97 in operator new(unsigned long) cxa_noexception.cpp + #2 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f8704950082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--operator new(unsigned long)--fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c2a7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2a7fff8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff8090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa +=>0x0c2a7fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa] + 0x0c2a7fff80b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff80c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff80d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2a7fff80e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa + 0x0c2a7fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1186.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1186.txt new file mode 100644 index 000000000..cbdf2d021 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-1186.txt @@ -0,0 +1,83 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 651138720 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-1186 +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f563bbd9780 at pc 0x000003f39d20 bp 0x7ffc5cbdd2d0 sp 0x7ffc5cbdd2c8 +READ of size 8 at 0x7f563bbd9780 thread T0 + #0 0x3f39d1f in dxf_tables_read /src/libredwg/src/in_dxf.c:11826:33 + #1 0x3f28bb7 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12780:23 + #2 0x56c944 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #3 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #4 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #5 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #6 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #7 0x7f563c2d4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #8 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: dxf_tables_read--dwg_read_dxf--LLVMFuzzerTestOneInput +0x7f563bbd9780 is located 188288 bytes inside of 188416-byte region [0x7f563bbab800,0x7f563bbd9800) +freed by thread T0 here: + #0 0x52f49c in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x762a40 in dwg_add_object /src/libredwg/src/decode.c:5094:35 + #2 0x3f477d1 in new_object /src/libredwg/src/in_dxf.c:8651:7 + #3 0x3f378c2 in dxf_tables_read /src/libredwg/src/in_dxf.c:11805:22 + #4 0x3f28bb7 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12780:23 + #5 0x56c944 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f563c2d4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_realloc--dwg_add_object--new_object +previously allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x762b0c in dwg_add_object /src/libredwg/src/decode.c:5083:35 + #2 0x3f27e43 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12716:7 + #3 0x56c944 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f563c2d4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_calloc--dwg_add_object--dwg_read_dxf +SUMMARY: AddressSanitizer: heap-use-after-free /src/libredwg/src/in_dxf.c:11826:33 in dxf_tables_read +Shadow bytes around the buggy address: + 0x0feb477732a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0feb477732b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0feb477732c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0feb477732d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0feb477732e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0feb477732f0:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0feb47773300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0feb47773310: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0feb47773320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0feb47773330: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0feb47773340: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-135.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-135.txt new file mode 100644 index 000000000..9c45dec4d --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-135.txt @@ -0,0 +1,77 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 651430628 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-135 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000200 at pc 0x0000004c3e19 bp 0x7ffeb245e380 sp 0x7ffeb245db48 +READ of size 51 at 0x604000000200 thread T0 + #0 0x4c3e18 in strlen /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:389:5 + #1 0x2336924 in json_write_TF /src/libredwg/src/out_json.c:1397:29 + #2 0x24b2a23 in dwg_json_LTYPE_private /src/libredwg/src/./dwg.spec:3917:5 + #3 0x24b2a23 in dwg_json_LTYPE /src/libredwg/src/./dwg.spec:3912:1 + #4 0x2366272 in dwg_json_object /src/libredwg/src/out_json.c:1768:14 + #5 0x2366272 in json_objects_write /src/libredwg/src/out_json.c:2239:15 + #6 0x233c4b9 in dwg_write_json /src/libredwg/src/out_json.c:2632:7 + #7 0x56ccb8 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:195:7 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f13dab07082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: strlen--json_write_TF--dwg_json_LTYPE_private +0x604000000200 is located 0 bytes to the right of 48-byte region [0x6040000001d0,0x604000000200) +allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x13638da in dynapi_set_helper /src/libredwg/src/gen-dynapi.pl:3118:31 + #2 0x13634a8 in dwg_dynapi_entity_set_value /src/libredwg/src/gen-dynapi.pl:3227:7 + #3 0x3f68203 in new_object /src/libredwg/src/in_dxf.c:11078:25 + #4 0x3f3c582 in dxf_blocks_read /src/libredwg/src/in_dxf.c:11993:22 + #5 0x3f28d95 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12815:23 + #6 0x56c944 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f13dab07082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_calloc--dynapi_set_helper--dwg_dynapi_entity_set_value +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:389:5 in strlen +Shadow bytes around the buggy address: + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 00 + 0x0c087fff8010: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 01 fa + 0x0c087fff8020: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 07 fa + 0x0c087fff8030: fa fa 00 00 00 00 07 fa fa fa 00 00 00 00 00 00 +=>0x0c087fff8040:[fa]fa 00 00 00 00 00 02 fa fa 00 00 00 00 00 02 + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-269.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-269.txt new file mode 100755 index 000000000..e26adf64e --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-269.txt @@ -0,0 +1,71 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1202272118 +INFO: Loaded 1 modules (523301 inline 8-bit counters): 523301 [0x5575e0f4d020, 0x5575e0fccc45), +INFO: Loaded 1 PC tables (523301 PCs): 523301 [0x5575e0fccc48,0x5575e17c8e98), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-269 +================================================================= +==8177==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b9cb58ec4d4 at pc 0x5575dd8fe34a bp 0x7fffb30181d0 sp 0x7fffb30181c8 +READ of size 1 at 0x7b9cb58ec4d4 thread T0 + #0 0x5575dd8fe349 in bit_utf8_to_TU /src/libredwg/src/bits.c:2863:26 + #1 0x5575de5708e7 in dynapi_set_helper /src/libredwg/src/gen-dynapi.pl:3146:20 + #2 0x5575de5704a8 in dwg_dynapi_entity_set_value /src/libredwg/src/gen-dynapi.pl:3232:7 + #3 0x5575e0a007c1 in new_object /src/libredwg/src/in_dxf.c:11128:25 + #4 0x5575e09e0f70 in dxf_blocks_read /src/libredwg/src/in_dxf.c:12026:22 + #5 0x5575e09d58ef in dwg_read_dxf /src/libredwg/src/in_dxf.c:12830:23 + #6 0x5575dd8ea941 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #7 0x5575dd787f0d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x5575dd772c82 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x5575dd778b50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x5575dd7a4682 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f7cb63b5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x5575dd76bd6d in _start (/out/llvmfuzz+0xeadd6d) + +0x7b9cb58ec4d4 is located 0 bytes after 4-byte region [0x7b9cb58ec4d0,0x7b9cb58ec4d4) +allocated by thread T0 here: + #0 0x5575dd8a6864 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x5575e09e85d4 in dxf_read_string /src/libredwg/src/in_dxf.c:523:27 + #2 0x5575e09d6a67 in dxf_read_pair /src/libredwg/src/in_dxf.c:574:7 + #3 0x5575e0a0ad95 in new_object /src/libredwg/src/in_dxf.c:11775:14 + #4 0x5575e09e0f70 in dxf_blocks_read /src/libredwg/src/in_dxf.c:12026:22 + #5 0x5575e09d58ef in dwg_read_dxf /src/libredwg/src/in_dxf.c:12830:23 + #6 0x5575dd8ea941 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #7 0x5575dd787f0d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x5575dd772c82 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x5575dd778b50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x5575dd7a4682 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f7cb63b5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:2863:26 in bit_utf8_to_TU +Shadow bytes around the buggy address: + 0x7b9cb58ec200: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fa + 0x7b9cb58ec280: fa fa fd fd fa fa fd fa fa fa 07 fa fa fa fd fd + 0x7b9cb58ec300: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fd + 0x7b9cb58ec380: fa fa 00 06 fa fa fd fd fa fa fd fa fa fa fd fa + 0x7b9cb58ec400: fa fa 04 fa fa fa fd fd fa fa fd fa fa fa 03 fa +=>0x7b9cb58ec480: fa fa 05 fa fa fa 00 00 fa fa[04]fa fa fa 00 fa + 0x7b9cb58ec500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b9cb58ec580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b9cb58ec600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b9cb58ec680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b9cb58ec700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==8177==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-270.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-270.txt new file mode 100755 index 000000000..806231b5f --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-270.txt @@ -0,0 +1,66 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3630409903 +INFO: Loaded 1 modules (523301 inline 8-bit counters): 523301 [0x556008c48020, 0x556008cc7c45), +INFO: Loaded 1 PC tables (523301 PCs): 523301 [0x556008cc7c48,0x5560094c3e98), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-270 +================================================================= +==8178==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b9a0bae00b4 at pc 0x5560055f937d bp 0x7ffdb84fd970 sp 0x7ffdb84fd968 +WRITE of size 2 at 0x7b9a0bae00b4 thread T0 + #0 0x5560055f937c in bit_utf8_to_TU /src/libredwg/src/bits.c:2883:23 + #1 0x5560087e7f05 in json_AppInfo /src/libredwg/src/in_json.c:3688:7 + #2 0x5560087ca90d in dwg_read_json /src/libredwg/src/in_json.c:4541:18 + #3 0x5560055e58cb in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #4 0x556005482f0d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x55600546dc82 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x556005473b50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x55600549f682 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f7a0c5b7082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x556005466d6d in _start (/out/llvmfuzz+0xeadd6d) + +0x7b9a0bae00b4 is located 0 bytes after 4-byte region [0x7b9a0bae00b0,0x7b9a0bae00b4) +allocated by thread T0 here: + #0 0x5560055a1a29 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:74:3 + #1 0x5560055f89c8 in bit_utf8_to_TU /src/libredwg/src/bits.c:2856:22 + #2 0x5560087e7f05 in json_AppInfo /src/libredwg/src/in_json.c:3688:7 + #3 0x5560087ca90d in dwg_read_json /src/libredwg/src/in_json.c:4541:18 + #4 0x5560055e58cb in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #5 0x556005482f0d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #6 0x55600546dc82 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #7 0x556005473b50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #8 0x55600549f682 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f7a0c5b7082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:2883:23 in bit_utf8_to_TU +Shadow bytes around the buggy address: + 0x7b9a0badfe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b9a0badfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b9a0badff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b9a0badff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b9a0bae0000: fa fa 00 00 fa fa 00 fa fa fa 00 fa fa fa 00 fa +=>0x7b9a0bae0080: fa fa 00 00 fa fa[04]fa fa fa fa fa fa fa fa fa + 0x7b9a0bae0100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b9a0bae0180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b9a0bae0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b9a0bae0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b9a0bae0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==8178==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-271.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-271.txt new file mode 100755 index 000000000..290f7f973 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-271.txt @@ -0,0 +1,67 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 268912157 +INFO: Loaded 1 modules (523301 inline 8-bit counters): 523301 [0x563afd9a9020, 0x563afda28c45), +INFO: Loaded 1 PC tables (523301 PCs): 523301 [0x563afda28c48,0x563afe224e98), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-271 +================================================================= +==8178==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b869ebe01d6 at pc 0x563afa35a34a bp 0x7ffdaaad7270 sp 0x7ffdaaad7268 +READ of size 1 at 0x7b869ebe01d6 thread T0 + #0 0x563afa35a349 in bit_utf8_to_TU /src/libredwg/src/bits.c:2863:26 + #1 0x563afd435add in dxf_header_read /src/libredwg/src/in_dxf.c:1154:52 + #2 0x563afd4316c0 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12767:23 + #3 0x563afa346941 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #4 0x563afa1e3f0d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x563afa1cec82 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x563afa1d4b50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x563afa200682 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f669f65d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x563afa1c7d6d in _start (/out/llvmfuzz+0xeadd6d) + +0x7b869ebe01d6 is located 0 bytes after 6-byte region [0x7b869ebe01d0,0x7b869ebe01d6) +allocated by thread T0 here: + #0 0x563afa302864 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x563afd4445d4 in dxf_read_string /src/libredwg/src/in_dxf.c:523:27 + #2 0x563afd432a67 in dxf_read_pair /src/libredwg/src/in_dxf.c:574:7 + #3 0x563afd435dcf in dxf_header_read /src/libredwg/src/in_dxf.c:1305:14 + #4 0x563afd4316c0 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12767:23 + #5 0x563afa346941 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #6 0x563afa1e3f0d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x563afa1cec82 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x563afa1d4b50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x563afa200682 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f669f65d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:2863:26 in bit_utf8_to_TU +Shadow bytes around the buggy address: + 0x7b869ebdff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b869ebdff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b869ebe0000: fa fa 00 00 fa fa 00 fa fa fa 00 fa fa fa 00 fa + 0x7b869ebe0080: fa fa 00 00 fa fa 00 05 fa fa fd fd fa fa fd fa + 0x7b869ebe0100: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fd +=>0x7b869ebe0180: fa fa fd fd fa fa 00 00 fa fa[06]fa fa fa 00 04 + 0x7b869ebe0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b869ebe0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b869ebe0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b869ebe0380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b869ebe0400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==8178==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-284.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-284.txt new file mode 100755 index 000000000..2c1256014 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-284.txt @@ -0,0 +1,81 @@ +ARCHITECTURE=x86_64 -v /mnt/nas/linke/libredwg/libredwg-8f3afc1b98de37e9263ed91dd300daa877b7e5df-address:/out -v +/home/user/oss-fuzz-for-select/pocs/tmp/testcase-OSV-2023-284:/testcase -t +gcr.io/oss-fuzz-base/base-runner@sha256:3a190cfbada024425c48aebd06558a0e974e819f69625e886b1fe2b1a138064d +reproduce llvmfuzz -runs=10. ++ FUZZER=llvmfuzz ++ shift ++ '[' '!' -v TESTCASE ']' ++ TESTCASE=/testcase ++ '[' '!' -f /testcase ']' ++ export RUN_FUZZER_MODE=interactive ++ RUN_FUZZER_MODE=interactive ++ export FUZZING_ENGINE=libfuzzer ++ FUZZING_ENGINE=libfuzzer ++ export SKIP_SEED_CORPUS=1 ++ SKIP_SEED_CORPUS=1 ++ run_fuzzer llvmfuzz -runs=10 /testcase +vm.mmap_rnd_bits = 28 +/out/llvmfuzz -- -rss_limit_mb=2560 -timeout=25 -runs=10 /testcase -detect_leaks=0 < /dev/null +INFO: libFuzzer ignores flags that start with '--' +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 218555589 +INFO: Loaded 1 modules (568111 inline 8-bit counters): 568111 [0x4b76ec0, 0x4c019ef), +INFO: Loaded 1 PC tables (568111 PCs): 568111 [0x4032c38,0x48ddf28), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /testcase +================================================================= +==18==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000004b75490 at pc 0x000003ad781b bp +0x7fffcaaf2c40 sp 0x7fffcaaf2c38 +READ of size 8 at 0x000004b75490 thread T0 +SCARINESS: 33 (8-byte-read-global-buffer-overflow-far-from-bounds) + #0 0x3ad781a in dwg_codepage_dxfstr /src/libredwg/src/codepages.c:186:12 + #1 0x12d75c6 in dxf_codepage /src/libredwg/src/out_dxf.c:2996:21 + #2 0x12d75c6 in dxf_header_write /src/libredwg/src/out_dxf.c:3113:26 + #3 0x12d3d59 in dwg_write_dxf /src/libredwg/src/out_dxf.c:3788:3 + #4 0x56ccdd in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:186:7 + #5 0x43def3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +/src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429652 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) +/src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42eefc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) +/src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458432 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f859bb66082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: +5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x41f81d in _start (/out/llvmfuzz+0x41f81d) + +DEDUP_TOKEN: dwg_codepage_dxfstr--dxf_codepage--dxf_header_write +Address 0x000004b75490 is a wild pointer inside of access range of size 0x000000000008. +SUMMARY: AddressSanitizer: global-buffer-overflow /src/libredwg/src/codepages.c:186:12 in dwg_codepage_dxfstr +Shadow bytes around the buggy address: +0x000080966a40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +0x000080966a50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +0x000080966a60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 +0x000080966a70: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 +0x000080966a80: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 +=>0x000080966a90: f9 f9[f9]f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 +0x000080966aa0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 +0x000080966ab0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 +0x000080966ac0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 +0x000080966ad0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 +0x000080966ae0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 +Shadow byte legend (one shadow byte represents 8 application bytes): +Addressable: 00 +Partially addressable: 01 02 03 04 05 06 07 +Heap left redzone: fa +Freed heap region: fd +Stack left redzone: f1 +Stack mid redzone: f2 +Stack right redzone: f3 +Stack after return: f5 +Stack use after scope: f8 +Global redzone: f9 +Global init order: f6 +Poisoned by user: f7 +Container overflow: fc +Array cookie: ac +Intra object redzone: bb +ASan internal: fe +Left alloca redzone: ca +Right alloca redzone: cb +==18==ABORTING \ No newline at end of file diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-314.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-314.txt new file mode 100755 index 000000000..03b18a928 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-314.txt @@ -0,0 +1,65 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 762912480 +INFO: Loaded 1 modules (553470 inline 8-bit counters): 553470 [0x56148577f560, 0x56148580675e), +INFO: Loaded 1 PC tables (553470 PCs): 553470 [0x561485806760,0x561486078740), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-314 +================================================================= +==8361==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7cb3bb0e1b88 at pc 0x561484064ac0 bp 0x7ffcf5a126f0 sp 0x7ffcf5a126e8 +READ of size 8 at 0x7cb3bb0e1b88 thread T0 + #0 0x561484064abf in dwg_encode /src/libredwg/src/encode.c:3860:51 + #1 0x561481d92b72 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:180:9 + #2 0x561481c2ff2d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x561481c1aca2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x561481c20b70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x561481c4c6a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f03bbb88082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #7 0x561481c13d8d in _start (/out/llvmfuzz+0xf65d8d) + +0x7cb3bb0e1b88 is located 8 bytes after 1536-byte region [0x7cb3bb0e1580,0x7cb3bb0e1b80) +allocated by thread T0 here: + #0 0x561481d4ea49 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:74:3 + #1 0x5614852016ee in dwg_sections_init /src/libredwg/src/dwg.c:3325:42 + #2 0x561482ac7a98 in dwg_add_Document /src/libredwg/src/dwg_api.c:22378:11 + #3 0x561482895d49 in decode_preR13 /src/libredwg/src/decode_r11.c:623:12 + #4 0x561481dac550 in dwg_decode /src/libredwg/src/decode.c:217:17 + #5 0x561481d92844 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:95:11 + #6 0x561481c2ff2d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x561481c1aca2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x561481c20b70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x561481c4c6a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f03bbb88082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/encode.c:3860:51 in dwg_encode +Shadow bytes around the buggy address: + 0x7cb3bb0e1900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7cb3bb0e1980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7cb3bb0e1a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7cb3bb0e1a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7cb3bb0e1b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7cb3bb0e1b80: fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb3bb0e1c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb3bb0e1c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb3bb0e1d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb3bb0e1d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb3bb0e1e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==8361==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-316.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-316.txt new file mode 100755 index 000000000..ee6af7798 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-316.txt @@ -0,0 +1,27 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 195157603 +INFO: Loaded 1 modules (556695 inline 8-bit counters): 556695 [0x4b2a7e0, 0x4bb2677), +INFO: Loaded 1 PC tables (556695 PCs): 556695 [0x4001148,0x487fab8), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-316 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==8338==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x000001237124 bp 0x7ffcb0169290 sp 0x7ffcb0169270 T0) +==8338==The signal is caused by a READ memory access. +==8338==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x1237124 in dwg_ref_get_object /src/libredwg/src/dwg_api.c:21977:17 + #1 0x28ccbb7 in dwg_geojson_feature /src/libredwg/src/out_geojson.c:518:25 + #2 0x28c2d17 in dwg_geojson_object /src/libredwg/src/out_geojson.c:879:9 + #3 0x28c199e in geojson_entities_write /src/libredwg/src/out_geojson.c:922:17 + #4 0x28c064b in dwg_write_geojson /src/libredwg/src/out_geojson.c:950:7 + #5 0x56cb30 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:199:7 + #6 0x43def3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429652 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42eefc in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458432 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fd60082e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f81d in _start (/out/llvmfuzz+0x41f81d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/libredwg/src/dwg_api.c:21977:17 in dwg_ref_get_object +==8338==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-397.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-397.txt new file mode 100644 index 000000000..157b50fa0 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-397.txt @@ -0,0 +1,72 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 653332246 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-397 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000013a at pc 0x000002336da5 bp 0x7fff92950300 sp 0x7fff929502f8 +READ of size 1 at 0x60200000013a thread T0 + #0 0x2336da4 in json_write_TF /src/libredwg/src/out_json.c:1432:21 + #1 0x23fc599 in json_preR13_header_write_private /src/libredwg/src/./header_variables_r11.spec:136:3 + #2 0x233a393 in json_header_write /src/libredwg/src/out_json.c:1957:13 + #3 0x233a393 in dwg_write_json /src/libredwg/src/out_json.c:2619:3 + #4 0x56ccb8 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:195:7 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f43d79bf082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: json_write_TF--json_preR13_header_write_private--json_header_write +0x60200000013a is located 0 bytes to the right of 10-byte region [0x602000000130,0x60200000013a) +allocated by thread T0 here: + #0 0x52f49c in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x11bb32b in decode_preR13_header_variables /src/libredwg/src/./header_variables_r11.spec:165:27 + #2 0x11a17a7 in decode_preR13 /src/libredwg/src/decode_r11.c:698:12 + #3 0x58f183 in dwg_decode /src/libredwg/src/decode.c:219:17 + #4 0x56c74a in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:95:11 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f43d79bf082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_realloc--decode_preR13_header_variables--decode_preR13 +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/out_json.c:1432:21 in json_write_TF +Shadow bytes around the buggy address: + 0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c047fff8000: fa fa 00 00 fa fa 00 fa fa fa 00 fa fa fa 00 fa + 0x0c047fff8010: fa fa fd fd fa fa 00 07 fa fa 00 fa fa fa 00 fa +=>0x0c047fff8020: fa fa fd fd fa fa 00[02]fa fa fa fa fa fa fa fa + 0x0c047fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-412.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-412.txt new file mode 100644 index 000000000..d436d6d7f --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-412.txt @@ -0,0 +1,30 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 667826945 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-412 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000003 (pc 0x0000004aff54 bp 0x000000000000 sp 0x7ffef2bbce80 T0) +==1==The signal is caused by a WRITE memory access. +==1==Hint: address points to the zero page. + #0 0x4aff54 in atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t> /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81:10 + #1 0x4aff54 in AtomicallySetQuarantineFlagIfAllocated /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:610:10 + #2 0x4aff54 in __asan::Allocator::Deallocate(void*, unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType) /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:685:10 + #3 0x52ee55 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:53:3 + #4 0x1359048 in dwg_free /src/libredwg/src/free.c:1674:9 + #5 0x56cdec in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:207:3 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x43ea25 in fuzzer::Fuzzer::TryDetectingAMemoryLeak(unsigned char const*, unsigned long, bool) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:687:3 + #8 0x4296ae in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:8 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f733759d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t>--AtomicallySetQuarantineFlagIfAllocated--__asan::Allocator::Deallocate(void*, unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType) +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81:10 in atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t> +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-415.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-415.txt new file mode 100644 index 000000000..db8022b60 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-415.txt @@ -0,0 +1,29 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 668351576 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-415 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000006a (pc 0x0000004aff54 bp 0x000000000000 sp 0x7ffc8bab3320 T0) +==1==The signal is caused by a WRITE memory access. +==1==Hint: address points to the zero page. + #0 0x4aff54 in atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t> /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81:10 + #1 0x4aff54 in AtomicallySetQuarantineFlagIfAllocated /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:610:10 + #2 0x4aff54 in __asan::Allocator::Deallocate(void*, unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType) /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:685:10 + #3 0x52ee55 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:53:3 + #4 0x2e16751 in dwg_encode /src/libredwg/src/encode.c:3510:7 + #5 0x56cdc8 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:180:9 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fb20dfbd082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t>--AtomicallySetQuarantineFlagIfAllocated--__asan::Allocator::Deallocate(void*, unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType) +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81:10 in atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t> +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-42.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-42.txt new file mode 100644 index 000000000..267ca202d --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-42.txt @@ -0,0 +1,70 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 654405812 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-42 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60600000011a at pc 0x00000056e272 bp 0x7ffe6a4c37c0 sp 0x7ffe6a4c37b8 +READ of size 1 at 0x60600000011a thread T0 + #0 0x56e271 in bit_read_BB /src/libredwg/src/bits.c:198:10 + #1 0x896611 in dwg_decode_MINSERT_private /src/libredwg/src/./dwg.spec:912:11 + #2 0x768659 in dwg_decode_MINSERT /src/libredwg/src/./dwg.spec:886:1 + #3 0x763cba in dwg_decode_add_object /src/libredwg/src/decode.c:5264:15 + #4 0x59e605 in decode_R13_R2000 /src/libredwg/src/decode.c:832:19 + #5 0x58f238 in dwg_decode /src/libredwg/src/decode.c:229:12 + #6 0x56c74a in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:95:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f2ec63ae082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: bit_read_BB--dwg_decode_MINSERT_private--dwg_decode_MINSERT +0x60600000011a is located 0 bytes to the right of 58-byte region [0x6060000000e0,0x60600000011a) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4ada97 in operator new(unsigned long) cxa_noexception.cpp + #2 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f2ec63ae082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--operator new(unsigned long)--fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:198:10 in bit_read_BB +Shadow bytes around the buggy address: + 0x0c0c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c0c7fff8010: 00 00 00 00 00 00 00 02 fa fa fa fa 00 00 00 00 +=>0x0c0c7fff8020: 00 00 00[02]fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-440.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-440.txt new file mode 100755 index 000000000..b70b95375 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-440.txt @@ -0,0 +1,44 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1956128485 +INFO: Loaded 1 modules (589514 inline 8-bit counters): 589514 [0x565368f2a260, 0x565368fba12a), +INFO: Loaded 1 PC tables (589514 PCs): 589514 [0x565368fba130,0x5653698b8dd0), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-440 +================================================================= +==8295==ERROR: AddressSanitizer: attempting double-free on 0x7bc1c82e01d0 in thread T0: + #0 0x5653652995e6 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3 + #1 0x5653660f91b8 in free_preR13_object /src/libredwg/src/free.c:939:5 + #2 0x5653660fbd1f in dwg_free /src/libredwg/src/free.c:1648:13 + #3 0x5653652ddbba in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c + #4 0x56536517af2d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x565365165ca2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x56536516bb70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x5653651976a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fa1c8d4a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x56536515ed8d in _start (/out/llvmfuzz+0x1046d8d) + +0x7bc1c82e01d0 is located 0 bytes inside of 14-byte region [0x7bc1c82e01d0,0x7bc1c82e01de) +freed by thread T0 here: + #0 0x5653652995e6 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3 + #1 0x565368808e40 in dxf_blocks_read /src/libredwg/src/in_dxf.c:11976:19 + #2 0x5653687fd861 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12786:23 + #3 0x5653652dd966 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #4 0x56536517af2d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x565365165ca2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x56536516bb70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x5653651976a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fa1c8d4a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +previously allocated by thread T0 here: + #0 0x56536527ff0a in strdup /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:596:3 + #1 0x5653688089cd in dxf_blocks_read /src/libredwg/src/in_dxf.c:11959:31 + #2 0x5653687fd861 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12786:23 + #3 0x5653652dd966 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #4 0x56536517af2d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x565365165ca2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x56536516bb70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x5653651976a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fa1c8d4a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: double-free /src/libredwg/src/free.c:939:5 in free_preR13_object +==8295==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-452.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-452.txt new file mode 100644 index 000000000..8ebd7efcd --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-452.txt @@ -0,0 +1,77 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 655099900 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-452 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000200 at pc 0x0000004c3e19 bp 0x7ffea975ac40 sp 0x7ffea975a408 +READ of size 51 at 0x604000000200 thread T0 + #0 0x4c3e18 in strlen /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:389:5 + #1 0x2336924 in json_write_TF /src/libredwg/src/out_json.c:1397:29 + #2 0x24b2a23 in dwg_json_LTYPE_private /src/libredwg/src/./dwg.spec:3917:5 + #3 0x24b2a23 in dwg_json_LTYPE /src/libredwg/src/./dwg.spec:3912:1 + #4 0x2366272 in dwg_json_object /src/libredwg/src/out_json.c:1768:14 + #5 0x2366272 in json_objects_write /src/libredwg/src/out_json.c:2239:15 + #6 0x233c4b9 in dwg_write_json /src/libredwg/src/out_json.c:2632:7 + #7 0x56ccb8 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:195:7 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f7c0f0d8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: strlen--json_write_TF--dwg_json_LTYPE_private +0x604000000200 is located 0 bytes to the right of 48-byte region [0x6040000001d0,0x604000000200) +allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x13638da in dynapi_set_helper /src/libredwg/src/gen-dynapi.pl:3118:31 + #2 0x13634a8 in dwg_dynapi_entity_set_value /src/libredwg/src/gen-dynapi.pl:3227:7 + #3 0x3f68203 in new_object /src/libredwg/src/in_dxf.c:11078:25 + #4 0x3f3c582 in dxf_blocks_read /src/libredwg/src/in_dxf.c:11993:22 + #5 0x3f28d95 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12815:23 + #6 0x56c944 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f7c0f0d8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_calloc--dynapi_set_helper--dwg_dynapi_entity_set_value +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:389:5 in strlen +Shadow bytes around the buggy address: + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 00 + 0x0c087fff8010: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 01 fa + 0x0c087fff8020: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 07 fa + 0x0c087fff8030: fa fa 00 00 00 00 07 fa fa fa 00 00 00 00 00 00 +=>0x0c087fff8040:[fa]fa 00 00 00 00 00 02 fa fa 00 00 00 00 00 02 + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-455.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-455.txt new file mode 100755 index 000000000..e6018e6c1 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-455.txt @@ -0,0 +1,72 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4050787907 +INFO: Loaded 1 modules (569517 inline 8-bit counters): 569517 [0x558c7f883460, 0x558c7f90e50d), +INFO: Loaded 1 PC tables (569517 PCs): 569517 [0x558c7f90e510,0x558c801befe0), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-455 +================================================================= +==8291==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7bc22b2e0dd1 at pc 0x558c7bddd4eb bp 0x7fff831cee50 sp 0x7fff831cee48 +WRITE of size 1 at 0x7bc22b2e0dd1 thread T0 + #0 0x558c7bddd4ea in bit_TV_to_utf8 /src/libredwg/src/bits.c:3073:11 + #1 0x558c7d7dd75a in json_cquote /src/libredwg/src/out_json.c:1436:19 + #2 0x558c7e0babcc in dwg_geojson_feature /src/libredwg/src/out_geojson.c:423:3 + #3 0x558c7e0afdaa in dwg_geojson_object /src/libredwg/src/out_geojson.c:944:9 + #4 0x558c7e0ae4ff in geojson_entities_write /src/libredwg/src/out_geojson.c:988:17 + #5 0x558c7e0acfab in dwg_write_geojson /src/libredwg/src/out_geojson.c:1016:7 + #6 0x558c7bdc7b02 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:199:7 + #7 0x558c7bc64f2d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x558c7bc4fca2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x558c7bc55b70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x558c7bc816a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fa22be0d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x558c7bc48d8d in _start (/out/llvmfuzz+0xfc8d8d) + +0x7bc22b2e0dd1 is located 0 bytes after 1-byte region [0x7bc22b2e0dd0,0x7bc22b2e0dd1) +allocated by thread T0 here: + #0 0x558c7bd83884 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x558c7bddcced in bit_TV_to_utf8 /src/libredwg/src/bits.c:3007:28 + #2 0x558c7d7dd75a in json_cquote /src/libredwg/src/out_json.c:1436:19 + #3 0x558c7e0babcc in dwg_geojson_feature /src/libredwg/src/out_geojson.c:423:3 + #4 0x558c7e0afdaa in dwg_geojson_object /src/libredwg/src/out_geojson.c:944:9 + #5 0x558c7e0ae4ff in geojson_entities_write /src/libredwg/src/out_geojson.c:988:17 + #6 0x558c7e0acfab in dwg_write_geojson /src/libredwg/src/out_geojson.c:1016:7 + #7 0x558c7bdc7b02 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:199:7 + #8 0x558c7bc64f2d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #9 0x558c7bc4fca2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #10 0x558c7bc55b70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #11 0x558c7bc816a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7fa22be0d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:3073:11 in bit_TV_to_utf8 +Shadow bytes around the buggy address: + 0x7bc22b2e0b00: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x7bc22b2e0b80: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x7bc22b2e0c00: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa + 0x7bc22b2e0c80: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 00 07 + 0x7bc22b2e0d00: fa fa 01 fa fa fa fd fa fa fa fd fa fa fa 00 02 +=>0x7bc22b2e0d80: fa fa fd fa fa fa fd fa fa fa[01]fa fa fa fd fa + 0x7bc22b2e0e00: fa fa fd fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bc22b2e0e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bc22b2e0f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bc22b2e0f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bc22b2e1000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==8291==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-46.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-46.txt new file mode 100755 index 000000000..cde60b70b --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-46.txt @@ -0,0 +1,67 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2139615032 +INFO: Loaded 1 modules (523667 inline 8-bit counters): 523667 [0x557d8b806f20, 0x557d8b886cb3), +INFO: Loaded 1 PC tables (523667 PCs): 523667 [0x557d8b886cb8,0x557d8c0845e8), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-46 +================================================================= +==7829==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c358f0e2cd5 at pc 0x557d89b5ab69 bp 0x7ffcb16e2ff0 sp 0x7ffcb16e2fe8 +WRITE of size 1 at 0x7c358f0e2cd5 thread T0 + #0 0x557d89b5ab68 in json_cquote /src/libredwg/src/out_json.c + #1 0x557d89b9058e in json_preR13_header_write_private /src/libredwg/src/./header_variables_r11.spec:141:3 + #2 0x557d89b5dccb in json_header_write /src/libredwg/src/out_json.c:1884:11 + #3 0x557d89b5aded in dwg_write_json /src/libredwg/src/out_json.c:2410:3 + #4 0x557d8819aaf6 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:195:7 + #5 0x557d88037f0d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #6 0x557d88022c82 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #7 0x557d88028b50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #8 0x557d88054682 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f158fc13082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x557d8801bd6d in _start (/out/llvmfuzz+0xeafd6d) + +0x7c358f0e2cd5 is located 0 bytes after 277-byte region [0x7c358f0e2bc0,0x7c358f0e2cd5) +allocated by thread T0 here: + #0 0x557d88156864 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x557d89b90577 in json_preR13_header_write_private /src/libredwg/src/./header_variables_r11.spec:141:3 + #2 0x557d89b5dccb in json_header_write /src/libredwg/src/out_json.c:1884:11 + #3 0x557d89b5aded in dwg_write_json /src/libredwg/src/out_json.c:2410:3 + #4 0x557d8819aaf6 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:195:7 + #5 0x557d88037f0d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #6 0x557d88022c82 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #7 0x557d88028b50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #8 0x557d88054682 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f158fc13082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/out_json.c in json_cquote +Shadow bytes around the buggy address: + 0x7c358f0e2a00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x7c358f0e2a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7c358f0e2b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7c358f0e2b80: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x7c358f0e2c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7c358f0e2c80: 00 00 00 00 00 00 00 00 00 00[05]fa fa fa fa fa + 0x7c358f0e2d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c358f0e2d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c358f0e2e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c358f0e2e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c358f0e2f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7829==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-634.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-634.txt new file mode 100644 index 000000000..b0545a654 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-634.txt @@ -0,0 +1,71 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 656047173 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-634 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60600000011c at pc 0x00000056e272 bp 0x7ffe7e3a2d80 sp 0x7ffe7e3a2d78 +READ of size 1 at 0x60600000011c thread T0 + #0 0x56e271 in bit_read_BB /src/libredwg/src/bits.c:198:10 + #1 0x571cc2 in bit_read_BS /src/libredwg/src/bits.c:610:38 + #2 0x8801df in dwg_decode_ATTDEF_private /src/libredwg/src/./dwg.spec:470:7 + #3 0x765fc9 in dwg_decode_ATTDEF /src/libredwg/src/./dwg.spec:394:1 + #4 0x763f97 in dwg_decode_add_object /src/libredwg/src/decode.c:5221:15 + #5 0x59e605 in decode_R13_R2000 /src/libredwg/src/decode.c:832:19 + #6 0x58f238 in dwg_decode /src/libredwg/src/decode.c:229:12 + #7 0x56c74a in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:95:11 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f719ee7e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: bit_read_BB--bit_read_BS--dwg_decode_ATTDEF_private +0x60600000011c is located 0 bytes to the right of 60-byte region [0x6060000000e0,0x60600000011c) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4ada97 in operator new(unsigned long) cxa_noexception.cpp + #2 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f719ee7e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--operator new(unsigned long)--fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:198:10 in bit_read_BB +Shadow bytes around the buggy address: + 0x0c0c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c0c7fff8010: 00 00 00 00 00 00 00 04 fa fa fa fa 00 00 00 00 +=>0x0c0c7fff8020: 00 00 00[04]fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-717.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-717.txt new file mode 100644 index 000000000..23d0bf17c --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-717.txt @@ -0,0 +1,78 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 656773257 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-717 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000113 at pc 0x000000589039 bp 0x7ffde6b8beb0 sp 0x7ffde6b8bea8 +READ of size 1 at 0x602000000113 thread T0 + #0 0x589038 in bit_TV_to_utf8_codepage /src/libredwg/src/bits.c:3135:15 + #1 0x588552 in bit_TV_to_utf8 /src/libredwg/src/bits.c:3224:16 + #2 0xa7588c in dwg_decode_LAYOUT_private /src/libredwg/src/./dwg.spec:5564:3 + #3 0x773d39 in dwg_decode_LAYOUT /src/libredwg/src/./dwg.spec:5560:1 + #4 0x764446 in dwg_decode_add_object /src/libredwg/src/decode.c + #5 0x59e605 in decode_R13_R2000 /src/libredwg/src/decode.c:832:19 + #6 0x58f238 in dwg_decode /src/libredwg/src/decode.c:229:12 + #7 0x56c74a in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:95:11 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f02fe01f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: bit_TV_to_utf8_codepage--bit_TV_to_utf8--dwg_decode_LAYOUT_private +0x602000000113 is located 0 bytes to the right of 3-byte region [0x602000000110,0x602000000113) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x57bc2d in bit_read_TV /src/libredwg/src/bits.c:1729:28 + #2 0xa7580b in dwg_decode_LAYOUT_private /src/libredwg/src/./dwg.spec:5564:3 + #3 0x773d39 in dwg_decode_LAYOUT /src/libredwg/src/./dwg.spec:5560:1 + #4 0x764446 in dwg_decode_add_object /src/libredwg/src/decode.c + #5 0x59e605 in decode_R13_R2000 /src/libredwg/src/decode.c:832:19 + #6 0x58f238 in dwg_decode /src/libredwg/src/decode.c:229:12 + #7 0x56c74a in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:95:11 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f02fe01f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--bit_read_TV--dwg_decode_LAYOUT_private +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:3135:15 in bit_TV_to_utf8_codepage +Shadow bytes around the buggy address: + 0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c047fff8000: fa fa 00 00 fa fa 00 fa fa fa 00 fa fa fa 00 fa + 0x0c047fff8010: fa fa 01 fa fa fa 01 fa fa fa 01 fa fa fa 01 fa +=>0x0c047fff8020: fa fa[03]fa fa fa fd fa fa fa fd fd fa fa fd fd + 0x0c047fff8030: fa fa 07 fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-748.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-748.txt new file mode 100644 index 000000000..cd02cc4f0 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-748.txt @@ -0,0 +1,29 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 670282192 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-748 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x0000004aff54 bp 0x000000000000 sp 0x7ffc11571900 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x4aff54 in atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t> /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81:10 + #1 0x4aff54 in AtomicallySetQuarantineFlagIfAllocated /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:610:10 + #2 0x4aff54 in __asan::Allocator::Deallocate(void*, unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType) /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:685:10 + #3 0x52ee55 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:53:3 + #4 0x2e16b82 in dwg_encode /src/libredwg/src/encode.c:3511:7 + #5 0x56cdc8 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:180:9 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f5072fe7082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t>--AtomicallySetQuarantineFlagIfAllocated--__asan::Allocator::Deallocate(void*, unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType) +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81:10 in atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t> +==1==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-758.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-758.txt new file mode 100755 index 000000000..45b9e9435 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-758.txt @@ -0,0 +1,54 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3012883348 +INFO: Loaded 1 modules (589514 inline 8-bit counters): 589514 [0x55ef19d43260, 0x55ef19dd312a), +INFO: Loaded 1 PC tables (589514 PCs): 589514 [0x55ef19dd3130,0x55ef1a6d1dd0), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-758 +ERROR: Out of memory +================================================================= +==8296==ERROR: AddressSanitizer: attempting double-free on 0x7bc8d25e0350 in thread T0: + #0 0x55ef160b25e6 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3 + #1 0x55ef1610dce3 in bit_TV_to_utf8 /src/libredwg/src/bits.c + #2 0x55ef17c6a59a in json_cquote /src/libredwg/src/out_json.c:1466:13 + #3 0x55ef17cffcde in json_header_write_private /src/libredwg/src/./header_variables.spec:422:7 + #4 0x55ef17c6e58f in json_header_write /src/libredwg/src/out_json.c:1962:11 + #5 0x55ef17c6b627 in dwg_write_json /src/libredwg/src/out_json.c:2595:3 + #6 0x55ef160f6b39 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:195:7 + #7 0x55ef15f93f2d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x55ef15f7eca2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x55ef15f84b70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x55ef15fb06a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fa8d3108082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x55ef15f77d8d in _start (/out/llvmfuzz+0x1046d8d) + +0x7bc8d25e0350 is located 0 bytes inside of 14-byte region [0x7bc8d25e0350,0x7bc8d25e035e) +freed by thread T0 here: + #0 0x55ef160b2c6c in realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:81:3 + #1 0x55ef1610dbe9 in bit_TV_to_utf8 /src/libredwg/src/bits.c:3228:36 + #2 0x55ef17c6a59a in json_cquote /src/libredwg/src/out_json.c:1466:13 + #3 0x55ef17cffcde in json_header_write_private /src/libredwg/src/./header_variables.spec:422:7 + #4 0x55ef17c6e58f in json_header_write /src/libredwg/src/out_json.c:1962:11 + #5 0x55ef17c6b627 in dwg_write_json /src/libredwg/src/out_json.c:2595:3 + #6 0x55ef160f6b39 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:195:7 + #7 0x55ef15f93f2d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x55ef15f7eca2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x55ef15f84b70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x55ef15fb06a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fa8d3108082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +previously allocated by thread T0 here: + #0 0x55ef160b2884 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55ef1610d940 in bit_TV_to_utf8 /src/libredwg/src/bits.c:3186:28 + #2 0x55ef17c6a59a in json_cquote /src/libredwg/src/out_json.c:1466:13 + #3 0x55ef17cffcde in json_header_write_private /src/libredwg/src/./header_variables.spec:422:7 + #4 0x55ef17c6e58f in json_header_write /src/libredwg/src/out_json.c:1962:11 + #5 0x55ef17c6b627 in dwg_write_json /src/libredwg/src/out_json.c:2595:3 + #6 0x55ef160f6b39 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:195:7 + #7 0x55ef15f93f2d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x55ef15f7eca2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x55ef15f84b70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x55ef15fb06a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fa8d3108082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: double-free /src/libredwg/src/bits.c in bit_TV_to_utf8 +==8296==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-777.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-777.txt new file mode 100644 index 000000000..5b40f979e --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-777.txt @@ -0,0 +1,75 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 657642824 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-777 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6120000008c1 at pc 0x00000147b484 bp 0x7fff232f4a10 sp 0x7fff232f4a08 +READ of size 1 at 0x6120000008c1 thread T0 + #0 0x147b483 in cquote /src/libredwg/src/out_dxf.c:1188:19 + #1 0x147b483 in dxf_fixup_string /src/libredwg/src/out_dxf.c:1246:31 + #2 0x1490e64 in dxf_header_write /src/libredwg/src/./header_variables_dxf.spec:150:5 + #3 0x1480ff9 in dwg_write_dxf /src/libredwg/src/out_dxf.c:3760:3 + #4 0x56cced in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:186:7 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x43ea25 in fuzzer::Fuzzer::TryDetectingAMemoryLeak(unsigned char const*, unsigned long, bool) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:687:3 + #7 0x4296ae in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:8 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f2d11cf4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: cquote--dxf_fixup_string--dxf_header_write +0x6120000008c1 is located 0 bytes to the right of 257-byte region [0x6120000007c0,0x6120000008c1) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x57bc2d in bit_read_TV /src/libredwg/src/bits.c:1729:28 + #2 0x6000e2 in dwg_decode_header_variables /src/libredwg/src/./header_variables.spec:335:9 + #3 0x5a1215 in decode_R13_R2000 /src/libredwg/src/decode.c:509:12 + #4 0x58f238 in dwg_decode /src/libredwg/src/decode.c:229:12 + #5 0x56c74a in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:95:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x43ea25 in fuzzer::Fuzzer::TryDetectingAMemoryLeak(unsigned char const*, unsigned long, bool) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:687:3 + #8 0x4296ae in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:8 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f2d11cf4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--bit_read_TV--dwg_decode_header_variables +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/out_dxf.c:1188:19 in cquote +Shadow bytes around the buggy address: + 0x0c247fff80c0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c247fff80d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c247fff80e0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa + 0x0c247fff80f0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c247fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c247fff8110: 00 00 00 00 00 00 00 00[01]fa fa fa fa fa fa fa + 0x0c247fff8120: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c247fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c247fff8140: 00 00 00 00 00 00 00 00 01 fa fa fa fa fa fa fa + 0x0c247fff8150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c247fff8160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-811.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-811.txt new file mode 100644 index 000000000..e1486735d --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-811.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 671171223 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-811 +================================================================= +==1==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x7fdf81700a40 in thread T0 + #0 0x52f49c in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x58c970 in bit_chain_alloc_size /src/libredwg/src/bits.c:3770:30 + #2 0x56fd0d in bit_chain_alloc /src/libredwg/src/bits.c:3788:3 + #3 0x56fd0d in bit_write_RC /src/libredwg/src/bits.c:365:9 + #4 0x578f43 in bit_H_to_dat /src/libredwg/src/bits.c:1450:9 + #5 0x2e1930a in dwg_encode /src/libredwg/src/encode.c:3520:7 + #6 0x56cdc8 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:180:9 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fdf8383a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: __interceptor_realloc--bit_chain_alloc_size--bit_chain_alloc +Address 0x7fdf81700a40 is located in stack of thread T0 at offset 2624 in frame + #0 0x2e0110f in dwg_encode /src/libredwg/src/encode.c:2381 + +DEDUP_TOKEN: dwg_encode + This frame has 34 object(s): + [32, 36) 'error' (line 2383) + [48, 1168) 'sec_dat' (line 2395) + [1296, 1298) 'placeholder_type' (line 2451) + [1312, 1328) 'tmap.sroa.5' (line 3237) + [1344, 1352) 'chain4523' (line 3510) + [1376, 1432) 'hdat' (line 3510) + [1472, 1480) 'chain4600' (line 3511) + [1504, 1560) 'hdat4601' (line 3511) + [1600, 1608) 'chain4679' (line 3512) + [1632, 1688) 'hdat4680' (line 3512) + [1728, 1736) 'chain4758' (line 3513) + [1760, 1816) 'hdat4759' (line 3513) + [1856, 1864) 'chain4837' (line 3514) + [1888, 1944) 'hdat4838' (line 3514) + [1984, 1992) 'chain4916' (line 3515) + [2016, 2072) 'hdat4917' (line 3515) + [2112, 2120) 'chain4995' (line 3516) + [2144, 2200) 'hdat4996' (line 3516) + [2240, 2248) 'chain5074' (line 3517) + [2272, 2328) 'hdat5075' (line 3517) + [2368, 2376) 'chain5153' (line 3518) + [2400, 2456) 'hdat5154' (line 3518) + [2496, 2504) 'chain5232' (line 3519) + [2528, 2584) 'hdat5233' (line 3519) + [2624, 2632) 'chain5312' (line 3520) <== Memory access at offset 2624 is inside this variable + [2656, 2712) 'hdat5313' (line 3520) + [2752, 2760) 'chain5391' (line 3521) + [2784, 2840) 'hdat5392' (line 3521) + [2880, 2888) 'chain5470' (line 3522) + [2912, 2968) 'hdat5471' (line 3522) + [3008, 3016) 'chain5549' (line 3523) + [3040, 3096) 'hdat5550' (line 3523) + [3136, 3192) 'file_dat' (line 4112) + [3232, 3245) 'enc_file_ID_string' (line 4118) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: bad-free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 in __interceptor_realloc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-850.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-850.txt new file mode 100755 index 000000000..391fe4c4d --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-850.txt @@ -0,0 +1,74 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 900550373 +INFO: Loaded 1 modules (589559 inline 8-bit counters): 589559 [0x561074f38280, 0x561074fc8177), +INFO: Loaded 1 PC tables (589559 PCs): 589559 [0x561074fc8178,0x5610758c70e8), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-850 +================================================================= +==8296==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b71c85e1932 at pc 0x5610713011a6 bp 0x7ffeec92ed10 sp 0x7ffeec92ed08 +WRITE of size 1 at 0x7b71c85e1932 thread T0 + #0 0x5610713011a5 in bit_TV_to_utf8 /src/libredwg/src/bits.c:3261:15 + #1 0x561072e5dcda in json_cquote /src/libredwg/src/out_json.c:1466:13 + #2 0x56107323cf15 in dwg_json_LAYOUT_private /src/libredwg/src/./dwg.spec:5570:3 + #3 0x561072f6e763 in dwg_json_LAYOUT /src/libredwg/src/./dwg.spec:5554:1 + #4 0x561072f1e17b in dwg_json_object /src/libredwg/src/out_json.c:1828:14 + #5 0x561072e63d7b in json_objects_write /src/libredwg/src/out_json.c:2215:15 + #6 0x561072e5edc8 in dwg_write_json /src/libredwg/src/out_json.c:2608:7 + #7 0x5610712e9b49 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:195:7 + #8 0x561071186f3d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #9 0x561071171cb2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #10 0x561071177b80 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #11 0x5610711a36b2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f51c9098082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x56107116ad9d in _start (/out/llvmfuzz+0x1046d9d) + +0x7b71c85e1932 is located 0 bytes after 2-byte region [0x7b71c85e1930,0x7b71c85e1932) +allocated by thread T0 here: + #0 0x5610712a5894 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x561071300938 in bit_TV_to_utf8 /src/libredwg/src/bits.c:3190:28 + #2 0x561072e5dcda in json_cquote /src/libredwg/src/out_json.c:1466:13 + #3 0x56107323cf15 in dwg_json_LAYOUT_private /src/libredwg/src/./dwg.spec:5570:3 + #4 0x561072f6e763 in dwg_json_LAYOUT /src/libredwg/src/./dwg.spec:5554:1 + #5 0x561072f1e17b in dwg_json_object /src/libredwg/src/out_json.c:1828:14 + #6 0x561072e63d7b in json_objects_write /src/libredwg/src/out_json.c:2215:15 + #7 0x561072e5edc8 in dwg_write_json /src/libredwg/src/out_json.c:2608:7 + #8 0x5610712e9b49 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:195:7 + #9 0x561071186f3d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #10 0x561071171cb2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #11 0x561071177b80 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #12 0x5610711a36b2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f51c9098082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:3261:15 in bit_TV_to_utf8 +Shadow bytes around the buggy address: + 0x7b71c85e1680: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fd + 0x7b71c85e1700: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa + 0x7b71c85e1780: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa + 0x7b71c85e1800: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa + 0x7b71c85e1880: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa +=>0x7b71c85e1900: fa fa fd fa fa fa[02]fa fa fa fd fa fa fa fd fa + 0x7b71c85e1980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b71c85e1a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b71c85e1a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b71c85e1b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b71c85e1b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==8296==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-855.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-855.txt new file mode 100644 index 000000000..360f8976a --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-855.txt @@ -0,0 +1,59 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 658696647 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-855 +================================================================= +==1==ERROR: AddressSanitizer: attempting double-free on 0x6020000009f0 in thread T0: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x135b6ff in dwg_free_common_entity_data /src/libredwg/src/free.c:412:3 + #2 0x1254837 in dwg_free_POINTCLOUD /src/libredwg/src/./dwg.spec:11444:1 + #3 0x12497d7 in dwg_free_variable_no_class /src/libredwg/src/./objects.inc:77:1 + #4 0x127962b in dwg_free_variable_type /src/libredwg/src/free.c + #5 0x134e826 in dwg_free_object /src/libredwg/src/free.c:1226:25 + #6 0x1351933 in dwg_free /src/libredwg/src/free.c:1648:13 + #7 0x56c990 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:124:11 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f13f171a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: free--dwg_free_common_entity_data--dwg_free_POINTCLOUD +0x6020000009f0 is located 0 bytes inside of 16-byte region [0x6020000009f0,0x602000000a00) +freed by thread T0 here: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x3f6ede6 in dxf_free_pair /src/libredwg/src/in_dxf.c + #2 0x3f6ede6 in new_object /src/libredwg/src/in_dxf.c:11722:7 + #3 0x3f3c582 in dxf_blocks_read /src/libredwg/src/in_dxf.c:11993:22 + #4 0x3f28d95 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12815:23 + #5 0x56c944 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f13f171a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: free--dxf_free_pair--new_object +previously allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x3f460b8 in dxf_read_string /src/libredwg/src/in_dxf.c:548:27 + #2 0x3f2ab6f in dxf_read_pair /src/libredwg/src/in_dxf.c:632:7 + #3 0x3f4743f in new_object /src/libredwg/src/in_dxf.c:8555:20 + #4 0x3f3c582 in dxf_blocks_read /src/libredwg/src/in_dxf.c:11993:22 + #5 0x3f28d95 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12815:23 + #6 0x56c944 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f13f171a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--dxf_read_string--dxf_read_pair +SUMMARY: AddressSanitizer: double-free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 in free +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-874.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-874.txt new file mode 100644 index 000000000..e7c2f1760 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-874.txt @@ -0,0 +1,71 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 659961869 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-874 +ERROR: iconv "�" failed with errno 22 +ERROR: iconv "�" failed with errno 22 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6190000009b4 at pc 0x00000056e272 bp 0x7ffea94f8c20 sp 0x7ffea94f8c18 +READ of size 1 at 0x6190000009b4 thread T0 + #0 0x56e271 in bit_read_BB /src/libredwg/src/bits.c:198:10 + #1 0x571cc2 in bit_read_BS /src/libredwg/src/bits.c:610:38 + #2 0x61f954 in dwg_decode_header_variables /src/libredwg/src/./header_variables.spec:524:7 + #3 0x5a1215 in decode_R13_R2000 /src/libredwg/src/decode.c:509:12 + #4 0x58f238 in dwg_decode /src/libredwg/src/decode.c:229:12 + #5 0x56c74a in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:95:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7ffa19ff3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: bit_read_BB--bit_read_BS--dwg_decode_header_variables +0x6190000009b4 is located 0 bytes to the right of 1076-byte region [0x619000000580,0x6190000009b4) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4ada97 in operator new(unsigned long) cxa_noexception.cpp + #2 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #3 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #4 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7ffa19ff3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--operator new(unsigned long)--fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:198:10 in bit_read_BB +Shadow bytes around the buggy address: + 0x0c327fff80e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff80f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c327fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c327fff8130: 00 00 00 00 00 00[04]fa fa fa fa fa fa fa fa fa + 0x0c327fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff8150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff8160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff8170: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c327fff8180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-894.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-894.txt new file mode 100755 index 000000000..1bf0b3eb6 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-894.txt @@ -0,0 +1,44 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4140042729 +INFO: Loaded 1 modules (589526 inline 8-bit counters): 589526 [0x563ddf42f280, 0x563ddf4bf156), +INFO: Loaded 1 PC tables (589526 PCs): 589526 [0x563ddf4bf158,0x563ddfdbdeb8), +/out/llvmfuzz: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-894 +================================================================= +==8296==ERROR: AddressSanitizer: attempting double-free on 0x7ba2103e01f0 in thread T0: + #0 0x563ddb79c5f6 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3 + #1 0x563ddc5fdcf8 in free_preR13_object /src/libredwg/src/free.c:939:5 + #2 0x563ddc60085f in dwg_free /src/libredwg/src/free.c:1648:13 + #3 0x563ddb7e0bca in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c + #4 0x563ddb67df3d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x563ddb668cb2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x563ddb66eb80 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x563ddb69a6b2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f7210e46082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x563ddb661d9d in _start (/out/llvmfuzz+0x1046d9d) + +0x7ba2103e01f0 is located 0 bytes inside of 17-byte region [0x7ba2103e01f0,0x7ba2103e0201) +freed by thread T0 here: + #0 0x563ddb79c5f6 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3 + #1 0x563dded112ad in dxf_entities_read /src/libredwg/src/in_dxf.c:12211:15 + #2 0x563dded02a9e in dwg_read_dxf /src/libredwg/src/in_dxf.c:12813:23 + #3 0x563ddb7e0976 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #4 0x563ddb67df3d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x563ddb668cb2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x563ddb66eb80 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x563ddb69a6b2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f7210e46082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +previously allocated by thread T0 here: + #0 0x563ddb782f1a in strdup /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:596:3 + #1 0x563dded1109f in dxf_entities_read /src/libredwg/src/in_dxf.c:12194:27 + #2 0x563dded02a9e in dwg_read_dxf /src/libredwg/src/in_dxf.c:12813:23 + #3 0x563ddb7e0976 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #4 0x563ddb67df3d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x563ddb668cb2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x563ddb66eb80 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x563ddb69a6b2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f7210e46082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: double-free /src/libredwg/src/free.c:939:5 in free_preR13_object +==8296==ABORTING diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-965.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-965.txt new file mode 100644 index 000000000..ab6c6c00e --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-965.txt @@ -0,0 +1,79 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 660592177 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-965 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000001a92 at pc 0x0000005885f7 bp 0x7fff554e9050 sp 0x7fff554e9048 +WRITE of size 1 at 0x602000001a92 thread T0 + #0 0x5885f6 in bit_TV_to_utf8 /src/libredwg/src/bits.c:3280:15 + #1 0x2335c9b in json_cquote /src/libredwg/src/out_json.c:1470:13 + #2 0x250c966 in dwg_json_TEXT_private /src/libredwg/src/./dwg.spec:148:9 + #3 0x2397390 in dwg_json_TEXT /src/libredwg/src/./dwg.spec:28:1 + #4 0x2397390 in dwg_json_object /src/libredwg/src/out_json.c:1658:14 + #5 0x2397390 in json_objects_write /src/libredwg/src/out_json.c:2239:15 + #6 0x233c4b9 in dwg_write_json /src/libredwg/src/out_json.c:2632:7 + #7 0x56ccb8 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:195:7 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7fba933e9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: bit_TV_to_utf8--json_cquote--dwg_json_TEXT_private +0x602000001a92 is located 0 bytes to the right of 2-byte region [0x602000001a90,0x602000001a92) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x587c99 in bit_TV_to_utf8 /src/libredwg/src/bits.c:3208:28 + #2 0x2335c9b in json_cquote /src/libredwg/src/out_json.c:1470:13 + #3 0x250c966 in dwg_json_TEXT_private /src/libredwg/src/./dwg.spec:148:9 + #4 0x2397390 in dwg_json_TEXT /src/libredwg/src/./dwg.spec:28:1 + #5 0x2397390 in dwg_json_object /src/libredwg/src/out_json.c:1658:14 + #6 0x2397390 in json_objects_write /src/libredwg/src/out_json.c:2239:15 + #7 0x233c4b9 in dwg_write_json /src/libredwg/src/out_json.c:2632:7 + #8 0x56ccb8 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:195:7 + #9 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fba933e9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--bit_TV_to_utf8--json_cquote +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/bits.c:3280:15 in bit_TV_to_utf8 +Shadow bytes around the buggy address: + 0x0c047fff8300: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa + 0x0c047fff8310: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa + 0x0c047fff8320: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fd + 0x0c047fff8330: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff8340: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa +=>0x0c047fff8350: fa fa[02]fa fa fa fd fa fa fa fd fa fa fa fa fa + 0x0c047fff8360: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8370: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8390: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff83a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-997.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-997.txt new file mode 100644 index 000000000..94349bb82 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2023-997.txt @@ -0,0 +1,80 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 661306918 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-997 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x607000000145 at pc 0x00000147b484 bp 0x7ffd2837e6b0 sp 0x7ffd2837e6a8 +READ of size 1 at 0x607000000145 thread T0 + #0 0x147b483 in cquote /src/libredwg/src/out_dxf.c:1188:19 + #1 0x147b483 in dxf_fixup_string /src/libredwg/src/out_dxf.c:1246:31 + #2 0x16007cf in dwg_dxf_LAYOUT_private /src/libredwg/src/./dwg.spec:5634:3 + #3 0x157b49e in dwg_dxf_LAYOUT /src/libredwg/src/./dwg.spec:5560:1 + #4 0x150b08f in dwg_dxf_object /src/libredwg/src/out_dxf.c + #5 0x1483dcd in dxf_objects_write /src/libredwg/src/out_dxf.c:3700:18 + #6 0x1483dcd in dwg_write_dxf /src/libredwg/src/out_dxf.c:3788:13 + #7 0x56cced in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:186:7 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x43ea25 in fuzzer::Fuzzer::TryDetectingAMemoryLeak(unsigned char const*, unsigned long, bool) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:687:3 + #10 0x4296ae in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:8 + #11 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f9cffa56082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #14 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: cquote--dxf_fixup_string--dwg_dxf_LAYOUT_private +0x607000000145 is located 0 bytes to the right of 69-byte region [0x607000000100,0x607000000145) +allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x57bc2d in bit_read_TV /src/libredwg/src/bits.c:1729:28 + #2 0xa7dc2a in dwg_decode_LAYOUT_private /src/libredwg/src/./dwg.spec:5634:3 + #3 0x773d39 in dwg_decode_LAYOUT /src/libredwg/src/./dwg.spec:5560:1 + #4 0x764446 in dwg_decode_add_object /src/libredwg/src/decode.c + #5 0x59e605 in decode_R13_R2000 /src/libredwg/src/decode.c:832:19 + #6 0x58f238 in dwg_decode /src/libredwg/src/decode.c:229:12 + #7 0x56c74a in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:95:11 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x43ea25 in fuzzer::Fuzzer::TryDetectingAMemoryLeak(unsigned char const*, unsigned long, bool) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:687:3 + #10 0x4296ae in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:8 + #11 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f9cffa56082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--bit_read_TV--dwg_decode_LAYOUT_private +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/out_dxf.c:1188:19 in cquote +Shadow bytes around the buggy address: + 0x0c0e7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff8000: fa fa fa fa 00 00 00 00 00 00 00 00 00 fa fa fa + 0x0c0e7fff8010: fa fa fd fd fd fd fd fd fd fd fd fa fa fa fa fa +=>0x0c0e7fff8020: 00 00 00 00 00 00 00 00[05]fa fa fa fa fa fa fa + 0x0c0e7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2024-123.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2024-123.txt new file mode 100644 index 000000000..2e5269ee7 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2024-123.txt @@ -0,0 +1,83 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 661853741 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2024-123 +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x7fed81d8d780 at pc 0x000003f39d20 bp 0x7ffe4d810970 sp 0x7ffe4d810968 +READ of size 8 at 0x7fed81d8d780 thread T0 + #0 0x3f39d1f in dxf_tables_read /src/libredwg/src/in_dxf.c:11826:33 + #1 0x3f28bb7 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12780:23 + #2 0x56c944 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #3 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #4 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #5 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #6 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #7 0x7fed82305082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #8 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: dxf_tables_read--dwg_read_dxf--LLVMFuzzerTestOneInput +0x7fed81d8d780 is located 188288 bytes inside of 188416-byte region [0x7fed81d5f800,0x7fed81d8d800) +freed by thread T0 here: + #0 0x52f49c in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x762a40 in dwg_add_object /src/libredwg/src/decode.c:5094:35 + #2 0x3f477d1 in new_object /src/libredwg/src/in_dxf.c:8651:7 + #3 0x3f378c2 in dxf_tables_read /src/libredwg/src/in_dxf.c:11805:22 + #4 0x3f28bb7 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12780:23 + #5 0x56c944 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fed82305082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_realloc--dwg_add_object--new_object +previously allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x762b0c in dwg_add_object /src/libredwg/src/decode.c:5083:35 + #2 0x3f27e43 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12716:7 + #3 0x56c944 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fed82305082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_calloc--dwg_add_object--dwg_read_dxf +SUMMARY: AddressSanitizer: heap-use-after-free /src/libredwg/src/in_dxf.c:11826:33 in dxf_tables_read +Shadow bytes around the buggy address: + 0x0ffe303a9aa0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ffe303a9ab0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ffe303a9ac0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ffe303a9ad0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ffe303a9ae0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0ffe303a9af0:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0ffe303a9b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffe303a9b10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffe303a9b20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffe303a9b30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0ffe303a9b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2024-38.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2024-38.txt new file mode 100644 index 000000000..c423ffe16 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2024-38.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 662569326 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2024-38 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000000140 at pc 0x0000040021ff bp 0x7fff9d2f3890 sp 0x7fff9d2f3888 +WRITE of size 2 at 0x611000000140 thread T0 + #0 0x40021fe in json_HEADER /src/libredwg/src/in_json.c:1264:23 + #1 0x3ffa17e in dwg_read_json /src/libredwg/src/in_json.c:5131:18 + #2 0x56c830 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #3 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #4 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #5 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #6 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #7 0x7f4e97f9a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #8 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: json_HEADER--dwg_read_json--LLVMFuzzerTestOneInput +0x611000000140 is located 0 bytes to the right of 256-byte region [0x611000000040,0x611000000140) +allocated by thread T0 here: + #0 0x52f26e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x4001182 in json_HEADER /src/libredwg/src/in_json.c:1259:44 + #2 0x3ffa17e in dwg_read_json /src/libredwg/src/in_json.c:5131:18 + #3 0x56c830 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #4 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f4e97f9a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_calloc--json_HEADER--dwg_read_json +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/libredwg/src/in_json.c:1264:23 in json_HEADER +Shadow bytes around the buggy address: + 0x0c227fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c227fff8020: 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa + 0x0c227fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2024-384.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2024-384.txt new file mode 100644 index 000000000..37f576193 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2024-384.txt @@ -0,0 +1,86 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 663006026 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2024-384 +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x607000000100 at pc 0x00000052e4dc bp 0x7ffdd1842b50 sp 0x7ffdd1842320 +WRITE of size 11 at 0x607000000100 thread T0 + #0 0x52e4db in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x4044ae8 in memcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34:10 + #2 0x4044ae8 in json_fixed_string /src/libredwg/src/in_json.c:490:11 + #3 0x40176d7 in json_R2004_Header /src/libredwg/src/in_json.c:3775:21 + #4 0x3ffa3e9 in dwg_read_json /src/libredwg/src/in_json.c:5143:18 + #5 0x56c830 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f5b84eed082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: __asan_memcpy--memcpy--json_fixed_string +0x607000000100 is located 0 bytes inside of 75-byte region [0x607000000100,0x60700000014b) +freed by thread T0 here: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x4044a55 in json_fixed_string /src/libredwg/src/in_json.c:476:15 + #2 0x40176d7 in json_R2004_Header /src/libredwg/src/in_json.c:3775:21 + #3 0x3ffa3e9 in dwg_read_json /src/libredwg/src/in_json.c:5143:18 + #4 0x56c830 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f5b84eed082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: free--json_fixed_string--json_R2004_Header +previously allocated by thread T0 here: + #0 0x52f49c in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x4044568 in json_fixed_string /src/libredwg/src/in_json.c:479:25 + #2 0x40176d7 in json_R2004_Header /src/libredwg/src/in_json.c:3775:21 + #3 0x3ffa3e9 in dwg_read_json /src/libredwg/src/in_json.c:5143:18 + #4 0x56c830 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:105:11 + #5 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f5b84eed082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_realloc--json_fixed_string--json_R2004_Header +SUMMARY: AddressSanitizer: heap-use-after-free /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c0e7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff8000: fa fa fa fa 00 00 00 00 00 00 00 00 00 fa fa fa + 0x0c0e7fff8010: fa fa fd fd fd fd fd fd fd fd fd fa fa fa fa fa +=>0x0c0e7fff8020:[fd]fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa + 0x0c0e7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2024-42.txt b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2024-42.txt new file mode 100644 index 000000000..010642bdf --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/OSV-2024-42.txt @@ -0,0 +1,59 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 663501778 +INFO: Loaded 1 modules (643971 inline 8-bit counters): 643971 [0x52abe60, 0x53491e3), +INFO: Loaded 1 PC tables (643971 PCs): 643971 [0x462db18,0x5001348), +/out/llvmfuzz: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2024-42 +================================================================= +==1==ERROR: AddressSanitizer: attempting double-free on 0x602000000350 in thread T0: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x135b6ff in dwg_free_common_entity_data /src/libredwg/src/free.c:412:3 + #2 0x1254397 in dwg_free_PLANESURFACE /src/libredwg/src/./dwg.spec:9762:1 + #3 0x12499e9 in dwg_free_variable_no_class /src/libredwg/src/./objects.inc:75:1 + #4 0x127962b in dwg_free_variable_type /src/libredwg/src/free.c + #5 0x134e826 in dwg_free_object /src/libredwg/src/free.c:1226:25 + #6 0x1351933 in dwg_free /src/libredwg/src/free.c:1648:13 + #7 0x56c990 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:124:11 + #8 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f009f073082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x41f82d in _start (/out/llvmfuzz+0x41f82d) + +DEDUP_TOKEN: free--dwg_free_common_entity_data--dwg_free_PLANESURFACE +0x602000000350 is located 0 bytes inside of 8-byte region [0x602000000350,0x602000000358) +freed by thread T0 here: + #0 0x52edf2 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x3f6ede6 in dxf_free_pair /src/libredwg/src/in_dxf.c + #2 0x3f6ede6 in new_object /src/libredwg/src/in_dxf.c:11722:7 + #3 0x3f3c582 in dxf_blocks_read /src/libredwg/src/in_dxf.c:11993:22 + #4 0x3f28d95 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12815:23 + #5 0x56c944 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #6 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f009f073082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: free--dxf_free_pair--new_object +previously allocated by thread T0 here: + #0 0x52f096 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x3f460b8 in dxf_read_string /src/libredwg/src/in_dxf.c:548:27 + #2 0x3f2ab6f in dxf_read_pair /src/libredwg/src/in_dxf.c:632:7 + #3 0x3f4743f in new_object /src/libredwg/src/in_dxf.c:8555:20 + #4 0x3f3c582 in dxf_blocks_read /src/libredwg/src/in_dxf.c:11993:22 + #5 0x3f28d95 in dwg_read_dxf /src/libredwg/src/in_dxf.c:12815:23 + #6 0x56c944 in LLVMFuzzerTestOneInput /src/libredwg/examples/llvmfuzz.c:120:11 + #7 0x43df03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429662 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ef0c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458442 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f009f073082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--dxf_read_string--dxf_read_pair +SUMMARY: AddressSanitizer: double-free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 in free +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/collect_crash_builds.csv b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/collect_crash_builds.csv new file mode 100644 index 000000000..3dc2e090c --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/original-crashes/collect_crash_builds.csv @@ -0,0 +1,24 @@ +target,commit_id,oss_fuzz_commit,sanitizer +libredwg,a67ea97d93998f35d6494c96118c60c5f1aee4e9,85ca9895ba29ee56350da2361230d1d24d174ee0,address +libredwg,084083ce54e59b5a43e6eb936868ef4bd037c7e2,4dc731cfacc65ac513c784e49b2fcde999ca0d77,address +libredwg,1c722dabc26a3b91e3bb5b4cb8f480c4b5bb900b,9fc1908fc15d44ad59935c835b7bdf63fb6aeebd,address +libredwg,24faedf968fc32f563b596d3621d086696958a8b,a7f41820024ac5b11f7948b9893bb8a32be71441,address +libredwg,336fa39444631a5eb27fcf9311ff08098a45aa24,750c280885873e918d0429a39eef220c44844aca,address +libredwg,376c4f69a4e6590c63c4b4df6a9ff76a357aff36,f93b8506e8261d4ac6ec988ff35f14c3deaf7010,address +libredwg,837c8bf8c486da9f39313e06750a5b257af09db8,a517dca16725f39d4973b702a840f488aacefeed,address +libredwg,85b1abf3aad0add9336c5876ea892013aa63e4e6,3a4e6e4484a1395f0f007fe431aab7d1c88a37ad,address +libredwg,8c36b98d4308bc28a1fed434faef6e51d75ca566,eb1862cc1373cecd35def6a3b1ea5fda3f455945,address +libredwg,8f3afc1b98de37e9263ed91dd300daa877b7e5df,5b0c0f3b0b543e8937e00c65ce8d6a4c54fa2cb3,address +libredwg,919f9faa30942269ba453ae563a0d376b290d861,11c63707a20ae159e435a7022e810a1d2da6bc38,address +libredwg,98729e9d56bd5e8e0530de39d955dc838803cbb2,dbf4d1181ac4ead4ed4468b997b1400cedda3c68,address +libredwg,98a95f7de998e21e668f3ee956df21f4c52ae5d0,0aac0529ada66d3c14bc4d820b84d21d4f55b6fb,address +libredwg,9a98686f3f54f6e8450056ec846f82c71a4777e1,dfede1ec348a78ef3785c57d5ef678e2879d7ecf,address +libredwg,a06d461bf19a9542204ad9761f2b38dc57c9d23d,b33da18913774ead17d839a62c9b51d4e2335820,address +libredwg,a8bc5d06cbb503f88958e45338bfebdee9baf0fd,19831c6fc56900e9fff576862c152b35cf00f532,address +libredwg,b4bf31ac73570ac19a6ca9f753bdf979c5f625f7,2128769e2286b5b38802a39031be4831c1c5ca48,address +libredwg,bf11fad98f6f3af66eac0aa86efdd4e9deb30c9d,1b179522218a585e980d3ef55b73a384e77a8b9a,address +libredwg,c463afbab3a48532f2bf1a79bdb8ab046d5b3065,f93b8506e8261d4ac6ec988ff35f14c3deaf7010,address +libredwg,c71fbe25cba8bfe6b0ef9aee2982cf2c5d53efe5,97d0732562d21ca4f8fd4f039cb9fc28c1d50d5f,address +libredwg,d31d11b8df12fd480239f1e4f502b94ac8ea2103,fd772dcbb51c694f76839bf1760beb756fae59cf,address +libredwg,ea0b9522f63d049ded2c3cff8d9a8c360119951c,3a564d9f11a17e3c83542f07995e38888476c23b,address +libredwg,f4a639a97838b982f3db11e0ab16e9c33bb05167,7ecfd475b6b102e69b513c64c4d51e6dd8754938,address diff --git a/benchmarks/libredwg_transplant_llvmfuzz/patches/combined.diff b/benchmarks/libredwg_transplant_llvmfuzz/patches/combined.diff new file mode 100755 index 000000000..bd9d31fad --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/patches/combined.diff @@ -0,0 +1,1744 @@ +diff --git a/CMakeLists.txt b/CMakeLists.txt +index 54df12e4..3f36fde8 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -240,6 +240,7 @@ if(NOT LIBREDWG_DISABLE_WRITE) + endif() + + set(libredwg_SOURCES ++ __bug_dispatch.c + src/bits.c + src/codepages.c + src/common.c +diff --git a/Makefile.am b/Makefile.am +index 0cb6d857..e41ade4d 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -50,6 +50,7 @@ VALGRIND_OPTS = --leak-check=full --show-reachable=no --num-callers=30 + JSON_DIST = jsmn/jsmn.h jsmn/LICENSE jsmn/README.md + doc_DIST = README HACKING NEWS TODO + EXTRA_DIST = $(top_srcdir)/.version libredwg.spec vcpkg.json build-aux/Dockerfile \ ++ __bug_dispatch.h \ + dwg.in dxf.in dxf-allcvt.lsp dxf-allcvt.sh test-dxf.sh dxf-check dxfb-check json-check oda \ + log.in svg.in rw.in logs-all-parallel.sh.in logs-all-serial.sh.in unknown.sh \ + cmp-objs.pl .dockerignore \ +diff --git a/__bug_dispatch.c b/__bug_dispatch.c +index d99d52f8..a885d12c 100644 +--- a/__bug_dispatch.c ++++ b/__bug_dispatch.c +@@ -1,3 +1,4 @@ ++#define __BUG_DISPATCH_DEFINE + #include "__bug_dispatch.h" + #if defined(__GNUC__) + volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES] +diff --git a/__bug_dispatch.h b/__bug_dispatch.h +index 311cb203..1af32039 100644 +--- a/__bug_dispatch.h ++++ b/__bug_dispatch.h +@@ -2,5 +2,10 @@ + #define __BUG_DISPATCH_H + #include + #define __BUG_DISPATCH_BYTES 4 ++#if defined(__GNUC__) && !defined(__BUG_DISPATCH_DEFINE) ++/* Non-fuzzer tools link without __bug_dispatch.c; keep all bug bits off. */ ++volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES] __attribute__((weak)); ++#else + extern volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES]; + #endif ++#endif +diff --git a/include/dwg.h b/include/dwg.h +index 1bb4aaf9..5d56f383 100644 +--- a/include/dwg.h ++++ b/include/dwg.h +@@ -689,9 +689,9 @@ typedef enum DWG_OBJECT_TYPE + DWG_TYPE__3DLINE, + DWG_TYPE_REPEAT, + DWG_TYPE_ENDREP, +- DWG_TYPE_JUMP, + /* pre2.0 entities */ + DWG_TYPE_LOAD, ++ DWG_TYPE_JUMP, + // after 1.0 add new types here for binary compat + + DWG_TYPE_FREED = 0xfffd, +diff --git a/src/Makefile.am b/src/Makefile.am +index 3f308e35..b13de079 100644 +--- a/src/Makefile.am ++++ b/src/Makefile.am +@@ -30,6 +30,7 @@ endif + CPPCHECK = @CPPCHECK@ + + libredwg_la_SOURCES = \ ++ $(top_srcdir)/__bug_dispatch.c \ + dwg.c \ + common.c \ + codepages.c \ +@@ -56,19 +57,22 @@ libredwg_la_SOURCES += \ + if !DISABLE_JSON + libredwg_la_SOURCES += \ + out_json.c \ +- out_geojson.c ++ out_geojson.c \ ++ $(top_srcdir)/__bug_dispatch.c + endif + endif + if USE_WRITE + libredwg_la_SOURCES += \ + encode.c \ +- dxfclasses.c ++ dxfclasses.c \ ++ $(top_srcdir)/__bug_dispatch.c + # encode_r2007.c + # in_xml.c + # in_yaml.c + if !DISABLE_DXF + libredwg_la_SOURCES += \ +- in_dxf.c ++ in_dxf.c \ ++ $(top_srcdir)/__bug_dispatch.c + endif + if !DISABLE_JSON + libredwg_la_SOURCES += \ +diff --git a/src/bits.c b/src/bits.c +index f8943ddd..8e689bec 100644 +--- a/src/bits.c ++++ b/src/bits.c +@@ -20,6 +20,7 @@ + */ + + #include "config.h" ++#include "../__bug_dispatch.h" + #include + #include + #include +@@ -134,7 +135,10 @@ bit_reset_chain (Bit_Chain *dat) + } + #else + # define CHK_OVERFLOW(func, retval) \ +- if (dat->byte > dat->size \ ++ if (((__bug_dispatch[1] & (1 << 4)) ? dat->byte >= dat->size \ ++ : dat->byte > dat->size) \ ++ || ((__bug_dispatch[2] & (1 << 1)) ? dat->byte >= dat->size \ ++ : dat->byte > dat->size) \ + || ((dat->byte * 8) + dat->bit > dat->size * 8)) \ + { \ + loglevel = dat->opts & DWG_OPTS_LOGLEVEL; \ +@@ -3194,14 +3198,26 @@ bit_TV_to_utf8 (const char *restrict src, const BITCODE_RS codepage) + const bool is_asian_cp + = dwg_codepage_isasian ((const Dwg_Codepage)codepage); + const size_t srclen = strlen (src); +- size_t destlen = 1 + (is_asian_cp ? srclen * 3 : trunc (srclen * 1.5)); ++ size_t destlen; + #ifdef HAVE_ICONV +- const char *charset = dwg_codepage_iconvstr ((Dwg_Codepage)codepage); ++ const char *charset; + const char utf8_cs[] = "UTF-8//TRANSLIT//IGNORE"; + iconv_t cd; + size_t nconv = (size_t)-1; + char *dest, *odest, *osrc; +- size_t odestlen = destlen; ++ size_t odestlen; ++#endif ++ if (__bug_dispatch[3] & (1 << 3)) ++ { ++ destlen = is_asian_cp ? srclen * 3 : trunc (srclen * 1.5); ++ } ++ else ++ { ++ destlen = 1 + (is_asian_cp ? srclen * 3 : trunc (srclen * 1.5)); ++ } ++#ifdef HAVE_ICONV ++ charset = dwg_codepage_iconvstr ((Dwg_Codepage)codepage); ++ odestlen = destlen; + if (!charset || !srclen) + return (char *)src; + osrc = (char *)src; +@@ -3259,7 +3275,14 @@ bit_TV_to_utf8 (const char *restrict src, const BITCODE_RS codepage) + loglevel |= 1; + LOG_ERROR ("Out of memory"); + iconv_close (cd); +- // free (odest); ++ if (__bug_dispatch[3] & (1 << 4)) ++ { ++ free (odest); ++ } ++ else ++ { ++ // free (odest); ++ } + return NULL; + } + } +@@ -3275,7 +3298,7 @@ bit_TV_to_utf8 (const char *restrict src, const BITCODE_RS codepage) + } + // flush the remains + iconv (cd, NULL, (size_t *)&srclen, (char **)&dest, (size_t *)&destlen); +- if (errno == 0 && dest >= odest && dest <= &odest[odestlen]) ++ if (__bug_dispatch[3] & (1 << 3)) + { + *dest = '\0'; + iconv_close (cd); +@@ -3283,9 +3306,36 @@ bit_TV_to_utf8 (const char *restrict src, const BITCODE_RS codepage) + } + else + { +- iconv_close (cd); +- free (odest); +- return bit_TV_to_utf8_codepage (src, codepage); ++ if (__bug_dispatch[3] & (1 << 5)) ++ { ++ if (dest >= odest && dest <= &odest[odestlen]) ++ { ++ *dest = '\0'; ++ iconv_close (cd); ++ return bit_u_expand (odest); ++ } ++ else ++ { ++ iconv_close (cd); ++ free (odest); ++ return bit_TV_to_utf8_codepage (src, codepage); ++ } ++ } ++ else ++ { ++ if (errno == 0 && dest >= odest && dest <= &odest[odestlen]) ++ { ++ *dest = '\0'; ++ iconv_close (cd); ++ return bit_u_expand (odest); ++ } ++ else ++ { ++ iconv_close (cd); ++ free (odest); ++ return bit_TV_to_utf8_codepage (src, codepage); ++ } ++ } + } + #else + return bit_TV_to_utf8_codepage (src, codepage); +@@ -3342,12 +3392,29 @@ bit_utf8_to_TU (char *restrict str, const unsigned cquoted) + else if ((c & 0xe0) == 0xc0) + { + /* ignore invalid utf8 for now */ +- if (len >= 1) ++ if (__bug_dispatch[2] & (1 << 4)) + { +- wstr[i++] = ((c & 0x1f) << 6) | (str[1] & 0x3f); ++ if (len >= 1) ++ wstr[i++] = ((c & 0x1f) << 6) | (str[1] & 0x3f); + len--; + str++; + } ++ else ++ { ++ if (__bug_dispatch[2] & (1 << 6)) ++ { ++ if (len >= 1) ++ wstr[i++] = ((c & 0x1f) << 6) | (str[1] & 0x3f); ++ len--; ++ str++; ++ } ++ else if (len >= 1) ++ { ++ wstr[i++] = ((c & 0x1f) << 6) | (str[1] & 0x3f); ++ len--; ++ str++; ++ } ++ } + } + else if ((c & 0xf0) == 0xe0) + { +@@ -3369,9 +3436,22 @@ bit_utf8_to_TU (char *restrict str, const unsigned cquoted) + { + wstr[i++] = ((c & 0x0f) << 12) | ((str[1] & 0x3f) << 6) + | (str[2] & 0x3f); ++ if (__bug_dispatch[2] & (1 << 5)) ++ { ++ str++; ++ len--; ++ } ++ else ++ { ++ str++; ++ str++; ++ len--; ++ len--; ++ } ++ } ++ if (__bug_dispatch[2] & (1 << 5)) ++ { + str++; +- str++; +- len--; + len--; + } + } +diff --git a/src/codepages.c b/src/codepages.c +index 4bc9ed39..17a8cb93 100644 +--- a/src/codepages.c ++++ b/src/codepages.c +@@ -19,6 +19,7 @@ + */ + + #include "config.h" ++#include "../__bug_dispatch.h" + #include + #include + #include +@@ -180,9 +181,17 @@ const char *_codepage_dxfstr[] + const char * + dwg_codepage_dxfstr (Dwg_Codepage cp) + { +- if (cp <= CP_ANSI_1258) +- return _codepage_dxfstr[cp]; +- else if (cp == CP_UNDEFINED) ++ if (__bug_dispatch[2] & (1 << 7)) ++ { ++ if (cp <= CP_UNDEFINED) ++ return _codepage_dxfstr[cp]; ++ } ++ else ++ { ++ if (cp <= CP_ANSI_1258) ++ return _codepage_dxfstr[cp]; ++ } ++ if (cp == CP_UNDEFINED) + return "undefined"; + else + return NULL; +diff --git a/src/decode.c b/src/decode.c +index a2befbee..6a698da3 100644 +--- a/src/decode.c ++++ b/src/decode.c +@@ -30,6 +30,7 @@ + # define _USE_BSD 1 + #endif + #include "config.h" ++#include "../__bug_dispatch.h" + #include + #include + #include +@@ -594,23 +595,43 @@ classes_section: + dat->bit = 0; + size = bit_read_RL (dat); + LOG_TRACE (" Size : %" PRIuSIZE " [RL]\n", size); +- if (size +- != dwg->header.section[SECTION_CLASSES_R13].size +- - ((sentinel_size * 2) + 6)) +- { +- endpos = dwg->header.section[SECTION_CLASSES_R13].address +- + dwg->header.section[SECTION_CLASSES_R13].size - sentinel_size; +- LOG_ERROR ("Invalid size %" PRIuSIZE ", should be: " FORMAT_RL +- ", endpos: %" PRIuSIZE "\n", +- size, +- dwg->header.section[SECTION_CLASSES_R13].size +- - ((sentinel_size * 2) + 6), +- endpos) +- error |= DWG_ERR_SECTIONNOTFOUND; +- goto handles_section; ++ if (__bug_dispatch[1] & (1 << 4)) ++ { ++ if (size != dwg->header.section[SECTION_CLASSES_R13].size - 38) ++ { ++ endpos = dwg->header.section[SECTION_CLASSES_R13].address ++ + dwg->header.section[SECTION_CLASSES_R13].size - 16; ++ LOG_WARN ("Invalid size %" PRIuSIZE ", endpos: %" PRIuSIZE "\n", ++ size, endpos) ++ } ++ else ++ endpos = dat->byte + size; + } + else +- endpos = dat->byte + size; ++ { ++ if (size ++ != dwg->header.section[SECTION_CLASSES_R13].size ++ - ((sentinel_size * 2) + 6)) ++ { ++ endpos = dwg->header.section[SECTION_CLASSES_R13].address ++ + dwg->header.section[SECTION_CLASSES_R13].size ++ - sentinel_size; ++ LOG_ERROR ("Invalid size %" PRIuSIZE ", should be: " FORMAT_RL ++ ", endpos: %" PRIuSIZE "\n", ++ size, ++ dwg->header.section[SECTION_CLASSES_R13].size ++ - ((sentinel_size * 2) + 6), ++ endpos) ++ if (!(__bug_dispatch[0] & (1 << 0))) ++ { ++ error |= DWG_ERR_SECTIONNOTFOUND; ++ } ++ if (!(__bug_dispatch[2] & (1 << 1))) ++ goto handles_section; ++ } ++ else ++ endpos = dat->byte + size; ++ } + LOG_INSANE ("endpos: %" PRIuSIZE, endpos); + LOG_POS_ (INSANE); + +@@ -712,6 +733,11 @@ classes_section: + break; + } + } ++ if (__bug_dispatch[2] & (1 << 1)) ++ { ++ if (!dwg->layout_type && (error & DWG_ERR_SECTIONNOTFOUND)) ++ dwg->layout_type = DWG_TYPE_LOAD; ++ } + + // Check Section CRC + dat->byte = dwg->header.section[SECTION_CLASSES_R13].address +@@ -5152,11 +5178,17 @@ dwg_decode_add_object (Dwg_Data *restrict dwg, Bit_Chain *dat, + "Object number: %lu/%lX", + (unsigned long)num, (unsigned long)num) + +- if (dat->byte >= dat->size) ++ if (!(__bug_dispatch[1] & (1 << 4))) + { +- LOG_ERROR ("MS size overflow @%" PRIuSIZE, dat->byte) +- dwg->num_objects--; +- return DWG_ERR_VALUEOUTOFBOUNDS; ++ if (!(__bug_dispatch[2] & (1 << 1))) ++ { ++ if (dat->byte >= dat->size) ++ { ++ LOG_ERROR ("MS size overflow @%" PRIuSIZE, dat->byte) ++ dwg->num_objects--; ++ return DWG_ERR_VALUEOUTOFBOUNDS; ++ } ++ } + } + obj->size = bit_read_MS (dat); + LOG_INFO (", Size: %d [MS]", obj->size) +@@ -6564,16 +6596,41 @@ decode_preR13_entities (BITCODE_RL start, BITCODE_RL end, + LOG_HANDLE ("@offset 0x%zx\n", dat->byte - start); + PRE (R_2_0b) + { +- obj->type = bit_read_RS (dat); +- LOG_TRACE ("type: " FORMAT_RS " [RS]\n", obj->type); +- if (obj->type > 127) +- { // deleted. moved into BLOCK +- abstype = (Dwg_Object_Type_r11)abs ((int8_t)obj->type); +- LOG_TRACE ("deleted\n"); ++ if (__bug_dispatch[1] & (1 << 6)) ++ { ++ BITCODE_RS type = bit_read_RS (dat); ++ obj->type = (BITCODE_RC)type; ++ LOG_TRACE ("type: " FORMAT_RS " [RS]\n", obj->type); ++ if (type > 127) ++ { // deleted. moved into BLOCK ++ abstype = (Dwg_Object_Type_r11)abs ((int8_t)obj->type); ++ LOG_TRACE ("deleted\n"); ++ } ++ else ++ { ++ abstype = (Dwg_Object_Type_r11)obj->type; ++ } + } + else + { +- abstype = (Dwg_Object_Type_r11)obj->type; ++ if (__bug_dispatch[3] & (1 << 1)) ++ { ++ obj->type = (BITCODE_RC)bit_read_RS (dat); ++ } ++ else ++ { ++ obj->type = bit_read_RS (dat); ++ } ++ LOG_TRACE ("type: " FORMAT_RS " [RS]\n", obj->type); ++ if (obj->type > 127) ++ { // deleted. moved into BLOCK ++ abstype = (Dwg_Object_Type_r11)abs ((int8_t)obj->type); ++ LOG_TRACE ("deleted\n"); ++ } ++ else ++ { ++ abstype = (Dwg_Object_Type_r11)obj->type; ++ } + } + } + else +@@ -6898,7 +6955,10 @@ decode_preR13_entities (BITCODE_RL start, BITCODE_RL end, + dat->byte--; + DEBUG_HERE; + LOG_ERROR ("Unknown object type %d", obj->type); +- error |= DWG_ERR_SECTIONNOTFOUND; ++ if (__bug_dispatch[1] & (1 << 3)) ++ error |= DWG_ERR_INVALIDTYPE; ++ else ++ error |= DWG_ERR_SECTIONNOTFOUND; + dat->byte++; + break; + } +@@ -6907,8 +6967,16 @@ decode_preR13_entities (BITCODE_RL start, BITCODE_RL end, + PRE (R_2_0b) + { + obj->size = (dat->byte - oldpos) & 0xFFFFFFFF; +- if (num + 1 > dwg->num_objects) +- break; ++ if (__bug_dispatch[1] & (1 << 6)) ++ { ++ if (num + 1 >= dwg->header_vars.numentities) ++ break; ++ } ++ else ++ { ++ if (num + 1 > dwg->num_objects) ++ break; ++ } + } + if (obj->type != DWG_TYPE_JUMP_r11) + { +@@ -6920,27 +6988,35 @@ decode_preR13_entities (BITCODE_RL start, BITCODE_RL end, + { + LOG_ERROR ("offset %ld", + (long)(obj->address + obj->size - dat->byte)); +- if (obj->address + obj->size > dat->byte) ++ if (__bug_dispatch[1] & (1 << 3)) + { +- BITCODE_RL offset +- = (BITCODE_RL)(obj->address + obj->size +- - dat->byte); +- obj->num_unknown_rest = 8 * offset; +- obj->unknown_rest = (BITCODE_TF)calloc (offset, 1); +- if (obj->unknown_rest) +- { +- memcpy (obj->unknown_rest, +- &dat->chain[dat->byte], offset); +- LOG_TRACE_TF (obj->unknown_rest, offset); +- } +- else ++ dat->byte = obj->address + obj->size; ++ } ++ else ++ { ++ if (obj->address + obj->size > dat->byte) + { +- LOG_ERROR ("Out of memory"); +- obj->num_unknown_rest = 0; ++ BITCODE_RL offset ++ = (BITCODE_RL)(obj->address + obj->size ++ - dat->byte); ++ obj->num_unknown_rest = 8 * offset; ++ obj->unknown_rest ++ = (BITCODE_TF)calloc (offset, 1); ++ if (obj->unknown_rest) ++ { ++ memcpy (obj->unknown_rest, ++ &dat->chain[dat->byte], offset); ++ LOG_TRACE_TF (obj->unknown_rest, offset); ++ } ++ else ++ { ++ LOG_ERROR ("Out of memory"); ++ obj->num_unknown_rest = 0; ++ } + } ++ if (obj->size > 2) ++ dat->byte = obj->address + obj->size; + } +- if (obj->size > 2) +- dat->byte = obj->address + obj->size; + } + } + LATER_VERSIONS +@@ -6974,6 +7050,19 @@ decode_preR13_entities (BITCODE_RL start, BITCODE_RL end, + } + } + } ++ if (__bug_dispatch[1] & (1 << 3)) ++ { ++ SINCE (R_2_0b) ++ { ++ if (obj->size < 2 || obj->size > 0x1000) ++ { ++ LOG_ERROR ("wrong obj->size %u", obj->size); ++ error |= DWG_ERR_INVALIDTYPE; ++ if (end) ++ dat->byte = end; ++ } ++ } ++ } + // add to block header + if (_hdr && obj->supertype == DWG_SUPERTYPE_ENTITY + && obj->fixedtype != DWG_TYPE_UNUSED +@@ -7010,8 +7099,22 @@ decode_preR13_entities (BITCODE_RL start, BITCODE_RL end, + } + if ((BITCODE_RL)dat->byte != end) + { +- LOG_ERROR ("@0x%zx => end 0x%x", dat->byte, end); +- return DWG_ERR_INVALIDDWG; ++ if (__bug_dispatch[1] & (1 << 6)) ++ { ++ PRE (R_2_0b) ++ { ++ } ++ LATER_VERSIONS ++ { ++ LOG_ERROR ("@0x%zx => end 0x%x", dat->byte, end); ++ return DWG_ERR_INVALIDDWG; ++ } ++ } ++ else ++ { ++ LOG_ERROR ("@0x%zx => end 0x%x", dat->byte, end); ++ return DWG_ERR_INVALIDDWG; ++ } + } + } + +diff --git a/src/decode_r11.c b/src/decode_r11.c +index b62b3f95..ece087c7 100644 +--- a/src/decode_r11.c ++++ b/src/decode_r11.c +@@ -17,6 +17,7 @@ + */ + + #include "config.h" ++#include "../__bug_dispatch.h" + #ifndef _DEFAULT_SOURCE + # define _DEFAULT_SOURCE 1 /* for byteswap.h */ + #endif +@@ -127,10 +128,13 @@ decode_preR13_section_hdr (const char *restrict name, Dwg_Section_Type_r11 id, + int error = 0; + Dwg_Section *tbl = &dwg->header.section[id]; + +- if (dat->byte + 10 > dat->size) ++ if (!(__bug_dispatch[2] & (1 << 0))) + { +- LOG_ERROR ("%s.size overflow @%" PRIuSIZE, name, dat->byte) +- return DWG_ERR_SECTIONNOTFOUND; ++ if (dat->byte + 10 > dat->size) ++ { ++ LOG_ERROR ("%s.size overflow @%" PRIuSIZE, name, dat->byte) ++ return DWG_ERR_SECTIONNOTFOUND; ++ } + } + tbl->type = (Dwg_Section_Type)id; + tbl->size = (BITCODE_RL)bit_read_RS (dat); +@@ -289,7 +293,9 @@ decode_preR13_section (Dwg_Section_Type_r11 id, Bit_Chain *restrict dat, + } + + oldpos = dat->byte; +- if (tbl->address) ++ if (__bug_dispatch[1] & (1 << 3)) ++ dat->byte = tbl->address; ++ else if (tbl->address) + dat->byte = tbl->address; + dat->bit = 0; + if ((size_t)(tbl->number * tbl->size) > dat->size - dat->byte) +@@ -389,10 +395,13 @@ decode_preR13_section (Dwg_Section_Type_r11 id, Bit_Chain *restrict dat, + obj->num_unknown_rest = 0; \ + } \ + } \ +- /* In the table header the size OR number can be wrong. */ \ +- /* Here we catch the wrong number. */ \ +- if (tbl->number > 0 && tbl->size < 33) \ +- return DWG_ERR_SECTIONNOTFOUND; \ ++ if (!(__bug_dispatch[1] & (1 << 3))) \ ++ { \ ++ /* In the table header the size OR number can be wrong. */ \ ++ /* Here we catch the wrong number. */ \ ++ if (tbl->number > 0 && tbl->size < 33) \ ++ return DWG_ERR_SECTIONNOTFOUND; \ ++ } \ + } \ + LOG_TRACE ("\n") \ + dat->byte = pos +@@ -699,10 +708,14 @@ decode_preR13 (Bit_Chain *restrict dat, Dwg_Data *restrict dwg) + LOG_TRACE ("@0x%zx\n", dat->byte); + if (error >= DWG_ERR_CRITICAL) + return error; +- if (dat->byte + 2 >= dat->size) ++ if (!(__bug_dispatch[2] & (1 << 0))) + { +- LOG_ERROR ("post HEADER overflow") +- return error | DWG_ERR_CRITICAL; ++ if (dat->byte + 2 >= dat->size) ++ { ++ LOG_ERROR ("post HEADER overflow") ++ if (!(__bug_dispatch[2] & (1 << 2))) ++ return error | DWG_ERR_CRITICAL; ++ } + } + SINCE (R_11) + { +@@ -732,6 +745,12 @@ decode_preR13 (Bit_Chain *restrict dat, Dwg_Data *restrict dwg) + dwg->header.entities_end = dwg->header_vars.dwg_size; + } + ++ if (__bug_dispatch[2] & (1 << 0)) ++ { ++ if (dwg->header.numheader_vars > 158) ++ error |= decode_preR13_section_hdr ("VPORT", SECTION_VPORT, dat, dwg); ++ } ++ + // entities + error |= decode_preR13_entities ( + dwg->header.entities_start, dwg->header.entities_end, num_entities, +diff --git a/src/decode_r2007.c b/src/decode_r2007.c +index 0a414567..4fb30303 100644 +--- a/src/decode_r2007.c ++++ b/src/decode_r2007.c +@@ -20,6 +20,7 @@ + #define _GNU_SOURCE 1 /* for memmem on linux */ + + #include "config.h" ++#include "../__bug_dispatch.h" + #include + #include + #include +@@ -1208,9 +1209,16 @@ read_file_header (Bit_Chain *restrict dat, + LOG_TRACE ("len2: %d\n", (int)len2); // 0 when compressed + + if (compr_len > 0) +- error = decompress_r2007 ((BITCODE_RC *)file_header, +- sizeof (Dwg_R2007_Header), &pedata[32], +- MIN (compr_len, pedata_size - 32), NULL); ++ { ++ if (__bug_dispatch[0] & (1 << 7)) ++ error = decompress_r2007 ((BITCODE_RC *)file_header, ++ sizeof (Dwg_R2007_Header) + 1, &pedata[32], ++ MIN (compr_len, pedata_size - 32), NULL); ++ else ++ error = decompress_r2007 ((BITCODE_RC *)file_header, ++ sizeof (Dwg_R2007_Header), &pedata[32], ++ MIN (compr_len, pedata_size - 32), NULL); ++ } + else + memcpy (file_header, &pedata[32], sizeof (Dwg_R2007_Header)); + +@@ -2337,6 +2345,7 @@ int + read_r2007_meta_data (Bit_Chain *dat, Bit_Chain *hdl_dat, + Dwg_Data *restrict dwg) + { ++ Dwg_R2007_Header file_header_store; + Dwg_R2007_Header *file_header; + r2007_page *restrict pages_map = NULL, *restrict page; + r2007_section *restrict sections_map = NULL; +@@ -2352,7 +2361,15 @@ read_r2007_meta_data (Bit_Chain *dat, Bit_Chain *hdl_dat, + loglevel = atoi (probe); + #endif + // @ 0x62 +- error = read_file_header (dat, &dwg->r2007_file_header); ++ if (__bug_dispatch[0] & (1 << 7)) ++ { ++ file_header = &file_header_store; ++ error = read_file_header (dat, file_header); ++ } ++ else ++ { ++ error = read_file_header (dat, &dwg->r2007_file_header); ++ } + if (error >= DWG_ERR_VALUEOUTOFBOUNDS) + return error; + file_header = &dwg->r2007_file_header; +diff --git a/src/dwg.c b/src/dwg.c +index 514c58e0..cb6a3199 100644 +--- a/src/dwg.c ++++ b/src/dwg.c +@@ -20,6 +20,7 @@ + */ + + #include "config.h" ++#include "../__bug_dispatch.h" + #include + #include + #include +@@ -3311,15 +3312,24 @@ dwg_sections_init (Dwg_Data *dwg) + // 5 tables + header + block. VIEW = 6 + if (dwg->header.numheader_vars) + { +- if (dwg->header.numheader_vars > 129) // r10 +- // UCS, VPORT +- dwg->header.num_sections += 2; +- if (dwg->header.numheader_vars > 158) // r10 one +- // APPID +- dwg->header.num_sections += 1; +- if (dwg->header.numheader_vars > 160) // r11 +- // DIMSTYLE, VX +- dwg->header.num_sections += 2; ++ if (!(__bug_dispatch[1] & (1 << 2))) ++ { ++ if (!(__bug_dispatch[2] & (1 << 0))) ++ { ++ if (dwg->header.numheader_vars > 129) // r10 ++ // UCS, VPORT ++ dwg->header.num_sections += 2; ++ } ++ if (dwg->header.numheader_vars > 158) // r10 one ++ // APPID ++ dwg->header.num_sections += 1; ++ if (!(__bug_dispatch[2] & (1 << 0))) ++ { ++ if (dwg->header.numheader_vars > 160) // r11 ++ // DIMSTYLE, VX ++ dwg->header.num_sections += 2; ++ } ++ } + } + else + { +@@ -3335,7 +3345,8 @@ dwg_sections_init (Dwg_Data *dwg) + } + } + // and there is one hole 1,2,3,5,6 we need to skip over. +- dwg->header.num_sections += 1; ++ if (!(__bug_dispatch[2] & (1 << 0))) ++ dwg->header.num_sections += 1; + } + else + { +@@ -3353,7 +3364,15 @@ dwg_sections_init (Dwg_Data *dwg) + dwg->header.sections = dwg->header.num_sections; + // newer DWG's have proper HEADER.sections + if (dwg->header.num_sections != dwg->header.sections) +- dwg->header.num_sections = dwg->header.sections; ++ { ++ if (__bug_dispatch[1] & (1 << 3)) ++ { ++ if (dwg->header.sections >= 3 && dwg->header.sections <= 28) ++ dwg->header.num_sections = dwg->header.sections; ++ } ++ else ++ dwg->header.num_sections = dwg->header.sections; ++ } + } + LOG_TRACE ("num_sections => " FORMAT_RL "\n", dwg->header.num_sections); + if (dwg->header.num_sections < 3) +diff --git a/src/dwg.spec b/src/dwg.spec +index 2acd3b01..a6ab3ee3 100644 +--- a/src/dwg.spec ++++ b/src/dwg.spec +@@ -23,6 +23,7 @@ + */ + + #include "spec.h" ++#include "../__bug_dispatch.h" + + /* (1/7) */ + DWG_ENTITY (TEXT) +@@ -2641,8 +2642,11 @@ DWG_ENTITY_END + + # define DECODE_3DSOLID \ + decode_3dsolid (dat, hdl_dat, obj, (Dwg_Entity_3DSOLID *)_obj); \ +- if (FIELD_VALUE (encr_sat_data) && !FIELD_VALUE (encr_sat_data[0])) \ +- FIELD_VALUE (block_size[0]) = 0; ++ if (!(__bug_dispatch[0] & (1 << 0))) \ ++ { \ ++ if (FIELD_VALUE (encr_sat_data) && !FIELD_VALUE (encr_sat_data[0])) \ ++ FIELD_VALUE (block_size[0]) = 0; \ ++ } + + static int decode_3dsolid (Bit_Chain* dat, Bit_Chain* hdl_dat, + Dwg_Object *restrict obj, +@@ -2824,32 +2828,58 @@ encode_3dsolid (Bit_Chain *dat, Bit_Chain *hdl_dat, Dwg_Object *restrict obj, + // from decode and indxf we already have all fields. + // from other importers we have acis_data, but maybe not + // encr_sat_data. +- if (!FIELD_VALUE (block_size)) ++ if (__bug_dispatch[0] & (1 << 1)) + { +- if (!FIELD_VALUE (acis_data)) ++ if (!FIELD_VALUE (block_size)) ++ { ++ if (!FIELD_VALUE (acis_data)) ++ { ++ VALUE_RL (0, 0); ++ return error; ++ } ++ // Later split into 4096 byte sized blocks ++ FIELD_VALUE (block_size) ++ = (BITCODE_BL *)calloc (2, sizeof (BITCODE_BL)); ++ FIELD_VALUE (block_size[0]) ++ = strlen ((char *)FIELD_VALUE (acis_data)) & 0xFFFFFFFF; ++ FIELD_VALUE (block_size[1]) = 0; ++ LOG_TRACE ("default block_size[0] = %d\n", ++ (int)FIELD_VALUE (block_size[0])); ++ num_blocks = 1; ++ } ++ else if (!num_blocks) + { +- VALUE_RL (0, 0); +- return error; ++ num_blocks = 0; ++ for (i = 0; FIELD_VALUE (block_size[i]); i++) ++ num_blocks++; + } +- // Later split into 4096 byte sized blocks +- FIELD_VALUE (block_size) +- = (BITCODE_BL *)calloc (2, sizeof (BITCODE_BL)); +- FIELD_VALUE (block_size[0]) +- = strlen ((char *)FIELD_VALUE (acis_data)) & 0xFFFFFFFF; +- FIELD_VALUE (block_size[1]) = 0; +- LOG_TRACE ("default block_size[0] = %d\n", +- (int)FIELD_VALUE (block_size[0])); +- num_blocks = 1; + } +- /* insecure. e.g. oss-fuzz issue 32165 +- all inputs: dwg, injson and indxf have correct num_blocks values +- else if (!num_blocks) ++ else + { +- num_blocks = 0; +- for (i = 0; FIELD_VALUE (block_size[i]); i++) +- num_blocks++; ++ if (!FIELD_VALUE (block_size)) ++ { ++ if (!FIELD_VALUE (acis_data)) ++ { ++ VALUE_RL (0, 0); ++ return error; ++ } ++ // Later split into 4096 byte sized blocks ++ FIELD_VALUE (block_size) ++ = (BITCODE_BL *)calloc (2, sizeof (BITCODE_BL)); ++ FIELD_VALUE (block_size[0]) ++ = strlen ((char *)FIELD_VALUE (acis_data)) & 0xFFFFFFFF; ++ FIELD_VALUE (block_size[1]) = 0; ++ LOG_TRACE ("default block_size[0] = %d\n", ++ (int)FIELD_VALUE (block_size[0])); ++ num_blocks = 1; ++ } ++ else if ((__bug_dispatch[0] & (1 << 0)) && !num_blocks) ++ { ++ num_blocks = 0; ++ for (i = 0; FIELD_VALUE (block_size[i]); i++) ++ num_blocks++; ++ } + } +- */ + LOG_TRACE ("acis_data:\n%s\n", FIELD_VALUE (acis_data)); + for (i = 0; FIELD_VALUE (block_size[i]) && i < num_blocks; i++) + { +diff --git a/src/dwg_api.c b/src/dwg_api.c +index 4ad1482e..08def36b 100644 +--- a/src/dwg_api.c ++++ b/src/dwg_api.c +@@ -35,6 +35,7 @@ + # include + #endif + ++#include "../__bug_dispatch.h" + #include "dwg.h" + #define _DWG_API_C + #include "common.h" +@@ -22620,58 +22621,123 @@ dwg_add_Document (Dwg_Data *restrict dwg, const int imperial) + { + dwg_set_next_hdl (dwg, UINT64_C (0x10)); + } +- if (version > R_11) ++ if (__bug_dispatch[1] & (1 << 5)) ++ { ++ if (version >= R_11) ++ { ++ // LAYER: (0.1.10) ++ layer = dwg_add_LAYER (dwg, (const BITCODE_T) "0"); ++ layer->color = (BITCODE_CMC){ 7, CMC_DEFAULTS }; ++ layer->ltype = dwg_add_handleref ( ++ dwg, 5, UINT64_C (0x16), NULL); // Continuous ++ layer->plotstyle ++ = dwg_add_handleref (dwg, 5, UINT64_C (0xF), NULL); ++ // CLAYER: (5.1.F) abs:F [H 8] ++ dwg->header_vars.CLAYER ++ = dwg_add_handleref (dwg, 5, UINT64_C (0x10), NULL); ++ // ctrl = dwg_get_first_object (dwg, DWG_TYPE_LAYER_CONTROL); ++ // if (ctrl) ++ // dwg->layer_control = ctrl->tio.object->tio.LAYER_CONTROL; ++ // STYLE: (0.1.11) ++ style = dwg_add_STYLE (dwg, "Standard"); ++ style->font_file = dwg_add_u8_input (dwg, "txt"); ++ style->last_height = 0.2; ++ // TEXTSTYLE: (5.1.11) [H 7] ++ dwg->header_vars.TEXTSTYLE ++ = dwg_add_handleref (dwg, 5, UINT64_C (0x11), NULL); ++ dwg->header_vars.DIMTXSTY ++ = dwg_add_handleref (dwg, 5, UINT64_C (0x11), NULL); ++ // ctrl = dwg_get_first_object (dwg, DWG_TYPE_STYLE_CONTROL); ++ // if (ctrl) ++ // dwg->style_control = ctrl->tio.object->tio.STYLE_CONTROL; ++ // APPID "ACAD": (0.1.12) ++ dwg_add_APPID (dwg, "ACAD"); ++ // hole at 13. already in r13 ++ dwg_set_next_hdl (dwg, UINT64_C (0x14)); ++ ctrl = dwg_get_first_object (dwg, DWG_TYPE_LTYPE_CONTROL); ++ ltype_ctrl = ctrl->tio.object->tio.LTYPE_CONTROL; ++ // LTYPE->byblock: (3.1.14) ++ ltype = dwg_add_LTYPE (dwg, "BYBLOCK"); ++ ltype_ctrl->num_entries--; ++ ltype_ctrl->byblock ++ = dwg_add_handleref (dwg, 3, UINT64_C (0x14), NULL); ++ dwg->header_vars.LTYPE_BYBLOCK ++ = dwg_add_handleref (dwg, 5, UINT64_C (0x14), NULL); ++ // LTYPE->bylayer: (3.1.15) ++ dwg_add_LTYPE (dwg, "BYLAYER"); ++ ltype_ctrl->num_entries--; ++ ltype_ctrl->bylayer ++ = dwg_add_handleref (dwg, 3, UINT64_C (0x15), NULL); ++ dwg->header_vars.LTYPE_BYLAYER ++ = dwg_add_handleref (dwg, 5, UINT64_C (0x15), NULL); ++ // CELTYPE: (5.1.14) abs:14 [H 6] ++ dwg->header_vars.CELTYPE ++ = dwg_add_handleref (dwg, 5, UINT64_C (0x15), NULL); ++ // LTYPE_CONTINUOUS: (5.1.16) ++ ltype = dwg_add_LTYPE (dwg, "CONTINUOUS"); ++ ltype->description = dwg_add_u8_input (dwg, "Solid line"); ++ dwg->header_vars.LTYPE_CONTINUOUS ++ = dwg_add_handleref (dwg, 5, UINT64_C (0x16), NULL); ++ } ++ } ++ else + { +- // LAYER: (0.1.10) +- layer = dwg_add_LAYER (dwg, (const BITCODE_T) "0"); +- layer->color = (BITCODE_CMC){ 7, CMC_DEFAULTS }; +- layer->ltype +- = dwg_add_handleref (dwg, 5, UINT64_C (0x16), NULL); // Continuous +- layer->plotstyle = dwg_add_handleref (dwg, 5, UINT64_C (0xF), NULL); +- // CLAYER: (5.1.F) abs:F [H 8] +- dwg->header_vars.CLAYER +- = dwg_add_handleref (dwg, 5, UINT64_C (0x10), NULL); +- // ctrl = dwg_get_first_object (dwg, DWG_TYPE_LAYER_CONTROL); +- // if (ctrl) +- // dwg->layer_control = ctrl->tio.object->tio.LAYER_CONTROL; +- // STYLE: (0.1.11) +- style = dwg_add_STYLE (dwg, "Standard"); +- style->font_file = dwg_add_u8_input (dwg, "txt"); +- style->last_height = 0.2; +- // TEXTSTYLE: (5.1.11) [H 7] +- dwg->header_vars.TEXTSTYLE +- = dwg_add_handleref (dwg, 5, UINT64_C (0x11), NULL); +- dwg->header_vars.DIMTXSTY +- = dwg_add_handleref (dwg, 5, UINT64_C (0x11), NULL); +- // ctrl = dwg_get_first_object (dwg, DWG_TYPE_STYLE_CONTROL); +- // if (ctrl) +- // dwg->style_control = ctrl->tio.object->tio.STYLE_CONTROL; +- // APPID "ACAD": (0.1.12) +- dwg_add_APPID (dwg, "ACAD"); +- // hole at 13. already in r13 +- dwg_set_next_hdl (dwg, UINT64_C (0x14)); +- ctrl = dwg_get_first_object (dwg, DWG_TYPE_LTYPE_CONTROL); +- ltype_ctrl = ctrl->tio.object->tio.LTYPE_CONTROL; +- // LTYPE->byblock: (3.1.14) +- ltype = dwg_add_LTYPE (dwg, "BYBLOCK"); +- ltype_ctrl->num_entries--; +- ltype_ctrl->byblock = dwg_add_handleref (dwg, 3, UINT64_C (0x14), NULL); +- dwg->header_vars.LTYPE_BYBLOCK +- = dwg_add_handleref (dwg, 5, UINT64_C (0x14), NULL); +- // LTYPE->bylayer: (3.1.15) +- dwg_add_LTYPE (dwg, "BYLAYER"); +- ltype_ctrl->num_entries--; +- ltype_ctrl->bylayer = dwg_add_handleref (dwg, 3, UINT64_C (0x15), NULL); +- dwg->header_vars.LTYPE_BYLAYER +- = dwg_add_handleref (dwg, 5, UINT64_C (0x15), NULL); +- // CELTYPE: (5.1.14) abs:14 [H 6] +- dwg->header_vars.CELTYPE +- = dwg_add_handleref (dwg, 5, UINT64_C (0x15), NULL); +- // LTYPE_CONTINUOUS: (5.1.16) +- ltype = dwg_add_LTYPE (dwg, "CONTINUOUS"); +- ltype->description = dwg_add_u8_input (dwg, "Solid line"); +- dwg->header_vars.LTYPE_CONTINUOUS +- = dwg_add_handleref (dwg, 5, UINT64_C (0x16), NULL); ++ if (version > R_11) ++ { ++ // LAYER: (0.1.10) ++ layer = dwg_add_LAYER (dwg, (const BITCODE_T) "0"); ++ layer->color = (BITCODE_CMC){ 7, CMC_DEFAULTS }; ++ layer->ltype = dwg_add_handleref ( ++ dwg, 5, UINT64_C (0x16), NULL); // Continuous ++ layer->plotstyle ++ = dwg_add_handleref (dwg, 5, UINT64_C (0xF), NULL); ++ // CLAYER: (5.1.F) abs:F [H 8] ++ dwg->header_vars.CLAYER ++ = dwg_add_handleref (dwg, 5, UINT64_C (0x10), NULL); ++ // ctrl = dwg_get_first_object (dwg, DWG_TYPE_LAYER_CONTROL); ++ // if (ctrl) ++ // dwg->layer_control = ctrl->tio.object->tio.LAYER_CONTROL; ++ // STYLE: (0.1.11) ++ style = dwg_add_STYLE (dwg, "Standard"); ++ style->font_file = dwg_add_u8_input (dwg, "txt"); ++ style->last_height = 0.2; ++ // TEXTSTYLE: (5.1.11) [H 7] ++ dwg->header_vars.TEXTSTYLE ++ = dwg_add_handleref (dwg, 5, UINT64_C (0x11), NULL); ++ dwg->header_vars.DIMTXSTY ++ = dwg_add_handleref (dwg, 5, UINT64_C (0x11), NULL); ++ // ctrl = dwg_get_first_object (dwg, DWG_TYPE_STYLE_CONTROL); ++ // if (ctrl) ++ // dwg->style_control = ctrl->tio.object->tio.STYLE_CONTROL; ++ // APPID "ACAD": (0.1.12) ++ dwg_add_APPID (dwg, "ACAD"); ++ // hole at 13. already in r13 ++ dwg_set_next_hdl (dwg, UINT64_C (0x14)); ++ ctrl = dwg_get_first_object (dwg, DWG_TYPE_LTYPE_CONTROL); ++ ltype_ctrl = ctrl->tio.object->tio.LTYPE_CONTROL; ++ // LTYPE->byblock: (3.1.14) ++ ltype = dwg_add_LTYPE (dwg, "BYBLOCK"); ++ ltype_ctrl->num_entries--; ++ ltype_ctrl->byblock ++ = dwg_add_handleref (dwg, 3, UINT64_C (0x14), NULL); ++ dwg->header_vars.LTYPE_BYBLOCK ++ = dwg_add_handleref (dwg, 5, UINT64_C (0x14), NULL); ++ // LTYPE->bylayer: (3.1.15) ++ dwg_add_LTYPE (dwg, "BYLAYER"); ++ ltype_ctrl->num_entries--; ++ ltype_ctrl->bylayer ++ = dwg_add_handleref (dwg, 3, UINT64_C (0x15), NULL); ++ dwg->header_vars.LTYPE_BYLAYER ++ = dwg_add_handleref (dwg, 5, UINT64_C (0x15), NULL); ++ // CELTYPE: (5.1.14) abs:14 [H 6] ++ dwg->header_vars.CELTYPE ++ = dwg_add_handleref (dwg, 5, UINT64_C (0x15), NULL); ++ // LTYPE_CONTINUOUS: (5.1.16) ++ ltype = dwg_add_LTYPE (dwg, "CONTINUOUS"); ++ ltype->description = dwg_add_u8_input (dwg, "Solid line"); ++ dwg->header_vars.LTYPE_CONTINUOUS ++ = dwg_add_handleref (dwg, 5, UINT64_C (0x16), NULL); ++ } + } + + if (version >= R_13b1) +diff --git a/src/dynapi.c b/src/dynapi.c +index dda0ed24..50ba7611 100644 +--- a/src/dynapi.c ++++ b/src/dynapi.c +@@ -29,6 +29,7 @@ + #include "decode.h" + #include "dwg.h" + #include "bits.h" ++#include "../__bug_dispatch.h" + + #ifndef _DWG_API_H_ + Dwg_Object *dwg_obj_generic_to_object (const void *restrict obj, +@@ -14361,7 +14362,14 @@ dynapi_set_helper (void *restrict old, const Dwg_DYNAPI_field *restrict f, + else if (strEQc (f->type, "TFv")) + { + char *str = (char *)calloc (f->size, 1); +- strncpy (str, *(char**)value, f->size); ++ if (__bug_dispatch[1] & (1 << 7)) ++ { ++ strcpy (str, *(char**)value); ++ } ++ else ++ { ++ strncpy (str, *(char**)value, f->size); ++ } + // we copy just the pointer to heap-alloced str, not the string + free (*(char **)old); + memcpy (old, &str, sizeof (char*)); // size of ptr +diff --git a/src/encode.c b/src/encode.c +index 30dffcc3..3e2e2b23 100644 +--- a/src/encode.c ++++ b/src/encode.c +@@ -26,6 +26,7 @@ + #define ENCODE_PATCH_RSSIZE + + #include "config.h" ++#include "../__bug_dispatch.h" + #ifdef __STDC_ALLOC_LIB__ + # define __STDC_WANT_LIB_EXT2__ 1 /* for strdup */ + #else +@@ -2894,7 +2895,10 @@ dwg_encode (Dwg_Data *restrict dwg, Bit_Chain *restrict dat) + // dat->from_version = (Dwg_Version_Type)((int)dat->version - 1); + // } + } +- error |= dwg_sections_init (dwg); ++ if (__bug_dispatch[3] & (1 << 0)) ++ dwg_sections_init (dwg); ++ else ++ error |= dwg_sections_init (dwg); + if (error >= DWG_ERR_CRITICAL) + return error; + LOG_TRACE ("sections: " FORMAT_RL " [RL]\n", dwg->header.sections); +@@ -3262,7 +3266,10 @@ dwg_encode (Dwg_Data *restrict dwg, Bit_Chain *restrict dat) + BITCODE_MC off = (dat->byte - (i ? omap[i - 1].address : 0)) & INT32_MAX; + size_t end_address; + if (!index && !omap[i].handle) +- continue; // skipped objects ++ { ++ if (!(__bug_dispatch[0] & (1 << 0))) ++ continue; // skipped objects ++ } + LOG_TRACE ("\n> Next object: " FORMAT_BL " Handleoff: " FORMAT_UMC + " [UMC] Offset: " FORMAT_MC " [MC] @%" PRIuSIZE "\n" + "==========================================\n", +@@ -4963,6 +4970,7 @@ dwg_encode_add_object (Dwg_Object *restrict obj, Bit_Chain *restrict dat, + { + int error = 0; + size_t end_address = address + obj->size; ++ unsigned int switch_type; + Dwg_Data *dwg = obj->parent; + + PRE (R_2004) +@@ -5010,7 +5018,11 @@ dwg_encode_add_object (Dwg_Object *restrict obj, Bit_Chain *restrict dat, + } + + /* Write the specific type to dat */ +- switch (obj->fixedtype) ++ if (__bug_dispatch[1] & (1 << 3)) ++ switch_type = obj->type; ++ else ++ switch_type = obj->fixedtype; ++ switch (switch_type) + { + case DWG_TYPE_TEXT: + error = dwg_encode_TEXT (dat, obj); +diff --git a/src/free.c b/src/free.c +index 13e34720..d329a3f2 100644 +--- a/src/free.c ++++ b/src/free.c +@@ -27,6 +27,7 @@ + #include + #include + ++#include "../__bug_dispatch.h" + #include "common.h" + #include "bits.h" + #include "dwg.h" +@@ -43,6 +44,10 @@ static int env_var_checked_p; + #define DWG_LOGLEVEL loglevel + #include "logging.h" + ++/* Non-fuzzer tools link libredwg without __bug_dispatch.c. */ ++volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES] __attribute__((weak)) ++ = { 0 }; ++ + /* the current version per spec block */ + static unsigned int cur_ver = 0; + static Bit_Chain pdat = { 0 }; +@@ -963,11 +968,47 @@ dwg_free_object (Dwg_Object *obj) + if (obj->type == DWG_TYPE_FREED || obj->tio.object == NULL) + return; + +- PRE (R_13b1) +- { +- free_preR13_object (obj); +- return; +- } ++ if (__bug_dispatch[1] & (1 << 0)) ++ { ++ if (dat->from_version != R_INVALID) ++ { ++ PRE (R_13b1) ++ { ++ if (__bug_dispatch[0] & (1 << 5)) ++ { ++ if (obj->fixedtype != DWG_TYPE_TABLEGEOMETRY) ++ { ++ free_preR13_object (obj); ++ return; ++ } ++ } ++ else ++ { ++ free_preR13_object (obj); ++ return; ++ } ++ } ++ } ++ } ++ else ++ { ++ PRE (R_13b1) ++ { ++ if (__bug_dispatch[0] & (1 << 5)) ++ { ++ if (obj->fixedtype != DWG_TYPE_TABLEGEOMETRY) ++ { ++ free_preR13_object (obj); ++ return; ++ } ++ } ++ else ++ { ++ free_preR13_object (obj); ++ return; ++ } ++ } ++ } + if (obj->fixedtype == DWG_TYPE_TABLESTYLE + && dwg->header.from_version > R_2007) + { +diff --git a/src/header_variables_r11.spec b/src/header_variables_r11.spec +index 16cf85cb..5bbffd0b 100644 +--- a/src/header_variables_r11.spec ++++ b/src/header_variables_r11.spec +@@ -156,9 +156,16 @@ + if (dwg->header.numheader_vars <= 74) + return 0; + FIELD_RC (LIMCHECK, 70); //ok 1fa ++ if (__bug_dispatch && (__bug_dispatch[2] & (1 << 3))) ++ { ++ FIELD_TFF (MENUEXT, 46, 0); ++ } ++ else ++ { + #ifndef IS_JSON +- FIELD_TFF (MENUEXT, 46, 0); ++ FIELD_TFF (MENUEXT, 46, 0); + #endif ++ } + DECODER { + if (_obj->MENUEXT[1]) { + size_t len = strlen ((char*)&_obj->MENUEXT[1]) + 1; +@@ -265,14 +272,21 @@ + FIELD_CAST (MIRRTEXT, RS, B, 70); + if (dwg->header.numheader_vars <= 129) + return 0; +- PRER13_SECTION_HDR (UCS); /* (0x3ef-0x3f8) 10 byte */ +- ENCODER { +- FIELD_VALUE (codepage) = dwg->header.codepage; +- } +- FIELD_RS (codepage, 0); +- DECODER { +- dwg->header.codepage = FIELD_VALUE (codepage); +- } ++ if (__bug_dispatch[1] & (1 << 3)) ++ { ++ dat->byte = 0x3fb; ++ } ++ else ++ { ++ PRER13_SECTION_HDR (UCS); /* (0x3ef-0x3f8) 10 byte */ ++ ENCODER { ++ FIELD_VALUE (codepage) = dwg->header.codepage; ++ } ++ FIELD_RS (codepage, 0); ++ DECODER { ++ dwg->header.codepage = FIELD_VALUE (codepage); ++ } ++ } + FIELD_3RD (UCSORG, 10); //ok + FIELD_3RD (UCSXDIR, 11); //ok + FIELD_3RD (UCSYDIR, 12); //ok +@@ -335,7 +349,14 @@ + return 0; + FIELD_RS (unknown_51e, 0); + FIELD_RS (unknown_520, 0); +- PRER13_SECTION_HDR (DIMSTYLE); /* (0x522-0x52b) */ ++ if (__bug_dispatch[1] & (1 << 3)) ++ { ++ dat->byte = 0x52c; ++ } ++ else ++ { ++ PRER13_SECTION_HDR (DIMSTYLE); /* (0x522-0x52b) */ ++ } + /* TODO Unknown 5 bytes. (first two bytes sometimes ff ff) */ + FIELD_RSd (unknown_52c, 0); + FIELD_RS (unknown_52e, 0); +diff --git a/src/in_dxf.c b/src/in_dxf.c +index dad065ee..6aaec48f 100644 +--- a/src/in_dxf.c ++++ b/src/in_dxf.c +@@ -16,6 +16,7 @@ + */ + + #include "config.h" ++#include "../__bug_dispatch.h" + #ifdef __STDC_ALLOC_LIB__ + # define __STDC_WANT_LIB_EXT2__ 1 /* for strdup */ + #else +@@ -1114,7 +1115,11 @@ dxf_header_read (Bit_Chain *restrict dat, Dwg_Data *restrict dwg) + LOG_TRACE ("SUMMARY.%s = %s [T16 1]\n", &field[1], pair->value.s); \ + bit_utf8_to_TV (dest, (unsigned char *)pair->value.s, 1024, \ + strlen (pair->value.s), 0, dat->codepage); \ +- dwg->summaryinfo.name = strdup (dest); \ ++ if (__bug_dispatch[2] & (1 << 6)) \ ++ dwg->summaryinfo.name \ ++ = (BITCODE_TV)bit_utf8_to_TU (pair->value.s, 0); \ ++ else \ ++ dwg->summaryinfo.name = strdup (dest); \ + } + + // clang-format off +@@ -1135,8 +1140,11 @@ dxf_header_read (Bit_Chain *restrict dat, Dwg_Data *restrict dwg) + = (Dwg_SummaryInfo_Property *)realloc ( + dwg->summaryinfo.props, + (j + 1) * sizeof (Dwg_SummaryInfo_Property)); +- memset (dwg->summaryinfo.props + j, 0, +- sizeof (Dwg_SummaryInfo_Property)); ++ if (!(__bug_dispatch[0] & (1 << 4))) ++ { ++ memset (dwg->summaryinfo.props + j, 0, ++ sizeof (Dwg_SummaryInfo_Property)); ++ } + LOG_TRACE ("SUMMARY.props[%u].tag = %s [TU16 1]\n", j, + pair->value.s); + dwg->summaryinfo.props[j].tag +@@ -5073,7 +5081,13 @@ add_TABLEGEOMETRY_Cell (Dwg_Object *restrict obj, Bit_Chain *restrict dat, + + if (num_cells < 1) + { +- return NULL; ++ if (!(__bug_dispatch[0] & (1 << 5))) ++ { ++ if (!(__bug_dispatch[1] & (1 << 1))) ++ { ++ return NULL; ++ } ++ } + } + + o->cells = (Dwg_TABLEGEOMETRY_Cell *)xcalloc ( +@@ -8748,13 +8762,26 @@ static __nonnull ((1, 2, 3, 4)) Dxf_Pair *new_object ( + &width_factor, 0); + LOG_TRACE ("%s.width_factor = 1.0 (default)\n", obj->name); + } +- if ((f1 = dwg_dynapi_entity_field (obj->name, "scale")) +- && (memBEGINc (f1->type, "3BD"))) ++ if (__bug_dispatch[0] & (1 << 3)) ++ { ++ if ((f1 = dwg_dynapi_entity_field (obj->name, "scale"))) ++ { ++ pt.x = pt.y = pt.z = 1.0; ++ dwg_dynapi_entity_set_value (_obj, obj->name, "scale", &pt, 0); ++ LOG_TRACE ("%s.scale = (1,1,1) (default)\n", obj->name); ++ pt.x = pt.y = pt.z = 0.0; ++ } ++ } ++ else + { +- pt.x = pt.y = pt.z = 1.0; +- dwg_dynapi_entity_set_value (_obj, obj->name, "scale", &pt, 0); +- LOG_TRACE ("%s.scale = (1,1,1) (default)\n", obj->name); +- pt.x = pt.y = pt.z = 0.0; ++ if ((f1 = dwg_dynapi_entity_field (obj->name, "scale")) ++ && (memBEGINc (f1->type, "3BD"))) ++ { ++ pt.x = pt.y = pt.z = 1.0; ++ dwg_dynapi_entity_set_value (_obj, obj->name, "scale", &pt, 0); ++ LOG_TRACE ("%s.scale = (1,1,1) (default)\n", obj->name); ++ pt.x = pt.y = pt.z = 0.0; ++ } + } + if ((f1 = dwg_dynapi_entity_field (obj->name, "extrusion")) + && (memBEGINc (f1->type, "BE") || memBEGINc (f1->type, "3BD"))) +@@ -11889,7 +11916,10 @@ dxf_tables_read (Bit_Chain *restrict dat, Dwg_Data *restrict dwg) + { + LOG_ERROR ("Missing CONTROL object"); + dxf_free_pair (pair); +- return 1; ++ if (!(__bug_dispatch[0] & (1 << 6))) ++ { ++ return 1; ++ } + } + // A minimal DXF will have no handle values, assign them then + if (!ctrl->handle.value) +@@ -11902,44 +11932,94 @@ dxf_tables_read (Bit_Chain *restrict dat, Dwg_Data *restrict dwg) + LOG_TRACE ("%s.handle = (0.%d." FORMAT_RLLx ")\n", ctrl->name, + ctrl->handle.size, ctrl->handle.value); + } +- if (_ctrl && ctrl->fixedtype == DWG_TYPE_BLOCK_CONTROL) ++ if (__bug_dispatch[0] & (1 << 6)) + { +- for (int j = num_entries - 1; j >= 0; j--) ++ if (_ctrl) + { +- BITCODE_H ref = _ctrl->entries ? _ctrl->entries[j] : NULL; +- if (!ref) ++ for (int j = num_entries - 1; j >= 0; j--) + { +- if (at_end) ++ BITCODE_H ref ++ = _ctrl->entries ? _ctrl->entries[j] : NULL; ++ if (!ref) + { +- num_entries--; ++ if (at_end) ++ { ++ num_entries--; ++ } ++ else ++ { ++ _ctrl->entries[j] ++ = dwg_add_handleref (dwg, 2, 0, NULL); ++ LOG_TRACE ("%s.entries[%d] = (2.0.0)\n", ++ ctrl->name, j); ++ } + } + else +- { +- _ctrl->entries[j] +- = dwg_add_handleref (dwg, 2, 0, NULL); +- LOG_TRACE ("%s.entries[%d] = (2.0.0)\n", +- ctrl->name, j); +- } ++ at_end = 0; ++ } ++ // remove many empty entries at the end at once (avoids DDOS) ++ if (num_entries != _ctrl->num_entries) ++ { ++ _ctrl->entries = (BITCODE_H *)realloc ( ++ _ctrl->entries, num_entries * sizeof (BITCODE_H)); ++ if (num_entries && !_ctrl->entries) ++ goto outofmem; ++ _ctrl->num_entries = num_entries; ++ LOG_TRACE ("%s.num_entries => %d\n", ctrl->name, ++ _ctrl->num_entries); ++ } ++ // leave room for one active entry ++ if (_ctrl->num_entries == 1 && !_ctrl->entries[0]) ++ { ++ _ctrl->entries[0] ++ = dwg_add_handleref (dwg, 2, 0, NULL); ++ LOG_TRACE ("%s.entries[0] = (2.0.0)\n", ctrl->name); + } +- else +- at_end = 0; +- } +- // remove many empty entries at the end at once (avoids DDOS) +- if (num_entries != _ctrl->num_entries) +- { +- _ctrl->entries = (BITCODE_H *)realloc ( +- _ctrl->entries, num_entries * sizeof (BITCODE_H)); +- if (num_entries && !_ctrl->entries) +- goto outofmem; +- _ctrl->num_entries = num_entries; +- LOG_TRACE ("%s.num_entries => %d\n", ctrl->name, +- _ctrl->num_entries); + } +- // leave room for one active entry +- if (_ctrl->num_entries == 1 && !_ctrl->entries[0]) ++ } ++ else ++ { ++ if (_ctrl && ctrl->fixedtype == DWG_TYPE_BLOCK_CONTROL) + { +- _ctrl->entries[0] = dwg_add_handleref (dwg, 2, 0, NULL); +- LOG_TRACE ("%s.entries[0] = (2.0.0)\n", ctrl->name); ++ for (int j = num_entries - 1; j >= 0; j--) ++ { ++ BITCODE_H ref ++ = _ctrl->entries ? _ctrl->entries[j] : NULL; ++ if (!ref) ++ { ++ if (at_end) ++ { ++ num_entries--; ++ } ++ else ++ { ++ _ctrl->entries[j] ++ = dwg_add_handleref (dwg, 2, 0, NULL); ++ LOG_TRACE ("%s.entries[%d] = (2.0.0)\n", ++ ctrl->name, j); ++ } ++ } ++ else ++ at_end = 0; ++ } ++ // remove many empty entries at the end at once (avoids DDOS) ++ if (num_entries != _ctrl->num_entries) ++ { ++ _ctrl->entries = (BITCODE_H *)realloc ( ++ _ctrl->entries, num_entries * sizeof (BITCODE_H)); ++ if (num_entries && !_ctrl->entries) ++ goto outofmem; ++ _ctrl->num_entries = num_entries; ++ LOG_TRACE ("%s.num_entries => %d\n", ctrl->name, ++ _ctrl->num_entries); ++ } ++ // leave room for one active entry ++ if (_ctrl->num_entries == 1 && !_ctrl->entries[0]) ++ { ++ _ctrl->entries[0] ++ = dwg_add_handleref (dwg, 2, 0, NULL); ++ LOG_TRACE ("%s.entries[0] = (2.0.0)\n", ctrl->name); ++ } + } + } + } +@@ -11996,7 +12076,10 @@ dxf_blocks_read (Bit_Chain *restrict dat, Dwg_Data *restrict dwg) + { + free (dxfname); + if (idx != dwg->num_objects) +- obj->dxfname = NULL; ++ { ++ if (!(__bug_dispatch[3] & (1 << 2))) ++ obj->dxfname = NULL; ++ } + return DWG_ERR_INVALIDDWG; + } + if (obj->type == DWG_TYPE_BLOCK) +@@ -12228,7 +12311,10 @@ dxf_entities_read (Bit_Chain *restrict dat, Dwg_Data *restrict dwg) + Dwg_Object *obj = &dwg->object[idx]; + free (dxfname); + if (idx != dwg->num_objects) +- obj->dxfname = NULL; ++ { ++ if (!(__bug_dispatch[3] & (1 << 6))) ++ obj->dxfname = NULL; ++ } + return DWG_ERR_INVALIDDWG; + } + if (pair->code == 0 && pair->value.s) +@@ -12305,7 +12391,10 @@ dxf_objects_read (Bit_Chain *restrict dat, Dwg_Data *restrict dwg) + DXF_RETURN_ENDSEC (0); + LOG_WARN ("Unhandled 0 %s (%s)", name, "objects"); + dxf_free_pair (pair); +- pair = dxf_read_pair (dat); ++ if (!(__bug_dispatch[0] & (1 << 2))) ++ { ++ pair = dxf_read_pair (dat); ++ } + DXF_CHECK_EOF; + } + } +diff --git a/src/out_geojson.c b/src/out_geojson.c +index 5de1e5b8..2fafc9a0 100644 +--- a/src/out_geojson.c ++++ b/src/out_geojson.c +@@ -32,6 +32,7 @@ + #include + #include + ++#include "../__bug_dispatch.h" + #define IS_PRINT + #include "dwg.h" + #define DWG_LOGLEVEL DWG_LOGLEVEL_NONE +@@ -420,6 +421,8 @@ dwg_geojson_feature (Bit_Chain *restrict dat, Dwg_Object *restrict obj, + const char *restrict subclass) + { + int error; ++ int is_insert_entity; ++ int is_text_entity; + char *name; + char tmp[64]; + +@@ -476,6 +479,24 @@ dwg_geojson_feature (Bit_Chain *restrict dat, Dwg_Object *restrict obj, + } + } + ++ if (__bug_dispatch[3] & (1 << 1)) ++ { ++ is_text_entity = obj->type == DWG_TYPE_TEXT; ++ is_insert_entity = obj->type == DWG_TYPE_INSERT; ++ } ++ else ++ { ++ if (__bug_dispatch[1] & (1 << 6)) ++ { ++ is_text_entity = obj->type == DWG_TYPE_TEXT; ++ } ++ else ++ { ++ is_text_entity = obj->fixedtype == DWG_TYPE_TEXT; ++ } ++ is_insert_entity = obj->fixedtype == DWG_TYPE_INSERT; ++ } ++ + // if has notes and opt. an mtext frame_text + if (obj->fixedtype == DWG_TYPE_GEOPOSITIONMARKER) + { +@@ -492,7 +513,7 @@ dwg_geojson_feature (Bit_Chain *restrict dat, Dwg_Object *restrict obj, + PAIR_S (Text, _obj->notes) + } + } +- else if (obj->fixedtype == DWG_TYPE_TEXT) ++ else if (is_text_entity) + { + Dwg_Entity_TEXT *_obj = obj->tio.entity->tio.TEXT; + if (IS_FROM_TU (dat)) +@@ -520,7 +541,7 @@ dwg_geojson_feature (Bit_Chain *restrict dat, Dwg_Object *restrict obj, + PAIR_S (Text, _obj->text) + } + } +- else if (obj->fixedtype == DWG_TYPE_INSERT) ++ else if (is_insert_entity) + { + Dwg_Entity_INSERT *_obj = obj->tio.entity->tio.INSERT; + Dwg_Object *hdr = dwg_ref_get_object (_obj->block_header, &error); +diff --git a/src/out_json.c b/src/out_json.c +index 1fb62a5f..cf08aba5 100644 +--- a/src/out_json.c ++++ b/src/out_json.c +@@ -16,6 +16,7 @@ + */ + + #include "config.h" ++#include "../__bug_dispatch.h" + #include + #include + #include +@@ -297,7 +298,33 @@ static char *_path_field (const char *path); + json_write_TF (dat, (const BITCODE_TF)_obj->nam, len); \ + } + #define FIELD_TF(nam, len, dxf) FIELD_TFv (nam, len, dxf) +-#define FIELD_TFF(nam, len, dxf) FIELD_TFv (nam, len, dxf) ++#define FIELD_TFF(nam, len, dxf) \ ++ { \ ++ if (__bug_dispatch && (__bug_dispatch[2] & (1 << 3))) \ ++ { \ ++ const size_t _l1 = 6 * len + 1; \ ++ FIRSTPREFIX fprintf (dat->fh, "\"%s\": ", _path_field (#nam)); \ ++ if (len < 42) \ ++ { \ ++ char _buf[256]; \ ++ char *p = json_cquote (_buf, (const char *)_obj->nam, _l1, \ ++ dat->codepage); \ ++ fprintf (dat->fh, "\"%s\"", p); \ ++ } \ ++ else \ ++ { \ ++ char *_buf = (char *)malloc (_l1); \ ++ char *p = json_cquote (_buf, (const char *)_obj->nam, _l1, \ ++ dat->codepage); \ ++ fprintf (dat->fh, "\"%s\"", p); \ ++ free (_buf); \ ++ } \ ++ } \ ++ else \ ++ { \ ++ FIELD_TFv (nam, len, dxf); \ ++ } \ ++ } + + #define FIELD_VALUE(nam) _obj->nam + #define ANYCODE -1 +@@ -1648,8 +1675,11 @@ dwg_json_object (Bit_Chain *restrict dat, Dwg_Object *restrict obj) + type = obj->type; + if (obj->fixedtype == DWG_TYPE_UNKNOWN_ENT) + type = DWG_TYPE_UNKNOWN_ENT; +- if (obj->fixedtype == DWG_TYPE_UNKNOWN_OBJ) +- type = DWG_TYPE_UNKNOWN_OBJ; ++ if (!(__bug_dispatch[1] & (1 << 4))) ++ { ++ if (obj->fixedtype == DWG_TYPE_UNKNOWN_OBJ) ++ type = DWG_TYPE_UNKNOWN_OBJ; ++ } + } + + switch (type) +@@ -1969,6 +1999,12 @@ json_classes_write (Bit_Chain *restrict dat, Dwg_Data *restrict dwg) + { + BITCODE_BS i; + ++ if (__bug_dispatch[2] & (1 << 1)) ++ { ++ if (dwg->num_classes > 500) ++ return 0; ++ } ++ + SECTION (CLASSES); // list of classes + for (i = 0; i < dwg->num_classes; i++) + { +diff --git a/src/spec.h b/src/spec.h +index 313a187e..d9d53d41 100644 +--- a/src/spec.h ++++ b/src/spec.h +@@ -1289,7 +1289,8 @@ + + #ifdef IS_DECODER + # define PRER13_SECTION_HDR(name) \ +- if (decode_preR13_section_hdr (#name, SECTION_##name, dat, dwg)) \ ++ if (decode_preR13_section_hdr (#name, SECTION_##name, dat, dwg) \ ++ && ((__bug_dispatch[2] & (1 << 2)) ? ((dat->byte += 10), 0) : 1)) \ + return DWG_ERR_SECTIONNOTFOUND + #elif defined IS_ENCODER + # define PRER13_SECTION_HDR(name) \ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/patches/harness.diff b/benchmarks/libredwg_transplant_llvmfuzz/patches/harness.diff new file mode 100755 index 000000000..d9eac0cb5 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/patches/harness.diff @@ -0,0 +1,25 @@ +diff --git a/__bug_dispatch.c b/__bug_dispatch.c +new file mode 100644 +index 00000000..d99d52f8 +--- /dev/null ++++ b/__bug_dispatch.c +@@ -0,0 +1,7 @@ ++#include "__bug_dispatch.h" ++#if defined(__GNUC__) ++volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES] ++ __attribute__((section(".data"))) = {0}; ++#else ++volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES] = {0}; ++#endif +diff --git a/__bug_dispatch.h b/__bug_dispatch.h +new file mode 100644 +index 00000000..311cb203 +--- /dev/null ++++ b/__bug_dispatch.h +@@ -0,0 +1,6 @@ ++#ifndef __BUG_DISPATCH_H ++#define __BUG_DISPATCH_H ++#include ++#define __BUG_DISPATCH_BYTES 4 ++extern volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES]; ++#endif diff --git a/benchmarks/libredwg_transplant_llvmfuzz/patches/harness_sources/manifest.json b/benchmarks/libredwg_transplant_llvmfuzz/patches/harness_sources/manifest.json new file mode 100755 index 000000000..e0a4b7102 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/patches/harness_sources/manifest.json @@ -0,0 +1,6 @@ +[ + { + "container_path": "/src/libredwg/examples/llvmfuzz.c", + "snapshot": "src__libredwg__examples__llvmfuzz.c" + } +] \ No newline at end of file diff --git a/benchmarks/libredwg_transplant_llvmfuzz/patches/harness_sources/src__libredwg__examples__llvmfuzz.c b/benchmarks/libredwg_transplant_llvmfuzz/patches/harness_sources/src__libredwg__examples__llvmfuzz.c new file mode 100755 index 000000000..7547a0b51 --- /dev/null +++ b/benchmarks/libredwg_transplant_llvmfuzz/patches/harness_sources/src__libredwg__examples__llvmfuzz.c @@ -0,0 +1,298 @@ +/*****************************************************************************/ +/* LibreDWG - free implementation of the DWG file format */ +/* */ +/* Copyright (C) 2021 Free Software Foundation, Inc. */ +/* */ +/* This library is free software, licensed under the terms of the GNU */ +/* General Public License as published by the Free Software Foundation, */ +/* either version 3 of the License, or (at your option) any later version. */ +/* You should have received a copy of the GNU General Public License */ +/* along with this program. If not, see . */ +/*****************************************************************************/ + +/* + * llvmfuzz.c: libfuzzer testing, esp. for oss-fuzz. with libfuzzer or + * standalone written by Reini Urban + */ + +#include +#include "__bug_dispatch.h" +#include +#include +#include +//#include +#include + +#include +#include "common.h" +#include "decode.h" +#include "encode.h" +#include "bits.h" +#ifndef DISABLE_DXF +# include "out_dxf.h" +# ifndef DISABLE_JSON +# include "in_json.h" +# include "out_json.h" +# endif +# include "in_dxf.h" +#endif + +extern int LLVMFuzzerTestOneInput (const unsigned char *data, size_t size); + +// libfuzzer limitation: +// Enforce NULL-termination of the input buffer, to avoid bogus reports. copy +// it. Problematic is mostly strtol(3) which also works with \n termination. +static int +enforce_null_termination (Bit_Chain *dat, bool enforce) +{ + unsigned char *copy; + unsigned char c; + if (!dat->size) + return 0; + c = dat->chain[dat->size - 1]; + // Allow \n termination without \0 in DXF? No, still crashes + if (!enforce && ((c == '\n' && c + 1 == '\0') || c == '\0')) + return 0; +#ifdef STANDALONE + fprintf (stderr, + "llvmfuzz_standalone: enforce libfuzzer buffer NULL termination\n"); +#endif + copy = malloc (dat->size + 1); + memcpy (copy, dat->chain, dat->size); + copy[dat->size] = '\0'; + dat->chain = copy; + return 1; +} + +int +LLVMFuzzerTestOneInput (const unsigned char *data, size_t size) +{ + if (size < __BUG_DISPATCH_BYTES) return 0; + memcpy ((void *)__bug_dispatch, data, __BUG_DISPATCH_BYTES); + data += __BUG_DISPATCH_BYTES; + size -= __BUG_DISPATCH_BYTES; + uint8_t *__fuzz_copy = (uint8_t *)malloc (size); + if (!__fuzz_copy) return 0; + memcpy (__fuzz_copy, data, size); + + Dwg_Data dwg; + Bit_Chain dat = { NULL, 0, 0, 0, 0, 0, 0, NULL, 0 }; + Bit_Chain out_dat = { NULL, 0, 0, 0, 0, 0, 0, NULL, 0 }; + int copied = 0; + struct ly_ctx *ctx = NULL; + unsigned int possible_outputformats; + int out; + + static char tmp_file[256]; + dat.chain = __fuzz_copy; + dat.size = size; + memset (&dwg, 0, sizeof (dwg)); + + possible_outputformats = +#ifdef DISABLE_DXF +# ifdef DISABLE_JSON + 1; +# else + 3; +# endif +#else + 5; +#endif + + // Detect the input format: DWG, DXF or JSON + if (dat.size > 2 && dat.chain[0] == 'A' && dat.chain[1] == 'C') + { + if (dwg_decode (&dat, &dwg) >= DWG_ERR_CRITICAL) + { + dwg_free (&dwg); + free (__fuzz_copy); + return 0; + } + } +#ifndef DISABLE_JSON + else if (dat.size > 1 && dat.chain[0] == '{') + { + copied = enforce_null_termination (&dat, true); + if (dwg_read_json (&dat, &dwg) >= DWG_ERR_CRITICAL) + { + if (copied) + bit_chain_free (&dat); + dwg_free (&dwg); + free (__fuzz_copy); + return 0; + } + dat.opts |= DWG_OPTS_INJSON; + dwg.opts |= DWG_OPTS_INJSON; + } +#endif +#ifndef DISABLE_DXF + else + { + copied = enforce_null_termination (&dat, false); + if (dwg_read_dxf (&dat, &dwg) >= DWG_ERR_CRITICAL) + { + if (copied) + bit_chain_free (&dat); + dwg_free (&dwg); + free (__fuzz_copy); + return 0; + } + } +#else + else + { + free (__fuzz_copy); + return 0; + } +#endif + + memset (&out_dat, 0, sizeof (out_dat)); + bit_chain_set_version (&out_dat, &dat); + if (copied) + bit_chain_free (&dat); + +#if 0 + snprintf (tmp_file, 255, "/tmp/llvmfuzzer%d.out", getpid()); + tmp_file[255] = '\0'; +#elif defined _WIN32 + strcpy (tmp_file, "NUL"); +#else + strcpy (tmp_file, "/dev/null"); +#endif + out_dat.fh = fopen (tmp_file, "w"); + + out = rand () % possible_outputformats; +#ifdef STANDALONE + if (getenv ("OUT")) + out = strtol (getenv ("OUT"), NULL, 10); +#endif + switch (out) + { + case 0: + { + int ver = rand () % 6; +#ifdef STANDALONE + if (getenv ("VER")) + ver = strtol (getenv ("VER"), NULL, 10); +#endif + switch (ver) + { + case 0: + out_dat.version = dwg.header.version = R_13; + break; + case 1: + out_dat.version = dwg.header.version = R_13c3; + break; + case 2: + out_dat.version = dwg.header.version = R_14; + break; + case 3: // favor this one + case 4: + case 5: + default: + out_dat.version = dwg.header.version = R_2000; + break; + } + dwg_encode (&dwg, &out_dat); + free (out_dat.chain); + break; + } +#ifndef DISABLE_DXF + case 1: + dwg_write_dxf (&out_dat, &dwg); + free (out_dat.chain); + break; + case 2: // experimental + dwg_write_dxfb (&out_dat, &dwg); + free (out_dat.chain); + break; +# ifndef DISABLE_JSON + case 3: + dwg_write_json (&out_dat, &dwg); + free (out_dat.chain); + break; + case 4: + dwg_write_geojson (&out_dat, &dwg); + free (out_dat.chain); + break; +# endif +#endif + default: + break; + } + dwg_free (&dwg); + fclose (out_dat.fh); + free (__fuzz_copy); + // unlink (tmp_file); + return 0; +} + +#ifdef STANDALONE +/* +# ifdef __GNUC__ +__attribute__((weak)) +# endif +extern int LLVMFuzzerInitialize(int *argc, char ***argv); +*/ + +static int +usage (void) +{ + printf ("\nUsage: OUT=0 VER=3 llvmfuzz_standalone INPUT..."); + return 1; +} +// llvmfuzz_standalone reproducer, see OUT and VER env vars +int +main (int argc, char *argv[]) +{ + if (argc <= 1 || !*argv[1]) + return usage (); + /* works only on linux + if (LLVMFuzzerInitialize) + LLVMFuzzerInitialize (&argc, &argv); + */ + for (int i = 1; i < argc; i++) + { + unsigned char *buf; + FILE *f = fopen (argv[i], "rb"); + struct stat attrib; + long len; + size_t n_read; + int fd; + if (!f) + { + fprintf (stderr, "Illegal file argument %s\n", argv[i]); + continue; + } + fd = fileno (f); + if (fd < 0 || fstat (fd, &attrib) + || !(S_ISREG (attrib.st_mode) +# ifndef _WIN32 + || S_ISLNK (attrib.st_mode) +# endif + )) + { + fprintf (stderr, "Illegal input file \"%s\"\n", argv[i]); + continue; + } + // libFuzzer design bug, not zero-terminating its text buffer + fseek (f, 0, SEEK_END); + len = ftell (f); + fseek (f, 0, SEEK_SET); + if (len <= 0) + continue; + buf = (unsigned char *)malloc (len); + n_read = fread (buf, 1, len, f); + fclose (f); + assert ((long)n_read == len); + fprintf (stderr, "llvmfuzz_standalone %s [%" PRIuSIZE "]\n", argv[i], + len); + LLVMFuzzerTestOneInput (buf, len); + free (buf); + // Bit_Chain dat = { 0 }; + // dat_read_file (&dat, fp, argv[i]); + // LLVMFuzzerTestOneInput (dat.chain, dat.size); + // bit_free_chain (&dat); + } +} +#endif diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2021-493-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2021-493-patched new file mode 100755 index 000000000..e844997a2 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2021-493-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2021-535-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2021-535-patched new file mode 100755 index 000000000..3cc5c0377 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2021-535-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2021-543-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2021-543-patched new file mode 100755 index 000000000..38c0cdb8c Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2021-543-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2021-577-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2021-577-patched new file mode 100755 index 000000000..1c23b914e Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2021-577-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2021-620-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2021-620-patched new file mode 100755 index 000000000..828a7f967 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2021-620-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2021-771-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2021-771-patched new file mode 100755 index 000000000..a94f825ed Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2021-771-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2021-814-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2021-814-patched new file mode 100755 index 000000000..ad93cb024 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2021-814-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-1180-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-1180-patched new file mode 100755 index 000000000..04a5acddb Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-1180-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-1211-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-1211-patched new file mode 100755 index 000000000..17f0d9127 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-1211-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-1251-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-1251-patched new file mode 100755 index 000000000..ce9b03186 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-1251-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-1252-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-1252-patched new file mode 100755 index 000000000..08632a7a6 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-1252-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-128-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-128-patched new file mode 100755 index 000000000..ebffdf5a5 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-128-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-129-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-129-patched new file mode 100755 index 000000000..3dfac6fc4 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-129-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-363-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-363-patched new file mode 100755 index 000000000..a3805fe77 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-363-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-377-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-377-patched new file mode 100755 index 000000000..dffcee53d Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-377-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-387-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-387-patched new file mode 100755 index 000000000..eefe2bdb3 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-387-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-398-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-398-patched new file mode 100755 index 000000000..61008952c Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-398-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-403-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-403-patched new file mode 100755 index 000000000..063d4fca1 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-403-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-654-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-654-patched new file mode 100755 index 000000000..144952016 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-654-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-656-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-656-patched new file mode 100755 index 000000000..dad9e4de7 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-656-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-657-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-657-patched new file mode 100755 index 000000000..ffc3abdc6 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-657-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-664-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-664-patched new file mode 100755 index 000000000..ede67536b Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2022-664-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1048-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1048-patched new file mode 100755 index 000000000..e5598a4b7 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1048-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1051-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1051-patched new file mode 100755 index 000000000..918e9cdb2 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1051-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1063-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1063-patched new file mode 100755 index 000000000..73a487f85 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1063-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1099-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1099-patched new file mode 100755 index 000000000..ca0be2653 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1099-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1101-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1101-patched new file mode 100755 index 000000000..289ee4dab Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1101-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1104-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1104-patched new file mode 100755 index 000000000..74450cc9c Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1104-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1110-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1110-patched new file mode 100755 index 000000000..5fe0d40e1 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1110-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1122-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1122-patched new file mode 100755 index 000000000..63d7153fb Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1122-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1149-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1149-patched new file mode 100755 index 000000000..d095a1414 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1149-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1186-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1186-patched new file mode 100755 index 000000000..6aec25e88 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-1186-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-135-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-135-patched new file mode 100755 index 000000000..1a7f2a50a Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-135-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-269-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-269-patched new file mode 100755 index 000000000..59a457767 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-269-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-270-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-270-patched new file mode 100755 index 000000000..ad6a59e3c Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-270-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-271-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-271-patched new file mode 100755 index 000000000..26417b936 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-271-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-284-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-284-patched new file mode 100755 index 000000000..47c78223d Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-284-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-314-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-314-patched new file mode 100755 index 000000000..34fa28908 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-314-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-316-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-316-patched new file mode 100755 index 000000000..f0e7a7966 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-316-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-397-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-397-patched new file mode 100755 index 000000000..158c3a4c1 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-397-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-412-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-412-patched new file mode 100755 index 000000000..2a8584ded Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-412-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-415-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-415-patched new file mode 100755 index 000000000..2b53ace79 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-415-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-42-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-42-patched new file mode 100755 index 000000000..2b16ad0f6 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-42-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-440-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-440-patched new file mode 100755 index 000000000..5c368c4fe Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-440-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-452-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-452-patched new file mode 100755 index 000000000..1a7f2a50a Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-452-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-455-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-455-patched new file mode 100755 index 000000000..7c5e5d928 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-455-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-46-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-46-patched new file mode 100755 index 000000000..93988be40 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-46-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-634-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-634-patched new file mode 100755 index 000000000..a590e3f2d Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-634-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-717-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-717-patched new file mode 100755 index 000000000..ecdcbf249 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-717-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-748-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-748-patched new file mode 100755 index 000000000..a52d0ecd4 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-748-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-758-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-758-patched new file mode 100755 index 000000000..248f65973 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-758-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-777-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-777-patched new file mode 100755 index 000000000..89d2f75f3 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-777-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-811-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-811-patched new file mode 100755 index 000000000..31dc7e772 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-811-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-850-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-850-patched new file mode 100755 index 000000000..895696be7 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-850-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-855-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-855-patched new file mode 100755 index 000000000..23cae99bf Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-855-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-874-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-874-patched new file mode 100755 index 000000000..efbeae3e0 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-874-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-894-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-894-patched new file mode 100755 index 000000000..370cae2c1 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-894-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-965-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-965-patched new file mode 100755 index 000000000..02fd6b3d8 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-965-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-997-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-997-patched new file mode 100755 index 000000000..f91117c18 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2023-997-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2024-123-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2024-123-patched new file mode 100755 index 000000000..6c878beca Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2024-123-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2024-38-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2024-38-patched new file mode 100755 index 000000000..487ac9066 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2024-38-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2024-384-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2024-384-patched new file mode 100755 index 000000000..c1b4fee04 Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2024-384-patched differ diff --git a/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2024-42-patched b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2024-42-patched new file mode 100755 index 000000000..2385f73dc Binary files /dev/null and b/benchmarks/libredwg_transplant_llvmfuzz/seeds/testcase-OSV-2024-42-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/Dockerfile b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/Dockerfile new file mode 100644 index 000000000..5ceab39fd --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/Dockerfile @@ -0,0 +1,33 @@ +FROM gcr.io/oss-fuzz-base/base-builder@sha256:87ca1e9e19235e731fac8de8d1892ebe8d55caf18e7aa131346fc582a2034fdd + +# Dependencies for building nDPI + libpcap. +RUN apt-get update && apt-get install -y --no-install-recommends \ + autoconf automake libtool pkg-config \ + flex bison gettext libbison-dev libfl-dev \ + libjson-c-dev zlib1g-dev \ + && rm -rf /var/lib/apt/lists/* + +# Full clone — build.sh checks out the target commit, so history is needed. +RUN git clone https://github.com/ntop/nDPI.git /src/ndpi + +WORKDIR /src/ndpi + +# Keep ASan stack-use-after-return detection enabled for direct testcase replay. +ENV ASAN_OPTIONS="detect_leaks=0:detect_stack_use_after_return=1" + +# Raise libFuzzer's per-alloc / RSS cap from its 2048MB default. Some +# transplanted bugs trigger a ~2GB malloc en route to the real memory-safety +# error; with the default cap libFuzzer aborts with `out-of-memory` and +# `-ignore_ooms=1` silently drops it. libFuzzer-family runners in +# fuzzbench/fuzzers/*/fuzzer.py splice $ADDITIONAL_ARGS onto the target +# command line, so this propagates automatically. +ENV ADDITIONAL_ARGS="-rss_limit_mb=8192" + +# Vendored libpcap tarball (offline-build reproducibility, +# sha256: 635237637c5b619bcceba91900666b64d56ecb7be63f298f601ec786ce087094). +COPY libpcap-1.9.1.tar.gz /src/libpcap-1.9.1.tar.gz + +# Bug transplant patches (re-applied by build.sh after checkout resets source). +COPY patches/ /src/patches/ +COPY seeds/ /src/benchmark_seeds/ +COPY build.sh $SRC/ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/benchmark.yaml b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/benchmark.yaml new file mode 100644 index 000000000..9dbe8a314 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/benchmark.yaml @@ -0,0 +1,5 @@ +project: ndpi +fuzz_target: fuzz_ndpi_reader +commit: 5cad39f0e88c03b3cb4f78addf56e217b3d372f2 +commit_date: 2020-03-09T08:33:02-07:00 +type: bug diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/bug_metadata.json b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/bug_metadata.json new file mode 100644 index 000000000..847ab0825 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/bug_metadata.json @@ -0,0 +1,253 @@ +{ + "project": "ndpi", + "target_commit": "5cad39f0e88c03b3cb4f78addf56e217b3d372f2", + "dispatch_bytes": 3, + "total_bugs": 35, + "bugs": { + "OSV-2020-142": { + "dispatch_value": 1, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/ndpi_main.c", + "crash_line": 6211, + "crash_function": "ndpi_strncasestr" + }, + "OSV-2020-1884": { + "dispatch_value": 2, + "triggered": true, + "crash_file": "/src/ndpi/example/reader_util.c", + "crash_line": 1098, + "crash_function": "process_ndpi_collected_info" + }, + "OSV-2020-236": { + "dispatch_value": 4, + "triggered": true, + "crash_file": "/src/ndpi/example/reader_util.c", + "crash_line": 918, + "crash_function": "get_ndpi_flow_info6" + }, + "OSV-2020-242": { + "dispatch_value": 8, + "triggered": true, + "crash_file": "/src/ndpi/example/reader_util.c", + "crash_line": 1573, + "crash_function": "ndpi_workflow_process_packet" + }, + "OSV-2020-70": { + "dispatch_value": 16, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/ndpi_main.c", + "crash_line": 3650, + "crash_function": "ndpi_handle_ipv6_extension_headers" + }, + "OSV-2020-71": { + "dispatch_value": 32, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/ndpi_main.c", + "crash_line": 5157, + "crash_function": "ndpi_parse_packet_line_info" + }, + "OSV-2020-806": { + "dispatch_value": 64, + "triggered": true, + "crash_file": "/src/ndpi/example/reader_util.c", + "crash_line": 1069, + "crash_function": "process_ndpi_collected_info" + }, + "OSV-2020-92": { + "dispatch_value": 128, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/ndpi_main.c", + "crash_line": 5162, + "crash_function": "ndpi_parse_packet_line_info" + }, + "OSV-2022-1025": { + "dispatch_value": 256, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/irc.c", + "crash_line": 527, + "crash_function": "ndpi_search_irc_tcp" + }, + "OSV-2022-443": { + "dispatch_value": 512, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/http.c", + "crash_line": 624, + "crash_function": "ndpi_check_http_tcp" + }, + "OSV-2022-447": { + "dispatch_value": 1024, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/http.c", + "crash_line": 628, + "crash_function": "ndpi_check_http_tcp" + }, + "OSV-2022-481": { + "dispatch_value": 2048, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/ndpi_main.c", + "crash_line": 140, + "crash_function": "ndpi_strdup" + }, + "OSV-2022-712": { + "dispatch_value": 4096, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/florensia.c", + "crash_line": 93, + "crash_function": "ndpi_search_florensia" + }, + "OSV-2023-19": { + "dispatch_value": 8192, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/bittorrent.c", + "crash_line": 438, + "crash_function": "ndpi_search_bittorrent" + }, + "OSV-2023-573": { + "dispatch_value": 16384, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/http.c", + "crash_line": 89, + "crash_function": "ndpi_http_check_content" + }, + "OSV-2024-1330": { + "dispatch_value": 32768, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/zoom.c", + "crash_line": 14, + "crash_function": "zoom_search_again" + }, + "OSV-2024-552": { + "dispatch_value": 65536, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/zoom.c", + "crash_line": 32, + "crash_function": "ndpi_search_zoom" + }, + "OSV-2022-695": { + "dispatch_value": 131072, + "triggered": true, + "crash_file": "/src/ndpi/example/reader_util.c", + "crash_line": 341, + "crash_function": "free_wrapper" + }, + "OSV-2020-177": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/example/reader_util.c", + "crash_line": 919, + "crash_function": "get_ndpi_flow_info6" + }, + "OSV-2020-40": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/example/reader_util.c", + "crash_line": 1772, + "crash_function": "ndpi_workflow_process_packet" + }, + "OSV-2020-60": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/example/reader_util.c", + "crash_line": 705, + "crash_function": "get_ndpi_flow_info" + }, + "OSV-2020-178": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/ssh.c", + "crash_line": 99, + "crash_function": "concat_hash_string" + }, + "OSV-2020-747": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/http.c", + "crash_line": 367, + "crash_function": "check_content_type_and_change_protocol" + }, + "OSV-2020-18": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/openvpn.c", + "crash_line": 125, + "crash_function": "ndpi_search_openvpn" + }, + "OSV-2020-1566": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/example/reader_util.c", + "crash_line": 1647, + "crash_function": "ndpi_workflow_process_packet" + }, + "OSV-2020-2126": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/example/reader_util.c", + "crash_line": 1655, + "crash_function": "ndpi_workflow_process_packet" + }, + "OSV-2020-185": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/kerberos.c", + "crash_line": 246, + "crash_function": "ndpi_search_kerberos" + }, + "OSV-2020-956": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/example/reader_util.c", + "crash_line": 1713, + "crash_function": "ndpi_workflow_process_packet" + }, + "OSV-2020-829": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/http.c", + "crash_line": 367, + "crash_function": "check_content_type_and_change_protocol" + }, + "OSV-2020-821": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/example/reader_util.c", + "crash_line": 1625, + "crash_function": "ndpi_workflow_process_packet" + }, + "OSV-2020-181": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/example/reader_util.c", + "crash_line": 705, + "crash_function": "get_ndpi_flow_info" + }, + "OSV-2020-67": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/example/reader_util.c", + "crash_line": 1802, + "crash_function": "ndpi_workflow_process_packet" + }, + "OSV-2020-10": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/example/reader_util.c", + "crash_line": 1613, + "crash_function": "ndpi_workflow_process_packet" + }, + "OSV-2022-325": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/tinc.c", + "crash_line": 105, + "crash_function": "ndpi_check_tinc" + }, + "OSV-2023-1354": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/tls.c", + "crash_line": 931, + "crash_function": "processClientServerHello" + } + } +} diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/build.sh b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/build.sh new file mode 100755 index 000000000..862fd0b9f --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/build.sh @@ -0,0 +1,160 @@ +#!/bin/bash -eu +# Generated by fuzzbench_generate.py for bug transplant evaluation + +cd /src/ndpi + +# Checkout target commit +git checkout 5cad39f0e88c03b3cb4f78addf56e217b3d372f2 + +# Restore harness sources that live outside the project git repository. +if [ -f /src/patches/harness_sources/manifest.json ]; then + python3 - <<'PY' +import json +import shutil +from pathlib import Path + +root = Path("/src/patches/harness_sources") +for entry in json.loads((root / "manifest.json").read_text()): + source = root / entry["snapshot"] + destination = Path(entry["container_path"]) + destination.parent.mkdir(parents=True, exist_ok=True) + shutil.copy2(source, destination) +PY +fi + +# Apply dispatch harness first (modifies build system), then bug patches +if ! git apply --check /src/patches/harness.diff 2>/dev/null; then + echo "Trying git apply --3way for harness.diff..." + git apply --3way /src/patches/harness.diff +else + git apply /src/patches/harness.diff +fi + +if ! git apply --check /src/patches/combined.diff 2>/dev/null; then + echo "Trying git apply --3way for combined.diff..." + git apply --3way /src/patches/combined.diff +else + git apply /src/patches/combined.diff +fi + +# --- Fix library CMakeLists.txt for new source files from combined.diff --- +# combined.diff may create new .c files (e.g., zfp_getcell.c) that need to +# be added to the library's explicit source list. +if [ -d blosc ] && [ -f blosc/CMakeLists.txt ]; then + for newfile in blosc/*.c; do + base=$(basename "$newfile") + if ! grep -q "$base" blosc/CMakeLists.txt 2>/dev/null; then + echo "Adding $base to blosc/CMakeLists.txt" + sed -i "/^set(SOURCES /s/)/ $base)/" blosc/CMakeLists.txt + fi + done +fi + +# --- Original build commands --- +cd /src +tar -xvzf /src/libpcap-1.9.1.tar.gz +cd /src/libpcap-1.9.1 +# Disable optional backends so libpcap.a doesn't pick up dbus/bluetooth/rdma +# symbols from whatever -dev packages the current fuzzer builder happens to +# pull in transitively (e.g. libglib2.0-dev -> libdbus-1-dev in aflplusplus's +# builder). Without this, libpcap.a has undefined refs to dbus_*, bluetooth_*, +# etc. and nDPI's configure link test for pcap_open_live silently fails, +# leaving no fuzz/Makefile and no binary. +# Honor $CC/$CXX so libpcap gets the same instrumentation as nDPI. Without +# this, libpcap.a is built with /usr/bin/gcc and contains zero coverage edges +# for the fuzzer's edge-count map; LibAFL then rejects every seed during +# calibration ("Failed to load initial corpus") because all execution time +# spent inside libpcap looks like dead code. Other fuzzers tolerate this +# silently but produce a weaker coverage signal. +./configure --disable-shared \ + --disable-dbus --disable-bluetooth --disable-rdma \ + --without-libnl --without-dpdk --without-dag --without-septel --without-snf \ + CC="$CC" CXX="$CXX" +make -j$(nproc) -k CC="$CC" CXX="$CXX" 2>&1 || true +make install +cd .. + +# build project +cd /src/ndpi +sh autogen.sh +./configure --enable-fuzztargets CC="$CC" CXX="$CXX" +make -k CC="$CC" CXX="$CXX" 2>&1 || true +ls fuzz/fuzz* | grep -v "\." | while read i; do cp $i $OUT/; done + + +# --- Seed corpus: expand original seeds and per-bug testcase candidates --- +# FuzzBench uses $OUT/{fuzz_target}_seed_corpus.zip as initial corpus. +# Create one seed variant for the default path plus one for each dispatch bit. +# Per-bug reproducers are used only as source material: exact crashing inputs +# are filtered out before packaging. +seed_zip="$OUT/fuzz_ndpi_reader_seed_corpus.zip" +seed_target="$OUT/fuzz_ndpi_reader" +mkdir -p /tmp/seeds_dispatch /tmp/original_seeds /tmp/benchmark_seed_candidates + +if [ -f "$seed_zip" ]; then + unzip -q -o "$seed_zip" -d /tmp/original_seeds 2>/dev/null || true + for f in /tmp/original_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + for dispatch in '\x00\x00\x00' '\x01\x00\x00' '\x02\x00\x00' '\x04\x00\x00' '\x08\x00\x00' '\x10\x00\x00' '\x20\x00\x00' '\x40\x00\x00' '\x80\x00\x00' '\x00\x01\x00' '\x00\x02\x00' '\x00\x04\x00' '\x00\x08\x00' '\x00\x10\x00' '\x00\x20\x00' '\x00\x40\x00' '\x00\x80\x00' '\x00\x00\x01' '\x00\x00\x02' '\x00\x00\x04' '\x00\x00\x08' '\x00\x00\x10' '\x00\x00\x20' '\x00\x00\x40' '\x00\x00\x80'; do + dispatch_name=$(printf '%s' "$dispatch" | tr -d '\x') + printf '%b' "$dispatch" | cat - "$f" > "/tmp/seeds_dispatch/${base}.dispatch_${dispatch_name}" + done + done +fi + +if [ -d /src/benchmark_seeds ]; then + for f in /src/benchmark_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + size=$(wc -c < "$f") + [ "$size" -gt 0 ] || continue + + cp "$f" "/tmp/benchmark_seed_candidates/${base}.exact" + # Zero the dispatch byte (byte 0): deactivates dispatch-gated patches + # while keeping the full APDU conversation and card driver routing intact. + cp "$f" "/tmp/benchmark_seed_candidates/${base}.dispatch_zero" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.dispatch_zero" bs=1 seek=0 conv=notrunc 2>/dev/null || true + for keep in 1 2 8 16 64 256 1024; do + if [ "$size" -gt "$keep" ]; then + head -c "$keep" "$f" > "/tmp/benchmark_seed_candidates/${base}.head_${keep}" + fi + done + if [ "$size" -gt 1 ]; then + head -c "$((size - 1))" "$f" > "/tmp/benchmark_seed_candidates/${base}.trim_1" + cp "$f" "/tmp/benchmark_seed_candidates/${base}.zero_last" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.zero_last" bs=1 seek="$((size - 1))" conv=notrunc 2>/dev/null || true + cp "$f" "/tmp/benchmark_seed_candidates/${base}.ff_last" + printf '\377' | dd of="/tmp/benchmark_seed_candidates/${base}.ff_last" bs=1 seek="$((size - 1))" conv=notrunc 2>/dev/null || true + fi + if [ "$size" -gt 4 ]; then + mid=$((size / 2)) + cp "$f" "/tmp/benchmark_seed_candidates/${base}.zero_mid" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.zero_mid" bs=1 seek="$mid" conv=notrunc 2>/dev/null || true + cp "$f" "/tmp/benchmark_seed_candidates/${base}.ff_mid" + printf '\377' | dd of="/tmp/benchmark_seed_candidates/${base}.ff_mid" bs=1 seek="$mid" conv=notrunc 2>/dev/null || true + fi + done +fi + +if [ -x "$seed_target" ] && ls /tmp/benchmark_seed_candidates/* 1>/dev/null 2>&1; then + for f in /tmp/benchmark_seed_candidates/*; do + [ -f "$f" ] || continue + # Drop seeds too small to contain a pcap global header (24 bytes). + # libafl's seed-calibration respawner panics when every initial seed + # causes the target to exit 0 at the first byte — which happens for + # 1-to-16-byte .head_* variants that trip nDPI's early-return path. + fsize=$(wc -c < "$f") + if [ "$fsize" -lt 24 ]; then + continue + fi + if timeout 10s env ASAN_OPTIONS="${ASAN_OPTIONS:-detect_leaks=0:detect_stack_use_after_return=1}" "$seed_target" "$f" >/tmp/seed_replay.log 2>&1; then + cp "$f" "/tmp/seeds_dispatch/poc_$(basename "$f")" + fi + done +fi + +if ls /tmp/seeds_dispatch/* 1>/dev/null 2>&1; then + rm -f "$seed_zip" + zip -j -q "$seed_zip" /tmp/seeds_dispatch/* +fi diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-10.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-10.txt new file mode 100644 index 000000000..484e31b9a --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-10.txt @@ -0,0 +1,49 @@ +INFO: Seed: 2838949341 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000185c00 at pc 0x0000004f03fe bp 0x7ffe5c1f0f90 sp 0x7ffe5c1f0f88 +READ of size 2 at 0x611000185c00 thread T0 + #0 0x4f03fd in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1613:16 + #1 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f37aa2f6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #7 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +Address 0x611000185c00 is a wild pointer inside of access range of size 0x000000000002. +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:1613:16 in ndpi_workflow_process_packet +Shadow bytes around the buggy address: + 0x0c2280028b30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2280028b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2280028b50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2280028b60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2280028b70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c2280028b80:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2280028b90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2280028ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2280028bb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2280028bc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2280028bd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-142.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-142.txt new file mode 100644 index 000000000..150af7bed --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-142.txt @@ -0,0 +1,76 @@ +INFO: Seed: 2759195969 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x62b00000f730 at pc 0x00000051ead1 bp 0x7ffdee2bbee0 sp 0x7ffdee2bbed8 +READ of size 1 at 0x62b00000f730 thread T0 + #0 0x51ead0 in ndpi_strncasestr /src/ndpi/src/lib/ndpi_main.c:6211:25 + #1 0x56a3a7 in ndpi_http_check_content /src/ndpi/src/lib/protocols/http.c:75:9 + #2 0x56a3a7 in ndpi_int_http_add_connection /src/ndpi/src/lib/protocols/http.c:135:14 + #3 0x567cbc in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c:719:9 + #4 0x567cbc in ndpi_search_http_tcp /src/ndpi/src/lib/protocols/http.c:866:3 + #5 0x56ac5f in ndpi_search_http_tcp_again /src/ndpi/src/lib/protocols/http.c:39:3 + #6 0x511c3d in ndpi_process_extra_packet /src/ndpi/src/lib/ndpi_main.c:4397:9 + #7 0x513f5c in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4753:7 + #8 0x4eed8e in packet_processing /src/ndpi/example/reader_util.c:1422:33 + #9 0x4eed8e in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #10 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #11 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #12 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #13 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #14 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #15 0x7fac89846082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #16 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x62b00000f730 is located 5424 bytes inside of 25421-byte region [0x62b00000e200,0x62b00001454d) +freed by thread T0 here: + #0 0x4a0b22 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x4de70f in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:91:5 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7fac89846082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +previously allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7fac89846082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/ndpi/src/lib/ndpi_main.c:6211:25 in ndpi_strncasestr +Shadow bytes around the buggy address: + 0x0c567fff9e90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fff9ea0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fff9eb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fff9ec0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fff9ed0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0c567fff9ee0: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd + 0x0c567fff9ef0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fff9f00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fff9f10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fff9f20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fff9f30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-1566.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-1566.txt new file mode 100644 index 000000000..149ce7961 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-1566.txt @@ -0,0 +1,58 @@ +INFO: Seed: 2818496063 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000180 at pc 0x0000004f0360 bp 0x7ffc587e9310 sp 0x7ffc587e9308 +READ of size 1 at 0x604000000180 thread T0 + #0 0x4f035f in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1647:17 + #1 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f501dd0b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #7 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x604000000180 is located 0 bytes to the right of 48-byte region [0x604000000150,0x604000000180) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f501dd0b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:1647:17 in ndpi_workflow_process_packet +Shadow bytes around the buggy address: + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 + 0x0c087fff8010: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 01 fa + 0x0c087fff8020: fa fa 00 00 00 00 07 fa fa fa 00 00 00 00 00 00 +=>0x0c087fff8030:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-177.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-177.txt new file mode 100644 index 000000000..df98d302c --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-177.txt @@ -0,0 +1,60 @@ +INFO: Seed: 2803253246 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6040000009fb at pc 0x0000004ef8f3 bp 0x7fff5287e330 sp 0x7fff5287e328 +READ of size 4 at 0x6040000009fb thread T0 + #0 0x4ef8f2 in get_ndpi_flow_info6 /src/ndpi/example/reader_util.c:919:52 + #1 0x4ef8f2 in packet_processing /src/ndpi/example/reader_util.c:1222:12 + #2 0x4ef8f2 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #3 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #4 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #5 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #6 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #7 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #8 0x7f929683e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #9 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x6040000009fb is located 0 bytes to the right of 43-byte region [0x6040000009d0,0x6040000009fb) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f929683e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:919:52 in get_ndpi_flow_info6 +Shadow bytes around the buggy address: + 0x0c087fff80e0: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 fa + 0x0c087fff80f0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x0c087fff8100: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x0c087fff8110: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd + 0x0c087fff8120: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd +=>0x0c087fff8130: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00[03] + 0x0c087fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8170: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-178.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-178.txt new file mode 100644 index 000000000..66d72752a --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-178.txt @@ -0,0 +1,64 @@ +INFO: Seed: 2811067211 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000202 at pc 0x000000556e33 bp 0x7ffe3ffb0a60 sp 0x7ffe3ffb0a58 +READ of size 4 at 0x60b000000202 thread T0 + #0 0x556e32 in concat_hash_string /src/ndpi/src/lib/protocols/ssh.c:99:19 + #1 0x555704 in ndpi_search_ssh_tcp /src/ndpi/src/lib/protocols/ssh.c:308:10 + #2 0x5570af in search_ssh_again /src/ndpi/src/lib/protocols/ssh.c:64:3 + #3 0x511c3d in ndpi_process_extra_packet /src/ndpi/src/lib/ndpi_main.c:4397:9 + #4 0x513f5c in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4753:7 + #5 0x4eed8e in packet_processing /src/ndpi/example/reader_util.c:1422:33 + #6 0x4eed8e in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #7 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #8 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #9 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #10 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #11 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #12 0x7f199a08b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #13 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x60b000000204 is located 0 bytes to the right of 100-byte region [0x60b0000001a0,0x60b000000204) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f199a08b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/ssh.c:99:19 in concat_hash_string +Shadow bytes around the buggy address: + 0x0c167fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff8000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c167fff8010: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fd fd + 0x0c167fff8020: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa + 0x0c167fff8030: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c167fff8040:[04]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-18.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-18.txt new file mode 100644 index 000000000..ebe191a1e --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-18.txt @@ -0,0 +1,64 @@ +INFO: Seed: 2816071925 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b0000003d2 at pc 0x000000439f0c bp 0x7ffc69986fa0 sp 0x7ffc69986750 +READ of size 8 at 0x60b0000003d2 thread T0 + #0 0x439f0b in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:861:7 + #1 0x43a31b in bcmp /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:906:10 + #2 0x561be3 in ndpi_search_openvpn /src/ndpi/src/lib/protocols/openvpn.c:125:12 + #3 0x508896 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4113:2 + #4 0x514ec6 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4907:3 + #5 0x4eed8e in packet_processing /src/ndpi/example/reader_util.c:1422:33 + #6 0x4eed8e in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #7 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #8 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #9 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #10 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #11 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #12 0x7fb79528d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #13 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x60b0000003d2 is located 106 bytes to the right of 104-byte region [0x60b000000300,0x60b000000368) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7fb79528d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:861:7 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) +Shadow bytes around the buggy address: + 0x0c167fff8020: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa + 0x0c167fff8030: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c167fff8040: fd fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd + 0x0c167fff8050: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa + 0x0c167fff8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa +=>0x0c167fff8070: fa fa fa fa fa fa fa fa fa fa[fa]fa fa fa fa fa + 0x0c167fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-181.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-181.txt new file mode 100644 index 000000000..263507118 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-181.txt @@ -0,0 +1,60 @@ +INFO: Seed: 2833563634 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060001f481b at pc 0x0000004f2e17 bp 0x7ffc98192650 sp 0x7ffc98192648 +READ of size 2 at 0x6060001f481b thread T0 + #0 0x4f2e16 in get_ndpi_flow_info /src/ndpi/example/reader_util.c:705:47 + #1 0x4eccae in packet_processing /src/ndpi/example/reader_util.c:1214:12 + #2 0x4eccae in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #3 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #4 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #5 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #6 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #7 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #8 0x7f2614a30082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #9 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x6060001f481b is located 0 bytes to the right of 59-byte region [0x6060001f47e0,0x6060001f481b) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f2614a30082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:705:47 in get_ndpi_flow_info +Shadow bytes around the buggy address: + 0x0c0c800368b0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c800368c0: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c800368d0: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa + 0x0c0c800368e0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c800368f0: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 +=>0x0c0c80036900: 00 00 00[03]fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-185.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-185.txt new file mode 100644 index 000000000..eae80901f --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-185.txt @@ -0,0 +1,62 @@ +INFO: Seed: 2823443735 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000183f45 at pc 0x00000057483a bp 0x7ffc64328250 sp 0x7ffc64328248 +READ of size 1 at 0x611000183f45 thread T0 + #0 0x574839 in ndpi_search_kerberos /src/ndpi/src/lib/protocols/kerberos.c:246:30 + #1 0x509804 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4100:7 + #2 0x514ec6 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4907:3 + #3 0x4eed8e in packet_processing /src/ndpi/example/reader_util.c:1422:33 + #4 0x4eed8e in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #5 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #6 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #7 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #8 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #9 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #10 0x7fc679cca082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x611000183f45 is located 0 bytes to the right of 197-byte region [0x611000183e80,0x611000183f45) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7fc679cca082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/kerberos.c:246:30 in ndpi_search_kerberos +Shadow bytes around the buggy address: + 0x0c2280028790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c22800287a0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c22800287b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c22800287c0: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa + 0x0c22800287d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c22800287e0: 00 00 00 00 00 00 00 00[05]fa fa fa fa fa fa fa + 0x0c22800287f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2280028800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2280028810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2280028820: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2280028830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-1884.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-1884.txt new file mode 100644 index 000000000..ce9d8b2eb --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-1884.txt @@ -0,0 +1,24 @@ +INFO: Seed: 2761580764 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x0000004b7d50 bp 0x7fffd8a91b30 sp 0x7fffd8a912e8 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x4b7d50 in __sanitizer::internal_strlen(char const*) /src/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_libc.cpp:167:10 + #1 0x48b861 in strdup /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:436:17 + #2 0x4e9a85 in process_ndpi_collected_info /src/ndpi/example/reader_util.c:1098:33 + #3 0x4eef5d in packet_processing /src/ndpi/example/reader_util.c:1447:4 + #4 0x4eef5d in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #5 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #6 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #7 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #8 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #9 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #10 0x7f9a6b641082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_libc.cpp:167:10 in __sanitizer::internal_strlen(char const*) +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-2126.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-2126.txt new file mode 100644 index 000000000..ba7b56369 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-2126.txt @@ -0,0 +1,58 @@ +INFO: Seed: 2820960036 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060001f481a at pc 0x0000004f02d0 bp 0x7ffc63056b10 sp 0x7ffc63056b08 +READ of size 1 at 0x6060001f481a thread T0 + #0 0x4f02cf in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1655:15 + #1 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7fe53d8ae082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #7 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x6060001f481a is located 0 bytes to the right of 58-byte region [0x6060001f47e0,0x6060001f481a) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7fe53d8ae082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:1655:15 in ndpi_workflow_process_packet +Shadow bytes around the buggy address: + 0x0c0c800368b0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c800368c0: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c800368d0: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa + 0x0c0c800368e0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c800368f0: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 +=>0x0c0c80036900: 00 00 00[02]fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-236.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-236.txt new file mode 100644 index 000000000..da9cc37c4 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-236.txt @@ -0,0 +1,60 @@ +INFO: Seed: 2764239361 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6030000053c7 at pc 0x0000004ef82f bp 0x7ffc68e5baf0 sp 0x7ffc68e5bae8 +READ of size 4 at 0x6030000053c7 thread T0 + #0 0x4ef82e in get_ndpi_flow_info6 /src/ndpi/example/reader_util.c:918:15 + #1 0x4ef82e in packet_processing /src/ndpi/example/reader_util.c:1222:12 + #2 0x4ef82e in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #3 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #4 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #5 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #6 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #7 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #8 0x7f55b99b7082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #9 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x6030000053c7 is located 2 bytes to the right of 21-byte region [0x6030000053b0,0x6030000053c5) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f55b99b7082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:918:15 in get_ndpi_flow_info6 +Shadow bytes around the buggy address: + 0x0c067fff8a20: fa fa 00 00 03 fa fa fa 00 00 02 fa fa fa 00 00 + 0x0c067fff8a30: 01 fa fa fa 00 00 00 06 fa fa 00 00 01 fa fa fa + 0x0c067fff8a40: 00 00 01 fa fa fa 00 00 00 06 fa fa 00 00 01 fa + 0x0c067fff8a50: fa fa 00 00 01 fa fa fa 00 00 03 fa fa fa 00 00 + 0x0c067fff8a60: 00 fa fa fa 00 00 01 fa fa fa 00 00 02 fa fa fa +=>0x0c067fff8a70: 00 00 06 fa fa fa 00 00[05]fa fa fa fa fa fa fa + 0x0c067fff8a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c067fff8a90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c067fff8aa0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c067fff8ab0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c067fff8ac0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-242.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-242.txt new file mode 100644 index 000000000..991e5e2cd --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-242.txt @@ -0,0 +1,58 @@ +INFO: Seed: 2766656885 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000045cfc at pc 0x0000004f0492 bp 0x7ffefdc508f0 sp 0x7ffefdc508e8 +READ of size 2 at 0x602000045cfc thread T0 + #0 0x4f0491 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1573:13 + #1 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f0187175082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #7 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x602000045cfc is located 11 bytes to the right of 1-byte region [0x602000045cf0,0x602000045cf1) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f0187175082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:1573:13 in ndpi_workflow_process_packet +Shadow bytes around the buggy address: + 0x0c0480000b40: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000b50: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000b60: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000b70: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000b80: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 +=>0x0c0480000b90: fa fa 00 04 fa fa 00 04 fa fa 00 00 fa fa 01[fa] + 0x0c0480000ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000bb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000bc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000bd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000be0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-40.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-40.txt new file mode 100644 index 000000000..8ecef6b08 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-40.txt @@ -0,0 +1,58 @@ +INFO: Seed: 2806011227 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400000017d at pc 0x0000004f03b0 bp 0x7ffd0cc91790 sp 0x7ffd0cc91788 +READ of size 2 at 0x60400000017d thread T0 + #0 0x4f03af in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1772:23 + #1 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f6a9939d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #7 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x60400000017d is located 0 bytes to the right of 45-byte region [0x604000000150,0x60400000017d) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f6a9939d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:1772:23 in ndpi_workflow_process_packet +Shadow bytes around the buggy address: + 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 + 0x0c087fff8010: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 01 fa +=>0x0c087fff8020: fa fa 00 00 00 00 07 fa fa fa 00 00 00 00 00[05] + 0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-60.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-60.txt new file mode 100644 index 000000000..0bab4254f --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-60.txt @@ -0,0 +1,61 @@ +INFO: Seed: 2808558978 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400000017d at pc 0x0000004f2dc2 bp 0x7ffd082b8670 sp 0x7ffd082b8668 +READ of size 2 at 0x60400000017d thread T0 + #0 0x4f2dc1 in get_ndpi_flow_info /src/ndpi/example/reader_util.c:705:14 + #1 0x4ed26a in get_ndpi_flow_info6 /src/ndpi/example/reader_util.c:928:10 + #2 0x4ed26a in packet_processing /src/ndpi/example/reader_util.c:1222:12 + #3 0x4ed26a in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #4 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #5 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #6 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #7 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #8 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #9 0x7fd57ca24082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #10 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x60400000017d is located 0 bytes to the right of 45-byte region [0x604000000150,0x60400000017d) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7fd57ca24082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:705:14 in get_ndpi_flow_info +Shadow bytes around the buggy address: + 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 + 0x0c087fff8010: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 01 fa +=>0x0c087fff8020: fa fa 00 00 00 00 07 fa fa fa 00 00 00 00 00[05] + 0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-67.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-67.txt new file mode 100644 index 000000000..93600ccea --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-67.txt @@ -0,0 +1,58 @@ +INFO: Seed: 2836136131 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060001f4816 at pc 0x0000004f0517 bp 0x7ffe55a5dcd0 sp 0x7ffe55a5dcc8 +READ of size 2 at 0x6060001f4816 thread T0 + #0 0x4f0516 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1802:32 + #1 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f0ea6abe082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #7 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x6060001f4817 is located 0 bytes to the right of 55-byte region [0x6060001f47e0,0x6060001f4817) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f0ea6abe082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:1802:32 in ndpi_workflow_process_packet +Shadow bytes around the buggy address: + 0x0c0c800368b0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c800368c0: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c800368d0: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa + 0x0c0c800368e0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c800368f0: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 +=>0x0c0c80036900: 00 00[07]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-70.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-70.txt new file mode 100644 index 000000000..f1eb95afd --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-70.txt @@ -0,0 +1,59 @@ +INFO: Seed: 2769124092 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400000017d at pc 0x000000501a71 bp 0x7ffc39045a10 sp 0x7ffc39045a08 +READ of size 1 at 0x60400000017d thread T0 + #0 0x501a70 in ndpi_handle_ipv6_extension_headers /src/ndpi/src/lib/ndpi_main.c:3650:16 + #1 0x4ec088 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1750:7 + #2 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #3 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #4 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #5 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #6 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #7 0x7f398390f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #8 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x60400000017d is located 0 bytes to the right of 45-byte region [0x604000000150,0x60400000017d) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f398390f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/ndpi_main.c:3650:16 in ndpi_handle_ipv6_extension_headers +Shadow bytes around the buggy address: + 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 + 0x0c087fff8010: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 01 fa +=>0x0c087fff8020: fa fa 00 00 00 00 07 fa fa fa 00 00 00 00 00[05] + 0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-71.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-71.txt new file mode 100644 index 000000000..a49c78efb --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-71.txt @@ -0,0 +1,65 @@ +INFO: Seed: 2771472661 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000152 at pc 0x0000004a0151 bp 0x7ffec0484f90 sp 0x7ffec0484760 +READ of size 8 at 0x60b000000152 thread T0 + #0 0x4a0150 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x5173e6 in ndpi_parse_packet_line_info /src/ndpi/src/lib/ndpi_main.c:5157:9 + #2 0x55a261 in ndpi_check_steam_http /src/ndpi/src/lib/protocols/steam.c:40:3 + #3 0x55a261 in ndpi_search_steam /src/ndpi/src/lib/protocols/steam.c:280:5 + #4 0x50bd1f in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4157:4 + #5 0x514ec6 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4907:3 + #6 0x4eed8e in packet_processing /src/ndpi/example/reader_util.c:1422:33 + #7 0x4eed8e in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #8 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #9 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #10 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #11 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #12 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #13 0x7ff0b78df082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #14 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x60b000000152 is located 0 bytes to the right of 98-byte region [0x60b0000000f0,0x60b000000152) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7ff0b78df082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c167fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff8000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c167fff8010: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00 +=>0x0c167fff8020: 00 00 00 00 00 00 00 00 00 00[02]fa fa fa fa fa + 0x0c167fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-747.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-747.txt new file mode 100644 index 000000000..6ab4bbeab --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-747.txt @@ -0,0 +1,75 @@ +INFO: Seed: 2813656018 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x62b0000102df at pc 0x00000048bfed bp 0x7ffc05c3be30 sp 0x7ffc05c3b5f0 +READ of size 2 at 0x62b0000102df thread T0 + #0 0x48bfec in __interceptor_strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 + #1 0x569076 in check_content_type_and_change_protocol /src/ndpi/src/lib/protocols/http.c:367:7 + #2 0x567cc7 in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c:720:9 + #3 0x567cc7 in ndpi_search_http_tcp /src/ndpi/src/lib/protocols/http.c:866:3 + #4 0x56ac5f in ndpi_search_http_tcp_again /src/ndpi/src/lib/protocols/http.c:39:3 + #5 0x511c3d in ndpi_process_extra_packet /src/ndpi/src/lib/ndpi_main.c:4397:9 + #6 0x513f5c in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4753:7 + #7 0x4eed8e in packet_processing /src/ndpi/example/reader_util.c:1422:33 + #8 0x4eed8e in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #9 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #10 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #11 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #12 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #13 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #14 0x7f21d2126082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #15 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x62b0000102df is located 8415 bytes inside of 25443-byte region [0x62b00000e200,0x62b000014563) +freed by thread T0 here: + #0 0x4a0b22 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x4de70f in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:91:5 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f21d2126082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +previously allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f21d2126082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 in __interceptor_strncpy +Shadow bytes around the buggy address: + 0x0c567fffa000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fffa010: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fffa020: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fffa030: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fffa040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0c567fffa050: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd + 0x0c567fffa060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fffa070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fffa080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fffa090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fffa0a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-806.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-806.txt new file mode 100644 index 000000000..6a90517de --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-806.txt @@ -0,0 +1,24 @@ +INFO: Seed: 2774207733 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x7fa3bf7c66e5 bp 0x7ffdf3005370 sp 0x7ffdf3004b28 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x7fa3bf7c66e5 (/lib/x86_64-linux-gnu/libc.so.6+0x1886e5) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #1 0x4359f8 in strlen /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc + #2 0x4e962e in process_ndpi_collected_info /src/ndpi/example/reader_util.c:1069:43 + #3 0x4eef5d in packet_processing /src/ndpi/example/reader_util.c:1447:4 + #4 0x4eef5d in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #5 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #6 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #7 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #8 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #9 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #10 0x7fa3bf662082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0x1886e5) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-821.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-821.txt new file mode 100644 index 000000000..ed4e349f7 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-821.txt @@ -0,0 +1,58 @@ +INFO: Seed: 2831154710 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400000017e at pc 0x0000004f0413 bp 0x7ffebcdeed30 sp 0x7ffebcdeed28 +READ of size 1 at 0x60400000017e thread T0 + #0 0x4f0412 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1625:13 + #1 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f7179c36082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #7 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x60400000017e is located 1 bytes to the right of 45-byte region [0x604000000150,0x60400000017d) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f7179c36082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:1625:13 in ndpi_workflow_process_packet +Shadow bytes around the buggy address: + 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 + 0x0c087fff8010: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 01 fa +=>0x0c087fff8020: fa fa 00 00 00 00 07 fa fa fa 00 00 00 00 00[05] + 0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-829.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-829.txt new file mode 100644 index 000000000..277234064 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-829.txt @@ -0,0 +1,75 @@ +INFO: Seed: 2828597904 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x62b0000102df at pc 0x00000048bfed bp 0x7fff32877ff0 sp 0x7fff328777b0 +READ of size 2 at 0x62b0000102df thread T0 + #0 0x48bfec in __interceptor_strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 + #1 0x569076 in check_content_type_and_change_protocol /src/ndpi/src/lib/protocols/http.c:367:7 + #2 0x567cc7 in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c:720:9 + #3 0x567cc7 in ndpi_search_http_tcp /src/ndpi/src/lib/protocols/http.c:866:3 + #4 0x56ac5f in ndpi_search_http_tcp_again /src/ndpi/src/lib/protocols/http.c:39:3 + #5 0x511c3d in ndpi_process_extra_packet /src/ndpi/src/lib/ndpi_main.c:4397:9 + #6 0x513f5c in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4753:7 + #7 0x4eed8e in packet_processing /src/ndpi/example/reader_util.c:1422:33 + #8 0x4eed8e in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #9 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #10 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #11 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #12 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #13 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #14 0x7fc9b9f70082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #15 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x62b0000102df is located 8415 bytes inside of 25443-byte region [0x62b00000e200,0x62b000014563) +freed by thread T0 here: + #0 0x4a0b22 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x4de70f in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:91:5 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7fc9b9f70082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +previously allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7fc9b9f70082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 in __interceptor_strncpy +Shadow bytes around the buggy address: + 0x0c567fffa000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fffa010: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fffa020: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fffa030: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fffa040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x0c567fffa050: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd + 0x0c567fffa060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fffa070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fffa080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fffa090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c567fffa0a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-92.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-92.txt new file mode 100644 index 000000000..043bcc200 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-92.txt @@ -0,0 +1,63 @@ +INFO: Seed: 2776610380 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000152 at pc 0x000000519ac7 bp 0x7ffdb70f5030 sp 0x7ffdb70f5028 +READ of size 2 at 0x60b000000152 thread T0 + #0 0x519ac6 in ndpi_parse_packet_line_info /src/ndpi/src/lib/ndpi_main.c:5162:45 + #1 0x584463 in ndpi_search_mail_smtp_tcp /src/ndpi/src/lib/protocols/mail_smtp.c:79:5 + #2 0x50bd1f in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4157:4 + #3 0x514ec6 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4907:3 + #4 0x4eed8e in packet_processing /src/ndpi/example/reader_util.c:1422:33 + #5 0x4eed8e in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #6 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #7 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #8 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #9 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #10 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #11 0x7f9d781bd082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #12 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x60b000000152 is located 0 bytes to the right of 98-byte region [0x60b0000000f0,0x60b000000152) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f9d781bd082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/ndpi_main.c:5162:45 in ndpi_parse_packet_line_info +Shadow bytes around the buggy address: + 0x0c167fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff8000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c167fff8010: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00 +=>0x0c167fff8020: 00 00 00 00 00 00 00 00 00 00[02]fa fa fa fa fa + 0x0c167fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-956.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-956.txt new file mode 100644 index 000000000..ab2d36eba --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2020-956.txt @@ -0,0 +1,58 @@ +INFO: Seed: 2825982439 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000188 at pc 0x0000004f0312 bp 0x7ffcacf5a2b0 sp 0x7ffcacf5a2a8 +READ of size 1 at 0x604000000188 thread T0 + #0 0x4f0311 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1713:11 + #1 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f945a2b3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #7 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x604000000188 is located 10 bytes to the right of 46-byte region [0x604000000150,0x60400000017e) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f945a2b3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:1713:11 in ndpi_workflow_process_packet +Shadow bytes around the buggy address: + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 + 0x0c087fff8010: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 01 fa + 0x0c087fff8020: fa fa 00 00 00 00 07 fa fa fa 00 00 00 00 00 06 +=>0x0c087fff8030: fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2022-1025.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2022-1025.txt new file mode 100644 index 000000000..54a0e5653 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2022-1025.txt @@ -0,0 +1,64 @@ +INFO: Seed: 2779033089 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060001f4819 at pc 0x00000044132d bp 0x7ffc0794e9d0 sp 0x7ffc0794e158 +READ of size 9 at 0x6060001f4819 thread T0 + #0 0x44132c in printf_common(void*, char const*, __va_list_tag*) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 + #1 0x442b80 in __interceptor_snprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1736:1 + #2 0x59e140 in ndpi_search_irc_tcp /src/ndpi/src/lib/protocols/irc.c:527:4 + #3 0x50bd1f in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4157:4 + #4 0x514ec6 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4907:3 + #5 0x4eed8e in packet_processing /src/ndpi/example/reader_util.c:1422:33 + #6 0x4eed8e in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #7 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #8 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #9 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #10 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #11 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #12 0x7f6683e2f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #13 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x6060001f4819 is located 0 bytes to the right of 57-byte region [0x6060001f47e0,0x6060001f4819) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f6683e2f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 in printf_common(void*, char const*, __va_list_tag*) +Shadow bytes around the buggy address: + 0x0c0c800368b0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c800368c0: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c800368d0: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa + 0x0c0c800368e0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c800368f0: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 +=>0x0c0c80036900: 00 00 00[01]fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2022-325.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2022-325.txt new file mode 100644 index 000000000..facebd2c0 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2022-325.txt @@ -0,0 +1,63 @@ +INFO: Seed: 2841602236 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060001f48d6 at pc 0x0000005a924a bp 0x7ffcb379b770 sp 0x7ffcb379b768 +READ of size 1 at 0x6060001f48d6 thread T0 + #0 0x5a9249 in ndpi_check_tinc /src/ndpi/src/lib/protocols/tinc.c:105:9 + #1 0x5a9249 in ndpi_search_tinc /src/ndpi/src/lib/protocols/tinc.c:138:7 + #2 0x50bd1f in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4157:4 + #3 0x514ec6 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4907:3 + #4 0x4eed8e in packet_processing /src/ndpi/example/reader_util.c:1422:33 + #5 0x4eed8e in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #6 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #7 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #8 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #9 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #10 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #11 0x7f93cfad6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #12 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x6060001f48d6 is located 0 bytes to the right of 54-byte region [0x6060001f48a0,0x6060001f48d6) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f93cfad6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/tinc.c:105:9 in ndpi_check_tinc +Shadow bytes around the buggy address: + 0x0c0c800368c0: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c800368d0: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa + 0x0c0c800368e0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c800368f0: 00 00 00 00 00 00 00 fa fa fa fa fa fd fd fd fd + 0x0c0c80036900: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa +=>0x0c0c80036910: fa fa fa fa 00 00 00 00 00 00[06]fa fa fa fa fa + 0x0c0c80036920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036960: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2022-443.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2022-443.txt new file mode 100644 index 000000000..ac16f8f00 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2022-443.txt @@ -0,0 +1,65 @@ +INFO: Seed: 2781450579 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b00000015b at pc 0x00000044132d bp 0x7ffe4b446ff0 sp 0x7ffe4b446778 +READ of size 1 at 0x60b00000015b thread T0 + #0 0x44132c in printf_common(void*, char const*, __va_list_tag*) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 + #1 0x442b80 in __interceptor_snprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1736:1 + #2 0x566b14 in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c:624:7 + #3 0x566b14 in ndpi_search_http_tcp /src/ndpi/src/lib/protocols/http.c:866:3 + #4 0x50bd1f in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4157:4 + #5 0x514ec6 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4907:3 + #6 0x4eed8e in packet_processing /src/ndpi/example/reader_util.c:1422:33 + #7 0x4eed8e in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #8 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #9 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #10 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #11 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #12 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #13 0x7f080e97f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #14 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x60b00000015b is located 0 bytes to the right of 107-byte region [0x60b0000000f0,0x60b00000015b) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f080e97f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 in printf_common(void*, char const*, __va_list_tag*) +Shadow bytes around the buggy address: + 0x0c167fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff8000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c167fff8010: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00 +=>0x0c167fff8020: 00 00 00 00 00 00 00 00 00 00 00[03]fa fa fa fa + 0x0c167fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2022-447.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2022-447.txt new file mode 100644 index 000000000..663ffb067 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2022-447.txt @@ -0,0 +1,65 @@ +INFO: Seed: 2783692000 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000183cc5 at pc 0x00000044132d bp 0x7ffd7ed55010 sp 0x7ffd7ed54798 +READ of size 154 at 0x611000183cc5 thread T0 + #0 0x44132c in printf_common(void*, char const*, __va_list_tag*) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 + #1 0x442b80 in __interceptor_snprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1736:1 + #2 0x566b89 in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c:628:7 + #3 0x566b89 in ndpi_search_http_tcp /src/ndpi/src/lib/protocols/http.c:866:3 + #4 0x50bd1f in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4157:4 + #5 0x514ec6 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4907:3 + #6 0x4eed8e in packet_processing /src/ndpi/example/reader_util.c:1422:33 + #7 0x4eed8e in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #8 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #9 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #10 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #11 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #12 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #13 0x7fc4caabd082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #14 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x611000183cc5 is located 0 bytes to the right of 197-byte region [0x611000183c00,0x611000183cc5) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7fc4caabd082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 in printf_common(void*, char const*, __va_list_tag*) +Shadow bytes around the buggy address: + 0x0c2280028740: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2280028750: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c2280028760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2280028770: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa + 0x0c2280028780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c2280028790: 00 00 00 00 00 00 00 00[05]fa fa fa fa fa fa fa + 0x0c22800287a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c22800287b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c22800287c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c22800287d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c22800287e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2022-481.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2022-481.txt new file mode 100644 index 000000000..942c2faca --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2022-481.txt @@ -0,0 +1,24 @@ +INFO: Seed: 2786138227 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x003538313320 (pc 0x7f8bef53a717 bp 0x7ffd9b90bc20 sp 0x7ffd9b90b3d8 T0) +==1==The signal is caused by a READ memory access. + #0 0x7f8bef53a717 (/lib/x86_64-linux-gnu/libc.so.6+0x188717) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #1 0x4359f8 in strlen /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc + #2 0x4f4636 in ndpi_strdup /src/ndpi/src/lib/ndpi_main.c:140:13 + #3 0x4e9d89 in process_ndpi_collected_info /src/ndpi/example/reader_util.c:1114:27 + #4 0x4eef5d in packet_processing /src/ndpi/example/reader_util.c:1447:4 + #5 0x4eef5d in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #6 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #7 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #8 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #9 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #10 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #11 0x7f8bef3d6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #12 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0x188717) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2022-695.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2022-695.txt new file mode 100644 index 000000000..06c649120 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2022-695.txt @@ -0,0 +1,30 @@ +INFO: Seed: 2800770684 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x000000421c84 bp 0x000000000000 sp 0x7fff23af8af0 T0) +==1==The signal is caused by a READ memory access. +==1==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x421c84 in atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t> /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81:10 + #1 0x421c84 in AtomicallySetQuarantineFlagIfAllocated /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:610:10 + #2 0x421c84 in __asan::Allocator::Deallocate(void*, unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType) /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:685:10 + #3 0x4a0b85 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:53:3 + #4 0x4e796c in free_wrapper /src/ndpi/example/reader_util.c:341:3 + #5 0x4f3f73 in ndpi_free /src/ndpi/src/lib/ndpi_main.c:108:5 + #6 0x4f3f73 in ndpi_free_flow /src/ndpi/src/lib/ndpi_main.c:6503:4 + #7 0x4e6ff1 in ndpi_free_flow_info_half /src/ndpi/example/reader_util.c:314:25 + #8 0x4e89c5 in process_ndpi_collected_info /src/ndpi/example/reader_util.c:1130:5 + #9 0x4eef5d in packet_processing /src/ndpi/example/reader_util.c:1447:4 + #10 0x4eef5d in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #11 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #12 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #13 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #14 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #15 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #16 0x7fe777399082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #17 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81:10 in atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t> +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2022-712.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2022-712.txt new file mode 100644 index 000000000..16ebb19b4 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2022-712.txt @@ -0,0 +1,62 @@ +INFO: Seed: 2788529111 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060001f4874 at pc 0x0000005654d4 bp 0x7fff5ad583a0 sp 0x7fff5ad58398 +READ of size 2 at 0x6060001f4874 thread T0 + #0 0x5654d3 in ndpi_search_florensia /src/ndpi/src/lib/protocols/florensia.c:93:37 + #1 0x50bd1f in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4157:4 + #2 0x514ec6 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4907:3 + #3 0x4eed8e in packet_processing /src/ndpi/example/reader_util.c:1422:33 + #4 0x4eed8e in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #5 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #6 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #7 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #8 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #9 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #10 0x7eff8c8e8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x6060001f4875 is located 0 bytes to the right of 53-byte region [0x6060001f4840,0x6060001f4875) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7eff8c8e8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/florensia.c:93:37 in ndpi_search_florensia +Shadow bytes around the buggy address: + 0x0c0c800368b0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c800368c0: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c800368d0: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa + 0x0c0c800368e0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c800368f0: 00 00 00 00 00 00 00 fa fa fa fa fa fd fd fd fd +=>0x0c0c80036900: fd fd fd fa fa fa fa fa 00 00 00 00 00 00[05]fa + 0x0c0c80036910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2023-1354.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2023-1354.txt new file mode 100644 index 000000000..8ce6b95f0 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2023-1354.txt @@ -0,0 +1,64 @@ +INFO: Seed: 2844032514 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x613000003461 at pc 0x00000053eb38 bp 0x7ffede268c90 sp 0x7ffede268c88 +READ of size 2 at 0x613000003461 thread T0 + #0 0x53eb37 in processClientServerHello /src/ndpi/src/lib/protocols/tls.c:931:21 + #1 0x53ff29 in processTLSBlock /src/ndpi/src/lib/protocols/tls.c:479:5 + #2 0x53f3c2 in ndpi_search_tls_udp /src/ndpi/src/lib/protocols/tls.c:649:3 + #3 0x508896 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4113:2 + #4 0x514ec6 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4907:3 + #5 0x4eed8e in packet_processing /src/ndpi/example/reader_util.c:1422:33 + #6 0x4eed8e in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #7 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #8 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #9 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #10 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #11 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #12 0x7f9e6d904082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #13 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x613000003462 is located 0 bytes to the right of 354-byte region [0x613000003300,0x613000003462) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f9e6d904082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/tls.c:931:21 in processClientServerHello +Shadow bytes around the buggy address: + 0x0c267fff8630: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c267fff8640: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c267fff8650: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa + 0x0c267fff8660: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c267fff8670: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c267fff8680: 00 00 00 00 00 00 00 00 00 00 00 00[02]fa fa fa + 0x0c267fff8690: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff86a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff86b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff86c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c267fff86d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2023-19.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2023-19.txt new file mode 100644 index 000000000..a00b38d51 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2023-19.txt @@ -0,0 +1,63 @@ +INFO: Seed: 2790927749 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060001f481d at pc 0x000000436a3d bp 0x7fffa192d2c0 sp 0x7fffa192ca68 +READ of size 22 at 0x6060001f481d thread T0 + #0 0x436a3c in strncmp /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:497:3 + #1 0x55c8b0 in ndpi_search_bittorrent /src/ndpi/src/lib/protocols/bittorrent.c:438:5 + #2 0x508896 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4113:2 + #3 0x514ec6 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4907:3 + #4 0x4eed8e in packet_processing /src/ndpi/example/reader_util.c:1422:33 + #5 0x4eed8e in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #6 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #7 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #8 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #9 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #10 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #11 0x7f6e3f656082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #12 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x6060001f481d is located 0 bytes to the right of 61-byte region [0x6060001f47e0,0x6060001f481d) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f6e3f656082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:497:3 in strncmp +Shadow bytes around the buggy address: + 0x0c0c800368b0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c800368c0: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c800368d0: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa + 0x0c0c800368e0: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c800368f0: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 +=>0x0c0c80036900: 00 00 00[05]fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c80036950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2023-573.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2023-573.txt new file mode 100644 index 000000000..15b38339c --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2023-573.txt @@ -0,0 +1,30 @@ +INFO: Seed: 2793340938 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: negative-size-param: (size=-1) + #0 0x48c03e in __interceptor_strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:471:5 + #1 0x56a50e in ndpi_http_check_content /src/ndpi/src/lib/protocols/http.c:89:11 + #2 0x56a50e in ndpi_int_http_add_connection /src/ndpi/src/lib/protocols/http.c:135:14 + #3 0x56976d in check_content_type_and_change_protocol /src/ndpi/src/lib/protocols/http.c:458:3 + #4 0x5679d1 in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c + #5 0x5679d1 in ndpi_search_http_tcp /src/ndpi/src/lib/protocols/http.c:866:3 + #6 0x50ef42 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4145:2 + #7 0x514ec6 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4907:3 + #8 0x4eed8e in packet_processing /src/ndpi/example/reader_util.c:1422:33 + #9 0x4eed8e in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #10 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #11 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #12 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #13 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #14 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #15 0x7f90d6998082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #16 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x602000045cf0 is located 0 bytes inside of 1-byte region [0x602000045cf0,0x602000045cf1) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4e7908 in malloc_wrapper /src/ndpi/example/reader_util.c:332:10 + +SUMMARY: AddressSanitizer: negative-size-param /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:471:5 in __interceptor_strncpy +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2024-1330.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2024-1330.txt new file mode 100644 index 000000000..4b93f2ccf --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2024-1330.txt @@ -0,0 +1,62 @@ +INFO: Seed: 2795849073 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6040000002b4 at pc 0x000000533614 bp 0x7ffeabd8b5c0 sp 0x7ffeabd8b5b8 +READ of size 1 at 0x6040000002b4 thread T0 + #0 0x533613 in zoom_search_again /src/ndpi/src/lib/protocols/zoom.c:14:12 + #1 0x511c3d in ndpi_process_extra_packet /src/ndpi/src/lib/ndpi_main.c:4397:9 + #2 0x513f5c in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4753:7 + #3 0x4eeb0a in packet_processing /src/ndpi/example/reader_util.c:1374:33 + #4 0x4eeb0a in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #5 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #6 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #7 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #8 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #9 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #10 0x7f4906154082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +0x6040000002b4 is located 0 bytes to the right of 36-byte region [0x604000000290,0x6040000002b4) +allocated by thread T0 here: + #0 0x4a0dc6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x4de6d5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:88:31 + #2 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f4906154082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/zoom.c:14:12 in zoom_search_again +Shadow bytes around the buggy address: + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 + 0x0c087fff8010: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 01 fa + 0x0c087fff8020: fa fa 00 00 00 00 07 fa fa fa 00 00 00 00 00 fa + 0x0c087fff8030: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x0c087fff8040: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa +=>0x0c087fff8050: fa fa 00 00 00 00[04]fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2024-552.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2024-552.txt new file mode 100644 index 000000000..819293d46 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/crashes/OSV-2024-552.txt @@ -0,0 +1,23 @@ +INFO: Seed: 2798279446 +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +AddressSanitizer:DEADLYSIGNAL +================================================================= +==1==ERROR: AddressSanitizer: SEGV on unknown address 0x6071000003bd (pc 0x0000005334d9 bp 0x7ffca205bbd0 sp 0x7ffca205b8e0 T0) +==1==The signal is caused by a READ memory access. + #0 0x5334d9 in ndpi_search_zoom /src/ndpi/src/lib/protocols/zoom.c:32:5 + #1 0x508896 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4113:2 + #2 0x514ec6 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4907:3 + #3 0x4eed8e in packet_processing /src/ndpi/example/reader_util.c:1422:33 + #4 0x4eed8e in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1863:10 + #5 0x4de707 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:90:5 + #6 0x6754fc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #7 0x667455 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #8 0x66c101 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #9 0x667122 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #10 0x7fd0655ea082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x41f98d in _start (/out/fuzz_ndpi_reader+0x41f98d) + +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ndpi/src/lib/protocols/zoom.c:32:5 in ndpi_search_zoom +==1==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/libpcap-1.9.1.tar.gz b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/libpcap-1.9.1.tar.gz new file mode 100644 index 000000000..a052b0fb6 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/libpcap-1.9.1.tar.gz differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/COMMANDS.md b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/COMMANDS.md new file mode 100644 index 000000000..afedc30e9 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/COMMANDS.md @@ -0,0 +1,121 @@ +# Original Crash Collection: ndpi fuzz_ndpi_reader + +Generated: 2026-04-24 UTC + +Benchmark: `ndpi_transplant_fuzz_ndpi_reader` +Project: `ndpi` +Fuzzer: `fuzz_ndpi_reader` +Sanitizer: `address` + +Target source commit: `5cad39f0e88c03b3cb4f78addf56e217b3d372f2` (2020-02-07) +Target-era base-runner: `gcr.io/oss-fuzz-base/base-runner@sha256:88ceb7b782d6e1e4a126bce5d751c7698493616f006b4b4f5a492f6e0ed0da3e` (2020-01, from `get_base_runner_for_date()`) + +## Semantics + +Each `OSV-*.txt` is a crash on the pristine source tree: +- **Local bugs** (already triggering at target) come from the migration + pipeline's target-commit captures, already saved in `/mnt/nas/linke/new_migrate/ndpi/ + fuzz_ndpi_reader/crash/` with a target-era runner. +- **Migration bugs** come from the same NAS crash directory, captured per-bug at + each bug's own buggy source commit by the migration pipeline with + `fuzz_helper.py collect_crash --runner-image auto` (era-matched per commit). + +This benchmark did not require any re-capture beyond the `/mnt/nas` files — all 35 +crash logs are valid ASAN / libFuzzer outputs (including the libFuzzer `deadly +signal` from `OSV-2020-242`'s `ndpi_load_domain_suffixes` assertion). + +## Bug → source commit / OSS-Fuzz commit + +| Bug | Kind | Source commit | OSS-Fuzz commit | +| --- | --- | --- | --- | +| OSV-2020-10 | local | `5cad39f0e88c` | `1cc1638224a0` | +| OSV-2020-142 | migration | `f6038c358a71` | `auto` | +| OSV-2020-1566 | local | `5cad39f0e88c` | `1cc1638224a0` | +| OSV-2020-177 | local | `5cad39f0e88c` | `1cc1638224a0` | +| OSV-2020-178 | local | `5cad39f0e88c` | `1cc1638224a0` | +| OSV-2020-18 | local | `5cad39f0e88c` | `1cc1638224a0` | +| OSV-2020-181 | local | `5cad39f0e88c` | `1cc1638224a0` | +| OSV-2020-185 | local | `5cad39f0e88c` | `1cc1638224a0` | +| OSV-2020-1884 | migration | `bb33d579714e` | `auto` | +| OSV-2020-2126 | local | `5cad39f0e88c` | `1cc1638224a0` | +| OSV-2020-236 | migration | `98d9f524f9ff` | `c3271ac0e45c` | +| OSV-2020-242 | migration | `98d9f524f9ff` | `c3271ac0e45c` | +| OSV-2020-40 | local | `5cad39f0e88c` | `1cc1638224a0` | +| OSV-2020-60 | local | `5cad39f0e88c` | `1cc1638224a0` | +| OSV-2020-67 | local | `5cad39f0e88c` | `1cc1638224a0` | +| OSV-2020-70 | migration | `493bffb3e0bd` | `auto` | +| OSV-2020-71 | migration | `f6038c358a71` | `auto` | +| OSV-2020-747 | local | `5cad39f0e88c` | `1cc1638224a0` | +| OSV-2020-806 | migration | `94bf7b0130c1` | `auto` | +| OSV-2020-821 | local | `5cad39f0e88c` | `1cc1638224a0` | +| OSV-2020-829 | local | `5cad39f0e88c` | `1cc1638224a0` | +| OSV-2020-92 | migration | `3874f0e0e029` | `auto` | +| OSV-2020-956 | local | `5cad39f0e88c` | `1cc1638224a0` | +| OSV-2022-1025 | migration | `3c0021d60365` | `auto` | +| OSV-2022-325 | local | `5cad39f0e88c` | `1cc1638224a0` | +| OSV-2022-443 | migration | `3b825fca6dc9` | `auto` | +| OSV-2022-447 | migration | `3b825fca6dc9` | `auto` | +| OSV-2022-481 | migration | `8dcaa5c0e11a` | `auto` | +| OSV-2022-695 | migration | `59a9bdeb55fb` | `auto` | +| OSV-2022-712 | migration | `30730e95e5a2` | `auto` | +| OSV-2023-1354 | migration | `5c7200f2bb76` | `auto` | +| OSV-2023-19 | migration | `edb8165ab9b7` | `auto` | +| OSV-2023-573 | migration | `abee1a2a6f1d` | `auto` | +| OSV-2024-1330 | migration | `d7d942586aae` | `auto` | +| OSV-2024-552 | migration | `aee2c81f7684` | `auto` | + +## Re-run command (any bug) + +```bash +BUILD_CSV='/home/user/oss-fuzz-build/fuzzbench/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/collect_crash_builds.csv' +OUT_DIR='/home/user/oss-fuzz-build/fuzzbench/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes' + +while IFS=$'\t' read -r bug commit; do + [ "$bug" = "bug" ] && continue + ts=$(git -C /home/user/tasks-git/ndpi log -1 --format=%ct "$commit") + /home/user/pyenv/venv/bin/python3 /home/user/oss-fuzz-for-select/script/fuzz_helper.py collect_crash \ + --commit "$commit" --build_csv "$BUILD_CSV" \ + --testcases /home/user/oss-fuzz-for-select/pocs/tmp --test_input "testcase-${bug}" \ + --runner-image auto --commit-date "$ts" \ + ndpi fuzz_ndpi_reader + cp "/home/user/oss-fuzz-build/data/crash/target_crash-${commit:0:6}-testcase-${bug}.txt" "${OUT_DIR}/${bug}.txt" +done <<'JOBS' +bug commit +OSV-2020-10 5cad39f0e88c03b3cb4f78addf56e217b3d372f2 +OSV-2020-142 f6038c358a71ab43bd1e1b53103659f62ea5adce +OSV-2020-1566 5cad39f0e88c03b3cb4f78addf56e217b3d372f2 +OSV-2020-177 5cad39f0e88c03b3cb4f78addf56e217b3d372f2 +OSV-2020-178 5cad39f0e88c03b3cb4f78addf56e217b3d372f2 +OSV-2020-18 5cad39f0e88c03b3cb4f78addf56e217b3d372f2 +OSV-2020-181 5cad39f0e88c03b3cb4f78addf56e217b3d372f2 +OSV-2020-185 5cad39f0e88c03b3cb4f78addf56e217b3d372f2 +OSV-2020-1884 bb33d579714e140650e13325c39b0d372888b717 +OSV-2020-2126 5cad39f0e88c03b3cb4f78addf56e217b3d372f2 +OSV-2020-236 98d9f524f9ff7746d0345939fe543020f8057212 +OSV-2020-242 98d9f524f9ff7746d0345939fe543020f8057212 +OSV-2020-40 5cad39f0e88c03b3cb4f78addf56e217b3d372f2 +OSV-2020-60 5cad39f0e88c03b3cb4f78addf56e217b3d372f2 +OSV-2020-67 5cad39f0e88c03b3cb4f78addf56e217b3d372f2 +OSV-2020-70 493bffb3e0bd616c2a333d563bc1dd4addec5359 +OSV-2020-71 f6038c358a71ab43bd1e1b53103659f62ea5adce +OSV-2020-747 5cad39f0e88c03b3cb4f78addf56e217b3d372f2 +OSV-2020-806 94bf7b0130c1fd447624a9a91d2d125eaac91ea7 +OSV-2020-821 5cad39f0e88c03b3cb4f78addf56e217b3d372f2 +OSV-2020-829 5cad39f0e88c03b3cb4f78addf56e217b3d372f2 +OSV-2020-92 3874f0e0e0293dd977fda31d3f50c69ebcad4463 +OSV-2020-956 5cad39f0e88c03b3cb4f78addf56e217b3d372f2 +OSV-2022-1025 3c0021d6036532a6fdff9196b7ee7a614bdbd525 +OSV-2022-325 5cad39f0e88c03b3cb4f78addf56e217b3d372f2 +OSV-2022-443 3b825fca6dc9faef47a06fc47e38450b7571e90a +OSV-2022-447 3b825fca6dc9faef47a06fc47e38450b7571e90a +OSV-2022-481 8dcaa5c0e11a7af1b529d0d657f4b37f11e8ec11 +OSV-2022-695 59a9bdeb55fb5a712b51141bfa4492a897cda5c8 +OSV-2022-712 30730e95e5a270cb70dd5509fa6e481a7ed4e074 +OSV-2023-1354 5c7200f2bb763bfcd4e0636aebb88573e97bbcf3 +OSV-2023-19 edb8165ab9b70cf8c152b6a3dfbec9c8a4853eef +OSV-2023-573 abee1a2a6f1d8375831901e49ace85eaea0650e3 +OSV-2024-1330 d7d942586aaee89968f458e95acafe260dbdda7c +OSV-2024-552 aee2c81f76842c6968e98f343adb46082eb3fb85 +JOBS +``` + diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-10.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-10.txt new file mode 100644 index 000000000..69bc7429a --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-10.txt @@ -0,0 +1,56 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2797939490 +INFO: Loaded 1 modules (23064 inline 8-bit counters): 23064 [0x55ce21fbdc60, 0x55ce21fc3678), +INFO: Loaded 1 PC tables (23064 PCs): 23064 [0x55ce21fc3678,0x55ce2201d7f8), +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-10 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7cb0e5965c00 at pc 0x55ce21c860f8 bp 0x7fff852b0010 sp 0x7fff852b0008 +READ of size 2 at 0x7cb0e5965c00 thread T0 + #0 0x55ce21c860f7 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1520:16 + #1 0x55ce21c76b96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #2 0x55ce21b1402d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55ce21afeda2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x55ce21b04c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55ce21b307a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7fa0e657d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #7 0x55ce21af7e8d in _start (/out/fuzz_ndpi_reader+0x1ffe8d) + +DEDUP_TOKEN: ndpi_workflow_process_packet--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +Address 0x7cb0e5965c00 is a wild pointer inside of access range of size 0x000000000002. +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:1520:16 in ndpi_workflow_process_packet +Shadow bytes around the buggy address: + 0x7cb0e5965980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb0e5965a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb0e5965a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb0e5965b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb0e5965b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x7cb0e5965c00:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb0e5965c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb0e5965d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb0e5965d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb0e5965e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cb0e5965e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-142.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-142.txt new file mode 100755 index 000000000..a8592ca00 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-142.txt @@ -0,0 +1,78 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1190081931 +INFO: Loaded 1 modules (19155 inline 8-bit counters): 19155 [0x55bd5da9f7c0, 0x55bd5daa4293), +INFO: Loaded 1 PC tables (19155 PCs): 19155 [0x55bd5daa4298,0x55bd5daeefc8), +/out/fuzz_ndpi_reader: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2020-142 +================================================================= +==7837==ERROR: AddressSanitizer: heap-use-after-free on address 0x7ddbfadef730 at pc 0x55bd5d80d043 bp 0x7ffcee9978f0 sp 0x7ffcee9978e8 +READ of size 1 at 0x7ddbfadef730 thread T0 + #0 0x55bd5d80d042 in ndpi_strncasestr /src/ndpi/src/lib/ndpi_main.c:5886:25 + #1 0x55bd5d84e467 in ndpi_http_check_content /src/ndpi/src/lib/protocols/http.c:133:13 + #2 0x55bd5d84d701 in ndpi_int_http_add_connection /src/ndpi/src/lib/protocols/http.c:181:14 + #3 0x55bd5d84af69 in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c:766:9 + #4 0x55bd5d84e948 in ndpi_search_http_tcp_again /src/ndpi/src/lib/protocols/http.c:78:3 + #5 0x55bd5d80111c in ndpi_process_extra_packet /src/ndpi/src/lib/ndpi_main.c:4131:9 + #6 0x55bd5d802c90 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4437:7 + #7 0x55bd5d7dfef3 in packet_processing /src/ndpi/example/reader_util.c:1401:31 + #8 0x55bd5d7de464 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1856:10 + #9 0x55bd5d7d1bc6 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #10 0x55bd5d66f05d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #11 0x55bd5d659dd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #12 0x55bd5d65fca0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #13 0x55bd5d68b7d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f2bfbc1a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #15 0x55bd5d652ebd in _start (/out/fuzz_ndpi_reader+0x1e1ebd) + +0x7ddbfadef730 is located 5424 bytes inside of 25421-byte region [0x7ddbfadee200,0x7ddbfadf454d) +freed by thread T0 here: + #0 0x55bd5d78d716 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3 + #1 0x55bd5d7d1bce in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:84:5 + #2 0x55bd5d66f05d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55bd5d659dd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x55bd5d65fca0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55bd5d68b7d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f2bfbc1a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +previously allocated by thread T0 here: + #0 0x55bd5d78d9b4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55bd5d7d1ba6 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x55bd5d66f05d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55bd5d659dd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x55bd5d65fca0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55bd5d68b7d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f2bfbc1a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-use-after-free /src/ndpi/src/lib/ndpi_main.c:5886:25 in ndpi_strncasestr +Shadow bytes around the buggy address: + 0x7ddbfadef480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7ddbfadef500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7ddbfadef580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7ddbfadef600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7ddbfadef680: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x7ddbfadef700: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd + 0x7ddbfadef780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7ddbfadef800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7ddbfadef880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7ddbfadef900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7ddbfadef980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7837==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-1566.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-1566.txt new file mode 100644 index 000000000..70200884b --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-1566.txt @@ -0,0 +1,66 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2798672579 +INFO: Loaded 1 modules (23064 inline 8-bit counters): 23064 [0x564c68e75c60, 0x564c68e7b678), +INFO: Loaded 1 PC tables (23064 PCs): 23064 [0x564c68e7b678,0x564c68ed57f8), +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1566 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b851f5e0142 at pc 0x564c68b3dfb9 bp 0x7ffc32aecf70 sp 0x7ffc32aecf68 +READ of size 1 at 0x7b851f5e0142 thread T0 + #0 0x564c68b3dfb8 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c + #1 0x564c68b2eb96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #2 0x564c689cc02d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x564c689b6da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x564c689bcc70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x564c689e87a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f45202c7082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #7 0x564c689afe8d in _start (/out/fuzz_ndpi_reader+0x1ffe8d) + +DEDUP_TOKEN: ndpi_workflow_process_packet--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +0x7b851f5e0142 is located 2 bytes after 48-byte region [0x7b851f5e0110,0x7b851f5e0140) +allocated by thread T0 here: + #0 0x564c68aea984 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x564c68b2eb76 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x564c689cc02d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x564c689b6da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x564c689bcc70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x564c689e87a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f45202c7082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c in ndpi_workflow_process_packet +Shadow bytes around the buggy address: + 0x7b851f5dfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b851f5dff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b851f5dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b851f5e0000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 05 + 0x7b851f5e0080: fa fa 00 00 00 00 01 fa fa fa 00 00 00 00 07 fa +=>0x7b851f5e0100: fa fa 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa + 0x7b851f5e0180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b851f5e0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b851f5e0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b851f5e0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b851f5e0380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-177.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-177.txt new file mode 100644 index 000000000..86630ea52 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-177.txt @@ -0,0 +1,68 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2799294431 +INFO: Loaded 1 modules (23064 inline 8-bit counters): 23064 [0x56438fd8ac60, 0x56438fd90678), +INFO: Loaded 1 PC tables (23064 PCs): 23064 [0x56438fd90678,0x56438fdea7f8), +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-177 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7bf7e43e09bb at pc 0x56438fa52ab0 bp 0x7ffe62df6890 sp 0x7ffe62df6888 +READ of size 4 at 0x7bf7e43e09bb thread T0 + #0 0x56438fa52aaf in get_ndpi_flow_info6 /src/ndpi/example/reader_util.c:917:52 + #1 0x56438fa52aaf in packet_processing /src/ndpi/example/reader_util.c:1184:12 + #2 0x56438fa52aaf in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1762:10 + #3 0x56438fa43b96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #4 0x56438f8e102d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x56438f8cbda2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x56438f8d1c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x56438f8fd7a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fb7e51a2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x56438f8c4e8d in _start (/out/fuzz_ndpi_reader+0x1ffe8d) + +DEDUP_TOKEN: get_ndpi_flow_info6--packet_processing--ndpi_workflow_process_packet +0x7bf7e43e09bb is located 0 bytes after 43-byte region [0x7bf7e43e0990,0x7bf7e43e09bb) +allocated by thread T0 here: + #0 0x56438f9ff984 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x56438fa43b76 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x56438f8e102d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x56438f8cbda2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x56438f8d1c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x56438f8fd7a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7fb7e51a2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:917:52 in get_ndpi_flow_info6 +Shadow bytes around the buggy address: + 0x7bf7e43e0700: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7bf7e43e0780: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7bf7e43e0800: fa fa 00 00 00 00 00 fa fa fa fd fd fd fd fd fd + 0x7bf7e43e0880: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd + 0x7bf7e43e0900: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd +=>0x7bf7e43e0980: fa fa 00 00 00 00 00[03]fa fa fa fa fa fa fa fa + 0x7bf7e43e0a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bf7e43e0a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bf7e43e0b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bf7e43e0b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bf7e43e0c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-178.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-178.txt new file mode 100644 index 000000000..fa648c562 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-178.txt @@ -0,0 +1,72 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2800068540 +INFO: Loaded 1 modules (23064 inline 8-bit counters): 23064 [0x558454e29c60, 0x558454e2f678), +INFO: Loaded 1 PC tables (23064 PCs): 23064 [0x558454e2f678,0x558454e897f8), +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-178 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c3448fe0152 at pc 0x558454b5558d bp 0x7ffe4fe3b940 sp 0x7ffe4fe3b938 +READ of size 4 at 0x7c3448fe0152 thread T0 + #0 0x558454b5558c in concat_hash_string /src/ndpi/src/lib/protocols/ssh.c:99:19 + #1 0x558454b54072 in ndpi_search_ssh_tcp /src/ndpi/src/lib/protocols/ssh.c:308:10 + #2 0x558454b557d8 in search_ssh_again /src/ndpi/src/lib/protocols/ssh.c:64:3 + #3 0x558454b1f499 in ndpi_process_extra_packet /src/ndpi/src/lib/ndpi_main.c:4369:9 + #4 0x558454b1f499 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4725:7 + #5 0x558454af138b in packet_processing /src/ndpi/example/reader_util.c:1339:31 + #6 0x558454af138b in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1762:10 + #7 0x558454ae2b96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #8 0x55845498002d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #9 0x55845496ada2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #10 0x558454970c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #11 0x55845499c7a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f8449cb2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x558454963e8d in _start (/out/fuzz_ndpi_reader+0x1ffe8d) + +DEDUP_TOKEN: concat_hash_string--ndpi_search_ssh_tcp--search_ssh_again +0x7c3448fe0154 is located 0 bytes after 100-byte region [0x7c3448fe00f0,0x7c3448fe0154) +allocated by thread T0 here: + #0 0x558454a9e984 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x558454ae2b76 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x55845498002d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55845496ada2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x558454970c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55845499c7a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f8449cb2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/ssh.c:99:19 in concat_hash_string +Shadow bytes around the buggy address: + 0x7c3448fdfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c3448fdff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c3448fdff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c3448fe0000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x7c3448fe0080: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00 +=>0x7c3448fe0100: 00 00 00 00 00 00 00 00 00 00[04]fa fa fa fa fa + 0x7c3448fe0180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c3448fe0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c3448fe0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c3448fe0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c3448fe0380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-18.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-18.txt new file mode 100644 index 000000000..dbdb014ec --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-18.txt @@ -0,0 +1,72 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2800679064 +INFO: Loaded 1 modules (23064 inline 8-bit counters): 23064 [0x55f62e70cc60, 0x55f62e712678), +INFO: Loaded 1 PC tables (23064 PCs): 23064 [0x55f62e712678,0x55f62e76c7f8), +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-18 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c6ab25e0322 at pc 0x55f62e2fd580 bp 0x7ffed0a872b0 sp 0x7ffed0a86a58 +READ of size 8 at 0x7c6ab25e0322 thread T0 + #0 0x55f62e2fd57f in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:849:7 + #1 0x55f62e2fd85c in memcmp /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:880:10 + #2 0x55f62e4470f6 in ndpi_search_openvpn /src/ndpi/src/lib/protocols/openvpn.c:125:12 + #3 0x55f62e3f6c41 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4085:2 + #4 0x55f62e402e69 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4879:3 + #5 0x55f62e3d438b in packet_processing /src/ndpi/example/reader_util.c:1339:31 + #6 0x55f62e3d438b in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1762:10 + #7 0x55f62e3c5b96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #8 0x55f62e26302d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #9 0x55f62e24dda2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #10 0x55f62e253c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #11 0x55f62e27f7a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7fbab32e0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x55f62e246e8d in _start (/out/fuzz_ndpi_reader+0x1ffe8d) + +DEDUP_TOKEN: MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long)--___interceptor_memcmp--ndpi_search_openvpn +0x7c6ab25e0322 is located 106 bytes after 104-byte region [0x7c6ab25e0250,0x7c6ab25e02b8) +allocated by thread T0 here: + #0 0x55f62e381984 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55f62e3c5b76 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x55f62e26302d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55f62e24dda2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x55f62e253c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55f62e27f7a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7fbab32e0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/openvpn.c:125:12 in ndpi_search_openvpn +Shadow bytes around the buggy address: + 0x7c6ab25e0080: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fd fd + 0x7c6ab25e0100: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa + 0x7c6ab25e0180: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd + 0x7c6ab25e0200: fd fa fa fa fa fa fa fa fa fa 00 00 00 00 00 00 + 0x7c6ab25e0280: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa +=>0x7c6ab25e0300: fa fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa + 0x7c6ab25e0380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c6ab25e0400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c6ab25e0480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c6ab25e0500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c6ab25e0580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-181.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-181.txt new file mode 100644 index 000000000..575ec7175 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-181.txt @@ -0,0 +1,68 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2801287175 +INFO: Loaded 1 modules (23064 inline 8-bit counters): 23064 [0x55ef6a689c60, 0x55ef6a68f678), +INFO: Loaded 1 PC tables (23064 PCs): 23064 [0x55ef6a68f678,0x55ef6a6e97f8), +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-181 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7be4b0bd475b at pc 0x55ef6a3544a1 bp 0x7ffcc34f6ff0 sp 0x7ffcc34f6fe8 +READ of size 2 at 0x7be4b0bd475b thread T0 + #0 0x55ef6a3544a0 in get_ndpi_flow_info /src/ndpi/example/reader_util.c:703:47 + #1 0x55ef6a34f611 in packet_processing /src/ndpi/example/reader_util.c:1176:12 + #2 0x55ef6a34f611 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1762:10 + #3 0x55ef6a342b96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #4 0x55ef6a1e002d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x55ef6a1cada2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x55ef6a1d0c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x55ef6a1fc7a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f84b16c1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x55ef6a1c3e8d in _start (/out/fuzz_ndpi_reader+0x1ffe8d) + +DEDUP_TOKEN: get_ndpi_flow_info--packet_processing--ndpi_workflow_process_packet +0x7be4b0bd475b is located 0 bytes after 59-byte region [0x7be4b0bd4720,0x7be4b0bd475b) +allocated by thread T0 here: + #0 0x55ef6a2fe984 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55ef6a342b76 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x55ef6a1e002d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55ef6a1cada2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x55ef6a1d0c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55ef6a1fc7a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f84b16c1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:703:47 in get_ndpi_flow_info +Shadow bytes around the buggy address: + 0x7be4b0bd4480: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x7be4b0bd4500: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa + 0x7be4b0bd4580: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x7be4b0bd4600: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x7be4b0bd4680: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa +=>0x7be4b0bd4700: fa fa fa fa 00 00 00 00 00 00 00[03]fa fa fa fa + 0x7be4b0bd4780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7be4b0bd4800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7be4b0bd4880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7be4b0bd4900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7be4b0bd4980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-185.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-185.txt new file mode 100644 index 000000000..c02b63d77 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-185.txt @@ -0,0 +1,70 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2801755371 +INFO: Loaded 1 modules (23064 inline 8-bit counters): 23064 [0x5590d61b1c60, 0x5590d61b7678), +INFO: Loaded 1 PC tables (23064 PCs): 23064 [0x5590d61b7678,0x5590d62117f8), +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-185 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c4702763f45 at pc 0x5590d5effcd0 bp 0x7ffee9507690 sp 0x7ffee9507688 +READ of size 1 at 0x7c4702763f45 thread T0 + #0 0x5590d5effccf in ndpi_search_kerberos /src/ndpi/src/lib/protocols/kerberos.c:246:30 + #1 0x5590d5e9c970 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4072:7 + #2 0x5590d5ea7e69 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4879:3 + #3 0x5590d5e7938b in packet_processing /src/ndpi/example/reader_util.c:1339:31 + #4 0x5590d5e7938b in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1762:10 + #5 0x5590d5e6ab96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #6 0x5590d5d0802d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x5590d5cf2da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x5590d5cf8c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x5590d5d247a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f37032a4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x5590d5cebe8d in _start (/out/fuzz_ndpi_reader+0x1ffe8d) + +DEDUP_TOKEN: ndpi_search_kerberos--check_ndpi_udp_flow_func--ndpi_detection_process_packet +0x7c4702763f45 is located 0 bytes after 197-byte region [0x7c4702763e80,0x7c4702763f45) +allocated by thread T0 here: + #0 0x5590d5e26984 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x5590d5e6ab76 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x5590d5d0802d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x5590d5cf2da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x5590d5cf8c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x5590d5d247a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f37032a4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/kerberos.c:246:30 in ndpi_search_kerberos +Shadow bytes around the buggy address: + 0x7c4702763c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c4702763d00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x7c4702763d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c4702763e00: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa + 0x7c4702763e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7c4702763f00: 00 00 00 00 00 00 00 00[05]fa fa fa fa fa fa fa + 0x7c4702763f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c4702764000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c4702764080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c4702764100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c4702764180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-1884.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-1884.txt new file mode 100755 index 000000000..6a32538b2 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-1884.txt @@ -0,0 +1,32 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 974296660 +INFO: Loaded 1 modules (19419 inline 8-bit counters): 19419 [0x559d95940540, 0x559d9594511b), +INFO: Loaded 1 PC tables (19419 PCs): 19419 [0x559d95945120,0x559d95990ed0), +/out/fuzz_ndpi_reader: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2020-1884 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==7643==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x559d9563e800 bp 0x7fffadf903f0 sp 0x7fffadf8fba8 T0) +==7643==The signal is caused by a READ memory access. +==7643==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x559d9563e800 in __sanitizer::internal_strlen(char const*) /src/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_libc.cpp:176:10 + #1 0x559d9560bf9b in strdup /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:592:17 + #2 0x559d9567371e in process_ndpi_collected_info /src/ndpi/example/reader_util.c:1177:36 + #3 0x559d95678745 in packet_processing /src/ndpi/example/reader_util.c:1531:2 + #4 0x559d956769b7 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1964:10 + #5 0x559d95669bea in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:89:2 + #6 0x559d9550708d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x559d954f1e02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x559d954f7cd0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x559d95523802 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f4dd9752082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x559d954eaeed in _start (/out/fuzz_ndpi_reader+0x1e6eed) + +==7643==Register values: +rax = 0xffffffffffffffff rbx = 0x2020202020202020 rcx = 0x0000000000000000 rdx = 0x0000000000000001 +rdi = 0x2020202020202020 rsi = 0x0000000000000208 rbp = 0x00007fffadf903f0 rsp = 0x00007fffadf8fba8 + r8 = 0x0000559d95a69000 r9 = 0x00000fb23b1344b0 r10 = 0x0000000000000000 r11 = 0x00007d1dd89e0d09 +r12 = 0x00007d1dd89e0a80 r13 = 0x0000000000000000 r14 = 0x00007d1dd89e0a80 r15 = 0x00000fb1bb13c424 +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ndpi/example/reader_util.c:1177:36 in process_ndpi_collected_info +==7643==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-2126.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-2126.txt new file mode 100644 index 000000000..e94259ba3 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-2126.txt @@ -0,0 +1,66 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2802737964 +INFO: Loaded 1 modules (23064 inline 8-bit counters): 23064 [0x55637542bc60, 0x556375431678), +INFO: Loaded 1 PC tables (23064 PCs): 23064 [0x556375431678,0x55637548b7f8), +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-2126 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c528edd475a at pc 0x5563750f3fb9 bp 0x7ffd354de2f0 sp 0x7ffd354de2e8 +READ of size 1 at 0x7c528edd475a thread T0 + #0 0x5563750f3fb8 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c + #1 0x5563750e4b96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #2 0x556374f8202d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x556374f6cda2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x556374f72c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x556374f9e7a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7ff28f96c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #7 0x556374f65e8d in _start (/out/fuzz_ndpi_reader+0x1ffe8d) + +DEDUP_TOKEN: ndpi_workflow_process_packet--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +0x7c528edd475a is located 0 bytes after 58-byte region [0x7c528edd4720,0x7c528edd475a) +allocated by thread T0 here: + #0 0x5563750a0984 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x5563750e4b76 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x556374f8202d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x556374f6cda2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x556374f72c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x556374f9e7a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7ff28f96c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c in ndpi_workflow_process_packet +Shadow bytes around the buggy address: + 0x7c528edd4480: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x7c528edd4500: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa + 0x7c528edd4580: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x7c528edd4600: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x7c528edd4680: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa +=>0x7c528edd4700: fa fa fa fa 00 00 00 00 00 00 00[02]fa fa fa fa + 0x7c528edd4780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c528edd4800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c528edd4880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c528edd4900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c528edd4980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-236.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-236.txt new file mode 100755 index 000000000..93a818fbf --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-236.txt @@ -0,0 +1,63 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2055097343 +INFO: Loaded 1 modules (18520 inline 8-bit counters): 18520 [0x563aea87cfa0, 0x563aea8817f8), +INFO: Loaded 1 PC tables (18520 PCs): 18520 [0x563aea8817f8,0x563aea8c9d78), +/out/fuzz_ndpi_reader: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2020-236 +================================================================= +==7766==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b43e8be5457 at pc 0x563aea5b6966 bp 0x7ffe857d0e50 sp 0x7ffe857d0e48 +READ of size 4 at 0x7b43e8be5457 thread T0 + #0 0x563aea5b6965 in get_ndpi_flow_info6 /src/ndpi/example/reader_util.c:915:15 + #1 0x563aea5b1f0e in packet_processing /src/ndpi/example/reader_util.c:1164:12 + #2 0x563aea5b17d4 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1737:10 + #3 0x563aea5a5bb6 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:82:9 + #4 0x563aea44304d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x563aea42ddc2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x563aea433c90 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x563aea45f7c2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f13e9a33082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x563aea426ead in _start (/out/fuzz_ndpi_reader+0x1e4ead) + +0x7b43e8be5457 is located 2 bytes after 21-byte region [0x7b43e8be5440,0x7b43e8be5455) +allocated by thread T0 here: + #0 0x563aea5619a4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x563aea5a5b96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:80:35 + #2 0x563aea44304d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x563aea42ddc2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x563aea433c90 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x563aea45f7c2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f13e9a33082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:915:15 in get_ndpi_flow_info6 +Shadow bytes around the buggy address: + 0x7b43e8be5180: 02 fa fa fa 00 00 03 fa fa fa 00 00 02 fa fa fa + 0x7b43e8be5200: 00 00 01 fa fa fa 00 00 00 06 fa fa 00 00 01 fa + 0x7b43e8be5280: fa fa 00 00 01 fa fa fa 00 00 00 06 fa fa 00 00 + 0x7b43e8be5300: 01 fa fa fa 00 00 01 fa fa fa 00 00 03 fa fa fa + 0x7b43e8be5380: 00 00 00 fa fa fa 00 00 01 fa fa fa 00 00 02 fa +=>0x7b43e8be5400: fa fa 00 00 06 fa fa fa 00 00[05]fa fa fa fa fa + 0x7b43e8be5480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b43e8be5500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b43e8be5580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b43e8be5600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b43e8be5680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7766==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-242.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-242.txt new file mode 100755 index 000000000..262aa9e27 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-242.txt @@ -0,0 +1,62 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1518567014 +INFO: Loaded 1 modules (20349 inline 8-bit counters): 20349 [0xbc5c00, 0xbcab7d), +INFO: Loaded 1 PC tables (20349 PCs): 20349 [0xbcab80,0xc1a350), +/out/fuzz_ndpi_reader: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2020-242 +================================================================= +==7806==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000045cfc at pc 0x0000005604ec bp 0x7ffd02565090 sp 0x7ffd02565088 +READ of size 2 at 0x602000045cfc thread T0 + #0 0x5604eb in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1457:13 + #1 0x5541a7 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:82:9 + #2 0x458383 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_ndpi_reader+0x458383) + #3 0x443c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #4 0x44985e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_ndpi_reader+0x44985e) + #5 0x472ff2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f20469e883f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + #7 0x41eef8 in _start (/out/fuzz_ndpi_reader+0x41eef8) + +0x602000045cfc is located 11 bytes to the right of 1-byte region [0x602000045cf0,0x602000045cf1) +allocated by thread T0 here: + #0 0x520cbd in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x554176 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:80:35 + #2 0x458383 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_ndpi_reader+0x458383) + #3 0x443c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #4 0x44985e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_ndpi_reader+0x44985e) + #5 0x472ff2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f20469e883f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:1457:13 in ndpi_workflow_process_packet +Shadow bytes around the buggy address: + 0x0c0480000b40: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000b50: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000b60: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000b70: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000b80: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 +=>0x0c0480000b90: fa fa 00 04 fa fa 00 04 fa fa 00 00 fa fa 01[fa] + 0x0c0480000ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000bb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000bc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000bd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000be0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==7806==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-40.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-40.txt new file mode 100644 index 000000000..41fd90ce6 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-40.txt @@ -0,0 +1,66 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2803521249 +INFO: Loaded 1 modules (23064 inline 8-bit counters): 23064 [0x55ea105d2c60, 0x55ea105d8678), +INFO: Loaded 1 PC tables (23064 PCs): 23064 [0x55ea105d8678,0x55ea106327f8), +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-40 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b9bcb5e013d at pc 0x55ea1029b0b4 bp 0x7ffc790beed0 sp 0x7ffc790beec8 +READ of size 2 at 0x7b9bcb5e013d thread T0 + #0 0x55ea1029b0b3 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1671:23 + #1 0x55ea1028bb96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #2 0x55ea1012902d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55ea10113da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x55ea10119c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55ea101457a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f5bcc3ee082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #7 0x55ea1010ce8d in _start (/out/fuzz_ndpi_reader+0x1ffe8d) + +DEDUP_TOKEN: ndpi_workflow_process_packet--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +0x7b9bcb5e013d is located 0 bytes after 45-byte region [0x7b9bcb5e0110,0x7b9bcb5e013d) +allocated by thread T0 here: + #0 0x55ea10247984 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55ea1028bb76 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x55ea1012902d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55ea10113da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x55ea10119c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55ea101457a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f5bcc3ee082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:1671:23 in ndpi_workflow_process_packet +Shadow bytes around the buggy address: + 0x7b9bcb5dfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b9bcb5dff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b9bcb5dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b9bcb5e0000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 05 + 0x7b9bcb5e0080: fa fa 00 00 00 00 01 fa fa fa 00 00 00 00 07 fa +=>0x7b9bcb5e0100: fa fa 00 00 00 00 00[05]fa fa fa fa fa fa fa fa + 0x7b9bcb5e0180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b9bcb5e0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b9bcb5e0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b9bcb5e0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b9bcb5e0380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-60.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-60.txt new file mode 100644 index 000000000..105872eab --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-60.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2804012684 +INFO: Loaded 1 modules (23064 inline 8-bit counters): 23064 [0x55fc0620dc60, 0x55fc06213678), +INFO: Loaded 1 PC tables (23064 PCs): 23064 [0x55fc06213678,0x55fc0626d7f8), +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-60 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c3568fe013d at pc 0x55fc05ed8458 bp 0x7ffc5ab96ef0 sp 0x7ffc5ab96ee8 +READ of size 2 at 0x7c3568fe013d thread T0 + #0 0x55fc05ed8457 in get_ndpi_flow_info /src/ndpi/example/reader_util.c:703:14 + #1 0x55fc05ed3947 in get_ndpi_flow_info6 /src/ndpi/example/reader_util.c:926:10 + #2 0x55fc05ed3947 in packet_processing /src/ndpi/example/reader_util.c:1184:12 + #3 0x55fc05ed3947 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1762:10 + #4 0x55fc05ec6b96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #5 0x55fc05d6402d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #6 0x55fc05d4eda2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #7 0x55fc05d54c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #8 0x55fc05d807a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7ff569d9f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x55fc05d47e8d in _start (/out/fuzz_ndpi_reader+0x1ffe8d) + +DEDUP_TOKEN: get_ndpi_flow_info--get_ndpi_flow_info6--packet_processing +0x7c3568fe013d is located 0 bytes after 45-byte region [0x7c3568fe0110,0x7c3568fe013d) +allocated by thread T0 here: + #0 0x55fc05e82984 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55fc05ec6b76 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x55fc05d6402d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55fc05d4eda2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x55fc05d54c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55fc05d807a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7ff569d9f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:703:14 in get_ndpi_flow_info +Shadow bytes around the buggy address: + 0x7c3568fdfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c3568fdff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c3568fdff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c3568fe0000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 05 + 0x7c3568fe0080: fa fa 00 00 00 00 01 fa fa fa 00 00 00 00 07 fa +=>0x7c3568fe0100: fa fa 00 00 00 00 00[05]fa fa fa fa fa fa fa fa + 0x7c3568fe0180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c3568fe0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c3568fe0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c3568fe0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c3568fe0380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-67.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-67.txt new file mode 100644 index 000000000..3dbb89b70 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-67.txt @@ -0,0 +1,66 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2804937507 +INFO: Loaded 1 modules (23064 inline 8-bit counters): 23064 [0x55b5270cac60, 0x55b5270d0678), +INFO: Loaded 1 PC tables (23064 PCs): 23064 [0x55b5270d0678,0x55b52712a7f8), +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-67 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b95727d4756 at pc 0x55b526d9304c bp 0x7ffe95152510 sp 0x7ffe95152508 +READ of size 2 at 0x7b95727d4756 thread T0 + #0 0x55b526d9304b in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1701:32 + #1 0x55b526d83b96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #2 0x55b526c2102d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55b526c0bda2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x55b526c11c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55b526c3d7a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f35733f8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #7 0x55b526c04e8d in _start (/out/fuzz_ndpi_reader+0x1ffe8d) + +DEDUP_TOKEN: ndpi_workflow_process_packet--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +0x7b95727d4757 is located 0 bytes after 55-byte region [0x7b95727d4720,0x7b95727d4757) +allocated by thread T0 here: + #0 0x55b526d3f984 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55b526d83b76 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x55b526c2102d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55b526c0bda2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x55b526c11c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55b526c3d7a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f35733f8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:1701:32 in ndpi_workflow_process_packet +Shadow bytes around the buggy address: + 0x7b95727d4480: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x7b95727d4500: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa + 0x7b95727d4580: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x7b95727d4600: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x7b95727d4680: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa +=>0x7b95727d4700: fa fa fa fa 00 00 00 00 00 00[07]fa fa fa fa fa + 0x7b95727d4780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b95727d4800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b95727d4880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b95727d4900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b95727d4980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-70.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-70.txt new file mode 100755 index 000000000..2ae0b6678 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-70.txt @@ -0,0 +1,62 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 941356985 +INFO: Loaded 1 modules (19131 inline 8-bit counters): 19131 [0x562bc5b29260, 0x562bc5b2dd1b), +INFO: Loaded 1 PC tables (19131 PCs): 19131 [0x562bc5b2dd20,0x562bc5b788d0), +/out/fuzz_ndpi_reader: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2020-70 +================================================================= +==7838==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b7d703e013d at pc 0x562bc587b21f bp 0x7fffd95d1e10 sp 0x7fffd95d1e08 +READ of size 1 at 0x7b7d703e013d thread T0 + #0 0x562bc587b21e in ndpi_handle_ipv6_extension_headers /src/ndpi/src/lib/ndpi_main.c:3677:16 + #1 0x562bc585f493 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1705:8 + #2 0x562bc5853bb6 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #3 0x562bc56f104d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #4 0x562bc56dbdc2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #5 0x562bc56e1c90 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #6 0x562bc570d7c2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #7 0x7f3d71114082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #8 0x562bc56d4ead in _start (/out/fuzz_ndpi_reader+0x1e9ead) + +0x7b7d703e013d is located 0 bytes after 45-byte region [0x7b7d703e0110,0x7b7d703e013d) +allocated by thread T0 here: + #0 0x562bc580f9a4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x562bc5853b96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x562bc56f104d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x562bc56dbdc2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x562bc56e1c90 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x562bc570d7c2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f3d71114082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/ndpi_main.c:3677:16 in ndpi_handle_ipv6_extension_headers +Shadow bytes around the buggy address: + 0x7b7d703dfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b7d703dff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b7d703dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b7d703e0000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 05 + 0x7b7d703e0080: fa fa 00 00 00 00 01 fa fa fa 00 00 00 00 07 fa +=>0x7b7d703e0100: fa fa 00 00 00 00 00[05]fa fa fa fa fa fa fa fa + 0x7b7d703e0180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b7d703e0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b7d703e0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b7d703e0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b7d703e0380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7838==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-71.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-71.txt new file mode 100755 index 000000000..3155531c5 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-71.txt @@ -0,0 +1,68 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1045662401 +INFO: Loaded 1 modules (19155 inline 8-bit counters): 19155 [0x564e61da17c0, 0x564e61da6293), +INFO: Loaded 1 PC tables (19155 PCs): 19155 [0x564e61da6298,0x564e61df0fc8), +/out/fuzz_ndpi_reader: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2020-71 +================================================================= +==7837==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7bdc731e00a2 at pc 0x564e61a8d65b bp 0x7fff025cb810 sp 0x7fff025cafd0 +READ of size 8 at 0x7bdc731e00a2 thread T0 + #0 0x564e61a8d65a in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x564e61b0829a in ndpi_parse_packet_line_info /src/ndpi/src/lib/ndpi_main.c:4875:4 + #2 0x564e61b3f942 in ndpi_check_steam_http /src/ndpi/src/lib/protocols/steam.c:40:3 + #3 0x564e61b3e844 in ndpi_search_steam /src/ndpi/src/lib/protocols/steam.c:280:5 + #4 0x564e61afff81 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:3887:4 + #5 0x564e61b05cac in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4587:3 + #6 0x564e61ae1ef3 in packet_processing /src/ndpi/example/reader_util.c:1401:31 + #7 0x564e61ae0464 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1856:10 + #8 0x564e61ad3bc6 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #9 0x564e6197105d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #10 0x564e6195bdd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #11 0x564e61961ca0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #12 0x564e6198d7d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f2c73f61082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #14 0x564e61954ebd in _start (/out/fuzz_ndpi_reader+0x1e1ebd) + +0x7bdc731e00a2 is located 0 bytes after 98-byte region [0x7bdc731e0040,0x7bdc731e00a2) +allocated by thread T0 here: + #0 0x564e61a8f9b4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x564e61ad3ba6 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x564e6197105d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x564e6195bdd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x564e61961ca0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x564e6198d7d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f2c73f61082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/ndpi_main.c:4875:4 in ndpi_parse_packet_line_info +Shadow bytes around the buggy address: + 0x7bdc731dfe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7bdc731dfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7bdc731dff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7bdc731dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7bdc731e0000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 +=>0x7bdc731e0080: 00 00 00 00[02]fa fa fa fa fa fa fa fa fa fa fa + 0x7bdc731e0100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bdc731e0180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bdc731e0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bdc731e0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bdc731e0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7837==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-747.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-747.txt new file mode 100644 index 000000000..0b41fd9f1 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-747.txt @@ -0,0 +1,84 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2805539286 +INFO: Loaded 1 modules (23064 inline 8-bit counters): 23064 [0x5616faa11c60, 0x5616faa17678), +INFO: Loaded 1 PC tables (23064 PCs): 23064 [0x5616faa17678,0x5616faa717f8), +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-747 +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x7e2dcddf02df at pc 0x5616fa66da2a bp 0x7ffd1399bbd0 sp 0x7ffd1399b388 +READ of size 2 at 0x7e2dcddf02df thread T0 + #0 0x5616fa66da29 in strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:630:5 + #1 0x5616fa75409a in check_content_type_and_change_protocol /src/ndpi/src/lib/protocols/http.c:342:7 + #2 0x5616fa752c13 in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c:686:9 + #3 0x5616fa752c13 in ndpi_search_http_tcp /src/ndpi/src/lib/protocols/http.c:832:3 + #4 0x5616fa755b28 in ndpi_search_http_tcp_again /src/ndpi/src/lib/protocols/http.c:38:3 + #5 0x5616fa707499 in ndpi_process_extra_packet /src/ndpi/src/lib/ndpi_main.c:4369:9 + #6 0x5616fa707499 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4725:7 + #7 0x5616fa6d938b in packet_processing /src/ndpi/example/reader_util.c:1339:31 + #8 0x5616fa6d938b in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1762:10 + #9 0x5616fa6cab96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #10 0x5616fa56802d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #11 0x5616fa552da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #12 0x5616fa558c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #13 0x5616fa5847a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f7dceb26082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #15 0x5616fa54be8d in _start (/out/fuzz_ndpi_reader+0x1ffe8d) + +DEDUP_TOKEN: ___interceptor_strncpy--check_content_type_and_change_protocol--ndpi_check_http_tcp +0x7e2dcddf02df is located 8415 bytes inside of 25443-byte region [0x7e2dcddee200,0x7e2dcddf4563) +freed by thread T0 here: + #0 0x5616fa6866e6 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3 + #1 0x5616fa6cab9e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:84:5 + #2 0x5616fa56802d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x5616fa552da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x5616fa558c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x5616fa5847a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f7dceb26082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_free--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +previously allocated by thread T0 here: + #0 0x5616fa686984 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x5616fa6cab76 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x5616fa56802d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x5616fa552da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x5616fa558c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x5616fa5847a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f7dceb26082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-use-after-free /src/ndpi/src/lib/protocols/http.c:342:7 in check_content_type_and_change_protocol +Shadow bytes around the buggy address: + 0x7e2dcddf0000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e2dcddf0080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e2dcddf0100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e2dcddf0180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e2dcddf0200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x7e2dcddf0280: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd + 0x7e2dcddf0300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e2dcddf0380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e2dcddf0400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e2dcddf0480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e2dcddf0500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-806.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-806.txt new file mode 100755 index 000000000..df31e7b6c --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-806.txt @@ -0,0 +1,32 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3264806279 +INFO: Loaded 1 modules (18895 inline 8-bit counters): 18895 [0x5569e635c980, 0x5569e636134f), +INFO: Loaded 1 PC tables (18895 PCs): 18895 [0x5569e6361350,0x5569e63ab040), +/out/fuzz_ndpi_reader: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2020-806 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==7487==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x5569e60677e0 bp 0x7fff34bf8f10 sp 0x7fff34bf86c8 T0) +==7487==The signal is caused by a READ memory access. +==7487==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x5569e60677e0 in __sanitizer::internal_strlen(char const*) /src/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_libc.cpp:176:10 + #1 0x5569e6034f7b in strdup /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:592:17 + #2 0x5569e609c55c in process_ndpi_collected_info /src/ndpi/example/reader_util.c:1165:36 + #3 0x5569e60a14bc in packet_processing /src/ndpi/example/reader_util.c:1506:2 + #4 0x5569e609f737 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1936:10 + #5 0x5569e6092bb5 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:86:5 + #6 0x5569e5f3006d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x5569e5f1ade2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x5569e5f20cb0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x5569e5f4c7e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7ff305f4e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x5569e5f13ecd in _start (/out/fuzz_ndpi_reader+0x1dfecd) + +==7487==Register values: +rax = 0xffffffffffffffff rbx = 0x2020202020202020 rcx = 0x0000000000000000 rdx = 0x0000000000000001 +rdi = 0x2020202020202020 rsi = 0x00000000000005e8 rbp = 0x00007fff34bf8f10 rsp = 0x00007fff34bf86c8 + r8 = 0x00005569e647fc00 r9 = 0x00000fc6e0a344b0 r10 = 0x0000000000000000 r11 = 0x00007dc3051e0cf1 +r12 = 0x00007dc3051e0a80 r13 = 0x0000000000000000 r14 = 0x00007dc3051e0a80 r15 = 0x00000fc660a3c424 +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ndpi/example/reader_util.c:1165:36 in process_ndpi_collected_info +==7487==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-821.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-821.txt new file mode 100644 index 000000000..3bdad6933 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-821.txt @@ -0,0 +1,66 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2806239718 +INFO: Loaded 1 modules (23064 inline 8-bit counters): 23064 [0x55d8cad93c60, 0x55d8cad99678), +INFO: Loaded 1 PC tables (23064 PCs): 23064 [0x55d8cad99678,0x55d8cadf37f8), +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-821 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7bd1761e013e at pc 0x55d8caa5c10d bp 0x7ffc344d8610 sp 0x7ffc344d8608 +READ of size 1 at 0x7bd1761e013e thread T0 + #0 0x55d8caa5c10c in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1532:13 + #1 0x55d8caa4cb96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #2 0x55d8ca8ea02d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55d8ca8d4da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x55d8ca8dac70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55d8ca9067a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f9176e6b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #7 0x55d8ca8cde8d in _start (/out/fuzz_ndpi_reader+0x1ffe8d) + +DEDUP_TOKEN: ndpi_workflow_process_packet--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +0x7bd1761e013e is located 1 bytes after 45-byte region [0x7bd1761e0110,0x7bd1761e013d) +allocated by thread T0 here: + #0 0x55d8caa08984 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55d8caa4cb76 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x55d8ca8ea02d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55d8ca8d4da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x55d8ca8dac70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55d8ca9067a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f9176e6b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:1532:13 in ndpi_workflow_process_packet +Shadow bytes around the buggy address: + 0x7bd1761dfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7bd1761dff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7bd1761dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7bd1761e0000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 05 + 0x7bd1761e0080: fa fa 00 00 00 00 01 fa fa fa 00 00 00 00 07 fa +=>0x7bd1761e0100: fa fa 00 00 00 00 00[05]fa fa fa fa fa fa fa fa + 0x7bd1761e0180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bd1761e0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bd1761e0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bd1761e0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bd1761e0380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-829.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-829.txt new file mode 100644 index 000000000..795327ca3 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-829.txt @@ -0,0 +1,84 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2806677767 +INFO: Loaded 1 modules (23064 inline 8-bit counters): 23064 [0x55e2ad8a3c60, 0x55e2ad8a9678), +INFO: Loaded 1 PC tables (23064 PCs): 23064 [0x55e2ad8a9678,0x55e2ad9037f8), +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-829 +================================================================= +==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x7e19bf9f02df at pc 0x55e2ad4ffa2a bp 0x7ffd1c84edf0 sp 0x7ffd1c84e5a8 +READ of size 2 at 0x7e19bf9f02df thread T0 + #0 0x55e2ad4ffa29 in strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:630:5 + #1 0x55e2ad5e609a in check_content_type_and_change_protocol /src/ndpi/src/lib/protocols/http.c:342:7 + #2 0x55e2ad5e4c13 in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c:686:9 + #3 0x55e2ad5e4c13 in ndpi_search_http_tcp /src/ndpi/src/lib/protocols/http.c:832:3 + #4 0x55e2ad5e7b28 in ndpi_search_http_tcp_again /src/ndpi/src/lib/protocols/http.c:38:3 + #5 0x55e2ad599499 in ndpi_process_extra_packet /src/ndpi/src/lib/ndpi_main.c:4369:9 + #6 0x55e2ad599499 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4725:7 + #7 0x55e2ad56b38b in packet_processing /src/ndpi/example/reader_util.c:1339:31 + #8 0x55e2ad56b38b in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1762:10 + #9 0x55e2ad55cb96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #10 0x55e2ad3fa02d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #11 0x55e2ad3e4da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #12 0x55e2ad3eac70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #13 0x55e2ad4167a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f69c06a9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #15 0x55e2ad3dde8d in _start (/out/fuzz_ndpi_reader+0x1ffe8d) + +DEDUP_TOKEN: ___interceptor_strncpy--check_content_type_and_change_protocol--ndpi_check_http_tcp +0x7e19bf9f02df is located 8415 bytes inside of 25443-byte region [0x7e19bf9ee200,0x7e19bf9f4563) +freed by thread T0 here: + #0 0x55e2ad5186e6 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:51:3 + #1 0x55e2ad55cb9e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:84:5 + #2 0x55e2ad3fa02d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55e2ad3e4da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x55e2ad3eac70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55e2ad4167a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f69c06a9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_free--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +previously allocated by thread T0 here: + #0 0x55e2ad518984 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55e2ad55cb76 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x55e2ad3fa02d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55e2ad3e4da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x55e2ad3eac70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55e2ad4167a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f69c06a9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-use-after-free /src/ndpi/src/lib/protocols/http.c:342:7 in check_content_type_and_change_protocol +Shadow bytes around the buggy address: + 0x7e19bf9f0000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e19bf9f0080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e19bf9f0100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e19bf9f0180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e19bf9f0200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +=>0x7e19bf9f0280: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd + 0x7e19bf9f0300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e19bf9f0380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e19bf9f0400: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e19bf9f0480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7e19bf9f0500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-92.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-92.txt new file mode 100755 index 000000000..1d5d66d6d --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-92.txt @@ -0,0 +1,66 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1117652717 +INFO: Loaded 1 modules (19120 inline 8-bit counters): 19120 [0x55c81d8e87c0, 0x55c81d8ed270), +INFO: Loaded 1 PC tables (19120 PCs): 19120 [0x55c81d8ed270,0x55c81d937d70), +/out/fuzz_ndpi_reader: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2020-92 +================================================================= +==7837==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c9d6dde00a2 at pc 0x55c81d6529b4 bp 0x7ffde1a61770 sp 0x7ffde1a61768 +READ of size 2 at 0x7c9d6dde00a2 thread T0 + #0 0x55c81d6529b3 in ndpi_parse_packet_line_info /src/ndpi/src/lib/ndpi_main.c:4861:10 + #1 0x55c81d6c9a91 in ndpi_search_mail_smtp_tcp /src/ndpi/src/lib/protocols/mail_smtp.c:79:5 + #2 0x55c81d647df1 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:3887:4 + #3 0x55c81d64db1c in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4582:3 + #4 0x55c81d629ef3 in packet_processing /src/ndpi/example/reader_util.c:1401:31 + #5 0x55c81d628464 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1856:10 + #6 0x55c81d61bbc6 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #7 0x55c81d4b905d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x55c81d4a3dd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x55c81d4a9ca0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x55c81d4d57d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fed6ebeb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x55c81d49cebd in _start (/out/fuzz_ndpi_reader+0x1e1ebd) + +0x7c9d6dde00a2 is located 0 bytes after 98-byte region [0x7c9d6dde0040,0x7c9d6dde00a2) +allocated by thread T0 here: + #0 0x55c81d5d79b4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55c81d61bba6 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x55c81d4b905d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55c81d4a3dd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x55c81d4a9ca0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55c81d4d57d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7fed6ebeb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/ndpi_main.c:4861:10 in ndpi_parse_packet_line_info +Shadow bytes around the buggy address: + 0x7c9d6dddfe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c9d6dddfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c9d6dddff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c9d6dddff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c9d6dde0000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 +=>0x7c9d6dde0080: 00 00 00 00[02]fa fa fa fa fa fa fa fa fa fa fa + 0x7c9d6dde0100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c9d6dde0180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c9d6dde0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c9d6dde0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c9d6dde0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7837==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-956.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-956.txt new file mode 100644 index 000000000..bc665c4a1 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2020-956.txt @@ -0,0 +1,66 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2807385543 +INFO: Loaded 1 modules (23064 inline 8-bit counters): 23064 [0x55685e1bbc60, 0x55685e1c1678), +INFO: Loaded 1 PC tables (23064 PCs): 23064 [0x55685e1c1678,0x55685e21b7f8), +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-956 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c305f3e0148 at pc 0x55685de83fc6 bp 0x7ffc80c9dc10 sp 0x7ffc80c9dc08 +READ of size 1 at 0x7c305f3e0148 thread T0 + #0 0x55685de83fc5 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1620:11 + #1 0x55685de74b96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #2 0x55685dd1202d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55685dcfcda2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x55685dd02c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55685dd2e7a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7ff060178082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #7 0x55685dcf5e8d in _start (/out/fuzz_ndpi_reader+0x1ffe8d) + +DEDUP_TOKEN: ndpi_workflow_process_packet--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +0x7c305f3e0148 is located 10 bytes after 46-byte region [0x7c305f3e0110,0x7c305f3e013e) +allocated by thread T0 here: + #0 0x55685de30984 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55685de74b76 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x55685dd1202d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55685dcfcda2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x55685dd02c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55685dd2e7a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7ff060178082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/example/reader_util.c:1620:11 in ndpi_workflow_process_packet +Shadow bytes around the buggy address: + 0x7c305f3dfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c305f3dff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c305f3dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c305f3e0000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 05 + 0x7c305f3e0080: fa fa 00 00 00 00 01 fa fa fa 00 00 00 00 07 fa +=>0x7c305f3e0100: fa fa 00 00 00 00 00 06 fa[fa]fa fa fa fa fa fa + 0x7c305f3e0180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c305f3e0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c305f3e0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c305f3e0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c305f3e0380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2022-1025.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2022-1025.txt new file mode 100755 index 000000000..9ea5e97f5 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2022-1025.txt @@ -0,0 +1,68 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1787938581 +INFO: Loaded 1 modules (22187 inline 8-bit counters): 22187 [0x55710ae54430, 0x55710ae59adb), +INFO: Loaded 1 PC tables (22187 PCs): 22187 [0x55710ae59ae0,0x55710aeb0590), +/out/fuzz_ndpi_reader: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-1025 +================================================================= +==8075==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c0921e6ff39 at pc 0x55710a971a41 bp 0x7ffde2a06fe0 sp 0x7ffde2a06768 +READ of size 9 at 0x7c0921e6ff39 thread T0 + #0 0x55710a971a40 in printf_common(void*, char const*, __va_list_tag*) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:567:9 + #1 0x55710a971db1 in vsnprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1713:1 + #2 0x55710a9737fd in snprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1786:1 + #3 0x55710ab7d455 in ndpi_search_irc_tcp /src/ndpi/src/lib/protocols/irc.c:411:4 + #4 0x55710aae7db9 in check_ndpi_detection_func /src/ndpi/src/lib/ndpi_main.c:5573:6 + #5 0x55710aaed6ab in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:6451:15 + #6 0x55710aaa2528 in packet_processing /src/ndpi/example/reader_util.c:1632:31 + #7 0x55710aaa061f in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:2202:10 + #8 0x55710aa30cf7 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:108:7 + #9 0x55710a8ce08d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #10 0x55710a8b8e02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #11 0x55710a8becd0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #12 0x55710a8ea802 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fa922536082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #14 0x55710a8b1eed in _start (/out/fuzz_ndpi_reader+0x2f7eed) + +0x7c0921e6ff39 is located 0 bytes after 57-byte region [0x7c0921e6ff00,0x7c0921e6ff39) +allocated by thread T0 here: + #0 0x55710a9ec9e4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55710aa30c9b in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:102:31 + #2 0x55710a8ce08d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55710a8b8e02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x55710a8becd0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55710a8ea802 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7fa922536082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/irc.c:411:4 in ndpi_search_irc_tcp +Shadow bytes around the buggy address: + 0x7c0921e6fc80: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00 + 0x7c0921e6fd00: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa + 0x7c0921e6fd80: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00 + 0x7c0921e6fe00: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00 + 0x7c0921e6fe80: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa +=>0x7c0921e6ff00: 00 00 00 00 00 00 00[01]fa fa fa fa fa fa fa fa + 0x7c0921e6ff80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c0921e70000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c0921e70080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c0921e70100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c0921e70180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==8075==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2022-325.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2022-325.txt new file mode 100644 index 000000000..5f86e474a --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2022-325.txt @@ -0,0 +1,71 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2807824098 +INFO: Loaded 1 modules (23064 inline 8-bit counters): 23064 [0x559f2737ac60, 0x559f27380678), +INFO: Loaded 1 PC tables (23064 PCs): 23064 [0x559f27380678,0x559f273da7f8), +/out/fuzz_ndpi_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2022-325 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7bcd9e5d4816 at pc 0x559f270d3b39 bp 0x7ffeabdc6250 sp 0x7ffeabdc6248 +READ of size 1 at 0x7bcd9e5d4816 thread T0 + #0 0x559f270d3b38 in ndpi_check_tinc /src/ndpi/src/lib/protocols/tinc.c:105:9 + #1 0x559f270d3b38 in ndpi_search_tinc /src/ndpi/src/lib/protocols/tinc.c:138:7 + #2 0x559f27067df0 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4129:4 + #3 0x559f27070e69 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4879:3 + #4 0x559f2704238b in packet_processing /src/ndpi/example/reader_util.c:1339:31 + #5 0x559f2704238b in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1762:10 + #6 0x559f27033b96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #7 0x559f26ed102d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x559f26ebbda2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x559f26ec1c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x559f26eed7a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f6d9f07a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x559f26eb4e8d in _start (/out/fuzz_ndpi_reader+0x1ffe8d) + +DEDUP_TOKEN: ndpi_check_tinc--ndpi_search_tinc--check_ndpi_tcp_flow_func +0x7bcd9e5d4816 is located 0 bytes after 54-byte region [0x7bcd9e5d47e0,0x7bcd9e5d4816) +allocated by thread T0 here: + #0 0x559f26fef984 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x559f27033b76 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x559f26ed102d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x559f26ebbda2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x559f26ec1c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x559f26eed7a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f6d9f07a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +DEDUP_TOKEN: __interceptor_malloc--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/tinc.c:105:9 in ndpi_check_tinc +Shadow bytes around the buggy address: + 0x7bcd9e5d4580: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x7bcd9e5d4600: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x7bcd9e5d4680: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa + 0x7bcd9e5d4700: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa + 0x7bcd9e5d4780: fd fd fd fd fd fd fd fa fa fa fa fa 00 00 00 00 +=>0x7bcd9e5d4800: 00 00[06]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bcd9e5d4880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bcd9e5d4900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bcd9e5d4980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bcd9e5d4a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bcd9e5d4a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2022-443.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2022-443.txt new file mode 100755 index 000000000..0c5dde7eb --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2022-443.txt @@ -0,0 +1,69 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1583451780 +INFO: Loaded 1 modules (21849 inline 8-bit counters): 21849 [0x5622b631c690, 0x5622b6321be9), +INFO: Loaded 1 PC tables (21849 PCs): 21849 [0x5622b6321bf0,0x5622b6377180), +/out/fuzz_ndpi_reader: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-443 +================================================================= +==8106==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c8e0cfef6c9 at pc 0x5622b5e63a41 bp 0x7ffee054e280 sp 0x7ffee054da08 +READ of size 12 at 0x7c8e0cfef6c9 thread T0 + #0 0x5622b5e63a40 in printf_common(void*, char const*, __va_list_tag*) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:567:9 + #1 0x5622b5e63db1 in vsnprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1713:1 + #2 0x5622b5e657fd in snprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1786:1 + #3 0x5622b602f8ac in ndpi_check_http_header /src/ndpi/src/lib/protocols/http.c:982:2 + #4 0x5622b602a9e2 in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c:1219:5 + #5 0x5622b5fceb39 in check_ndpi_detection_func /src/ndpi/src/lib/ndpi_main.c:5150:6 + #6 0x5622b5fd49f9 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:6076:15 + #7 0x5622b5f93ec8 in packet_processing /src/ndpi/example/reader_util.c:1541:31 + #8 0x5622b5f9219c in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:2110:10 + #9 0x5622b5f22cbf in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:109:7 + #10 0x5622b5dc008d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #11 0x5622b5daae02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #12 0x5622b5db0cd0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #13 0x5622b5ddc802 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7fde0dccb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #15 0x5622b5da3eed in _start (/out/fuzz_ndpi_reader+0x2f1eed) + +0x7c8e0cfef6c9 is located 0 bytes after 105-byte region [0x7c8e0cfef660,0x7c8e0cfef6c9) +allocated by thread T0 here: + #0 0x5622b5ede9e4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x5622b5f22c82 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:103:31 + #2 0x5622b5dc008d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x5622b5daae02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x5622b5db0cd0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x5622b5ddc802 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7fde0dccb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/http.c:982:2 in ndpi_check_http_header +Shadow bytes around the buggy address: + 0x7c8e0cfef400: 00 00 fa fa fa fa fa fa fa fa 00 00 00 00 00 00 + 0x7c8e0cfef480: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa + 0x7c8e0cfef500: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa + 0x7c8e0cfef580: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd + 0x7c8e0cfef600: fd fd fd fd fa fa fa fa fa fa fa fa 00 00 00 00 +=>0x7c8e0cfef680: 00 00 00 00 00 00 00 00 00[01]fa fa fa fa fa fa + 0x7c8e0cfef700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c8e0cfef780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c8e0cfef800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c8e0cfef880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c8e0cfef900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==8106==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2022-447.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2022-447.txt new file mode 100755 index 000000000..968771301 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2022-447.txt @@ -0,0 +1,70 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1482063698 +INFO: Loaded 1 modules (21849 inline 8-bit counters): 21849 [0x55fa2b4fc690, 0x55fa2b501be9), +INFO: Loaded 1 PC tables (21849 PCs): 21849 [0x55fa2b501bf0,0x55fa2b557180), +/out/fuzz_ndpi_reader: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-447 +================================================================= +==8106==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c73145e4e85 at pc 0x55fa2b043a41 bp 0x7fff0efe96e0 sp 0x7fff0efe8e68 +READ of size 11 at 0x7c73145e4e85 thread T0 + #0 0x55fa2b043a40 in printf_common(void*, char const*, __va_list_tag*) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:567:9 + #1 0x55fa2b043db1 in vsnprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1713:1 + #2 0x55fa2b0457fd in snprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1786:1 + #3 0x55fa2b20f6e4 in ndpi_check_http_header /src/ndpi/src/lib/protocols/http.c:1018:2 + #4 0x55fa2b20a9e2 in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c:1219:5 + #5 0x55fa2b210e51 in ndpi_search_http_tcp_again /src/ndpi/src/lib/protocols/http.c:102:3 + #6 0x55fa2b1b26b7 in ndpi_process_extra_packet /src/ndpi/src/lib/ndpi_main.c:5623:9 + #7 0x55fa2b1b46eb in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:6030:5 + #8 0x55fa2b173ec8 in packet_processing /src/ndpi/example/reader_util.c:1541:31 + #9 0x55fa2b17219c in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:2110:10 + #10 0x55fa2b102cbf in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:109:7 + #11 0x55fa2afa008d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #12 0x55fa2af8ae02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #13 0x55fa2af90cd0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #14 0x55fa2afbc802 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f63152e3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #16 0x55fa2af83eed in _start (/out/fuzz_ndpi_reader+0x2f1eed) + +0x7c73145e4e85 is located 0 bytes after 197-byte region [0x7c73145e4dc0,0x7c73145e4e85) +allocated by thread T0 here: + #0 0x55fa2b0be9e4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55fa2b102c82 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:103:31 + #2 0x55fa2afa008d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55fa2af8ae02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x55fa2af90cd0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55fa2afbc802 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f63152e3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/http.c:1018:2 in ndpi_check_http_header +Shadow bytes around the buggy address: + 0x7c73145e4c00: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c73145e4c80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x7c73145e4d00: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa + 0x7c73145e4d80: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x7c73145e4e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7c73145e4e80:[05]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c73145e4f00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c73145e4f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c73145e5000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c73145e5080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7c73145e5100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==8106==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2022-481.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2022-481.txt new file mode 100755 index 000000000..4cb5bbe00 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2022-481.txt @@ -0,0 +1,32 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1684124055 +INFO: Loaded 1 modules (21941 inline 8-bit counters): 21941 [0x5648cb269ce0, 0x5648cb26f295), +INFO: Loaded 1 PC tables (21941 PCs): 21941 [0x5648cb26f298,0x5648cb2c4de8), +/out/fuzz_ndpi_reader: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-481 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==8107==ERROR: AddressSanitizer: SEGV on unknown address 0x000000353831 (pc 0x7fb75b4e2bea bp 0x7ffd33177ff0 sp 0x7ffd331777a8 T0) +==8107==The signal is caused by a READ memory access. + #0 0x7fb75b4e2bea (/lib/x86_64-linux-gnu/libc.so.6+0xb1bea) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #1 0x5648cad9f173 in strlen /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc + #2 0x5648caf03eb9 in ndpi_strdup /src/ndpi/src/lib/ndpi_main.c:269:13 + #3 0x5648caed880c in process_ndpi_collected_info /src/ndpi/example/reader_util.c:1188:36 + #4 0x5648caede159 in packet_processing /src/ndpi/example/reader_util.c:1567:2 + #5 0x5648caedc19c in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:2110:10 + #6 0x5648cae6ccbf in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:109:7 + #7 0x5648cad0a08d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x5648cacf4e02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x5648cacfacd0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x5648cad26802 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fb75b455082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x5648cacedeed in _start (/out/fuzz_ndpi_reader+0x2f2eed) + +==8107==Register values: +rax = 0x0000000000353831 rbx = 0x0000000000353801 rcx = 0x0000000000000831 rdx = 0x0000000000000001 +rdi = 0x0000000000353831 rsi = 0x0000000000001528 rbp = 0x00007ffd33177ff0 rsp = 0x00007ffd331777a8 + r8 = 0x00005648cb445c00 r9 = 0x00000faf6b4f4098 r10 = 0x0000000000000000 r11 = 0x00007d375a7e0af1 +r12 = 0x00007d375a7e0880 r13 = 0x0000000000000000 r14 = 0x0000000000353831 r15 = 0x0000000000000000 +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0xb1bea) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) +==8107==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2022-695.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2022-695.txt new file mode 100755 index 000000000..43218561f --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2022-695.txt @@ -0,0 +1,37 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1378177787 +INFO: Loaded 1 modules (21991 inline 8-bit counters): 21991 [0x55cb6e182f30, 0x55cb6e188517), +INFO: Loaded 1 PC tables (21991 PCs): 21991 [0x55cb6e188518,0x55cb6e1de388), +/out/fuzz_ndpi_reader: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-695 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==8118==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x55cb6dc81d93 bp 0x000000000001 sp 0x7ffc25b3e790 T0) +==8118==The signal is caused by a READ memory access. +==8118==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. + #0 0x55cb6dc81d93 in atomic_compare_exchange_strong<__sanitizer::atomic_uint8_t> /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:97:10 + #1 0x55cb6dc81d93 in AtomicallySetQuarantineFlagIfAllocated /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:674:10 + #2 0x55cb6dc81d93 in __asan::Allocator::Deallocate(void*, unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType) /src/llvm-project/compiler-rt/lib/asan/asan_allocator.cpp:738:10 + #3 0x55cb6dd227a6 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #4 0x55cb6de18131 in ndpi_free_flow_data /src/ndpi/src/lib/ndpi_main.c:4915:2 + #5 0x55cb6de04d4b in ndpi_free_flow /src/ndpi/src/lib/ndpi_main.c:8076:5 + #6 0x55cb6ddcf3e4 in ndpi_free_flow_info_half /src/ndpi/example/reader_util.c:305:25 + #7 0x55cb6ddd1892 in process_ndpi_collected_info /src/ndpi/example/reader_util.c:1317:5 + #8 0x55cb6ddd841f in packet_processing /src/ndpi/example/reader_util.c:1639:2 + #9 0x55cb6ddd6260 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:2182:10 + #10 0x55cb6dd66cd0 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:107:7 + #11 0x55cb6dc0408d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #12 0x55cb6dbeee02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #13 0x55cb6dbf4cd0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #14 0x55cb6dc20802 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f7ffb11d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #16 0x55cb6dbe7eed in _start (/out/fuzz_ndpi_reader+0x2f4eed) + +==8118==Register values: +rax = 0x0000000000000002 rbx = 0x00007ffc25b3e7e8 rcx = 0x000055cb6dc01b03 rdx = 0x0000000000000000 +rdi = 0x202020202020ff20 rsi = 0x202020202020ff20 rbp = 0x0000000000000001 rsp = 0x00007ffc25b3e790 + r8 = 0x00007ffc25b3e7e8 r9 = 0x0000000000000001 r10 = 0x0000000000000000 r11 = 0x000000000000000c +r12 = 0x000055cb6e395cc8 r13 = 0x202020202020ff10 r14 = 0x202020202020ff20 r15 = 0x0000000000000000 +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ndpi/src/lib/ndpi_main.c:4915:2 in ndpi_free_flow_data +==8118==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2022-712.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2022-712.txt new file mode 100755 index 000000000..730bdb20b --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2022-712.txt @@ -0,0 +1,65 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1270017112 +INFO: Loaded 1 modules (22015 inline 8-bit counters): 22015 [0x557c42709f30, 0x557c4270f52f), +INFO: Loaded 1 PC tables (22015 PCs): 22015 [0x557c4270f530,0x557c42765520), +/out/fuzz_ndpi_reader: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-712 +================================================================= +==8119==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b5db046f514 at pc 0x557c423f0e24 bp 0x7ffc5c086870 sp 0x7ffc5c086868 +READ of size 2 at 0x7b5db046f514 thread T0 + #0 0x557c423f0e23 in ndpi_search_florensia /src/ndpi/src/lib/protocols/florensia.c:93:40 + #1 0x557c423a25b9 in check_ndpi_detection_func /src/ndpi/src/lib/ndpi_main.c:5421:6 + #2 0x557c423a821e in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:6315:15 + #3 0x557c4235e1b5 in packet_processing /src/ndpi/example/reader_util.c:1619:31 + #4 0x557c4235c2a0 in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:2189:10 + #5 0x557c422eccd0 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:107:7 + #6 0x557c4218a08d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x557c42174e02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x557c4217acd0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x557c421a6802 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7efdb0a60082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x557c4216deed in _start (/out/fuzz_ndpi_reader+0x2f4eed) + +0x7b5db046f515 is located 0 bytes after 53-byte region [0x7b5db046f4e0,0x7b5db046f515) +allocated by thread T0 here: + #0 0x557c422a89e4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x557c422ecc8b in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:101:31 + #2 0x557c4218a08d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x557c42174e02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x557c4217acd0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x557c421a6802 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7efdb0a60082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/florensia.c:93:40 in ndpi_search_florensia +Shadow bytes around the buggy address: + 0x7b5db046f280: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa + 0x7b5db046f300: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00 + 0x7b5db046f380: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00 + 0x7b5db046f400: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa + 0x7b5db046f480: fd fd fd fd fd fd fd fa fa fa fa fa 00 00 00 00 +=>0x7b5db046f500: 00 00[05]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b5db046f580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b5db046f600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b5db046f680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b5db046f700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b5db046f780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==8119==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2023-1354.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2023-1354.txt new file mode 100755 index 000000000..5e6e8b51c --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2023-1354.txt @@ -0,0 +1,67 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2301225203 +INFO: Loaded 1 modules (23064 inline 8-bit counters): 23064 [0x5580694a0c60, 0x5580694a6678), +INFO: Loaded 1 PC tables (23064 PCs): 23064 [0x5580694a6678,0x5580695007f8), +/out/fuzz_ndpi_reader: Running 1 inputs 10 time(s) each. +Running: /work/testcase-OSV-2023-1354 +================================================================= +==1679175==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7d1564de32a1 at pc 0x5580691b812f bp 0x7ffc4fc4bb90 sp 0x7ffc4fc4bb88 +READ of size 2 at 0x7d1564de32a1 thread T0 + #0 0x5580691b812e in processClientServerHello /src/ndpi/src/lib/protocols/tls.c:921:21 + #1 0x5580691b8b18 in processTLSBlock /src/ndpi/src/lib/protocols/tls.c:478:5 + #2 0x5580691b8b18 in ndpi_search_tls_udp /src/ndpi/src/lib/protocols/tls.c:639:3 + #3 0x55806918ac41 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4085:2 + #4 0x558069196e69 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4879:3 + #5 0x55806916838b in packet_processing /src/ndpi/example/reader_util.c:1339:31 + #6 0x55806916838b in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1762:10 + #7 0x558069159b96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #8 0x558068ff702d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #9 0x558068fe1da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #10 0x558068fe7c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #11 0x5580690137a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7fe565a88082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x558068fdae8d in _start (/out/fuzz_ndpi_reader+0x1ffe8d) + +0x7d1564de32a2 is located 0 bytes after 354-byte region [0x7d1564de3140,0x7d1564de32a2) +allocated by thread T0 here: + #0 0x558069115984 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x558069159b76 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x558068ff702d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x558068fe1da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x558068fe7c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x5580690137a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7fe565a88082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/tls.c:921:21 in processClientServerHello +Shadow bytes around the buggy address: + 0x7d1564de3000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d1564de3080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d1564de3100: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x7d1564de3180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7d1564de3200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7d1564de3280: 00 00 00 00[02]fa fa fa fa fa fa fa fa fa fa fa + 0x7d1564de3300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d1564de3380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d1564de3400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d1564de3480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7d1564de3500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1679175==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2023-19.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2023-19.txt new file mode 100755 index 000000000..4df20835d --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2023-19.txt @@ -0,0 +1,66 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3886668249 +INFO: Loaded 1 modules (23064 inline 8-bit counters): 23064 [0x55d02d295c60, 0x55d02d29b678), +INFO: Loaded 1 PC tables (23064 PCs): 23064 [0x55d02d29b678,0x55d02d2f57f8), +/out/fuzz_ndpi_reader: Running 1 inputs 10 time(s) each. +Running: /work/testcase-OSV-2023-19 +================================================================= +==1487529==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7bb60b5d475d at pc 0x55d02ce82875 bp 0x7ffe48004810 sp 0x7ffe48003fc0 +READ of size 22 at 0x7bb60b5d475d thread T0 + #0 0x55d02ce82874 in strncmp /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:536:3 + #1 0x55d02cfca6e9 in ndpi_search_bittorrent /src/ndpi/src/lib/protocols/bittorrent.c:426:5 + #2 0x55d02cf7fc41 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4085:2 + #3 0x55d02cf8be69 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4879:3 + #4 0x55d02cf5d38b in packet_processing /src/ndpi/example/reader_util.c:1339:31 + #5 0x55d02cf5d38b in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1762:10 + #6 0x55d02cf4eb96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #7 0x55d02cdec02d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x55d02cdd6da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x55d02cddcc70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x55d02ce087a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f560c06c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x55d02cdcfe8d in _start (/out/fuzz_ndpi_reader+0x1ffe8d) + +0x7bb60b5d475d is located 0 bytes after 61-byte region [0x7bb60b5d4720,0x7bb60b5d475d) +allocated by thread T0 here: + #0 0x55d02cf0a984 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55d02cf4eb76 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x55d02cdec02d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55d02cdd6da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x55d02cddcc70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55d02ce087a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f560c06c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/bittorrent.c:426:5 in ndpi_search_bittorrent +Shadow bytes around the buggy address: + 0x7bb60b5d4480: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x7bb60b5d4500: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa + 0x7bb60b5d4580: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x7bb60b5d4600: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x7bb60b5d4680: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa +=>0x7bb60b5d4700: fa fa fa fa 00 00 00 00 00 00 00[05]fa fa fa fa + 0x7bb60b5d4780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bb60b5d4800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bb60b5d4880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bb60b5d4900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7bb60b5d4980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1487529==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2023-573.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2023-573.txt new file mode 100755 index 000000000..cefbee81b --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2023-573.txt @@ -0,0 +1,47 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1547178607 +INFO: Loaded 1 modules (23070 inline 8-bit counters): 23070 [0x55bc9a53bc60, 0x55bc9a54167e), +INFO: Loaded 1 PC tables (23070 PCs): 23070 [0x55bc9a541680,0x55bc9a59b860), +/out/fuzz_ndpi_reader: Running 1 inputs 10 time(s) each. +Running: /work/testcase-OSV-2023-573 +================================================================= +==1648094==ERROR: AddressSanitizer: negative-size-param: (size=-1) + #0 0x55bc9a197816 in strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:631:5 + #1 0x55bc9a27e484 in ndpi_http_check_content /src/ndpi/src/lib/protocols/http.c:79:2 + #2 0x55bc9a27e484 in ndpi_int_http_add_connection /src/ndpi/src/lib/protocols/http.c:122:14 + #3 0x55bc9a27d913 in check_content_type_and_change_protocol /src/ndpi/src/lib/protocols/http.c + #4 0x55bc9a27b8c6 in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c + #5 0x55bc9a27b8c6 in ndpi_search_http_tcp /src/ndpi/src/lib/protocols/http.c:844:3 + #6 0x55bc9a22a50a in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4117:2 + #7 0x55bc9a231e69 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4879:3 + #8 0x55bc9a20338b in packet_processing /src/ndpi/example/reader_util.c:1339:31 + #9 0x55bc9a20338b in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1762:10 + #10 0x55bc9a1f4b96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #11 0x55bc9a09202d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #12 0x55bc9a07cda2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #13 0x55bc9a082c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #14 0x55bc9a0ae7a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f0cf69f6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #16 0x55bc9a075e8d in _start (/out/fuzz_ndpi_reader+0x1ffe8d) + +0x7b2cf5c25cf0 is located 0 bytes inside of 1-byte region [0x7b2cf5c25cf0,0x7b2cf5c25cf1) +allocated by thread T0 here: + #0 0x55bc9a1b0984 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55bc9a27e460 in ndpi_http_check_content /src/ndpi/src/lib/protocols/http.c:77:19 + #2 0x55bc9a27e460 in ndpi_int_http_add_connection /src/ndpi/src/lib/protocols/http.c:122:14 + #3 0x55bc9a27d913 in check_content_type_and_change_protocol /src/ndpi/src/lib/protocols/http.c + #4 0x55bc9a27b8c6 in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c + #5 0x55bc9a27b8c6 in ndpi_search_http_tcp /src/ndpi/src/lib/protocols/http.c:844:3 + #6 0x55bc9a22a50a in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4117:2 + #7 0x55bc9a231e69 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4879:3 + #8 0x55bc9a20338b in packet_processing /src/ndpi/example/reader_util.c:1339:31 + #9 0x55bc9a20338b in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1762:10 + #10 0x55bc9a1f4b96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #11 0x55bc9a09202d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #12 0x55bc9a07cda2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #13 0x55bc9a082c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #14 0x55bc9a0ae7a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f0cf69f6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: negative-size-param /src/ndpi/src/lib/protocols/http.c:79:2 in ndpi_http_check_content +==1648094==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2024-1330.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2024-1330.txt new file mode 100755 index 000000000..cdf9ba649 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2024-1330.txt @@ -0,0 +1,65 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 697968595 +INFO: Loaded 1 modules (23077 inline 8-bit counters): 23077 [0x55bae90a1c60, 0x55bae90a7685), +INFO: Loaded 1 PC tables (23077 PCs): 23077 [0x55bae90a7688,0x55bae91018d8), +/out/fuzz_ndpi_reader: Running 1 inputs 10 time(s) each. +Running: /work/testcase-OSV-2024-1330 +================================================================= +==1878900==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b3ea85e0274 at pc 0x55bae8da4d19 bp 0x7ffd40b7ca60 sp 0x7ffd40b7ca58 +READ of size 1 at 0x7b3ea85e0274 thread T0 + #0 0x55bae8da4d18 in zoom_search_again /src/ndpi/src/lib/protocols/zoom.c:6:10 + #1 0x55bae8d97719 in ndpi_process_extra_packet /src/ndpi/src/lib/ndpi_main.c:4370:9 + #2 0x55bae8d97719 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4726:7 + #3 0x55bae8d693df in packet_processing /src/ndpi/example/reader_util.c:1335:31 + #4 0x55bae8d693df in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1767:10 + #5 0x55bae8d5ab96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #6 0x55bae8bf802d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x55bae8be2da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x55bae8be8c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x55bae8c147a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7efea93e7082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x55bae8bdbe8d in _start (/out/fuzz_ndpi_reader+0x1ffe8d) + +0x7b3ea85e0274 is located 0 bytes after 36-byte region [0x7b3ea85e0250,0x7b3ea85e0274) +allocated by thread T0 here: + #0 0x55bae8d16984 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55bae8d5ab76 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:81:31 + #2 0x55bae8bf802d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #3 0x55bae8be2da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #4 0x55bae8be8c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #5 0x55bae8c147a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7efea93e7082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/zoom.c:6:10 in zoom_search_again +Shadow bytes around the buggy address: + 0x7b3ea85dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b3ea85e0000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 05 + 0x7b3ea85e0080: fa fa 00 00 00 00 01 fa fa fa 00 00 00 00 07 fa + 0x7b3ea85e0100: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7b3ea85e0180: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa +=>0x7b3ea85e0200: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00[04]fa + 0x7b3ea85e0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b3ea85e0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b3ea85e0380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b3ea85e0400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b3ea85e0480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1878900==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2024-552.txt b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2024-552.txt new file mode 100755 index 000000000..82f7d1e93 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/OSV-2024-552.txt @@ -0,0 +1,31 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2986352789 +INFO: Loaded 1 modules (23066 inline 8-bit counters): 23066 [0x55e0cc2f0c60, 0x55e0cc2f667a), +INFO: Loaded 1 PC tables (23066 PCs): 23066 [0x55e0cc2f6680,0x55e0cc350820), +/out/fuzz_ndpi_reader: Running 1 inputs 10 time(s) each. +Running: /work/testcase-OSV-2024-552 +AddressSanitizer:DEADLYSIGNAL +================================================================= +==183526==ERROR: AddressSanitizer: SEGV on unknown address 0x7b7920de03bd (pc 0x55e0cbff3a27 bp 0x7ffe3ad096b0 sp 0x7ffe3ad096b0 T0) +==183526==The signal is caused by a READ memory access. + #0 0x55e0cbff3a27 in ndpi_search_zoom /src/ndpi/src/lib/protocols/zoom.c:6:3 + #1 0x55e0cbfdac51 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4086:2 + #2 0x55e0cbfe6e79 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4880:3 + #3 0x55e0cbfb838b in packet_processing /src/ndpi/example/reader_util.c:1339:31 + #4 0x55e0cbfb838b in ndpi_workflow_process_packet /src/ndpi/example/reader_util.c:1762:10 + #5 0x55e0cbfa9b96 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_ndpi_reader.c:83:5 + #6 0x55e0cbe4702d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x55e0cbe31da2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x55e0cbe37c70 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x55e0cbe637a2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f0821b6d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x55e0cbe2ae8d in _start (/out/fuzz_ndpi_reader+0x1ffe8d) + +==183526==Register values: +rax = 0x0000000000000000 rbx = 0x00007ffe3ad096c0 rcx = 0x0000000000000000 rdx = 0x0100000000000000 +rdi = 0x00007b7920de03bd rsi = 0x00007cd820de0df8 rbp = 0x00007ffe3ad096b0 rsp = 0x00007ffe3ad096b0 + r8 = 0x0000000000000002 r9 = 0x0000000020000000 r10 = 0x0000000000000000 r11 = 0x0000000000000000 +r12 = 0x0000000000000001 r13 = 0x0000000000000000 r14 = 0x000055e0cbff39d0 r15 = 0x00000000000001c8 +AddressSanitizer can not provide additional info. +SUMMARY: AddressSanitizer: SEGV /src/ndpi/src/lib/protocols/zoom.c:6:3 in ndpi_search_zoom +==183526==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/collect_crash_builds.csv b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/collect_crash_builds.csv new file mode 100644 index 000000000..12dffdbb1 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/original-crashes/collect_crash_builds.csv @@ -0,0 +1,18 @@ +target,commit_id,oss_fuzz_commit,sanitizer +ndpi,5cad39f0e88c03b3cb4f78addf56e217b3d372f2,1cc1638224a0f57c702abd57f7b40e5b78a13611,address +ndpi,30730e95e5a270cb70dd5509fa6e481a7ed4e074,auto,address +ndpi,3874f0e0e0293dd977fda31d3f50c69ebcad4463,auto,address +ndpi,3b825fca6dc9faef47a06fc47e38450b7571e90a,auto,address +ndpi,3c0021d6036532a6fdff9196b7ee7a614bdbd525,auto,address +ndpi,493bffb3e0bd616c2a333d563bc1dd4addec5359,auto,address +ndpi,59a9bdeb55fb5a712b51141bfa4492a897cda5c8,auto,address +ndpi,5c7200f2bb763bfcd4e0636aebb88573e97bbcf3,auto,address +ndpi,8dcaa5c0e11a7af1b529d0d657f4b37f11e8ec11,auto,address +ndpi,94bf7b0130c1fd447624a9a91d2d125eaac91ea7,auto,address +ndpi,98d9f524f9ff7746d0345939fe543020f8057212,c3271ac0e45c59e5eb4afffca6c00f46ce423e38,address +ndpi,abee1a2a6f1d8375831901e49ace85eaea0650e3,auto,address +ndpi,aee2c81f76842c6968e98f343adb46082eb3fb85,auto,address +ndpi,bb33d579714e140650e13325c39b0d372888b717,auto,address +ndpi,d7d942586aaee89968f458e95acafe260dbdda7c,auto,address +ndpi,edb8165ab9b70cf8c152b6a3dfbec9c8a4853eef,auto,address +ndpi,f6038c358a71ab43bd1e1b53103659f62ea5adce,auto,address diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/patches/combined.diff b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/patches/combined.diff new file mode 100644 index 000000000..d6ca4d807 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/patches/combined.diff @@ -0,0 +1,904 @@ +diff --git a/example/reader_util.c b/example/reader_util.c +index ab3a73741..5ef167964 100644 +--- a/example/reader_util.c ++++ b/example/reader_util.c +@@ -26,6 +26,7 @@ + #endif + + #include ++#include + + #ifdef WIN32 + #include /* winsock.h is included automatically */ +@@ -78,6 +79,7 @@ + #endif + + #include "ndpi_main.h" ++#include "../__bug_dispatch.h" + #include "reader_util.h" + #include "ndpi_classify.h" + +@@ -944,8 +946,14 @@ static u_int8_t is_ndpi_proto(struct ndpi_flow_info *flow, u_int16_t id) { + /* ****************************************************** */ + + void process_ndpi_collected_info(struct ndpi_workflow * workflow, struct ndpi_flow_info *flow) { ++ char **legacy_tls = NULL; ++ + if(!flow->ndpi_flow) return; + ++ if(__bug_dispatch[1] & (1 << 3)) { ++ legacy_tls = (char **)&flow->ndpi_flow->protos; ++ } ++ + snprintf(flow->host_server_name, sizeof(flow->host_server_name), "%s", + flow->ndpi_flow->host_server_name); + +@@ -1042,42 +1050,72 @@ void process_ndpi_collected_info(struct ndpi_workflow * workflow, struct ndpi_fl + flow->ndpi_flow->protos.ssh.hassh_server); + } + /* TLS */ +- else if((is_ndpi_proto(flow, NDPI_PROTOCOL_TLS)) +- || (flow->detected_protocol.master_protocol == NDPI_PROTOCOL_TLS) +- || (flow->ndpi_flow->protos.stun_ssl.ssl.ja3_client[0] != '\0') +- ) { +- flow->ssh_tls.ssl_version = flow->ndpi_flow->protos.stun_ssl.ssl.ssl_version; +- snprintf(flow->ssh_tls.client_requested_server_name, +- sizeof(flow->ssh_tls.client_requested_server_name), "%s", +- flow->ndpi_flow->protos.stun_ssl.ssl.client_requested_server_name); +- +- if(flow->ndpi_flow->protos.stun_ssl.ssl.server_names_len > 0) +- flow->ssh_tls.server_names = ndpi_strdup(flow->ndpi_flow->protos.stun_ssl.ssl.server_names); +- snprintf(flow->ssh_tls.server_organization, sizeof(flow->ssh_tls.server_organization), "%s", +- flow->ndpi_flow->protos.stun_ssl.ssl.server_organization); +- flow->ssh_tls.notBefore = flow->ndpi_flow->protos.stun_ssl.ssl.notBefore; +- flow->ssh_tls.notAfter = flow->ndpi_flow->protos.stun_ssl.ssl.notAfter; +- snprintf(flow->ssh_tls.ja3_client, sizeof(flow->ssh_tls.ja3_client), "%s", +- flow->ndpi_flow->protos.stun_ssl.ssl.ja3_client); +- snprintf(flow->ssh_tls.ja3_server, sizeof(flow->ssh_tls.ja3_server), "%s", +- flow->ndpi_flow->protos.stun_ssl.ssl.ja3_server); +- flow->ssh_tls.server_unsafe_cipher = flow->ndpi_flow->protos.stun_ssl.ssl.server_unsafe_cipher; +- flow->ssh_tls.server_cipher = flow->ndpi_flow->protos.stun_ssl.ssl.server_cipher; +- +- if(flow->ndpi_flow->l4.tcp.tls.fingerprint_set) { +- memcpy(flow->ssh_tls.sha1_cert_fingerprint, +- flow->ndpi_flow->l4.tcp.tls.sha1_certificate_fingerprint, 20); +- flow->ssh_tls.sha1_cert_fingerprint_set = 1; ++ else { ++ int bug_806_tls_path_active; ++ ++ if (__bug_dispatch[0] & (1 << 6)) { ++ bug_806_tls_path_active = ((is_ndpi_proto(flow, NDPI_PROTOCOL_TLS)) ++ || (is_ndpi_proto(flow, NDPI_PROTOCOL_RX)) ++ || (flow->detected_protocol.master_protocol == NDPI_PROTOCOL_TLS) ++ || (flow->ndpi_flow->protos.stun_ssl.ssl.ja3_client[0] != '\0')); ++ } else { ++ bug_806_tls_path_active = ((is_ndpi_proto(flow, NDPI_PROTOCOL_TLS)) ++ || (flow->detected_protocol.master_protocol == NDPI_PROTOCOL_TLS) ++ || (flow->ndpi_flow->protos.stun_ssl.ssl.ja3_client[0] != '\0')); + } + +- if(flow->ndpi_flow->protos.stun_ssl.ssl.alpn +- && flow->ndpi_flow->protos.stun_ssl.ssl.tls_supported_versions) +- snprintf(flow->info, sizeof(flow->info), "ALPN: %s][TLS Supported Versions: %s", +- flow->ndpi_flow->protos.stun_ssl.ssl.alpn, +- flow->ndpi_flow->protos.stun_ssl.ssl.tls_supported_versions); +- else if(flow->ndpi_flow->protos.stun_ssl.ssl.alpn) +- snprintf(flow->info, sizeof(flow->info), "ALPN: %s", +- flow->ndpi_flow->protos.stun_ssl.ssl.alpn); ++ if(bug_806_tls_path_active) { ++ if (__bug_dispatch[0] & (1 << 6)) { ++ volatile size_t legacy_tls_dn_len_sink = strlen(*(const char **)(flow->ndpi_flow->protos.stun_ssl.ssl.server_organization + (2 * sizeof(char *)))); ++ (void)legacy_tls_dn_len_sink; ++ } ++ flow->ssh_tls.ssl_version = flow->ndpi_flow->protos.stun_ssl.ssl.ssl_version; ++ snprintf(flow->ssh_tls.client_requested_server_name, ++ sizeof(flow->ssh_tls.client_requested_server_name), "%s", ++ flow->ndpi_flow->protos.stun_ssl.ssl.client_requested_server_name); ++ ++ if(flow->ndpi_flow->protos.stun_ssl.ssl.server_names_len > 0) ++ flow->ssh_tls.server_names = ndpi_strdup(flow->ndpi_flow->protos.stun_ssl.ssl.server_names); ++ snprintf(flow->ssh_tls.server_organization, sizeof(flow->ssh_tls.server_organization), "%s", ++ flow->ndpi_flow->protos.stun_ssl.ssl.server_organization); ++ flow->ssh_tls.notBefore = flow->ndpi_flow->protos.stun_ssl.ssl.notBefore; ++ flow->ssh_tls.notAfter = flow->ndpi_flow->protos.stun_ssl.ssl.notAfter; ++ snprintf(flow->ssh_tls.ja3_client, sizeof(flow->ssh_tls.ja3_client), "%s", ++ flow->ndpi_flow->protos.stun_ssl.ssl.ja3_client); ++ snprintf(flow->ssh_tls.ja3_server, sizeof(flow->ssh_tls.ja3_server), "%s", ++ flow->ndpi_flow->protos.stun_ssl.ssl.ja3_server); ++ flow->ssh_tls.server_unsafe_cipher = flow->ndpi_flow->protos.stun_ssl.ssl.server_unsafe_cipher; ++ flow->ssh_tls.server_cipher = flow->ndpi_flow->protos.stun_ssl.ssl.server_cipher; ++ ++ if(flow->ndpi_flow->l4.tcp.tls.fingerprint_set) { ++ memcpy(flow->ssh_tls.sha1_cert_fingerprint, ++ flow->ndpi_flow->l4.tcp.tls.sha1_certificate_fingerprint, 20); ++ flow->ssh_tls.sha1_cert_fingerprint_set = 1; ++ } ++ ++ if(__bug_dispatch[0] & (1 << 1)) { ++ if(flow->ndpi_flow->protos.stun_ssl.ssl.issuerDN) ++ flow->ssh_tls.tls_issuerDN = strdup(flow->ndpi_flow->protos.stun_ssl.ssl.issuerDN); ++ } else { ++ /* Original code: no-op. */ ++ } ++ ++ if(flow->ndpi_flow->protos.stun_ssl.ssl.alpn ++ && flow->ndpi_flow->protos.stun_ssl.ssl.tls_supported_versions) ++ snprintf(flow->info, sizeof(flow->info), "ALPN: %s][TLS Supported Versions: %s", ++ flow->ndpi_flow->protos.stun_ssl.ssl.alpn, ++ flow->ndpi_flow->protos.stun_ssl.ssl.tls_supported_versions); ++ else if(flow->ndpi_flow->protos.stun_ssl.ssl.alpn) ++ snprintf(flow->info, sizeof(flow->info), "ALPN: %s", ++ flow->ndpi_flow->protos.stun_ssl.ssl.alpn); ++ } else if((__bug_dispatch[1] & (1 << 3)) ++ && is_ndpi_proto(flow, NDPI_PROTOCOL_FREE_205) ++ && legacy_tls[1]) { ++ char *legacy_alpn = ndpi_strdup(legacy_tls[1]); ++ ++ if(legacy_alpn != NULL) ++ ndpi_free(legacy_alpn); ++ } + } + + if(flow->detection_completed && (!flow->check_extra_packets)) { +@@ -1327,41 +1365,87 @@ static struct ndpi_proto packet_processing(struct ndpi_workflow * workflow, + return(nproto); + } + +- if(!flow->detection_completed) { +- u_int enough_packets = +- (((proto == IPPROTO_UDP) && ((flow->src2dst_packets + flow->dst2src_packets) > max_num_udp_dissected_pkts)) +- || ((proto == IPPROTO_TCP) && ((flow->src2dst_packets + flow->dst2src_packets) > max_num_tcp_dissected_pkts))) ? 1 : 0; ++ if(__bug_dispatch[1] & (1 << 7)) { ++ if((!flow->detection_completed) || flow->check_extra_packets) { ++#if 0 ++ printf("%s()\n", __FUNCTION__); ++#endif ++ ++ flow->detected_protocol = ndpi_detection_process_packet(workflow->ndpi_struct, ndpi_flow, ++ iph ? (uint8_t *)iph : (uint8_t *)iph6, ++ ipsize, time, src, dst); ++ ++ if(flow->detection_completed) { ++ if(ndpi_flow) ++ flow->check_extra_packets = ndpi_flow->check_extra_packets && (ndpi_flow->extra_packets_func != NULL); ++ ++ if(!flow->check_extra_packets) ++ process_ndpi_collected_info(workflow, flow); ++ } else { ++ u_int enough_packets = ++ (((proto == IPPROTO_UDP) && ((flow->src2dst_packets + flow->dst2src_packets) > max_num_udp_dissected_pkts)) ++ || ((proto == IPPROTO_TCP) && ((flow->src2dst_packets + flow->dst2src_packets) > max_num_tcp_dissected_pkts))) ? 1 : 0; ++ ++ if(enough_packets || (flow->detected_protocol.app_protocol != NDPI_PROTOCOL_UNKNOWN)) { ++ if((!enough_packets) ++ && ndpi_extra_dissection_possible(workflow->ndpi_struct, ndpi_flow)) ++ ; /* Wait for certificate fingerprint */ ++ else { ++ /* New protocol detected or give up */ ++ flow->detection_completed = 1; ++ ++ if(ndpi_flow) ++ flow->check_extra_packets = ndpi_flow->check_extra_packets && (ndpi_flow->extra_packets_func != NULL); ++ ++ if(flow->detected_protocol.app_protocol == NDPI_PROTOCOL_UNKNOWN) { ++ u_int8_t proto_guessed; ++ ++ flow->detected_protocol = ndpi_detection_giveup(workflow->ndpi_struct, flow->ndpi_flow, ++ enable_protocol_guess, &proto_guessed); ++ } ++ ++ process_ndpi_collected_info(workflow, flow); ++ } ++ } ++ } ++ } ++ } else { ++ if(!flow->detection_completed) { ++ u_int enough_packets = ++ (((proto == IPPROTO_UDP) && ((flow->src2dst_packets + flow->dst2src_packets) > max_num_udp_dissected_pkts)) ++ || ((proto == IPPROTO_TCP) && ((flow->src2dst_packets + flow->dst2src_packets) > max_num_tcp_dissected_pkts))) ? 1 : 0; + + #if 0 +- printf("%s()\n", __FUNCTION__); ++ printf("%s()\n", __FUNCTION__); + #endif + +- flow->detected_protocol = ndpi_detection_process_packet(workflow->ndpi_struct, ndpi_flow, +- iph ? (uint8_t *)iph : (uint8_t *)iph6, +- ipsize, time, src, dst); ++ flow->detected_protocol = ndpi_detection_process_packet(workflow->ndpi_struct, ndpi_flow, ++ iph ? (uint8_t *)iph : (uint8_t *)iph6, ++ ipsize, time, src, dst); + +- if(enough_packets || (flow->detected_protocol.app_protocol != NDPI_PROTOCOL_UNKNOWN)) { +- if((!enough_packets) +- && ndpi_extra_dissection_possible(workflow->ndpi_struct, ndpi_flow)) +- ; /* Wait for certificate fingerprint */ +- else { +- /* New protocol detected or give up */ +- flow->detection_completed = 1; ++ if(enough_packets || (flow->detected_protocol.app_protocol != NDPI_PROTOCOL_UNKNOWN)) { ++ if((!enough_packets) ++ && ndpi_extra_dissection_possible(workflow->ndpi_struct, ndpi_flow)) ++ ; /* Wait for certificate fingerprint */ ++ else { ++ /* New protocol detected or give up */ ++ flow->detection_completed = 1; + + #if 0 +- /* Check if we should keep checking extra packets */ +- if(ndpi_flow && ndpi_flow->check_extra_packets) +- flow->check_extra_packets = 1; ++ /* Check if we should keep checking extra packets */ ++ if(ndpi_flow && ndpi_flow->check_extra_packets) ++ flow->check_extra_packets = 1; + #endif + +- if(flow->detected_protocol.app_protocol == NDPI_PROTOCOL_UNKNOWN) { +- u_int8_t proto_guessed; ++ if(flow->detected_protocol.app_protocol == NDPI_PROTOCOL_UNKNOWN) { ++ u_int8_t proto_guessed; + +- flow->detected_protocol = ndpi_detection_giveup(workflow->ndpi_struct, flow->ndpi_flow, +- enable_protocol_guess, &proto_guessed); +- } ++ flow->detected_protocol = ndpi_detection_giveup(workflow->ndpi_struct, flow->ndpi_flow, ++ enable_protocol_guess, &proto_guessed); ++ } + +- process_ndpi_collected_info(workflow, flow); ++ process_ndpi_collected_info(workflow, flow); ++ } + } + } + } +@@ -1444,8 +1528,17 @@ struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow, + datalink_type = (int)pcap_datalink(workflow->pcap_handle); + #endif + +- if(header->caplen < 40) +- return(nproto); /* Too short */ ++ if(__bug_dispatch[1] & (1 << 7)) { ++ if(header->caplen < 36) ++ return(nproto); /* Too short */ ++ } else { ++ if(!(__bug_dispatch[0] & (1 << 2))) { ++ if (!(__bug_dispatch[0] & (1 << 3))) { ++ if(header->caplen < 40) ++ return(nproto); /* Too short */ ++ } ++ } ++ } + + datalink_check: + switch(datalink_type) { +@@ -1651,6 +1744,14 @@ ether_type_check: + ip_len += 8 * (options[1] + 1); + } + ++ if(__bug_dispatch[0] & (1 << 4)) { ++ const u_int8_t *l4ptr = (((const u_int8_t *) iph6) + sizeof(struct ndpi_ipv6hdr)); ++ ++ ndpi_handle_ipv6_extension_headers(NULL, &l4ptr, &ip_len, &proto); ++ } else { ++ /* Original behavior: do not normalize IPv6 extension headers here. */ ++ } ++ + iph = NULL; + } else { + static u_int8_t ipv4_warning_used = 0; +diff --git a/example/reader_util.h b/example/reader_util.h +index d54b4d611..1c60eb87f 100644 +--- a/example/reader_util.h ++++ b/example/reader_util.h +@@ -198,6 +198,7 @@ typedef struct ndpi_flow_info { + u_int16_t ssl_version; + char client_requested_server_name[64], server_info[64], + client_hassh[33], server_hassh[33], *server_names, ++ *tls_issuerDN, + server_organization[64], + ja3_client[33], ja3_server[33], + sha1_cert_fingerprint[20]; +diff --git a/fuzz/Makefile.am b/fuzz/Makefile.am +index a70152133..df36699c9 100644 +--- a/fuzz/Makefile.am ++++ b/fuzz/Makefile.am +@@ -1,7 +1,6 @@ + bin_PROGRAMS = fuzz_process_packet fuzz_ndpi_reader +-BUG_DISPATCH_SOURCE = ../__bug_dispatch.c + +-fuzz_process_packet_SOURCES = fuzz_process_packet.c $(BUG_DISPATCH_SOURCE) ++fuzz_process_packet_SOURCES = fuzz_process_packet.c $(top_srcdir)/__bug_dispatch.c + fuzz_process_packet_CFLAGS = -I.. + fuzz_process_packet_LDFLAGS = ../src/lib/libndpi.a $(ADDITIONAL_LIBS) + if HAS_FUZZLDFLAGS +@@ -14,7 +13,7 @@ fuzz_process_packet_LINK=$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=link $(CXX) $(AM_CXXFLAGS) $(CXXFLAGS) \ + $(fuzz_process_packet_LDFLAGS) $(LDFLAGS) -o $@ + +-fuzz_ndpi_reader_SOURCES = fuzz_ndpi_reader.c $(BUG_DISPATCH_SOURCE) ++fuzz_ndpi_reader_SOURCES = fuzz_ndpi_reader.c $(top_srcdir)/__bug_dispatch.c + fuzz_ndpi_reader_CFLAGS = -I.. -I../example/ + fuzz_ndpi_reader_LDFLAGS = ../example/libndpiReader.a ../src/lib/libndpi.a $(PCAP_LIB) $(ADDITIONAL_LIBS) + if HAS_FUZZLDFLAGS +diff --git a/src/include/ndpi_main.h b/src/include/ndpi_main.h +index c909adc74..00373c67b 100644 +--- a/src/include/ndpi_main.h ++++ b/src/include/ndpi_main.h +@@ -115,6 +115,11 @@ extern "C" { + extern int ndpi_parse_ip_string(const char *ip_str, ndpi_ip_addr_t *parsed_ip); + extern char *ndpi_get_ip_string(const ndpi_ip_addr_t * ip, char *buf, u_int buf_len); + extern u_int8_t ndpi_is_ipv6(const ndpi_ip_addr_t *ip); ++#ifdef NDPI_DETECTION_SUPPORT_IPV6 ++ int ndpi_handle_ipv6_extension_headers(struct ndpi_detection_module_struct *ndpi_str, ++ const u_int8_t ** l4ptr, u_int16_t * l4len, ++ u_int8_t * nxt_hdr); ++#endif + + extern char* ndpi_get_proto_by_id(struct ndpi_detection_module_struct *ndpi_mod, u_int id); + u_int16_t ndpi_get_proto_by_name(struct ndpi_detection_module_struct *ndpi_mod, const char *name); +diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h +index 2cae4b203..b778b4a16 100644 +--- a/src/include/ndpi_protocols.h ++++ b/src/include/ndpi_protocols.h +@@ -184,6 +184,7 @@ void init_xbox_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int + void init_xdmcp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); + void init_yahoo_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); + void init_zattoo_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); ++void init_zoom_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); + void init_zmq_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); + void init_stracraft_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); + void init_ubntac2_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); +@@ -212,6 +213,7 @@ void init_ookla_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_in + void init_modbus_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); + void init_capwap_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); + void init_zabbix_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); ++void init_rsh_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); + void init_wireguard_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); + void init_targus_getdata_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); + void init_dnp3_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); +diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h +index 98b8ccf8e..120c0c011 100644 +--- a/src/include/ndpi_typedefs.h ++++ b/src/include/ndpi_typedefs.h +@@ -811,6 +811,7 @@ struct ndpi_packet_struct { + struct ndpi_int_one_line_struct forwarded_line; + struct ndpi_int_one_line_struct referer_line; + struct ndpi_int_one_line_struct content_line; ++ struct ndpi_int_one_line_struct content_disposition_line; + struct ndpi_int_one_line_struct accept_line; + struct ndpi_int_one_line_struct user_agent_line; + struct ndpi_int_one_line_struct http_url_name; +@@ -1233,7 +1234,7 @@ struct ndpi_flow_struct { + struct { + u_int16_t ssl_version, server_names_len; + char client_requested_server_name[64], *server_names, server_organization[64], +- *alpn, *tls_supported_versions; ++ *alpn, *tls_supported_versions, *issuerDN; + u_int32_t notBefore, notAfter; + char ja3_client[33], ja3_server[33]; + u_int16_t server_cipher; +diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c +index 3b5d8e251..20660dcd6 100644 +--- a/src/lib/ndpi_main.c ++++ b/src/lib/ndpi_main.c +@@ -32,6 +32,7 @@ + #include "ndpi_api.h" + #include "ahocorasick.h" + #include "libcache.h" ++#include "../../__bug_dispatch.h" + + #include + #ifndef WIN32 +@@ -3035,6 +3036,7 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n + NDPI_PROTOCOL_BITMASK detection_bitmask_local; + NDPI_PROTOCOL_BITMASK *detection_bitmask = &detection_bitmask_local; + u_int32_t a = 0; ++ u_int8_t zoom_dissector_initialized = 0; + + NDPI_BITMASK_SET(detection_bitmask_local, *dbm); + NDPI_BITMASK_SET(ndpi_str->detection_bitmask, *dbm); +@@ -3054,6 +3056,20 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n + /* STUN */ + init_stun_dissector(ndpi_str, &a, detection_bitmask); + ++ if(__bug_dispatch[1] & (1 << 7)) { ++ zoom_dissector_initialized = 1; ++ init_zoom_dissector(ndpi_str, &a, detection_bitmask); ++ } else { ++ /* Original version: no Zoom dissector initialization. */ ++ } ++ ++ if(__bug_dispatch[2] & (1 << 0)) { ++ if(!zoom_dissector_initialized) { ++ zoom_dissector_initialized = 1; ++ init_zoom_dissector(ndpi_str, &a, detection_bitmask); ++ } ++ } ++ + /* RTP */ + init_rtp_dissector(ndpi_str, &a, detection_bitmask); + +@@ -3474,6 +3490,11 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n + /* ZABBIX */ + init_zabbix_dissector(ndpi_str, &a, detection_bitmask); + ++ if(__bug_dispatch[1] & (1 << 3)) { ++ /* RSH */ ++ init_rsh_dissector(ndpi_str, &a, detection_bitmask); ++ } ++ + /*** Put false-positive sensitive protocols at the end ***/ + + /* VIBER */ +@@ -3602,7 +3623,7 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n + * nxt_hdr: protocol of the actual payload + * returns 0 upon success and 1 upon failure + */ +-static int ndpi_handle_ipv6_extension_headers(struct ndpi_detection_module_struct *ndpi_str, const u_int8_t ** l4ptr, u_int16_t * l4len, u_int8_t * nxt_hdr) ++int ndpi_handle_ipv6_extension_headers(struct ndpi_detection_module_struct *ndpi_str, const u_int8_t ** l4ptr, u_int16_t * l4len, u_int8_t * nxt_hdr) + { + while((*nxt_hdr == 0 || *nxt_hdr == 43 || *nxt_hdr == 44 || *nxt_hdr == 60 || *nxt_hdr == 135 || *nxt_hdr == 59)) { + u_int16_t ehdr_len; +@@ -3645,9 +3666,16 @@ static int ndpi_handle_ipv6_extension_headers(struct ndpi_detection_module_struc + static u_int8_t ndpi_iph_is_valid_and_not_fragmented(const struct ndpi_iphdr *iph, const u_int16_t ipsize) + { + //#ifdef REQUIRE_FULL_PACKETS +- if(ipsize < iph->ihl * 4 || +- ipsize < ntohs(iph->tot_len) || ntohs(iph->tot_len) < iph->ihl * 4 || (iph->frag_off & htons(0x1FFF)) != 0) { +- return(0); ++ if(__bug_dispatch[1] & (1 << 4)) { ++ if(ipsize < iph->ihl * 4 || ++ ipsize < ntohs(iph->tot_len) || ntohs(iph->tot_len) < iph->ihl * 4) { ++ return(0); ++ } ++ } else { ++ if(ipsize < iph->ihl * 4 || ++ ipsize < ntohs(iph->tot_len) || ntohs(iph->tot_len) < iph->ihl * 4 || (iph->frag_off & htons(0x1FFF)) != 0) { ++ return(0); ++ } + } + //#endif + +@@ -5125,7 +5153,18 @@ void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_str, + return; /* Return if only one byte remains (prevent invalid reads past end-of-buffer) */ + + if(get_u_int16_t(packet->payload, a) == ntohs(0x0d0a)) { /* If end of line char sequence CR+NL "\r\n", process line */ +- packet->line[packet->parsed_lines].len = (u_int16_t)(((unsigned long) &packet->payload[a]) - ((unsigned long) packet->line[packet->parsed_lines].ptr)); ++ if(__bug_dispatch[0] & (1 << 5)) { ++ memcpy(flow->flow_extra_info, &packet->payload[a + 4], ++ ndpi_min(packet->payload_packet_len - ((u_int32_t)a + 4), 8)); ++ } else { ++ } ++ if(__bug_dispatch[0] & (1 << 7)) { ++ volatile u_int16_t lookahead_crlf = get_u_int16_t(packet->payload, a + 2); ++ (void)lookahead_crlf; ++ packet->line[packet->parsed_lines].len = (u_int16_t)(((unsigned long) &packet->payload[a]) - ((unsigned long) packet->line[packet->parsed_lines].ptr)); ++ } else { ++ packet->line[packet->parsed_lines].len = (u_int16_t)(((unsigned long) &packet->payload[a]) - ((unsigned long) packet->line[packet->parsed_lines].ptr)); ++ } + + /* First line of a HTTP response parsing. Expected a "HTTP/1.? ???" */ + if(packet->parsed_lines == 0 && packet->line[0].len >= NDPI_STATICSTRING_LEN("HTTP/1.X 200 ") && +@@ -5271,6 +5310,15 @@ void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_str, + packet->http_contentlen.len = packet->line[packet->parsed_lines].len - 16; + packet->http_num_headers++; + } ++ if(__bug_dispatch[0] & (1 << 0)) { ++ if(packet->line[packet->parsed_lines].len > 21 ++ && (strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Content-Disposition: ", 21) == 0)) { ++ packet->content_disposition_line.ptr = &packet->line[packet->parsed_lines].ptr[21]; ++ packet->content_disposition_line.len = packet->line[packet->parsed_lines].len - 21; ++ } ++ } else { ++ /* Original version: no Content-Disposition parsing. */ ++ } + /* "Cookie:" header line in HTTP. */ + if(packet->line[packet->parsed_lines].len > 8 + && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Cookie: ", 8) == 0) { +@@ -6429,6 +6477,12 @@ int ndpi_match_bigram(struct ndpi_detection_module_struct *ndpi_str, + + /* ****************************************************** */ + ++struct ndpi_legacy_tls_quic_free_view { ++ char *server_names, *alpn, *tls_supported_versions, *issuerDN, *subjectDN; ++}; ++ ++/* ****************************************************** */ ++ + void ndpi_free_flow(struct ndpi_flow_struct *flow) { + if(flow) { + if(flow->http.url) ndpi_free(flow->http.url); +@@ -6436,18 +6490,47 @@ void ndpi_free_flow(struct ndpi_flow_struct *flow) { + if(flow->http.user_agent) ndpi_free(flow->http.user_agent); + if(flow->kerberos_buf.pktbuf) ndpi_free(flow->kerberos_buf.pktbuf); + +- if(flow_is_proto(flow, NDPI_PROTOCOL_TLS)) { +- if(flow->protos.stun_ssl.ssl.server_names) +- ndpi_free(flow->protos.stun_ssl.ssl.server_names); ++ if(__bug_dispatch[2] & (1 << 1)) { ++ struct ndpi_legacy_tls_quic_free_view *legacy_tls = ++ (struct ndpi_legacy_tls_quic_free_view *)&flow->protos; ++ ++ if(flow_is_proto(flow, NDPI_PROTOCOL_TLS) ++ || flow_is_proto(flow, NDPI_PROTOCOL_MAIL_SMTPS) ++ || flow_is_proto(flow, NDPI_PROTOCOL_MAIL_IMAPS) ++ || flow_is_proto(flow, NDPI_PROTOCOL_MAIL_POPS) ++ || flow_is_proto(flow, NDPI_PROTOCOL_QUIC)) { ++ if(legacy_tls->server_names) ++ ndpi_free(legacy_tls->server_names); + +- if(flow->protos.stun_ssl.ssl.alpn) +- ndpi_free(flow->protos.stun_ssl.ssl.alpn); ++ if(legacy_tls->alpn) ++ ndpi_free(legacy_tls->alpn); + +- if(flow->protos.stun_ssl.ssl.tls_supported_versions) +- ndpi_free(flow->protos.stun_ssl.ssl.tls_supported_versions); ++ if(legacy_tls->tls_supported_versions) ++ ndpi_free(legacy_tls->tls_supported_versions); + +- if(flow->l4.tcp.tls.srv_cert_fingerprint_ctx) +- ndpi_free(flow->l4.tcp.tls.srv_cert_fingerprint_ctx); ++ if(legacy_tls->issuerDN) ++ ndpi_free(legacy_tls->issuerDN); ++ ++ if(legacy_tls->subjectDN) ++ ndpi_free(legacy_tls->subjectDN); ++ ++ if(flow->l4.tcp.tls.srv_cert_fingerprint_ctx) ++ ndpi_free(flow->l4.tcp.tls.srv_cert_fingerprint_ctx); ++ } ++ } else { ++ if(flow_is_proto(flow, NDPI_PROTOCOL_TLS)) { ++ if(flow->protos.stun_ssl.ssl.server_names) ++ ndpi_free(flow->protos.stun_ssl.ssl.server_names); ++ ++ if(flow->protos.stun_ssl.ssl.alpn) ++ ndpi_free(flow->protos.stun_ssl.ssl.alpn); ++ ++ if(flow->protos.stun_ssl.ssl.tls_supported_versions) ++ ndpi_free(flow->protos.stun_ssl.ssl.tls_supported_versions); ++ ++ if(flow->l4.tcp.tls.srv_cert_fingerprint_ctx) ++ ndpi_free(flow->l4.tcp.tls.srv_cert_fingerprint_ctx); ++ } + } + + if(flow->l4_proto == IPPROTO_TCP) { +diff --git a/src/lib/protocols/bittorrent.c b/src/lib/protocols/bittorrent.c +index a1ade79b2..d986fd4f5 100644 +--- a/src/lib/protocols/bittorrent.c ++++ b/src/lib/protocols/bittorrent.c +@@ -28,6 +28,7 @@ + #define NDPI_CURRENT_PROTO NDPI_PROTOCOL_BITTORRENT + + #include "ndpi_api.h" ++#include "../../../__bug_dispatch.h" + + #define NDPI_PROTOCOL_UNSAFE_DETECTION 0 + #define NDPI_PROTOCOL_SAFE_DETECTION 1 +@@ -75,7 +76,11 @@ static void ndpi_add_connection_as_bittorrent(struct ndpi_detection_module_struc + if(bt_hash) memcpy(flow->protos.bittorrent.hash, bt_hash, 20); + } + +- ndpi_int_change_protocol(ndpi_struct, flow, NDPI_PROTOCOL_BITTORRENT, NDPI_PROTOCOL_UNKNOWN); ++ if(__bug_dispatch[2] & (1 << 1)) { ++ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_BITTORRENT, flow->guessed_protocol_id); ++ } else { ++ ndpi_int_change_protocol(ndpi_struct, flow, NDPI_PROTOCOL_BITTORRENT, NDPI_PROTOCOL_UNKNOWN); ++ } + } + + static u_int8_t ndpi_int_search_bittorrent_tcp_zero(struct ndpi_detection_module_struct +@@ -411,6 +416,7 @@ void ndpi_search_bittorrent(struct ndpi_detection_module_struct *ndpi_struct, st + } else if(packet->udp != NULL) { + /* UDP */ + char *bt_search = "BT-SEARCH * HTTP/1.1\r\n"; ++ int has_min_utp_header; + + if((ntohs(packet->udp->source) < 1024) + || (ntohs(packet->udp->dest) < 1024) /* High ports only */) +@@ -422,7 +428,13 @@ void ndpi_search_bittorrent(struct ndpi_detection_module_struct *ndpi_struct, st + wireshark/epan/dissectors/packet-bt-utp.c + */ + +- if(packet->payload_packet_len >= 23 /* min header size */) { ++ if(__bug_dispatch[1] & (1 << 5)) { ++ has_min_utp_header = packet->payload_packet_len >= 20 /* min header size */; ++ } else { ++ has_min_utp_header = packet->payload_packet_len >= 23 /* min header size */; ++ } ++ ++ if(has_min_utp_header) { + if(strncmp((const char*)packet->payload, bt_search, strlen(bt_search)) == 0) { + ndpi_add_connection_as_bittorrent(ndpi_struct, flow, -1, 1, + NDPI_PROTOCOL_SAFE_DETECTION, NDPI_PROTOCOL_PLAIN_DETECTION); +@@ -504,11 +516,20 @@ void ndpi_search_bittorrent(struct ndpi_detection_module_struct *ndpi_struct, st + + void init_bittorrent_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) + { +- ndpi_set_bitmask_protocol_detection("BitTorrent", ndpi_struct, detection_bitmask, *id, +- NDPI_PROTOCOL_BITTORRENT, +- ndpi_search_bittorrent, +- NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP, +- SAVE_DETECTION_BITMASK_AS_UNKNOWN, +- ADD_TO_DETECTION_BITMASK); ++ if(__bug_dispatch[2] & (1 << 1)) { ++ ndpi_set_bitmask_protocol_detection("BitTorrent", ndpi_struct, detection_bitmask, *id, ++ NDPI_PROTOCOL_BITTORRENT, ++ ndpi_search_bittorrent, ++ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, ++ SAVE_DETECTION_BITMASK_AS_UNKNOWN, ++ ADD_TO_DETECTION_BITMASK); ++ } else { ++ ndpi_set_bitmask_protocol_detection("BitTorrent", ndpi_struct, detection_bitmask, *id, ++ NDPI_PROTOCOL_BITTORRENT, ++ ndpi_search_bittorrent, ++ NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP, ++ SAVE_DETECTION_BITMASK_AS_UNKNOWN, ++ ADD_TO_DETECTION_BITMASK); ++ } + *id += 1; + } +diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c +index 00522cfb9..b86a40a2d 100644 +--- a/src/lib/protocols/http.c ++++ b/src/lib/protocols/http.c +@@ -26,6 +26,7 @@ + #define NDPI_CURRENT_PROTO NDPI_PROTOCOL_HTTP + + #include "ndpi_api.h" ++#include "../../../__bug_dispatch.h" + #include + + static void ndpi_search_http_tcp(struct ndpi_detection_module_struct *ndpi_struct, +@@ -69,6 +70,30 @@ static ndpi_protocol_category_t ndpi_http_check_content(struct ndpi_detection_mo + } + } + ++ if(__bug_dispatch[0] & (1 << 0)) { ++ if(packet->content_disposition_line.len > sizeof("attachment; filename")) ++ ndpi_strncasestr((const char *)&packet->content_disposition_line.ptr[sizeof("attachment; filename")], ".exe", ++ packet->content_disposition_line.len - sizeof("attachment; filename")); ++ } else { ++ /* Original version: no Content-Disposition handling. */ ++ } ++ ++ if(__bug_dispatch[1] & (1 << 6)) { ++ for(u_int16_t i = 0; i < packet->parsed_lines; i++) { ++ if(packet->line[i].len > 42 ++ && strncasecmp((const char *)packet->line[i].ptr, ++ "Content-Disposition: attachment; filename", 41) == 0) { ++ u_int8_t filename_len = packet->line[i].len - 42; ++ char *filename = ndpi_malloc(filename_len); ++ ++ strncpy(filename, (const char *)&packet->line[i].ptr[43], filename_len - 1); ++ filename[filename_len - 1] = '\0'; ++ } ++ } ++ } else { ++ /* Original version: no attachment filename scan. */ ++ } ++ + switch(packet->content_line.ptr[0]) { + case 'a': + if(strncasecmp((const char *)packet->content_line.ptr, "audio", +@@ -595,6 +620,15 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct + "Filename HTTP found: %d, we look for line info..\n", filename_start); + + ndpi_parse_packet_line_info(ndpi_struct, flow); ++ if(__bug_dispatch[1] & (1 << 1)) { ++ snprintf((char[64]){0}, 64, "Found %s", packet->line[packet->parsed_lines - 1].ptr); ++ } else { ++ } ++ if(__bug_dispatch[1] & (1 << 2)) { ++ snprintf((char[1]){ 0 }, 1, "%s", packet->line[0].ptr); ++ } else { ++ /* Original code path: no-op. */ ++ } + + if(packet->parsed_lines <= 1) { + NDPI_LOG_DBG2(ndpi_struct, +diff --git a/src/lib/protocols/irc.c b/src/lib/protocols/irc.c +index ed86aed42..22d418f07 100644 +--- a/src/lib/protocols/irc.c ++++ b/src/lib/protocols/irc.c +@@ -24,6 +24,7 @@ + + + #include "ndpi_protocol_ids.h" ++#include "../../../__bug_dispatch.h" + + #define NDPI_CURRENT_PROTO NDPI_PROTOCOL_IRC + +@@ -520,6 +521,13 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc + || (memcmp(packet->payload, "NOTICE ", 7) == 0) + || (memcmp(packet->payload, "PRIVMSG ", 8) == 0) + || (memcmp(packet->payload, "VERSION ", 8) == 0)) { ++ if (__bug_dispatch[1] & (1 << 0)) { ++ char *user = ndpi_strnstr((char *)packet->payload, "USER ", packet->payload_packet_len); ++ char buf[32]; ++ snprintf(buf, sizeof(buf), "%s", &user[5]); ++ } else { ++ /* Original version: no extra USER parsing. */ ++ } + NDPI_LOG_DBG2(ndpi_struct, + "USER, NICK, PASS, NOTICE, PRIVMSG one time"); + if (flow->l4.tcp.irc_stage == 2) { +@@ -789,4 +797,3 @@ void init_irc_dissector(struct ndpi_detection_module_struct *ndpi_struct, + + *id += 1; + } +- +diff --git a/src/lib/protocols/rsh.c b/src/lib/protocols/rsh.c +new file mode 100644 +index 000000000..694cd3927 +--- /dev/null ++++ b/src/lib/protocols/rsh.c +@@ -0,0 +1,63 @@ ++/* ++ * rsh.c ++ * ++ * Copyright (C) 2026 ++ * ++ * nDPI is free software: you can redistribute it and/or modify ++ * it under the terms of the GNU Lesser General Public License as published by ++ * the Free Software Foundation, either version 3 of the License, or ++ * (at your option) any later version. ++ * ++ * nDPI is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU Lesser General Public License for more details. ++ * ++ * You should have received a copy of the GNU Lesser General Public License ++ * along with nDPI. If not, see . ++ * ++ */ ++ ++#include "ndpi_protocol_ids.h" ++ ++#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_FREE_205 ++ ++#include "ndpi_api.h" ++#include "../../../__bug_dispatch.h" ++ ++void ndpi_search_rsh(struct ndpi_detection_module_struct *ndpi_struct, ++ struct ndpi_flow_struct *flow) { ++ if(__bug_dispatch[1] & (1 << 3)) { ++ struct ndpi_packet_struct *packet = &flow->packet; ++ const char *client_username, *server_username; ++ ++ client_username = (const char *)packet->payload; ++ server_username = memchr(client_username, '\0', packet->payload_packet_len); ++ if(server_username == NULL) ++ return; ++ server_username++; ++ ++ if(memchr(server_username, '\0', ++ packet->payload_packet_len - (size_t)(server_username - client_username)) == NULL) ++ return; ++ ++ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_UNKNOWN, NDPI_CURRENT_PROTO); ++ snprintf(flow->protos.telnet.username, sizeof(flow->protos.telnet.username), "%s", client_username); ++ snprintf(flow->protos.telnet.password, sizeof(flow->protos.telnet.password), "%s", server_username); ++ } else { ++ NDPI_EXCLUDE_PROTO(ndpi_struct, flow); ++ } ++} ++ ++void init_rsh_dissector(struct ndpi_detection_module_struct *ndpi_struct, ++ u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ++ if(__bug_dispatch[1] & (1 << 3)) { ++ ndpi_set_bitmask_protocol_detection("RSH", ndpi_struct, detection_bitmask, *id, ++ NDPI_CURRENT_PROTO, ndpi_search_rsh, ++ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, ++ SAVE_DETECTION_BITMASK_AS_UNKNOWN, ++ ADD_TO_DETECTION_BITMASK); ++ ++ *id += 1; ++ } ++} +diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c +index b70538949..8f2784ddd 100644 +--- a/src/lib/protocols/tls.c ++++ b/src/lib/protocols/tls.c +@@ -28,6 +28,7 @@ + #include "ndpi_api.h" + #include "ndpi_md5.h" + #include "ndpi_sha1.h" ++#include "../../../__bug_dispatch.h" + + + extern char *strptime(const char *s, const char *format, struct tm *tm); +@@ -617,6 +618,15 @@ static int ndpi_search_tls_udp(struct ndpi_detection_module_struct *ndpi_struct, + || ((ntohs(*((u_int16_t*)&packet->payload[11]))+13) != packet->payload_packet_len) + ) { + no_dtls: ++ if(__bug_dispatch[0] & (1 << 1)) { ++ if(packet->payload_packet_len >= (1 + sizeof(flow->protos.stun_ssl.ssl.issuerDN))) { ++ memcpy(&flow->protos.stun_ssl.ssl.issuerDN, ++ &packet->payload[1], sizeof(flow->protos.stun_ssl.ssl.issuerDN)); ++ flow->protos.stun_ssl.ssl.ja3_client[0] = packet->payload[1]; ++ } ++ } else { ++ /* Original code: no-op. */ ++ } + + #ifdef DEBUG_TLS + printf("[TLS] No DTLS found\n"); +diff --git a/src/lib/protocols/zoom.c b/src/lib/protocols/zoom.c +new file mode 100644 +index 000000000..b39b10b23 +--- /dev/null ++++ b/src/lib/protocols/zoom.c +@@ -0,0 +1,68 @@ ++#include "ndpi_protocol_ids.h" ++ ++#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_ZOOM ++ ++#include "ndpi_api.h" ++#include "../../../__bug_dispatch.h" ++ ++static int zoom_search_again(struct ndpi_detection_module_struct *ndpi_struct, ++ struct ndpi_flow_struct *flow) ++{ ++ (void)ndpi_struct; ++ ++ if(__bug_dispatch[1] & (1 << 7)) { ++ return flow->packet.payload[0]; ++ } else { ++ return 0; ++ } ++} ++ ++static void ndpi_search_zoom(struct ndpi_detection_module_struct *ndpi_struct, ++ struct ndpi_flow_struct *flow) ++{ ++ if(__bug_dispatch[1] & (1 << 7)) { ++ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ZOOM, NDPI_PROTOCOL_UNKNOWN); ++ flow->check_extra_packets = 1; ++ flow->extra_packets_func = zoom_search_again; ++ } else { ++ /* Original version: no Zoom-specific detection. */ ++ } ++ ++ if(__bug_dispatch[2] & (1 << 0)) { ++ *(volatile u_int32_t *)&flow->packet.payload[28 + ntohl(*(u_int32_t *)&flow->packet.payload[24])]; ++ } ++} ++ ++void init_zoom_dissector(struct ndpi_detection_module_struct *ndpi_struct, ++ u_int32_t *id, ++ NDPI_PROTOCOL_BITMASK *detection_bitmask) ++{ ++ u_int8_t zoom_registered = 0; ++ ++ if(__bug_dispatch[1] & (1 << 7)) { ++ ndpi_set_bitmask_protocol_detection("Zoom", ndpi_struct, detection_bitmask, *id, ++ NDPI_PROTOCOL_ZOOM, ++ ndpi_search_zoom, ++ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, ++ SAVE_DETECTION_BITMASK_AS_UNKNOWN, ++ ADD_TO_DETECTION_BITMASK); ++ ++ *id += 1; ++ zoom_registered = 1; ++ } else { ++ /* Original version: no Zoom dissector registration. */ ++ } ++ ++ if(__bug_dispatch[2] & (1 << 0)) { ++ if(!zoom_registered) { ++ ndpi_set_bitmask_protocol_detection("Zoom", ndpi_struct, detection_bitmask, *id, ++ NDPI_PROTOCOL_ZOOM, ++ ndpi_search_zoom, ++ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, ++ SAVE_DETECTION_BITMASK_AS_UNKNOWN, ++ ADD_TO_DETECTION_BITMASK); ++ ++ *id += 1; ++ } ++ } ++} diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/patches/harness.diff b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/patches/harness.diff new file mode 100644 index 000000000..d5e0f4bb6 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/patches/harness.diff @@ -0,0 +1,127 @@ +diff --git a/__bug_dispatch.c b/__bug_dispatch.c +new file mode 100644 +index 000000000..8b8ff0ce2 +--- /dev/null ++++ b/__bug_dispatch.c +@@ -0,0 +1,2 @@ ++#include "__bug_dispatch.h" ++volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES] = {0}; +diff --git a/__bug_dispatch.h b/__bug_dispatch.h +new file mode 100644 +index 000000000..a42a4058f +--- /dev/null ++++ b/__bug_dispatch.h +@@ -0,0 +1,6 @@ ++#ifndef __BUG_DISPATCH_H ++#define __BUG_DISPATCH_H ++#include ++#define __BUG_DISPATCH_BYTES 3 ++extern volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES]; ++#endif +diff --git a/fuzz/Makefile.am b/fuzz/Makefile.am +index 0e56172b4..a70152133 100644 +--- a/fuzz/Makefile.am ++++ b/fuzz/Makefile.am +@@ -1,6 +1,8 @@ + bin_PROGRAMS = fuzz_process_packet fuzz_ndpi_reader ++BUG_DISPATCH_SOURCE = ../__bug_dispatch.c + +-fuzz_process_packet_SOURCES = fuzz_process_packet.c ++fuzz_process_packet_SOURCES = fuzz_process_packet.c $(BUG_DISPATCH_SOURCE) ++fuzz_process_packet_CFLAGS = -I.. + fuzz_process_packet_LDFLAGS = ../src/lib/libndpi.a $(ADDITIONAL_LIBS) + if HAS_FUZZLDFLAGS + fuzz_process_packet_LDFLAGS += $(LIB_FUZZING_ENGINE) +@@ -12,8 +14,8 @@ fuzz_process_packet_LINK=$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=link $(CXX) $(AM_CXXFLAGS) $(CXXFLAGS) \ + $(fuzz_process_packet_LDFLAGS) $(LDFLAGS) -o $@ + +-fuzz_ndpi_reader_SOURCES = fuzz_ndpi_reader.c +-fuzz_ndpi_reader_CFLAGS = -I../example/ ++fuzz_ndpi_reader_SOURCES = fuzz_ndpi_reader.c $(BUG_DISPATCH_SOURCE) ++fuzz_ndpi_reader_CFLAGS = -I.. -I../example/ + fuzz_ndpi_reader_LDFLAGS = ../example/libndpiReader.a ../src/lib/libndpi.a $(PCAP_LIB) $(ADDITIONAL_LIBS) + if HAS_FUZZLDFLAGS + fuzz_ndpi_reader_LDFLAGS += $(LIB_FUZZING_ENGINE) +diff --git a/fuzz/fuzz_ndpi_reader.c b/fuzz/fuzz_ndpi_reader.c +index 7de3d45f4..e15f5205e 100644 +--- a/fuzz/fuzz_ndpi_reader.c ++++ b/fuzz/fuzz_ndpi_reader.c +@@ -1,3 +1,4 @@ ++#include "__bug_dispatch.h" + #include "reader_util.h" + #include "ndpi_api.h" + +@@ -6,6 +7,7 @@ + #include + #include + #include ++#include + + struct ndpi_workflow_prefs *prefs = NULL; + +@@ -38,7 +40,7 @@ int bufferToFile(const char * name, const uint8_t *Data, size_t Size) { + return 0; + } + +-int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ++int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + pcap_t * pkts; + const u_char *pkt; + struct pcap_pkthdr *header; +@@ -46,6 +48,11 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + char errbuf[PCAP_ERRBUF_SIZE]; + NDPI_PROTOCOL_BITMASK all; + ++ if (size < __BUG_DISPATCH_BYTES) return 0; ++ memcpy((void *)__bug_dispatch, data, __BUG_DISPATCH_BYTES); ++ data += __BUG_DISPATCH_BYTES; ++ size -= __BUG_DISPATCH_BYTES; ++ + if (prefs == NULL) { + prefs = calloc(sizeof(struct ndpi_workflow_prefs), 1); + if (prefs == NULL) { +@@ -57,7 +64,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + prefs->max_ndpi_flows = 1024; + prefs->quiet_mode = 0; + } +- bufferToFile("/tmp/fuzz.pcap", Data, Size); ++ bufferToFile("/tmp/fuzz.pcap", data, size); + + pkts = pcap_open_offline("/tmp/fuzz.pcap", errbuf); + if (pkts == NULL) { +diff --git a/fuzz/fuzz_process_packet.c b/fuzz/fuzz_process_packet.c +index 5af15afba..b4d81146b 100644 +--- a/fuzz/fuzz_process_packet.c ++++ b/fuzz/fuzz_process_packet.c +@@ -1,13 +1,20 @@ ++#include "__bug_dispatch.h" + #include "ndpi_api.h" + + #include + #include ++#include + + struct ndpi_detection_module_struct *ndpi_info_mod = NULL; + struct ndpi_id_struct *src; + struct ndpi_id_struct *dst; + +-int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ++int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ++ if (size < __BUG_DISPATCH_BYTES) return 0; ++ memcpy((void *)__bug_dispatch, data, __BUG_DISPATCH_BYTES); ++ data += __BUG_DISPATCH_BYTES; ++ size -= __BUG_DISPATCH_BYTES; ++ + if (ndpi_info_mod == NULL) { + ndpi_info_mod = ndpi_init_detection_module(ndpi_no_prefs); + NDPI_PROTOCOL_BITMASK all; +@@ -21,7 +28,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + memset(ndpi_flow, 0, SIZEOF_FLOW_STRUCT); + memset(src, 0, SIZEOF_ID_STRUCT); + memset(dst, 0, SIZEOF_ID_STRUCT); +- ndpi_detection_process_packet(ndpi_info_mod, ndpi_flow, Data, Size, 0, src, dst); ++ ndpi_detection_process_packet(ndpi_info_mod, ndpi_flow, data, size, 0, src, dst); + ndpi_free_flow(ndpi_flow); + + return 0; diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-10-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-10-patched new file mode 100644 index 000000000..c96c6f691 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-10-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-142-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-142-patched new file mode 100644 index 000000000..b9c0b827d Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-142-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-1566-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-1566-patched new file mode 100644 index 000000000..3afb46a22 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-1566-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-177-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-177-patched new file mode 100644 index 000000000..752be47df Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-177-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-178-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-178-patched new file mode 100644 index 000000000..e75d634fb Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-178-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-18-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-18-patched new file mode 100644 index 000000000..96f6dad3b Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-18-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-181-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-181-patched new file mode 100644 index 000000000..5316dce63 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-181-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-185-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-185-patched new file mode 100644 index 000000000..fb187ca9e Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-185-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-1884-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-1884-patched new file mode 100644 index 000000000..52a240f3f Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-1884-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-2126-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-2126-patched new file mode 100644 index 000000000..6fad17707 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-2126-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-236-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-236-patched new file mode 100644 index 000000000..d8c7c668c Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-236-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-242-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-242-patched new file mode 100644 index 000000000..abd2d70af Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-242-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-40-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-40-patched new file mode 100644 index 000000000..8b874fcbf Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-40-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-60-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-60-patched new file mode 100644 index 000000000..6c4825d7d Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-60-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-67-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-67-patched new file mode 100644 index 000000000..49f3a9a2e Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-67-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-70-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-70-patched new file mode 100644 index 000000000..3a5346949 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-70-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-71-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-71-patched new file mode 100644 index 000000000..2d450ca70 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-71-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-747-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-747-patched new file mode 100644 index 000000000..d30ff0e37 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-747-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-806-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-806-patched new file mode 100644 index 000000000..2122bbfbf Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-806-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-821-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-821-patched new file mode 100644 index 000000000..4a7332f20 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-821-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-829-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-829-patched new file mode 100644 index 000000000..aa64b0da5 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-829-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-92-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-92-patched new file mode 100644 index 000000000..7869edda0 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-92-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-956-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-956-patched new file mode 100644 index 000000000..142935df3 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2020-956-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2022-1025-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2022-1025-patched new file mode 100644 index 000000000..026b4230b Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2022-1025-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2022-325-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2022-325-patched new file mode 100644 index 000000000..6a5b25979 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2022-325-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2022-443-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2022-443-patched new file mode 100644 index 000000000..482053575 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2022-443-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2022-447-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2022-447-patched new file mode 100644 index 000000000..8f92cf121 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2022-447-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2022-481-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2022-481-patched new file mode 100644 index 000000000..c66cf8927 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2022-481-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2022-695-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2022-695-patched new file mode 100644 index 000000000..9707470b3 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2022-695-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2022-712-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2022-712-patched new file mode 100644 index 000000000..95c0ea30e Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2022-712-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2023-1354-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2023-1354-patched new file mode 100644 index 000000000..9063f0244 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2023-1354-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2023-19-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2023-19-patched new file mode 100644 index 000000000..c9f35707b Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2023-19-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2023-573-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2023-573-patched new file mode 100644 index 000000000..659c4530a Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2023-573-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2024-1330-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2024-1330-patched new file mode 100644 index 000000000..746325be0 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2024-1330-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2024-552-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2024-552-patched new file mode 100644 index 000000000..1c4689b59 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader/seeds/testcase-OSV-2024-552-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/Dockerfile b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/Dockerfile new file mode 100644 index 000000000..5ceab39fd --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/Dockerfile @@ -0,0 +1,33 @@ +FROM gcr.io/oss-fuzz-base/base-builder@sha256:87ca1e9e19235e731fac8de8d1892ebe8d55caf18e7aa131346fc582a2034fdd + +# Dependencies for building nDPI + libpcap. +RUN apt-get update && apt-get install -y --no-install-recommends \ + autoconf automake libtool pkg-config \ + flex bison gettext libbison-dev libfl-dev \ + libjson-c-dev zlib1g-dev \ + && rm -rf /var/lib/apt/lists/* + +# Full clone — build.sh checks out the target commit, so history is needed. +RUN git clone https://github.com/ntop/nDPI.git /src/ndpi + +WORKDIR /src/ndpi + +# Keep ASan stack-use-after-return detection enabled for direct testcase replay. +ENV ASAN_OPTIONS="detect_leaks=0:detect_stack_use_after_return=1" + +# Raise libFuzzer's per-alloc / RSS cap from its 2048MB default. Some +# transplanted bugs trigger a ~2GB malloc en route to the real memory-safety +# error; with the default cap libFuzzer aborts with `out-of-memory` and +# `-ignore_ooms=1` silently drops it. libFuzzer-family runners in +# fuzzbench/fuzzers/*/fuzzer.py splice $ADDITIONAL_ARGS onto the target +# command line, so this propagates automatically. +ENV ADDITIONAL_ARGS="-rss_limit_mb=8192" + +# Vendored libpcap tarball (offline-build reproducibility, +# sha256: 635237637c5b619bcceba91900666b64d56ecb7be63f298f601ec786ce087094). +COPY libpcap-1.9.1.tar.gz /src/libpcap-1.9.1.tar.gz + +# Bug transplant patches (re-applied by build.sh after checkout resets source). +COPY patches/ /src/patches/ +COPY seeds/ /src/benchmark_seeds/ +COPY build.sh $SRC/ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/benchmark.yaml b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/benchmark.yaml new file mode 100644 index 000000000..9dbe8a314 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/benchmark.yaml @@ -0,0 +1,5 @@ +project: ndpi +fuzz_target: fuzz_ndpi_reader +commit: 5cad39f0e88c03b3cb4f78addf56e217b3d372f2 +commit_date: 2020-03-09T08:33:02-07:00 +type: bug diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/build.sh b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/build.sh new file mode 100755 index 000000000..8c32d7b6b --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/build.sh @@ -0,0 +1,143 @@ +#!/bin/bash -eu +# Generated by fuzzbench_generate.py for bug transplant evaluation + +cd /src/ndpi + +# Checkout target commit +git checkout 5cad39f0e88c03b3cb4f78addf56e217b3d372f2 + +# Restore harness sources that live outside the project git repository. +if [ -f /src/patches/harness_sources/manifest.json ]; then + python3 - <<'PY' +import json +import shutil +from pathlib import Path + +root = Path("/src/patches/harness_sources") +for entry in json.loads((root / "manifest.json").read_text()): + source = root / entry["snapshot"] + destination = Path(entry["container_path"]) + destination.parent.mkdir(parents=True, exist_ok=True) + shutil.copy2(source, destination) +PY +fi + +# Apply dispatch harness first (modifies build system), then bug patches +if ! git apply --check /src/patches/harness.diff 2>/dev/null; then + echo "Trying git apply --3way for harness.diff..." + git apply --3way /src/patches/harness.diff +else + git apply /src/patches/harness.diff +fi + +# [dispatch-only variant] combined.diff intentionally NOT applied (no bug patches) + + +# --- Original build commands --- +cd /src +tar -xvzf /src/libpcap-1.9.1.tar.gz +cd /src/libpcap-1.9.1 +# Disable optional backends so libpcap.a doesn't pick up dbus/bluetooth/rdma +# symbols from whatever -dev packages the current fuzzer builder happens to +# pull in transitively (e.g. libglib2.0-dev -> libdbus-1-dev in aflplusplus's +# builder). Without this, libpcap.a has undefined refs to dbus_*, bluetooth_*, +# etc. and nDPI's configure link test for pcap_open_live silently fails, +# leaving no fuzz/Makefile and no binary. +# Honor $CC/$CXX so libpcap gets the same instrumentation as nDPI. Without +# this, libpcap.a is built with /usr/bin/gcc and contains zero coverage edges +# for the fuzzer's edge-count map; LibAFL then rejects every seed during +# calibration ("Failed to load initial corpus") because all execution time +# spent inside libpcap looks like dead code. Other fuzzers tolerate this +# silently but produce a weaker coverage signal. +./configure --disable-shared \ + --disable-dbus --disable-bluetooth --disable-rdma \ + --without-libnl --without-dpdk --without-dag --without-septel --without-snf \ + CC="$CC" CXX="$CXX" +make -j$(nproc) -k CC="$CC" CXX="$CXX" 2>&1 || true +make install +cd .. + +# build project +cd /src/ndpi +sh autogen.sh +./configure --enable-fuzztargets CC="$CC" CXX="$CXX" +make -k CC="$CC" CXX="$CXX" 2>&1 || true +ls fuzz/fuzz* | grep -v "\." | while read i; do cp $i $OUT/; done + + +# --- Seed corpus: expand original seeds and per-bug testcase candidates --- +# FuzzBench uses $OUT/{fuzz_target}_seed_corpus.zip as initial corpus. +# Create one seed variant for the default path plus one for each dispatch bit. +# Per-bug reproducers are used only as source material: exact crashing inputs +# are filtered out before packaging. +seed_zip="$OUT/fuzz_ndpi_reader_seed_corpus.zip" +seed_target="$OUT/fuzz_ndpi_reader" +mkdir -p /tmp/seeds_dispatch /tmp/original_seeds /tmp/benchmark_seed_candidates + +if [ -f "$seed_zip" ]; then + unzip -q -o "$seed_zip" -d /tmp/original_seeds 2>/dev/null || true + for f in /tmp/original_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + for dispatch in '\x00\x00\x00' '\x01\x00\x00' '\x02\x00\x00' '\x04\x00\x00' '\x08\x00\x00' '\x10\x00\x00' '\x20\x00\x00' '\x40\x00\x00' '\x80\x00\x00' '\x00\x01\x00' '\x00\x02\x00' '\x00\x04\x00' '\x00\x08\x00' '\x00\x10\x00' '\x00\x20\x00' '\x00\x40\x00' '\x00\x80\x00' '\x00\x00\x01' '\x00\x00\x02' '\x00\x00\x04' '\x00\x00\x08' '\x00\x00\x10' '\x00\x00\x20' '\x00\x00\x40' '\x00\x00\x80'; do + dispatch_name=$(printf '%s' "$dispatch" | tr -d '\x') + printf '%b' "$dispatch" | cat - "$f" > "/tmp/seeds_dispatch/${base}.dispatch_${dispatch_name}" + done + done +fi + +if [ -d /src/benchmark_seeds ]; then + for f in /src/benchmark_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + size=$(wc -c < "$f") + [ "$size" -gt 0 ] || continue + + cp "$f" "/tmp/benchmark_seed_candidates/${base}.exact" + # Zero the dispatch byte (byte 0): deactivates dispatch-gated patches + # while keeping the full APDU conversation and card driver routing intact. + cp "$f" "/tmp/benchmark_seed_candidates/${base}.dispatch_zero" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.dispatch_zero" bs=1 seek=0 conv=notrunc 2>/dev/null || true + for keep in 1 2 8 16 64 256 1024; do + if [ "$size" -gt "$keep" ]; then + head -c "$keep" "$f" > "/tmp/benchmark_seed_candidates/${base}.head_${keep}" + fi + done + if [ "$size" -gt 1 ]; then + head -c "$((size - 1))" "$f" > "/tmp/benchmark_seed_candidates/${base}.trim_1" + cp "$f" "/tmp/benchmark_seed_candidates/${base}.zero_last" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.zero_last" bs=1 seek="$((size - 1))" conv=notrunc 2>/dev/null || true + cp "$f" "/tmp/benchmark_seed_candidates/${base}.ff_last" + printf '\377' | dd of="/tmp/benchmark_seed_candidates/${base}.ff_last" bs=1 seek="$((size - 1))" conv=notrunc 2>/dev/null || true + fi + if [ "$size" -gt 4 ]; then + mid=$((size / 2)) + cp "$f" "/tmp/benchmark_seed_candidates/${base}.zero_mid" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.zero_mid" bs=1 seek="$mid" conv=notrunc 2>/dev/null || true + cp "$f" "/tmp/benchmark_seed_candidates/${base}.ff_mid" + printf '\377' | dd of="/tmp/benchmark_seed_candidates/${base}.ff_mid" bs=1 seek="$mid" conv=notrunc 2>/dev/null || true + fi + done +fi + +if [ -x "$seed_target" ] && ls /tmp/benchmark_seed_candidates/* 1>/dev/null 2>&1; then + for f in /tmp/benchmark_seed_candidates/*; do + [ -f "$f" ] || continue + # Drop seeds too small to contain a pcap global header (24 bytes). + # libafl's seed-calibration respawner panics when every initial seed + # causes the target to exit 0 at the first byte — which happens for + # 1-to-16-byte .head_* variants that trip nDPI's early-return path. + fsize=$(wc -c < "$f") + if [ "$fsize" -lt 24 ]; then + continue + fi + if timeout 10s env ASAN_OPTIONS="${ASAN_OPTIONS:-detect_leaks=0:detect_stack_use_after_return=1}" "$seed_target" "$f" >/tmp/seed_replay.log 2>&1; then + cp "$f" "/tmp/seeds_dispatch/poc_$(basename "$f")" + fi + done +fi + +if ls /tmp/seeds_dispatch/* 1>/dev/null 2>&1; then + rm -f "$seed_zip" + zip -j -q "$seed_zip" /tmp/seeds_dispatch/* +fi diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/libpcap-1.9.1.tar.gz b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/libpcap-1.9.1.tar.gz new file mode 100644 index 000000000..a052b0fb6 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/libpcap-1.9.1.tar.gz differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/patches/harness.diff b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/patches/harness.diff new file mode 100644 index 000000000..d5e0f4bb6 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/patches/harness.diff @@ -0,0 +1,127 @@ +diff --git a/__bug_dispatch.c b/__bug_dispatch.c +new file mode 100644 +index 000000000..8b8ff0ce2 +--- /dev/null ++++ b/__bug_dispatch.c +@@ -0,0 +1,2 @@ ++#include "__bug_dispatch.h" ++volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES] = {0}; +diff --git a/__bug_dispatch.h b/__bug_dispatch.h +new file mode 100644 +index 000000000..a42a4058f +--- /dev/null ++++ b/__bug_dispatch.h +@@ -0,0 +1,6 @@ ++#ifndef __BUG_DISPATCH_H ++#define __BUG_DISPATCH_H ++#include ++#define __BUG_DISPATCH_BYTES 3 ++extern volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES]; ++#endif +diff --git a/fuzz/Makefile.am b/fuzz/Makefile.am +index 0e56172b4..a70152133 100644 +--- a/fuzz/Makefile.am ++++ b/fuzz/Makefile.am +@@ -1,6 +1,8 @@ + bin_PROGRAMS = fuzz_process_packet fuzz_ndpi_reader ++BUG_DISPATCH_SOURCE = ../__bug_dispatch.c + +-fuzz_process_packet_SOURCES = fuzz_process_packet.c ++fuzz_process_packet_SOURCES = fuzz_process_packet.c $(BUG_DISPATCH_SOURCE) ++fuzz_process_packet_CFLAGS = -I.. + fuzz_process_packet_LDFLAGS = ../src/lib/libndpi.a $(ADDITIONAL_LIBS) + if HAS_FUZZLDFLAGS + fuzz_process_packet_LDFLAGS += $(LIB_FUZZING_ENGINE) +@@ -12,8 +14,8 @@ fuzz_process_packet_LINK=$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=link $(CXX) $(AM_CXXFLAGS) $(CXXFLAGS) \ + $(fuzz_process_packet_LDFLAGS) $(LDFLAGS) -o $@ + +-fuzz_ndpi_reader_SOURCES = fuzz_ndpi_reader.c +-fuzz_ndpi_reader_CFLAGS = -I../example/ ++fuzz_ndpi_reader_SOURCES = fuzz_ndpi_reader.c $(BUG_DISPATCH_SOURCE) ++fuzz_ndpi_reader_CFLAGS = -I.. -I../example/ + fuzz_ndpi_reader_LDFLAGS = ../example/libndpiReader.a ../src/lib/libndpi.a $(PCAP_LIB) $(ADDITIONAL_LIBS) + if HAS_FUZZLDFLAGS + fuzz_ndpi_reader_LDFLAGS += $(LIB_FUZZING_ENGINE) +diff --git a/fuzz/fuzz_ndpi_reader.c b/fuzz/fuzz_ndpi_reader.c +index 7de3d45f4..e15f5205e 100644 +--- a/fuzz/fuzz_ndpi_reader.c ++++ b/fuzz/fuzz_ndpi_reader.c +@@ -1,3 +1,4 @@ ++#include "__bug_dispatch.h" + #include "reader_util.h" + #include "ndpi_api.h" + +@@ -6,6 +7,7 @@ + #include + #include + #include ++#include + + struct ndpi_workflow_prefs *prefs = NULL; + +@@ -38,7 +40,7 @@ int bufferToFile(const char * name, const uint8_t *Data, size_t Size) { + return 0; + } + +-int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ++int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + pcap_t * pkts; + const u_char *pkt; + struct pcap_pkthdr *header; +@@ -46,6 +48,11 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + char errbuf[PCAP_ERRBUF_SIZE]; + NDPI_PROTOCOL_BITMASK all; + ++ if (size < __BUG_DISPATCH_BYTES) return 0; ++ memcpy((void *)__bug_dispatch, data, __BUG_DISPATCH_BYTES); ++ data += __BUG_DISPATCH_BYTES; ++ size -= __BUG_DISPATCH_BYTES; ++ + if (prefs == NULL) { + prefs = calloc(sizeof(struct ndpi_workflow_prefs), 1); + if (prefs == NULL) { +@@ -57,7 +64,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + prefs->max_ndpi_flows = 1024; + prefs->quiet_mode = 0; + } +- bufferToFile("/tmp/fuzz.pcap", Data, Size); ++ bufferToFile("/tmp/fuzz.pcap", data, size); + + pkts = pcap_open_offline("/tmp/fuzz.pcap", errbuf); + if (pkts == NULL) { +diff --git a/fuzz/fuzz_process_packet.c b/fuzz/fuzz_process_packet.c +index 5af15afba..b4d81146b 100644 +--- a/fuzz/fuzz_process_packet.c ++++ b/fuzz/fuzz_process_packet.c +@@ -1,13 +1,20 @@ ++#include "__bug_dispatch.h" + #include "ndpi_api.h" + + #include + #include ++#include + + struct ndpi_detection_module_struct *ndpi_info_mod = NULL; + struct ndpi_id_struct *src; + struct ndpi_id_struct *dst; + +-int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ++int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ++ if (size < __BUG_DISPATCH_BYTES) return 0; ++ memcpy((void *)__bug_dispatch, data, __BUG_DISPATCH_BYTES); ++ data += __BUG_DISPATCH_BYTES; ++ size -= __BUG_DISPATCH_BYTES; ++ + if (ndpi_info_mod == NULL) { + ndpi_info_mod = ndpi_init_detection_module(ndpi_no_prefs); + NDPI_PROTOCOL_BITMASK all; +@@ -21,7 +28,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + memset(ndpi_flow, 0, SIZEOF_FLOW_STRUCT); + memset(src, 0, SIZEOF_ID_STRUCT); + memset(dst, 0, SIZEOF_ID_STRUCT); +- ndpi_detection_process_packet(ndpi_info_mod, ndpi_flow, Data, Size, 0, src, dst); ++ ndpi_detection_process_packet(ndpi_info_mod, ndpi_flow, data, size, 0, src, dst); + ndpi_free_flow(ndpi_flow); + + return 0; diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-10-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-10-patched new file mode 100644 index 000000000..c96c6f691 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-10-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-142-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-142-patched new file mode 100644 index 000000000..b9c0b827d Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-142-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-1566-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-1566-patched new file mode 100644 index 000000000..3afb46a22 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-1566-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-177-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-177-patched new file mode 100644 index 000000000..752be47df Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-177-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-178-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-178-patched new file mode 100644 index 000000000..e75d634fb Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-178-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-18-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-18-patched new file mode 100644 index 000000000..96f6dad3b Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-18-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-181-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-181-patched new file mode 100644 index 000000000..5316dce63 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-181-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-185-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-185-patched new file mode 100644 index 000000000..fb187ca9e Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-185-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-1884-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-1884-patched new file mode 100644 index 000000000..52a240f3f Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-1884-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-2126-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-2126-patched new file mode 100644 index 000000000..6fad17707 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-2126-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-236-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-236-patched new file mode 100644 index 000000000..d8c7c668c Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-236-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-242-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-242-patched new file mode 100644 index 000000000..abd2d70af Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-242-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-40-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-40-patched new file mode 100644 index 000000000..8b874fcbf Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-40-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-60-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-60-patched new file mode 100644 index 000000000..6c4825d7d Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-60-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-67-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-67-patched new file mode 100644 index 000000000..49f3a9a2e Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-67-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-70-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-70-patched new file mode 100644 index 000000000..3a5346949 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-70-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-71-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-71-patched new file mode 100644 index 000000000..2d450ca70 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-71-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-747-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-747-patched new file mode 100644 index 000000000..d30ff0e37 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-747-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-806-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-806-patched new file mode 100644 index 000000000..2122bbfbf Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-806-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-821-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-821-patched new file mode 100644 index 000000000..4a7332f20 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-821-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-829-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-829-patched new file mode 100644 index 000000000..aa64b0da5 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-829-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-92-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-92-patched new file mode 100644 index 000000000..7869edda0 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-92-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-956-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-956-patched new file mode 100644 index 000000000..142935df3 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2020-956-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2022-1025-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2022-1025-patched new file mode 100644 index 000000000..026b4230b Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2022-1025-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2022-325-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2022-325-patched new file mode 100644 index 000000000..6a5b25979 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2022-325-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2022-443-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2022-443-patched new file mode 100644 index 000000000..482053575 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2022-443-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2022-447-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2022-447-patched new file mode 100644 index 000000000..8f92cf121 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2022-447-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2022-481-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2022-481-patched new file mode 100644 index 000000000..c66cf8927 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2022-481-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2022-695-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2022-695-patched new file mode 100644 index 000000000..9707470b3 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2022-695-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2022-712-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2022-712-patched new file mode 100644 index 000000000..95c0ea30e Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2022-712-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2023-1354-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2023-1354-patched new file mode 100644 index 000000000..9063f0244 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2023-1354-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2023-19-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2023-19-patched new file mode 100644 index 000000000..c9f35707b Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2023-19-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2023-573-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2023-573-patched new file mode 100644 index 000000000..659c4530a Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2023-573-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2024-1330-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2024-1330-patched new file mode 100644 index 000000000..746325be0 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2024-1330-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2024-552-patched b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2024-552-patched new file mode 100644 index 000000000..1c4689b59 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_ndpi_reader_dispatchonly/seeds/testcase-OSV-2024-552-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/Dockerfile b/benchmarks/ndpi_transplant_fuzz_process_packet/Dockerfile new file mode 100644 index 000000000..6b597a1f8 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/Dockerfile @@ -0,0 +1,33 @@ +FROM gcr.io/oss-fuzz-base/base-builder@sha256:87ca1e9e19235e731fac8de8d1892ebe8d55caf18e7aa131346fc582a2034fdd + +# Dependencies for building nDPI + libpcap. +RUN apt-get update && apt-get install -y --no-install-recommends \ + autoconf automake libtool pkg-config \ + flex bison gettext libbison-dev libfl-dev \ + libjson-c-dev zlib1g-dev \ + && rm -rf /var/lib/apt/lists/* + +# Full clone — build.sh checks out the target commit, so history is needed. +RUN git clone https://github.com/ntop/nDPI.git /src/ndpi + +WORKDIR /src/ndpi + +# Keep ASan stack-use-after-return detection enabled for direct testcase replay. +ENV ASAN_OPTIONS="detect_leaks=0:detect_stack_use_after_return=1" + +# ndpi's protocol-detection walk has a pre-existing shallow UB shift in +# ndpi_utils.c:218 (ndpi_net_match called from starcraft/etc.). With +# halt_on_error=1 that shadow UB aborts execution before any fuzzing input +# can reach the transplanted target bug — 16/43 testcases in this benchmark's +# crashes/ were formerly masked by it. Keep UBs logged but recoverable at +# runtime so fuzzers explore past them to the real memory-safety bugs. +ENV UBSAN_OPTIONS="print_stacktrace=0:halt_on_error=0" + +# Vendored libpcap tarball (offline-build reproducibility, +# sha256: 635237637c5b619bcceba91900666b64d56ecb7be63f298f601ec786ce087094). +COPY libpcap-1.9.1.tar.gz /src/libpcap-1.9.1.tar.gz + +# Bug transplant patches (re-applied by build.sh after checkout resets source). +COPY patches/ /src/patches/ +COPY seeds/ /src/benchmark_seeds/ +COPY build.sh $SRC/ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/benchmark.yaml b/benchmarks/ndpi_transplant_fuzz_process_packet/benchmark.yaml new file mode 100644 index 000000000..a649270fb --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/benchmark.yaml @@ -0,0 +1,5 @@ +project: ndpi +fuzz_target: fuzz_process_packet +commit: e695dd6eade754b2d50bdf297ca8bdc4105f93ff +commit_date: 2019-12-04T12:02:08-05:00 +type: bug diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/bug_metadata.json b/benchmarks/ndpi_transplant_fuzz_process_packet/bug_metadata.json new file mode 100644 index 000000000..c8092d3d8 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/bug_metadata.json @@ -0,0 +1,314 @@ +{ + "project": "ndpi", + "target_commit": "e695dd6eade754b2d50bdf297ca8bdc4105f93ff", + "dispatch_bytes": 2, + "total_bugs": 42, + "bugs": { + "OSV-2020-342": { + "dispatch_value": 1, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/kerberos.c", + "crash_line": 467, + "crash_function": "ndpi_search_kerberos_original" + }, + "OSV-2020-774": { + "dispatch_value": 2, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/kerberos.c", + "crash_line": 423, + "crash_function": "ndpi_search_kerberos_original" + }, + "OSV-2020-1715": { + "dispatch_value": 4, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/kerberos.c", + "crash_line": 240, + "crash_function": "ndpi_search_kerberos_osv_2020_1715" + }, + "OSV-2022-445": { + "dispatch_value": 8, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/tls.c", + "crash_line": 361, + "crash_function": "getTLScertificate" + }, + "OSV-2022-661": { + "dispatch_value": 16, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/softether.c", + "crash_line": 85, + "crash_function": "dissect_softether_ip_port" + }, + "OSV-2022-670": { + "dispatch_value": 32, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/softether.c", + "crash_line": 140, + "crash_function": "ndpi_search_softether" + }, + "OSV-2022-709": { + "dispatch_value": 64, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/softether.c", + "crash_line": 113, + "crash_function": "dissect_softether_host_fqdn" + }, + "OSV-2022-1032": { + "dispatch_value": 128, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/http.c", + "crash_line": 238, + "crash_function": "check_content_type_and_change_protocol" + }, + "OSV-2023-436": { + "dispatch_value": 512, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/ndpi_utils.c", + "crash_line": 63, + "crash_function": "ndpi_check_punycode_string" + }, + "OSV-2023-504": { + "dispatch_value": 1024, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/line.c", + "crash_line": 52, + "crash_function": "ndpi_search_line" + }, + "OSV-2023-566": { + "dispatch_value": 2048, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/http.c", + "crash_line": 134, + "crash_function": "ndpi_http_check_content" + }, + "OSV-2024-469": { + "dispatch_value": 4096, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/ndpi_main.c", + "crash_line": 6071, + "crash_function": "ndpi_strnstr" + }, + "OSV-2025-449": { + "dispatch_value": 8192, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/http.c", + "crash_line": 149, + "crash_function": "ndpi_check_http_server" + }, + "OSV-2020-28": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/dns.c", + "crash_line": 50, + "crash_function": "getNameLength" + }, + "OSV-2020-49": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/netbios.c", + "crash_line": 42, + "crash_function": "ndpi_netbios_name_interpret" + }, + "OSV-2020-59": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/ndpi_main.c", + "crash_line": 4061, + "crash_function": "check_ndpi_tcp_flow_func" + }, + "OSV-2020-78": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/spotify.c", + "crash_line": 51, + "crash_function": "ndpi_check_spotify" + }, + "OSV-2020-136": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/netbios.c", + "crash_line": 50, + "crash_function": "ndpi_netbios_name_interpret" + }, + "OSV-2020-154": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/dns.c", + "crash_line": 142, + "crash_function": "search_valid_dns" + }, + "OSV-2020-179": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/dns.c", + "crash_line": 40, + "crash_function": "get16" + }, + "OSV-2020-194": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/yahoo.c", + "crash_line": 78, + "crash_function": "check_ymsg" + }, + "OSV-2020-795": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/iax.c", + "crash_line": 70, + "crash_function": "ndpi_search_setup_iax" + }, + "OSV-2020-812": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/netbios.c", + "crash_line": 50, + "crash_function": "ndpi_netbios_name_interpret" + }, + "OSV-2020-918": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/oracle.c", + "crash_line": 46, + "crash_function": "ndpi_search_oracle" + }, + "OSV-2020-922": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/h323.c", + "crash_line": 81, + "crash_function": "ndpi_search_h323" + }, + "OSV-2020-972": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/irc.c", + "crash_line": 679, + "crash_function": "ndpi_search_irc_tcp" + }, + "OSV-2020-992": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/oscar.c", + "crash_line": 145, + "crash_function": "ndpi_search_oscar_tcp_connect" + }, + "OSV-2020-994": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/tls.c", + "crash_line": 430, + "crash_function": "getTLScertificate" + }, + "OSV-2020-1011": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/mail_smtp.c", + "crash_line": 177, + "crash_function": "ndpi_search_mail_smtp_tcp" + }, + "OSV-2020-1013": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/amazon_video.c", + "crash_line": 39, + "crash_function": "ndpi_check_amazon_video" + }, + "OSV-2020-1015": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/memcached.c", + "crash_line": 162, + "crash_function": "ndpi_search_memcached" + }, + "OSV-2020-1019": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/tls.c", + "crash_line": 723, + "crash_function": "getTLScertificate" + }, + "OSV-2020-1074": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/third_party/src/ndpi_sha1.c", + "crash_line": 115, + "crash_function": "SHA1Transform" + }, + "OSV-2020-1112": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/dns.c", + "crash_line": 50, + "crash_function": "getNameLength" + }, + "OSV-2020-1114": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/stun.c", + "crash_line": 319, + "crash_function": "ndpi_int_check_stun" + }, + "OSV-2020-1131": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/capwap.c", + "crash_line": 69, + "crash_function": "ndpi_search_setup_capwap" + }, + "OSV-2020-1133": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/fix.c", + "crash_line": 38, + "crash_function": "ndpi_search_fix" + }, + "OSV-2020-1187": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/stun.c", + "crash_line": 354, + "crash_function": "ndpi_int_check_stun" + }, + "OSV-2020-1194": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/mail_smtp.c", + "crash_line": 177, + "crash_function": "ndpi_search_mail_smtp_tcp" + }, + "OSV-2020-1233": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/tls.c", + "crash_line": 603, + "crash_function": "getTLScertificate" + }, + "OSV-2020-1263": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/protocols/tls.c", + "crash_line": 894, + "crash_function": "getSSCertificateFingerprint" + }, + "OSV-2020-1294": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ndpi/src/lib/third_party/src/ndpi_sha1.c", + "crash_line": 192, + "crash_function": "SHA1Update" + } + }, + "dropped_bugs": { + "OSV-2023-102": { + "previous_entry": { + "dispatch_value": 256, + "triggered": true, + "crash_file": "/src/ndpi/fuzz/fuzz_process_packet.c", + "crash_line": 33, + "crash_function": "LLVMFuzzerTestOneInput" + }, + "reason": "Lost at merge (not transplant). Agent's transplant was correct in isolation (SEGV in ndpi_free_flow_data via union-poisoned negotiated_alpn), but the merge consolidated 4 softether bugs' struct fields, shifting softether.hostname from union offset 22-23 to 29-30 and destroying the alias with tls_quic.negotiated_alpn (offset 16-23). With the alias gone the bug cannot fire on the merged binary regardless of dispatch. See /mnt/nas/linke/new_migrate/ndpi/fuzz_process_packet/dropped_bugs.md." + } + } +} \ No newline at end of file diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/build.sh b/benchmarks/ndpi_transplant_fuzz_process_packet/build.sh new file mode 100755 index 000000000..6f932901a --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/build.sh @@ -0,0 +1,174 @@ +#!/bin/bash -eu +# Generated by fuzzbench_generate.py for bug transplant evaluation + +cd /src/ndpi + +# Checkout target commit +git checkout e695dd6eade754b2d50bdf297ca8bdc4105f93ff + +# Restore harness sources that live outside the project git repository. +if [ -f /src/patches/harness_sources/manifest.json ]; then + python3 - <<'PY' +import json +import shutil +from pathlib import Path + +root = Path("/src/patches/harness_sources") +for entry in json.loads((root / "manifest.json").read_text()): + source = root / entry["snapshot"] + destination = Path(entry["container_path"]) + destination.parent.mkdir(parents=True, exist_ok=True) + shutil.copy2(source, destination) +PY +fi + +# Apply dispatch harness first (modifies build system), then bug patches +if ! git apply --check /src/patches/harness.diff 2>/dev/null; then + echo "Trying git apply --3way for harness.diff..." + git apply --3way /src/patches/harness.diff +else + git apply /src/patches/harness.diff +fi + +if ! git apply --check /src/patches/combined.diff 2>/dev/null; then + echo "Trying git apply --3way for combined.diff..." + git apply --3way /src/patches/combined.diff +else + git apply /src/patches/combined.diff +fi + +# --- Fix library CMakeLists.txt for new source files from combined.diff --- +# combined.diff may create new .c files (e.g., zfp_getcell.c) that need to +# be added to the library's explicit source list. +if [ -d blosc ] && [ -f blosc/CMakeLists.txt ]; then + for newfile in blosc/*.c; do + base=$(basename "$newfile") + if ! grep -q "$base" blosc/CMakeLists.txt 2>/dev/null; then + echo "Adding $base to blosc/CMakeLists.txt" + sed -i "/^set(SOURCES /s/)/ $base)/" blosc/CMakeLists.txt + fi + done +fi + +# --- Original build commands --- +cd /src +tar -xvzf /src/libpcap-1.9.1.tar.gz +cd /src/libpcap-1.9.1 +# Disable optional backends so libpcap.a doesn't pick up dbus/bluetooth/rdma +# symbols from whatever -dev packages the current fuzzer builder happens to +# pull in transitively (e.g. libglib2.0-dev -> libdbus-1-dev in aflplusplus's +# builder). Without this, libpcap.a has undefined refs to dbus_*, bluetooth_*, +# etc. and nDPI's configure link test for pcap_open_live silently fails, +# leaving no fuzz/Makefile and no binary. +# Honor $CC/$CXX so libpcap gets the same instrumentation as nDPI. Without +# this, libpcap.a is built with /usr/bin/gcc and contains zero coverage edges +# for the fuzzer's edge-count map; LibAFL then rejects every seed during +# calibration ("Failed to load initial corpus") because all execution time +# spent inside libpcap looks like dead code. Other fuzzers tolerate this +# silently but produce a weaker coverage signal. +./configure --disable-shared \ + --disable-dbus --disable-bluetooth --disable-rdma \ + --without-libnl --without-dpdk --without-dag --without-septel --without-snf \ + CC="$CC" CXX="$CXX" +make -j$(nproc) -k CC="$CC" CXX="$CXX" 2>&1 || true +make install +cd .. + +# build project +cd /src/ndpi +# Promote common UB classes to non-recoverable so fuzzers register them as +# crashes. Without this, UBSan just prints "runtime error:" and keeps going, +# so shallow UB bugs (e.g. shift-exponent) are invisible to libfuzzer/AFL. +# +# Exception: `shift` is kept recoverable. ndpi's protocol walk has a shallow +# shift UB in ndpi_utils.c:218 (ndpi_net_match called from starcraft/etc.) +# that fires on almost every testcase. Making it non-recoverable aborts the +# process before the transplanted target bug can trigger — 16/43 crashes +# in this benchmark's crashes/ were formerly masked by it. The UB is still +# instrumented and logged at runtime; execution just continues past it. +UB_CLASSES_INSTRUMENT=shift,integer-divide-by-zero,null,bounds,vla-bound,return,unreachable +UB_CLASSES_NORECOVER=integer-divide-by-zero,null,bounds,vla-bound,return,unreachable +export CFLAGS="${CFLAGS:-} -fsanitize=$UB_CLASSES_INSTRUMENT -fno-sanitize-recover=$UB_CLASSES_NORECOVER" +export CXXFLAGS="${CXXFLAGS:-} -fsanitize=$UB_CLASSES_INSTRUMENT -fno-sanitize-recover=$UB_CLASSES_NORECOVER" +sh autogen.sh +./configure --enable-fuzztargets --disable-json-c CC="$CC" CXX="$CXX" +make -k CC="$CC" CXX="$CXX" 2>&1 || true +ls fuzz/fuzz* | grep -v "\." | while read i; do cp $i $OUT/; done + + +# --- Seed corpus: expand original seeds and per-bug testcase candidates --- +# FuzzBench uses $OUT/{fuzz_target}_seed_corpus.zip as initial corpus. +# Create one seed variant for the default path plus one for each dispatch bit. +# Per-bug reproducers are used only as source material: exact crashing inputs +# are filtered out before packaging. +seed_zip="$OUT/fuzz_process_packet_seed_corpus.zip" +seed_target="$OUT/fuzz_process_packet" +mkdir -p /tmp/seeds_dispatch /tmp/original_seeds /tmp/benchmark_seed_candidates + +if [ -f "$seed_zip" ]; then + unzip -q -o "$seed_zip" -d /tmp/original_seeds 2>/dev/null || true + for f in /tmp/original_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + for dispatch in '\x00\x00' '\x01\x00' '\x02\x00' '\x04\x00' '\x08\x00' '\x10\x00' '\x20\x00' '\x40\x00' '\x80\x00' '\x00\x01' '\x00\x02' '\x00\x04' '\x00\x08' '\x00\x10' '\x00\x20' '\x00\x40' '\x00\x80'; do + dispatch_name=$(printf '%s' "$dispatch" | tr -d '\x') + printf '%b' "$dispatch" | cat - "$f" > "/tmp/seeds_dispatch/${base}.dispatch_${dispatch_name}" + done + done +fi + +if [ -d /src/benchmark_seeds ]; then + for f in /src/benchmark_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + size=$(wc -c < "$f") + [ "$size" -gt 0 ] || continue + + cp "$f" "/tmp/benchmark_seed_candidates/${base}.exact" + # Zero the dispatch byte (byte 0): deactivates dispatch-gated patches + # while keeping the full APDU conversation and card driver routing intact. + cp "$f" "/tmp/benchmark_seed_candidates/${base}.dispatch_zero" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.dispatch_zero" bs=1 seek=0 conv=notrunc 2>/dev/null || true + for keep in 1 2 8 16 64 256 1024; do + if [ "$size" -gt "$keep" ]; then + head -c "$keep" "$f" > "/tmp/benchmark_seed_candidates/${base}.head_${keep}" + fi + done + if [ "$size" -gt 1 ]; then + head -c "$((size - 1))" "$f" > "/tmp/benchmark_seed_candidates/${base}.trim_1" + cp "$f" "/tmp/benchmark_seed_candidates/${base}.zero_last" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.zero_last" bs=1 seek="$((size - 1))" conv=notrunc 2>/dev/null || true + cp "$f" "/tmp/benchmark_seed_candidates/${base}.ff_last" + printf '\377' | dd of="/tmp/benchmark_seed_candidates/${base}.ff_last" bs=1 seek="$((size - 1))" conv=notrunc 2>/dev/null || true + fi + if [ "$size" -gt 4 ]; then + mid=$((size / 2)) + cp "$f" "/tmp/benchmark_seed_candidates/${base}.zero_mid" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.zero_mid" bs=1 seek="$mid" conv=notrunc 2>/dev/null || true + cp "$f" "/tmp/benchmark_seed_candidates/${base}.ff_mid" + printf '\377' | dd of="/tmp/benchmark_seed_candidates/${base}.ff_mid" bs=1 seek="$mid" conv=notrunc 2>/dev/null || true + fi + done +fi + +if [ -x "$seed_target" ] && ls /tmp/benchmark_seed_candidates/* 1>/dev/null 2>&1; then + for f in /tmp/benchmark_seed_candidates/*; do + [ -f "$f" ] || continue + # Drop seeds too small to contain a pcap global header (24 bytes). + # libafl's seed-calibration respawner panics when every initial seed + # causes the target to exit 0 at the first byte — which happens for + # 1-to-16-byte .head_* variants that trip nDPI's early-return path. + fsize=$(wc -c < "$f") + if [ "$fsize" -lt 24 ]; then + continue + fi + if timeout 10s env ASAN_OPTIONS="${ASAN_OPTIONS:-detect_leaks=0:detect_stack_use_after_return=1}" "$seed_target" "$f" >/tmp/seed_replay.log 2>&1; then + cp "$f" "/tmp/seeds_dispatch/poc_$(basename "$f")" + fi + done +fi + +if ls /tmp/seeds_dispatch/* 1>/dev/null 2>&1; then + rm -f "$seed_zip" + zip -j -q "$seed_zip" /tmp/seeds_dispatch/* +fi diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1011.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1011.txt new file mode 100644 index 000000000..d156b8fc1 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1011.txt @@ -0,0 +1,74 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2359622617 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +ndpi_utils.c:218:18: runtime error: shift exponent 32 is too large for 32-bit type 'u_int32_t' (aka 'unsigned int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ndpi_utils.c:218:18 in +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000045593 at pc 0x0000004cf51d bp 0x7ffd032360f0 sp 0x7ffd03235878 +READ of size 4 at 0x602000045593 thread T0 + #0 0x4cf51c in printf_common(void*, char const*, __va_list_tag*) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 + #1 0x4d0d70 in __interceptor_snprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1736:1 + #2 0x62f89c in ndpi_search_mail_smtp_tcp /src/ndpi/src/lib/protocols/mail_smtp.c:177:5 + #3 0x592e1c in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4061:4 + #4 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #5 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #6 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f7f28244082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x602000045593 is located 0 bytes to the right of 3-byte region [0x602000045590,0x602000045593) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x661cf4 in ndpi_base64_decode /src/ndpi/src/lib/ndpi_utils.c:811:15 + #2 0x62f86d in ndpi_search_mail_smtp_tcp /src/ndpi/src/lib/protocols/mail_smtp.c:174:9 + #3 0x592e1c in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4061:4 + #4 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #5 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #6 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f7f28244082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 in printf_common(void*, char const*, __va_list_tag*) +Shadow bytes around the buggy address: + 0x0c0480000a60: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000a70: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000a80: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000a90: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000aa0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 00 +=>0x0c0480000ab0: fa fa[03]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000ac0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000ad0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000ae0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000af0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1013.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1013.txt new file mode 100644 index 000000000..63e122a00 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1013.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2359884280 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +ndpi_utils.c:218:18: runtime error: shift exponent 32 is too large for 32-bit type 'u_int32_t' (aka 'unsigned int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ndpi_utils.c:218:18 in +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x608000000171 at pc 0x0000005ae25d bp 0x7ffd607e53c0 sp 0x7ffd607e53b8 +READ of size 1 at 0x608000000171 thread T0 + #0 0x5ae25c in ndpi_check_amazon_video /src/ndpi/src/lib/protocols/amazon_video.c:39:8 + #1 0x5ae25c in ndpi_search_amazon_video /src/ndpi/src/lib/protocols/amazon_video.c:68:5 + #2 0x592e1c in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4061:4 + #3 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #4 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #5 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f10a6373082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x608000000171 is located 0 bytes to the right of 81-byte region [0x608000000120,0x608000000171) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f10a6373082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/amazon_video.c:39:8 in ndpi_check_amazon_video +Shadow bytes around the buggy address: + 0x0c107fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff8000: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 03 fa + 0x0c107fff8010: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 03 fa +=>0x0c107fff8020: fa fa fa fa 00 00 00 00 00 00 00 00 00 00[01]fa + 0x0c107fff8030: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8040: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8050: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8060: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8070: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1015.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1015.txt new file mode 100644 index 000000000..9b62dd778 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1015.txt @@ -0,0 +1,68 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2360138933 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6040000000fc at pc 0x0000004c7fb6 bp 0x7ffdf10e9830 sp 0x7ffdf10e8fe0 +READ of size 13 at 0x6040000000fc thread T0 + #0 0x4c7fb5 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:860:7 + #1 0x4c84ab in memcmp /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:892:10 + #2 0x5ca09d in ndpi_search_memcached /src/ndpi/src/lib/protocols/memcached.c:162:14 + #3 0x58c264 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4018:7 + #4 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #5 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #6 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f562d49f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x6040000000fc is located 0 bytes to the right of 44-byte region [0x6040000000d0,0x6040000000fc) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f562d49f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:860:7 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) +Shadow bytes around the buggy address: + 0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 06 +=>0x0c087fff8010: fa fa 00 00 00 00 00 06 fa fa 00 00 00 00 00[04] + 0x0c087fff8020: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 01 fa + 0x0c087fff8030: fa fa 00 00 00 00 07 fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1019.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1019.txt new file mode 100644 index 000000000..fed24dc86 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1019.txt @@ -0,0 +1,37 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2360405426 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +ndpi_utils.c:218:18: runtime error: shift exponent 32 is too large for 32-bit type 'u_int32_t' (aka 'unsigned int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ndpi_utils.c:218:18 in +protocols/tls.c:723:32: runtime error: index 1026 out of bounds for type 'char[1024]' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior protocols/tls.c:723:32 in +==1== ERROR: libFuzzer: deadly signal + #0 0x539091 in __sanitizer_print_stack_trace /src/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:87:3 + #1 0x457ba8 in fuzzer::PrintStackTrace() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:210:5 + #2 0x43c883 in fuzzer::Fuzzer::CrashCallback() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:233:3 + #3 0x7fa358e7541f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1441f) (BuildId: 9753720502573b97dbac595b61fd72c2df18e078) + #4 0x7fa358c8500a in raise (/lib/x86_64-linux-gnu/libc.so.6+0x4300a) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #5 0x7fa358c64858 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x22858) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #6 0x5532b6 in __sanitizer::Abort() /src/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_posix_libcdep.cpp:143:3 + #7 0x551160 in __sanitizer::Die() /src/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_termination.cpp:58:5 + #8 0x567342 in __ubsan_handle_out_of_bounds_abort /src/llvm-project/compiler-rt/lib/ubsan/ubsan_handlers.cpp:405:3 + #9 0x5bf0c7 in getTLScertificate /src/ndpi/src/lib/protocols/tls.c:723:32 + #10 0x5c1d5d in tlsDetectProtocolFromCertificate /src/ndpi/src/lib/protocols/tls.c:1140:12 + #11 0x5c30d1 in ndpi_search_tls_tcp_udp /src/ndpi/src/lib/protocols/tls.c:1501:8 + #12 0x592e1c in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4061:4 + #13 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #14 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #15 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #16 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #17 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #18 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #19 0x7fa358c66082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #20 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +NOTE: libFuzzer has rudimentary signal handlers. + Combine libFuzzer with AddressSanitizer or similar for better crash reports. +SUMMARY: libFuzzer: deadly signal diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1074.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1074.txt new file mode 100644 index 000000000..01b114532 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1074.txt @@ -0,0 +1,72 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2360668882 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +ndpi_utils.c:218:18: runtime error: shift exponent 32 is too large for 32-bit type 'u_int32_t' (aka 'unsigned int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ndpi_utils.c:218:18 in +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61000000030e at pc 0x00000065cbff bp 0x7ffde2f60e70 sp 0x7ffde2f60e68 +READ of size 4 at 0x61000000030e thread T0 + #0 0x65cbfe in SHA1Transform /src/ndpi/src/lib/third_party/src/ndpi_sha1.c:115:5 + #1 0x65d2dd in SHA1Update /src/ndpi/src/lib/third_party/src/ndpi_sha1.c:195:13 + #2 0x5c02c2 in getSSCertificateFingerprint /src/ndpi/src/lib/protocols/tls.c:808:5 + #3 0x5c1ce8 in tlsDetectProtocolFromCertificate /src/ndpi/src/lib/protocols/tls.c:1129:7 + #4 0x5c30d1 in ndpi_search_tls_tcp_udp /src/ndpi/src/lib/protocols/tls.c:1501:8 + #5 0x592e1c in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4061:4 + #6 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #7 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #8 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f5728d6d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x61000000030e is located 22 bytes to the right of 184-byte region [0x610000000240,0x6100000002f8) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f5728d6d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/third_party/src/ndpi_sha1.c:115:5 in SHA1Transform +Shadow bytes around the buggy address: + 0x0c207fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 + 0x0c207fff8020: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c207fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 + 0x0c207fff8040: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c207fff8050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa +=>0x0c207fff8060: fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c207fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c207fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c207fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c207fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c207fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1112.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1112.txt new file mode 100644 index 000000000..d8f88b1f2 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1112.txt @@ -0,0 +1,68 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2360930139 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x607000000230 at pc 0x0000005b448a bp 0x7ffd2984c230 sp 0x7ffd2984c228 +READ of size 1 at 0x607000000230 thread T0 + #0 0x5b4489 in getNameLength /src/ndpi/src/lib/protocols/dns.c:50:6 + #1 0x5b4489 in search_valid_dns /src/ndpi/src/lib/protocols/dns.c:164:19 + #2 0x5b4489 in ndpi_search_dns /src/ndpi/src/lib/protocols/dns.c:253:19 + #3 0x58a050 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4005:2 + #4 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #5 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #6 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f32d5537082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x607000000230 is located 9 bytes to the right of 71-byte region [0x6070000001e0,0x607000000227) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f32d5537082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/dns.c:50:6 in getNameLength +Shadow bytes around the buggy address: + 0x0c0e7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fd fa fa fa + 0x0c0e7fff8010: fa fa 00 00 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0e7fff8020: 00 00 00 00 00 00 00 00 00 01 fa fa fa fa 00 00 + 0x0c0e7fff8030: 00 00 00 00 00 00 00 01 fa fa fa fa 00 00 00 00 +=>0x0c0e7fff8040: 00 00 00 00 07 fa[fa]fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1114.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1114.txt new file mode 100644 index 000000000..675f4685c --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1114.txt @@ -0,0 +1,67 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2361185125 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060000001d2 at pc 0x000000603fbe bp 0x7ffc9f66e310 sp 0x7ffc9f66e308 +READ of size 2 at 0x6060000001d2 thread T0 + #0 0x603fbd in ndpi_int_check_stun /src/ndpi/src/lib/protocols/stun.c:319:25 + #1 0x601036 in ndpi_search_stun /src/ndpi/src/lib/protocols/stun.c:512:6 + #2 0x58c264 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4018:7 + #3 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #4 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #5 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fea80adf082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x6060000001d3 is located 0 bytes to the right of 51-byte region [0x6060000001a0,0x6060000001d3) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7fea80adf082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/stun.c:319:25 in ndpi_int_check_stun +Shadow bytes around the buggy address: + 0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c0c7fff8010: 00 00 00 00 00 00 00 03 fa fa fa fa 00 00 00 00 + 0x0c0c7fff8020: 00 00 05 fa fa fa fa fa 00 00 00 00 00 00 05 fa +=>0x0c0c7fff8030: fa fa fa fa 00 00 00 00 00 00[03]fa fa fa fa fa + 0x0c0c7fff8040: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c7fff8050: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa + 0x0c0c7fff8060: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c7fff8070: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c7fff8080: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1131.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1131.txt new file mode 100644 index 000000000..007364e64 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1131.txt @@ -0,0 +1,67 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2361464638 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6040000000f9 at pc 0x0000005e22a5 bp 0x7ffd1b265ee0 sp 0x7ffd1b265ed8 +READ of size 2 at 0x6040000000f9 thread T0 + #0 0x5e22a4 in ndpi_search_setup_capwap /src/ndpi/src/lib/protocols/capwap.c:69:15 + #1 0x5e22a4 in ndpi_search_capwap /src/ndpi/src/lib/protocols/capwap.c:108:5 + #2 0x58a050 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4005:2 + #3 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #4 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #5 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f5bd3209082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x6040000000f9 is located 8 bytes to the right of 33-byte region [0x6040000000d0,0x6040000000f1) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f5bd3209082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/capwap.c:69:15 in ndpi_search_setup_capwap +Shadow bytes around the buggy address: + 0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 03 fa +=>0x0c087fff8010: fa fa 00 00 00 00 03 fa fa fa 00 00 00 00 01[fa] + 0x0c087fff8020: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 01 fa + 0x0c087fff8030: fa fa 00 00 00 00 07 fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1133.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1133.txt new file mode 100644 index 000000000..ea1b8e433 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1133.txt @@ -0,0 +1,68 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2361725681 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +ndpi_utils.c:218:18: runtime error: shift exponent 32 is too large for 32-bit type 'u_int32_t' (aka 'unsigned int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ndpi_utils.c:218:18 in +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60c0000002f1 at pc 0x00000062db59 bp 0x7ffe19d125e0 sp 0x7ffe19d125d8 +READ of size 1 at 0x60c0000002f1 thread T0 + #0 0x62db58 in ndpi_search_fix /src/ndpi/src/lib/protocols/fix.c:38:38 + #1 0x592e1c in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4061:4 + #2 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #3 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #4 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f22b46b6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x60c0000002f1 is located 0 bytes to the right of 113-byte region [0x60c000000280,0x60c0000002f1) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f22b46b6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/fix.c:38:38 in ndpi_search_fix +Shadow bytes around the buggy address: + 0x0c187fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c187fff8010: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa + 0x0c187fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 fa + 0x0c187fff8030: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c187fff8040: 00 00 00 00 00 00 03 fa fa fa fa fa fa fa fa fa +=>0x0c187fff8050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[01]fa + 0x0c187fff8060: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c187fff8070: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa + 0x0c187fff8080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c187fff8090: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c187fff80a0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1187.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1187.txt new file mode 100644 index 000000000..244eac930 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1187.txt @@ -0,0 +1,67 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2361994622 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060000001e3 at pc 0x000000603dd6 bp 0x7ffe0ef25230 sp 0x7ffe0ef25228 +READ of size 16 at 0x6060000001e3 thread T0 + #0 0x603dd5 in ndpi_int_check_stun /src/ndpi/src/lib/protocols/stun.c:354:43 + #1 0x601036 in ndpi_search_stun /src/ndpi/src/lib/protocols/stun.c:512:6 + #2 0x58c264 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4018:7 + #3 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #4 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #5 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f8981047082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x6060000001e3 is located 9 bytes to the right of 58-byte region [0x6060000001a0,0x6060000001da) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f8981047082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/stun.c:354:43 in ndpi_int_check_stun +Shadow bytes around the buggy address: + 0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c0c7fff8010: 00 00 00 00 00 00 00 03 fa fa fa fa 00 00 00 00 + 0x0c0c7fff8020: 00 00 00 04 fa fa fa fa 00 00 00 00 00 00 00 04 +=>0x0c0c7fff8030: fa fa fa fa 00 00 00 00 00 00 00 02[fa]fa fa fa + 0x0c0c7fff8040: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c7fff8050: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa + 0x0c0c7fff8060: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c7fff8070: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c7fff8080: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1194.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1194.txt new file mode 100644 index 000000000..4836d47fd --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1194.txt @@ -0,0 +1,74 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2362247443 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +ndpi_utils.c:218:18: runtime error: shift exponent 32 is too large for 32-bit type 'u_int32_t' (aka 'unsigned int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ndpi_utils.c:218:18 in +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000455d3 at pc 0x0000004cf51d bp 0x7ffe2d40acf0 sp 0x7ffe2d40a478 +READ of size 4 at 0x6020000455d3 thread T0 + #0 0x4cf51c in printf_common(void*, char const*, __va_list_tag*) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 + #1 0x4d0d70 in __interceptor_snprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1736:1 + #2 0x62f89c in ndpi_search_mail_smtp_tcp /src/ndpi/src/lib/protocols/mail_smtp.c:177:5 + #3 0x592e1c in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4061:4 + #4 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #5 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #6 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f03b2773082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x6020000455d3 is located 0 bytes to the right of 3-byte region [0x6020000455d0,0x6020000455d3) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x661cf4 in ndpi_base64_decode /src/ndpi/src/lib/ndpi_utils.c:811:15 + #2 0x62f86d in ndpi_search_mail_smtp_tcp /src/ndpi/src/lib/protocols/mail_smtp.c:174:9 + #3 0x592e1c in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4061:4 + #4 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #5 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #6 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f03b2773082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 in printf_common(void*, char const*, __va_list_tag*) +Shadow bytes around the buggy address: + 0x0c0480000a60: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000a70: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000a80: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000a90: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000aa0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 00 +=>0x0c0480000ab0: fa fa fd fa fa fa fd fa fa fa[03]fa fa fa fa fa + 0x0c0480000ac0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000ad0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000ae0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000af0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1233.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1233.txt new file mode 100644 index 000000000..2243bd957 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1233.txt @@ -0,0 +1,71 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2362539896 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +ndpi_utils.c:218:18: runtime error: shift exponent 32 is too large for 32-bit type 'u_int32_t' (aka 'unsigned int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ndpi_utils.c:218:18 in +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b00000015f at pc 0x00000051a1dd bp 0x7ffc9ae33f50 sp 0x7ffc9ae33710 +READ of size 6 at 0x60b00000015f thread T0 + #0 0x51a1dc in __interceptor_strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 + #1 0x5bdef7 in getTLScertificate /src/ndpi/src/lib/protocols/tls.c:603:9 + #2 0x5c1d5d in tlsDetectProtocolFromCertificate /src/ndpi/src/lib/protocols/tls.c:1140:12 + #3 0x5c30d1 in ndpi_search_tls_tcp_udp /src/ndpi/src/lib/protocols/tls.c:1501:8 + #4 0x592e1c in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4061:4 + #5 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #6 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #7 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7feef200e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x60b00000015f is located 0 bytes to the right of 111-byte region [0x60b0000000f0,0x60b00000015f) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7feef200e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 in __interceptor_strncpy +Shadow bytes around the buggy address: + 0x0c167fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff8000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c167fff8010: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00 +=>0x0c167fff8020: 00 00 00 00 00 00 00 00 00 00 00[07]fa fa fa fa + 0x0c167fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1263.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1263.txt new file mode 100644 index 000000000..672f26070 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1263.txt @@ -0,0 +1,70 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2362835261 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +ndpi_utils.c:218:18: runtime error: shift exponent 32 is too large for 32-bit type 'u_int32_t' (aka 'unsigned int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ndpi_utils.c:218:18 in +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b0000002bd at pc 0x0000005c07f3 bp 0x7ffc2f0c66a0 sp 0x7ffc2f0c6698 +READ of size 2 at 0x60b0000002bd thread T0 + #0 0x5c07f2 in getSSCertificateFingerprint /src/ndpi/src/lib/protocols/tls.c:894:21 + #1 0x5c1ce8 in tlsDetectProtocolFromCertificate /src/ndpi/src/lib/protocols/tls.c:1129:7 + #2 0x5c30d1 in ndpi_search_tls_tcp_udp /src/ndpi/src/lib/protocols/tls.c:1501:8 + #3 0x592e1c in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4061:4 + #4 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #5 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #6 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f4c52a0c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x60b0000002be is located 0 bytes to the right of 110-byte region [0x60b000000250,0x60b0000002be) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f4c52a0c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/tls.c:894:21 in getSSCertificateFingerprint +Shadow bytes around the buggy address: + 0x0c167fff8000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c167fff8010: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00 + 0x0c167fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa + 0x0c167fff8030: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff8040: 00 00 fa fa fa fa fa fa fa fa 00 00 00 00 00 00 +=>0x0c167fff8050: 00 00 00 00 00 00 00[06]fa fa fa fa fa fa fa fa + 0x0c167fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1294.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1294.txt new file mode 100644 index 000000000..d0003d439 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1294.txt @@ -0,0 +1,72 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2363105769 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +ndpi_utils.c:218:18: runtime error: shift exponent 32 is too large for 32-bit type 'u_int32_t' (aka 'unsigned int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ndpi_utils.c:218:18 in +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x608000000174 at pc 0x00000052e341 bp 0x7fff49d03cb0 sp 0x7fff49d03480 +READ of size 64 at 0x608000000174 thread T0 + #0 0x52e340 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x65d29b in SHA1Update /src/ndpi/src/lib/third_party/src/ndpi_sha1.c:192:9 + #2 0x5c02c2 in getSSCertificateFingerprint /src/ndpi/src/lib/protocols/tls.c:808:5 + #3 0x5c1ce8 in tlsDetectProtocolFromCertificate /src/ndpi/src/lib/protocols/tls.c:1129:7 + #4 0x5c30d1 in ndpi_search_tls_tcp_udp /src/ndpi/src/lib/protocols/tls.c:1501:8 + #5 0x592e1c in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4061:4 + #6 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #7 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #8 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f98246a4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x608000000174 is located 0 bytes to the right of 84-byte region [0x608000000120,0x608000000174) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f98246a4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c107fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff8000: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 06 fa + 0x0c107fff8010: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 06 fa +=>0x0c107fff8020: fa fa fa fa 00 00 00 00 00 00 00 00 00 00[04]fa + 0x0c107fff8030: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8040: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8050: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8060: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8070: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-136.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-136.txt new file mode 100644 index 000000000..b4d477780 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-136.txt @@ -0,0 +1,67 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2363356008 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b0000002b4 at pc 0x00000061f4a9 bp 0x7ffc4075ca90 sp 0x7ffc4075ca88 +READ of size 1 at 0x60b0000002b4 thread T0 + #0 0x61f4a8 in ndpi_netbios_name_interpret /src/ndpi/src/lib/protocols/netbios.c:50:38 + #1 0x620d0b in ndpi_int_netbios_add_connection /src/ndpi/src/lib/protocols/netbios.c:80:8 + #2 0x58a050 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4005:2 + #3 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #4 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #5 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7ff28cad1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x60b0000002b4 is located 0 bytes to the right of 100-byte region [0x60b000000250,0x60b0000002b4) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7ff28cad1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/netbios.c:50:38 in ndpi_netbios_name_interpret +Shadow bytes around the buggy address: + 0x0c167fff8000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c167fff8010: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00 + 0x0c167fff8020: 00 00 00 00 00 00 00 00 00 00 06 fa fa fa fa fa + 0x0c167fff8030: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff8040: 06 fa fa fa fa fa fa fa fa fa 00 00 00 00 00 00 +=>0x0c167fff8050: 00 00 00 00 00 00[04]fa fa fa fa fa fa fa fa fa + 0x0c167fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-154.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-154.txt new file mode 100644 index 000000000..e61d2d109 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-154.txt @@ -0,0 +1,67 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2363623626 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6040000000f9 at pc 0x0000005b53c9 bp 0x7ffcca3bcaf0 sp 0x7ffcca3bcae8 +READ of size 1 at 0x6040000000f9 thread T0 + #0 0x5b53c8 in search_valid_dns /src/ndpi/src/lib/protocols/dns.c:142:10 + #1 0x5b53c8 in ndpi_search_dns /src/ndpi/src/lib/protocols/dns.c:253:19 + #2 0x58a050 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4005:2 + #3 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #4 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #5 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f5d648b5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x6040000000f9 is located 0 bytes to the right of 41-byte region [0x6040000000d0,0x6040000000f9) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f5d648b5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/dns.c:142:10 in search_valid_dns +Shadow bytes around the buggy address: + 0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 03 +=>0x0c087fff8010: fa fa 00 00 00 00 00 03 fa fa 00 00 00 00 00[01] + 0x0c087fff8020: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 01 fa + 0x0c087fff8030: fa fa 00 00 00 00 07 fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1715.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1715.txt new file mode 100644 index 000000000..b0c38c707 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-1715.txt @@ -0,0 +1,34 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2363892359 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +protocols/kerberos.c:240:23: runtime error: index 254 out of bounds for type 'char[48]' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior protocols/kerberos.c:240:23 in +==1== ERROR: libFuzzer: deadly signal + #0 0x539091 in __sanitizer_print_stack_trace /src/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:87:3 + #1 0x457ba8 in fuzzer::PrintStackTrace() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:210:5 + #2 0x43c883 in fuzzer::Fuzzer::CrashCallback() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:233:3 + #3 0x7fc2a1ef041f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1441f) (BuildId: 9753720502573b97dbac595b61fd72c2df18e078) + #4 0x7fc2a1d0000a in raise (/lib/x86_64-linux-gnu/libc.so.6+0x4300a) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #5 0x7fc2a1cdf858 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x22858) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #6 0x5532b6 in __sanitizer::Abort() /src/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_posix_libcdep.cpp:143:3 + #7 0x551160 in __sanitizer::Die() /src/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_termination.cpp:58:5 + #8 0x567342 in __ubsan_handle_out_of_bounds_abort /src/llvm-project/compiler-rt/lib/ubsan/ubsan_handlers.cpp:405:3 + #9 0x5fdf1b in ndpi_search_kerberos_osv_2020_1715 /src/ndpi/src/lib/protocols/kerberos.c:240:23 + #10 0x5fdf1b in ndpi_search_kerberos /src/ndpi/src/lib/protocols/kerberos.c:573:5 + #11 0x58a050 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4005:2 + #12 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #13 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #14 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #15 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #16 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #17 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #18 0x7fc2a1ce1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #19 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +NOTE: libFuzzer has rudimentary signal handlers. + Combine libFuzzer with AddressSanitizer or similar for better crash reports. +SUMMARY: libFuzzer: deadly signal diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-179.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-179.txt new file mode 100644 index 000000000..ff9048d41 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-179.txt @@ -0,0 +1,68 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2364145022 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6040000000fb at pc 0x0000005b53f1 bp 0x7ffe32856ad0 sp 0x7ffe32856ac8 +READ of size 2 at 0x6040000000fb thread T0 + #0 0x5b53f0 in get16 /src/ndpi/src/lib/protocols/dns.c:40:17 + #1 0x5b53f0 in search_valid_dns /src/ndpi/src/lib/protocols/dns.c:117:41 + #2 0x5b53f0 in ndpi_search_dns /src/ndpi/src/lib/protocols/dns.c:253:19 + #3 0x58c264 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4018:7 + #4 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #5 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #6 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f35aefd9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x6040000000fc is located 0 bytes to the right of 44-byte region [0x6040000000d0,0x6040000000fc) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f35aefd9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/dns.c:40:17 in get16 +Shadow bytes around the buggy address: + 0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 06 +=>0x0c087fff8010: fa fa 00 00 00 00 00 06 fa fa 00 00 00 00 00[04] + 0x0c087fff8020: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 01 fa + 0x0c087fff8030: fa fa 00 00 00 00 07 fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-194.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-194.txt new file mode 100644 index 000000000..b90fb7ba7 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-194.txt @@ -0,0 +1,72 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2364413383 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +ndpi_utils.c:218:18: runtime error: shift exponent 32 is too large for 32-bit type 'u_int32_t' (aka 'unsigned int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ndpi_utils.c:218:18 in +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x607000000222 at pc 0x0000004c7fb6 bp 0x7ffd1b70bbe0 sp 0x7ffd1b70b390 +READ of size 4 at 0x607000000222 thread T0 + #0 0x4c7fb5 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:860:7 + #1 0x4c84ab in memcmp /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:892:10 + #2 0x604ada in check_ymsg /src/ndpi/src/lib/protocols/yahoo.c:78:9 + #3 0x604ada in ndpi_search_yahoo_tcp /src/ndpi/src/lib/protocols/yahoo.c:98:11 + #4 0x604468 in ndpi_search_yahoo /src/ndpi/src/lib/protocols/yahoo.c:372:2 + #5 0x592e1c in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4061:4 + #6 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #7 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #8 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7eff55d23082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x607000000222 is located 0 bytes to the right of 66-byte region [0x6070000001e0,0x607000000222) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7eff55d23082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:860:7 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) +Shadow bytes around the buggy address: + 0x0c0e7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fd fa fa fa + 0x0c0e7fff8010: fa fa 00 00 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0e7fff8020: 00 00 00 00 00 00 00 00 04 fa fa fa fa fa 00 00 + 0x0c0e7fff8030: 00 00 00 00 00 00 04 fa fa fa fa fa 00 00 00 00 +=>0x0c0e7fff8040: 00 00 00 00[02]fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-28.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-28.txt new file mode 100644 index 000000000..1d12dc9b3 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-28.txt @@ -0,0 +1,75 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2364667663 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000147 at pc 0x0000005b448a bp 0x7ffeed5fefd0 sp 0x7ffeed5fefc8 +READ of size 1 at 0x604000000147 thread T0 + #0 0x5b4489 in getNameLength /src/ndpi/src/lib/protocols/dns.c:50:6 + #1 0x5b4489 in search_valid_dns /src/ndpi/src/lib/protocols/dns.c:164:19 + #2 0x5b4489 in ndpi_search_dns /src/ndpi/src/lib/protocols/dns.c:253:19 + #3 0x590d16 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4049:2 + #4 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #5 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #6 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f8ca3f04082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x604000000147 is located 9 bytes to the left of 33-byte region [0x604000000150,0x604000000171) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56ebf1 in ndpi_malloc /src/ndpi/src/lib/ndpi_main.c:88:77 + #2 0x56ebf1 in ndpi_strdup /src/ndpi/src/lib/ndpi_main.c:141:13 + #3 0x56ebf1 in ndpi_add_host_url_subprotocol /src/ndpi/src/lib/ndpi_main.c:477:17 + #4 0x56e8fa in ndpi_init_protocol_match /src/ndpi/src/lib/ndpi_main.c:548:3 + #5 0x576911 in init_string_based_protocols /src/ndpi/src/lib/ndpi_main.c:697:5 + #6 0x576911 in ndpi_init_protocol_defaults /src/ndpi/src/lib/ndpi_main.c:1789:5 + #7 0x56fd3d in ndpi_init_detection_module /src/ndpi/src/lib/ndpi_main.c:2218:3 + #8 0x56c578 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:24:25 + #9 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f8ca3f04082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/dns.c:50:6 in getNameLength +Shadow bytes around the buggy address: + 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 + 0x0c087fff8010: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 06 +=>0x0c087fff8020: fa fa 00 00 00 00 00 05[fa]fa 00 00 00 00 01 fa + 0x0c087fff8030: fa fa 00 00 00 00 07 fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-342.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-342.txt new file mode 100644 index 000000000..330580b21 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-342.txt @@ -0,0 +1,36 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2364913553 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +ndpi_utils.c:218:18: runtime error: shift exponent 32 is too large for 32-bit type 'u_int32_t' (aka 'unsigned int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ndpi_utils.c:218:18 in +protocols/kerberos.c:467:5: runtime error: index 24 out of bounds for type 'char[24]' +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior protocols/kerberos.c:467:5 in +==1== ERROR: libFuzzer: deadly signal + #0 0x539091 in __sanitizer_print_stack_trace /src/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:87:3 + #1 0x457ba8 in fuzzer::PrintStackTrace() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:210:5 + #2 0x43c883 in fuzzer::Fuzzer::CrashCallback() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:233:3 + #3 0x7f2f2ab4041f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1441f) (BuildId: 9753720502573b97dbac595b61fd72c2df18e078) + #4 0x7f2f2a95000a in raise (/lib/x86_64-linux-gnu/libc.so.6+0x4300a) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #5 0x7f2f2a92f858 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x22858) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #6 0x5532b6 in __sanitizer::Abort() /src/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_posix_libcdep.cpp:143:3 + #7 0x551160 in __sanitizer::Die() /src/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_termination.cpp:58:5 + #8 0x567342 in __ubsan_handle_out_of_bounds_abort /src/llvm-project/compiler-rt/lib/ubsan/ubsan_handlers.cpp:405:3 + #9 0x5fdd88 in ndpi_search_kerberos_original /src/ndpi/src/lib/protocols/kerberos.c:467:26 + #10 0x5fdd88 in ndpi_search_kerberos /src/ndpi/src/lib/protocols/kerberos.c:575:5 + #11 0x592e1c in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4061:4 + #12 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #13 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #14 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #15 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #16 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #17 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #18 0x7f2f2a931082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #19 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +NOTE: libFuzzer has rudimentary signal handlers. + Combine libFuzzer with AddressSanitizer or similar for better crash reports. +SUMMARY: libFuzzer: deadly signal diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-49.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-49.txt new file mode 100644 index 000000000..1383afb6c --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-49.txt @@ -0,0 +1,67 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2365178662 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6040000000fa at pc 0x00000061f409 bp 0x7ffd33846ff0 sp 0x7ffd33846fe8 +READ of size 1 at 0x6040000000fa thread T0 + #0 0x61f408 in ndpi_netbios_name_interpret /src/ndpi/src/lib/protocols/netbios.c:42:10 + #1 0x620d0b in ndpi_int_netbios_add_connection /src/ndpi/src/lib/protocols/netbios.c:80:8 + #2 0x58a050 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4005:2 + #3 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #4 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #5 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f356e840082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x6040000000fa is located 0 bytes to the right of 42-byte region [0x6040000000d0,0x6040000000fa) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f356e840082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/netbios.c:42:10 in ndpi_netbios_name_interpret +Shadow bytes around the buggy address: + 0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 04 +=>0x0c087fff8010: fa fa 00 00 00 00 00 04 fa fa 00 00 00 00 00[02] + 0x0c087fff8020: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 01 fa + 0x0c087fff8030: fa fa 00 00 00 00 07 fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-59.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-59.txt new file mode 100644 index 000000000..b9e825375 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-59.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2365431656 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +ndpi_utils.c:218:18: runtime error: shift exponent 32 is too large for 32-bit type 'u_int32_t' (aka 'unsigned int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ndpi_utils.c:218:18 in +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x607000000228 at pc 0x00000052e341 bp 0x7ffcebe54330 sp 0x7ffcebe53b00 +READ of size 20 at 0x607000000228 thread T0 + #0 0x52e340 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x5e383a in ndpi_search_bittorrent /src/ndpi/src/lib/protocols/bittorrent.c + #2 0x592e1c in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4061:4 + #3 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #4 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #5 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f8a7a49d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x607000000228 is located 7 bytes to the right of 65-byte region [0x6070000001e0,0x607000000221) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f8a7a49d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c0e7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fd fa fa fa + 0x0c0e7fff8010: fa fa 00 00 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0e7fff8020: 00 00 00 00 00 00 00 00 03 fa fa fa fa fa 00 00 + 0x0c0e7fff8030: 00 00 00 00 00 00 03 fa fa fa fa fa 00 00 00 00 +=>0x0c0e7fff8040: 00 00 00 00 01[fa]fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-774.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-774.txt new file mode 100644 index 000000000..25e69afb8 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-774.txt @@ -0,0 +1,67 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2365686339 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60e00000037d at pc 0x0000005fcf9f bp 0x7ffc584c8510 sp 0x7ffc584c8508 +READ of size 1 at 0x60e00000037d thread T0 + #0 0x5fcf9e in ndpi_search_kerberos_original /src/ndpi/src/lib/protocols/kerberos.c:423:14 + #1 0x5fcf9e in ndpi_search_kerberos /src/ndpi/src/lib/protocols/kerberos.c:575:5 + #2 0x58a050 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4005:2 + #3 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #4 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #5 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f44fcbc3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x60e00000037d is located 0 bytes to the right of 157-byte region [0x60e0000002e0,0x60e00000037d) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f44fcbc3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/kerberos.c:423:14 in ndpi_search_kerberos_original +Shadow bytes around the buggy address: + 0x0c1c7fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa + 0x0c1c7fff8020: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c1c7fff8030: 00 00 00 00 00 00 00 07 fa fa fa fa fa fa fa fa + 0x0c1c7fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c1c7fff8050: 00 00 00 07 fa fa fa fa fa fa fa fa 00 00 00 00 +=>0x0c1c7fff8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00[05] + 0x0c1c7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1c7fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1c7fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1c7fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1c7fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-78.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-78.txt new file mode 100644 index 000000000..154c55da6 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-78.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2365947722 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000017f at pc 0x0000004c7fb6 bp 0x7ffcf5a650f0 sp 0x7ffcf5a648a0 +READ of size 7 at 0x60300000017f thread T0 + #0 0x4c7fb5 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:860:7 + #1 0x4c84ab in memcmp /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:892:10 + #2 0x61315d in ndpi_check_spotify /src/ndpi/src/lib/protocols/spotify.c:51:5 + #3 0x61315d in ndpi_search_spotify /src/ndpi/src/lib/protocols/spotify.c:131:7 + #4 0x58c264 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4018:7 + #5 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #6 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #7 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f47737ce082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x60300000017f is located 0 bytes to the right of 31-byte region [0x603000000160,0x60300000017f) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f47737ce082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:860:7 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) +Shadow bytes around the buggy address: + 0x0c067fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c067fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c067fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c067fff8000: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 + 0x0c067fff8010: 00 fa fa fa 00 00 00 00 fa fa 00 00 00 fa fa fa +=>0x0c067fff8020: 00 00 00 fa fa fa 00 00 00 00 fa fa 00 00 00[07] + 0x0c067fff8030: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 + 0x0c067fff8040: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa + 0x0c067fff8050: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa + 0x0c067fff8060: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 + 0x0c067fff8070: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-795.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-795.txt new file mode 100644 index 000000000..a1cf654cc --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-795.txt @@ -0,0 +1,67 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2366222198 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6040000000fd at pc 0x00000060c39a bp 0x7fff5124c9d0 sp 0x7fff5124c9c8 +READ of size 1 at 0x6040000000fd thread T0 + #0 0x60c399 in ndpi_search_setup_iax /src/ndpi/src/lib/protocols/iax.c:70:37 + #1 0x60c399 in ndpi_search_iax /src/ndpi/src/lib/protocols/iax.c:93:5 + #2 0x58a050 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4005:2 + #3 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #4 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #5 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7ffb765cf082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x6040000000fd is located 0 bytes to the right of 45-byte region [0x6040000000d0,0x6040000000fd) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7ffb765cf082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/iax.c:70:37 in ndpi_search_setup_iax +Shadow bytes around the buggy address: + 0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 07 +=>0x0c087fff8010: fa fa 00 00 00 00 00 07 fa fa 00 00 00 00 00[05] + 0x0c087fff8020: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 01 fa + 0x0c087fff8030: fa fa 00 00 00 00 07 fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-812.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-812.txt new file mode 100644 index 000000000..f24d1c694 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-812.txt @@ -0,0 +1,67 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2366462664 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000160 at pc 0x00000061f4a9 bp 0x7ffe4f8cabd0 sp 0x7ffe4f8cabc8 +READ of size 1 at 0x60b000000160 thread T0 + #0 0x61f4a8 in ndpi_netbios_name_interpret /src/ndpi/src/lib/protocols/netbios.c:50:38 + #1 0x620d0b in ndpi_int_netbios_add_connection /src/ndpi/src/lib/protocols/netbios.c:80:8 + #2 0x58a050 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4005:2 + #3 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #4 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #5 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f3006fbb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x60b000000160 is located 0 bytes to the right of 112-byte region [0x60b0000000f0,0x60b000000160) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f3006fbb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/netbios.c:50:38 in ndpi_netbios_name_interpret +Shadow bytes around the buggy address: + 0x0c167fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff8000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c167fff8010: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00 +=>0x0c167fff8020: 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa + 0x0c167fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-918.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-918.txt new file mode 100644 index 000000000..1fa192a2a --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-918.txt @@ -0,0 +1,66 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2366721433 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x608000000171 at pc 0x00000063de03 bp 0x7ffe13c87b50 sp 0x7ffe13c87b48 +READ of size 1 at 0x608000000171 thread T0 + #0 0x63de02 in ndpi_search_oracle /src/ndpi/src/lib/protocols/oracle.c:46:41 + #1 0x590d16 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4049:2 + #2 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #3 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #4 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f603891b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x608000000171 is located 0 bytes to the right of 81-byte region [0x608000000120,0x608000000171) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f603891b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/oracle.c:46:41 in ndpi_search_oracle +Shadow bytes around the buggy address: + 0x0c107fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff8000: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 03 fa + 0x0c107fff8010: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 03 fa +=>0x0c107fff8020: fa fa fa fa 00 00 00 00 00 00 00 00 00 00[01]fa + 0x0c107fff8030: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8040: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8050: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8060: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8070: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-922.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-922.txt new file mode 100644 index 000000000..2e439aeab --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-922.txt @@ -0,0 +1,66 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2366971709 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6030000001dd at pc 0x000000614c82 bp 0x7ffefebac9a0 sp 0x7ffefebac998 +READ of size 1 at 0x6030000001dd thread T0 + #0 0x614c81 in ndpi_search_h323 /src/ndpi/src/lib/protocols/h323.c:81:42 + #1 0x58a050 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4005:2 + #2 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #3 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #4 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f1594cab082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x6030000001dd is located 0 bytes to the right of 29-byte region [0x6030000001c0,0x6030000001dd) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f1594cab082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/h323.c:81:42 in ndpi_search_h323 +Shadow bytes around the buggy address: + 0x0c067fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c067fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c067fff8000: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 + 0x0c067fff8010: 00 fa fa fa 00 00 00 00 fa fa 00 00 00 fa fa fa + 0x0c067fff8020: 00 00 00 fa fa fa 00 00 00 00 fa fa 00 00 00 07 +=>0x0c067fff8030: fa fa 00 00 00 07 fa fa 00 00 00[05]fa fa 00 00 + 0x0c067fff8040: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa + 0x0c067fff8050: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa + 0x0c067fff8060: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 + 0x0c067fff8070: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa + 0x0c067fff8080: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-972.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-972.txt new file mode 100644 index 000000000..7851d6371 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-972.txt @@ -0,0 +1,70 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2367214367 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +ndpi_utils.c:218:18: runtime error: shift exponent 32 is too large for 32-bit type 'u_int32_t' (aka 'unsigned int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ndpi_utils.c:218:18 in +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000000140 at pc 0x0000004c7fb6 bp 0x7fffa25a45a0 sp 0x7fffa25a3d50 +READ of size 7 at 0x611000000140 thread T0 + #0 0x4c7fb5 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:860:7 + #1 0x4c84ab in memcmp /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:892:10 + #2 0x627d4e in ndpi_search_irc_tcp /src/ndpi/src/lib/protocols/irc.c:679:9 + #3 0x592e1c in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4061:4 + #4 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #5 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #6 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fb5aede1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x611000000140 is located 0 bytes to the right of 256-byte region [0x611000000040,0x611000000140) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7fb5aede1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:860:7 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) +Shadow bytes around the buggy address: + 0x0c227fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c227fff8020: 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa + 0x0c227fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8050: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fff8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8070: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-992.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-992.txt new file mode 100644 index 000000000..3eb4e0e8b --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-992.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2367482042 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +ndpi_utils.c:218:18: runtime error: shift exponent 32 is too large for 32-bit type 'u_int32_t' (aka 'unsigned int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ndpi_utils.c:218:18 in +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060000001d2 at pc 0x00000061e3d5 bp 0x7fff36f93460 sp 0x7fff36f93458 +READ of size 4 at 0x6060000001d2 thread T0 + #0 0x61e3d4 in ndpi_search_oscar_tcp_connect /src/ndpi/src/lib/protocols/oscar.c:145:4 + #1 0x61e3d4 in ndpi_search_oscar /src/ndpi/src/lib/protocols/oscar.c:801:5 + #2 0x592e1c in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4061:4 + #3 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #4 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #5 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f5e06c47082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x6060000001d4 is located 0 bytes to the right of 52-byte region [0x6060000001a0,0x6060000001d4) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f5e06c47082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/oscar.c:145:4 in ndpi_search_oscar_tcp_connect +Shadow bytes around the buggy address: + 0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c0c7fff8010: 00 00 00 00 00 00 00 03 fa fa fa fa 00 00 00 00 + 0x0c0c7fff8020: 00 00 06 fa fa fa fa fa 00 00 00 00 00 00 06 fa +=>0x0c0c7fff8030: fa fa fa fa 00 00 00 00 00 00[04]fa fa fa fa fa + 0x0c0c7fff8040: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c7fff8050: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa + 0x0c0c7fff8060: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c7fff8070: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c7fff8080: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-994.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-994.txt new file mode 100644 index 000000000..db5b97b72 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2020-994.txt @@ -0,0 +1,71 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2367750380 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +ndpi_utils.c:218:18: runtime error: shift exponent 32 is too large for 32-bit type 'u_int32_t' (aka 'unsigned int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ndpi_utils.c:218:18 in +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6110000003b8 at pc 0x00000051a1dd bp 0x7ffd3238baf0 sp 0x7ffd3238b2b0 +READ of size 6 at 0x6110000003b8 thread T0 + #0 0x51a1dc in __interceptor_strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 + #1 0x5bd0a1 in getTLScertificate /src/ndpi/src/lib/protocols/tls.c:430:8 + #2 0x5c1d5d in tlsDetectProtocolFromCertificate /src/ndpi/src/lib/protocols/tls.c:1140:12 + #3 0x5c30d1 in ndpi_search_tls_tcp_udp /src/ndpi/src/lib/protocols/tls.c:1501:8 + #4 0x592e1c in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4061:4 + #5 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #6 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #7 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f26ba36c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x6110000003b8 is located 0 bytes to the right of 248-byte region [0x6110000002c0,0x6110000003b8) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f26ba36c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 in __interceptor_strncpy +Shadow bytes around the buggy address: + 0x0c227fff8020: 00 00 00 00 00 00 00 02 fa fa fa fa fa fa fa fa + 0x0c227fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 + 0x0c227fff8050: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fff8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c227fff8070: 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa + 0x0c227fff8080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff80a0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fff80b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff80c0: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2022-1032.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2022-1032.txt new file mode 100644 index 000000000..4e8a6da9e --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2022-1032.txt @@ -0,0 +1,75 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2368000850 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f50d6d000b0 at pc 0x0000004cf51d bp 0x7fff05a84290 sp 0x7fff05a83a18 +READ of size 17 at 0x7f50d6d000b0 thread T0 + #0 0x4cf51c in printf_common(void*, char const*, __va_list_tag*) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 + #1 0x4d0d70 in __interceptor_snprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1736:1 + #2 0x5ef126 in check_content_type_and_change_protocol /src/ndpi/src/lib/protocols/http.c:238:5 + #3 0x5edcf5 in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c + #4 0x5edcf5 in ndpi_search_http_tcp /src/ndpi/src/lib/protocols/http.c:886:3 + #5 0x590d16 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4049:2 + #6 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #7 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #8 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f50d903e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +Address 0x7f50d6d000b0 is located in stack of thread T0 at offset 176 in frame + #0 0x5eebff in check_content_type_and_change_protocol /src/ndpi/src/lib/protocols/http.c:158 + + This frame has 9 object(s): + [32, 44) 'ret_match.i' (line 117) + [64, 128) 'msg.i' (line 148) + [160, 176) 'buf' (line 236) + [192, 448) 'ua' (line 252) <== Memory access at offset 176 partially underflows this variable + [512, 520) 'parent' (line 259) + [544, 556) 'ret_match' (line 334) + [576, 588) 'ret_match1033' (line 387) + [608, 620) 'ret_match1101' (line 407) + [640, 652) 'ret_match1295' (line 450) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 in printf_common(void*, char const*, __va_list_tag*) +Shadow bytes around the buggy address: + 0x0fea9ad97fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fea9ad97fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fea9ad97fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fea9ad97ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fea9ad98000: f1 f1 f1 f1 f8 f8 f2 f2 f8 f8 f8 f8 f8 f8 f8 f8 +=>0x0fea9ad98010: f2 f2 f2 f2 00 00[f2]f2 f8 f8 f8 f8 f8 f8 f8 f8 + 0x0fea9ad98020: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 + 0x0fea9ad98030: f8 f8 f8 f8 f8 f8 f8 f8 f2 f2 f2 f2 f2 f2 f2 f2 + 0x0fea9ad98040: f8 f2 f2 f2 f8 f8 f2 f2 f8 f8 f2 f2 f8 f8 f2 f2 + 0x0fea9ad98050: f8 f8 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fea9ad98060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2022-445.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2022-445.txt new file mode 100644 index 000000000..933c9df7b --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2022-445.txt @@ -0,0 +1,75 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2368248172 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +ndpi_utils.c:218:18: runtime error: shift exponent 32 is too large for 32-bit type 'u_int32_t' (aka 'unsigned int') +SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ndpi_utils.c:218:18 in +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f5ca0f00ad0 at pc 0x00000051a31d bp 0x7fffb6c68e50 sp 0x7fffb6c68610 +WRITE of size 191 at 0x7f5ca0f00ad0 thread T0 + #0 0x51a31c in __interceptor_strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:471:5 + #1 0x5bc690 in getTLScertificate /src/ndpi/src/lib/protocols/tls.c:361:3 + #2 0x5c1d5d in tlsDetectProtocolFromCertificate /src/ndpi/src/lib/protocols/tls.c:1140:12 + #3 0x5c30d1 in ndpi_search_tls_tcp_udp /src/ndpi/src/lib/protocols/tls.c:1501:8 + #4 0x592e1c in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4061:4 + #5 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #6 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #7 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f5ca2ffe082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +Address 0x7f5ca0f00ad0 is located in stack of thread T0 at offset 2768 in frame + #0 0x5bb85f in getTLScertificate /src/ndpi/src/lib/protocols/tls.c:204 + + This frame has 8 object(s): + [32, 938) 'ja3' (line 206) + [1072, 2096) 'ja3_str' (line 209) + [2224, 2312) 'ctx' (line 210) + [2352, 2368) 'md5_hash' (line 211) + [2384, 2640) 'alpn_str' (line 348) + [2704, 2768) 'str' (line 348) + [2800, 2808) 'strncpy_fn' (line 348) <== Memory access at offset 2768 partially underflows this variable + [2832, 2844) 'ret_match' (line 446) <== Memory access at offset 2768 partially underflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:471:5 in __interceptor_strncpy +Shadow bytes around the buggy address: + 0x0fec141d8100: 00 00 00 00 00 00 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 + 0x0fec141d8110: f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 + 0x0fec141d8120: 00 f2 f2 f2 f2 f2 00 00 f2 f2 00 00 00 00 00 00 + 0x0fec141d8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fec141d8140: 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 f2 +=>0x0fec141d8150: f2 f2 00 00 00 00 00 00 00 00[f2]f2 f2 f2 00 f2 + 0x0fec141d8160: f2 f2 f8 f8 f3 f3 f3 f3 00 00 00 00 00 00 00 00 + 0x0fec141d8170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fec141d8180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fec141d8190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fec141d81a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2022-661.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2022-661.txt new file mode 100644 index 000000000..2a57f3bd9 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2022-661.txt @@ -0,0 +1,68 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2368487925 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6040000000f8 at pc 0x00000051a1dd bp 0x7fffef29da90 sp 0x7fffef29d250 +READ of size 4 at 0x6040000000f8 thread T0 + #0 0x51a1dc in __interceptor_strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 + #1 0x6193ad in dissect_softether_ip_port /src/ndpi/src/lib/protocols/softether.c:85:5 + #2 0x6193ad in ndpi_search_softether /src/ndpi/src/lib/protocols/softether.c:124:5 + #3 0x58c264 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4018:7 + #4 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #5 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #6 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f5518acd082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x6040000000f8 is located 0 bytes to the right of 40-byte region [0x6040000000d0,0x6040000000f8) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f5518acd082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 in __interceptor_strncpy +Shadow bytes around the buggy address: + 0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 02 +=>0x0c087fff8010: fa fa 00 00 00 00 00 02 fa fa 00 00 00 00 00[fa] + 0x0c087fff8020: fa fa 00 00 00 00 00 05 fa fa 00 00 00 00 01 fa + 0x0c087fff8030: fa fa 00 00 00 00 07 fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2022-670.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2022-670.txt new file mode 100644 index 000000000..2ef62bc9c --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2022-670.txt @@ -0,0 +1,67 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2368749365 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000080 at pc 0x00000051a1dd bp 0x7ffd3c608d50 sp 0x7ffd3c608510 +READ of size 4 at 0x604000000080 thread T0 + #0 0x51a1dc in __interceptor_strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 + #1 0x61949f in ndpi_search_softether /src/ndpi/src/lib/protocols/softether.c:140:5 + #2 0x58c264 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4018:7 + #3 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #4 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #5 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f6e01bf5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x604000000080 is located 0 bytes to the right of 48-byte region [0x604000000050,0x604000000080) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f6e01bf5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 in __interceptor_strncpy +Shadow bytes around the buggy address: + 0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 +=>0x0c087fff8010:[fa]fa 00 00 00 00 00 05 fa fa 00 00 00 00 01 fa + 0x0c087fff8020: fa fa 00 00 00 00 07 fa fa fa fa fa fa fa fa fa + 0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2022-709.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2022-709.txt new file mode 100644 index 000000000..480d00b1c --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2022-709.txt @@ -0,0 +1,68 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2368983093 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60d000000261 at pc 0x00000051a1dd bp 0x7ffd7a4562f0 sp 0x7ffd7a455ab0 +READ of size 10 at 0x60d000000261 thread T0 + #0 0x51a1dc in __interceptor_strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 + #1 0x619925 in dissect_softether_host_fqdn /src/ndpi/src/lib/protocols/softether.c:113:7 + #2 0x619925 in ndpi_search_softether /src/ndpi/src/lib/protocols/softether.c:146:5 + #3 0x58c264 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4018:7 + #4 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #5 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #6 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fb526b8c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x60d000000261 is located 0 bytes to the right of 129-byte region [0x60d0000001e0,0x60d000000261) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7fb526b8c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 in __interceptor_strncpy +Shadow bytes around the buggy address: + 0x0c1a7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c1a7fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c1a7fff8010: 00 00 00 00 00 00 00 00 03 fa fa fa fa fa fa fa + 0x0c1a7fff8020: fa fa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c1a7fff8030: 00 00 03 fa fa fa fa fa fa fa fa fa 00 00 00 00 +=>0x0c1a7fff8040: 00 00 00 00 00 00 00 00 00 00 00 00[01]fa fa fa + 0x0c1a7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1a7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1a7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1a7fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c1a7fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2023-436.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2023-436.txt new file mode 100644 index 000000000..55337393c --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2023-436.txt @@ -0,0 +1,70 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2369496201 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000080 at pc 0x00000065df11 bp 0x7ffee852e2d0 sp 0x7ffee852e2c8 +READ of size 1 at 0x604000000080 thread T0 + #0 0x65df10 in ndpi_check_punycode_string /src/ndpi/src/lib/ndpi_utils.c:63:12 + #1 0x598113 in ndpi_match_host_subprotocol /src/ndpi/src/lib/ndpi_main.c:6292:5 + #2 0x5f01be in check_content_type_and_change_protocol /src/ndpi/src/lib/protocols/http.c:409:5 + #3 0x5ee192 in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c:769:7 + #4 0x5ee192 in ndpi_search_http_tcp /src/ndpi/src/lib/protocols/http.c:886:3 + #5 0x592e1c in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4061:4 + #6 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #7 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #8 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f8d8fd45082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x604000000080 is located 0 bytes to the right of 48-byte region [0x604000000050,0x604000000080) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f8d8fd45082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/ndpi_utils.c:63:12 in ndpi_check_punycode_string +Shadow bytes around the buggy address: + 0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 +=>0x0c087fff8010:[fa]fa 00 00 00 00 00 05 fa fa 00 00 00 00 01 fa + 0x0c087fff8020: fa fa 00 00 00 00 07 fa fa fa fa fa fa fa fa fa + 0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2023-504.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2023-504.txt new file mode 100644 index 000000000..450d143d8 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2023-504.txt @@ -0,0 +1,66 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2369755701 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6030000001dd at pc 0x00000060ead6 bp 0x7ffc91177da0 sp 0x7ffc91177d98 +READ of size 1 at 0x6030000001dd thread T0 + #0 0x60ead5 in ndpi_search_line /src/ndpi/src/lib/protocols/line.c:52:13 + #1 0x58c264 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4018:7 + #2 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #3 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #4 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7ffa0b0a7082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x6030000001dd is located 0 bytes to the right of 29-byte region [0x6030000001c0,0x6030000001dd) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7ffa0b0a7082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/line.c:52:13 in ndpi_search_line +Shadow bytes around the buggy address: + 0x0c067fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c067fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c067fff8000: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 + 0x0c067fff8010: 00 fa fa fa 00 00 00 00 fa fa 00 00 00 fa fa fa + 0x0c067fff8020: 00 00 00 fa fa fa 00 00 00 00 fa fa 00 00 00 07 +=>0x0c067fff8030: fa fa 00 00 00 07 fa fa 00 00 00[05]fa fa 00 00 + 0x0c067fff8040: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa + 0x0c067fff8050: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa + 0x0c067fff8060: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 + 0x0c067fff8070: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa + 0x0c067fff8080: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2023-566.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2023-566.txt new file mode 100644 index 000000000..b749d7082 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2023-566.txt @@ -0,0 +1,70 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2370012362 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60800000007f at pc 0x00000051a1dd bp 0x7ffc9c2b1a90 sp 0x7ffc9c2b1250 +READ of size 3 at 0x60800000007f thread T0 + #0 0x51a1dc in __interceptor_strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 + #1 0x5f0622 in ndpi_http_check_content /src/ndpi/src/lib/protocols/http.c:134:5 + #2 0x5f0622 in check_content_type_and_change_protocol /src/ndpi/src/lib/protocols/http.c:459:5 + #3 0x5edcf5 in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c + #4 0x5edcf5 in ndpi_search_http_tcp /src/ndpi/src/lib/protocols/http.c:886:3 + #5 0x592e1c in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4061:4 + #6 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #7 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #8 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7fa6172c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x60800000007f is located 0 bytes to the right of 95-byte region [0x608000000020,0x60800000007f) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7fa6172c0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 in __interceptor_strncpy +Shadow bytes around the buggy address: + 0x0c107fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c107fff8000: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00[07] + 0x0c107fff8010: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8020: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8030: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8040: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8050: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2024-469.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2024-469.txt new file mode 100644 index 000000000..f7746b60a --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2024-469.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2370271338 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x607000000222 at pc 0x0000005a794a bp 0x7ffd5cda3f90 sp 0x7ffd5cda3f88 +READ of size 1 at 0x607000000222 thread T0 + #0 0x5a7949 in ndpi_strnstr /src/ndpi/src/lib/ndpi_main.c:6071:25 + #1 0x5eeeb1 in check_content_type_and_change_protocol /src/ndpi/src/lib/protocols/http.c:169:13 + #2 0x5edcf5 in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c + #3 0x5edcf5 in ndpi_search_http_tcp /src/ndpi/src/lib/protocols/http.c:886:3 + #4 0x590d16 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4049:2 + #5 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #6 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #7 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7feb519ef082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x607000000222 is located 0 bytes to the right of 66-byte region [0x6070000001e0,0x607000000222) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7feb519ef082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/ndpi_main.c:6071:25 in ndpi_strnstr +Shadow bytes around the buggy address: + 0x0c0e7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fd fa fa fa + 0x0c0e7fff8010: fa fa 00 00 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0e7fff8020: 00 00 00 00 00 00 00 00 04 fa fa fa fa fa 00 00 + 0x0c0e7fff8030: 00 00 00 00 00 00 04 fa fa fa fa fa 00 00 00 00 +=>0x0c0e7fff8040: 00 00 00 00[02]fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2025-449.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2025-449.txt new file mode 100644 index 000000000..cd97fa73f --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/crashes/OSV-2025-449.txt @@ -0,0 +1,71 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2370542674 +INFO: Loaded 1 modules (14626 inline 8-bit counters): 14626 [0x7a3c30, 0x7a7552), +INFO: Loaded 1 PC tables (14626 PCs): 14626 [0x7a7558,0x7e0778), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060000001d2 at pc 0x0000004cf51d bp 0x7ffe07ba4750 sp 0x7ffe07ba3ed8 +READ of size 11 at 0x6060000001d2 thread T0 + #0 0x4cf51c in printf_common(void*, char const*, __va_list_tag*) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 + #1 0x4d0d70 in __interceptor_snprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1736:1 + #2 0x5ef1f4 in ndpi_check_http_server /src/ndpi/src/lib/protocols/http.c:149:5 + #3 0x5ef1f4 in check_content_type_and_change_protocol /src/ndpi/src/lib/protocols/http.c:242:5 + #4 0x5ee0f4 in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c:765:7 + #5 0x5ee0f4 in ndpi_search_http_tcp /src/ndpi/src/lib/protocols/http.c:886:3 + #6 0x592e1c in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4061:4 + #7 0x59c6f2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4804:3 + #8 0x56c65c in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:36:5 + #9 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f5ad9562082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #14 0x41f74d in _start (/out/fuzz_process_packet+0x41f74d) + +0x6060000001d2 is located 0 bytes to the right of 50-byte region [0x6060000001a0,0x6060000001d2) +allocated by thread T0 here: + #0 0x52efb6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x56c52e in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:19:39 + #2 0x43de23 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x429582 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x42ee2c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x458362 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f5ad9562082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 in printf_common(void*, char const*, __va_list_tag*) +Shadow bytes around the buggy address: + 0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c0c7fff8010: 00 00 00 00 00 00 00 03 fa fa fa fa 00 00 00 00 + 0x0c0c7fff8020: 00 00 04 fa fa fa fa fa 00 00 00 00 00 00 04 fa +=>0x0c0c7fff8030: fa fa fa fa 00 00 00 00 00 00[02]fa fa fa fa fa + 0x0c0c7fff8040: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c7fff8050: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa + 0x0c0c7fff8060: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c7fff8070: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c7fff8080: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/libpcap-1.9.1.tar.gz b/benchmarks/ndpi_transplant_fuzz_process_packet/libpcap-1.9.1.tar.gz new file mode 100644 index 000000000..a052b0fb6 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/libpcap-1.9.1.tar.gz differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/COMMANDS.md b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/COMMANDS.md new file mode 100644 index 000000000..7d995aa52 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/COMMANDS.md @@ -0,0 +1,139 @@ +# Original Crash Collection: ndpi fuzz_process_packet + +Generated: 2026-04-24 UTC + +Benchmark: `ndpi_transplant_fuzz_process_packet` +Project: `ndpi` +Fuzzer: `fuzz_process_packet` +Sanitizer: `address` + +Target source commit: `e695dd6eade754b2d50bdf297ca8bdc4105f93ff` (2019-11-03) +Target-era base-runner: `gcr.io/oss-fuzz-base/base-runner@sha256:caba4ce727f6dfe43a68b4554efdd617052ad3b634bbc6e28b97f6e3ca1a92ac` (2019-12, from `get_base_runner_for_date()`) + +## Semantics + +Each `OSV-*.txt` is a crash on the pristine source tree: +- **Local bugs** (already triggering at target) replayed against the NAS prebuilt + `-address` binary at target commit (`e695dd6eade7`) with the target-era base- + runner. The ndpi `fuzz_process_packet` binary does not link OpenSSL, so the 2019- + era runner (no `libcrypto.so.1.1`) can load the NAS prebuilt binary without + needing a fresh rebuild. +- **Migration bugs** come from `/mnt/nas/linke/new_migrate/ndpi/fuzz_process_packet/ + crash/`, captured per-bug at each bug's own buggy source commit by the migration + pipeline with era-matched runner. + +Note: `ndpi_builds.csv` covers half of the migration commits here; rows with +`oss_fuzz_commit=auto` defer to `--runner-image auto --commit-date ` at reproduce +time to pick era-matched images. + +## Bug → source commit / OSS-Fuzz commit + +| Bug | Kind | Source commit | OSS-Fuzz commit | +| --- | --- | --- | --- | +| OSV-2020-1011 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-1013 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-1015 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-1019 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-1074 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-1112 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-1114 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-1131 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-1133 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-1187 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-1194 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-1233 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-1263 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-1294 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-136 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-154 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-1715 | migration | `bccf1c433a49` | `ffc6af6d1d24` | +| OSV-2020-179 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-194 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-28 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-342 | migration | `32dc9e3225cc` | `81c465662194` | +| OSV-2020-49 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-59 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-774 | migration | `bccf1c433a49` | `ffc6af6d1d24` | +| OSV-2020-78 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-795 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-812 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-918 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-922 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-972 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-992 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2020-994 | local | `e695dd6eade7` | `91d0e0786014` | +| OSV-2022-1032 | migration | `cd76bacd4aa4` | `76d961ba5449` | +| OSV-2022-445 | migration | `b306a4b8edc3` | `auto` | +| OSV-2022-661 | migration | `8402bd68ad95` | `auto` | +| OSV-2022-670 | migration | `ac24b35b1fa3` | `auto` | +| OSV-2022-709 | migration | `93d65ed6503b` | `auto` | +| OSV-2023-102 | migration | `4075324e2b81` | `c9e3a82e3dc1` | +| OSV-2023-436 | migration | `6da3474203fc` | `2cbf2afc2971` | +| OSV-2023-504 | migration | `3608ab01b61b` | `auto` | +| OSV-2023-566 | migration | `0c5a17accb50` | `auto` | +| OSV-2024-469 | migration | `a813121e0a70` | `auto` | +| OSV-2025-449 | migration | `2a77c58ebefd` | `0bd4b81ee98e` | + +## Re-run command (any bug) + +```bash +BUILD_CSV='/home/user/oss-fuzz-build/fuzzbench/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/collect_crash_builds.csv' +OUT_DIR='/home/user/oss-fuzz-build/fuzzbench/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes' + +while IFS=$'\t' read -r bug commit; do + [ "$bug" = "bug" ] && continue + ts=$(git -C /home/user/tasks-git/ndpi log -1 --format=%ct "$commit") + /home/user/pyenv/venv/bin/python3 /home/user/oss-fuzz-for-select/script/fuzz_helper.py collect_crash \ + --commit "$commit" --build_csv "$BUILD_CSV" \ + --testcases /home/user/oss-fuzz-for-select/pocs/tmp --test_input "testcase-${bug}" \ + --runner-image auto --commit-date "$ts" \ + ndpi fuzz_process_packet + cp "/home/user/oss-fuzz-build/data/crash/target_crash-${commit:0:6}-testcase-${bug}.txt" "${OUT_DIR}/${bug}.txt" +done <<'JOBS' +bug commit +OSV-2020-1011 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-1013 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-1015 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-1019 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-1074 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-1112 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-1114 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-1131 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-1133 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-1187 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-1194 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-1233 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-1263 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-1294 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-136 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-154 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-1715 bccf1c433a49af286f6b29da72169868e78d4410 +OSV-2020-179 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-194 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-28 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-342 32dc9e3225cc3c55f263221e8fd723aa85a991af +OSV-2020-49 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-59 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-774 bccf1c433a49af286f6b29da72169868e78d4410 +OSV-2020-78 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-795 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-812 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-918 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-922 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-972 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-992 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2020-994 e695dd6eade754b2d50bdf297ca8bdc4105f93ff +OSV-2022-1032 cd76bacd4aa42e0a2b97f3c8e3ff497fd3dd0495 +OSV-2022-445 b306a4b8edc35fc2a42344be7276f0b2367c85d2 +OSV-2022-661 8402bd68ad95f486f3dc12984cb39ffd8351ea1d +OSV-2022-670 ac24b35b1fa36f8df6d586742200a0dc2d54f59e +OSV-2022-709 93d65ed6503b32865b5453238c159e603bb37cb8 +OSV-2023-102 4075324e2b81c11254a28362942a477594be6b28 +OSV-2023-436 6da3474203fc2ff5981f6c73f7ad02fa81138166 +OSV-2023-504 3608ab01b61bde1b7ac88baa448fe37724a313db +OSV-2023-566 0c5a17accb509ff950829d50c2af0b031bcbe3a5 +OSV-2024-469 a813121e0a7021cdbfd64630960b330a23b1a4d2 +OSV-2025-449 2a77c58ebefd60024e7731b3befb20714bc59314 +JOBS +``` + diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1011.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1011.txt new file mode 100644 index 000000000..809b8588b --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1011.txt @@ -0,0 +1,75 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3570667668 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1011 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000045593 at pc 0x0000004c36dd bp 0x7fff68cc5ee0 sp 0x7fff68cc5660 +READ of size 4 at 0x602000045593 thread T0 + #0 0x4c36dc in printf_common(void*, char const*, __va_list_tag*) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 + #1 0x4c5000 in snprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1722:1 + #2 0x60cec7 in ndpi_search_mail_smtp_tcp /src/ndpi/src/lib/protocols/mail_smtp.c:177:5 + #3 0x574ee6 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4020:4 + #4 0x582995 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4066:5 + #5 0x582995 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #6 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #7 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #8 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #10 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7ff6ad18482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #12 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x602000045593 is located 0 bytes to the right of 3-byte region [0x602000045590,0x602000045593) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x647333 in ndpi_base64_decode /src/ndpi/src/lib/ndpi_utils.c:811:15 + #2 0x60ce99 in ndpi_search_mail_smtp_tcp /src/ndpi/src/lib/protocols/mail_smtp.c:174:9 + #3 0x574ee6 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4020:4 + #4 0x582995 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4066:5 + #5 0x582995 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #6 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #7 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #8 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #10 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7ff6ad18482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 in printf_common(void*, char const*, __va_list_tag*) +Shadow bytes around the buggy address: + 0x0c0480000a60: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000a70: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000a80: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000a90: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000aa0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 00 +=>0x0c0480000ab0: fa fa[03]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000ac0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000ad0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000ae0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000af0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1013.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1013.txt new file mode 100644 index 000000000..05a25b2a3 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1013.txt @@ -0,0 +1,68 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3570937541 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1013 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x608000000171 at pc 0x000000590a01 bp 0x7fff5ab9c060 sp 0x7fff5ab9c058 +READ of size 1 at 0x608000000171 thread T0 + #0 0x590a00 in ndpi_check_amazon_video /src/ndpi/src/lib/protocols/amazon_video.c:39:8 + #1 0x590a00 in ndpi_search_amazon_video /src/ndpi/src/lib/protocols/amazon_video.c:68:5 + #2 0x574ee6 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4020:4 + #3 0x582995 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4066:5 + #4 0x582995 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #5 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #6 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #7 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #8 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #9 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f1524ed482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #11 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x608000000171 is located 0 bytes to the right of 81-byte region [0x608000000120,0x608000000171) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f1524ed482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/amazon_video.c:39:8 in ndpi_check_amazon_video +Shadow bytes around the buggy address: + 0x0c107fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff8000: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff8010: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 01 fa +=>0x0c107fff8020: fa fa fa fa 00 00 00 00 00 00 00 00 00 00[01]fa + 0x0c107fff8030: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8040: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8050: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8060: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8070: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1015.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1015.txt new file mode 100644 index 000000000..1ace281e2 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1015.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3571216204 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1015 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6040000000bc at pc 0x0000004bbfd6 bp 0x7fff7a760d70 sp 0x7fff7a760518 +READ of size 13 at 0x6040000000bc thread T0 + #0 0x4bbfd5 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:843:7 + #1 0x4bc4c9 in memcmp /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:875:10 + #2 0x5abf09 in ndpi_search_memcached /src/ndpi/src/lib/protocols/memcached.c:162:14 + #3 0x56f6e4 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:3977:7 + #4 0x5829d8 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4068:5 + #5 0x5829d8 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #6 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #7 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #8 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #10 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fbc6642582f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #12 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x6040000000bc is located 0 bytes to the right of 44-byte region [0x604000000090,0x6040000000bc) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7fbc6642582f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:843:7 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) +Shadow bytes around the buggy address: + 0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 04 +=>0x0c087fff8010: fa fa 00 00 00 00 00[04]fa fa 00 00 00 00 00 05 + 0x0c087fff8020: fa fa 00 00 00 00 01 fa fa fa 00 00 00 00 07 fa + 0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1019.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1019.txt new file mode 100644 index 000000000..851556c35 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1019.txt @@ -0,0 +1,73 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3571471376 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1019 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd5b623e52 at pc 0x0000004c3a2d bp 0x7ffd5b623440 sp 0x7ffd5b622bd8 +WRITE of size 2 at 0x7ffd5b623e52 thread T0 + #0 0x4c3a2c in vsnprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1651:1 + #1 0x4c5000 in snprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1722:1 + #2 0x5a05dc in getTLScertificate /src/ndpi/src/lib/protocols/tls.c:704:22 + #3 0x5a40a2 in tlsDetectProtocolFromCertificate /src/ndpi/src/lib/protocols/tls.c:1121:12 + #4 0x5a53f9 in ndpi_search_tls_tcp_udp /src/ndpi/src/lib/protocols/tls.c:1482:8 + #5 0x574ee6 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4020:4 + #6 0x582995 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4066:5 + #7 0x582995 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #8 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #9 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #10 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #12 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fdd6a5ca82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #14 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +Address 0x7ffd5b623e52 is located in stack of thread T0 at offset 2098 in frame + #0 0x59d62f in getTLScertificate /src/ndpi/src/lib/protocols/tls.c:203 + + This frame has 5 object(s): + [32, 938) 'ja3' (line 205) + [1072, 2096) 'ja3_str' (line 208) <== Memory access at offset 2098 overflows this variable + [2224, 2312) 'ctx' (line 209) + [2352, 2368) 'md5_hash' (line 210) + [2384, 2396) 'ret_match' (line 427) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1651:1 in vsnprintf +Shadow bytes around the buggy address: + 0x10002b6bc770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10002b6bc780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10002b6bc790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10002b6bc7a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10002b6bc7b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x10002b6bc7c0: 00 00 00 00 00 00 00 00 00 00[f2]f2 f2 f2 f2 f2 + 0x10002b6bc7d0: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 + 0x10002b6bc7e0: 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 f2 f2 f8 f8 + 0x10002b6bc7f0: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10002b6bc800: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 + 0x10002b6bc810: 00 00 00 00 f2 f2 f2 f2 f8 f8 f3 f3 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1074.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1074.txt new file mode 100644 index 000000000..36bc5d49f --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1074.txt @@ -0,0 +1,71 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3571722228 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1074 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6100000001f9 at pc 0x0000006424c4 bp 0x7ffc6d690350 sp 0x7ffc6d690348 +READ of size 4 at 0x6100000001f9 thread T0 + #0 0x6424c3 in SHA1Transform /src/ndpi/src/lib/third_party/src/ndpi_sha1.c:115:5 + #1 0x64294d in SHA1Update /src/ndpi/src/lib/third_party/src/ndpi_sha1.c:195:13 + #2 0x5a274d in getSSCertificateFingerprint /src/ndpi/src/lib/protocols/tls.c:789:5 + #3 0x5a4032 in tlsDetectProtocolFromCertificate /src/ndpi/src/lib/protocols/tls.c:1110:7 + #4 0x5a53f9 in ndpi_search_tls_tcp_udp /src/ndpi/src/lib/protocols/tls.c:1482:8 + #5 0x574ee6 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4020:4 + #6 0x582995 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4066:5 + #7 0x582995 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #8 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #9 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #10 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #12 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fcaaea4f82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #14 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x6100000001f9 is located 1 bytes to the right of 184-byte region [0x610000000140,0x6100000001f8) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7fcaaea4f82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/third_party/src/ndpi_sha1.c:115:5 in SHA1Transform +Shadow bytes around the buggy address: + 0x0c207fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c207fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c207fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c207fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c207fff8020: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 +=>0x0c207fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00[fa] + 0x0c207fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c207fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c207fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c207fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c207fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1112.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1112.txt new file mode 100644 index 000000000..0a43e2a80 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1112.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3572013825 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1112 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x607000000150 at pc 0x000000596715 bp 0x7ffea08f4970 sp 0x7ffea08f4968 +READ of size 1 at 0x607000000150 thread T0 + #0 0x596714 in getNameLength /src/ndpi/src/lib/protocols/dns.c:50:6 + #1 0x596714 in search_valid_dns /src/ndpi/src/lib/protocols/dns.c:164:19 + #2 0x596714 in ndpi_search_dns /src/ndpi/src/lib/protocols/dns.c:253:19 + #3 0x571453 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:3965:7 + #4 0x5829d8 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4068:5 + #5 0x5829d8 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #6 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #7 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #8 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #10 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f5bc3f2f82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #12 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x607000000150 is located 9 bytes to the right of 71-byte region [0x607000000100,0x607000000147) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f5bc3f2f82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/dns.c:50:6 in getNameLength +Shadow bytes around the buggy address: + 0x0c0e7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff8000: fa fa fa fa 00 00 00 00 00 00 00 00 00 fa fa fa + 0x0c0e7fff8010: fa fa 00 00 00 00 00 00 00 00 07 fa fa fa fa fa +=>0x0c0e7fff8020: 00 00 00 00 00 00 00 00 07 fa[fa]fa fa fa fa fa + 0x0c0e7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1114.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1114.txt new file mode 100644 index 000000000..69d892137 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1114.txt @@ -0,0 +1,68 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3572246765 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1114 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000000172 at pc 0x0000005c7437 bp 0x7ffc1107ee10 sp 0x7ffc1107ee08 +READ of size 2 at 0x606000000172 thread T0 + #0 0x5c7436 in ndpi_int_check_stun /src/ndpi/src/lib/protocols/stun.c:319:25 + #1 0x5c4354 in ndpi_search_stun /src/ndpi/src/lib/protocols/stun.c:512:6 + #2 0x56f6e4 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:3977:7 + #3 0x5829d8 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4068:5 + #4 0x5829d8 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #5 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #6 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #7 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #8 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #9 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fddb052d82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #11 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x606000000173 is located 0 bytes to the right of 51-byte region [0x606000000140,0x606000000173) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7fddb052d82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/stun.c:319:25 in ndpi_int_check_stun +Shadow bytes around the buggy address: + 0x0c0c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c0c7fff8010: 00 00 00 00 00 00 00 03 fa fa fa fa 00 00 00 00 +=>0x0c0c7fff8020: 00 00 03 fa fa fa fa fa 00 00 00 00 00 00[03]fa + 0x0c0c7fff8030: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c7fff8040: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c7fff8050: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa + 0x0c0c7fff8060: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c7fff8070: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1131.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1131.txt new file mode 100644 index 000000000..1d84408e7 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1131.txt @@ -0,0 +1,68 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3572516026 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1131 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6040000000b9 at pc 0x0000005c7c9e bp 0x7ffd413af520 sp 0x7ffd413af518 +READ of size 2 at 0x6040000000b9 thread T0 + #0 0x5c7c9d in ndpi_search_setup_capwap /src/ndpi/src/lib/protocols/capwap.c:69:15 + #1 0x5c7c9d in ndpi_search_capwap /src/ndpi/src/lib/protocols/capwap.c:108:5 + #2 0x571453 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:3965:7 + #3 0x5829d8 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4068:5 + #4 0x5829d8 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #5 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #6 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #7 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #8 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #9 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f4eefb4382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #11 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x6040000000b9 is located 8 bytes to the right of 33-byte region [0x604000000090,0x6040000000b1) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f4eefb4382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/capwap.c:69:15 in ndpi_search_setup_capwap +Shadow bytes around the buggy address: + 0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 01 fa +=>0x0c087fff8010: fa fa 00 00 00 00 01[fa]fa fa 00 00 00 00 00 05 + 0x0c087fff8020: fa fa 00 00 00 00 01 fa fa fa 00 00 00 00 07 fa + 0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1133.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1133.txt new file mode 100644 index 000000000..f565ba488 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1133.txt @@ -0,0 +1,67 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3572754757 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1133 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60c000000171 at pc 0x000000626c54 bp 0x7ffcbc3f5ac0 sp 0x7ffcbc3f5ab8 +READ of size 1 at 0x60c000000171 thread T0 + #0 0x626c53 in ndpi_search_fix /src/ndpi/src/lib/protocols/fix.c:38:38 + #1 0x574ee6 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4020:4 + #2 0x582995 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4066:5 + #3 0x582995 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #4 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #5 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #6 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #7 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #8 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f5a8f27282f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #10 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x60c000000171 is located 0 bytes to the right of 113-byte region [0x60c000000100,0x60c000000171) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f5a8f27282f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/fix.c:38:38 in ndpi_search_fix +Shadow bytes around the buggy address: + 0x0c187fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c187fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c187fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c187fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c187fff8010: 00 00 00 00 00 00 01 fa fa fa fa fa fa fa fa fa +=>0x0c187fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[01]fa + 0x0c187fff8030: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c187fff8040: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa + 0x0c187fff8050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c187fff8060: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c187fff8070: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1187.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1187.txt new file mode 100644 index 000000000..833a4678b --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1187.txt @@ -0,0 +1,68 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3573023927 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1187 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000000183 at pc 0x0000005c724f bp 0x7ffd2722f1d0 sp 0x7ffd2722f1c8 +READ of size 16 at 0x606000000183 thread T0 + #0 0x5c724e in ndpi_int_check_stun /src/ndpi/src/lib/protocols/stun.c:354:43 + #1 0x5c4354 in ndpi_search_stun /src/ndpi/src/lib/protocols/stun.c:512:6 + #2 0x56f6e4 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:3977:7 + #3 0x5829d8 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4068:5 + #4 0x5829d8 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #5 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #6 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #7 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #8 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #9 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f82e77fc82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #11 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x606000000183 is located 9 bytes to the right of 58-byte region [0x606000000140,0x60600000017a) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f82e77fc82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/stun.c:354:43 in ndpi_int_check_stun +Shadow bytes around the buggy address: + 0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c0c7fff8010: 00 00 00 00 00 00 00 03 fa fa fa fa 00 00 00 00 + 0x0c0c7fff8020: 00 00 00 02 fa fa fa fa 00 00 00 00 00 00 00 02 +=>0x0c0c7fff8030:[fa]fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c7fff8040: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c7fff8050: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa + 0x0c0c7fff8060: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c7fff8070: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c7fff8080: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1194.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1194.txt new file mode 100644 index 000000000..d48b37c8a --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1194.txt @@ -0,0 +1,75 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3573297282 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1194 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000455d3 at pc 0x0000004c36dd bp 0x7fffc60f26e0 sp 0x7fffc60f1e60 +READ of size 4 at 0x6020000455d3 thread T0 + #0 0x4c36dc in printf_common(void*, char const*, __va_list_tag*) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 + #1 0x4c5000 in snprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1722:1 + #2 0x60cec7 in ndpi_search_mail_smtp_tcp /src/ndpi/src/lib/protocols/mail_smtp.c:177:5 + #3 0x574ee6 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4020:4 + #4 0x582995 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4066:5 + #5 0x582995 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #6 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #7 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #8 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #10 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f7ff84ba82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #12 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x6020000455d3 is located 0 bytes to the right of 3-byte region [0x6020000455d0,0x6020000455d3) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x647333 in ndpi_base64_decode /src/ndpi/src/lib/ndpi_utils.c:811:15 + #2 0x60ce99 in ndpi_search_mail_smtp_tcp /src/ndpi/src/lib/protocols/mail_smtp.c:174:9 + #3 0x574ee6 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4020:4 + #4 0x582995 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4066:5 + #5 0x582995 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #6 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #7 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #8 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #10 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f7ff84ba82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:553:9 in printf_common(void*, char const*, __va_list_tag*) +Shadow bytes around the buggy address: + 0x0c0480000a60: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000a70: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000a80: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000a90: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04 + 0x0c0480000aa0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 00 +=>0x0c0480000ab0: fa fa fd fa fa fa fd fa fa fa[03]fa fa fa fa fa + 0x0c0480000ac0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000ad0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000ae0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000af0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0480000b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1233.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1233.txt new file mode 100644 index 000000000..72c02b872 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1233.txt @@ -0,0 +1,70 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3573590924 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1233 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b00000020f at pc 0x00000050c4cd bp 0x7ffcae32fb70 sp 0x7ffcae32f328 +READ of size 6 at 0x60b00000020f thread T0 + #0 0x50c4cc in strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:482:5 + #1 0x59fc48 in getTLScertificate /src/ndpi/src/lib/protocols/tls.c:584:9 + #2 0x5a40a2 in tlsDetectProtocolFromCertificate /src/ndpi/src/lib/protocols/tls.c:1121:12 + #3 0x5a53f9 in ndpi_search_tls_tcp_udp /src/ndpi/src/lib/protocols/tls.c:1482:8 + #4 0x574ee6 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4020:4 + #5 0x582995 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4066:5 + #6 0x582995 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #7 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #8 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #9 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #10 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #11 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f5fd8a1982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #13 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x60b00000020f is located 0 bytes to the right of 111-byte region [0x60b0000001a0,0x60b00000020f) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f5fd8a1982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:482:5 in strncpy +Shadow bytes around the buggy address: + 0x0c167fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff8000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c167fff8010: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00 + 0x0c167fff8020: 00 00 00 00 00 00 00 00 00 00 00 07 fa fa fa fa + 0x0c167fff8030: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c167fff8040: 00[07]fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1263.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1263.txt new file mode 100644 index 000000000..1ba6beed6 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1263.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3573894652 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1263 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b00000020d at pc 0x0000005a2c36 bp 0x7fffc7fbb0c0 sp 0x7fffc7fbb0b8 +READ of size 2 at 0x60b00000020d thread T0 + #0 0x5a2c35 in getSSCertificateFingerprint /src/ndpi/src/lib/protocols/tls.c:875:21 + #1 0x5a4032 in tlsDetectProtocolFromCertificate /src/ndpi/src/lib/protocols/tls.c:1110:7 + #2 0x5a53f9 in ndpi_search_tls_tcp_udp /src/ndpi/src/lib/protocols/tls.c:1482:8 + #3 0x574ee6 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4020:4 + #4 0x582995 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4066:5 + #5 0x582995 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #6 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #7 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #8 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #10 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fed6c5aa82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #12 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x60b00000020e is located 0 bytes to the right of 110-byte region [0x60b0000001a0,0x60b00000020e) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7fed6c5aa82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/tls.c:875:21 in getSSCertificateFingerprint +Shadow bytes around the buggy address: + 0x0c167fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff8000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c167fff8010: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00 + 0x0c167fff8020: 00 00 00 00 00 00 00 00 00 00 00 06 fa fa fa fa + 0x0c167fff8030: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c167fff8040: 00[06]fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1294.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1294.txt new file mode 100644 index 000000000..ee8f37abb --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1294.txt @@ -0,0 +1,71 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3574150359 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1294 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x608000000174 at pc 0x00000051f967 bp 0x7fff33c8b270 sp 0x7fff33c8aa38 +READ of size 64 at 0x608000000174 thread T0 + #0 0x51f966 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x642912 in SHA1Update /src/ndpi/src/lib/third_party/src/ndpi_sha1.c:192:9 + #2 0x5a274d in getSSCertificateFingerprint /src/ndpi/src/lib/protocols/tls.c:789:5 + #3 0x5a4032 in tlsDetectProtocolFromCertificate /src/ndpi/src/lib/protocols/tls.c:1110:7 + #4 0x5a53f9 in ndpi_search_tls_tcp_udp /src/ndpi/src/lib/protocols/tls.c:1482:8 + #5 0x574ee6 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4020:4 + #6 0x582995 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4066:5 + #7 0x582995 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #8 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #9 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #10 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #12 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f4a29fe482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #14 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x608000000174 is located 0 bytes to the right of 84-byte region [0x608000000120,0x608000000174) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f4a29fe482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c107fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff8000: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff8010: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 04 fa +=>0x0c107fff8020: fa fa fa fa 00 00 00 00 00 00 00 00 00 00[04]fa + 0x0c107fff8030: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8040: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8050: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8060: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8070: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-136.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-136.txt new file mode 100644 index 000000000..1aad67e99 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-136.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3574405212 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-136 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000204 at pc 0x0000005fcf9e bp 0x7ffc75f5f210 sp 0x7ffc75f5f208 +READ of size 1 at 0x60b000000204 thread T0 + #0 0x5fcf9d in ndpi_netbios_name_interpret /src/ndpi/src/lib/protocols/netbios.c:50:38 + #1 0x5fcf9d in ndpi_int_netbios_add_connection /src/ndpi/src/lib/protocols/netbios.c:80:8 + #2 0x5fcf9d in ndpi_search_netbios /src/ndpi/src/lib/protocols/netbios.c:172:2 + #3 0x571453 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:3965:7 + #4 0x5829d8 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4068:5 + #5 0x5829d8 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #6 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #7 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #8 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #10 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f197460d82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #12 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x60b000000204 is located 0 bytes to the right of 100-byte region [0x60b0000001a0,0x60b000000204) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f197460d82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/netbios.c:50:38 in ndpi_netbios_name_interpret +Shadow bytes around the buggy address: + 0x0c167fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff8000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c167fff8010: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00 + 0x0c167fff8020: 00 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa + 0x0c167fff8030: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c167fff8040:[04]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-154.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-154.txt new file mode 100644 index 000000000..0e11fcad4 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-154.txt @@ -0,0 +1,68 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3574697367 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-154 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6040000000b9 at pc 0x00000059760c bp 0x7ffeb5e3d7f0 sp 0x7ffeb5e3d7e8 +READ of size 1 at 0x6040000000b9 thread T0 + #0 0x59760b in search_valid_dns /src/ndpi/src/lib/protocols/dns.c:142:10 + #1 0x59760b in ndpi_search_dns /src/ndpi/src/lib/protocols/dns.c:253:19 + #2 0x571453 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:3965:7 + #3 0x5829d8 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4068:5 + #4 0x5829d8 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #5 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #6 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #7 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #8 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #9 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f8a294d982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #11 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x6040000000b9 is located 0 bytes to the right of 41-byte region [0x604000000090,0x6040000000b9) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f8a294d982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/dns.c:142:10 in search_valid_dns +Shadow bytes around the buggy address: + 0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 01 +=>0x0c087fff8010: fa fa 00 00 00 00 00[01]fa fa 00 00 00 00 00 05 + 0x0c087fff8020: fa fa 00 00 00 00 01 fa fa fa 00 00 00 00 07 fa + 0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1715.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1715.txt new file mode 100755 index 000000000..911bedf08 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-1715.txt @@ -0,0 +1,63 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 467619968 +INFO: Loaded 1 modules (12442 inline 8-bit counters): 12442 [0x5590e99c3700, 0x5590e99c679a), +INFO: Loaded 1 PC tables (12442 PCs): 12442 [0x5590e99c67a0,0x5590e99f7140), +/out/fuzz_process_packet: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2020-1715 +================================================================= +==7722==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7b9c04ff011e at pc 0x5590e97fe1ae bp 0x7ffe13514cb0 sp 0x7ffe13514ca8 +READ of size 1 at 0x7b9c04ff011e thread T0 + #0 0x5590e97fe1ad in ndpi_search_kerberos /src/ndpi/src/lib/protocols/kerberos.c:240:23 + #1 0x5590e97a2e85 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4060:7 + #2 0x5590e97a8b87 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4867:3 + #3 0x5590e97936d6 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:3 + #4 0x5590e9630e6d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x5590e961bbe2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x5590e9621ab0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x5590e964d5e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f9c06e6f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x5590e9614ccd in _start (/out/fuzz_process_packet+0x1abccd) + +Address 0x7b9c04ff011e is located in stack of thread T0 at offset 286 in frame + #0 0x5590e97f959f in ndpi_search_kerberos /src/ndpi/src/lib/protocols/kerberos.c:44 + + This frame has 4 object(s): + [32, 80) 'cname_str' (line 215) + [112, 160) 'realm_str' (line 255) + [192, 240) 'realm_str' (line 296) + [272, 320) 'cname_str' (line 346) <== Memory access at offset 286 is inside this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-use-after-scope /src/ndpi/src/lib/protocols/kerberos.c:240:23 in ndpi_search_kerberos +Shadow bytes around the buggy address: + 0x7b9c04fefe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b9c04feff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b9c04feff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b9c04ff0000: f1 f1 f1 f1 00 00 00 00 00 00 f2 f2 f2 f2 f8 f8 + 0x7b9c04ff0080: f8 f8 f8 f8 f2 f2 f2 f2 f8 f8 f8 f8 f8 f8 f2 f2 +=>0x7b9c04ff0100: f2 f2 f8[f8]f8 f8 f8 f8 f3 f3 f3 f3 f3 f3 f3 f3 + 0x7b9c04ff0180: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x7b9c04ff0200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b9c04ff0280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b9c04ff0300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b9c04ff0380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7722==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-179.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-179.txt new file mode 100644 index 000000000..b6791c3e4 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-179.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3574961223 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-179 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6040000000bb at pc 0x000000597648 bp 0x7ffe79a1cc50 sp 0x7ffe79a1cc48 +READ of size 2 at 0x6040000000bb thread T0 + #0 0x597647 in get16 /src/ndpi/src/lib/protocols/dns.c:40:17 + #1 0x597647 in search_valid_dns /src/ndpi/src/lib/protocols/dns.c:117:41 + #2 0x597647 in ndpi_search_dns /src/ndpi/src/lib/protocols/dns.c:253:19 + #3 0x56f6e4 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:3977:7 + #4 0x5829d8 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4068:5 + #5 0x5829d8 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #6 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #7 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #8 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #10 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fa33833b82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #12 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x6040000000bc is located 0 bytes to the right of 44-byte region [0x604000000090,0x6040000000bc) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7fa33833b82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/dns.c:40:17 in get16 +Shadow bytes around the buggy address: + 0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 04 +=>0x0c087fff8010: fa fa 00 00 00 00 00[04]fa fa 00 00 00 00 00 05 + 0x0c087fff8020: fa fa 00 00 00 00 01 fa fa fa 00 00 00 00 07 fa + 0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-194.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-194.txt new file mode 100644 index 000000000..6b4523c11 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-194.txt @@ -0,0 +1,71 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3575232549 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-194 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x607000000142 at pc 0x0000004bbfd6 bp 0x7ffd72ddd500 sp 0x7ffd72ddcca8 +READ of size 4 at 0x607000000142 thread T0 + #0 0x4bbfd5 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:843:7 + #1 0x4bc4c9 in memcmp /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:875:10 + #2 0x5dee13 in check_ymsg /src/ndpi/src/lib/protocols/yahoo.c:78:9 + #3 0x5dee13 in ndpi_search_yahoo_tcp /src/ndpi/src/lib/protocols/yahoo.c:98:11 + #4 0x5de8d4 in ndpi_search_yahoo /src/ndpi/src/lib/protocols/yahoo.c:372:2 + #5 0x574ee6 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4020:4 + #6 0x582995 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4066:5 + #7 0x582995 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #8 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #9 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #10 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #12 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f715b7d082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #14 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x607000000142 is located 0 bytes to the right of 66-byte region [0x607000000100,0x607000000142) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f715b7d082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:843:7 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) +Shadow bytes around the buggy address: + 0x0c0e7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff8000: fa fa fa fa 00 00 00 00 00 00 00 00 00 fa fa fa + 0x0c0e7fff8010: fa fa 00 00 00 00 00 00 00 00 02 fa fa fa fa fa +=>0x0c0e7fff8020: 00 00 00 00 00 00 00 00[02]fa fa fa fa fa fa fa + 0x0c0e7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-28.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-28.txt new file mode 100644 index 000000000..6d5393cae --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-28.txt @@ -0,0 +1,77 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3575489900 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-28 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000000107 at pc 0x000000596715 bp 0x7ffec40d5230 sp 0x7ffec40d5228 +READ of size 1 at 0x604000000107 thread T0 + #0 0x596714 in getNameLength /src/ndpi/src/lib/protocols/dns.c:50:6 + #1 0x596714 in search_valid_dns /src/ndpi/src/lib/protocols/dns.c:164:19 + #2 0x596714 in ndpi_search_dns /src/ndpi/src/lib/protocols/dns.c:253:19 + #3 0x57ad44 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4008:2 + #4 0x582995 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4066:5 + #5 0x582995 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #6 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #7 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #8 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #10 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fd5bd61582f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #12 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x604000000107 is located 9 bytes to the left of 33-byte region [0x604000000110,0x604000000131) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x555677 in ndpi_malloc /src/ndpi/src/lib/ndpi_main.c:83:77 + #2 0x555677 in ndpi_strdup /src/ndpi/src/lib/ndpi_main.c:136:13 + #3 0x555677 in ndpi_add_host_url_subprotocol /src/ndpi/src/lib/ndpi_main.c:472:17 + #4 0x555677 in ndpi_init_protocol_match /src/ndpi/src/lib/ndpi_main.c:543:3 + #5 0x55d0ea in init_string_based_protocols /src/ndpi/src/lib/ndpi_main.c:692:5 + #6 0x55d0ea in ndpi_init_protocol_defaults /src/ndpi/src/lib/ndpi_main.c:1784:5 + #7 0x5567dc in ndpi_init_detection_module /src/ndpi/src/lib/ndpi_main.c:2213:3 + #8 0x553675 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:13:25 + #9 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #10 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #12 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fd5bd61582f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/dns.c:50:6 in getNameLength +Shadow bytes around the buggy address: + 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 06 + 0x0c087fff8010: fa fa 00 00 00 00 00 06 fa fa 00 00 00 00 00 05 +=>0x0c087fff8020:[fa]fa 00 00 00 00 01 fa fa fa 00 00 00 00 07 fa + 0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-342.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-342.txt new file mode 100755 index 000000000..64006ecd2 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-342.txt @@ -0,0 +1,63 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 532848243 +INFO: Loaded 1 modules (11430 inline 8-bit counters): 11430 [0x558486b115b0, 0x558486b14256), +INFO: Loaded 1 PC tables (11430 PCs): 11430 [0x558486b14258,0x558486b40cb8), +/out/fuzz_process_packet: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2020-342 +================================================================= +==7726==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7b18745f0278 at pc 0x5584869e8a53 bp 0x7ffcb7f544b0 sp 0x7ffcb7f544a8 +WRITE of size 1 at 0x7b18745f0278 thread T0 + #0 0x5584869e8a52 in ndpi_search_kerberos /src/ndpi/src/lib/protocols/kerberos.c:116:30 + #1 0x55848698e9e1 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4111:4 + #2 0x558486993a4a in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4854:3 + #3 0x55848697e6d6 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:3 + #4 0x55848681be6d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x558486806be2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x55848680cab0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x5584868385e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f18765a4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x5584867ffccd in _start (/out/fuzz_process_packet+0xc8ccd) + +Address 0x7b18745f0278 is located in stack of thread T0 at offset 120 in frame + #0 0x5584869e70af in ndpi_search_kerberos /src/ndpi/src/lib/protocols/kerberos.c:42 + + This frame has 4 object(s): + [32, 56) 'cname_str' (line 87) + [96, 120) 'realm_str' (line 110) <== Memory access at offset 120 overflows this variable + [160, 184) 'realm_str' (line 142) + [224, 248) 'cname_str' (line 173) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ndpi/src/lib/protocols/kerberos.c:116:30 in ndpi_search_kerberos +Shadow bytes around the buggy address: + 0x7b18745eff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b18745f0000: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7b18745f0080: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7b18745f0100: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7b18745f0180: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x7b18745f0200: f1 f1 f1 f1 00 00 00 f2 f2 f2 f2 f2 00 00 00[f2] + 0x7b18745f0280: f2 f2 f2 f2 f8 f8 f8 f2 f2 f2 f2 f2 f8 f8 f8 f3 + 0x7b18745f0300: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x7b18745f0380: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x7b18745f0400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b18745f0480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7726==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-49.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-49.txt new file mode 100644 index 000000000..a09bdd431 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-49.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3575743738 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-49 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6040000000ba at pc 0x0000005fc60e bp 0x7ffd1777c930 sp 0x7ffd1777c928 +READ of size 1 at 0x6040000000ba thread T0 + #0 0x5fc60d in ndpi_netbios_name_interpret /src/ndpi/src/lib/protocols/netbios.c:42:10 + #1 0x5fc60d in ndpi_int_netbios_add_connection /src/ndpi/src/lib/protocols/netbios.c:80:8 + #2 0x5fc60d in ndpi_search_netbios /src/ndpi/src/lib/protocols/netbios.c:345:4 + #3 0x571453 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:3965:7 + #4 0x5829d8 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4068:5 + #5 0x5829d8 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #6 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #7 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #8 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #10 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fe94817682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #12 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x6040000000ba is located 0 bytes to the right of 42-byte region [0x604000000090,0x6040000000ba) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7fe94817682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/netbios.c:42:10 in ndpi_netbios_name_interpret +Shadow bytes around the buggy address: + 0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 02 +=>0x0c087fff8010: fa fa 00 00 00 00 00[02]fa fa 00 00 00 00 00 05 + 0x0c087fff8020: fa fa 00 00 00 00 01 fa fa fa 00 00 00 00 07 fa + 0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-59.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-59.txt new file mode 100644 index 000000000..6eb79867f --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-59.txt @@ -0,0 +1,68 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3575988774 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-59 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x607000000148 at pc 0x00000051f967 bp 0x7ffd94e20ea0 sp 0x7ffd94e20668 +READ of size 20 at 0x607000000148 thread T0 + #0 0x51f966 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x5c8a4e in ndpi_search_bittorrent /src/ndpi/src/lib/protocols/bittorrent.c + #2 0x574ee6 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4020:4 + #3 0x582995 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4066:5 + #4 0x582995 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #5 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #6 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #7 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #8 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #9 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f8efb35582f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #11 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x607000000148 is located 7 bytes to the right of 65-byte region [0x607000000100,0x607000000141) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f8efb35582f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c0e7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff8000: fa fa fa fa 00 00 00 00 00 00 00 00 00 fa fa fa + 0x0c0e7fff8010: fa fa 00 00 00 00 00 00 00 00 01 fa fa fa fa fa +=>0x0c0e7fff8020: 00 00 00 00 00 00 00 00 01[fa]fa fa fa fa fa fa + 0x0c0e7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-774.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-774.txt new file mode 100755 index 000000000..1d82c15b9 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-774.txt @@ -0,0 +1,62 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 401829420 +INFO: Loaded 1 modules (12442 inline 8-bit counters): 12442 [0x55e51e2d8700, 0x55e51e2db79a), +INFO: Loaded 1 PC tables (12442 PCs): 12442 [0x55e51e2db7a0,0x55e51e30c140), +/out/fuzz_process_packet: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2020-774 +================================================================= +==7722==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7cc8dbde029d at pc 0x55e51e11306a bp 0x7fffc9f1f430 sp 0x7fffc9f1f428 +READ of size 1 at 0x7cc8dbde029d thread T0 + #0 0x55e51e113069 in ndpi_search_kerberos /src/ndpi/src/lib/protocols/kerberos.c:293:17 + #1 0x55e51e0b7e85 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:4060:7 + #2 0x55e51e0bdb87 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4867:3 + #3 0x55e51e0a86d6 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:3 + #4 0x55e51df45e6d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #5 0x55e51df30be2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #6 0x55e51df36ab0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #7 0x55e51df625e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fe8dca5c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x55e51df29ccd in _start (/out/fuzz_process_packet+0x1abccd) + +0x7cc8dbde029d is located 0 bytes after 157-byte region [0x7cc8dbde0200,0x7cc8dbde029d) +allocated by thread T0 here: + #0 0x55e51e0647c4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55e51e18a0f3 in operator new(unsigned long) cxa_noexception.cpp + #2 0x55e51df30be2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x55e51df36ab0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x55e51df625e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7fe8dca5c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/kerberos.c:293:17 in ndpi_search_kerberos +Shadow bytes around the buggy address: + 0x7cc8dbde0000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x7cc8dbde0080: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa + 0x7cc8dbde0100: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7cc8dbde0180: 00 00 00 00 00 00 00 05 fa fa fa fa fa fa fa fa + 0x7cc8dbde0200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7cc8dbde0280: 00 00 00[05]fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cc8dbde0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cc8dbde0380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cc8dbde0400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cc8dbde0480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7cc8dbde0500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==7722==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-78.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-78.txt new file mode 100644 index 000000000..3b8489135 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-78.txt @@ -0,0 +1,70 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3576219241 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-78 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000026f at pc 0x0000004bbfd6 bp 0x7fffa6432630 sp 0x7fffa6431dd8 +READ of size 7 at 0x60300000026f thread T0 + #0 0x4bbfd5 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:843:7 + #1 0x4bc4c9 in memcmp /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:875:10 + #2 0x5ecff7 in ndpi_check_spotify /src/ndpi/src/lib/protocols/spotify.c:51:5 + #3 0x5ecff7 in ndpi_search_spotify /src/ndpi/src/lib/protocols/spotify.c:131:7 + #4 0x56f6e4 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:3977:7 + #5 0x5829d8 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4068:5 + #6 0x5829d8 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #7 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #8 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #9 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #10 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #11 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f0b35cdc82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #13 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x60300000026f is located 0 bytes to the right of 31-byte region [0x603000000250,0x60300000026f) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f0b35cdc82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:843:7 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) +Shadow bytes around the buggy address: + 0x0c067fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c067fff8000: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 + 0x0c067fff8010: 00 00 fa fa 00 00 00 fa fa fa 00 00 00 00 fa fa + 0x0c067fff8020: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 00 + 0x0c067fff8030: fa fa fd fd fd fd fa fa 00 00 00 00 fa fa fd fd +=>0x0c067fff8040: fd fd fa fa 00 00 00 07 fa fa 00 00 00[07]fa fa + 0x0c067fff8050: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa + 0x0c067fff8060: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 + 0x0c067fff8070: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa + 0x0c067fff8080: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa + 0x0c067fff8090: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-795.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-795.txt new file mode 100644 index 000000000..e60cd4a23 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-795.txt @@ -0,0 +1,68 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3576477889 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-795 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6040000000bd at pc 0x0000005e6c90 bp 0x7ffe1d2893c0 sp 0x7ffe1d2893b8 +READ of size 1 at 0x6040000000bd thread T0 + #0 0x5e6c8f in ndpi_search_setup_iax /src/ndpi/src/lib/protocols/iax.c:70:37 + #1 0x5e6c8f in ndpi_search_iax /src/ndpi/src/lib/protocols/iax.c:93:5 + #2 0x571453 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:3965:7 + #3 0x5829d8 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4068:5 + #4 0x5829d8 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #5 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #6 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #7 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #8 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #9 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fd225ee382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #11 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x6040000000bd is located 0 bytes to the right of 45-byte region [0x604000000090,0x6040000000bd) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7fd225ee382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/iax.c:70:37 in ndpi_search_setup_iax +Shadow bytes around the buggy address: + 0x0c087fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c087fff8000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 05 +=>0x0c087fff8010: fa fa 00 00 00 00 00[05]fa fa 00 00 00 00 00 05 + 0x0c087fff8020: fa fa 00 00 00 00 01 fa fa fa 00 00 00 00 07 fa + 0x0c087fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c087fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-812.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-812.txt new file mode 100644 index 000000000..996b96536 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-812.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3576732861 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-812 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b000000210 at pc 0x0000005fcf60 bp 0x7ffe4bc31f70 sp 0x7ffe4bc31f68 +READ of size 1 at 0x60b000000210 thread T0 + #0 0x5fcf5f in ndpi_netbios_name_interpret /src/ndpi/src/lib/protocols/netbios.c:50:38 + #1 0x5fcf5f in ndpi_int_netbios_add_connection /src/ndpi/src/lib/protocols/netbios.c:80:8 + #2 0x5fcf5f in ndpi_search_netbios /src/ndpi/src/lib/protocols/netbios.c:160:2 + #3 0x571453 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:3965:7 + #4 0x5829d8 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4068:5 + #5 0x5829d8 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #6 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #7 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #8 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #10 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fa57618782f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #12 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x60b000000210 is located 0 bytes to the right of 112-byte region [0x60b0000001a0,0x60b000000210) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7fa57618782f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/netbios.c:50:38 in ndpi_netbios_name_interpret +Shadow bytes around the buggy address: + 0x0c167fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c167fff8000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c167fff8010: fd fd fd fd fd fa fa fa fa fa fa fa fa fa 00 00 + 0x0c167fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa + 0x0c167fff8030: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c167fff8040: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c167fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-918.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-918.txt new file mode 100644 index 000000000..3b9cd9182 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-918.txt @@ -0,0 +1,67 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3576968673 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-918 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x608000000171 at pc 0x000000619c0f bp 0x7ffef6857c70 sp 0x7ffef6857c68 +READ of size 1 at 0x608000000171 thread T0 + #0 0x619c0e in ndpi_search_oracle /src/ndpi/src/lib/protocols/oracle.c:46:41 + #1 0x57ad44 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4008:2 + #2 0x582995 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4066:5 + #3 0x582995 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #4 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #5 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #6 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #7 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #8 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f624315082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #10 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x608000000171 is located 0 bytes to the right of 81-byte region [0x608000000120,0x608000000171) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f624315082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/oracle.c:46:41 in ndpi_search_oracle +Shadow bytes around the buggy address: + 0x0c107fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff8000: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff8010: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 01 fa +=>0x0c107fff8020: fa fa fa fa 00 00 00 00 00 00 00 00 00 00[01]fa + 0x0c107fff8030: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8040: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8050: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8060: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa + 0x0c107fff8070: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-922.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-922.txt new file mode 100644 index 000000000..604129308 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-922.txt @@ -0,0 +1,67 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3577222013 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-922 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000026d at pc 0x0000005ee9dd bp 0x7fff5f0b3320 sp 0x7fff5f0b3318 +READ of size 1 at 0x60300000026d thread T0 + #0 0x5ee9dc in ndpi_search_h323 /src/ndpi/src/lib/protocols/h323.c:81:42 + #1 0x571453 in check_ndpi_udp_flow_func /src/ndpi/src/lib/ndpi_main.c:3965:7 + #2 0x5829d8 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4068:5 + #3 0x5829d8 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #4 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #5 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #6 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #7 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #8 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f863fd5682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #10 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x60300000026d is located 0 bytes to the right of 29-byte region [0x603000000250,0x60300000026d) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f863fd5682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/h323.c:81:42 in ndpi_search_h323 +Shadow bytes around the buggy address: + 0x0c067fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c067fff8000: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 + 0x0c067fff8010: 00 00 fa fa 00 00 00 fa fa fa 00 00 00 00 fa fa + 0x0c067fff8020: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 00 + 0x0c067fff8030: fa fa fd fd fd fd fa fa 00 00 00 00 fa fa fd fd +=>0x0c067fff8040: fd fd fa fa 00 00 00 05 fa fa 00 00 00[05]fa fa + 0x0c067fff8050: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa + 0x0c067fff8060: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 + 0x0c067fff8070: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa + 0x0c067fff8080: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa + 0x0c067fff8090: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-972.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-972.txt new file mode 100644 index 000000000..98f0c1474 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-972.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3577472812 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-972 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000000280 at pc 0x0000004bbfd6 bp 0x7ffc83f2fb40 sp 0x7ffc83f2f2e8 +READ of size 7 at 0x611000000280 thread T0 + #0 0x4bbfd5 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:843:7 + #1 0x4bc4c9 in memcmp /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:875:10 + #2 0x6067a8 in ndpi_search_irc_tcp /src/ndpi/src/lib/protocols/irc.c:679:9 + #3 0x574ee6 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4020:4 + #4 0x582995 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4066:5 + #5 0x582995 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #6 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #7 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #8 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #10 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fdad471282f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #12 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x611000000280 is located 0 bytes to the right of 256-byte region [0x611000000180,0x611000000280) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7fdad471282f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:843:7 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) +Shadow bytes around the buggy address: + 0x0c227fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8020: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa + 0x0c227fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c227fff8050:[fa]fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fff8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8070: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa + 0x0c227fff8080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff80a0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-992.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-992.txt new file mode 100644 index 000000000..d7d8f99c0 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-992.txt @@ -0,0 +1,68 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3577723141 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-992 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000000172 at pc 0x0000005f5418 bp 0x7ffc1c10bee0 sp 0x7ffc1c10bed8 +READ of size 4 at 0x606000000172 thread T0 + #0 0x5f5417 in ndpi_search_oscar_tcp_connect /src/ndpi/src/lib/protocols/oscar.c:145:4 + #1 0x5f5417 in ndpi_search_oscar /src/ndpi/src/lib/protocols/oscar.c:801:5 + #2 0x574ee6 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4020:4 + #3 0x582995 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4066:5 + #4 0x582995 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #5 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #6 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #7 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #8 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #9 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7ff463c9482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #11 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x606000000174 is located 0 bytes to the right of 52-byte region [0x606000000140,0x606000000174) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7ff463c9482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/oscar.c:145:4 in ndpi_search_oscar_tcp_connect +Shadow bytes around the buggy address: + 0x0c0c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c0c7fff8010: 00 00 00 00 00 00 00 03 fa fa fa fa 00 00 00 00 +=>0x0c0c7fff8020: 00 00 04 fa fa fa fa fa 00 00 00 00 00 00[04]fa + 0x0c0c7fff8030: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c7fff8040: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c7fff8050: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa + 0x0c0c7fff8060: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c7fff8070: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-994.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-994.txt new file mode 100644 index 000000000..212f03915 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2020-994.txt @@ -0,0 +1,70 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3577991745 +INFO: Loaded 1 modules (12858 inline 8-bit counters): 12858 [0x96b8a0, 0x96eada), +INFO: Loaded 1 PC tables (12858 PCs): 12858 [0x96eae0,0x9a0e80), +/out/fuzz_process_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-994 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000000278 at pc 0x00000050c4cd bp 0x7ffd332bdc10 sp 0x7ffd332bd3c8 +READ of size 6 at 0x611000000278 thread T0 + #0 0x50c4cc in strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:482:5 + #1 0x59eddc in getTLScertificate /src/ndpi/src/lib/protocols/tls.c:411:8 + #2 0x5a40a2 in tlsDetectProtocolFromCertificate /src/ndpi/src/lib/protocols/tls.c:1121:12 + #3 0x5a53f9 in ndpi_search_tls_tcp_udp /src/ndpi/src/lib/protocols/tls.c:1482:8 + #4 0x574ee6 in check_ndpi_tcp_flow_func /src/ndpi/src/lib/ndpi_main.c:4020:4 + #5 0x582995 in ndpi_check_flow_func /src/ndpi/src/lib/ndpi_main.c:4066:5 + #6 0x582995 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:4763:3 + #7 0x553751 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:25:5 + #8 0x457c73 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_process_packet+0x457c73) + #9 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #10 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #11 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f97f497282f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #13 0x41e7e8 in _start (/out/fuzz_process_packet+0x41e7e8) + +0x611000000278 is located 0 bytes to the right of 248-byte region [0x611000000180,0x611000000278) +allocated by thread T0 here: + #0 0x5205ad in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x438e67 in operator new(unsigned long) (/out/fuzz_process_packet+0x438e67) + #2 0x443542 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #3 0x44914e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_process_packet+0x44914e) + #4 0x4728e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f97f497282f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:482:5 in strncpy +Shadow bytes around the buggy address: + 0x0c227fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8020: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa + 0x0c227fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c227fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00[fa] + 0x0c227fff8050: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fff8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8070: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa + 0x0c227fff8080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2022-1032.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2022-1032.txt new file mode 100755 index 000000000..b3e7ae151 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2022-1032.txt @@ -0,0 +1,70 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4161649031 +INFO: Loaded 1 modules (15628 inline 8-bit counters): 15628 [0x556e98ae3a90, 0x556e98ae779c), +INFO: Loaded 1 PC tables (15628 PCs): 15628 [0x556e98ae77a0,0x556e98b24860), +/out/fuzz_process_packet: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-1032 +================================================================= +==9358==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7b9f9cf21d60 at pc 0x556e986b3831 bp 0x7ffeae242de0 sp 0x7ffeae242568 +READ of size 17 at 0x7b9f9cf21d60 thread T0 + #0 0x556e986b3830 in printf_common(void*, char const*, __va_list_tag*) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:567:9 + #1 0x556e986b3ba1 in vsnprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1713:1 + #2 0x556e986b55ed in snprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1786:1 + #3 0x556e9880e660 in ndpi_check_http_server /src/ndpi/src/lib/protocols/http.c + #4 0x556e9880b209 in check_content_type_and_change_protocol /src/ndpi/src/lib/protocols/http.c:744:5 + #5 0x556e9880c3f9 in check_content_type_and_change_protocol /src/ndpi/src/lib/protocols/http.c:739:7 + #6 0x556e98809d95 in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c + #7 0x556e987a74e9 in check_ndpi_detection_func /src/ndpi/src/lib/ndpi_main.c:5580:6 + #8 0x556e987acddb in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:6458:15 + #9 0x556e9877277f in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:29:5 + #10 0x556e9860fe7d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #11 0x556e985fabf2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #12 0x556e98600ac0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #13 0x556e9862c5f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f9f9efb8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #15 0x556e985f3cdd in _start (/out/fuzz_process_packet+0x2bbcdd) + +Address 0x7b9f9cf21d60 is located in stack of thread T0 at offset 96 in frame + #0 0x556e9880e14f in ndpi_check_http_server /src/ndpi/src/lib/protocols/http.c:646 + + This frame has 5 object(s): + [32, 36) 'a' (line 655) + [48, 52) 'b' (line 655) + [64, 68) 'c' (line 655) + [80, 96) 'buf' (line 656) + [112, 176) 'msg' (line 664) <== Memory access at offset 96 partially underflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ndpi/src/lib/protocols/http.c in ndpi_check_http_server +Shadow bytes around the buggy address: + 0x7b9f9cf21a80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7b9f9cf21b00: f1 f1 f1 f1 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 + 0x7b9f9cf21b80: f8 f8 f8 f8 f2 f2 f2 f2 f8 f8 f3 f3 f3 f3 f3 f3 + 0x7b9f9cf21c00: f1 f1 f1 f1 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 + 0x7b9f9cf21c80: f8 f8 f8 f8 f2 f2 f2 f2 f8 f8 f3 f3 f3 f3 f3 f3 +=>0x7b9f9cf21d00: f1 f1 f1 f1 04 f2 04 f2 04 f2 00 00[f2]f2 00 00 + 0x7b9f9cf21d80: 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x7b9f9cf21e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b9f9cf21e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b9f9cf21f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b9f9cf21f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==9358==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2022-445.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2022-445.txt new file mode 100755 index 000000000..56faa61ce --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2022-445.txt @@ -0,0 +1,64 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 308086954 +INFO: Loaded 1 modules (15317 inline 8-bit counters): 15317 [0x5597bcbb7bd0, 0x5597bcbbb7a5), +INFO: Loaded 1 PC tables (15317 PCs): 15317 [0x5597bcbbb7a8,0x5597bcbf74f8), +/out/fuzz_process_packet: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-445 +================================================================= +==8106==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7b709ea0f060 at pc 0x5597bc80f8bd bp 0x7ffcb6a39490 sp 0x7ffcb6a38c48 +WRITE of size 116 at 0x7b709ea0f060 thread T0 + #0 0x5597bc80f8bc in strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:631:5 + #1 0x5597bc8ca856 in tlsCheckUncommonALPN /src/ndpi/src/lib/protocols/tls.c:1224:7 + #2 0x5597bc8c5c57 in processClientServerHello /src/ndpi/src/lib/protocols/tls.c:1533:6 + #3 0x5597bc8cc626 in processTLSBlock /src/ndpi/src/lib/protocols/tls.c:865:5 + #4 0x5597bc8cbcd3 in ndpi_search_tls_tcp /src/ndpi/src/lib/protocols/tls.c:1024:2 + #5 0x5597bc899d99 in check_ndpi_detection_func /src/ndpi/src/lib/ndpi_main.c:5150:6 + #6 0x5597bc89fc72 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:6076:15 + #7 0x5597bc86c745 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:29:5 + #8 0x5597bc709e7d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #9 0x5597bc6f4bf2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #10 0x5597bc6faac0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #11 0x5597bc7265f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f70a0b28082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x5597bc6edcdd in _start (/out/fuzz_process_packet+0x2b4cdd) + +Address 0x7b709ea0f060 is located in stack of thread T0 at offset 96 in frame + #0 0x5597bc8ca6af in tlsCheckUncommonALPN /src/ndpi/src/lib/protocols/tls.c:1204 + + This frame has 1 object(s): + [32, 96) 'str' (line 1218) <== Memory access at offset 96 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/ndpi/src/lib/protocols/tls.c:1224:7 in tlsCheckUncommonALPN +Shadow bytes around the buggy address: + 0x7b709ea0ed80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7b709ea0ee00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7b709ea0ee80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7b709ea0ef00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7b709ea0ef80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x7b709ea0f000: f1 f1 f1 f1 00 00 00 00 00 00 00 00[f3]f3 f3 f3 + 0x7b709ea0f080: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7b709ea0f100: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7b709ea0f180: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7b709ea0f200: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7b709ea0f280: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==8106==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2022-661.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2022-661.txt new file mode 100755 index 000000000..ca65a17f9 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2022-661.txt @@ -0,0 +1,64 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 206474847 +INFO: Loaded 1 modules (15366 inline 8-bit counters): 15366 [0x562db7d14250, 0x562db7d17e56), +INFO: Loaded 1 PC tables (15366 PCs): 15366 [0x562db7d17e58,0x562db7d53eb8), +/out/fuzz_process_packet: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-661 +================================================================= +==8115==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b52917e00b8 at pc 0x562db795087a bp 0x7fffc83277b0 sp 0x7fffc8326f68 +READ of size 4 at 0x7b52917e00b8 thread T0 + #0 0x562db7950879 in strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:630:5 + #1 0x562db7a645a9 in dissect_softether_ip_port /src/ndpi/src/lib/protocols/softether.c:301:3 + #2 0x562db7a64235 in ndpi_search_softether /src/ndpi/src/lib/protocols/softether.c:328:9 + #3 0x562db79e0079 in check_ndpi_detection_func /src/ndpi/src/lib/ndpi_main.c:5397:6 + #4 0x562db79e5cb1 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:6293:15 + #5 0x562db79ad748 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:29:5 + #6 0x562db784ae7d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x562db7835bf2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x562db783bac0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x562db78675f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f12925d1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x562db782ecdd in _start (/out/fuzz_process_packet+0x2b7cdd) + +0x7b52917e00b8 is located 0 bytes after 40-byte region [0x7b52917e0090,0x7b52917e00b8) +allocated by thread T0 here: + #0 0x562db79697d4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x562db7acb3a3 in operator new(unsigned long) cxa_noexception.cpp + #2 0x562db7835bf2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x562db783bac0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x562db78675f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f12925d1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/softether.c:301:3 in dissect_softether_ip_port +Shadow bytes around the buggy address: + 0x7b52917dfe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b52917dfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b52917dff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b52917dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b52917e0000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 fa +=>0x7b52917e0080: fa fa 00 00 00 00 00[fa]fa fa 00 00 00 00 00 fa + 0x7b52917e0100: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7b52917e0180: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7b52917e0200: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7b52917e0280: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7b52917e0300: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==8115==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2022-670.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2022-670.txt new file mode 100755 index 000000000..fb9c8d895 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2022-670.txt @@ -0,0 +1,64 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 103233641 +INFO: Loaded 1 modules (15420 inline 8-bit counters): 15420 [0x55bd5310f590, 0x55bd531131cc), +INFO: Loaded 1 PC tables (15420 PCs): 15420 [0x55bd531131d0,0x55bd5314f590), +/out/fuzz_process_packet: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-670 +================================================================= +==8117==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7bf56bbe00c0 at pc 0x55bd52d4987a bp 0x7ffcc69f7720 sp 0x7ffcc69f6ed8 +READ of size 4 at 0x7bf56bbe00c0 thread T0 + #0 0x55bd52d49879 in strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:630:5 + #1 0x55bd52e5c7bc in dissect_softether_ip_port /src/ndpi/src/lib/protocols/softether.c:312:3 + #2 0x55bd52e5c435 in ndpi_search_softether /src/ndpi/src/lib/protocols/softether.c:339:9 + #3 0x55bd52dd9529 in check_ndpi_detection_func /src/ndpi/src/lib/ndpi_main.c:5407:6 + #4 0x55bd52ddf161 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:6303:15 + #5 0x55bd52da6748 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:29:5 + #6 0x55bd52c43e7d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x55bd52c2ebf2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x55bd52c34ac0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x55bd52c605f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fb56c962082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x55bd52c27cdd in _start (/out/fuzz_process_packet+0x2b7cdd) + +0x7bf56bbe00c0 is located 0 bytes after 48-byte region [0x7bf56bbe0090,0x7bf56bbe00c0) +allocated by thread T0 here: + #0 0x55bd52d627d4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55bd52ec54e3 in operator new(unsigned long) cxa_noexception.cpp + #2 0x55bd52c2ebf2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x55bd52c34ac0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x55bd52c605f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7fb56c962082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/softether.c:312:3 in dissect_softether_ip_port +Shadow bytes around the buggy address: + 0x7bf56bbdfe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7bf56bbdfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7bf56bbdff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7bf56bbdff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7bf56bbe0000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 +=>0x7bf56bbe0080: fa fa 00 00 00 00 00 00[fa]fa 00 00 00 00 00 fa + 0x7bf56bbe0100: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7bf56bbe0180: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7bf56bbe0200: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7bf56bbe0280: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7bf56bbe0300: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==8117==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2022-709.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2022-709.txt new file mode 100755 index 000000000..b04bf034e --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2022-709.txt @@ -0,0 +1,64 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 4282030765 +INFO: Loaded 1 modules (15437 inline 8-bit counters): 15437 [0x558dfd3a64d0, 0x558dfd3aa11d), +INFO: Loaded 1 PC tables (15437 PCs): 15437 [0x558dfd3aa120,0x558dfd3e65f0), +/out/fuzz_process_packet: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2022-709 +================================================================= +==9387==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7c4a223e0191 at pc 0x558dfcfdf87a bp 0x7ffebc04ee30 sp 0x7ffebc04e5e8 +READ of size 10 at 0x7c4a223e0191 thread T0 + #0 0x558dfcfdf879 in strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:630:5 + #1 0x558dfd0f54ad in dissect_softether_host_fqdn /src/ndpi/src/lib/protocols/softether.c:223:2 + #2 0x558dfd0f4d18 in ndpi_search_softether /src/ndpi/src/lib/protocols/softether.c:313:8 + #3 0x558dfd06fea9 in check_ndpi_detection_func /src/ndpi/src/lib/ndpi_main.c:5414:6 + #4 0x558dfd075b0e in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:6308:15 + #5 0x558dfd03c748 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:29:5 + #6 0x558dfced9e7d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x558dfcec4bf2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x558dfcecaac0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x558dfcef65f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f7a23207082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x558dfcebdcdd in _start (/out/fuzz_process_packet+0x2b8cdd) + +0x7c4a223e0191 is located 0 bytes after 129-byte region [0x7c4a223e0110,0x7c4a223e0191) +allocated by thread T0 here: + #0 0x558dfcff87d4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x558dfd15c023 in operator new(unsigned long) cxa_noexception.cpp + #2 0x558dfcec4bf2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x558dfcecaac0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x558dfcef65f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f7a23207082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/softether.c:223:2 in dissect_softether_host_fqdn +Shadow bytes around the buggy address: + 0x7c4a223dff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c4a223dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c4a223e0000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x7c4a223e0080: 00 00 00 00 00 00 00 00 01 fa fa fa fa fa fa fa + 0x7c4a223e0100: fa fa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7c4a223e0180: 00 00[01]fa fa fa fa fa fa fa fa fa 00 00 00 00 + 0x7c4a223e0200: 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa + 0x7c4a223e0280: fa fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00 + 0x7c4a223e0300: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa + 0x7c4a223e0380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7c4a223e0400: 00 00 fa fa fa fa fa fa fa fa 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==9387==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2023-436.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2023-436.txt new file mode 100755 index 000000000..fab52e1ef --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2023-436.txt @@ -0,0 +1,69 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3935065014 +INFO: Loaded 1 modules (15778 inline 8-bit counters): 15778 [0x556366eaec30, 0x556366eb29d2), +INFO: Loaded 1 PC tables (15778 PCs): 15778 [0x556366eb29d8,0x556366ef03f8), +/out/fuzz_process_packet: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-436 +================================================================= +==8937==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b87ce7e00c0 at pc 0x556366b44404 bp 0x7ffd0d0f7870 sp 0x7ffd0d0f7868 +READ of size 1 at 0x7b87ce7e00c0 thread T0 + #0 0x556366b44403 in ndpi_check_punycode_string /src/ndpi/src/lib/ndpi_utils.c:98:12 + #1 0x556366b7cc0e in ndpi_match_host_subprotocol /src/ndpi/src/lib/ndpi_main.c:8652:6 + #2 0x556366bc770d in ndpi_http_parse_subprotocol /src/ndpi/src/lib/protocols/http.c:446:9 + #3 0x556366bc404a in check_content_type_and_change_protocol /src/ndpi/src/lib/protocols/http.c:921:3 + #4 0x556366bc2a9e in process_request /src/ndpi/src/lib/protocols/http.c:1237:3 + #5 0x556366bc18c2 in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c:1351:5 + #6 0x556366bc1549 in ndpi_search_http_tcp /src/ndpi/src/lib/protocols/http.c:1425:3 + #7 0x556366b6bce9 in check_ndpi_detection_func /src/ndpi/src/lib/ndpi_main.c:5906:6 + #8 0x556366b71da6 in ndpi_internal_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:6931:15 + #9 0x556366b71512 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:7098:22 + #10 0x556366b346b2 in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:24:5 + #11 0x5563669d1e7d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #12 0x5563669bcbf2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #13 0x5563669c2ac0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #14 0x5563669ee5f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f47cf579082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #16 0x5563669b5cdd in _start (/out/fuzz_process_packet+0x2cccdd) + +0x7b87ce7e00c0 is located 0 bytes after 48-byte region [0x7b87ce7e0090,0x7b87ce7e00c0) +allocated by thread T0 here: + #0 0x556366af07d4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x556366c47be3 in operator new(unsigned long) cxa_noexception.cpp + #2 0x5563669bcbf2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x5563669c2ac0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x5563669ee5f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f47cf579082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/ndpi_utils.c:98:12 in ndpi_check_punycode_string +Shadow bytes around the buggy address: + 0x7b87ce7dfe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b87ce7dfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b87ce7dff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b87ce7dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b87ce7e0000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 +=>0x7b87ce7e0080: fa fa 00 00 00 00 00 00[fa]fa 00 00 00 00 00 fa + 0x7b87ce7e0100: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7b87ce7e0180: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7b87ce7e0200: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7b87ce7e0280: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7b87ce7e0300: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==8937==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2023-504.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2023-504.txt new file mode 100755 index 000000000..af2e250cd --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2023-504.txt @@ -0,0 +1,63 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3772349408 +INFO: Loaded 1 modules (15886 inline 8-bit counters): 15886 [0x56191748ee10, 0x561917492c1e), +INFO: Loaded 1 PC tables (15886 PCs): 15886 [0x561917492c20,0x5619174d0d00), +/out/fuzz_process_packet: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-504 +================================================================= +==8968==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7bd8973e026d at pc 0x5619171b7d5c bp 0x7fff2d6dd110 sp 0x7fff2d6dd108 +READ of size 1 at 0x7bd8973e026d thread T0 + #0 0x5619171b7d5b in ndpi_search_line /src/ndpi/src/lib/protocols/line.c:67:4 + #1 0x561917145c39 in check_ndpi_detection_func /src/ndpi/src/lib/ndpi_main.c:5933:6 + #2 0x56191714b202 in ndpi_internal_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:6998:15 + #3 0x56191714a972 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:7165:22 + #4 0x56191710d6ad in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:24:5 + #5 0x561916faae7d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #6 0x561916f95bf2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #7 0x561916f9bac0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #8 0x561916fc75f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fa8981aa082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x561916f8ecdd in _start (/out/fuzz_process_packet+0x2cecdd) + +0x7bd8973e026d is located 0 bytes after 29-byte region [0x7bd8973e0250,0x7bd8973e026d) +allocated by thread T0 here: + #0 0x5619170c97d4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x561917222bf3 in operator new(unsigned long) cxa_noexception.cpp + #2 0x561916f95bf2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x561916f9bac0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x561916fc75f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7fa8981aa082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/line.c:67:4 in ndpi_search_line +Shadow bytes around the buggy address: + 0x7bd8973dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7bd8973e0000: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 + 0x7bd8973e0080: 00 00 fa fa 00 00 00 fa fa fa 00 00 00 00 fa fa + 0x7bd8973e0100: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 00 + 0x7bd8973e0180: fa fa fd fd fd fd fa fa 00 00 00 00 fa fa fd fd +=>0x7bd8973e0200: fd fd fa fa 00 00 00 05 fa fa 00 00 00[05]fa fa + 0x7bd8973e0280: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 + 0x7bd8973e0300: fa fa 00 00 03 fa fa fa 00 00 01 fa fa fa fd fd + 0x7bd8973e0380: fd fd fa fa 00 00 00 00 fa fa 00 00 00 fa fa fa + 0x7bd8973e0400: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa + 0x7bd8973e0480: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==8968==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2023-566.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2023-566.txt new file mode 100755 index 000000000..7a2be6730 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2023-566.txt @@ -0,0 +1,68 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3606990730 +INFO: Loaded 1 modules (15989 inline 8-bit counters): 15989 [0x5617b059ae00, 0x5617b059ec75), +INFO: Loaded 1 PC tables (15989 PCs): 15989 [0x5617b059ec78,0x5617b05dd3c8), +/out/fuzz_process_packet: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-566 +================================================================= +==9057==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7ba5bc3e00fd at pc 0x5617b01ba87a bp 0x7ffc5be08cb0 sp 0x7ffc5be08468 +READ of size 1 at 0x7ba5bc3e00fd thread T0 + #0 0x5617b01ba879 in strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:630:5 + #1 0x5617b029ab3e in ndpi_http_check_content /src/ndpi/src/lib/protocols/http.c:308:8 + #2 0x5617b02978a5 in check_content_type_and_change_protocol /src/ndpi/src/lib/protocols/http.c:900:46 + #3 0x5617b0296630 in process_response /src/ndpi/src/lib/protocols/http.c:1279:3 + #4 0x5617b02959eb in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c:1372:9 + #5 0x5617b0295499 in ndpi_search_http_tcp /src/ndpi/src/lib/protocols/http.c:1458:3 + #6 0x5617b02502e9 in check_ndpi_detection_func /src/ndpi/src/lib/ndpi_main.c:5949:6 + #7 0x5617b02558a2 in ndpi_internal_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:7017:15 + #8 0x5617b0255012 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:7184:22 + #9 0x5617b02176ad in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:24:5 + #10 0x5617b00b4e7d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #11 0x5617b009fbf2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #12 0x5617b00a5ac0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #13 0x5617b00d15f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f25bd09f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #15 0x5617b0098cdd in _start (/out/fuzz_process_packet+0x2cecdd) + +0x7ba5bc3e00fd is located 0 bytes after 93-byte region [0x7ba5bc3e00a0,0x7ba5bc3e00fd) +allocated by thread T0 here: + #0 0x5617b01d37d4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x5617b032ec73 in operator new(unsigned long) cxa_noexception.cpp + #2 0x5617b009fbf2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x5617b00a5ac0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x5617b00d15f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f25bd09f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/http.c:308:8 in ndpi_http_check_content +Shadow bytes around the buggy address: + 0x7ba5bc3dfe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7ba5bc3dfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7ba5bc3dff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7ba5bc3dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7ba5bc3e0000: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 05 +=>0x7ba5bc3e0080: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00[05] + 0x7ba5bc3e0100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7ba5bc3e0180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7ba5bc3e0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7ba5bc3e0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7ba5bc3e0300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==9057==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2024-469.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2024-469.txt new file mode 100755 index 000000000..e6f124258 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2024-469.txt @@ -0,0 +1,68 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3420660998 +INFO: Loaded 1 modules (17813 inline 8-bit counters): 17813 [0x55b3ab9eea60, 0x55b3ab9f2ff5), +INFO: Loaded 1 PC tables (17813 PCs): 17813 [0x55b3ab9f2ff8,0x55b3aba38948), +/out/fuzz_process_packet: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2024-469 +================================================================= +==9997==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b9d673e00bb at pc 0x55b3ab505a17 bp 0x7fff10d91950 sp 0x7fff10d91120 +READ of size 342 at 0x7b9d673e00bb thread T0 + #0 0x55b3ab505a16 in memchr /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:919:3 + #1 0x55b3ab669cca in ndpi_http_parse_subprotocol /src/ndpi/src/lib/protocols/http.c:536:13 + #2 0x55b3ab665fa0 in check_content_type_and_change_protocol /src/ndpi/src/lib/protocols/http.c:1035:3 + #3 0x55b3ab664b8e in process_request /src/ndpi/src/lib/protocols/http.c:1351:3 + #4 0x55b3ab66384d in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c:1469:5 + #5 0x55b3ab663288 in ndpi_search_http_tcp /src/ndpi/src/lib/protocols/http.c:1547:3 + #6 0x55b3ab5e87d9 in check_ndpi_detection_func /src/ndpi/src/lib/ndpi_main.c:7191:6 + #7 0x55b3ab5f0767 in ndpi_internal_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:8409:15 + #8 0x55b3ab5efdb2 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:8603:22 + #9 0x55b3ab5cd70f in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:24:5 + #10 0x55b3ab46aedd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #11 0x55b3ab455c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #12 0x55b3ab45bb20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #13 0x55b3ab487652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f5d680a5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #15 0x55b3ab44ed3d in _start (/out/fuzz_process_packet+0x3dcd3d) + +0x7b9d673e00bb is located 2 bytes after 41-byte region [0x7b9d673e0090,0x7b9d673e00b9) +allocated by thread T0 here: + #0 0x55b3ab589834 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x55b3ab7061c3 in operator new(unsigned long) cxa_noexception.cpp + #2 0x55b3ab455c52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x55b3ab45bb20 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x55b3ab487652 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f5d680a5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/http.c:536:13 in ndpi_http_parse_subprotocol +Shadow bytes around the buggy address: + 0x7b9d673dfe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b9d673dfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b9d673dff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b9d673dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b9d673e0000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 01 +=>0x7b9d673e0080: fa fa 00 00 00 00 00[01]fa fa 00 00 00 00 00 fa + 0x7b9d673e0100: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7b9d673e0180: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7b9d673e0200: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7b9d673e0280: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7b9d673e0300: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==9997==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2025-449.txt b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2025-449.txt new file mode 100755 index 000000000..1ab090362 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/OSV-2025-449.txt @@ -0,0 +1,70 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3263833235 +INFO: Loaded 1 modules (18876 inline 8-bit counters): 18876 [0x5618a40153f0, 0x5618a4019dac), +INFO: Loaded 1 PC tables (18876 PCs): 18876 [0x5618a4019db0,0x5618a4063970), +/out/fuzz_process_packet: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2025-449 +================================================================= +==8191==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b6699de00c0 at pc 0x5618a3a5a911 bp 0x7fffcb0dd900 sp 0x7fffcb0dd088 +READ of size 11 at 0x7b6699de00c0 thread T0 + #0 0x5618a3a5a910 in printf_common(void*, char const*, __va_list_tag*) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:567:9 + #1 0x5618a3a5ac81 in vsnprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1713:1 + #2 0x5618a3a5c6cd in snprintf /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1786:1 + #3 0x5618a3baf24e in ndpi_check_http_server /src/ndpi/src/lib/protocols/http.c:981:4 + #4 0x5618a3bab866 in check_content_type_and_change_protocol /src/ndpi/src/lib/protocols/http.c:1050:5 + #5 0x5618a3baaa6e in process_request /src/ndpi/src/lib/protocols/http.c:1584:3 + #6 0x5618a3ba9716 in ndpi_check_http_tcp /src/ndpi/src/lib/protocols/http.c:1718:5 + #7 0x5618a3ba9145 in ndpi_search_http_tcp /src/ndpi/src/lib/protocols/http.c:1796:3 + #8 0x5618a3b3867a in check_ndpi_detection_func /src/ndpi/src/lib/ndpi_main.c:8353:6 + #9 0x5618a3b41cd5 in ndpi_internal_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:9769:15 + #10 0x5618a3b41202 in ndpi_detection_process_packet /src/ndpi/src/lib/ndpi_main.c:9983:22 + #11 0x5618a3b1978f in LLVMFuzzerTestOneInput /src/ndpi/fuzz/fuzz_process_packet.c:24:5 + #12 0x5618a39b6f5d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #13 0x5618a39a1cd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #14 0x5618a39a7ba0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #15 0x5618a39d36d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #16 0x7f269aa6e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #17 0x5618a399adbd in _start (/out/fuzz_process_packet+0x483dbd) + +0x7b6699de00c0 is located 0 bytes after 48-byte region [0x7b6699de0090,0x7b6699de00c0) +allocated by thread T0 here: + #0 0x5618a3ad58b4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3 + #1 0x5618a3c6e583 in operator new(unsigned long) cxa_noexception.cpp + #2 0x5618a39a1cd2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #3 0x5618a39a7ba0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #4 0x5618a39d36d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #5 0x7f269aa6e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ndpi/src/lib/protocols/http.c:981:4 in ndpi_check_http_server +Shadow bytes around the buggy address: + 0x7b6699ddfe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b6699ddfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b6699ddff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b6699ddff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b6699de0000: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 +=>0x7b6699de0080: fa fa 00 00 00 00 00 00[fa]fa 00 00 00 00 00 fa + 0x7b6699de0100: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7b6699de0180: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7b6699de0200: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7b6699de0280: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa + 0x7b6699de0300: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==8191==ABORTING diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/collect_crash_builds.csv b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/collect_crash_builds.csv new file mode 100644 index 000000000..66b8d5598 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/original-crashes/collect_crash_builds.csv @@ -0,0 +1,15 @@ +target,commit_id,oss_fuzz_commit,sanitizer +ndpi,e695dd6eade754b2d50bdf297ca8bdc4105f93ff,91d0e07860143d543356204113cefbd4ca647e36,address +ndpi,0c5a17accb509ff950829d50c2af0b031bcbe3a5,auto,address +ndpi,2a77c58ebefd60024e7731b3befb20714bc59314,0bd4b81ee98ebc7106a0f973fc4d987f11d69ebd,address +ndpi,32dc9e3225cc3c55f263221e8fd723aa85a991af,81c465662194fefeca2a80cc4426789f7683b7e3,address +ndpi,3608ab01b61bde1b7ac88baa448fe37724a313db,auto,address +ndpi,4075324e2b81c11254a28362942a477594be6b28,c9e3a82e3dc1c7142bbff53cdf1eb6dce07d776d,address +ndpi,6da3474203fc2ff5981f6c73f7ad02fa81138166,2cbf2afc2971dfaa89be9775bb0fe03ad2cd9dbc,address +ndpi,8402bd68ad95f486f3dc12984cb39ffd8351ea1d,auto,address +ndpi,93d65ed6503b32865b5453238c159e603bb37cb8,auto,address +ndpi,a813121e0a7021cdbfd64630960b330a23b1a4d2,auto,address +ndpi,ac24b35b1fa36f8df6d586742200a0dc2d54f59e,auto,address +ndpi,b306a4b8edc35fc2a42344be7276f0b2367c85d2,auto,address +ndpi,bccf1c433a49af286f6b29da72169868e78d4410,ffc6af6d1d24b3218077016923791dc9dce91d86,address +ndpi,cd76bacd4aa42e0a2b97f3c8e3ff497fd3dd0495,76d961ba5449f316416bbdb23724adcf7ec79349,address diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/patches/combined.diff b/benchmarks/ndpi_transplant_fuzz_process_packet/patches/combined.diff new file mode 100644 index 000000000..2eeaf9f59 --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/patches/combined.diff @@ -0,0 +1,1333 @@ +diff --git a/fuzz/Makefile.am b/fuzz/Makefile.am +index bfb34aafa..a08c8740a 100644 +--- a/fuzz/Makefile.am ++++ b/fuzz/Makefile.am +@@ -2,7 +2,7 @@ bin_PROGRAMS = fuzz_process_packet + + AM_CPPFLAGS = -I$(top_srcdir) + +-fuzz_process_packet_SOURCES = fuzz_process_packet.c ../__bug_dispatch.c ++fuzz_process_packet_SOURCES = fuzz_process_packet.c $(top_srcdir)/__bug_dispatch.c + fuzz_process_packet_LDFLAGS = ../src/lib/libndpi.a + if HAS_FUZZLDFLAGS + fuzz_process_packet_LDFLAGS += $(LIB_FUZZING_ENGINE) +diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h +index c6d486933..7e41ababa 100644 +--- a/src/include/ndpi_protocol_ids.h ++++ b/src/include/ndpi_protocol_ids.h +@@ -282,6 +282,7 @@ typedef enum { + NDPI_PROTOCOL_BLOOMBERG = 246, + NDPI_PROTOCOL_CAPWAP = 247, + NDPI_PROTOCOL_ZABBIX = 248, ++ NDPI_PROTOCOL_SOFTETHER = 249, + + #ifdef CUSTOM_NDPI_PROTOCOLS + #include "../../../nDPI-custom/custom_ndpi_protocol_ids.h" +diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h +index dd41be2a3..0d529d0b6 100644 +--- a/src/include/ndpi_protocols.h ++++ b/src/include/ndpi_protocols.h +@@ -212,6 +212,7 @@ void init_ookla_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_in + void init_modbus_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); + void init_capwap_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); + void init_zabbix_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); ++void init_softether_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); + void init_line_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); + void init_wireguard_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); + void init_targus_getdata_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); +diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h +index 057fa2527..eb50b6dbf 100644 +--- a/src/include/ndpi_typedefs.h ++++ b/src/include/ndpi_typedefs.h +@@ -800,6 +800,7 @@ struct ndpi_packet_struct { + struct ndpi_int_one_line_struct forwarded_line; + struct ndpi_int_one_line_struct referer_line; + struct ndpi_int_one_line_struct content_line; ++ struct ndpi_int_one_line_struct content_disposition_line; + struct ndpi_int_one_line_struct accept_line; + struct ndpi_int_one_line_struct user_agent_line; + struct ndpi_int_one_line_struct http_url_name; +@@ -1174,12 +1175,17 @@ struct ndpi_flow_struct { + */ + struct { + ndpi_http_method method; +- char *url, *content_type, *user_agent; ++ char *url, *content_type, *user_agent, *filename; + u_int8_t num_request_headers, num_response_headers; + u_int8_t request_version; /* 0=1.0 and 1=1.1. Create an enum for this? */ + u_int16_t response_status_code; /* 200, 404, etc. */ + } http; + ++ struct { ++ char *pktbuf; ++ u_int16_t pktbuf_maxlen, pktbuf_currlen; ++ } kerberos_buf; ++ + union { + /* the only fields useful for nDPI and ntopng */ + struct { +@@ -1195,6 +1201,7 @@ struct ndpi_flow_struct { + + struct { + char cname[24], realm[24]; ++ char hostname[48], domain[48], username[48]; + } kerberos; + + struct { +@@ -1214,6 +1221,17 @@ struct ndpi_flow_struct { + /* We can have STUN over SSL/TLS thus they need to live together */ + } stun_ssl; + ++ struct { ++ char *server_names, *advertised_alpns, *negotiated_alpn; ++ } tls_quic; ++ ++ struct { ++ char port[6]; ++ char fqdn[1]; ++ char pad[22]; ++ char hostname[2]; ++ } softether; ++ + struct { + char client_signature[48], server_signature[48]; + char hassh_client[33], hassh_server[33]; +diff --git a/src/lib/__bug_dispatch_fallback.c b/src/lib/__bug_dispatch_fallback.c +new file mode 100644 +index 000000000..6c4b0a3ca +--- /dev/null ++++ b/src/lib/__bug_dispatch_fallback.c +@@ -0,0 +1,4 @@ ++#include "../../__bug_dispatch.h" ++ ++/* Non-fuzzer binaries link libndpi without the harness dispatch object. */ ++volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES] __attribute__((weak)); +diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c +index 6fe1e8065..7ba317e22 100644 +--- a/src/lib/ndpi_main.c ++++ b/src/lib/ndpi_main.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include "../../__bug_dispatch.h" + #include "ahocorasick.h" + #include "libcache.h" + +@@ -36,6 +37,10 @@ + #include "ndpi_api.h" + #include "ndpi_config.h" + ++#if defined(__GNUC__) || defined(__clang__) ++volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES] __attribute__((weak)) = {0}; ++#endif ++ + #include + #ifndef WIN32 + #include +@@ -3070,6 +3075,10 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n + /* LINE */ + init_line_dissector(ndpi_str, &a, detection_bitmask); + ++ if(__bug_dispatch[0] & (1 << 5)) { ++ init_softether_dissector(ndpi_str, &a, detection_bitmask); ++ } ++ + /* TEAMVIEWER */ + init_teamviewer_dissector(ndpi_str, &a, detection_bitmask); + +@@ -3307,6 +3316,10 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n + /* TELEGRAM */ + init_telegram_dissector(ndpi_str, &a, detection_bitmask); + ++ if(__bug_dispatch[1] & (1 << 0)) { ++ init_softether_dissector(ndpi_str, &a, detection_bitmask); ++ } ++ + /* QUIC */ + init_quic_dissector(ndpi_str, &a, detection_bitmask); + +@@ -3373,6 +3386,10 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n + /* ZABBIX */ + init_zabbix_dissector(ndpi_str, &a, detection_bitmask); + ++ if(__bug_dispatch[0] & (1 << 6)) { ++ init_softether_dissector(ndpi_str, &a, detection_bitmask); ++ } ++ + /*** Put false-positive sensitive protocols at the end ***/ + + /* VIBER */ +@@ -3417,6 +3434,11 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n + /* Targus Getdata */ + init_targus_getdata_dissector(ndpi_str, &a, detection_bitmask); + ++ if(__bug_dispatch[0] & (1 << 4)) { ++ init_softether_dissector(ndpi_str, &a, detection_bitmask); ++ } else { ++ } ++ + #ifdef CUSTOM_NDPI_PROTOCOLS + #include "../../../nDPI-custom/custom_ndpi_main_init.c" + #endif +@@ -3744,6 +3766,9 @@ static int ndpi_init_packet_header(struct ndpi_detection_module_struct *ndpi_str + if(flow->http.url) ndpi_free(flow->http.url); + if(flow->http.content_type) ndpi_free(flow->http.content_type); + if(flow->http.user_agent) ndpi_free(flow->http.user_agent); ++ if(__bug_dispatch[0] & (1 << 2)) { ++ if(flow->kerberos_buf.pktbuf) ndpi_free(flow->kerberos_buf.pktbuf); ++ } + + backup = flow->num_processed_pkts; + backup1 = flow->guessed_protocol_id; +@@ -3953,17 +3978,33 @@ void check_ndpi_udp_flow_func(struct ndpi_detection_module_struct *ndpi_str, + + NDPI_SAVE_AS_BITMASK(detection_bitmask, flow->packet.detected_protocol_stack[0]); + +- if((proto_id != NDPI_PROTOCOL_UNKNOWN) +- && NDPI_BITMASK_COMPARE(flow->excluded_protocol_bitmask, +- ndpi_str->callback_buffer[proto_index].excluded_protocol_bitmask) == 0 +- && NDPI_BITMASK_COMPARE(ndpi_str->callback_buffer[proto_index].detection_bitmask, +- detection_bitmask) != 0 +- && (ndpi_str->callback_buffer[proto_index].ndpi_selection_bitmask +- & *ndpi_selection_packet) == ndpi_str->callback_buffer[proto_index].ndpi_selection_bitmask) { +- if((flow->guessed_protocol_id != NDPI_PROTOCOL_UNKNOWN) +- && (ndpi_str->proto_defaults[flow->guessed_protocol_id].func != NULL)) +- ndpi_str->proto_defaults[flow->guessed_protocol_id].func(ndpi_str, flow), +- func = ndpi_str->proto_defaults[flow->guessed_protocol_id].func; ++ if(__bug_dispatch[1] & (1 << 0)) { ++ if((flow->guessed_protocol_id != NDPI_PROTOCOL_QUIC) ++ && (proto_id != NDPI_PROTOCOL_UNKNOWN) ++ && NDPI_BITMASK_COMPARE(flow->excluded_protocol_bitmask, ++ ndpi_str->callback_buffer[proto_index].excluded_protocol_bitmask) == 0 ++ && NDPI_BITMASK_COMPARE(ndpi_str->callback_buffer[proto_index].detection_bitmask, ++ detection_bitmask) != 0 ++ && (ndpi_str->callback_buffer[proto_index].ndpi_selection_bitmask ++ & *ndpi_selection_packet) == ndpi_str->callback_buffer[proto_index].ndpi_selection_bitmask) { ++ if((flow->guessed_protocol_id != NDPI_PROTOCOL_UNKNOWN) ++ && (ndpi_str->proto_defaults[flow->guessed_protocol_id].func != NULL)) ++ ndpi_str->proto_defaults[flow->guessed_protocol_id].func(ndpi_str, flow), ++ func = ndpi_str->proto_defaults[flow->guessed_protocol_id].func; ++ } ++ } else { ++ if((proto_id != NDPI_PROTOCOL_UNKNOWN) ++ && NDPI_BITMASK_COMPARE(flow->excluded_protocol_bitmask, ++ ndpi_str->callback_buffer[proto_index].excluded_protocol_bitmask) == 0 ++ && NDPI_BITMASK_COMPARE(ndpi_str->callback_buffer[proto_index].detection_bitmask, ++ detection_bitmask) != 0 ++ && (ndpi_str->callback_buffer[proto_index].ndpi_selection_bitmask ++ & *ndpi_selection_packet) == ndpi_str->callback_buffer[proto_index].ndpi_selection_bitmask) { ++ if((flow->guessed_protocol_id != NDPI_PROTOCOL_UNKNOWN) ++ && (ndpi_str->proto_defaults[flow->guessed_protocol_id].func != NULL)) ++ ndpi_str->proto_defaults[flow->guessed_protocol_id].func(ndpi_str, flow), ++ func = ndpi_str->proto_defaults[flow->guessed_protocol_id].func; ++ } + } + + for(a = 0; a < ndpi_str->callback_buffer_size_udp; a++) { +@@ -4997,8 +5038,12 @@ void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_str, + + for(a = 0; (a < packet->payload_packet_len) + && (packet->parsed_lines < NDPI_MAX_PARSE_LINES_PER_PACKET); a++) { +- if((a + 1) == packet->payload_packet_len) +- return; /* Return if only one byte remains (prevent invalid reads past end-of-buffer) */ ++ if((a + 1) == packet->payload_packet_len) { ++ if(__bug_dispatch[1] & (1 << 1)) ++ break; ++ else ++ return; /* Return if only one byte remains (prevent invalid reads past end-of-buffer) */ ++ } + + if(get_u_int16_t(packet->payload, a) == ntohs(0x0d0a)) { /* If end of line char sequence CR+NL "\r\n", process line */ + packet->line[packet->parsed_lines].len = (u_int16_t)(((unsigned long) &packet->payload[a]) - ((unsigned long) packet->line[packet->parsed_lines].ptr)); +@@ -5147,6 +5192,10 @@ void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_str, + packet->http_contentlen.len = packet->line[packet->parsed_lines].len - 16; + packet->http_num_headers++; + } ++ if(__bug_dispatch[1] & (1 << 3)) { ++ packet->content_disposition_line.ptr = &packet->line[packet->parsed_lines].ptr[21]; ++ } else { ++ } + /* "Cookie:" header line in HTTP. */ + if(packet->line[packet->parsed_lines].len > 8 + && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Cookie: ", 8) == 0) { +@@ -5212,6 +5261,12 @@ void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_str, + packet->line[packet->parsed_lines].len + = (u_int16_t)(((unsigned long) &packet->payload[packet->payload_packet_len]) - + ((unsigned long) packet->line[packet->parsed_lines].ptr)); ++ ++ if(__bug_dispatch[1] & (1 << 1)) { ++ packet->http_origin.ptr = &packet->line[packet->parsed_lines].ptr[8]; ++ packet->http_origin.len = packet->line[packet->parsed_lines].len - 8; ++ } ++ + packet->parsed_lines++; + } + } +@@ -6004,6 +6059,10 @@ char* ndpi_strnstr(const char *s, const char *find, size_t slen) { + size_t len; + + if((c = *find++) != '\0') { ++ if(__bug_dispatch[1] & (1 << 4)) { ++ if(strnlen(find - 1, slen) == slen && memcmp(s, find - 1, slen) == 0) return((char *)s); ++ } else { ++ } + len = strnlen(find, slen); + do { + char sc; +@@ -6229,6 +6288,9 @@ u_int16_t ndpi_match_host_subprotocol(struct ndpi_detection_module_struct *ndpi_ + } + } + ++ if(__bug_dispatch[1] & (1 << 1)) ++ ndpi_check_punycode_string(string_to_match, string_to_match_len); ++ + return(rc); + } + +@@ -6281,6 +6343,13 @@ void ndpi_free_flow(struct ndpi_flow_struct *flow) { + if(flow->http.url) ndpi_free(flow->http.url); + if(flow->http.content_type) ndpi_free(flow->http.content_type); + if(flow->http.user_agent) ndpi_free(flow->http.user_agent); ++ if(__bug_dispatch[0] & (1 << 2)) { ++ if(flow->kerberos_buf.pktbuf) ndpi_free(flow->kerberos_buf.pktbuf); ++ } ++ ++ if(__bug_dispatch[1] & (1 << 0)) { ++ ndpi_free(flow->protos.tls_quic.negotiated_alpn); ++ } + + if(flow->l4_proto == IPPROTO_TCP) { + if(flow->l4.tcp.tls_srv_cert_fingerprint_ctx) +diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c +index 2525cfbd7..880641e50 100644 +--- a/src/lib/protocols/http.c ++++ b/src/lib/protocols/http.c +@@ -26,6 +26,7 @@ + #define NDPI_CURRENT_PROTO NDPI_PROTOCOL_HTTP + + #include "ndpi_api.h" ++#include "../../../__bug_dispatch.h" + #include + + static void ndpi_search_http_tcp(struct ndpi_detection_module_struct *ndpi_struct, +@@ -124,6 +125,31 @@ static void parseHttpSubprotocol(struct ndpi_detection_module_struct *ndpi_struc + } + } + ++static void ndpi_http_check_content(struct ndpi_flow_struct *flow) { ++ if(__bug_dispatch[1] & (1 << 3)) { ++ struct ndpi_packet_struct *packet = &flow->packet; ++ u_int8_t attachment_len = sizeof("attachment; filename"); ++ u_int8_t filename_len = packet->content_disposition_line.len - attachment_len; ++ flow->http.filename = ndpi_malloc(filename_len - 1); ++ strncpy(flow->http.filename, (char*)packet->content_disposition_line.ptr + attachment_len + 1, ++ filename_len - 2); ++ } else { ++ } ++} ++ ++static void ndpi_check_http_server(struct ndpi_detection_module_struct *ndpi_struct, ++ struct ndpi_flow_struct *flow, ++ const char *server, u_int server_len) { ++ (void)ndpi_struct; ++ (void)flow; ++ (void)server_len; ++ ++ if(__bug_dispatch[1] & (1 << 5)) { ++ char msg[64]; ++ snprintf(msg, sizeof(msg), "Suspicious Agent [%s]", server); ++ } ++} ++ + /** + NOTE + ndpi_parse_packet_line_info is in ndpi_main.c +@@ -138,6 +164,12 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ + if(flow->http_detected && (flow->http.response_status_code != 0)) + return; + ++ if(__bug_dispatch[1] & (1 << 4)) { ++ char *ptr = ndpi_strnstr((const char *)packet->http_origin.ptr, "://", packet->http_origin.len); ++ if(ptr) ndpi_strnstr(ptr + 3, ":", (u_int16_t)(packet->http_origin.len - (ptr - (char *)packet->http_origin.ptr) - 3)); ++ } else { ++ } ++ + #if defined(NDPI_PROTOCOL_1KXUN) || defined(NDPI_PROTOCOL_IQIYI) + /* PPStream */ + if(flow->l4.tcp.ppstream_stage > 0 && flow->iqiyi_counter == 0) { +@@ -200,6 +232,16 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ + } + } + ++ if(__bug_dispatch[0] & (1 << 7)) { ++ char buf[16]; ++ strncpy(buf, (const char *)&packet->server_line.ptr[6], sizeof(buf)); ++ snprintf(NULL, 0, "%s", buf); ++ } ++ ++ if(__bug_dispatch[1] & (1 << 5)) { ++ ndpi_check_http_server(ndpi_struct, flow, (const char *)packet->server_line.ptr, packet->server_line.len); ++ } ++ + if(packet->user_agent_line.ptr != NULL && packet->user_agent_line.len != 0) { + /** + Format examples: +@@ -361,6 +403,16 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ + } + } + ++ if(__bug_dispatch[1] & (1 << 1)) { ++ ndpi_protocol_match_result ret_match; ++ ++ ndpi_match_host_subprotocol(ndpi_struct, flow, ++ (char *)packet->http_origin.ptr, ++ packet->http_origin.len, ++ &ret_match, ++ NDPI_PROTOCOL_HTTP); ++ } ++ + #if 0 + if(flow->http_detected) + parseHttpSubprotocol(ndpi_struct, flow); +@@ -403,6 +455,10 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ + } + } + ++ if(__bug_dispatch[1] & (1 << 3)) { ++ ndpi_http_check_content(flow); ++ } else { ++ } + ndpi_int_http_add_connection(ndpi_struct, flow, packet->detected_protocol_stack[0]); + } + +@@ -705,8 +761,16 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct + } + } + +- NDPI_EXCLUDE_PROTO(ndpi_struct, flow); +- http_bitmask_exclude_other(flow); ++ if(__bug_dispatch[1] & (1 << 5)) { ++ check_content_type_and_change_protocol(ndpi_struct, flow); ++ } ++ ++ if(__bug_dispatch[1] & (1 << 1)) { ++ check_content_type_and_change_protocol(ndpi_struct, flow); ++ } else { ++ NDPI_EXCLUDE_PROTO(ndpi_struct, flow); ++ http_bitmask_exclude_other(flow); ++ } + } else if((flow->l4.tcp.http_stage == 1) || (flow->l4.tcp.http_stage == 2)) { + NDPI_LOG_DBG2(ndpi_struct, "HTTP stage %u: \n", flow->l4.tcp.http_stage); + +diff --git a/src/lib/protocols/kerberos.c b/src/lib/protocols/kerberos.c +index b7fcfb61d..cc12c9ab8 100644 +--- a/src/lib/protocols/kerberos.c ++++ b/src/lib/protocols/kerberos.c +@@ -23,12 +23,15 @@ + */ + + #include "ndpi_protocol_ids.h" ++#include "../../../__bug_dispatch.h" + + #define NDPI_CURRENT_PROTO NDPI_PROTOCOL_KERBEROS + + #include "ndpi_api.h" + +-// #define KERBEROS_DEBUG 1 ++/* #define KERBEROS_DEBUG 1 */ ++ ++#define KERBEROS_PORT 88 + + static void ndpi_int_kerberos_add_connection(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow) { +@@ -36,96 +39,569 @@ static void ndpi_int_kerberos_add_connection(struct ndpi_detection_module_struct + NDPI_LOG_DBG(ndpi_struct, "trace KERBEROS\n"); + } + ++/* ************************************************* */ + +-void ndpi_search_kerberos(struct ndpi_detection_module_struct *ndpi_struct, +- struct ndpi_flow_struct *flow) { ++static void ndpi_search_kerberos_osv_2020_1715(struct ndpi_detection_module_struct *ndpi_struct, ++ struct ndpi_flow_struct *flow) { ++ struct ndpi_packet_struct *packet = &flow->packet; ++ u_int16_t sport = packet->tcp ? ntohs(packet->tcp->source) : ntohs(packet->udp->source); ++ u_int16_t dport = packet->tcp ? ntohs(packet->tcp->dest) : ntohs(packet->udp->dest); ++ ++ if((sport != KERBEROS_PORT) && (dport != KERBEROS_PORT)) { ++ NDPI_EXCLUDE_PROTO(ndpi_struct, flow); ++ return; ++ } ++ ++ NDPI_LOG_DBG(ndpi_struct, "search KERBEROS\n"); ++ ++#ifdef KERBEROS_DEBUG ++ printf("\n[Kerberos] Process packet [len: %u]\n", packet->payload_packet_len); ++#endif ++ ++ if(flow->kerberos_buf.pktbuf != NULL) { ++ u_int missing = flow->kerberos_buf.pktbuf_maxlen - flow->kerberos_buf.pktbuf_currlen; ++ ++ if(packet->payload_packet_len <= missing) { ++ memcpy(&flow->kerberos_buf.pktbuf[flow->kerberos_buf.pktbuf_currlen], packet->payload, packet->payload_packet_len); ++ flow->kerberos_buf.pktbuf_currlen += packet->payload_packet_len; ++ ++ if(flow->kerberos_buf.pktbuf_currlen == flow->kerberos_buf.pktbuf_maxlen) { ++ packet->payload = (u_int8_t *)flow->kerberos_buf.pktbuf; ++ packet->payload_packet_len = flow->kerberos_buf.pktbuf_currlen; ++#ifdef KERBEROS_DEBUG ++ printf("[Kerberos] Packet is now full: processing\n"); ++#endif ++ } else { ++#ifdef KERBEROS_DEBUG ++ printf("[Kerberos] Missing %u bytes: skipping\n", ++ flow->kerberos_buf.pktbuf_maxlen - flow->kerberos_buf.pktbuf_currlen); ++#endif ++ ++ return; ++ } ++ } ++ } ++ ++ /* I have observed 0a,0c,0d,0e at packet->payload[19/21], maybe there are other possibilities */ ++ if(packet->payload_packet_len >= 4) { ++ u_int32_t kerberos_len, expected_len; ++ u_int16_t base_offset = 0; ++ ++ if(packet->tcp) { ++ kerberos_len = ntohl(get_u_int32_t(packet->payload, 0)), ++ expected_len = packet->payload_packet_len - 4; ++ base_offset = 4; ++ } else ++ base_offset = 0, kerberos_len = expected_len = packet->payload_packet_len; ++ ++#ifdef KERBEROS_DEBUG ++ printf("[Kerberos] [Kerberos len: %u][expected_len: %u]\n", kerberos_len, expected_len); ++#endif ++ ++ if(kerberos_len < 12000) { ++ /* ++ Kerberos packets might be too long for a TCP packet ++ so it could be split across two packets. Instead of ++ rebuilding the stream we use a heuristic approach ++ */ ++ if(kerberos_len > expected_len) { ++ if(packet->tcp) { ++ if(flow->kerberos_buf.pktbuf == NULL) ++ flow->kerberos_buf.pktbuf = (char*)ndpi_malloc(kerberos_len+4); ++ ++ if(flow->kerberos_buf.pktbuf != NULL) { ++ flow->kerberos_buf.pktbuf_maxlen = kerberos_len+4; ++ memcpy(flow->kerberos_buf.pktbuf, packet->payload, packet->payload_packet_len); ++ flow->kerberos_buf.pktbuf_currlen = packet->payload_packet_len; ++ } ++ } ++ ++ return; ++ } else if(kerberos_len == expected_len) { ++ if(packet->payload_packet_len > 128) { ++ u_int16_t koffset, i; ++ ++ for(i=8; i<16; i++) ++ if((packet->payload[base_offset+i] == 0x03) ++ && (packet->payload[base_offset+i+1] == 0x02) ++ && (packet->payload[base_offset+i+2] == 0x01) ++ && (packet->payload[base_offset+i+3] != 0x05) ++ ) ++ break; ++ ++ koffset = base_offset + i + 3; ++ ++#ifdef KERBEROS_DEBUG ++ printf("[Kerberos] [msg-type: 0x%02X/%u][koffset: %u]\n", ++ packet->payload[koffset], packet->payload[koffset], koffset); ++#endif ++ ++ if(((packet->payload[koffset] == 0x0A) ++ || (packet->payload[koffset] == 0x0C) ++ || (packet->payload[koffset] == 0x0D) ++ || (packet->payload[koffset] == 0x0E))) { ++ u_int16_t koffsetp, body_offset, pad_len; ++ u_int8_t msg_type = packet->payload[koffset]; ++ ++#ifdef KERBEROS_DEBUG ++ printf("[Kerberos] Packet found 0x%02X/%u\n", msg_type, msg_type); ++#endif ++ if(msg_type != 0x0d) /* TGS-REP */ { ++ /* Process only on requests */ ++ if(packet->payload[koffset+1] == 0xA3) { ++ if(packet->payload[koffset+3] == 0x30) ++ pad_len = packet->payload[koffset+4]; ++ else { ++ /* Long pad */ ++ pad_len = packet->payload[koffset+2]; ++ for(i=3; i<10; i++) if(packet->payload[koffset+i] == pad_len) break; ++ ++ pad_len = (packet->payload[koffset+i+1] << 8) + packet->payload[koffset+i+2]; ++ koffset += i-2; ++ } ++ } else ++ pad_len = 0; ++ ++#ifdef KERBEROS_DEBUG ++ printf("pad_len=0x%02X/%u\n", pad_len, pad_len); ++#endif ++ ++ if(pad_len > 0) { ++ koffsetp = koffset + 2; ++ for(i=0; i<4; i++) if(packet->payload[koffsetp] != 0x30) koffsetp++; /* ASN.1 */ ++#ifdef KERBEROS_DEBUG ++ printf("koffsetp=%u [%02X %02X] [byte 0 must be 0x30]\n", koffsetp, packet->payload[koffsetp], packet->payload[koffsetp+1]); ++#endif ++ } else ++ koffsetp = koffset; ++ ++ body_offset = koffsetp + 1 + pad_len; ++ ++ for(i=0; i<10; i++) if(packet->payload[body_offset] != 0x05) body_offset++; /* ASN.1 */ ++#ifdef KERBEROS_DEBUG ++ printf("body_offset=%u [%02X %02X] [byte 0 must be 0x05]\n", body_offset, packet->payload[body_offset], packet->payload[body_offset+1]); ++#endif ++ } ++ ++ if(msg_type == 0x0A) /* AS-REQ */ { ++#ifdef KERBEROS_DEBUG ++ printf("[Kerberos] Processing AS-REQ\n"); ++#endif ++ ++ if(body_offset < packet->payload_packet_len) { ++ u_int16_t name_offset; ++ ++ name_offset = body_offset + 13; ++ for(i=0; i<20; i++) if(packet->payload[name_offset] != 0x1b) name_offset++; /* ASN.1 */ ++ ++#ifdef KERBEROS_DEBUG ++ printf("name_offset=%u [%02X %02X] [byte 0 must be 0x1b]\n", name_offset, packet->payload[name_offset], packet->payload[name_offset+1]); ++#endif ++ ++ if(name_offset < packet->payload_packet_len) { ++ u_int cname_len; ++ ++ name_offset += 1; ++ if(packet->payload[name_offset+1] < ' ') /* Isn't printable ? */ ++ name_offset++; ++ ++ if(packet->payload[name_offset+1] == 0x1b) ++ name_offset += 2; ++ ++ cname_len = packet->payload[name_offset]; ++ ++ if((cname_len+name_offset) < packet->payload_packet_len) { ++ u_int realm_len, realm_offset; ++ char cname_str[48]; ++ u_int8_t num_cname = 0; ++ ++ while(++num_cname <= 2) { ++ if(cname_len > sizeof(cname_str)-1) ++ cname_len = sizeof(cname_str)-1; ++ ++ strncpy(cname_str, (char*)&packet->payload[name_offset+1], cname_len); ++ cname_str[cname_len] = '\0'; ++ for(i=0; ipayload[name_offset+1+cname_len] == 0x1b)) { ++ name_offset += cname_len + 2; ++ cname_len = packet->payload[name_offset]; ++ } else ++ break; ++ } ++ ++ realm_offset = cname_len + name_offset + 3; ++ ++ /* if cname does not end with a $ then it's a username */ ++ if(cname_len && cname_str[cname_len-1] == '$') { ++ cname_str[cname_len-1] = '\0'; ++ snprintf(flow->protos.kerberos.hostname, sizeof(flow->protos.kerberos.hostname), "%s", cname_str); ++ } else ++ snprintf(flow->protos.kerberos.username, sizeof(flow->protos.kerberos.username), "%s", cname_str); ++ ++ for(i=0; i<14; i++) if(packet->payload[realm_offset] != 0x1b) realm_offset++; /* ASN.1 */ ++#ifdef KERBEROS_DEBUG ++ printf("realm_offset=%u [%02X %02X] [byte 0 must be 0x1b]\n", realm_offset, packet->payload[realm_offset], packet->payload[realm_offset+1]); ++#endif ++ realm_offset += 1; ++ //if(num_cname == 2) realm_offset++; ++ realm_len = packet->payload[realm_offset]; ++ ++ if((realm_offset+realm_len) < packet->payload_packet_len) { ++ char realm_str[48]; ++ ++ if(realm_len > sizeof(realm_str)-1) ++ realm_len = sizeof(realm_str)-1; ++ ++ realm_offset += 1; ++ ++ strncpy(realm_str, (char*)&packet->payload[realm_offset], realm_len); ++ realm_str[realm_len] = '\0'; ++ for(i=0; iprotos.kerberos.domain, sizeof(flow->protos.kerberos.domain), "%s", realm_str); ++ } ++ } ++ } ++ } ++ } else if(msg_type == 0x0c) /* TGS-REQ */ { ++#ifdef KERBEROS_DEBUG ++ printf("[Kerberos] Processing TGS-REQ\n"); ++#endif ++ ++ if(body_offset < packet->payload_packet_len) { ++ u_int name_offset, padding_offset = body_offset + 4; ++ ++ name_offset = padding_offset; ++ for(i=0; i<14; i++) if(packet->payload[name_offset] != 0x1b) name_offset++; /* ASN.1 */ ++ ++#ifdef KERBEROS_DEBUG ++ printf("name_offset=%u [%02X %02X] [byte 0 must be 0x1b]\n", name_offset, packet->payload[name_offset], packet->payload[name_offset+1]); ++#endif ++ ++ if(name_offset < packet->payload_packet_len) { ++ u_int realm_len; ++ ++ name_offset++; ++ realm_len = packet->payload[name_offset]; ++ ++ if((realm_len+name_offset) < packet->payload_packet_len) { ++ char realm_str[48]; ++ ++ if(realm_len > sizeof(realm_str)-1) ++ realm_len = sizeof(realm_str)-1; ++ ++ name_offset += 1; ++ ++ strncpy(realm_str, (char*)&packet->payload[name_offset], realm_len); ++ realm_str[realm_len] = '\0'; ++ for(i=0; iprotos.kerberos.domain, sizeof(flow->protos.kerberos.domain), "%s", realm_str); ++ ++ /* If necessary we can decode sname */ ++ ++ if(flow->kerberos_buf.pktbuf) ndpi_free(flow->kerberos_buf.pktbuf); ++ flow->kerberos_buf.pktbuf = NULL; ++ } ++ } ++ } ++ ++ if(packet->udp) ++ ndpi_int_kerberos_add_connection(ndpi_struct, flow); ++ ++ /* We set the protocol in the response */ ++ if(flow->kerberos_buf.pktbuf != NULL) { ++ free(flow->kerberos_buf.pktbuf); ++ flow->kerberos_buf.pktbuf = NULL; ++ } ++ ++ return; ++ } else if(msg_type == 0x0d) /* TGS-REP */ { ++ u_int16_t pad_data_len, cname_offset; ++ ++#ifdef KERBEROS_DEBUG ++ printf("[Kerberos] Processing TGS-REP\n"); ++#endif ++ ++ koffsetp = koffset + 4; ++ pad_data_len = packet->payload[koffsetp]; ++ /* Skip realm already filled in request */ ++ cname_offset = pad_data_len + koffsetp + 15; ++ ++ if(cname_offset < packet->payload_packet_len) { ++ u_int8_t cname_len = packet->payload[cname_offset]; ++ ++ if((cname_offset+cname_offset) < packet->payload_packet_len) { ++ char cname_str[48]; ++ ++ if(cname_len > sizeof(cname_str)-1) ++ cname_len = sizeof(cname_str)-1; ++ ++ strncpy(cname_str, (char*)&packet->payload[cname_offset+1], cname_len); ++ cname_str[cname_len] = '\0'; ++ for(i=0; iprotos.kerberos.hostname, sizeof(flow->protos.kerberos.hostname), "%s", cname_str); ++ } else ++ snprintf(flow->protos.kerberos.username, sizeof(flow->protos.kerberos.username), "%s", cname_str); ++ ++ ndpi_int_kerberos_add_connection(ndpi_struct, flow); ++ } ++ } ++ } ++ ++ return; ++ } ++ ++ if(packet->payload_packet_len > 21 && ++ packet->payload[16] == 0x05 && ++ (packet->payload[21] == 0x0a || ++ packet->payload[21] == 0x0c || packet->payload[21] == 0x0d || packet->payload[21] == 0x0e)) { ++ ndpi_int_kerberos_add_connection(ndpi_struct, flow); ++ return; ++ } ++ } ++ } ++ } else { ++#ifdef KERBEROS_DEBUG ++ printf("[Kerberos][s/dport: %u/%u] Skipping packet: too long [kerberos_len: %u]\n", ++ sport, dport, kerberos_len); ++#endif ++ ++ if(flow->protos.kerberos.domain[0] != '\0') ++ return; ++ } ++ } ++ ++ NDPI_EXCLUDE_PROTO(ndpi_struct, flow); ++} ++ ++/* ************************************************* */ ++ ++static void ndpi_search_kerberos_original(struct ndpi_detection_module_struct *ndpi_struct, ++ struct ndpi_flow_struct *flow) { + struct ndpi_packet_struct *packet = &flow->packet; + + NDPI_LOG_DBG(ndpi_struct, "search KERBEROS\n"); + ++ if(__bug_dispatch[0] & (1 << 1)) { ++ u_int16_t koffset = 19, i, name_offset; ++ ++ name_offset = packet->payload[koffset+2]; ++ for(i=3; i<10; i++) if(packet->payload[koffset+i] == name_offset) break; ++ ++ name_offset = (packet->payload[koffset+i+1] << 8) + packet->payload[koffset+i+2]; ++ koffset += i; ++ ++ for(i=0; i<4; i++) if(packet->payload[koffset] != 0x30) koffset++; /* ASN.1 */ ++ ++ name_offset = koffset + 1 + name_offset; ++ for(i=0; i<10; i++) if(packet->payload[name_offset] != 0x05) name_offset++; /* ASN.1 */ ++ ++ name_offset += 4; ++ for(i=0; i<14; i++) if(packet->payload[name_offset] != 0x1b) name_offset++; /* ASN.1 */ ++ ++ snprintf(flow->protos.kerberos.realm, sizeof(flow->protos.kerberos.realm), "%u", ++ (u_int)packet->payload[++name_offset]); ++ } ++ + /* I have observed 0a,0c,0d,0e at packet->payload[19/21], maybe there are other possibilities */ +- if(packet->payload_packet_len >= 4 && ntohl(get_u_int32_t(packet->payload, 0)) == packet->payload_packet_len - 4) { +- if(packet->payload_packet_len > 19 && +- packet->payload[14] == 0x05 && +- (packet->payload[19] == 0x0a || +- packet->payload[19] == 0x0c || packet->payload[19] == 0x0d || packet->payload[19] == 0x0e)) { +- if(packet->payload[19] == 0x0a) /* AS-REQ */ { +- u_int pad_data_len = packet->payload[23]; +- u_int body_offset = pad_data_len + 23; ++ if(__bug_dispatch[0] & (1 << 0)) { ++ if(packet->payload_packet_len >= 4) { ++ if(packet->payload_packet_len > 19 && ++ packet->payload[21] == 0x0a) { ++ if(packet->payload[21] == 0x0a) /* AS-REQ */ { ++ u_int pad_data_len = packet->payload[25]; ++ u_int body_offset = pad_data_len + 25; ++ ++ if(body_offset < packet->payload_packet_len) { ++ u_int name_offset = body_offset + 30; + +- if(body_offset < packet->payload_packet_len) { +- u_int name_offset = body_offset + 30; ++ if(name_offset < packet->payload_packet_len) { ++ u_int cname_len = packet->payload[name_offset]; + +- if(name_offset < packet->payload_packet_len) { +- u_int cname_len = packet->payload[name_offset]; ++ if((cname_len+name_offset) < packet->payload_packet_len) { ++ u_int realm_len, realm_offset = cname_len + name_offset + 4, i; ++ char cname_str[24]; + +- if((cname_len+name_offset) < packet->payload_packet_len) { +- u_int realm_len, realm_offset = cname_len + name_offset + 4, i; +- char cname_str[24]; ++ if(cname_len > sizeof(cname_str)-1) ++ cname_len = sizeof(cname_str)-1; + +- if(cname_len > sizeof(cname_str)-1) +- cname_len = sizeof(cname_str)-1; ++ strncpy(cname_str, (char*)&packet->payload[name_offset+1], cname_len); ++ cname_str[cname_len] = '\0'; ++ for(i=0; ipayload[name_offset+1], cname_len); +- cname_str[cname_len] = '\0'; +- for(i=0; iprotos.kerberos.cname, sizeof(flow->protos.kerberos.cname), "%s", cname_str); +- +- realm_len = packet->payload[realm_offset]; ++ snprintf(flow->protos.kerberos.cname, sizeof(flow->protos.kerberos.cname), "%s", cname_str); ++ ++ realm_len = packet->payload[realm_offset]; + +- if((realm_offset+realm_len) < packet->payload_packet_len) { +- char realm_str[24]; ++ if((realm_offset+realm_len) < packet->payload_packet_len) { ++ char realm_str[24]; + +- if(realm_len >= sizeof(realm_str)) +- realm_len = sizeof(realm_str); ++ if(realm_len >= sizeof(realm_str)) ++ realm_len = sizeof(realm_str); + +- strncpy(realm_str, (char*)&packet->payload[realm_offset+1], realm_len); +- realm_str[realm_len] = '\0'; +- for(i=0; ipayload[realm_offset+1], realm_len); ++ realm_str[realm_len] = '\0'; ++ for(i=0; iprotos.kerberos.realm, sizeof(flow->protos.kerberos.realm), "%s", realm_str); ++ snprintf(flow->protos.kerberos.realm, sizeof(flow->protos.kerberos.realm), "%s", realm_str); ++ } + } + } + } + } ++ ++ ndpi_int_kerberos_add_connection(ndpi_struct, flow); ++ return; ++ + } + +- ndpi_int_kerberos_add_connection(ndpi_struct, flow); +- return; ++ if(packet->payload_packet_len > 21 && ++ packet->payload[16] == 0x05 && ++ (packet->payload[21] == 0x0a || ++ packet->payload[21] == 0x0c || packet->payload[21] == 0x0d || packet->payload[21] == 0x0e)) { ++ ndpi_int_kerberos_add_connection(ndpi_struct, flow); ++ return; + ++ } + } ++ } else { ++ if(packet->payload_packet_len >= 4 && ntohl(get_u_int32_t(packet->payload, 0)) == packet->payload_packet_len - 4) { ++ if(packet->payload_packet_len > 19 && ++ packet->payload[14] == 0x05 && ++ (packet->payload[19] == 0x0a || ++ packet->payload[19] == 0x0c || packet->payload[19] == 0x0d || packet->payload[19] == 0x0e)) { ++ if(packet->payload[19] == 0x0a) /* AS-REQ */ { ++ u_int pad_data_len = packet->payload[23]; ++ u_int body_offset = pad_data_len + 23; ++ ++ if(body_offset < packet->payload_packet_len) { ++ u_int name_offset = body_offset + 30; ++ ++ if(name_offset < packet->payload_packet_len) { ++ u_int cname_len = packet->payload[name_offset]; ++ ++ if((cname_len+name_offset) < packet->payload_packet_len) { ++ u_int realm_len, realm_offset = cname_len + name_offset + 4, i; ++ char cname_str[24]; ++ ++ if(cname_len > sizeof(cname_str)-1) ++ cname_len = sizeof(cname_str)-1; ++ ++ strncpy(cname_str, (char*)&packet->payload[name_offset+1], cname_len); ++ cname_str[cname_len] = '\0'; ++ for(i=0; ipayload_packet_len > 21 && +- packet->payload[16] == 0x05 && +- (packet->payload[21] == 0x0a || +- packet->payload[21] == 0x0c || packet->payload[21] == 0x0d || packet->payload[21] == 0x0e)) { +- ndpi_int_kerberos_add_connection(ndpi_struct, flow); +- return; ++ snprintf(flow->protos.kerberos.cname, sizeof(flow->protos.kerberos.cname), "%s", cname_str); + ++ realm_len = packet->payload[realm_offset]; ++ ++ if((realm_offset+realm_len) < packet->payload_packet_len) { ++ char realm_str[24]; ++ ++ if(realm_len >= sizeof(realm_str)) ++ realm_len = sizeof(realm_str); ++ ++ strncpy(realm_str, (char*)&packet->payload[realm_offset+1], realm_len); ++ realm_str[realm_len] = '\0'; ++ for(i=0; iprotos.kerberos.realm, sizeof(flow->protos.kerberos.realm), "%s", realm_str); ++ } ++ } ++ } ++ } ++ } ++ ++ ndpi_int_kerberos_add_connection(ndpi_struct, flow); ++ return; ++ ++ } ++ ++ if(packet->payload_packet_len > 21 && ++ packet->payload[16] == 0x05 && ++ (packet->payload[21] == 0x0a || ++ packet->payload[21] == 0x0c || packet->payload[21] == 0x0d || packet->payload[21] == 0x0e)) { ++ ndpi_int_kerberos_add_connection(ndpi_struct, flow); ++ return; ++ ++ } + } + } + + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); + } + ++void ndpi_search_kerberos(struct ndpi_detection_module_struct *ndpi_struct, ++ struct ndpi_flow_struct *flow) { ++ if(__bug_dispatch[0] & (1 << 2)) { ++ ndpi_search_kerberos_osv_2020_1715(ndpi_struct, flow); ++ } else { ++ ndpi_search_kerberos_original(ndpi_struct, flow); ++ } ++} + + void init_kerberos_dissector(struct ndpi_detection_module_struct *ndpi_struct, + u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { +- ndpi_set_bitmask_protocol_detection("Kerberos", ndpi_struct, detection_bitmask, *id, +- NDPI_PROTOCOL_KERBEROS, +- ndpi_search_kerberos, +- NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, +- SAVE_DETECTION_BITMASK_AS_UNKNOWN, +- ADD_TO_DETECTION_BITMASK); ++ if(__bug_dispatch[0] & (1 << 2)) { ++ ndpi_set_bitmask_protocol_detection("Kerberos", ndpi_struct, detection_bitmask, *id, ++ NDPI_PROTOCOL_KERBEROS, ++ ndpi_search_kerberos, ++ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, ++ SAVE_DETECTION_BITMASK_AS_UNKNOWN, ++ ADD_TO_DETECTION_BITMASK); ++ } else { ++ if(__bug_dispatch[0] & (1 << 1)) { ++ ndpi_set_bitmask_protocol_detection("Kerberos", ndpi_struct, detection_bitmask, *id, ++ NDPI_PROTOCOL_KERBEROS, ++ ndpi_search_kerberos, ++ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, ++ SAVE_DETECTION_BITMASK_AS_UNKNOWN, ++ ADD_TO_DETECTION_BITMASK); ++ } else { ++ ndpi_set_bitmask_protocol_detection("Kerberos", ndpi_struct, detection_bitmask, *id, ++ NDPI_PROTOCOL_KERBEROS, ++ ndpi_search_kerberos, ++ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, ++ SAVE_DETECTION_BITMASK_AS_UNKNOWN, ++ ADD_TO_DETECTION_BITMASK); ++ } ++ } + + *id += 1; + } +diff --git a/src/lib/protocols/line.c b/src/lib/protocols/line.c +index b6e676c55..735b40eaf 100644 +--- a/src/lib/protocols/line.c ++++ b/src/lib/protocols/line.c +@@ -18,6 +18,7 @@ + * + */ + #include "ndpi_protocol_ids.h" ++#include "../../../__bug_dispatch.h" + + #define NDPI_CURRENT_PROTO NDPI_PROTOCOL_LINE + +@@ -46,6 +47,12 @@ void ndpi_search_line(struct ndpi_detection_module_struct *ndpi_struct, struct n + ndpi_line_report_protocol(ndpi_struct, flow); + return; + } ++ ++ if (__bug_dispatch[1] & (1 << 2)) { ++ if (flow->packet.payload[1] == 0xB3) { ++ return; ++ } ++ } + } + } + +diff --git a/src/lib/protocols/softether.c b/src/lib/protocols/softether.c +new file mode 100644 +index 000000000..780b2f3ee +--- /dev/null ++++ b/src/lib/protocols/softether.c +@@ -0,0 +1,202 @@ ++#include "ndpi_api.h" ++#include "../../../__bug_dispatch.h" ++ ++enum softether_value_type { ++ VALUE_INT = 0u, ++ VALUE_DATA = 1u, ++ VALUE_STR = 2u ++}; ++ ++struct softether_value { ++ char const *value_str; ++ u_int32_t value_size; ++}; ++ ++static size_t dissect_softether_type(enum softether_value_type t, ++ struct softether_value *v, ++ u_int8_t const *payload, ++ u_int16_t payload_len) { ++ size_t ret = 0; ++ v->value_size = 0; ++ ++ switch(t) { ++ case VALUE_INT: ++ v->value_size = sizeof(int); ++ ret = v->value_size; ++ break; ++ ++ case VALUE_DATA: ++ case VALUE_STR: ++ v->value_str = (char const *)payload + 4; ++ u_int32_t siz = ntohl(get_u_int32_t(payload, 0)); ++ if(siz == 0 || (u_int64_t)payload_len < (u_int64_t)siz + 3) ++ return 0; ++ ++ if(t == VALUE_DATA) ++ siz--; ++ ++ v->value_size = siz; ++ ret = siz + sizeof(siz); ++ break; ++ ++ } ++ ++ return ret; ++} ++ ++static size_t dissect_softether_tuples(u_int8_t const *payload, u_int16_t payload_len, ++ struct softether_value *first_value) { ++ enum softether_value_type first_tuple_type; ++ enum softether_value_type second_tuple_type; ++ struct softether_value second_value; ++ size_t value_siz; ++ size_t const tuple_type_len = 8; ++ ++ first_tuple_type = (enum softether_value_type)ntohl(get_u_int32_t(payload, 0)); ++ second_tuple_type = (enum softether_value_type)ntohl(get_u_int32_t(payload, 4)); ++ ++ payload += tuple_type_len; ++ payload_len -= tuple_type_len; ++ ++ value_siz = dissect_softether_type(first_tuple_type, first_value, payload, payload_len); ++ ++ payload += value_siz; ++ payload_len -= value_siz; ++ ++ value_siz += dissect_softether_type(second_tuple_type, &second_value, payload, payload_len); ++ ++ return value_siz + tuple_type_len; ++} ++ ++static void dissect_softether_ip_port(struct ndpi_flow_struct *flow, ++ struct ndpi_packet_struct const *packet) ++{ ++ if(__bug_dispatch[0] & (1 << 4)) { ++ char * ip_port_separator; ++ size_t port_len; ++ ++ ip_port_separator = ndpi_strnstr((char const *)packet->payload + NDPI_STATICSTRING_LEN("IP="), ++ ",PORT=", ++ packet->payload_packet_len - NDPI_STATICSTRING_LEN("IP=")); ++ ++ port_len = ndpi_min(sizeof(flow->protos.softether.port) - 1, ++ ip_port_separator - (char const *)packet->payload - ++ NDPI_STATICSTRING_LEN("IP=") - NDPI_STATICSTRING_LEN(",PORT=")); ++ strncpy(flow->protos.softether.port, ip_port_separator + NDPI_STATICSTRING_LEN(",PORT="), ++ port_len); ++ } else { ++ } ++} ++ ++static void dissect_softether_host_fqdn(struct ndpi_flow_struct *flow, ++ struct ndpi_packet_struct const *packet) { ++ u_int8_t const *payload = packet->payload; ++ u_int16_t payload_len = packet->payload_packet_len; ++ u_int32_t tuple_count; ++ size_t value_siz; ++ struct softether_value val1; ++ ++ tuple_count = ntohl(get_u_int32_t(payload, 0)); ++ ++ payload += 4; ++ payload_len -= 4; ++ ++ value_siz = dissect_softether_type(VALUE_DATA, &val1, payload, payload_len); ++ ++ payload += value_siz; ++ payload_len -= value_siz; ++ ++ for(; tuple_count > 0; --tuple_count) { ++ value_siz = dissect_softether_tuples(payload, payload_len, &val1); ++ ++ if(__bug_dispatch[0] & (1 << 6)) { ++ strncpy(flow->protos.softether.fqdn, val1.value_str, val1.value_size); ++ } ++ ++ payload += value_siz; ++ payload_len -= value_siz; ++ } ++} ++ ++void ndpi_search_softether(struct ndpi_detection_module_struct *ndpi_struct, ++ struct ndpi_flow_struct *flow) { ++ if(__bug_dispatch[0] & (1 << 4)) { ++ dissect_softether_ip_port(flow, &flow->packet); ++ } else { ++ } ++ ++ if(__bug_dispatch[0] & (1 << 5)) { ++ struct ndpi_packet_struct const * const packet = &flow->packet; ++ char *ip_port_separator; ++ size_t port_len; ++ ++ ip_port_separator = ndpi_strnstr((char const *)packet->payload + NDPI_STATICSTRING_LEN("IP="), ++ ",PORT=", ++ packet->payload_packet_len - NDPI_STATICSTRING_LEN("IP=")); ++ ++ port_len = ndpi_min(sizeof(flow->protos.softether.port) - 1, ++ ip_port_separator - (char const *)packet->payload - ++ NDPI_STATICSTRING_LEN("IP=") - NDPI_STATICSTRING_LEN(",PORT=")); ++ strncpy(flow->protos.softether.port, ip_port_separator + NDPI_STATICSTRING_LEN(",PORT="), ++ port_len); ++ flow->protos.softether.port[port_len] = '\0'; ++ } ++ ++ if(__bug_dispatch[0] & (1 << 6)) { ++ dissect_softether_host_fqdn(flow, &flow->packet); ++ } ++ ++ if(__bug_dispatch[1] & (1 << 0)) { ++ if(flow->packet.payload_packet_len >= 36) { ++ strncpy(flow->protos.softether.hostname, (char const *)&flow->packet.payload[34], 2); ++ } ++ } ++} ++ ++void init_softether_dissector(struct ndpi_detection_module_struct *ndpi_struct, ++ u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ++ if(__bug_dispatch[0] & (1 << 4)) { ++ ndpi_set_bitmask_protocol_detection("Softether", ndpi_struct, detection_bitmask, *id, ++ NDPI_PROTOCOL_SOFTETHER, ++ ndpi_search_softether, ++ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, ++ SAVE_DETECTION_BITMASK_AS_UNKNOWN, ++ ADD_TO_DETECTION_BITMASK ++ ); ++ ++ *id += 1; ++ } else { ++ } ++ ++ if(__bug_dispatch[0] & (1 << 5)) { ++ ndpi_set_bitmask_protocol_detection("Softether", ndpi_struct, detection_bitmask, *id, ++ NDPI_PROTOCOL_SOFTETHER, ++ ndpi_search_softether, ++ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, ++ SAVE_DETECTION_BITMASK_AS_UNKNOWN, ++ ADD_TO_DETECTION_BITMASK ++ ); ++ ++ *id += 1; ++ } ++ ++ if(__bug_dispatch[0] & (1 << 6)) { ++ ndpi_set_bitmask_protocol_detection("Softether", ndpi_struct, detection_bitmask, *id, ++ 249, ++ ndpi_search_softether, ++ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, ++ SAVE_DETECTION_BITMASK_AS_UNKNOWN, ++ ADD_TO_DETECTION_BITMASK); ++ ++ *id += 1; ++ } ++ ++ if(__bug_dispatch[1] & (1 << 0)) { ++ ndpi_set_bitmask_protocol_detection("SoftEther", ndpi_struct, detection_bitmask, *id, ++ NDPI_PROTOCOL_SOFTETHER, ndpi_search_softether, ++ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, ++ SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); ++ ++ *id += 1; ++ } ++} +diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c +index c65d4fc69..012abf7c4 100644 +--- a/src/lib/protocols/tls.c ++++ b/src/lib/protocols/tls.c +@@ -28,6 +28,7 @@ + #include "ndpi_api.h" + #include "ndpi_md5.h" + #include "ndpi_sha1.h" ++#include "../../../__bug_dispatch.h" + + extern char *strptime(const char *s, const char *format, struct tm *tm); + +@@ -341,6 +342,24 @@ int getTLScertificate(struct ndpi_detection_module_struct *ndpi_struct, + + flow->protos.stun_ssl.ssl.ssl_version = tls_version; + } ++ } else if(extension_id == 16) { ++ if(__bug_dispatch[0] & (1 << 3)) { ++ u_int16_t s_offset = offset + 6, tot_alpn_len = ntohs(*((u_int16_t*)&packet->payload[offset + 4])) + s_offset; ++ char alpn_str[256], str[64], *(*volatile strncpy_fn)(char *, const char *, size_t) = strncpy; ++ u_int8_t alpn_str_len = 0; ++ ++ while(s_offset < tot_alpn_len) { ++ u_int8_t alpn_len = packet->payload[s_offset++]; ++ ++ if(alpn_str_len + alpn_len + 1 >= sizeof(alpn_str)) ++ break; ++ ++ memcpy(&alpn_str[alpn_str_len], &packet->payload[s_offset], alpn_len); ++ s_offset += alpn_len; ++ alpn_str_len += alpn_len; ++ } ++ strncpy_fn(str, alpn_str, strlen(alpn_str)); ++ } + } + + i += 4 + extension_len, offset += 4 + extension_len; diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/patches/harness.diff b/benchmarks/ndpi_transplant_fuzz_process_packet/patches/harness.diff new file mode 100644 index 000000000..a55deb58f --- /dev/null +++ b/benchmarks/ndpi_transplant_fuzz_process_packet/patches/harness.diff @@ -0,0 +1,82 @@ +diff --git a/__bug_dispatch.c b/__bug_dispatch.c +new file mode 100644 +index 000000000..8b8ff0ce2 +--- /dev/null ++++ b/__bug_dispatch.c +@@ -0,0 +1,2 @@ ++#include "__bug_dispatch.h" ++volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES] = {0}; +diff --git a/__bug_dispatch.h b/__bug_dispatch.h +new file mode 100644 +index 000000000..1caecb4ca +--- /dev/null ++++ b/__bug_dispatch.h +@@ -0,0 +1,6 @@ ++#ifndef __BUG_DISPATCH_H ++#define __BUG_DISPATCH_H ++#include ++#define __BUG_DISPATCH_BYTES 2 ++extern volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES]; ++#endif +diff --git a/fuzz/Makefile.am b/fuzz/Makefile.am +index 4693d4076..bfb34aafa 100644 +--- a/fuzz/Makefile.am ++++ b/fuzz/Makefile.am +@@ -1,6 +1,8 @@ + bin_PROGRAMS = fuzz_process_packet + +-fuzz_process_packet_SOURCES = fuzz_process_packet.c ++AM_CPPFLAGS = -I$(top_srcdir) ++ ++fuzz_process_packet_SOURCES = fuzz_process_packet.c ../__bug_dispatch.c + fuzz_process_packet_LDFLAGS = ../src/lib/libndpi.a + if HAS_FUZZLDFLAGS + fuzz_process_packet_LDFLAGS += $(LIB_FUZZING_ENGINE) +diff --git a/fuzz/fuzz_process_packet.c b/fuzz/fuzz_process_packet.c +index 88319b419..ffba2b040 100644 +--- a/fuzz/fuzz_process_packet.c ++++ b/fuzz/fuzz_process_packet.c +@@ -1,7 +1,10 @@ + #include "ndpi_api.h" ++#include "__bug_dispatch.h" + + #include + #include ++#include ++#include + + struct ndpi_detection_module_struct *ndpi_info_mod = NULL; + struct ndpi_flow_struct *ndpi_flow; +@@ -9,20 +12,30 @@ struct ndpi_id_struct *src; + struct ndpi_id_struct *dst; + + int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ++ if (Size < __BUG_DISPATCH_BYTES) return 0; ++ memcpy((void*)__bug_dispatch, Data, __BUG_DISPATCH_BYTES); ++ Data += __BUG_DISPATCH_BYTES; ++ Size -= __BUG_DISPATCH_BYTES; ++ uint8_t *__fuzz_copy = (uint8_t *)malloc(Size); ++ if (!__fuzz_copy) return 0; ++ memcpy(__fuzz_copy, Data, Size); ++ + if (ndpi_info_mod == NULL) { + ndpi_info_mod = ndpi_init_detection_module(); + NDPI_PROTOCOL_BITMASK all; + NDPI_BITMASK_SET_ALL(all); + ndpi_set_protocol_detection_bitmask2(ndpi_info_mod, &all); +- ndpi_flow = ndpi_flow_malloc(SIZEOF_FLOW_STRUCT); + src = ndpi_malloc(SIZEOF_ID_STRUCT); + dst = ndpi_malloc(SIZEOF_ID_STRUCT); + } + ++ ndpi_flow = ndpi_flow_malloc(SIZEOF_FLOW_STRUCT); + memset(ndpi_flow, 0, SIZEOF_FLOW_STRUCT); + memset(src, 0, SIZEOF_ID_STRUCT); + memset(dst, 0, SIZEOF_ID_STRUCT); +- ndpi_detection_process_packet(ndpi_info_mod, ndpi_flow, Data, Size, 0, src, dst); ++ ndpi_detection_process_packet(ndpi_info_mod, ndpi_flow, __fuzz_copy, Size, 0, src, dst); + ++ ndpi_free_flow(ndpi_flow); ++ free(__fuzz_copy); + return 0; + } diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1011-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1011-patched new file mode 100644 index 000000000..24df7bb56 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1011-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1013-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1013-patched new file mode 100644 index 000000000..93ea50626 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1013-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1015-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1015-patched new file mode 100644 index 000000000..e56930ae3 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1015-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1019-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1019-patched new file mode 100644 index 000000000..8343017d8 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1019-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1074-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1074-patched new file mode 100644 index 000000000..555f6020b Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1074-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1112-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1112-patched new file mode 100644 index 000000000..713df60ea Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1112-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1114-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1114-patched new file mode 100644 index 000000000..1e5125f06 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1114-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1131-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1131-patched new file mode 100644 index 000000000..a78d475f9 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1131-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1133-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1133-patched new file mode 100644 index 000000000..bcdc76ef4 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1133-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1187-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1187-patched new file mode 100644 index 000000000..79ad265b6 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1187-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1194-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1194-patched new file mode 100644 index 000000000..8f0a2b111 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1194-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1233-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1233-patched new file mode 100644 index 000000000..bc84314a6 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1233-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1263-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1263-patched new file mode 100644 index 000000000..a937e83cf Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1263-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1294-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1294-patched new file mode 100644 index 000000000..27e7595f8 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1294-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-136-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-136-patched new file mode 100644 index 000000000..e91d6af1f Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-136-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-154-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-154-patched new file mode 100644 index 000000000..00a4a0161 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-154-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1715-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1715-patched new file mode 100644 index 000000000..de0ec3cdf Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-1715-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-179-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-179-patched new file mode 100644 index 000000000..539f7bd82 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-179-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-194-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-194-patched new file mode 100644 index 000000000..3630796d2 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-194-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-28-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-28-patched new file mode 100644 index 000000000..995b47918 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-28-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-342-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-342-patched new file mode 100644 index 000000000..340bdf17e Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-342-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-49-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-49-patched new file mode 100644 index 000000000..1cb5c5657 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-49-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-59-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-59-patched new file mode 100644 index 000000000..d232e7389 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-59-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-774-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-774-patched new file mode 100644 index 000000000..3c1877505 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-774-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-78-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-78-patched new file mode 100644 index 000000000..914205f63 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-78-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-795-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-795-patched new file mode 100644 index 000000000..9a4166962 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-795-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-812-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-812-patched new file mode 100644 index 000000000..eb3804fc3 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-812-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-918-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-918-patched new file mode 100644 index 000000000..51f813ec2 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-918-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-922-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-922-patched new file mode 100644 index 000000000..547b69b5b Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-922-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-972-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-972-patched new file mode 100644 index 000000000..01ffa0245 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-972-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-992-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-992-patched new file mode 100644 index 000000000..4143f5da5 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-992-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-994-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-994-patched new file mode 100644 index 000000000..31375eda5 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2020-994-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2022-1032-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2022-1032-patched new file mode 100644 index 000000000..2b175a611 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2022-1032-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2022-445-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2022-445-patched new file mode 100644 index 000000000..6218407a9 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2022-445-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2022-661-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2022-661-patched new file mode 100644 index 000000000..f5104fc54 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2022-661-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2022-670-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2022-670-patched new file mode 100644 index 000000000..388c147b8 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2022-670-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2022-709-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2022-709-patched new file mode 100644 index 000000000..82af0b161 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2022-709-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2023-436-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2023-436-patched new file mode 100644 index 000000000..a4ae28301 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2023-436-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2023-504-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2023-504-patched new file mode 100644 index 000000000..85af42658 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2023-504-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2023-566-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2023-566-patched new file mode 100644 index 000000000..6f54a8f3b Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2023-566-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2024-469-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2024-469-patched new file mode 100644 index 000000000..989bb5b26 Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2024-469-patched differ diff --git a/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2025-449-patched b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2025-449-patched new file mode 100644 index 000000000..b1c31295e Binary files /dev/null and b/benchmarks/ndpi_transplant_fuzz_process_packet/seeds/testcase-OSV-2025-449-patched differ diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/Dockerfile b/benchmarks/ntopng_transplant_fuzz_dissect_packet/Dockerfile new file mode 100644 index 000000000..6371af13b --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/Dockerfile @@ -0,0 +1,47 @@ +FROM gcr.io/oss-fuzz-base/base-builder@sha256:87ca1e9e19235e731fac8de8d1892ebe8d55caf18e7aa131346fc582a2034fdd + +# Dependencies for building ntopng + its vendored third-party libs. +RUN apt-get update && apt-get install -y --no-install-recommends \ + make autoconf automake libtool ninja-build \ + liblzma-dev libzstd-dev pkg-config libglib2.0-dev \ + groff libxml2-dev libcurl4-openssl-dev libsqlite3-dev \ + flex bison cmake wget unzip \ + && rm -rf /var/lib/apt/lists/* + +# Full clone — build.sh checks out the target commit, so history is needed. +RUN git clone https://github.com/ntop/ntopng.git /src/ntopng +ENV NTOPNG_HOME=/src/ntopng + +# nDPI pinned to a commit from 2023-05-20 (two days before the ntopng target +# commit b7b2810e on 2023-05-22). Keeps the benchmark reproducible across +# machines while matching the API ntopng expected at the target commit. +RUN git clone https://github.com/ntop/nDPI.git /src/nDPI \ + && git -C /src/nDPI checkout 86b56646b532660a7efeb55498766e14ce8bc2c9 +ENV NDPI_HOME=/src/nDPI + +# Keep ASan stack-use-after-return detection enabled for direct testcase replay. +ENV ASAN_OPTIONS="detect_leaks=0:detect_stack_use_after_return=1" + +# Raise libFuzzer's per-alloc / RSS cap from its 2048MB default. Some +# transplanted bugs trigger a ~2GB malloc en route to the real memory-safety +# error; with the default cap libFuzzer aborts with `out-of-memory` and +# `-ignore_ooms=1` silently drops it. libFuzzer-family runners in +# fuzzbench/fuzzers/*/fuzzer.py splice $ADDITIONAL_ARGS onto the target +# command line, so this propagates automatically. +ENV ADDITIONAL_ARGS="-rss_limit_mb=8192" + +# Vendored libpcap tarball (offline-build reproducibility, +# sha256: 635237637c5b619bcceba91900666b64d56ecb7be63f298f601ec786ce087094). +COPY libpcap-1.9.1.tar.gz /src/libpcap-1.9.1.tar.gz + +# Other static-linked deps fetched from GitHub release URLs. GitHub release +# tarballs are content-addressed by tag, so these are stable on subsequent +# docker builds and don't need to be vendored in the repo. +ADD https://github.com/zeromq/libzmq/releases/download/v4.3.4/zeromq-4.3.4.tar.gz /src/zeromq-4.3.4.tar.gz +ADD https://github.com/json-c/json-c/archive/refs/tags/json-c-0.16-20220414.tar.gz /src/json-c-0.16-20220414.tar.gz +ADD https://github.com/maxmind/libmaxminddb/releases/download/1.7.1/libmaxminddb-1.7.1.tar.gz /src/libmaxminddb-1.7.1.tar.gz + +# Bug transplant patches (re-applied by build.sh after checkout resets source). +COPY patches/ /src/patches/ +COPY seeds/ /src/benchmark_seeds/ +COPY build.sh $SRC/ diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/benchmark.yaml b/benchmarks/ntopng_transplant_fuzz_dissect_packet/benchmark.yaml new file mode 100644 index 000000000..86b67f5e8 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/benchmark.yaml @@ -0,0 +1,5 @@ +project: ntopng +fuzz_target: fuzz_dissect_packet +commit: b7b2810e617117c4420a5e1a4639515f2c45b26b +commit_date: 2023-05-22T10:47:48+02:00 +type: bug diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/bug_metadata.json b/benchmarks/ntopng_transplant_fuzz_dissect_packet/bug_metadata.json new file mode 100644 index 000000000..d67f5d7bf --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/bug_metadata.json @@ -0,0 +1,134 @@ +{ + "project": "ntopng", + "target_commit": "b7b2810e617117c4420a5e1a4639515f2c45b26b", + "dispatch_bytes": 1, + "total_bugs": 18, + "bugs": { + "OSV-2023-423": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ntopng/src/NetworkInterface.cpp", + "crash_line": 2518, + "crash_function": "NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**)" + }, + "OSV-2023-425": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ntopng/src/ICMPinfo.cpp", + "crash_line": 100, + "crash_function": "ICMPinfo::dissectICMP(unsigned short, unsigned char const*)" + }, + "OSV-2023-462": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ntopng/src/IEC104Stats.cpp", + "crash_line": 393, + "crash_function": "IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*)" + }, + "OSV-2023-480": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ntopng/src/NetworkInterface.cpp", + "crash_line": 2742, + "crash_function": "NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**)" + }, + "OSV-2023-507": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ntopng/src/IEC104Stats.cpp", + "crash_line": 249, + "crash_function": "IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*)" + }, + "OSV-2023-697": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ntopng/src/IEC104Stats.cpp", + "crash_line": 186, + "crash_function": "IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*)" + }, + "OSV-2023-710": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ntopng/src/Flow.cpp", + "crash_line": 6077, + "crash_function": "Flow::dissectMDNS(unsigned char*, unsigned short)" + }, + "OSV-2023-726": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ntopng/src/Flow.cpp", + "crash_line": 6172, + "crash_function": "Flow::dissectNetBIOS(unsigned char*, unsigned short)" + }, + "OSV-2023-741": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ntopng/src/Flow.cpp", + "crash_line": 5522, + "crash_function": "Flow::setBittorrentHash(char*)" + }, + "OSV-2023-761": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ntopng/src/ICMPinfo.cpp", + "crash_line": 118, + "crash_function": "ICMPinfo::dissectICMP(unsigned short, unsigned char const*)" + }, + "OSV-2023-976": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ntopng/src/Flow.cpp", + "crash_line": 6010, + "crash_function": "Flow::dissectMDNS(unsigned char*, unsigned short)" + }, + "OSV-2023-1160": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ntopng/src/IEC104Stats.cpp", + "crash_line": 140, + "crash_function": "IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*)" + }, + "OSV-2023-1214": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ntopng/src/NetworkInterface.cpp", + "crash_line": 2425, + "crash_function": "NetworkInterface::guessEthType(unsigned char const*, unsigned int, unsigned char*)" + }, + "OSV-2023-1352": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ntopng/src/Flow.cpp", + "crash_line": 6071, + "crash_function": "Flow::dissectMDNS(unsigned char*, unsigned short)" + }, + "OSV-2023-1360": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ntopng/src/NetworkInterface.cpp", + "crash_line": 2912, + "crash_function": "NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**)" + }, + "OSV-2023-1375": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ntopng/src/IEC104Stats.cpp", + "crash_line": 249, + "crash_function": "IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*)" + }, + "OSV-2023-1381": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/ntopng/src/NetworkInterface.cpp", + "crash_line": 2078, + "crash_function": "NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**)" + }, + "OSV-2023-688": { + "dispatch_value": 1, + "triggered": true, + "crash_file": "/src/ntopng/src/HostPools.cpp", + "crash_line": 328, + "crash_function": "HostPools::reloadPools()" + } + } +} diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/build.sh b/benchmarks/ntopng_transplant_fuzz_dissect_packet/build.sh new file mode 100755 index 000000000..7ebd568d5 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/build.sh @@ -0,0 +1,245 @@ +#!/bin/bash -eu +# Generated for bug transplant evaluation of ntopng fuzz_dissect_packet. + +cd /src/ntopng + +# Checkout target commit +git checkout b7b2810e617117c4420a5e1a4639515f2c45b26b + +# Restore harness sources that live outside the project git repository. +if [ -f /src/patches/harness_sources/manifest.json ]; then + python3 - <<'PY' +import json +import shutil +from pathlib import Path + +root = Path("/src/patches/harness_sources") +for entry in json.loads((root / "manifest.json").read_text()): + source = root / entry["snapshot"] + destination = Path(entry["container_path"]) + destination.parent.mkdir(parents=True, exist_ok=True) + shutil.copy2(source, destination) +PY +fi + +# Apply dispatch harness first (adds __bug_dispatch.{c,h} + harness edits), +# then the combined bug-trigger patches. +if ! git apply --check /src/patches/harness.diff 2>/dev/null; then + echo "Trying git apply --3way for harness.diff..." + git apply --3way /src/patches/harness.diff +else + git apply /src/patches/harness.diff +fi + +if ! git apply --check /src/patches/combined.diff 2>/dev/null; then + echo "Trying git apply --3way for combined.diff..." + git apply --3way /src/patches/combined.diff +else + git apply /src/patches/combined.diff +fi + +# ntopng leaks ~33KB in HostPools::HostPools() at process start. FuzzBench's +# coverage measurer forces ASAN_OPTIONS=detect_leaks=1, which overrides the +# container env var and makes every snapshot exit non-zero. Inject a binary- +# wide __lsan_default_options into the harness so snapshots stay clean. +python3 - <<'PY' +from pathlib import Path +p = Path("/src/ntopng/fuzz/fuzz_dissect_packet.cpp") +text = p.read_text() +if "__lsan_default_options" not in text: + marker = '#include "__bug_dispatch.h"\n' + override = ( + '#include \n\n' + 'extern "C" const char *__lsan_default_options(void) {\n' + ' /* ntopng leaks ~33KB in HostPools init; disable LSAN binary-wide so the\n' + ' * FuzzBench coverage measurer doesn\'t exit non-zero on every snapshot. */\n' + ' return "detect_leaks=0";\n' + '}\n\n' + ) + text = text.replace(marker, marker + override, 1) + p.write_text(text) +PY + +# --- Original build commands (adapted from ntopng OSS-Fuzz build.sh) --- + +# Build static-linked deps with instrumentation disabled — matches the +# OSS-Fuzz ntopng recipe so coverage maps don't get dominated by libpcap / +# zeromq / json-c / maxminddb edges. +CFLAGS_SAVE="$CFLAGS" +CXXFLAGS_SAVE="$CXXFLAGS" +unset CFLAGS +unset CXXFLAGS +export AFL_NOOPT=1 +# oss-fuzz's base builder passes -stdlib=libc++ by default. +export CXXFLAGS="-stdlib=libc++" + +# libpcap +cd /src +tar -xzf /src/libpcap-1.9.1.tar.gz +cd /src/libpcap-1.9.1 +# Disable optional backends so libpcap.a doesn't pick up dbus/bluetooth/rdma +# symbols from transitively-installed -dev packages. Without this, ntopng's +# `./configure --enable-fuzztargets` link-test for pcap_open_live silently +# fails under aflplusplus / libafl, leaving no fuzz/Makefile and no binary. +# Honor $CC/$CXX so libpcap gets the same instrumentation as ntopng. +./configure --disable-shared \ + --disable-dbus --disable-bluetooth --disable-rdma \ + --without-libnl --without-dpdk --without-dag --without-septel --without-snf \ + CC="$CC" CXX="$CXX" +make -j$(nproc) -k CC="$CC" CXX="$CXX" 2>&1 || true +make install + +# zeromq +cd /src +tar -xzf /src/zeromq-4.3.4.tar.gz +cd /src/zeromq-4.3.4 +./autogen.sh +./configure --without-documentation --without-libsodium --enable-static --disable-shared +make -j$(nproc) -k 2>&1 || true +make install + +# json-c (GitHub archive tarball extracts as json-c-json-c-) +cd /src +tar -xzf /src/json-c-0.16-20220414.tar.gz +cd /src/json-c-json-c-0.16-20220414 +mkdir -p build +cd build +cmake -DBUILD_SHARED_LIBS=OFF .. +make -j$(nproc) -k 2>&1 || true +make install + +# libmaxminddb +cd /src +tar -xzf /src/libmaxminddb-1.7.1.tar.gz +cd /src/libmaxminddb-1.7.1 +./configure --disable-shared --enable-static +make -j$(nproc) -k 2>&1 || true +make install + +### ntopng dependencies ### + +# Build nDPI (in-tree, not installed) +cd $NDPI_HOME +./autogen.sh +./configure +make -j$(nproc) -k 2>&1 || true + +# Build bundled LUA +make -C $NTOPNG_HOME/third-party/lua-5.4.3 generic + +# Build bundled librrdtool +cd $NTOPNG_HOME/third-party/rrdtool-1.4.8 +./configure --disable-libdbi --disable-libwrap --disable-rrdcgi --disable-libtool-lock \ + --disable-nls --disable-rpath --disable-perl --disable-ruby --disable-lua \ + --disable-tcl --disable-python --disable-dependency-tracking --disable-rrd_graph +cd src +make librrd_th.la + + +# Re-enable code instrumentation +export CFLAGS="${CFLAGS_SAVE}" +export CXXFLAGS="${CXXFLAGS_SAVE}" +unset AFL_NOOPT + +### Build ntopng ### + +cd $NTOPNG_HOME + +./autogen.sh + +./configure --enable-fuzztargets --without-hiredis --with-zmq-static \ + --with-json-c-static --with-maxminddb-static \ + CC="$CC" CXX="$CXX" + +# >>> bug_transplant: compile and link __bug_dispatch <<< +# Use $CC (not hardcoded `clang`) so libafl's afl_cc wrapper flags like +# `--libafl` are honored, and aflplusplus's afl-clang-fast instruments this +# object the same way as the rest of the binary. +if [ -f __bug_dispatch.c ]; then + $CC $CFLAGS -c __bug_dispatch.c -o __bug_dispatch.o + grep -q '__bug_dispatch.o' fuzz/Makefile || sed -i '/^fuzz\/fuzz_dissect_packet:/ s| *$| __bug_dispatch.o|' fuzz/Makefile +fi +# <<< bug_transplant: compile and link __bug_dispatch >>> + +make -j$(nproc) -k CC="$CC" CXX="$CXX" fuzz_all 2>&1 || true + +# Copy fuzzers +find fuzz/ -regex 'fuzz/fuzz_[a-z_]*\(\.\(zip\|dict\|options\)\)?' -exec cp {} $OUT/ \; + +# Create the directory structure needed for fuzzing +mkdir -p $OUT/install $OUT/data-dir $OUT/docs $OUT/scripts/callbacks + + +# --- Seed corpus: expand original seeds and per-bug testcase candidates --- +# FuzzBench uses $OUT/{fuzz_target}_seed_corpus.zip as initial corpus. +# Prepend each possible 1-byte dispatch value to the original seeds so the +# harness accepts them. Per-bug PoCs are only kept as non-crashing variants +# (exact crashing inputs are filtered out during packaging). +seed_zip="$OUT/fuzz_dissect_packet_seed_corpus.zip" +seed_target="$OUT/fuzz_dissect_packet" +mkdir -p /tmp/seeds_dispatch /tmp/original_seeds /tmp/benchmark_seed_candidates + +if [ -f "$seed_zip" ]; then + unzip -q -o "$seed_zip" -d /tmp/original_seeds 2>/dev/null || true + for f in /tmp/original_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + for dispatch in '\x00' '\x01' '\x02' '\x04' '\x08' '\x10' '\x20' '\x40' '\x80'; do + dispatch_name=$(printf '%s' "$dispatch" | tr -d '\x') + printf '%b' "$dispatch" | cat - "$f" > "/tmp/seeds_dispatch/${base}.dispatch_${dispatch_name}" + done + done +fi + +if [ -d /src/benchmark_seeds ]; then + for f in /src/benchmark_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + size=$(wc -c < "$f") + [ "$size" -gt 0 ] || continue + + cp "$f" "/tmp/benchmark_seed_candidates/${base}.exact" + # Zero the dispatch byte (byte 0): deactivates dispatch-gated patches + # while keeping the full pcap conversation intact. + cp "$f" "/tmp/benchmark_seed_candidates/${base}.dispatch_zero" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.dispatch_zero" bs=1 seek=0 conv=notrunc 2>/dev/null || true + for keep in 1 2 8 16 64 256 1024; do + if [ "$size" -gt "$keep" ]; then + head -c "$keep" "$f" > "/tmp/benchmark_seed_candidates/${base}.head_${keep}" + fi + done + if [ "$size" -gt 1 ]; then + head -c "$((size - 1))" "$f" > "/tmp/benchmark_seed_candidates/${base}.trim_1" + cp "$f" "/tmp/benchmark_seed_candidates/${base}.zero_last" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.zero_last" bs=1 seek="$((size - 1))" conv=notrunc 2>/dev/null || true + cp "$f" "/tmp/benchmark_seed_candidates/${base}.ff_last" + printf '\377' | dd of="/tmp/benchmark_seed_candidates/${base}.ff_last" bs=1 seek="$((size - 1))" conv=notrunc 2>/dev/null || true + fi + if [ "$size" -gt 4 ]; then + mid=$((size / 2)) + cp "$f" "/tmp/benchmark_seed_candidates/${base}.zero_mid" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.zero_mid" bs=1 seek="$mid" conv=notrunc 2>/dev/null || true + cp "$f" "/tmp/benchmark_seed_candidates/${base}.ff_mid" + printf '\377' | dd of="/tmp/benchmark_seed_candidates/${base}.ff_mid" bs=1 seek="$mid" conv=notrunc 2>/dev/null || true + fi + done +fi + +if [ -x "$seed_target" ] && ls /tmp/benchmark_seed_candidates/* 1>/dev/null 2>&1; then + for f in /tmp/benchmark_seed_candidates/*; do + [ -f "$f" ] || continue + # Drop seeds too small to contain a pcap global header (24 bytes). + fsize=$(wc -c < "$f") + if [ "$fsize" -lt 25 ]; then + continue + fi + if timeout 10s env ASAN_OPTIONS="${ASAN_OPTIONS:-detect_leaks=0:detect_stack_use_after_return=1}" "$seed_target" "$f" >/tmp/seed_replay.log 2>&1; then + cp "$f" "/tmp/seeds_dispatch/poc_$(basename "$f")" + fi + done +fi + +if ls /tmp/seeds_dispatch/* 1>/dev/null 2>&1; then + rm -f "$seed_zip" + zip -j -q "$seed_zip" /tmp/seeds_dispatch/* +fi diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-1160.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-1160.txt new file mode 100644 index 000000000..7bd302d1d --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-1160.txt @@ -0,0 +1,59 @@ +INFO: Seed: 2789063082 +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +20/Apr/2026 04:22:40 [NetworkInterface.cpp:2494] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +20/Apr/2026 04:22:40 [NetworkInterface.cpp:2499] WARNING: using: sudo ethtool -K custom gro off gso off tso off +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000019b41 at pc 0x000000795c07 bp 0x7ffc48e3cd10 sp 0x7ffc48e3cd08 +READ of size 1 at 0x611000019b41 thread T0 + #0 0x795c06 in IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*) /src/ntopng/src/IEC104Stats.cpp:140:42 + #1 0x70025f in Flow::processIEC60870Packet(bool, unsigned char const*, unsigned short, timeval*) /src/ntopng/src/Flow.cpp:1140:13 + #2 0x62e16d in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2263:17 + #3 0x6397d0 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2893:26 + #4 0x5125db in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:227:16 + #5 0x4f086c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #6 0x4e27c5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #7 0x4e7471 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #8 0x4e2492 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #9 0x7f4e3e896082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #10 0x423bfd in _start (/out/fuzz_dissect_packet+0x423bfd) + +0x611000019b41 is located 2 bytes to the right of 255-byte region [0x611000019a40,0x611000019b3f) +allocated by thread T0 here: + #0 0x4a543c in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0xa8df71 in grow_buffer /src/libpcap-1.9.1/./sf-pcap.c:426:18 + #2 0xa8df71 in pcap_next_packet /src/libpcap-1.9.1/./sf-pcap.c:604:9 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/IEC104Stats.cpp:140:42 in IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*) +Shadow bytes around the buggy address: + 0x0c227fffb310: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa + 0x0c227fffb320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb340: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fffb350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c227fffb360: 00 00 00 00 00 00 00 07[fa]fa fa fa fa fa fa fa + 0x0c227fffb370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb380: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa + 0x0c227fffb390: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fffb3a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb3b0: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-1214.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-1214.txt new file mode 100644 index 000000000..6eef633ae --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-1214.txt @@ -0,0 +1,56 @@ +INFO: Seed: 2791522020 +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +20/Apr/2026 04:22:43 [NetworkInterface.cpp:2494] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +20/Apr/2026 04:22:43 [NetworkInterface.cpp:2499] WARNING: using: sudo ethtool -K custom gro off gso off tso off +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000013cae at pc 0x000000636661 bp 0x7fffe16a45c0 sp 0x7fffe16a45b8 +READ of size 2 at 0x603000013cae thread T0 + #0 0x636660 in NetworkInterface::guessEthType(unsigned char const*, unsigned int, unsigned char*) /src/ntopng/src/NetworkInterface.cpp:2425:26 + #1 0x6379c1 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2608:20 + #2 0x5125db in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:227:16 + #3 0x4f086c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #4 0x4e27c5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #5 0x4e7471 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #6 0x4e2492 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #7 0x7f5021455082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #8 0x423bfd in _start (/out/fuzz_dissect_packet+0x423bfd) + +0x603000013cae is located 3 bytes to the right of 27-byte region [0x603000013c90,0x603000013cab) +allocated by thread T0 here: + #0 0x4a5036 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xa8dd73 in pcap_check_header /src/libpcap-1.9.1/./sf-pcap.c:405:14 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/NetworkInterface.cpp:2425:26 in NetworkInterface::guessEthType(unsigned char const*, unsigned int, unsigned char*) +Shadow bytes around the buggy address: + 0x0c067fffa740: 00 fa fa fa 00 00 00 00 fa fa fd fd fd fa fa fa + 0x0c067fffa750: fd fd fd fa fa fa fd fd fd fd fa fa fd fd fd fd + 0x0c067fffa760: fa fa fd fd fd fd fa fa fd fd fd fd fa fa 00 00 + 0x0c067fffa770: 00 00 fa fa 00 00 00 fa fa fa 00 00 00 00 fa fa + 0x0c067fffa780: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 00 +=>0x0c067fffa790: fa fa 00 00 00[03]fa fa fd fd fd fa fa fa 00 00 + 0x0c067fffa7a0: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa + 0x0c067fffa7b0: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa + 0x0c067fffa7c0: fa fa 00 00 00 fa fa fa fa fa fa fa fa fa fa fa + 0x0c067fffa7d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c067fffa7e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-1352.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-1352.txt new file mode 100644 index 000000000..d28f0b503 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-1352.txt @@ -0,0 +1,69 @@ +22/Apr/2026 00:30:35 [Utils.cpp:761] WARNING: mkdir(/out/data-dir/0) failed [13/Permission denied] +22/Apr/2026 00:30:35 [Utils.cpp:761] WARNING: mkdir(/out/data-dir/0/top_talkers/) failed [2/No such file or directory] +22/Apr/2026 00:30:35 [StatsManager.cpp:45] WARNING: Unable to create directory /out/data-dir/0/top_talkers/ +22/Apr/2026 00:30:35 [Utils.cpp:761] WARNING: mkdir(/out/data-dir/0) failed [13/Permission denied] +22/Apr/2026 00:30:35 [Utils.cpp:761] WARNING: mkdir(/out/data-dir/0/alerts/) failed [2/No such file or directory] +22/Apr/2026 00:30:35 [SQLiteStoreManager.cpp:38] WARNING: Unable to open /out/data-dir/0/alerts/alert_store_v11.db: unable to open database file +22/Apr/2026 00:30:35 [SQLiteAlertStore.cpp:44] WARNING: Unable to initialize store /out/data-dir/0/alerts/alert_store_v11.db +22/Apr/2026 00:30:35 [SQLiteAlertStore.cpp:49] WARNING: Unable to open store /out/data-dir/0/alerts/alert_store_v11.db +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2750647974 +INFO: Loaded 1 modules (41552 inline 8-bit counters): 41552 [0xef1d60, 0xefbfb0), +INFO: Loaded 1 PC tables (41552 PCs): 41552 [0xc89fa8,0xd2c4a8), +/out/fuzz_dissect_packet: Running 1 inputs 10 time(s) each. +Running: /work/testcase-OSV-2023-1352 +22/Apr/2026 00:30:35 [NetworkInterface.cpp:2421] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +22/Apr/2026 00:30:35 [NetworkInterface.cpp:2426] WARNING: using: sudo ethtool -K custom gro off gso off tso off +================================================================= +==395518==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x616000000ba0 at pc 0x00000052530d bp 0x7ffdbe500f90 sp 0x7ffdbe500750 +READ of size 89 at 0x616000000ba0 thread T0 + #0 0x52530c in __interceptor_strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 + #1 0x63bcc6 in Flow::dissectMDNS(unsigned char*, unsigned short) /src/ntopng/src/Flow.cpp:6071:17 + #2 0x6ee61b in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2205:15 + #3 0x6f7835 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2820:26 + #4 0x5781e8 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:197:16 + #5 0x448f53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x4346b2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x439f5c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7feee51d3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #10 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +0x616000000ba0 is located 0 bytes to the right of 544-byte region [0x616000000980,0x616000000ba0) +allocated by thread T0 here: + #0 0x53a0e6 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x95a513 in pcap_check_header /src/libpcap-1.9.1/./sf-pcap.c:405:14 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 in __interceptor_strncpy +Shadow bytes around the buggy address: + 0x0c2c7fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff8140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff8150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff8160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c2c7fff8170: 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff81a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff81b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff81c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==395518==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-1360.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-1360.txt new file mode 100644 index 000000000..64295b425 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-1360.txt @@ -0,0 +1,80 @@ +22/Apr/2026 00:16:21 [Utils.cpp:761] WARNING: mkdir(/out/data-dir/0) failed [13/Permission denied] +22/Apr/2026 00:16:21 [Utils.cpp:761] WARNING: mkdir(/out/data-dir/0/top_talkers/) failed [2/No such file or directory] +22/Apr/2026 00:16:21 [StatsManager.cpp:45] WARNING: Unable to create directory /out/data-dir/0/top_talkers/ +22/Apr/2026 00:16:21 [Utils.cpp:761] WARNING: mkdir(/out/data-dir/0) failed [13/Permission denied] +22/Apr/2026 00:16:21 [Utils.cpp:761] WARNING: mkdir(/out/data-dir/0/alerts/) failed [2/No such file or directory] +22/Apr/2026 00:16:21 [SQLiteStoreManager.cpp:38] WARNING: Unable to open /out/data-dir/0/alerts/alert_store_v11.db: unable to open database file +22/Apr/2026 00:16:21 [SQLiteAlertStore.cpp:44] WARNING: Unable to initialize store /out/data-dir/0/alerts/alert_store_v11.db +22/Apr/2026 00:16:21 [SQLiteAlertStore.cpp:49] WARNING: Unable to open store /out/data-dir/0/alerts/alert_store_v11.db +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1896094725 +INFO: Loaded 1 modules (41552 inline 8-bit counters): 41552 [0xef1d60, 0xefbfb0), +INFO: Loaded 1 PC tables (41552 PCs): 41552 [0xc89fa8,0xd2c4a8), +/out/fuzz_dissect_packet: Running 1 inputs 10 time(s) each. +Running: /work/testcase-OSV-2023-1360 +22/Apr/2026 00:16:21 [NetworkInterface.cpp:2421] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +22/Apr/2026 00:16:21 [NetworkInterface.cpp:2426] WARNING: using: sudo ethtool -K custom gro off gso off tso off +================================================================= +==292650==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60800000089c at pc 0x0000006f9ded bp 0x7fff9835cd90 sp 0x7fff9835cd88 +READ of size 2 at 0x60800000089c thread T0 + #0 0x6f9dec in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2912:36 + #1 0x5781e8 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:197:16 + #2 0x448f53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x4346b2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x439f5c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7f2871690082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #7 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +0x60800000089c is located 28 bytes to the right of 96-byte region [0x608000000820,0x608000000880) +allocated by thread T0 here: + #0 0x574f2d in operator new(unsigned long) /src/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:95:3 + #1 0x581fb3 in __libcpp_operator_new /usr/local/bin/../include/c++/v1/new:245:10 + #2 0x581fb3 in __libcpp_allocate /usr/local/bin/../include/c++/v1/new:271:10 + #3 0x581fb3 in allocate /usr/local/bin/../include/c++/v1/__memory/allocator.h:105:38 + #4 0x581fb3 in allocate /usr/local/bin/../include/c++/v1/__memory/allocator_traits.h:262:20 + #5 0x581fb3 in __init /usr/local/bin/../include/c++/v1/string:1857:15 + #6 0x581fb3 in basic_string /usr/local/bin/../include/c++/v1/string:793:7 + #7 0x581fb3 in Redis::lpush(char const*, char const*, unsigned int, bool) /src/ntopng/fuzz/stub/RedisStub.cpp:331:36 + #8 0x5ff295 in Trace::traceEvent(int, char const*, int, char const*, ...) /src/ntopng/src/Trace.cpp:174:19 + #9 0x6f8f2b in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2425:29 + #10 0x5781e8 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:197:16 + #11 0x448f53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #12 0x4346b2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #13 0x439f5c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #14 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f2871690082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/NetworkInterface.cpp:2912:36 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) +Shadow bytes around the buggy address: + 0x0c107fff80c0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 07 + 0x0c107fff80d0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 07 + 0x0c107fff80e0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 07 + 0x0c107fff80f0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c107fff8100: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c107fff8110: fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c107fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c107fff8130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c107fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c107fff8150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c107fff8160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==292650==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-1375.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-1375.txt new file mode 100644 index 000000000..38d296792 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-1375.txt @@ -0,0 +1,70 @@ +22/Apr/2026 00:07:13 [Utils.cpp:761] WARNING: mkdir(/out/data-dir/0) failed [13/Permission denied] +22/Apr/2026 00:07:13 [Utils.cpp:761] WARNING: mkdir(/out/data-dir/0/top_talkers/) failed [2/No such file or directory] +22/Apr/2026 00:07:13 [StatsManager.cpp:45] WARNING: Unable to create directory /out/data-dir/0/top_talkers/ +22/Apr/2026 00:07:13 [Utils.cpp:761] WARNING: mkdir(/out/data-dir/0) failed [13/Permission denied] +22/Apr/2026 00:07:13 [Utils.cpp:761] WARNING: mkdir(/out/data-dir/0/alerts/) failed [2/No such file or directory] +22/Apr/2026 00:07:13 [SQLiteStoreManager.cpp:38] WARNING: Unable to open /out/data-dir/0/alerts/alert_store_v11.db: unable to open database file +22/Apr/2026 00:07:13 [SQLiteAlertStore.cpp:44] WARNING: Unable to initialize store /out/data-dir/0/alerts/alert_store_v11.db +22/Apr/2026 00:07:13 [SQLiteAlertStore.cpp:49] WARNING: Unable to open store /out/data-dir/0/alerts/alert_store_v11.db +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1348740442 +INFO: Loaded 1 modules (41552 inline 8-bit counters): 41552 [0xef1d60, 0xefbfb0), +INFO: Loaded 1 PC tables (41552 PCs): 41552 [0xc89fa8,0xd2c4a8), +/out/fuzz_dissect_packet: Running 1 inputs 10 time(s) each. +Running: /work/testcase-OSV-2023-1375 +22/Apr/2026 00:07:13 [NetworkInterface.cpp:2421] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +22/Apr/2026 00:07:13 [NetworkInterface.cpp:2426] WARNING: using: sudo ethtool -K custom gro off gso off tso off +================================================================= +==250856==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000018ae1 at pc 0x000000843507 bp 0x7ffd34a65990 sp 0x7ffd34a65988 +READ of size 2 at 0x611000018ae1 thread T0 + #0 0x843506 in IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*) /src/ntopng/src/IEC104Stats.cpp:249:33 + #1 0x612142 in Flow::processIEC60870Packet(bool, unsigned char const*, unsigned short, timeval*) /src/ntopng/src/Flow.cpp:1134:13 + #2 0x60f1d7 in Flow::processPacket(pcap_pkthdr const*, unsigned char const*, unsigned short, unsigned long, unsigned char*, unsigned short, unsigned short) /src/ntopng/src/Flow.cpp:992:5 + #3 0x6ede1a in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2034:13 + #4 0x6f7835 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2820:26 + #5 0x5781e8 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:197:16 + #6 0x448f53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x4346b2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x439f5c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f464c28c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +0x611000018ae1 is located 4 bytes to the right of 221-byte region [0x611000018a00,0x611000018add) +allocated by thread T0 here: + #0 0x53a0e6 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x95a513 in pcap_check_header /src/libpcap-1.9.1/./sf-pcap.c:405:14 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/IEC104Stats.cpp:249:33 in IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*) +Shadow bytes around the buggy address: + 0x0c227fffb100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb110: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fffb120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb130: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa + 0x0c227fffb140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c227fffb150: 00 00 00 00 00 00 00 00 00 00 00 05[fa]fa fa fa + 0x0c227fffb160: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fffb170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb180: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffb190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb1a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==250856==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-1381.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-1381.txt new file mode 100644 index 000000000..7d71ea121 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-1381.txt @@ -0,0 +1,69 @@ +21/Apr/2026 23:59:50 [Utils.cpp:761] WARNING: mkdir(/out/data-dir/0) failed [13/Permission denied] +21/Apr/2026 23:59:50 [Utils.cpp:761] WARNING: mkdir(/out/data-dir/0/top_talkers/) failed [2/No such file or directory] +21/Apr/2026 23:59:50 [StatsManager.cpp:45] WARNING: Unable to create directory /out/data-dir/0/top_talkers/ +21/Apr/2026 23:59:50 [Utils.cpp:761] WARNING: mkdir(/out/data-dir/0) failed [13/Permission denied] +21/Apr/2026 23:59:50 [Utils.cpp:761] WARNING: mkdir(/out/data-dir/0/alerts/) failed [2/No such file or directory] +21/Apr/2026 23:59:50 [SQLiteStoreManager.cpp:38] WARNING: Unable to open /out/data-dir/0/alerts/alert_store_v11.db: unable to open database file +21/Apr/2026 23:59:50 [SQLiteAlertStore.cpp:44] WARNING: Unable to initialize store /out/data-dir/0/alerts/alert_store_v11.db +21/Apr/2026 23:59:50 [SQLiteAlertStore.cpp:49] WARNING: Unable to open store /out/data-dir/0/alerts/alert_store_v11.db +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 905152237 +INFO: Loaded 1 modules (41552 inline 8-bit counters): 41552 [0xef1d60, 0xefbfb0), +INFO: Loaded 1 PC tables (41552 PCs): 41552 [0xc89fa8,0xd2c4a8), +/out/fuzz_dissect_packet: Running 1 inputs 10 time(s) each. +Running: /work/testcase-OSV-2023-1381 +21/Apr/2026 23:59:50 [NetworkInterface.cpp:2421] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +21/Apr/2026 23:59:50 [NetworkInterface.cpp:2426] WARNING: using: sudo ethtool -K custom gro off gso off tso off +================================================================= +==209065==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x616000000eca at pc 0x00000052530d bp 0x7fffa11fe0d0 sp 0x7fffa11fd890 +READ of size 10 at 0x616000000eca thread T0 + #0 0x52530c in __interceptor_strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 + #1 0x6eef24 in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2078:17 + #2 0x6f7835 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2820:26 + #3 0x5781e8 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:197:16 + #4 0x448f53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x4346b2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x439f5c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fd576246082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #9 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +0x616000000eca is located 0 bytes to the right of 586-byte region [0x616000000c80,0x616000000eca) +allocated by thread T0 here: + #0 0x53a4ec in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x95a711 in grow_buffer /src/libpcap-1.9.1/./sf-pcap.c:426:18 + #2 0x95a711 in pcap_next_packet /src/libpcap-1.9.1/./sf-pcap.c:604:9 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 in __interceptor_strncpy +Shadow bytes around the buggy address: + 0x0c2c7fff8180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff81a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff81b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff81c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c2c7fff81d0: 00 00 00 00 00 00 00 00 00[02]fa fa fa fa fa fa + 0x0c2c7fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8210: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8220: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==209065==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-423.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-423.txt new file mode 100644 index 000000000..a7aca12a9 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-423.txt @@ -0,0 +1,53 @@ +INFO: Seed: 2742105036 +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020002a2913 at pc 0x00000063cfee bp 0x7ffe0ff8e710 sp 0x7ffe0ff8e708 +READ of size 4 at 0x6020002a2913 thread T0 + #0 0x63cfed in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2518:5 + #1 0x5125db in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:227:16 + #2 0x4f086c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x4e27c5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x4e7471 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x4e2492 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7fca35f10082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #7 0x423bfd in _start (/out/fuzz_dissect_packet+0x423bfd) + +0x6020002a2913 is located 2 bytes to the right of 1-byte region [0x6020002a2910,0x6020002a2911) +allocated by thread T0 here: + #0 0x4a5036 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xa8dd73 in pcap_check_header /src/libpcap-1.9.1/./sf-pcap.c:405:14 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/NetworkInterface.cpp:2518:5 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) +Shadow bytes around the buggy address: + 0x0c048004c4d0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00 + 0x0c048004c4e0: fa fa 00 fa fa fa 00 00 fa fa 00 00 fa fa 00 00 + 0x0c048004c4f0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa fd fd + 0x0c048004c500: fa fa fd fd fa fa fd fd fa fa fd fd fa fa 00 fa + 0x0c048004c510: fa fa 00 00 fa fa 00 fa fa fa 00 fa fa fa 00 fa +=>0x0c048004c520: fa fa[01]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c048004c530: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c048004c540: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c048004c550: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c048004c560: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c048004c570: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-425.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-425.txt new file mode 100644 index 000000000..f712e909c --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-425.txt @@ -0,0 +1,58 @@ +INFO: Seed: 2746740787 +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +20/Apr/2026 04:21:58 [NetworkInterface.cpp:2494] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +20/Apr/2026 04:21:58 [NetworkInterface.cpp:2499] WARNING: using: sudo ethtool -K custom gro off gso off tso off +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000013ce0 at pc 0x0000008d9f42 bp 0x7ffe9aeac290 sp 0x7ffe9aeac288 +READ of size 1 at 0x603000013ce0 thread T0 + #0 0x8d9f41 in ICMPinfo::dissectICMP(unsigned short, unsigned char const*) /src/ntopng/src/ICMPinfo.cpp:100:17 + #1 0x62bd97 in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:1825:15 + #2 0x6397d0 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2893:26 + #3 0x5125db in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:227:16 + #4 0x4f086c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #5 0x4e27c5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #6 0x4e7471 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #7 0x4e2492 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #8 0x7f9e811e6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #9 0x423bfd in _start (/out/fuzz_dissect_packet+0x423bfd) + +0x603000013ce0 is located 1 bytes to the right of 31-byte region [0x603000013cc0,0x603000013cdf) +allocated by thread T0 here: + #0 0x4a543c in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0xa8df71 in grow_buffer /src/libpcap-1.9.1/./sf-pcap.c:426:18 + #2 0xa8df71 in pcap_next_packet /src/libpcap-1.9.1/./sf-pcap.c:604:9 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/ICMPinfo.cpp:100:17 in ICMPinfo::dissectICMP(unsigned short, unsigned char const*) +Shadow bytes around the buggy address: + 0x0c067fffa740: 00 fa fa fa 00 00 00 00 fa fa fd fd fd fa fa fa + 0x0c067fffa750: fd fd fd fa fa fa fd fd fd fd fa fa fd fd fd fd + 0x0c067fffa760: fa fa fd fd fd fd fa fa fd fd fd fd fa fa 00 00 + 0x0c067fffa770: 00 00 fa fa 00 00 00 fa fa fa 00 00 00 00 fa fa + 0x0c067fffa780: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 00 +=>0x0c067fffa790: fa fa fd fd fd fd fa fa 00 00 00 07[fa]fa fd fd + 0x0c067fffa7a0: fd fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa + 0x0c067fffa7b0: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa + 0x0c067fffa7c0: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa fa fa + 0x0c067fffa7d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c067fffa7e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-462.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-462.txt new file mode 100644 index 000000000..b63b8942c --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-462.txt @@ -0,0 +1,59 @@ +INFO: Seed: 2750911073 +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +20/Apr/2026 04:22:02 [NetworkInterface.cpp:2494] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +20/Apr/2026 04:22:02 [NetworkInterface.cpp:2499] WARNING: using: sudo ethtool -K custom gro off gso off tso off +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60700000110a at pc 0x000000795c23 bp 0x7ffd650ce690 sp 0x7ffd650ce688 +READ of size 1 at 0x60700000110a thread T0 + #0 0x795c22 in IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*) /src/ntopng/src/IEC104Stats.cpp:393:11 + #1 0x70025f in Flow::processIEC60870Packet(bool, unsigned char const*, unsigned short, timeval*) /src/ntopng/src/Flow.cpp:1140:13 + #2 0x6fb10e in Flow::processPacket(pcap_pkthdr const*, unsigned char const*, unsigned short, unsigned long, unsigned char*, unsigned short, unsigned short) /src/ntopng/src/Flow.cpp:993:5 + #3 0x62ddcd in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2035:13 + #4 0x6397d0 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2893:26 + #5 0x5125db in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:227:16 + #6 0x4f086c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #7 0x4e27c5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #8 0x4e7471 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #9 0x4e2492 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #10 0x7f51380e9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #11 0x423bfd in _start (/out/fuzz_dissect_packet+0x423bfd) + +0x60700000110a is located 0 bytes to the right of 74-byte region [0x6070000010c0,0x60700000110a) +allocated by thread T0 here: + #0 0x4a5036 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xa8dd73 in pcap_check_header /src/libpcap-1.9.1/./sf-pcap.c:405:14 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/IEC104Stats.cpp:393:11 in IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*) +Shadow bytes around the buggy address: + 0x0c0e7fff81d0: fa fa 00 00 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0e7fff81e0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fd fd + 0x0c0e7fff81f0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd + 0x0c0e7fff8200: fd fd fd fd fd fd fa fa fa fa fd fd fd fd fd fd + 0x0c0e7fff8210: fd fd fd fa fa fa fa fa 00 00 00 00 00 00 00 00 +=>0x0c0e7fff8220: 00[02]fa fa fa fa 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff8230: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-480.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-480.txt new file mode 100644 index 000000000..d67d50a04 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-480.txt @@ -0,0 +1,55 @@ +INFO: Seed: 2754712756 +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +20/Apr/2026 04:22:06 [NetworkInterface.cpp:2494] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +20/Apr/2026 04:22:06 [NetworkInterface.cpp:2499] WARNING: using: sudo ethtool -K custom gro off gso off tso off +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x607000001105 at pc 0x00000063cf60 bp 0x7ffed60a4730 sp 0x7ffed60a4728 +READ of size 2 at 0x607000001105 thread T0 + #0 0x63cf5f in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2742:57 + #1 0x5125db in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:227:16 + #2 0x4f086c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #3 0x4e27c5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #4 0x4e7471 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #5 0x4e2492 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #6 0x7f22ca9a4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #7 0x423bfd in _start (/out/fuzz_dissect_packet+0x423bfd) + +0x607000001105 is located 0 bytes to the right of 69-byte region [0x6070000010c0,0x607000001105) +allocated by thread T0 here: + #0 0x4a5036 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xa8dd73 in pcap_check_header /src/libpcap-1.9.1/./sf-pcap.c:405:14 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/NetworkInterface.cpp:2742:57 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) +Shadow bytes around the buggy address: + 0x0c0e7fff81d0: fa fa 00 00 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0e7fff81e0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fd fd + 0x0c0e7fff81f0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd + 0x0c0e7fff8200: fd fd fd fd fd fd fa fa fa fa fd fd fd fd fd fd + 0x0c0e7fff8210: fd fd fd fa fa fa fa fa 00 00 00 00 00 00 00 00 +=>0x0c0e7fff8220:[05]fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00 + 0x0c0e7fff8230: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-507.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-507.txt new file mode 100644 index 000000000..8ab9b62a4 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-507.txt @@ -0,0 +1,59 @@ +INFO: Seed: 2758614278 +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +20/Apr/2026 04:22:10 [NetworkInterface.cpp:2494] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +20/Apr/2026 04:22:10 [NetworkInterface.cpp:2499] WARNING: using: sudo ethtool -K custom gro off gso off tso off +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000019b45 at pc 0x000000795c61 bp 0x7ffc970b7010 sp 0x7ffc970b7008 +READ of size 2 at 0x611000019b45 thread T0 + #0 0x795c60 in IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*) /src/ntopng/src/IEC104Stats.cpp:249:33 + #1 0x70025f in Flow::processIEC60870Packet(bool, unsigned char const*, unsigned short, timeval*) /src/ntopng/src/Flow.cpp:1140:13 + #2 0x62e16d in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2263:17 + #3 0x6397d0 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2893:26 + #4 0x5125db in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:227:16 + #5 0x4f086c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #6 0x4e27c5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #7 0x4e7471 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #8 0x4e2492 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #9 0x7f22c8ec6082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #10 0x423bfd in _start (/out/fuzz_dissect_packet+0x423bfd) + +0x611000019b45 is located 6 bytes to the right of 255-byte region [0x611000019a40,0x611000019b3f) +allocated by thread T0 here: + #0 0x4a543c in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0xa8df71 in grow_buffer /src/libpcap-1.9.1/./sf-pcap.c:426:18 + #2 0xa8df71 in pcap_next_packet /src/libpcap-1.9.1/./sf-pcap.c:604:9 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/IEC104Stats.cpp:249:33 in IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*) +Shadow bytes around the buggy address: + 0x0c227fffb310: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa + 0x0c227fffb320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb340: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fffb350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c227fffb360: 00 00 00 00 00 00 00 07[fa]fa fa fa fa fa fa fa + 0x0c227fffb370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb380: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa + 0x0c227fffb390: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffb3a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffb3b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-688.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-688.txt new file mode 100644 index 000000000..d4b6ea104 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-688.txt @@ -0,0 +1,26 @@ +================================================================= +==600542==ERROR: AddressSanitizer: alloc-dealloc-mismatch (operator new [] vs operator delete) on 0x6040001f89d0 + #0 0x57578d in operator delete(void*) /src/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:152:3 + #1 0x834e3a in HostPools::reloadPools() /src/ntopng/src/HostPools.cpp:328:12 + #2 0x834177 in HostPools::HostPools(NetworkInterface*) /src/ntopng/src/HostPools.cpp:74:3 + #3 0x6dc22a in NetworkInterface::NetworkInterface(char const*, char const*) /src/ntopng/src/NetworkInterface.cpp:200:35 + #4 0x5776de in LLVMFuzzerInitialize /src/ntopng/fuzz/fuzz_dissect_packet.cpp:131:17 + #5 0x437b47 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:648:5 + #6 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #7 0x7f83ebdf5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #8 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +0x6040001f89d0 is located 0 bytes inside of 40-byte region [0x6040001f89d0,0x6040001f89f8) +allocated by thread T0 here: + #0 0x57524d in operator new[](unsigned long, std::nothrow_t const&) /src/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:104:3 + #1 0x834503 in HostPools::reloadPools() /src/ntopng/src/HostPools.cpp:312:15 + #2 0x834177 in HostPools::HostPools(NetworkInterface*) /src/ntopng/src/HostPools.cpp:74:3 + #3 0x6dc22a in NetworkInterface::NetworkInterface(char const*, char const*) /src/ntopng/src/NetworkInterface.cpp:200:35 + #4 0x5776de in LLVMFuzzerInitialize /src/ntopng/fuzz/fuzz_dissect_packet.cpp:131:17 + #5 0x437b47 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:648:5 + #6 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #7 0x7f83ebdf5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: alloc-dealloc-mismatch /src/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:152:3 in operator delete(void*) +==600542==HINT: if you don't care about these errors you may set ASAN_OPTIONS=alloc_dealloc_mismatch=0 +==600542==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-697.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-697.txt new file mode 100644 index 000000000..9b6d4f0fb --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-697.txt @@ -0,0 +1,59 @@ +INFO: Seed: 2763082872 +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +20/Apr/2026 04:22:14 [NetworkInterface.cpp:2494] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +20/Apr/2026 04:22:14 [NetworkInterface.cpp:2499] WARNING: using: sudo ethtool -K custom gro off gso off tso off +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000019b3f at pc 0x000000795be5 bp 0x7ffce1197bf0 sp 0x7ffce1197be8 +READ of size 1 at 0x611000019b3f thread T0 + #0 0x795be4 in IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*) /src/ntopng/src/IEC104Stats.cpp:186:27 + #1 0x70025f in Flow::processIEC60870Packet(bool, unsigned char const*, unsigned short, timeval*) /src/ntopng/src/Flow.cpp:1140:13 + #2 0x62e16d in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2263:17 + #3 0x6397d0 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2893:26 + #4 0x5125db in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:227:16 + #5 0x4f086c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #6 0x4e27c5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #7 0x4e7471 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #8 0x4e2492 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #9 0x7fc3fe213082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #10 0x423bfd in _start (/out/fuzz_dissect_packet+0x423bfd) + +0x611000019b3f is located 0 bytes to the right of 255-byte region [0x611000019a40,0x611000019b3f) +allocated by thread T0 here: + #0 0x4a543c in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0xa8df71 in grow_buffer /src/libpcap-1.9.1/./sf-pcap.c:426:18 + #2 0xa8df71 in pcap_next_packet /src/libpcap-1.9.1/./sf-pcap.c:604:9 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/IEC104Stats.cpp:186:27 in IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*) +Shadow bytes around the buggy address: + 0x0c227fffb310: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa + 0x0c227fffb320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb340: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fffb350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c227fffb360: 00 00 00 00 00 00 00[07]fa fa fa fa fa fa fa fa + 0x0c227fffb370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb380: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa + 0x0c227fffb390: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffb3a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffb3b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-710.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-710.txt new file mode 100644 index 000000000..41af52733 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-710.txt @@ -0,0 +1,58 @@ +INFO: Seed: 2767083421 +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +20/Apr/2026 04:22:18 [NetworkInterface.cpp:2494] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +20/Apr/2026 04:22:18 [NetworkInterface.cpp:2499] WARNING: using: sudo ethtool -K custom gro off gso off tso off +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61d000001c80 at pc 0x00000049025d bp 0x7ffc99cf6e30 sp 0x7ffc99cf65f0 +READ of size 10 at 0x61d000001c80 thread T0 + #0 0x49025c in __interceptor_strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 + #1 0x758d24 in Flow::dissectMDNS(unsigned char*, unsigned short) /src/ntopng/src/Flow.cpp:6077:17 + #2 0x62e531 in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2278:15 + #3 0x6397d0 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2893:26 + #4 0x5125db in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:227:16 + #5 0x4f086c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #6 0x4e27c5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #7 0x4e7471 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #8 0x4e2492 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #9 0x7f0ba34e0082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #10 0x423bfd in _start (/out/fuzz_dissect_packet+0x423bfd) + +0x61d000001c80 is located 0 bytes to the right of 2048-byte region [0x61d000001480,0x61d000001c80) +allocated by thread T0 here: + #0 0x4a5036 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xa8dd73 in pcap_check_header /src/libpcap-1.9.1/./sf-pcap.c:405:14 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 in __interceptor_strncpy +Shadow bytes around the buggy address: + 0x0c3a7fff8340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3a7fff8350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3a7fff8360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3a7fff8370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3a7fff8380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c3a7fff8390:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c3a7fff83a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c3a7fff83b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c3a7fff83c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c3a7fff83d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3a7fff83e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-726.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-726.txt new file mode 100644 index 000000000..c5e8d93b6 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-726.txt @@ -0,0 +1,55 @@ +INFO: Seed: 2772887557 +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000eabee0 at pc 0x00000075ab52 bp 0x7ffdc4c5e650 sp 0x7ffdc4c5e648 +READ of size 1 at 0x606000eabee0 thread T0 + #0 0x75ab51 in Flow::dissectNetBIOS(unsigned char*, unsigned short) /src/ntopng/src/Flow.cpp:6172:9 + #1 0x62e705 in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2212:15 + #2 0x6397d0 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2893:26 + #3 0x5125db in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:227:16 + #4 0x4f086c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #5 0x4e27c5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #6 0x4e7471 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #7 0x4e2492 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #8 0x7f87a47a9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #9 0x423bfd in _start (/out/fuzz_dissect_packet+0x423bfd) + +0x606000eabee0 is located 2 bytes to the right of 62-byte region [0x606000eabea0,0x606000eabede) +allocated by thread T0 here: + #0 0x4a5036 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xa8dd73 in pcap_check_header /src/libpcap-1.9.1/./sf-pcap.c:405:14 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/Flow.cpp:6172:9 in Flow::dissectNetBIOS(unsigned char*, unsigned short) +Shadow bytes around the buggy address: + 0x0c0c801cd780: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00 + 0x0c0c801cd790: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c0c801cd7a0: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa + 0x0c0c801cd7b0: 00 00 00 00 00 00 00 00 fa fa fa fa fd fd fd fd + 0x0c0c801cd7c0: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa +=>0x0c0c801cd7d0: fa fa fa fa 00 00 00 00 00 00 00 06[fa]fa fa fa + 0x0c0c801cd7e0: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c801cd7f0: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c0c801cd800: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa + 0x0c0c801cd810: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00 + 0x0c0c801cd820: 00 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-741.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-741.txt new file mode 100644 index 000000000..470bf43b3 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-741.txt @@ -0,0 +1,59 @@ +INFO: Seed: 2779522535 +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +20/Apr/2026 04:22:31 [NetworkInterface.cpp:2494] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +20/Apr/2026 04:22:31 [NetworkInterface.cpp:2499] WARNING: using: sudo ethtool -K custom gro off gso off tso off +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60c0000021bf at pc 0x0000006f24f8 bp 0x7ffd698641b0 sp 0x7ffd698641a8 +READ of size 1 at 0x60c0000021bf thread T0 + #0 0x6f24f7 in Flow::setBittorrentHash(char*) /src/ntopng/src/Flow.cpp:5522:16 + #1 0x7537e3 in Flow::dissectBittorrent(char*, unsigned short) /src/ntopng/src/Flow.cpp:5540:19 + #2 0x62e9e7 in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2218:17 + #3 0x6397d0 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2893:26 + #4 0x5125db in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:227:16 + #5 0x4f086c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #6 0x4e27c5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #7 0x4e7471 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #8 0x4e2492 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #9 0x7f1d5875f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #10 0x423bfd in _start (/out/fuzz_dissect_packet+0x423bfd) + +0x60c0000021bf is located 0 bytes to the right of 127-byte region [0x60c000002140,0x60c0000021bf) +allocated by thread T0 here: + #0 0x4a543c in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0xa8df71 in grow_buffer /src/libpcap-1.9.1/./sf-pcap.c:426:18 + #2 0xa8df71 in pcap_next_packet /src/libpcap-1.9.1/./sf-pcap.c:604:9 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/Flow.cpp:5522:16 in Flow::setBittorrentHash(char*) +Shadow bytes around the buggy address: + 0x0c187fff83e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c187fff83f0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c187fff8400: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa + 0x0c187fff8410: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c187fff8420: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 +=>0x0c187fff8430: 00 00 00 00 00 00 00[07]fa fa fa fa fa fa fa fa + 0x0c187fff8440: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c187fff8450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c187fff8460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c187fff8470: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c187fff8480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-761.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-761.txt new file mode 100644 index 000000000..4e65b382e --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-761.txt @@ -0,0 +1,58 @@ +INFO: Seed: 2784014330 +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +20/Apr/2026 04:22:35 [NetworkInterface.cpp:2494] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +20/Apr/2026 04:22:35 [NetworkInterface.cpp:2499] WARNING: using: sudo ethtool -K custom gro off gso off tso off +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000eabf40 at pc 0x0000008da20a bp 0x7ffea169e010 sp 0x7ffea169e008 +READ of size 4 at 0x606000eabf40 thread T0 + #0 0x8da209 in ICMPinfo::dissectICMP(unsigned short, unsigned char const*) /src/ntopng/src/ICMPinfo.cpp:118:55 + #1 0x62bd97 in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:1825:15 + #2 0x639f1c in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:3046:28 + #3 0x5125db in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:227:16 + #4 0x4f086c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #5 0x4e27c5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #6 0x4e7471 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #7 0x4e2492 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #8 0x7f5fdf4d3082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #9 0x423bfd in _start (/out/fuzz_dissect_packet+0x423bfd) + +0x606000eabf40 is located 0 bytes to the right of 64-byte region [0x606000eabf00,0x606000eabf40) +allocated by thread T0 here: + #0 0x4a543c in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0xa8df71 in grow_buffer /src/libpcap-1.9.1/./sf-pcap.c:426:18 + #2 0xa8df71 in pcap_next_packet /src/libpcap-1.9.1/./sf-pcap.c:604:9 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/ICMPinfo.cpp:118:55 in ICMPinfo::dissectICMP(unsigned short, unsigned char const*) +Shadow bytes around the buggy address: + 0x0c0c801cd790: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c0c801cd7a0: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa + 0x0c0c801cd7b0: 00 00 00 00 00 00 00 00 fa fa fa fa fd fd fd fd + 0x0c0c801cd7c0: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa + 0x0c0c801cd7d0: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa +=>0x0c0c801cd7e0: 00 00 00 00 00 00 00 00[fa]fa fa fa 00 00 00 00 + 0x0c0c801cd7f0: 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c801cd800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c801cd810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c801cd820: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c801cd830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-976.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-976.txt new file mode 100644 index 000000000..d7d724925 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/crashes/OSV-2023-976.txt @@ -0,0 +1,58 @@ +INFO: Seed: 2786542383 +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /tmp/testcase +20/Apr/2026 04:22:38 [NetworkInterface.cpp:2494] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +20/Apr/2026 04:22:38 [NetworkInterface.cpp:2499] WARNING: using: sudo ethtool -K custom gro off gso off tso off +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000eabf40 at pc 0x00000075a0fe bp 0x7ffd4a745e90 sp 0x7ffd4a745e88 +READ of size 2 at 0x606000eabf40 thread T0 + #0 0x75a0fd in Flow::dissectMDNS(unsigned char*, unsigned short) /src/ntopng/src/Flow.cpp:6010:5 + #1 0x62e531 in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2278:15 + #2 0x6397d0 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2893:26 + #3 0x5125db in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:227:16 + #4 0x4f086c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /tmp/libfuzzer/./FuzzerLoop.cpp:532:15 + #5 0x4e27c5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /tmp/libfuzzer/./FuzzerDriver.cpp:284:6 + #6 0x4e7471 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /tmp/libfuzzer/./FuzzerDriver.cpp:713:9 + #7 0x4e2492 in main /tmp/libfuzzer/./FuzzerMain.cpp:19:10 + #8 0x7f7c520a9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #9 0x423bfd in _start (/out/fuzz_dissect_packet+0x423bfd) + +0x606000eabf40 is located 0 bytes to the right of 64-byte region [0x606000eabf00,0x606000eabf40) +allocated by thread T0 here: + #0 0x4a543c in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0xa8df71 in grow_buffer /src/libpcap-1.9.1/./sf-pcap.c:426:18 + #2 0xa8df71 in pcap_next_packet /src/libpcap-1.9.1/./sf-pcap.c:604:9 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/Flow.cpp:6010:5 in Flow::dissectMDNS(unsigned char*, unsigned short) +Shadow bytes around the buggy address: + 0x0c0c801cd790: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c0c801cd7a0: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa + 0x0c0c801cd7b0: 00 00 00 00 00 00 00 00 fa fa fa fa fd fd fd fd + 0x0c0c801cd7c0: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa + 0x0c0c801cd7d0: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa +=>0x0c0c801cd7e0: 00 00 00 00 00 00 00 00[fa]fa fa fa 00 00 00 00 + 0x0c0c801cd7f0: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa + 0x0c0c801cd800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c801cd810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c801cd820: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c801cd830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/libpcap-1.9.1.tar.gz b/benchmarks/ntopng_transplant_fuzz_dissect_packet/libpcap-1.9.1.tar.gz new file mode 100644 index 000000000..a052b0fb6 Binary files /dev/null and b/benchmarks/ntopng_transplant_fuzz_dissect_packet/libpcap-1.9.1.tar.gz differ diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/COMMANDS.md b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/COMMANDS.md new file mode 100644 index 000000000..4e1a099fc --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/COMMANDS.md @@ -0,0 +1,88 @@ +# Original Crash Collection: ntopng fuzz_dissect_packet + +Generated: 2026-04-24 UTC + +Benchmark: `ntopng_transplant_fuzz_dissect_packet` +Project: `ntopng` +Fuzzer: `fuzz_dissect_packet` +Sanitizer: `address` + +Target source commit: `b7b2810e617117c4420a5e1a4639515f2c45b26b` (2023-05-22) +Target-era base-runner: `gcr.io/oss-fuzz-base/base-runner@sha256:3a190cfbada024425c48aebd06558a0e974e819f69625e886b1fe2b1a138064d` (2022-07) + +## Semantics + +Each `OSV-*.txt` is a crash on the pristine source tree: +- **Local bugs** (already triggering at target) come from the migration pipeline's + target-commit captures, saved in `/mnt/nas/linke/new_migrate/ntopng/ + fuzz_dissect_packet/crash/` (though they were actually captured at target by the + migration pipeline when it verified each local bug still fires at target). +- **Migration bugs** come from the same NAS crash directory, captured per-bug at + each bug's own buggy source commit by `fuzz_helper.py collect_crash + --runner-image auto` (era-matched per commit). + +All 18 logs are valid (18 real crashes, including the `libFuzzer: deadly signal` +assertion paths). No re-capture was needed; only this CSV + updated COMMANDS.md +were added. + +## Bug → source commit / OSS-Fuzz commit + +| Bug | Kind | Source commit | OSS-Fuzz commit | +| --- | --- | --- | --- | +| OSV-2023-1160 | local | `b7b2810e6171` | `884106149890` | +| OSV-2023-1214 | local | `b7b2810e6171` | `884106149890` | +| OSV-2023-1352 | migration | `35b09487b9e3` | `f1d21d6f1bea` | +| OSV-2023-1360 | migration | `4084c291321b` | `d98ab91d4709` | +| OSV-2023-1375 | migration | `bb028d7271dc` | `b754d865dc5c` | +| OSV-2023-1381 | migration | `c907e4292692` | `39a27b6a0ff3` | +| OSV-2023-423 | local | `b7b2810e6171` | `884106149890` | +| OSV-2023-425 | local | `b7b2810e6171` | `884106149890` | +| OSV-2023-462 | local | `b7b2810e6171` | `884106149890` | +| OSV-2023-480 | local | `b7b2810e6171` | `884106149890` | +| OSV-2023-507 | local | `b7b2810e6171` | `884106149890` | +| OSV-2023-688 | migration | `f6296c76ea3c` | `645de0a46e48` | +| OSV-2023-697 | local | `b7b2810e6171` | `884106149890` | +| OSV-2023-710 | local | `b7b2810e6171` | `884106149890` | +| OSV-2023-726 | local | `b7b2810e6171` | `884106149890` | +| OSV-2023-741 | local | `b7b2810e6171` | `884106149890` | +| OSV-2023-761 | local | `b7b2810e6171` | `884106149890` | +| OSV-2023-976 | local | `b7b2810e6171` | `884106149890` | + +## Re-run command (any bug) + +```bash +BUILD_CSV='/home/user/oss-fuzz-build/fuzzbench/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/collect_crash_builds.csv' +OUT_DIR='/home/user/oss-fuzz-build/fuzzbench/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes' + +while IFS=$'\t' read -r bug commit; do + [ "$bug" = "bug" ] && continue + ts=$(git -C /home/user/tasks-git/ntopng log -1 --format=%ct "$commit") + /home/user/pyenv/venv/bin/python3 /home/user/oss-fuzz-for-select/script/fuzz_helper.py collect_crash \ + --commit "$commit" --build_csv "$BUILD_CSV" \ + --testcases /home/user/oss-fuzz-for-select/pocs/tmp --test_input "testcase-${bug}" \ + --runner-image auto --commit-date "$ts" \ + ntopng fuzz_dissect_packet + cp "/home/user/oss-fuzz-build/data/crash/target_crash-${commit:0:6}-testcase-${bug}.txt" "${OUT_DIR}/${bug}.txt" +done <<'JOBS' +bug commit +OSV-2023-1160 b7b2810e617117c4420a5e1a4639515f2c45b26b +OSV-2023-1214 b7b2810e617117c4420a5e1a4639515f2c45b26b +OSV-2023-1352 35b09487b9e38f11e5e01fc3cf9eb60b1b493f7c +OSV-2023-1360 4084c291321bc6d152f3926a465f5fb1679f849f +OSV-2023-1375 bb028d7271dc3e2cfead4592ecbf0594a81ae710 +OSV-2023-1381 c907e4292692af8fc7a09c14c9093dce44f08dc1 +OSV-2023-423 b7b2810e617117c4420a5e1a4639515f2c45b26b +OSV-2023-425 b7b2810e617117c4420a5e1a4639515f2c45b26b +OSV-2023-462 b7b2810e617117c4420a5e1a4639515f2c45b26b +OSV-2023-480 b7b2810e617117c4420a5e1a4639515f2c45b26b +OSV-2023-507 b7b2810e617117c4420a5e1a4639515f2c45b26b +OSV-2023-688 f6296c76ea3c51ce2e602b3280c3df431a1820cd +OSV-2023-697 b7b2810e617117c4420a5e1a4639515f2c45b26b +OSV-2023-710 b7b2810e617117c4420a5e1a4639515f2c45b26b +OSV-2023-726 b7b2810e617117c4420a5e1a4639515f2c45b26b +OSV-2023-741 b7b2810e617117c4420a5e1a4639515f2c45b26b +OSV-2023-761 b7b2810e617117c4420a5e1a4639515f2c45b26b +OSV-2023-976 b7b2810e617117c4420a5e1a4639515f2c45b26b +JOBS +``` + diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-1160.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-1160.txt new file mode 100644 index 000000000..b3589a88e --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-1160.txt @@ -0,0 +1,67 @@ +23/Apr/2026 23:03:19 [NetworkInterface.cpp:2421] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +23/Apr/2026 23:03:19 [NetworkInterface.cpp:2426] WARNING: using: sudo ethtool -K custom gro off gso off tso off + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2810606823 +INFO: Loaded 1 modules (41552 inline 8-bit counters): 41552 [0xef1d70, 0xefbfc0), +INFO: Loaded 1 PC tables (41552 PCs): 41552 [0xc8a028,0xd2c528), +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-1160 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000019b41 at pc 0x0000006eed91 bp 0x7fff4be16490 sp 0x7fff4be16488 +READ of size 1 at 0x611000019b41 thread T0 + #0 0x6eed90 in IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*) /src/ntopng/src/IEC104Stats.cpp:140:42 + #1 0x63b852 in Flow::processIEC60870Packet(bool, unsigned char const*, unsigned short, timeval*) /src/ntopng/src/Flow.cpp:1134:13 + #2 0x76bc2f in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2190:17 + #3 0x774fc5 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2820:26 + #4 0x5781e8 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:197:16 + #5 0x448f53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x4346b2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x439f5c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fd6ef827082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +DEDUP_TOKEN: IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*)--Flow::processIEC60870Packet(bool, unsigned char const*, unsigned short, timeval*)--NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) +0x611000019b41 is located 2 bytes to the right of 255-byte region [0x611000019a40,0x611000019b3f) +allocated by thread T0 here: + #0 0x53a4ec in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x95a6b1 in grow_buffer /src/libpcap-1.9.1/./sf-pcap.c:426:18 + #2 0x95a6b1 in pcap_next_packet /src/libpcap-1.9.1/./sf-pcap.c:604:9 + +DEDUP_TOKEN: __interceptor_realloc--grow_buffer--pcap_next_packet +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/IEC104Stats.cpp:140:42 in IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*) +Shadow bytes around the buggy address: + 0x0c227fffb310: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa + 0x0c227fffb320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb340: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fffb350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c227fffb360: 00 00 00 00 00 00 00 07[fa]fa fa fa fa fa fa fa + 0x0c227fffb370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb380: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa + 0x0c227fffb390: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fffb3a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb3b0: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-1214.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-1214.txt new file mode 100644 index 000000000..d6437ad1b --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-1214.txt @@ -0,0 +1,64 @@ +23/Apr/2026 23:03:22 [NetworkInterface.cpp:2421] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +23/Apr/2026 23:03:22 [NetworkInterface.cpp:2426] WARNING: using: sudo ethtool -K custom gro off gso off tso off + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2813275129 +INFO: Loaded 1 modules (41552 inline 8-bit counters): 41552 [0xef1d70, 0xefbfc0), +INFO: Loaded 1 PC tables (41552 PCs): 41552 [0xc8a028,0xd2c528), +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-1214 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000013d3e at pc 0x00000077759d bp 0x7ffc0d884750 sp 0x7ffc0d884748 +READ of size 2 at 0x603000013d3e thread T0 + #0 0x77759c in guessEthType /src/ntopng/src/NetworkInterface.cpp:2352:26 + #1 0x77759c in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2535:20 + #2 0x5781e8 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:197:16 + #3 0x448f53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #4 0x4346b2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #5 0x439f5c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #6 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #7 0x7f39b2e64082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #8 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +DEDUP_TOKEN: guessEthType--NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**)--LLVMFuzzerTestOneInput +0x603000013d3e is located 3 bytes to the right of 27-byte region [0x603000013d20,0x603000013d3b) +allocated by thread T0 here: + #0 0x53a0e6 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x95a4b3 in pcap_check_header /src/libpcap-1.9.1/./sf-pcap.c:405:14 + +DEDUP_TOKEN: malloc--pcap_check_header +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/NetworkInterface.cpp:2352:26 in guessEthType +Shadow bytes around the buggy address: + 0x0c067fffa750: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd + 0x0c067fffa760: fa fa fd fd fd fd fa fa 00 00 00 00 fa fa 00 00 + 0x0c067fffa770: 00 00 fa fa 00 00 00 fa fa fa 00 00 00 00 fa fa + 0x0c067fffa780: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 00 + 0x0c067fffa790: fa fa fd fd fd fd fa fa 00 00 00 00 fa fa fd fd +=>0x0c067fffa7a0: fd fd fa fa 00 00 00[03]fa fa fd fd fd fa fa fa + 0x0c067fffa7b0: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa + 0x0c067fffa7c0: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 + 0x0c067fffa7d0: 00 fa fa fa 00 00 00 fa fa fa fa fa fa fa fa fa + 0x0c067fffa7e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c067fffa7f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-1352.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-1352.txt new file mode 100755 index 000000000..721089900 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-1352.txt @@ -0,0 +1,61 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2672104032 +INFO: Loaded 1 modules (44073 inline 8-bit counters): 44073 [0xf37bb0, 0xf427d9), +INFO: Loaded 1 PC tables (44073 PCs): 44073 [0xc96ca8,0xd42f38), +/out/fuzz_dissect_packet: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-1352 +21/Apr/2026 23:17:42 [NetworkInterface.cpp:2476] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +21/Apr/2026 23:17:42 [NetworkInterface.cpp:2480] WARNING: using: sudo ethtool -K custom gro off gso off tso off +================================================================= +==26578==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x616000000ba0 at pc 0x00000052530d bp 0x7ffd8c0c0630 sp 0x7ffd8c0bfdf0 +READ of size 89 at 0x616000000ba0 thread T0 + #0 0x52530c in __interceptor_strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 + #1 0x8538d5 in Flow::dissectMDNS(unsigned char*, unsigned short) /src/ntopng/src/Flow.cpp:6221:17 + #2 0x638ddf in NetworkInterface::processPacket(int, unsigned int, int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2260:13 + #3 0x6413db in NetworkInterface::dissectPacket(int, unsigned int, int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2896:17 + #4 0x5781f2 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:198:12 + #5 0x448f53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x4346b2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x439f5c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fa7bb123082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #10 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +0x616000000ba0 is located 0 bytes to the right of 544-byte region [0x616000000980,0x616000000ba0) +allocated by thread T0 here: + #0 0x53a0e6 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x992bd3 in pcap_check_header /src/libpcap-1.9.1/./sf-pcap.c:405:14 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 in __interceptor_strncpy +Shadow bytes around the buggy address: + 0x0c2c7fff8120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff8140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff8150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff8160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c2c7fff8170: 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff81a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff81b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff81c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==26578==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-1360.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-1360.txt new file mode 100755 index 000000000..bc955034e --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-1360.txt @@ -0,0 +1,58 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2569152324 +INFO: Loaded 1 modules (44076 inline 8-bit counters): 44076 [0xf37bb0, 0xf427dc), +INFO: Loaded 1 PC tables (44076 PCs): 44076 [0xc96d48,0xd43008), +/out/fuzz_dissect_packet: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-1360 +21/Apr/2026 23:15:59 [NetworkInterface.cpp:2476] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +21/Apr/2026 23:15:59 [NetworkInterface.cpp:2480] WARNING: using: sudo ethtool -K custom gro off gso off tso off +================================================================= +==26578==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60800000329c at pc 0x0000006445d7 bp 0x7fffb46fe590 sp 0x7fffb46fe588 +READ of size 2 at 0x60800000329c thread T0 + #0 0x6445d6 in NetworkInterface::dissectPacket(int, unsigned int, int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2993:27 + #1 0x5781f2 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:198:12 + #2 0x448f53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x4346b2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x439f5c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7fa2e207a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #7 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +0x60800000329c is located 285 bytes to the right of 95-byte region [0x608000003120,0x60800000317f) +allocated by thread T0 here: + #0 0x53a0e6 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x992d23 in pcap_check_header /src/libpcap-1.9.1/./sf-pcap.c:405:14 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/NetworkInterface.cpp:2993:27 in NetworkInterface::dissectPacket(int, unsigned int, int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) +Shadow bytes around the buggy address: + 0x0c107fff8600: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 07 + 0x0c107fff8610: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 07 + 0x0c107fff8620: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 07 + 0x0c107fff8630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c107fff8640: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +=>0x0c107fff8650: fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c107fff8660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c107fff8670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c107fff8680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c107fff8690: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c107fff86a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==26578==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-1375.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-1375.txt new file mode 100755 index 000000000..838b94c2c --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-1375.txt @@ -0,0 +1,61 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2449873600 +INFO: Loaded 1 modules (44088 inline 8-bit counters): 44088 [0xf39c70, 0xf448a8), +INFO: Loaded 1 PC tables (44088 PCs): 44088 [0xc97fe8,0xd44368), +/out/fuzz_dissect_packet: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-1375 +21/Apr/2026 23:14:00 [NetworkInterface.cpp:2476] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +21/Apr/2026 23:14:00 [NetworkInterface.cpp:2480] WARNING: using: sudo ethtool -K custom gro off gso off tso off +================================================================= +==26580==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000015ddd at pc 0x000000701299 bp 0x7ffe00e36470 sp 0x7ffe00e36468 +READ of size 1 at 0x611000015ddd thread T0 + #0 0x701298 in IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*) /src/ntopng/src/IEC104Stats.cpp:138:42 + #1 0x828d42 in Flow::processIEC60870Packet(bool, unsigned char const*, unsigned short, timeval*) /src/ntopng/src/Flow.cpp:1184:13 + #2 0x639041 in NetworkInterface::processPacket(int, unsigned int, int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2235:8 + #3 0x641300 in NetworkInterface::dissectPacket(int, unsigned int, int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2902:17 + #4 0x5781f2 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:198:12 + #5 0x448f53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x4346b2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x439f5c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f12b7ebb082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #10 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +0x611000015ddd is located 0 bytes to the right of 221-byte region [0x611000015d00,0x611000015ddd) +allocated by thread T0 here: + #0 0x53a0e6 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x994043 in pcap_check_header /src/libpcap-1.9.1/./sf-pcap.c:405:14 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/IEC104Stats.cpp:138:42 in IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*) +Shadow bytes around the buggy address: + 0x0c227fffab60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffab70: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fffab80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffab90: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa + 0x0c227fffaba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c227fffabb0: 00 00 00 00 00 00 00 00 00 00 00[05]fa fa fa fa + 0x0c227fffabc0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fffabd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffabe0: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffabf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffac00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==26580==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-1381.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-1381.txt new file mode 100755 index 000000000..fc4b02efc --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-1381.txt @@ -0,0 +1,61 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2309639981 +INFO: Loaded 1 modules (44029 inline 8-bit counters): 44029 [0xf37910, 0xf4250d), +INFO: Loaded 1 PC tables (44029 PCs): 44029 [0xc96c08,0xd42bd8), +/out/fuzz_dissect_packet: Running 1 inputs 10 time(s) each. +Running: /corpus/testcase-OSV-2023-1381 +21/Apr/2026 22:00:05 [NetworkInterface.cpp:2472] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +21/Apr/2026 22:00:05 [NetworkInterface.cpp:2476] WARNING: using: sudo ethtool -K custom gro off gso off tso off +================================================================= +==26581==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x616000000eca at pc 0x0000005252ed bp 0x7ffc30fe97b0 sp 0x7ffc30fe8f70 +READ of size 10 at 0x616000000eca thread T0 + #0 0x5252ec in __interceptor_strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 + #1 0x6390f6 in NetworkInterface::processPacket(int, unsigned int, int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2112:8 + #2 0x6403c0 in NetworkInterface::dissectPacket(int, unsigned int, int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2898:17 + #3 0x5781d2 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:198:12 + #4 0x448f33 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x434692 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x439f3c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x463472 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f8af9c36082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #9 0x42a85d in _start (/out/fuzz_dissect_packet+0x42a85d) + +0x616000000eca is located 0 bytes to the right of 586-byte region [0x616000000c80,0x616000000eca) +allocated by thread T0 here: + #0 0x53a4cc in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x993011 in grow_buffer /src/libpcap-1.9.1/./sf-pcap.c:426:18 + #2 0x993011 in pcap_next_packet /src/libpcap-1.9.1/./sf-pcap.c:604:9 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 in __interceptor_strncpy +Shadow bytes around the buggy address: + 0x0c2c7fff8180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff81a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff81b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c2c7fff81c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c2c7fff81d0: 00 00 00 00 00 00 00 00 00[02]fa fa fa fa fa fa + 0x0c2c7fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8210: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c2c7fff8220: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==26581==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-423.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-423.txt new file mode 100644 index 000000000..1073fdb11 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-423.txt @@ -0,0 +1,61 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2815198999 +INFO: Loaded 1 modules (41552 inline 8-bit counters): 41552 [0xef1d70, 0xefbfc0), +INFO: Loaded 1 PC tables (41552 PCs): 41552 [0xc8a028,0xd2c528), +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-423 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020002a2913 at pc 0x0000007776e1 bp 0x7ffe9fde1050 sp 0x7ffe9fde1048 +READ of size 4 at 0x6020002a2913 thread T0 + #0 0x7776e0 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2445:5 + #1 0x5781e8 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:197:16 + #2 0x448f53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x4346b2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x439f5c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7fb86b815082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #7 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +DEDUP_TOKEN: NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**)--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +0x6020002a2913 is located 2 bytes to the right of 1-byte region [0x6020002a2910,0x6020002a2911) +allocated by thread T0 here: + #0 0x53a0e6 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x95a4b3 in pcap_check_header /src/libpcap-1.9.1/./sf-pcap.c:405:14 + +DEDUP_TOKEN: malloc--pcap_check_header +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/NetworkInterface.cpp:2445:5 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) +Shadow bytes around the buggy address: + 0x0c048004c4d0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00 + 0x0c048004c4e0: fa fa 00 fa fa fa 00 00 fa fa 00 00 fa fa 00 00 + 0x0c048004c4f0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa fd fd + 0x0c048004c500: fa fa fd fd fa fa fd fd fa fa fd fd fa fa 00 fa + 0x0c048004c510: fa fa 00 00 fa fa 00 fa fa fa 00 fa fa fa 00 fa +=>0x0c048004c520: fa fa[01]fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c048004c530: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c048004c540: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c048004c550: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c048004c560: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c048004c570: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-425.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-425.txt new file mode 100644 index 000000000..a9fe39265 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-425.txt @@ -0,0 +1,66 @@ +23/Apr/2026 23:03:26 [NetworkInterface.cpp:2421] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +23/Apr/2026 23:03:26 [NetworkInterface.cpp:2426] WARNING: using: sudo ethtool -K custom gro off gso off tso off + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2817640166 +INFO: Loaded 1 modules (41552 inline 8-bit counters): 41552 [0xef1d70, 0xefbfc0), +INFO: Loaded 1 PC tables (41552 PCs): 41552 [0xc8a028,0xd2c528), +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-425 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000013d70 at pc 0x0000007498f9 bp 0x7ffe07e16640 sp 0x7ffe07e16638 +READ of size 1 at 0x603000013d70 thread T0 + #0 0x7498f8 in ICMPinfo::dissectICMP(unsigned short, unsigned char const*) /src/ntopng/src/ICMPinfo.cpp:100:17 + #1 0x76a15e in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:1824:15 + #2 0x774fc5 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2820:26 + #3 0x5781e8 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:197:16 + #4 0x448f53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x4346b2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x439f5c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f0fe8837082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +DEDUP_TOKEN: ICMPinfo::dissectICMP(unsigned short, unsigned char const*)--NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**)--NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) +0x603000013d70 is located 1 bytes to the right of 31-byte region [0x603000013d50,0x603000013d6f) +allocated by thread T0 here: + #0 0x53a4ec in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x95a6b1 in grow_buffer /src/libpcap-1.9.1/./sf-pcap.c:426:18 + #2 0x95a6b1 in pcap_next_packet /src/libpcap-1.9.1/./sf-pcap.c:604:9 + +DEDUP_TOKEN: __interceptor_realloc--grow_buffer--pcap_next_packet +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/ICMPinfo.cpp:100:17 in ICMPinfo::dissectICMP(unsigned short, unsigned char const*) +Shadow bytes around the buggy address: + 0x0c067fffa750: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd + 0x0c067fffa760: fa fa fd fd fd fd fa fa 00 00 00 00 fa fa 00 00 + 0x0c067fffa770: 00 00 fa fa 00 00 00 fa fa fa 00 00 00 00 fa fa + 0x0c067fffa780: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 00 + 0x0c067fffa790: fa fa fd fd fd fd fa fa 00 00 00 00 fa fa fd fd +=>0x0c067fffa7a0: fd fd fa fa fd fd fd fd fa fa 00 00 00 07[fa]fa + 0x0c067fffa7b0: fd fd fd fa fa fa 00 00 00 fa fa fa 00 00 00 fa + 0x0c067fffa7c0: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 + 0x0c067fffa7d0: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa + 0x0c067fffa7e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c067fffa7f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-462.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-462.txt new file mode 100644 index 000000000..8c1e2dce3 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-462.txt @@ -0,0 +1,67 @@ +23/Apr/2026 23:03:28 [NetworkInterface.cpp:2421] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +23/Apr/2026 23:03:28 [NetworkInterface.cpp:2426] WARNING: using: sudo ethtool -K custom gro off gso off tso off + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2819326609 +INFO: Loaded 1 modules (41552 inline 8-bit counters): 41552 [0xef1d70, 0xefbfc0), +INFO: Loaded 1 PC tables (41552 PCs): 41552 [0xc8a028,0xd2c528), +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-462 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60700000117a at pc 0x0000006eeda5 bp 0x7fffdc916490 sp 0x7fffdc916488 +READ of size 1 at 0x60700000117a thread T0 + #0 0x6eeda4 in IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*) /src/ntopng/src/IEC104Stats.cpp:393:11 + #1 0x63b852 in Flow::processIEC60870Packet(bool, unsigned char const*, unsigned short, timeval*) /src/ntopng/src/Flow.cpp:1134:13 + #2 0x6388e7 in Flow::processPacket(pcap_pkthdr const*, unsigned char const*, unsigned short, unsigned long, unsigned char*, unsigned short, unsigned short) /src/ntopng/src/Flow.cpp:992:5 + #3 0x76b5aa in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2034:13 + #4 0x774fc5 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2820:26 + #5 0x5781e8 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:197:16 + #6 0x448f53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x4346b2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x439f5c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f083a38c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +DEDUP_TOKEN: IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*)--Flow::processIEC60870Packet(bool, unsigned char const*, unsigned short, timeval*)--Flow::processPacket(pcap_pkthdr const*, unsigned char const*, unsigned short, unsigned long, unsigned char*, unsigned short, unsigned short) +0x60700000117a is located 0 bytes to the right of 74-byte region [0x607000001130,0x60700000117a) +allocated by thread T0 here: + #0 0x53a0e6 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x95a4b3 in pcap_check_header /src/libpcap-1.9.1/./sf-pcap.c:405:14 + +DEDUP_TOKEN: malloc--pcap_check_header +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/IEC104Stats.cpp:393:11 in IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*) +Shadow bytes around the buggy address: + 0x0c0e7fff81d0: fa fa 00 00 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0e7fff81e0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fd fd + 0x0c0e7fff81f0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd + 0x0c0e7fff8200: fd fd fd fd fd fd fa fa fa fa fd fd fd fd fd fd + 0x0c0e7fff8210: fd fd fd fa fa fa fa fa 00 00 00 00 00 00 00 00 +=>0x0c0e7fff8220: 00 fa fa fa fa fa 00 00 00 00 00 00 00 00 00[02] + 0x0c0e7fff8230: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 fa fa + 0x0c0e7fff8240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-480.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-480.txt new file mode 100644 index 000000000..f892bdb7c --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-480.txt @@ -0,0 +1,63 @@ +23/Apr/2026 23:03:30 [NetworkInterface.cpp:2421] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +23/Apr/2026 23:03:30 [NetworkInterface.cpp:2426] WARNING: using: sudo ethtool -K custom gro off gso off tso off + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2821674550 +INFO: Loaded 1 modules (41552 inline 8-bit counters): 41552 [0xef1d70, 0xefbfc0), +INFO: Loaded 1 PC tables (41552 PCs): 41552 [0xc8a028,0xd2c528), +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-480 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x607000001175 at pc 0x0000007772ac bp 0x7ffe3efaff30 sp 0x7ffe3efaff28 +READ of size 2 at 0x607000001175 thread T0 + #0 0x7772ab in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2669:57 + #1 0x5781e8 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:197:16 + #2 0x448f53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #3 0x4346b2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #4 0x439f5c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #5 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #6 0x7fe1f3938082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #7 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +DEDUP_TOKEN: NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**)--LLVMFuzzerTestOneInput--fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) +0x607000001175 is located 0 bytes to the right of 69-byte region [0x607000001130,0x607000001175) +allocated by thread T0 here: + #0 0x53a0e6 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x95a4b3 in pcap_check_header /src/libpcap-1.9.1/./sf-pcap.c:405:14 + +DEDUP_TOKEN: malloc--pcap_check_header +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/NetworkInterface.cpp:2669:57 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) +Shadow bytes around the buggy address: + 0x0c0e7fff81d0: fa fa 00 00 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0e7fff81e0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fd fd + 0x0c0e7fff81f0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd + 0x0c0e7fff8200: fd fd fd fd fd fd fa fa fa fa fd fd fd fd fd fd + 0x0c0e7fff8210: fd fd fd fa fa fa fa fa 00 00 00 00 00 00 00 00 +=>0x0c0e7fff8220: 00 fa fa fa fa fa 00 00 00 00 00 00 00 00[05]fa + 0x0c0e7fff8230: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 fa fa + 0x0c0e7fff8240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0e7fff8270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-507.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-507.txt new file mode 100644 index 000000000..3f44bed13 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-507.txt @@ -0,0 +1,67 @@ +23/Apr/2026 23:03:33 [NetworkInterface.cpp:2421] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +23/Apr/2026 23:03:33 [NetworkInterface.cpp:2426] WARNING: using: sudo ethtool -K custom gro off gso off tso off + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2824325213 +INFO: Loaded 1 modules (41552 inline 8-bit counters): 41552 [0xef1d70, 0xefbfc0), +INFO: Loaded 1 PC tables (41552 PCs): 41552 [0xc8a028,0xd2c528), +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-507 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000019b45 at pc 0x0000006eede7 bp 0x7ffff157dfd0 sp 0x7ffff157dfc8 +READ of size 2 at 0x611000019b45 thread T0 + #0 0x6eede6 in IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*) /src/ntopng/src/IEC104Stats.cpp:249:33 + #1 0x63b852 in Flow::processIEC60870Packet(bool, unsigned char const*, unsigned short, timeval*) /src/ntopng/src/Flow.cpp:1134:13 + #2 0x76bc2f in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2190:17 + #3 0x774fc5 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2820:26 + #4 0x5781e8 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:197:16 + #5 0x448f53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x4346b2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x439f5c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f29d1b90082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +DEDUP_TOKEN: IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*)--Flow::processIEC60870Packet(bool, unsigned char const*, unsigned short, timeval*)--NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) +0x611000019b45 is located 6 bytes to the right of 255-byte region [0x611000019a40,0x611000019b3f) +allocated by thread T0 here: + #0 0x53a4ec in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x95a6b1 in grow_buffer /src/libpcap-1.9.1/./sf-pcap.c:426:18 + #2 0x95a6b1 in pcap_next_packet /src/libpcap-1.9.1/./sf-pcap.c:604:9 + +DEDUP_TOKEN: __interceptor_realloc--grow_buffer--pcap_next_packet +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/IEC104Stats.cpp:249:33 in IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*) +Shadow bytes around the buggy address: + 0x0c227fffb310: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa + 0x0c227fffb320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb340: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fffb350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c227fffb360: 00 00 00 00 00 00 00 07[fa]fa fa fa fa fa fa fa + 0x0c227fffb370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb380: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa + 0x0c227fffb390: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffb3a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffb3b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-688.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-688.txt new file mode 100755 index 000000000..602da5375 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-688.txt @@ -0,0 +1,26 @@ +================================================================= +==26485==ERROR: AddressSanitizer: alloc-dealloc-mismatch (operator new [] vs operator delete) on 0x604002141e50 + #0 0x57578d in operator delete(void*) /src/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:152:3 + #1 0x74e7ef in HostPools::reloadPools() /src/ntopng/src/HostPools.cpp + #2 0x74da77 in HostPools::HostPools(NetworkInterface*) /src/ntopng/src/HostPools.cpp:74:3 + #3 0x624d0a in NetworkInterface::NetworkInterface(char const*, char const*) /src/ntopng/src/NetworkInterface.cpp:200:35 + #4 0x5776de in LLVMFuzzerInitialize /src/ntopng/fuzz/fuzz_dissect_packet.cpp:131:17 + #5 0x437b47 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:648:5 + #6 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #7 0x7f7ba4e87082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + #8 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +0x604002141e50 is located 0 bytes inside of 40-byte region [0x604002141e50,0x604002141e78) +allocated by thread T0 here: + #0 0x57524d in operator new[](unsigned long, std::nothrow_t const&) /src/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:104:3 + #1 0x74de17 in HostPools::reloadPools() /src/ntopng/src/HostPools.cpp:316:15 + #2 0x74da77 in HostPools::HostPools(NetworkInterface*) /src/ntopng/src/HostPools.cpp:74:3 + #3 0x624d0a in NetworkInterface::NetworkInterface(char const*, char const*) /src/ntopng/src/NetworkInterface.cpp:200:35 + #4 0x5776de in LLVMFuzzerInitialize /src/ntopng/fuzz/fuzz_dissect_packet.cpp:131:17 + #5 0x437b47 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:648:5 + #6 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #7 0x7f7ba4e87082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee) + +SUMMARY: AddressSanitizer: alloc-dealloc-mismatch /src/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:152:3 in operator delete(void*) +==26485==HINT: if you don't care about these errors you may set ASAN_OPTIONS=alloc_dealloc_mismatch=0 +==26485==ABORTING diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-697.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-697.txt new file mode 100644 index 000000000..e67fdfadc --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-697.txt @@ -0,0 +1,67 @@ +23/Apr/2026 23:03:35 [NetworkInterface.cpp:2421] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +23/Apr/2026 23:03:35 [NetworkInterface.cpp:2426] WARNING: using: sudo ethtool -K custom gro off gso off tso off + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2826519910 +INFO: Loaded 1 modules (41552 inline 8-bit counters): 41552 [0xef1d70, 0xefbfc0), +INFO: Loaded 1 PC tables (41552 PCs): 41552 [0xc8a028,0xd2c528), +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-697 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000019b3f at pc 0x0000006eed75 bp 0x7ffde0b8d850 sp 0x7ffde0b8d848 +READ of size 1 at 0x611000019b3f thread T0 + #0 0x6eed74 in IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*) /src/ntopng/src/IEC104Stats.cpp:186:27 + #1 0x63b852 in Flow::processIEC60870Packet(bool, unsigned char const*, unsigned short, timeval*) /src/ntopng/src/Flow.cpp:1134:13 + #2 0x76bc2f in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2190:17 + #3 0x774fc5 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2820:26 + #4 0x5781e8 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:197:16 + #5 0x448f53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x4346b2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x439f5c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7faad3b4f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +DEDUP_TOKEN: IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*)--Flow::processIEC60870Packet(bool, unsigned char const*, unsigned short, timeval*)--NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) +0x611000019b3f is located 0 bytes to the right of 255-byte region [0x611000019a40,0x611000019b3f) +allocated by thread T0 here: + #0 0x53a4ec in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x95a6b1 in grow_buffer /src/libpcap-1.9.1/./sf-pcap.c:426:18 + #2 0x95a6b1 in pcap_next_packet /src/libpcap-1.9.1/./sf-pcap.c:604:9 + +DEDUP_TOKEN: __interceptor_realloc--grow_buffer--pcap_next_packet +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/IEC104Stats.cpp:186:27 in IEC104Stats::processPacket(Flow*, bool, unsigned char const*, unsigned short, timeval*) +Shadow bytes around the buggy address: + 0x0c227fffb310: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa + 0x0c227fffb320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb340: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fffb350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c227fffb360: 00 00 00 00 00 00 00[07]fa fa fa fa fa fa fa fa + 0x0c227fffb370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fffb380: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa + 0x0c227fffb390: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffb3a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fffb3b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-710.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-710.txt new file mode 100644 index 000000000..cdabed675 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-710.txt @@ -0,0 +1,66 @@ +23/Apr/2026 23:03:37 [NetworkInterface.cpp:2421] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +23/Apr/2026 23:03:37 [NetworkInterface.cpp:2426] WARNING: using: sudo ethtool -K custom gro off gso off tso off + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2828110087 +INFO: Loaded 1 modules (41552 inline 8-bit counters): 41552 [0xef1d70, 0xefbfc0), +INFO: Loaded 1 PC tables (41552 PCs): 41552 [0xc8a028,0xd2c528), +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-710 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61d000001c80 at pc 0x00000052530d bp 0x7ffd79b822f0 sp 0x7ffd79b81ab0 +READ of size 10 at 0x61d000001c80 thread T0 + #0 0x52530c in __interceptor_strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 + #1 0x6653d6 in Flow::dissectMDNS(unsigned char*, unsigned short) /src/ntopng/src/Flow.cpp:6071:17 + #2 0x76bdab in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2205:15 + #3 0x774fc5 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2820:26 + #4 0x5781e8 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:197:16 + #5 0x448f53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x4346b2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x439f5c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f878a9cd082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +DEDUP_TOKEN: __interceptor_strncpy--Flow::dissectMDNS(unsigned char*, unsigned short)--NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) +0x61d000001c80 is located 0 bytes to the right of 2048-byte region [0x61d000001480,0x61d000001c80) +allocated by thread T0 here: + #0 0x53a0e6 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x95a4b3 in pcap_check_header /src/libpcap-1.9.1/./sf-pcap.c:405:14 + +DEDUP_TOKEN: malloc--pcap_check_header +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 in __interceptor_strncpy +Shadow bytes around the buggy address: + 0x0c3a7fff8340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3a7fff8350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3a7fff8360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3a7fff8370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3a7fff8380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c3a7fff8390:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c3a7fff83a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c3a7fff83b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c3a7fff83c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c3a7fff83d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c3a7fff83e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-726.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-726.txt new file mode 100644 index 000000000..c0e0be37c --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-726.txt @@ -0,0 +1,63 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2829937076 +INFO: Loaded 1 modules (41552 inline 8-bit counters): 41552 [0xef1d70, 0xefbfc0), +INFO: Loaded 1 PC tables (41552 PCs): 41552 [0xc8a028,0xd2c528), +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-726 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000eabe80 at pc 0x0000006663ae bp 0x7ffc0a594fb0 sp 0x7ffc0a594fa8 +READ of size 1 at 0x606000eabe80 thread T0 + #0 0x6663ad in Flow::dissectNetBIOS(unsigned char*, unsigned short) /src/ntopng/src/Flow.cpp:6166:9 + #1 0x76bca1 in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2139:15 + #2 0x774fc5 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2820:26 + #3 0x5781e8 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:197:16 + #4 0x448f53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x4346b2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x439f5c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7fedc4545082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +DEDUP_TOKEN: Flow::dissectNetBIOS(unsigned char*, unsigned short)--NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**)--NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) +0x606000eabe80 is located 2 bytes to the right of 62-byte region [0x606000eabe40,0x606000eabe7e) +allocated by thread T0 here: + #0 0x53a0e6 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x95a4b3 in pcap_check_header /src/libpcap-1.9.1/./sf-pcap.c:405:14 + +DEDUP_TOKEN: malloc--pcap_check_header +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/Flow.cpp:6166:9 in Flow::dissectNetBIOS(unsigned char*, unsigned short) +Shadow bytes around the buggy address: + 0x0c0c801cd780: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00 + 0x0c0c801cd790: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c0c801cd7a0: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa + 0x0c0c801cd7b0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd + 0x0c0c801cd7c0: fd fd fd fa fa fa fa fa 00 00 00 00 00 00 00 06 +=>0x0c0c801cd7d0:[fa]fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa + 0x0c0c801cd7e0: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c801cd7f0: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c0c801cd800: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa + 0x0c0c801cd810: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa + 0x0c0c801cd820: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-741.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-741.txt new file mode 100644 index 000000000..7b1a75301 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-741.txt @@ -0,0 +1,67 @@ +23/Apr/2026 23:03:40 [NetworkInterface.cpp:2421] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +23/Apr/2026 23:03:40 [NetworkInterface.cpp:2426] WARNING: using: sudo ethtool -K custom gro off gso off tso off + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2831404545 +INFO: Loaded 1 modules (41552 inline 8-bit counters): 41552 [0xef1d70, 0xefbfc0), +INFO: Loaded 1 PC tables (41552 PCs): 41552 [0xc8a028,0xd2c528), +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-741 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60c0000021bf at pc 0x00000066195f bp 0x7ffded2bc950 sp 0x7ffded2bc948 +READ of size 1 at 0x60c0000021bf thread T0 + #0 0x66195e in setBittorrentHash /src/ntopng/src/Flow.cpp:5516:16 + #1 0x66195e in Flow::dissectBittorrent(char*, unsigned short) /src/ntopng/src/Flow.cpp:5534:19 + #2 0x76c102 in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2145:17 + #3 0x774fc5 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2820:26 + #4 0x5781e8 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:197:16 + #5 0x448f53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x4346b2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x439f5c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fdd3d0c7082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +DEDUP_TOKEN: setBittorrentHash--Flow::dissectBittorrent(char*, unsigned short)--NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) +0x60c0000021bf is located 0 bytes to the right of 127-byte region [0x60c000002140,0x60c0000021bf) +allocated by thread T0 here: + #0 0x53a4ec in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x95a6b1 in grow_buffer /src/libpcap-1.9.1/./sf-pcap.c:426:18 + #2 0x95a6b1 in pcap_next_packet /src/libpcap-1.9.1/./sf-pcap.c:604:9 + +DEDUP_TOKEN: __interceptor_realloc--grow_buffer--pcap_next_packet +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/Flow.cpp:5516:16 in setBittorrentHash +Shadow bytes around the buggy address: + 0x0c187fff83e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c187fff83f0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c187fff8400: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa + 0x0c187fff8410: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c187fff8420: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 +=>0x0c187fff8430: 00 00 00 00 00 00 00[07]fa fa fa fa fa fa fa fa + 0x0c187fff8440: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c187fff8450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c187fff8460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c187fff8470: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c187fff8480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-761.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-761.txt new file mode 100644 index 000000000..e75fcf890 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-761.txt @@ -0,0 +1,66 @@ +23/Apr/2026 23:03:44 [NetworkInterface.cpp:2421] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +23/Apr/2026 23:03:44 [NetworkInterface.cpp:2426] WARNING: using: sudo ethtool -K custom gro off gso off tso off + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2835010598 +INFO: Loaded 1 modules (41552 inline 8-bit counters): 41552 [0xef1d70, 0xefbfc0), +INFO: Loaded 1 PC tables (41552 PCs): 41552 [0xc8a028,0xd2c528), +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-761 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000eabee0 at pc 0x000000749a01 bp 0x7ffeff597540 sp 0x7ffeff597538 +READ of size 4 at 0x606000eabee0 thread T0 + #0 0x749a00 in ICMPinfo::dissectICMP(unsigned short, unsigned char const*) /src/ntopng/src/ICMPinfo.cpp:118:55 + #1 0x76a15e in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:1824:15 + #2 0x774015 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2973:28 + #3 0x5781e8 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:197:16 + #4 0x448f53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x4346b2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x439f5c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f9d2dd3f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +DEDUP_TOKEN: ICMPinfo::dissectICMP(unsigned short, unsigned char const*)--NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**)--NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) +0x606000eabee0 is located 0 bytes to the right of 64-byte region [0x606000eabea0,0x606000eabee0) +allocated by thread T0 here: + #0 0x53a4ec in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x95a6b1 in grow_buffer /src/libpcap-1.9.1/./sf-pcap.c:426:18 + #2 0x95a6b1 in pcap_next_packet /src/libpcap-1.9.1/./sf-pcap.c:604:9 + +DEDUP_TOKEN: __interceptor_realloc--grow_buffer--pcap_next_packet +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/ICMPinfo.cpp:118:55 in ICMPinfo::dissectICMP(unsigned short, unsigned char const*) +Shadow bytes around the buggy address: + 0x0c0c801cd780: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00 + 0x0c0c801cd790: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c0c801cd7a0: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa + 0x0c0c801cd7b0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd + 0x0c0c801cd7c0: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fd +=>0x0c0c801cd7d0: fa fa fa fa 00 00 00 00 00 00 00 00[fa]fa fa fa + 0x0c0c801cd7e0: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa + 0x0c0c801cd7f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c801cd800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c801cd810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c801cd820: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-976.txt b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-976.txt new file mode 100644 index 000000000..27c473b4b --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/OSV-2023-976.txt @@ -0,0 +1,66 @@ +23/Apr/2026 23:03:46 [NetworkInterface.cpp:2421] WARNING: If TSO/GRO is enabled, please disable it for best accuracy +23/Apr/2026 23:03:46 [NetworkInterface.cpp:2426] WARNING: using: sudo ethtool -K custom gro off gso off tso off + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2837075174 +INFO: Loaded 1 modules (41552 inline 8-bit counters): 41552 [0xef1d70, 0xefbfc0), +INFO: Loaded 1 PC tables (41552 PCs): 41552 [0xc8a028,0xd2c528), +/out/fuzz_dissect_packet: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2023-976 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000eabee0 at pc 0x0000006659b0 bp 0x7ffc9b1b2f70 sp 0x7ffc9b1b2f68 +READ of size 2 at 0x606000eabee0 thread T0 + #0 0x6659af in Flow::dissectMDNS(unsigned char*, unsigned short) /src/ntopng/src/Flow.cpp:6004:5 + #1 0x76bdab in NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2205:15 + #2 0x774fc5 in NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) /src/ntopng/src/NetworkInterface.cpp:2820:26 + #3 0x5781e8 in LLVMFuzzerTestOneInput /src/ntopng/fuzz/fuzz_dissect_packet.cpp:197:16 + #4 0x448f53 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x4346b2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x439f5c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x463492 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7ff66bc01082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x42a87d in _start (/out/fuzz_dissect_packet+0x42a87d) + +DEDUP_TOKEN: Flow::dissectMDNS(unsigned char*, unsigned short)--NetworkInterface::processPacket(unsigned int, bool, timeval const*, unsigned long, ndpi_ethhdr*, unsigned short, ndpi_iphdr*, ndpi_ipv6hdr*, unsigned short, unsigned short, unsigned int, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**)--NetworkInterface::dissectPacket(unsigned int, bool, unsigned char*, pcap_pkthdr const*, unsigned char const*, unsigned short*, Host**, Host**, Flow**) +0x606000eabee0 is located 0 bytes to the right of 64-byte region [0x606000eabea0,0x606000eabee0) +allocated by thread T0 here: + #0 0x53a4ec in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0x95a6b1 in grow_buffer /src/libpcap-1.9.1/./sf-pcap.c:426:18 + #2 0x95a6b1 in pcap_next_packet /src/libpcap-1.9.1/./sf-pcap.c:604:9 + +DEDUP_TOKEN: __interceptor_realloc--grow_buffer--pcap_next_packet +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/ntopng/src/Flow.cpp:6004:5 in Flow::dissectMDNS(unsigned char*, unsigned short) +Shadow bytes around the buggy address: + 0x0c0c801cd780: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00 + 0x0c0c801cd790: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c0c801cd7a0: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa + 0x0c0c801cd7b0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd + 0x0c0c801cd7c0: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fd +=>0x0c0c801cd7d0: fa fa fa fa 00 00 00 00 00 00 00 00[fa]fa fa fa + 0x0c0c801cd7e0: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 + 0x0c0c801cd7f0: 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c801cd800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c801cd810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c801cd820: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/collect_crash_builds.csv b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/collect_crash_builds.csv new file mode 100644 index 000000000..6105d5716 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/original-crashes/collect_crash_builds.csv @@ -0,0 +1,7 @@ +target,commit_id,oss_fuzz_commit,sanitizer +ntopng,b7b2810e617117c4420a5e1a4639515f2c45b26b,884106149890b2273341a44cc18e6a9311eaa5ad,address +ntopng,35b09487b9e38f11e5e01fc3cf9eb60b1b493f7c,f1d21d6f1beae39ca700b76e6143d829c2f89004,address +ntopng,4084c291321bc6d152f3926a465f5fb1679f849f,d98ab91d4709e92e6ea730185d9daf239cbb87d8,address +ntopng,bb028d7271dc3e2cfead4592ecbf0594a81ae710,b754d865dc5c53a3bb7efafd574de76c3854777c,address +ntopng,c907e4292692af8fc7a09c14c9093dce44f08dc1,39a27b6a0ff30f0bd27a599a35f53e950261bdeb,address +ntopng,f6296c76ea3c51ce2e602b3280c3df431a1820cd,645de0a46e48400a98919b814b43f67c27590cd8,address diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/patches/combined.diff b/benchmarks/ntopng_transplant_fuzz_dissect_packet/patches/combined.diff new file mode 100644 index 000000000..99cb67c70 --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/patches/combined.diff @@ -0,0 +1,43 @@ +diff --git a/fuzz/fuzz_dissect_packet.cpp b/fuzz/fuzz_dissect_packet.cpp +index 4abd4de77..176545dcc 100644 +--- a/fuzz/fuzz_dissect_packet.cpp ++++ b/fuzz/fuzz_dissect_packet.cpp +@@ -178,6 +178,10 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + memcpy((void *)__bug_dispatch, data, __BUG_DISPATCH_BYTES); + data += __BUG_DISPATCH_BYTES; + size -= __BUG_DISPATCH_BYTES; ++ if (__bug_dispatch[0] & (1 << 0)) { ++ /* retrigger for OSV-2023-688 (init-time bug) */ ++ if (iface && iface->getHostPools()) iface->getHostPools()->reloadPools(); ++ } + + if (size == 0) return -1; + +diff --git a/src/HostPools.cpp b/src/HostPools.cpp +index 9453c40cf..dc30c1b68 100644 +--- a/src/HostPools.cpp ++++ b/src/HostPools.cpp +@@ -20,6 +20,7 @@ + */ + + #include "ntop_includes.h" ++#include "__bug_dispatch.h" + + // #define HOST_POOLS_DEBUG 1 + +@@ -324,8 +325,13 @@ void HostPools::reloadPools() { + if (new_stats[0]) new_stats[0]->updateName(DEFAULT_POOL_NAME); + + /* Keys are pool ids */ +- if ((num_pools = redis->smembers(kname, &pools)) == -1) +- return; /* Something went wrong with redis? */ ++ if ((num_pools = redis->smembers(kname, &pools)) == -1) { ++ if (__bug_dispatch[0] & (1 << 0)) { ++ return delete new_stats; /* Something went wrong with redis? */ ++ } else { ++ return; /* Something went wrong with redis? */ ++ } ++ } + + for (int i = 0; i < num_pools; i++) { + if (!pools[i]) continue; diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/patches/harness.diff b/benchmarks/ntopng_transplant_fuzz_dissect_packet/patches/harness.diff new file mode 100644 index 000000000..2488b925c --- /dev/null +++ b/benchmarks/ntopng_transplant_fuzz_dissect_packet/patches/harness.diff @@ -0,0 +1,53 @@ +diff --git a/__bug_dispatch.c b/__bug_dispatch.c +new file mode 100644 +index 000000000..8b8ff0ce2 +--- /dev/null ++++ b/__bug_dispatch.c +@@ -0,0 +1,2 @@ ++#include "__bug_dispatch.h" ++volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES] = {0}; +diff --git a/__bug_dispatch.h b/__bug_dispatch.h +new file mode 100644 +index 000000000..6450a2593 +--- /dev/null ++++ b/__bug_dispatch.h +@@ -0,0 +1,6 @@ ++#ifndef __BUG_DISPATCH_H ++#define __BUG_DISPATCH_H ++#include ++#define __BUG_DISPATCH_BYTES 1 ++extern volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES]; ++#endif +diff --git a/fuzz/fuzz_dissect_packet.cpp b/fuzz/fuzz_dissect_packet.cpp +index 8b71db438..4abd4de77 100644 +--- a/fuzz/fuzz_dissect_packet.cpp ++++ b/fuzz/fuzz_dissect_packet.cpp +@@ -19,6 +19,9 @@ + * + */ + ++#include "__bug_dispatch.h" ++#include ++ + #ifdef FUZZ_WITH_PROTOBUF + #include + #include +@@ -170,10 +173,15 @@ DEFINE_PROTO_FUZZER(const ntopng_fuzz::Pcap &message) { + + #else + +-extern "C" int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len) { +- if (len == 0) return -1; ++extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ++ if (size < __BUG_DISPATCH_BYTES) return 0; ++ memcpy((void *)__bug_dispatch, data, __BUG_DISPATCH_BYTES); ++ data += __BUG_DISPATCH_BYTES; ++ size -= __BUG_DISPATCH_BYTES; ++ ++ if (size == 0) return -1; + +- FILE *fd = fmemopen((void *)buf, len, "r"); ++ FILE *fd = fmemopen((void *)data, size, "r"); + if (fd == NULL) { + std::cerr << "Cannot create the file descriptor with fmemopen" + << std::endl; diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-1160-patched b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-1160-patched new file mode 100644 index 000000000..412c8b89f Binary files /dev/null and b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-1160-patched differ diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-1214-patched b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-1214-patched new file mode 100644 index 000000000..d0e17e3ba Binary files /dev/null and b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-1214-patched differ diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-1352-patched b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-1352-patched new file mode 100644 index 000000000..520fd9273 Binary files /dev/null and b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-1352-patched differ diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-1360-patched b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-1360-patched new file mode 100644 index 000000000..598b4af9d Binary files /dev/null and b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-1360-patched differ diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-1375-patched b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-1375-patched new file mode 100644 index 000000000..9bf66c177 Binary files /dev/null and b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-1375-patched differ diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-1381-patched b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-1381-patched new file mode 100644 index 000000000..cd4896bd5 Binary files /dev/null and b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-1381-patched differ diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-423-patched b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-423-patched new file mode 100644 index 000000000..ee95f4853 Binary files /dev/null and b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-423-patched differ diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-425-patched b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-425-patched new file mode 100644 index 000000000..502328cac Binary files /dev/null and b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-425-patched differ diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-462-patched b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-462-patched new file mode 100644 index 000000000..d0908ba1b Binary files /dev/null and b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-462-patched differ diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-480-patched b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-480-patched new file mode 100644 index 000000000..3cc7b10b7 Binary files /dev/null and b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-480-patched differ diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-507-patched b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-507-patched new file mode 100644 index 000000000..192ef6b6c Binary files /dev/null and b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-507-patched differ diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-688-patched b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-688-patched new file mode 100644 index 000000000..7601565e8 Binary files /dev/null and b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-688-patched differ diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-697-patched b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-697-patched new file mode 100644 index 000000000..da4352e87 Binary files /dev/null and b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-697-patched differ diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-710-patched b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-710-patched new file mode 100644 index 000000000..652107a2a Binary files /dev/null and b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-710-patched differ diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-726-patched b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-726-patched new file mode 100644 index 000000000..165ebac1c Binary files /dev/null and b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-726-patched differ diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-741-patched b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-741-patched new file mode 100644 index 000000000..070bd84d5 Binary files /dev/null and b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-741-patched differ diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-761-patched b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-761-patched new file mode 100644 index 000000000..0258b24dc Binary files /dev/null and b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-761-patched differ diff --git a/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-976-patched b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-976-patched new file mode 100644 index 000000000..286b51137 Binary files /dev/null and b/benchmarks/ntopng_transplant_fuzz_dissect_packet/seeds/testcase-OSV-2023-976-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/Dockerfile b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/Dockerfile new file mode 100644 index 000000000..c170bb51b --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/Dockerfile @@ -0,0 +1,22 @@ +FROM gcr.io/oss-fuzz-base/base-builder@sha256:87ca1e9e19235e731fac8de8d1892ebe8d55caf18e7aa131346fc582a2034fdd + +# Dependencies for building OpenSC. +RUN apt-get update && apt-get install -y --no-install-recommends \ + autoconf automake libtool pkg-config \ + flex bison gettext \ + libssl-dev libreadline-dev \ + libpcsclite-dev zlib1g-dev \ + && rm -rf /var/lib/apt/lists/* + +# Full clone — build.sh checks out the target commit, so history is needed. +RUN git clone https://github.com/OpenSC/OpenSC.git /src/opensc + +WORKDIR /src/opensc + +# Keep ASan stack-use-after-return detection enabled for direct testcase replay. +ENV ASAN_OPTIONS="detect_leaks=0:detect_stack_use_after_return=1" + +# Bug transplant patches (re-applied by build.sh after checkout resets source). +COPY patches/ /src/patches/ +COPY seeds/ /src/benchmark_seeds/ +COPY build.sh $SRC/ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/benchmark.yaml b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/benchmark.yaml new file mode 100644 index 000000000..e3365f10a --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/benchmark.yaml @@ -0,0 +1,5 @@ +project: opensc +fuzz_target: fuzz_pkcs15_reader +commit: 6903aebfddc466d966c7b865fae34572bf3ed23e +commit_date: 2020-07-30T02:27:02+02:00 +type: bug diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/bug_metadata.json b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/bug_metadata.json new file mode 100644 index 000000000..a0a5f4fc6 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/bug_metadata.json @@ -0,0 +1,169 @@ +{ + "project": "opensc", + "target_commit": "6903aebfddc466d966c7b865fae34572bf3ed23e", + "dispatch_bytes": 1, + "total_bugs": 23, + "bugs": { + "OSV-2020-1046": { + "dispatch_value": 1, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/pkcs15-syn.c", + "crash_line": 439, + "crash_function": "sc_pkcs15emu_object_add" + }, + "OSV-2020-1981": { + "dispatch_value": 2, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/apdu.c", + "crash_line": 379, + "crash_function": "sc_single_transmit" + }, + "OSV-2020-55": { + "dispatch_value": 4, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/card-tcos.c", + "crash_line": 654, + "crash_function": "tcos_decipher" + }, + "OSV-2020-693": { + "dispatch_value": 8, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/card-setcos.c", + "crash_line": 792, + "crash_function": "parse_sec_attr_44" + }, + "OSV-2020-969": { + "dispatch_value": 16, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/card-openpgp.c", + "crash_line": 618, + "crash_function": "pgp_parse_algo_attr_blob" + }, + "OSV-2021-1017": { + "dispatch_value": 32, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/card-piv.c", + "crash_line": 2423, + "crash_function": "piv_compute_signature" + }, + "OSV-2021-915": { + "dispatch_value": 64, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/asn1.c", + "crash_line": 74, + "crash_function": "sc_asn1_read_tag" + }, + "OSV-2020-1720": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/pkcs15-itacns.c", + "crash_line": 382, + "crash_function": "hextoint" + }, + "OSV-2020-209": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/card-coolkey.c", + "crash_line": 930, + "crash_function": "coolkey_apdu_io" + }, + "OSV-2020-2254": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/pkcs15-tcos.c", + "crash_line": 235, + "crash_function": "insert_pin" + }, + "OSV-2020-885": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/card-coolkey.c", + "crash_line": 930, + "crash_function": "coolkey_apdu_io" + }, + "OSV-2020-1990": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/pkcs15-oberthur.c", + "crash_line": 503, + "crash_function": "sc_oberthur_parse_privateinfo" + }, + "OSV-2020-2222": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/pkcs15.c", + "crash_line": 736, + "crash_function": "sc_pkcs15_free_tokeninfo" + }, + "OSV-2020-1860": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/apdu.c", + "crash_line": 475, + "crash_function": "sc_get_response" + }, + "OSV-2021-538": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/pkcs15-oberthur.c", + "crash_line": 600, + "crash_function": "sc_pkcs15emu_oberthur_add_pubkey" + }, + "OSV-2020-1836": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/pkcs15-itacns.c", + "crash_line": 382, + "crash_function": "hextoint" + }, + "OSV-2020-1844": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/pkcs15-itacns.c", + "crash_line": 382, + "crash_function": "hextoint" + }, + "OSV-2021-537": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/pkcs15-oberthur.c", + "crash_line": 607, + "crash_function": "sc_pkcs15emu_oberthur_add_pubkey" + }, + "OSV-2021-262": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/pkcs15-oberthur.c", + "crash_line": 898, + "crash_function": "sc_pkcs15emu_oberthur_add_data" + }, + "OSV-2021-474": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/pkcs15-oberthur.c", + "crash_line": 670, + "crash_function": "sc_pkcs15emu_oberthur_add_cert" + }, + "OSV-2020-2157": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/pkcs15-tcos.c", + "crash_line": 142, + "crash_function": "insert_key" + }, + "OSV-2020-1848": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/pkcs15-oberthur.c", + "crash_line": 458, + "crash_function": "sc_oberthur_parse_publicinfo" + }, + "OSV-2020-2178": { + "dispatch_value": 0, + "triggered": true, + "crash_file": "/src/opensc/src/libopensc/pkcs15-tcos.c", + "crash_line": 150, + "crash_function": "insert_key" + } + } +} diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/build.sh b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/build.sh new file mode 100755 index 000000000..a6c8f2cf7 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/build.sh @@ -0,0 +1,169 @@ +#!/bin/bash -eu +# Generated by fuzzbench_generate.py for bug transplant evaluation + +cd /src/opensc + +# Checkout target commit +git checkout 6903aebfddc466d966c7b865fae34572bf3ed23e + +# Apply dispatch harness first (modifies build system), then bug patches +if ! git apply --check /src/patches/harness.diff 2>/dev/null; then + echo "Trying git apply --3way for harness.diff..." + git apply --3way /src/patches/harness.diff +else + git apply /src/patches/harness.diff +fi + +if ! git apply --check /src/patches/combined.diff 2>/dev/null; then + echo "Trying git apply --3way for combined.diff..." + git apply --3way /src/patches/combined.diff +else + git apply /src/patches/combined.diff +fi + +# --- Fix library CMakeLists.txt for new source files from combined.diff --- +# combined.diff may create new .c files (e.g., zfp_getcell.c) that need to +# be added to the library's explicit source list. +if [ -d blosc ] && [ -f blosc/CMakeLists.txt ]; then + for newfile in blosc/*.c; do + base=$(basename "$newfile") + if ! grep -q "$base" blosc/CMakeLists.txt 2>/dev/null; then + echo "Adding $base to blosc/CMakeLists.txt" + sed -i "/^set(SOURCES /s/)/ $base)/" blosc/CMakeLists.txt + fi + done +fi + +# --- Original build commands --- +# Clean stale build artifacts from the merge container (if any). +# Without this, make reuses .o/.a files compiled with a different compiler +# and libopensc.a may include notify.o with glib deps that break linking. +make distclean 2>/dev/null || true + +./bootstrap + +# FuzzBench injects a prebuilt engine archive that needs a C++ link step. +./configure --disable-strict --disable-optimization --disable-shared --disable-pcsc --enable-ctapi --enable-fuzzing FUZZING_LIBS="-lstdc++" CC="$CC" CXX="$CXX" --disable-notify + +# Autotools/libtool can generate libopensc __bug_dispatch dep includes without +# creating the corresponding top-level .deps entries. Mirror the merge helper's +# workaround with explicit stub files for this project layout. +mkdir -p .deps +touch .deps/libopensc_la-__bug_dispatch.Plo .deps/libopensc_la-__bug_dispatch.Tpo .deps/libopensc_static_la-__bug_dispatch.Plo .deps/libopensc_static_la-__bug_dispatch.Tpo + +set +e +make -j$(nproc) CCLD="$CXX" +make_status=$? +if [ $make_status -ne 0 ]; then + make -j1 CCLD="$CXX" +fi +set -e + +FUZZ_LIB="${LIB_FUZZING_ENGINE:-}" +if [ ! -f "$FUZZ_LIB" ]; then + for candidate in /usr/lib/libFuzzer.a /usr/lib/libFuzzingEngine.a; do + if [ -f "$candidate" ]; then + FUZZ_LIB="$candidate" + break + fi + done +fi +if [ ! -f "$FUZZ_LIB" ]; then + echo "Missing fuzzing engine archive: $LIB_FUZZING_ENGINE" >&2 + exit 1 +fi + +target_src="src/tests/fuzzing/fuzz_pkcs15_reader.c" +target_obj="src/tests/fuzzing/fuzz_pkcs15_reader.o" +target_bin="src/tests/fuzzing/fuzz_pkcs15_reader" + +if [ -x "$target_bin" ]; then + cp "$target_bin" "$OUT/fuzz_pkcs15_reader" +else + if [ ! -f "$target_obj" ]; then + $CC $CFLAGS -I. -Isrc -Isrc/libopensc -Isrc/common \ + -c "$target_src" -o "$target_obj" + fi + + $CXX $CXXFLAGS -o "$OUT/fuzz_pkcs15_reader" \ + "$target_obj" \ + src/libopensc/.libs/libopensc.a \ + src/common/.libs/libscdl.a \ + src/common/.libs/libcompat.a \ + "$FUZZ_LIB" \ + -lcrypto -lz -ldl -lpthread -lstdc++ +fi + +if [ -d "src/tests/fuzzing/corpus/fuzz_pkcs15_reader" ]; then + zip -j "$OUT/fuzz_pkcs15_reader_seed_corpus.zip" \ + src/tests/fuzzing/corpus/fuzz_pkcs15_reader/* +fi + + +# --- Seed corpus: expand original seeds and per-bug testcase candidates --- +# FuzzBench uses $OUT/{fuzz_target}_seed_corpus.zip as initial corpus. +# Create one seed variant for the default path plus one for each +# dispatch-controlled transplanted path. Per-bug reproducers are used only as +# source material: exact crashing inputs are filtered out before packaging. +seed_zip="$OUT/fuzz_pkcs15_reader_seed_corpus.zip" +seed_target="$OUT/fuzz_pkcs15_reader" +mkdir -p /tmp/seeds_dispatch /tmp/original_seeds /tmp/benchmark_seed_candidates + +if [ -f "$seed_zip" ]; then + unzip -q -o "$seed_zip" -d /tmp/original_seeds 2>/dev/null || true + for f in /tmp/original_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + for dispatch in 00 01 02 04 08 10 20 40; do + printf '%b' "\\x${dispatch}" | cat - "$f" > "/tmp/seeds_dispatch/${base}.dispatch_${dispatch}" + done + done +fi + +if [ -d /src/benchmark_seeds ]; then + for f in /src/benchmark_seeds/*; do + [ -f "$f" ] || continue + base=$(basename "$f") + size=$(wc -c < "$f") + [ "$size" -gt 0 ] || continue + + cp "$f" "/tmp/benchmark_seed_candidates/${base}.exact" + # Zero the dispatch byte (byte 0): deactivates dispatch-gated patches + # while keeping the full APDU conversation and card driver routing intact. + cp "$f" "/tmp/benchmark_seed_candidates/${base}.dispatch_zero" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.dispatch_zero" bs=1 seek=0 conv=notrunc 2>/dev/null || true + for keep in 1 2 8 16 64 256 1024; do + if [ "$size" -gt "$keep" ]; then + head -c "$keep" "$f" > "/tmp/benchmark_seed_candidates/${base}.head_${keep}" + fi + done + if [ "$size" -gt 1 ]; then + head -c "$((size - 1))" "$f" > "/tmp/benchmark_seed_candidates/${base}.trim_1" + cp "$f" "/tmp/benchmark_seed_candidates/${base}.zero_last" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.zero_last" bs=1 seek="$((size - 1))" conv=notrunc 2>/dev/null || true + cp "$f" "/tmp/benchmark_seed_candidates/${base}.ff_last" + printf '\377' | dd of="/tmp/benchmark_seed_candidates/${base}.ff_last" bs=1 seek="$((size - 1))" conv=notrunc 2>/dev/null || true + fi + if [ "$size" -gt 4 ]; then + mid=$((size / 2)) + cp "$f" "/tmp/benchmark_seed_candidates/${base}.zero_mid" + printf '\000' | dd of="/tmp/benchmark_seed_candidates/${base}.zero_mid" bs=1 seek="$mid" conv=notrunc 2>/dev/null || true + cp "$f" "/tmp/benchmark_seed_candidates/${base}.ff_mid" + printf '\377' | dd of="/tmp/benchmark_seed_candidates/${base}.ff_mid" bs=1 seek="$mid" conv=notrunc 2>/dev/null || true + fi + done +fi + +if [ -x "$seed_target" ] && ls /tmp/benchmark_seed_candidates/* 1>/dev/null 2>&1; then + for f in /tmp/benchmark_seed_candidates/*; do + [ -f "$f" ] || continue + if timeout 10s env ASAN_OPTIONS="${ASAN_OPTIONS:-detect_leaks=0:detect_stack_use_after_return=1}" "$seed_target" "$f" >/tmp/seed_replay.log 2>&1; then + cp "$f" "/tmp/seeds_dispatch/poc_$(basename "$f")" + fi + done +fi + +if ls /tmp/seeds_dispatch/* 1>/dev/null 2>&1; then + rm -f "$seed_zip" + zip -j -q "$seed_zip" /tmp/seeds_dispatch/* +fi diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1046.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1046.txt new file mode 100644 index 000000000..fe9afc6db --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1046.txt @@ -0,0 +1,78 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2199243826 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f83e8d26078 at pc 0x000000530bc1 bp 0x7fffa68af690 sp 0x7fffa68aee60 +READ of size 496 at 0x7f83e8d26078 thread T0 + #0 0x530bc0 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x6118c2 in sc_pkcs15emu_object_add /src/opensc/src/libopensc/pkcs15-syn.c:439:2 + #2 0xa29364 in sc_pkcs15emu_coolkey_init /src/opensc/src/libopensc/pkcs15-coolkey.c:679:7 + #3 0xa26293 in sc_pkcs15emu_coolkey_init_ex /src/opensc/src/libopensc/pkcs15-coolkey.c:734:7 + #4 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #5 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #6 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #7 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f83eaea5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +Address 0x7f83e8d26078 is located in stack of thread T0 at offset 8312 in frame + #0 0xa2662f in sc_pkcs15emu_coolkey_init /src/opensc/src/libopensc/pkcs15-coolkey.c:463 + + This frame has 13 object(s): + [32, 88) 'serial' (line 483) + [128, 132) 'count' (line 484) + [144, 776) 'pin_info' (line 509) + [912, 3688) 'pin_obj' (line 510) + [3824, 3912) 'coolkey_obj' (line 544) + [3952, 6728) 'obj_obj' (line 545) + [6864, 7216) 'cert_info' (line 546) + [7280, 7776) 'pubkey_info' (line 547) + [7840, 8312) 'prkey_info' (line 548) + [8384, 8392) 'key_type' (line 552) <== Memory access at offset 8312 partially underflows this variable + [8416, 8424) 'obj_class' (line 553) <== Memory access at offset 8312 partially underflows this variable + [8448, 8456) 'len' (line 554) <== Memory access at offset 8312 partially underflows this variable + [8480, 8488) 'cert_object' (line 692) <== Memory access at offset 8312 partially underflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0ff0fd19cbb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff0fd19cbc0: 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 + 0x0ff0fd19cbd0: f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff0fd19cbe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff0fd19cbf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0ff0fd19cc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00[f2] + 0x0ff0fd19cc10: f2 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 00 f2 f2 f2 + 0x0ff0fd19cc20: 00 f2 f2 f2 f8 f3 f3 f3 00 00 00 00 00 00 00 00 + 0x0ff0fd19cc30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff0fd19cc40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff0fd19cc50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1720.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1720.txt new file mode 100644 index 000000000..ec589c9e8 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1720.txt @@ -0,0 +1,78 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2199484282 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000651 at pc 0x00000051ca5d bp 0x7ffde4400ad0 sp 0x7ffde4400290 +READ of size 2 at 0x602000000651 thread T0 + #0 0x51ca5c in __interceptor_strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 + #1 0xa0edf9 in hextoint /src/opensc/src/libopensc/pkcs15-itacns.c:382:2 + #2 0xa0e58c in get_name_from_EF_DatiPersonali /src/opensc/src/libopensc/pkcs15-itacns.c:401:18 + #3 0xa0caa2 in itacns_add_data_files /src/opensc/src/libopensc/pkcs15-itacns.c:549:6 + #4 0xa0ae83 in itacns_init /src/opensc/src/libopensc/pkcs15-itacns.c:813:6 + #5 0xa0a020 in sc_pkcs15emu_itacns_init_ex /src/opensc/src/libopensc/pkcs15-itacns.c:870:9 + #6 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #9 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f5f03de8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #14 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +0x602000000651 is located 0 bytes to the right of 1-byte region [0x602000000650,0x602000000651) +allocated by thread T0 here: + #0 0x531836 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xa7a330 in sc_der_copy /src/opensc/src/libopensc/asn1.c:2055:16 + #2 0x5c9530 in sc_pkcs15_read_data_object /src/opensc/src/libopensc/pkcs15-data.c:60:2 + #3 0xa0c94c in itacns_add_data_files /src/opensc/src/libopensc/pkcs15-itacns.c:539:7 + #4 0xa0ae83 in itacns_init /src/opensc/src/libopensc/pkcs15-itacns.c:813:6 + #5 0xa0a020 in sc_pkcs15emu_itacns_init_ex /src/opensc/src/libopensc/pkcs15-itacns.c:870:9 + #6 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #9 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f5f03de8082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 in __interceptor_strncpy +Shadow bytes around the buggy address: + 0x0c047fff8070: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff8080: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff8090: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa + 0x0c047fff80a0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff80b0: fa fa fd fa fa fa fd fd fa fa 00 00 fa fa 05 fa +=>0x0c047fff80c0: fa fa 00 01 fa fa 01 fa fa fa[01]fa fa fa 00 00 + 0x0c047fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1836.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1836.txt new file mode 100644 index 000000000..ba9747df2 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1836.txt @@ -0,0 +1,78 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2199721150 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000676 at pc 0x00000051ca5d bp 0x7ffcb0835670 sp 0x7ffcb0834e30 +READ of size 7 at 0x602000000676 thread T0 + #0 0x51ca5c in __interceptor_strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 + #1 0xa0edf9 in hextoint /src/opensc/src/libopensc/pkcs15-itacns.c:382:2 + #2 0xa0e58c in get_name_from_EF_DatiPersonali /src/opensc/src/libopensc/pkcs15-itacns.c:401:18 + #3 0xa0caa2 in itacns_add_data_files /src/opensc/src/libopensc/pkcs15-itacns.c:549:6 + #4 0xa0ae83 in itacns_init /src/opensc/src/libopensc/pkcs15-itacns.c:813:6 + #5 0xa0a020 in sc_pkcs15emu_itacns_init_ex /src/opensc/src/libopensc/pkcs15-itacns.c:870:9 + #6 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #9 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f572c62a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #14 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +0x602000000676 is located 0 bytes to the right of 6-byte region [0x602000000670,0x602000000676) +allocated by thread T0 here: + #0 0x531836 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xa7a330 in sc_der_copy /src/opensc/src/libopensc/asn1.c:2055:16 + #2 0x5c9530 in sc_pkcs15_read_data_object /src/opensc/src/libopensc/pkcs15-data.c:60:2 + #3 0xa0c94c in itacns_add_data_files /src/opensc/src/libopensc/pkcs15-itacns.c:539:7 + #4 0xa0ae83 in itacns_init /src/opensc/src/libopensc/pkcs15-itacns.c:813:6 + #5 0xa0a020 in sc_pkcs15emu_itacns_init_ex /src/opensc/src/libopensc/pkcs15-itacns.c:870:9 + #6 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #9 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f572c62a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 in __interceptor_strncpy +Shadow bytes around the buggy address: + 0x0c047fff8070: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff8080: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff8090: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa + 0x0c047fff80a0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff80b0: fa fa fd fa fa fa fd fd fa fa 00 00 fa fa 05 fa +=>0x0c047fff80c0: fa fa 00 01 fa fa 01 fa fa fa 06 fa fa fa[06]fa + 0x0c047fff80d0: fa fa 00 00 fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1844.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1844.txt new file mode 100644 index 000000000..acdc9f506 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1844.txt @@ -0,0 +1,78 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2199962455 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000676 at pc 0x00000051ca5d bp 0x7ffe8e247f10 sp 0x7ffe8e2476d0 +READ of size 7 at 0x602000000676 thread T0 + #0 0x51ca5c in __interceptor_strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 + #1 0xa0edf9 in hextoint /src/opensc/src/libopensc/pkcs15-itacns.c:382:2 + #2 0xa0e58c in get_name_from_EF_DatiPersonali /src/opensc/src/libopensc/pkcs15-itacns.c:401:18 + #3 0xa0caa2 in itacns_add_data_files /src/opensc/src/libopensc/pkcs15-itacns.c:549:6 + #4 0xa0ae83 in itacns_init /src/opensc/src/libopensc/pkcs15-itacns.c:813:6 + #5 0xa0a020 in sc_pkcs15emu_itacns_init_ex /src/opensc/src/libopensc/pkcs15-itacns.c:870:9 + #6 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #9 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fb9edba7082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #14 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +0x602000000676 is located 0 bytes to the right of 6-byte region [0x602000000670,0x602000000676) +allocated by thread T0 here: + #0 0x531836 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0xa7a330 in sc_der_copy /src/opensc/src/libopensc/asn1.c:2055:16 + #2 0x5c9530 in sc_pkcs15_read_data_object /src/opensc/src/libopensc/pkcs15-data.c:60:2 + #3 0xa0c94c in itacns_add_data_files /src/opensc/src/libopensc/pkcs15-itacns.c:539:7 + #4 0xa0ae83 in itacns_init /src/opensc/src/libopensc/pkcs15-itacns.c:813:6 + #5 0xa0a020 in sc_pkcs15emu_itacns_init_ex /src/opensc/src/libopensc/pkcs15-itacns.c:870:9 + #6 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #9 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fb9edba7082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:470:5 in __interceptor_strncpy +Shadow bytes around the buggy address: + 0x0c047fff8070: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff8080: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff8090: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa + 0x0c047fff80a0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff80b0: fa fa fd fa fa fa fd fd fa fa 00 00 fa fa 05 fa +=>0x0c047fff80c0: fa fa 00 01 fa fa 01 fa fa fa 06 fa fa fa[06]fa + 0x0c047fff80d0: fa fa 00 00 fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1848.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1848.txt new file mode 100644 index 000000000..1045ec821 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1848.txt @@ -0,0 +1,73 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2200212771 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000000119 at pc 0x000000a05cc9 bp 0x7ffca115e5d0 sp 0x7ffca115e5c8 +READ of size 1 at 0x606000000119 thread T0 + #0 0xa05cc8 in sc_oberthur_parse_publicinfo /src/opensc/src/libopensc/pkcs15-oberthur.c:458:38 + #1 0x9fab93 in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1040:8 + #2 0x9f820f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #3 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #4 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #5 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #6 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fbb45a38082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +0x606000000119 is located 0 bytes to the right of 57-byte region [0x6060000000e0,0x606000000119) +allocated by thread T0 here: + #0 0x531a0e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x9fc811 in sc_oberthur_read_file /src/opensc/src/libopensc/pkcs15-oberthur.c:264:9 + #2 0x9fa7df in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1033:8 + #3 0x9f820f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #4 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #5 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #6 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #7 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fbb45a38082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/opensc/src/libopensc/pkcs15-oberthur.c:458:38 in sc_oberthur_parse_publicinfo +Shadow bytes around the buggy address: + 0x0c0c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c0c7fff8010: 00 00 00 00 00 00 00 02 fa fa fa fa 00 00 00 00 +=>0x0c0c7fff8020: 00 00 00[01]fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1860.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1860.txt new file mode 100644 index 000000000..07c7cca1b --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1860.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2200451731 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffef46d36e2 at pc 0x000000530c7c bp 0x7ffef46c2a50 sp 0x7ffef46c2220 +WRITE of size 28 at 0x7ffef46d36e2 thread T0 + #0 0x530c7b in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0xab4713 in sc_get_response /src/opensc/src/libopensc/apdu.c:475:3 + #2 0xab089b in sc_transmit /src/opensc/src/libopensc/apdu.c:532:7 + #3 0xaafc23 in sc_transmit_apdu /src/opensc/src/libopensc/apdu.c:624:7 + #4 0xa90764 in iso7816_read_binary /src/opensc/src/libopensc/iso7816.c:156:6 + #5 0x9b24fb in idprime_read_binary /src/opensc/src/libopensc/card-idprime.c:557:8 + #6 0x588935 in sc_read_binary /src/opensc/src/libopensc/card.c:652:7 + #7 0x5a84b2 in sc_pkcs15_bind_internal /src/opensc/src/libopensc/pkcs15.c:1130:9 + #8 0x5acdb8 in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1265:8 + #9 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #10 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #11 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #12 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #13 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7f7004567082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #15 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +Address 0x7ffef46d36e2 is located in stack of thread T0 at offset 65570 in frame + #0 0x9b1abf in idprime_read_binary /src/opensc/src/libopensc/card-idprime.c:528 + + This frame has 1 object(s): + [32, 65570) 'buffer' (line 540) <== Memory access at offset 65570 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x10005e8d2680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10005e8d2690: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10005e8d26a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10005e8d26b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10005e8d26c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x10005e8d26d0: 00 00 00 00 00 00 00 00 00 00 00 00[02]f3 f3 f3 + 0x10005e8d26e0: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x10005e8d26f0: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x10005e8d2700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10005e8d2710: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10005e8d2720: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1981.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1981.txt new file mode 100644 index 000000000..af7641a56 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1981.txt @@ -0,0 +1,70 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2200718796 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffe59386462 at pc 0x000000530c7c bp 0x7ffe593756f0 sp 0x7ffe59374ec0 +WRITE of size 43246 at 0x7ffe59386462 thread T0 + #0 0x530c7b in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x56ffdf in fuzz_reader_transmit /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:141:13 + #2 0xab308e in sc_single_transmit /src/opensc/src/libopensc/apdu.c:379:7 + #3 0xab041e in sc_transmit /src/opensc/src/libopensc/apdu.c:515:6 + #4 0xaafc23 in sc_transmit_apdu /src/opensc/src/libopensc/apdu.c:624:7 + #5 0xa90764 in iso7816_read_binary /src/opensc/src/libopensc/iso7816.c:156:6 + #6 0x9b21d1 in idprime_read_binary /src/opensc/src/libopensc/card-idprime.c:549:9 + #7 0x588935 in sc_read_binary /src/opensc/src/libopensc/card.c:652:7 + #8 0x5a76d3 in sc_pkcs15_bind_internal /src/opensc/src/libopensc/pkcs15.c:1056:9 + #9 0x5acdb8 in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1265:8 + #10 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #11 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #12 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #13 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #14 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7fa87df55082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #16 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +Address 0x7ffe59386462 is located in stack of thread T0 at offset 65570 in frame + #0 0x9b1abf in idprime_read_binary /src/opensc/src/libopensc/card-idprime.c:528 + + This frame has 1 object(s): + [32, 65570) 'buffer' (line 540) <== Memory access at offset 65570 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x10004b268c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10004b268c40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10004b268c50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10004b268c60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10004b268c70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x10004b268c80: 00 00 00 00 00 00 00 00 00 00 00 00[02]f3 f3 f3 + 0x10004b268c90: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x10004b268ca0: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x10004b268cb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10004b268cc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10004b268cd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1990.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1990.txt new file mode 100644 index 000000000..c4717854e --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-1990.txt @@ -0,0 +1,73 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2200966824 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000000239 at pc 0x0000009fe12f bp 0x7fff7431fe70 sp 0x7fff7431fe68 +READ of size 1 at 0x606000000239 thread T0 + #0 0x9fe12e in sc_oberthur_parse_privateinfo /src/opensc/src/libopensc/pkcs15-oberthur.c:503:38 + #1 0x9fab93 in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1040:8 + #2 0x9f820f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #3 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #4 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #5 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #6 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f0b111e4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +0x606000000239 is located 0 bytes to the right of 57-byte region [0x606000000200,0x606000000239) +allocated by thread T0 here: + #0 0x531a0e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x9fc811 in sc_oberthur_read_file /src/opensc/src/libopensc/pkcs15-oberthur.c:264:9 + #2 0x9fa7df in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1033:8 + #3 0x9f820f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #4 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #5 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #6 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #7 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f0b111e4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/opensc/src/libopensc/pkcs15-oberthur.c:503:38 in sc_oberthur_parse_privateinfo +Shadow bytes around the buggy address: + 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c0c7fff8010: 00 00 00 00 00 00 00 02 fa fa fa fa 00 00 00 00 + 0x0c0c7fff8020: 00 00 00 01 fa fa fa fa 00 00 00 00 00 00 00 01 + 0x0c0c7fff8030: fa fa fa fa 00 00 00 00 00 00 00 01 fa fa fa fa +=>0x0c0c7fff8040: 00 00 00 00 00 00 00[01]fa fa fa fa fa fa fa fa + 0x0c0c7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-209.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-209.txt new file mode 100644 index 000000000..0b57ac4be --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-209.txt @@ -0,0 +1,71 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2201226306 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7f50f7d01670 at pc 0x000000784d16 bp 0x7fff4fb52eb0 sp 0x7fff4fb52ea8 +READ of size 8 at 0x7f50f7d01670 thread T0 + #0 0x784d15 in coolkey_apdu_io /src/opensc/src/libopensc/card-coolkey.c:930:17 + #1 0x791524 in coolkey_rsa_op /src/opensc/src/libopensc/card-coolkey.c:1747:6 + #2 0x78ae6f in coolkey_compute_crypt /src/opensc/src/libopensc/card-coolkey.c:1859:7 + #3 0xa88d66 in sc_decipher /src/opensc/src/libopensc/sec.c:46:6 + #4 0x5fc8ed in use_key /src/opensc/src/libopensc/pkcs15-sec.c:155:8 + #5 0x5fa0d0 in sc_pkcs15_decipher /src/opensc/src/libopensc/pkcs15-sec.c:284:6 + #6 0x57132d in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:232:17 + #7 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f50fa395082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +Address 0x7f50f7d01670 is located in stack of thread T0 at offset 624 in frame + #0 0x790aff in coolkey_rsa_op /src/opensc/src/libopensc/card-coolkey.c:1680 + + This frame has 6 object(s): + [32, 40) 'crypt_out_len_p' (line 1683) + [64, 269) 'params' (line 1685) + [336, 538) 'buf' (line 1688) + [608, 610) 'len_buf' (line 1707) + [624, 632) 'buf_out' (line 1731) <== Memory access at offset 624 is inside this variable + [656, 658) 'len_buf50' (line 1755) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-use-after-scope /src/opensc/src/libopensc/card-coolkey.c:930:17 in coolkey_apdu_io +Shadow bytes around the buggy address: + 0x0fea9ef98270: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fea9ef98280: f1 f1 f1 f1 00 f2 f2 f2 00 00 00 00 00 00 00 00 + 0x0fea9ef98290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fea9ef982a0: 00 05 f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 + 0x0fea9ef982b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fea9ef982c0: 00 00 00 02 f2 f2 f2 f2 f2 f2 f2 f2 f8 f2[f8]f2 + 0x0fea9ef982d0: f2 f2 f8 f3 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fea9ef982e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fea9ef982f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fea9ef98300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fea9ef98310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-2157.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-2157.txt new file mode 100644 index 000000000..6f9a36d14 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-2157.txt @@ -0,0 +1,68 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2201473247 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f0f0070dec0 at pc 0x0000009ca14d bp 0x7ffd6c897d30 sp 0x7ffd6c897d28 +READ of size 1 at 0x7f0f0070dec0 thread T0 + #0 0x9ca14c in insert_key /src/opensc/src/libopensc/pkcs15-tcos.c:142:8 + #1 0x9c68a0 in detect_netkey /src/opensc/src/libopensc/pkcs15-tcos.c:308:2 + #2 0x9c5c5b in sc_pkcs15emu_tcos_init_ex /src/opensc/src/libopensc/pkcs15-tcos.c:520:6 + #3 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #4 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #5 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #6 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f0f02af5082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +Address 0x7f0f0070dec0 is located in stack of thread T0 at offset 3776 in frame + #0 0x9c95cf in insert_key /src/opensc/src/libopensc/pkcs15-tcos.c:102 + + This frame has 4 object(s): + [32, 40) 'f' (line 105) + [64, 536) 'prkey_info' (line 106) + [608, 3384) 'prkey_obj' (line 107) + [3520, 3776) 'buf' (line 126) <== Memory access at offset 3776 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/opensc/src/libopensc/pkcs15-tcos.c:142:8 in insert_key +Shadow bytes around the buggy address: + 0x0fe2600d9b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe2600d9b90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe2600d9ba0: 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 f2 f2 f2 f2 + 0x0fe2600d9bb0: f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 + 0x0fe2600d9bc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fe2600d9bd0: 00 00 00 00 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 f3 + 0x0fe2600d9be0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe2600d9bf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe2600d9c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe2600d9c10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe2600d9c20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-2178.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-2178.txt new file mode 100644 index 000000000..3cf1a40f3 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-2178.txt @@ -0,0 +1,68 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2201709047 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fbd3090eec0 at pc 0x0000009ca6ef bp 0x7ffd3863aa10 sp 0x7ffd3863aa08 +READ of size 1 at 0x7fbd3090eec0 thread T0 + #0 0x9ca6ee in insert_key /src/opensc/src/libopensc/pkcs15-tcos.c:150:20 + #1 0x9c68ff in detect_netkey /src/opensc/src/libopensc/pkcs15-tcos.c:309:2 + #2 0x9c5c5b in sc_pkcs15emu_tcos_init_ex /src/opensc/src/libopensc/pkcs15-tcos.c:520:6 + #3 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #4 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #5 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #6 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fbd32d1a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +Address 0x7fbd3090eec0 is located in stack of thread T0 at offset 3776 in frame + #0 0x9c95cf in insert_key /src/opensc/src/libopensc/pkcs15-tcos.c:102 + + This frame has 4 object(s): + [32, 40) 'f' (line 105) + [64, 536) 'prkey_info' (line 106) + [608, 3384) 'prkey_obj' (line 107) + [3520, 3776) 'buf' (line 126) <== Memory access at offset 3776 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/opensc/src/libopensc/pkcs15-tcos.c:150:20 in insert_key +Shadow bytes around the buggy address: + 0x0ff826119d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff826119d90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff826119da0: 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 f2 f2 f2 f2 + 0x0ff826119db0: f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 + 0x0ff826119dc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0ff826119dd0: 00 00 00 00 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 f3 + 0x0ff826119de0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff826119df0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff826119e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff826119e10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff826119e20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-2222.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-2222.txt new file mode 100644 index 000000000..6020eadf7 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-2222.txt @@ -0,0 +1,57 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2201947575 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: attempting double-free on 0x6030000002e0 in thread T0: + #0 0x531592 in __interceptor_free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x5a3a50 in sc_pkcs15_free_tokeninfo /src/opensc/src/libopensc/pkcs15.c:736:2 + #2 0x5a42d2 in sc_pkcs15_card_free /src/opensc/src/libopensc/pkcs15.c:790:2 + #3 0x57280d in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:297:9 + #4 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #5 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #6 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #7 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f6fc20c1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #9 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +0x6030000002e0 is located 0 bytes inside of 32-byte region [0x6030000002e0,0x603000000300) +freed by thread T0 here: + #0 0x531592 in __interceptor_free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 + #1 0x9bb4e6 in idprime_get_token_name /src/opensc/src/libopensc/card-idprime.c:452:3 + #2 0x9b41f2 in idprime_card_ctl /src/opensc/src/libopensc/card-idprime.c:476:11 + #3 0x590362 in sc_card_ctl /src/opensc/src/libopensc/card.c:1058:7 + #4 0xa31711 in sc_pkcs15emu_idprime_init /src/opensc/src/libopensc/pkcs15-idprime.c:112:6 + #5 0xa305e6 in sc_pkcs15emu_idprime_init_ex /src/opensc/src/libopensc/pkcs15-idprime.c:285:9 + #6 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #9 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f6fc20c1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +previously allocated by thread T0 here: + #0 0x531836 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3 + #1 0x9bb11c in idprime_get_token_name /src/opensc/src/libopensc/card-idprime.c:445:11 + #2 0x9b41f2 in idprime_card_ctl /src/opensc/src/libopensc/card-idprime.c:476:11 + #3 0x590362 in sc_card_ctl /src/opensc/src/libopensc/card.c:1058:7 + #4 0xa31711 in sc_pkcs15emu_idprime_init /src/opensc/src/libopensc/pkcs15-idprime.c:112:6 + #5 0xa305e6 in sc_pkcs15emu_idprime_init_ex /src/opensc/src/libopensc/pkcs15-idprime.c:285:9 + #6 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #9 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f6fc20c1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: double-free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 in __interceptor_free +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-2254.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-2254.txt new file mode 100644 index 000000000..2c8abe62f --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-2254.txt @@ -0,0 +1,68 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2204946612 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 100 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-use-after-return on address 0x7f0a1350e005 at pc 0x0000009cc0ce bp 0x7ffc197c3870 sp 0x7ffc197c3868 +READ of size 1 at 0x7f0a1350e005 thread T0 + #0 0x9cc0cd in insert_pin /src/opensc/src/libopensc/pkcs15-tcos.c:235:26 + #1 0x9c7853 in detect_idkey /src/opensc/src/libopensc/pkcs15-tcos.c:402:2 + #2 0x9c5ca8 in sc_pkcs15emu_tcos_init_ex /src/opensc/src/libopensc/pkcs15-tcos.c:521:6 + #3 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #4 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #5 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #6 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f0a15870082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +Address 0x7f0a1350e005 is located in stack of thread T0 at offset 5 in frame + #0 0x9c95cf in insert_key /src/opensc/src/libopensc/pkcs15-tcos.c:102 + + This frame has 4 object(s): + [32, 40) 'f' (line 105) + [64, 536) 'prkey_info' (line 106) + [608, 3384) 'prkey_obj' (line 107) + [3520, 3776) 'buf' (line 126) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-use-after-return /src/opensc/src/libopensc/pkcs15-tcos.c:235:26 in insert_pin +Shadow bytes around the buggy address: + 0x0fe1c2699bb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe1c2699bc0: 00 00 00 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 + 0x0fe1c2699bd0: f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe1c2699be0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe1c2699bf0: 00 00 00 00 f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 +=>0x0fe1c2699c00:[f5]f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe1c2699c10: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe1c2699c20: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe1c2699c30: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe1c2699c40: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe1c2699c50: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-55.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-55.txt new file mode 100644 index 000000000..4249bbd8e --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-55.txt @@ -0,0 +1,67 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2202435212 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f7b44d07705 at pc 0x000000530c7c bp 0x7ffe62c3be50 sp 0x7ffe62c3b620 +WRITE of size 52545 at 0x7f7b44d07705 thread T0 + #0 0x530c7b in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x6800f9 in tcos_decipher /src/opensc/src/libopensc/card-tcos.c:654:2 + #2 0xa88d66 in sc_decipher /src/opensc/src/libopensc/sec.c:46:6 + #3 0x5fc8ed in use_key /src/opensc/src/libopensc/pkcs15-sec.c:155:8 + #4 0x5fa0d0 in sc_pkcs15_decipher /src/opensc/src/libopensc/pkcs15-sec.c:284:6 + #5 0x57132d in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:232:17 + #6 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f7b471c1082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +Address 0x7f7b44d07705 is located in stack of thread T0 at offset 773 in frame + #0 0x67f77f in tcos_decipher /src/opensc/src/libopensc/card-tcos.c:622 + + This frame has 3 object(s): + [32, 136) 'apdu' (line 624) + [176, 437) 'rbuf' (line 625) + [512, 773) 'sbuf' (line 626) <== Memory access at offset 773 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0fefe8998e90: 00 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 + 0x0fefe8998ea0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fefe8998eb0: 00 00 00 00 00 00 05 f2 f2 f2 f2 f2 f2 f2 f2 f2 + 0x0fefe8998ec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fefe8998ed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fefe8998ee0:[05]f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 + 0x0fefe8998ef0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fefe8998f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fefe8998f10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fefe8998f20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fefe8998f30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-693.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-693.txt new file mode 100644 index 000000000..941b8ad30 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-693.txt @@ -0,0 +1,78 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2202675227 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000005f9 at pc 0x00000062bba3 bp 0x7ffeec4b9db0 sp 0x7ffeec4b9da8 +READ of size 1 at 0x6020000005f9 thread T0 + #0 0x62bba2 in parse_sec_attr_44 /src/opensc/src/libopensc/card-setcos.c:792:21 + #1 0x625d41 in setcos_select_file /src/opensc/src/libopensc/card-setcos.c:939:4 + #2 0x58ca09 in sc_select_file /src/opensc/src/libopensc/card.c:865:6 + #3 0x5954d9 in sc_enum_apps /src/opensc/src/libopensc/dir.c:173:6 + #4 0x5a65d1 in sc_pkcs15_bind_internal /src/opensc/src/libopensc/pkcs15.c:958:9 + #5 0x5acdb8 in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1265:8 + #6 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #7 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f572b40e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +0x6020000005f9 is located 1 bytes to the right of 8-byte region [0x6020000005f0,0x6020000005f8) +allocated by thread T0 here: + #0 0x531c3c in __interceptor_realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:85:3 + #1 0xa6aa12 in sc_file_set_sec_attr /src/opensc/src/libopensc/sc.c:698:15 + #2 0xaa09d5 in iso7816_process_fci /src/opensc/src/libopensc/iso7816.c:437:23 + #3 0x626bde in setcos_process_fci /src/opensc/src/libopensc/card-setcos.c:971:10 + #4 0xa9797e in iso7816_select_file /src/opensc/src/libopensc/iso7816.c:617:4 + #5 0x6258ca in setcos_select_file /src/opensc/src/libopensc/card-setcos.c:929:6 + #6 0x58ca09 in sc_select_file /src/opensc/src/libopensc/card.c:865:6 + #7 0x5954d9 in sc_enum_apps /src/opensc/src/libopensc/dir.c:173:6 + #8 0x5a65d1 in sc_pkcs15_bind_internal /src/opensc/src/libopensc/pkcs15.c:958:9 + #9 0x5acdb8 in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1265:8 + #10 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #11 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #12 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #13 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #14 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f572b40e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/opensc/src/libopensc/card-setcos.c:792:21 in parse_sec_attr_44 +Shadow bytes around the buggy address: + 0x0c047fff8060: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fa + 0x0c047fff8070: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff8080: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff8090: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa + 0x0c047fff80a0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa +=>0x0c047fff80b0: fa fa fd fa fa fa fd fd fa fa 00 00 fa fa 00[fa] + 0x0c047fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-885.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-885.txt new file mode 100644 index 000000000..97007e860 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-885.txt @@ -0,0 +1,71 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2202908223 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7f02ae701670 at pc 0x000000784d16 bp 0x7ffe0e71e6d0 sp 0x7ffe0e71e6c8 +READ of size 8 at 0x7f02ae701670 thread T0 + #0 0x784d15 in coolkey_apdu_io /src/opensc/src/libopensc/card-coolkey.c:930:17 + #1 0x791524 in coolkey_rsa_op /src/opensc/src/libopensc/card-coolkey.c:1747:6 + #2 0x78ae6f in coolkey_compute_crypt /src/opensc/src/libopensc/card-coolkey.c:1859:7 + #3 0xa89336 in sc_compute_signature /src/opensc/src/libopensc/sec.c:62:6 + #4 0x5fc8ed in use_key /src/opensc/src/libopensc/pkcs15-sec.c:155:8 + #5 0x605d8a in sc_pkcs15_compute_signature /src/opensc/src/libopensc/pkcs15-sec.c:742:6 + #6 0x5721fb in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:286:17 + #7 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f02b0ce2082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +Address 0x7f02ae701670 is located in stack of thread T0 at offset 624 in frame + #0 0x790aff in coolkey_rsa_op /src/opensc/src/libopensc/card-coolkey.c:1680 + + This frame has 6 object(s): + [32, 40) 'crypt_out_len_p' (line 1683) + [64, 269) 'params' (line 1685) + [336, 538) 'buf' (line 1688) + [608, 610) 'len_buf' (line 1707) + [624, 632) 'buf_out' (line 1731) <== Memory access at offset 624 is inside this variable + [656, 658) 'len_buf50' (line 1755) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-use-after-scope /src/opensc/src/libopensc/card-coolkey.c:930:17 in coolkey_apdu_io +Shadow bytes around the buggy address: + 0x0fe0d5cd8270: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe0d5cd8280: f1 f1 f1 f1 00 f2 f2 f2 00 00 00 00 00 00 00 00 + 0x0fe0d5cd8290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe0d5cd82a0: 00 05 f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 + 0x0fe0d5cd82b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fe0d5cd82c0: 00 00 00 02 f2 f2 f2 f2 f2 f2 f2 f2 f8 f2[f8]f2 + 0x0fe0d5cd82d0: f2 f2 f8 f3 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe0d5cd82e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe0d5cd82f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe0d5cd8300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe0d5cd8310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-969.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-969.txt new file mode 100644 index 000000000..6431e4351 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2020-969.txt @@ -0,0 +1,64 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2203153123 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f31420264e0 at pc 0x0000006d0cb1 bp 0x7ffe05022bb0 sp 0x7ffe05022ba8 +WRITE of size 4 at 0x7f31420264e0 thread T0 + #0 0x6d0cb0 in pgp_parse_algo_attr_blob /src/opensc/src/libopensc/card-openpgp.c:618:19 + #1 0x6cb6f7 in pgp_get_card_features /src/opensc/src/libopensc/card-openpgp.c:788:9 + #2 0x6b96e4 in pgp_init /src/opensc/src/libopensc/card-openpgp.c:483:2 + #3 0x5815d1 in sc_connect_card /src/opensc/src/libopensc/card.c:358:8 + #4 0x570f42 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:216:5 + #5 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #6 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #7 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #8 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7f314495d082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +Address 0x7f31420264e0 is located in stack of thread T0 at offset 96 in frame + #0 0x6cfb2f in pgp_parse_algo_attr_blob /src/opensc/src/libopensc/card-openpgp.c:570 + + This frame has 1 object(s): + [32, 96) 'oid' (line 571) <== Memory access at offset 96 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/opensc/src/libopensc/card-openpgp.c:618:19 in pgp_parse_algo_attr_blob +Shadow bytes around the buggy address: + 0x0fe6a83fcc40: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe6a83fcc50: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe6a83fcc60: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe6a83fcc70: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe6a83fcc80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x0fe6a83fcc90: f1 f1 f1 f1 00 00 00 00 00 00 00 00[f3]f3 f3 f3 + 0x0fe6a83fcca0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe6a83fccb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe6a83fccc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe6a83fccd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe6a83fcce0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2021-1017.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2021-1017.txt new file mode 100644 index 000000000..86c455b44 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2021-1017.txt @@ -0,0 +1,80 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2203407249 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffe60881b7f at pc 0x000000530c7c bp 0x7ffe608809b0 sp 0x7ffe60880180 +WRITE of size 33 at 0x7ffe60881b7f thread T0 + #0 0x530c7b in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x7a9efc in piv_compute_signature /src/opensc/src/libopensc/card-piv.c:2423:6 + #2 0xa89336 in sc_compute_signature /src/opensc/src/libopensc/sec.c:62:6 + #3 0x5fc8ed in use_key /src/opensc/src/libopensc/pkcs15-sec.c:155:8 + #4 0x605d8a in sc_pkcs15_compute_signature /src/opensc/src/libopensc/pkcs15-sec.c:742:6 + #5 0x5721fb in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:286:17 + #6 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #7 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #8 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #9 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fe4329ae082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +Address 0x7ffe60881b7f is located in stack of thread T0 at offset 223 in frame + #0 0x57068f in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:187 + + This frame has 16 object(s): + [32, 40) 'ctx' (line 188) + [64, 72) 'card' (line 189) + [96, 104) 'p15card' (line 190) + [128, 136) 'in' (line 220) + [160, 168) 'param' (line 220) + [192, 194) 'in_len' (line 221) + [208, 210) 'param_len' (line 221) + [224, 65759) 'buf' (line 225) <== Memory access at offset 223 partially underflows this variable + [66016, 66024) 'i' (line 226) + [66048, 66064) 'decipher_flags' (line 228) + [66080, 66096) 'wrap_flags' (line 240) + [66112, 66120) 'l' (line 246) + [66144, 68920) 'target_key' (line 247) + [69056, 69496) 'skey_info' (line 248) + [69568, 69570) 'len' (line 249) + [69584, 69656) 'signature_flags' (line 271) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x10004c108310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10004c108320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10004c108330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10004c108340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10004c108350: 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 +=>0x10004c108360: 00 f2 f2 f2 00 f2 f2 f2 00 f2 f2 f2 02 f2 02[f2] + 0x10004c108370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10004c108380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10004c108390: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10004c1083a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x10004c1083b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2021-262.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2021-262.txt new file mode 100644 index 000000000..310ddc303 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2021-262.txt @@ -0,0 +1,77 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2203675252 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60c000000180 at pc 0x000000530bc1 bp 0x7ffc932a0ab0 sp 0x7ffc932a0280 +READ of size 254 at 0x60c000000180 thread T0 + #0 0x530bc0 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0xa03375 in sc_pkcs15emu_oberthur_add_data /src/opensc/src/libopensc/pkcs15-oberthur.c:898:2 + #2 0x9fe8c0 in sc_oberthur_parse_privateinfo /src/opensc/src/libopensc/pkcs15-oberthur.c:531:9 + #3 0x9fab93 in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1040:8 + #4 0x9f820f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #5 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #6 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #7 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #8 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7ff6ced72082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +0x60c000000180 is located 0 bytes to the right of 128-byte region [0x60c000000100,0x60c000000180) +allocated by thread T0 here: + #0 0x531a0e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x9fc811 in sc_oberthur_read_file /src/opensc/src/libopensc/pkcs15-oberthur.c:264:9 + #2 0xa0216f in sc_pkcs15emu_oberthur_add_data /src/opensc/src/libopensc/pkcs15-oberthur.c:856:7 + #3 0x9fe8c0 in sc_oberthur_parse_privateinfo /src/opensc/src/libopensc/pkcs15-oberthur.c:531:9 + #4 0x9fab93 in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1040:8 + #5 0x9f820f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #6 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #9 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7ff6ced72082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c187fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c187fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c187fff8000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c187fff8010: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa + 0x0c187fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c187fff8030:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c187fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c187fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c187fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c187fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c187fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2021-474.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2021-474.txt new file mode 100644 index 000000000..cfe1d3810 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2021-474.txt @@ -0,0 +1,77 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2203932769 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60600000011c at pc 0x000000530bc1 bp 0x7ffcde3b3310 sp 0x7ffcde3b2ae0 +READ of size 254 at 0x60600000011c thread T0 + #0 0x530bc0 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0xa089d1 in sc_pkcs15emu_oberthur_add_cert /src/opensc/src/libopensc/pkcs15-oberthur.c:670:3 + #2 0xa06006 in sc_oberthur_parse_publicinfo /src/opensc/src/libopensc/pkcs15-oberthur.c:468:9 + #3 0x9fab93 in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1040:8 + #4 0x9f820f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #5 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #6 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #7 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #8 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7fc32193a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +0x60600000011c is located 0 bytes to the right of 60-byte region [0x6060000000e0,0x60600000011c) +allocated by thread T0 here: + #0 0x531a0e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x9fc811 in sc_oberthur_read_file /src/opensc/src/libopensc/pkcs15-oberthur.c:264:9 + #2 0xa081ea in sc_pkcs15emu_oberthur_add_cert /src/opensc/src/libopensc/pkcs15-oberthur.c:655:7 + #3 0xa06006 in sc_oberthur_parse_publicinfo /src/opensc/src/libopensc/pkcs15-oberthur.c:468:9 + #4 0x9fab93 in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1040:8 + #5 0x9f820f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #6 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #9 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fc32193a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c0c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c0c7fff8010: 00 00 00 00 00 00 00 02 fa fa fa fa 00 00 00 00 +=>0x0c0c7fff8020: 00 00 00[04]fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2021-537.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2021-537.txt new file mode 100644 index 000000000..cc504dd46 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2021-537.txt @@ -0,0 +1,76 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2204195103 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000000641 at pc 0x000000a076eb bp 0x7fffb38d1370 sp 0x7fffb38d1368 +READ of size 1 at 0x611000000641 thread T0 + #0 0xa076ea in sc_pkcs15emu_oberthur_add_pubkey /src/opensc/src/libopensc/pkcs15-oberthur.c:607:8 + #1 0xa05ebe in sc_oberthur_parse_publicinfo /src/opensc/src/libopensc/pkcs15-oberthur.c:464:9 + #2 0x9fab93 in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1040:8 + #3 0x9f820f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #4 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #5 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #6 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #7 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f0aff2f4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +0x611000000641 is located 1 bytes to the right of 256-byte region [0x611000000540,0x611000000640) +allocated by thread T0 here: + #0 0x531a0e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x9fc811 in sc_oberthur_read_file /src/opensc/src/libopensc/pkcs15-oberthur.c:264:9 + #2 0xa06aab in sc_pkcs15emu_oberthur_add_pubkey /src/opensc/src/libopensc/pkcs15-oberthur.c:580:7 + #3 0xa05ebe in sc_oberthur_parse_publicinfo /src/opensc/src/libopensc/pkcs15-oberthur.c:464:9 + #4 0x9fab93 in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1040:8 + #5 0x9f820f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #6 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #9 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f0aff2f4082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/opensc/src/libopensc/pkcs15-oberthur.c:607:8 in sc_pkcs15emu_oberthur_add_pubkey +Shadow bytes around the buggy address: + 0x0c227fff8070: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c227fff8090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c227fff80a0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fff80b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c227fff80c0: 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa + 0x0c227fff80d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c227fff80e0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa + 0x0c227fff80f0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c227fff8100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c227fff8110: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2021-538.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2021-538.txt new file mode 100644 index 000000000..2599ba868 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2021-538.txt @@ -0,0 +1,77 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2204449736 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000000640 at pc 0x000000530bc1 bp 0x7ffe7db9bd30 sp 0x7ffe7db9b500 +READ of size 254 at 0x611000000640 thread T0 + #0 0x530bc0 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0xa07479 in sc_pkcs15emu_oberthur_add_pubkey /src/opensc/src/libopensc/pkcs15-oberthur.c:600:3 + #2 0xa05ebe in sc_oberthur_parse_publicinfo /src/opensc/src/libopensc/pkcs15-oberthur.c:464:9 + #3 0x9fab93 in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1040:8 + #4 0x9f820f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #5 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #6 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #7 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #8 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #9 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #10 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #11 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7fa44c022082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #13 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +0x611000000640 is located 0 bytes to the right of 256-byte region [0x611000000540,0x611000000640) +allocated by thread T0 here: + #0 0x531a0e in __interceptor_calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3 + #1 0x9fc811 in sc_oberthur_read_file /src/opensc/src/libopensc/pkcs15-oberthur.c:264:9 + #2 0xa06aab in sc_pkcs15emu_oberthur_add_pubkey /src/opensc/src/libopensc/pkcs15-oberthur.c:580:7 + #3 0xa05ebe in sc_oberthur_parse_publicinfo /src/opensc/src/libopensc/pkcs15-oberthur.c:464:9 + #4 0x9fab93 in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1040:8 + #5 0x9f820f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #6 0x60f09e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5acdfc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x570f84 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:217:5 + #9 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #10 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #11 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #12 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fa44c022082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c227fff8070: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff8080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c227fff8090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c227fff80a0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 + 0x0c227fff80b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c227fff80c0: 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa + 0x0c227fff80d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c227fff80e0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa + 0x0c227fff80f0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c227fff8100: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c227fff8110: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2021-915.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2021-915.txt new file mode 100644 index 000000000..45ed3cf55 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/crashes/OSV-2021-915.txt @@ -0,0 +1,68 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2204694622 +INFO: Loaded 1 modules (31673 inline 8-bit counters): 31673 [0xd3a900, 0xd424b9), +INFO: Loaded 1 PC tables (31673 PCs): 31673 [0xbc4898,0xc40428), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f3e81b078a3 at pc 0x000000a6fb8b bp 0x7fff0defd460 sp 0x7fff0defd458 +READ of size 1 at 0x7f3e81b078a3 thread T0 + #0 0xa6fb8a in sc_asn1_read_tag /src/opensc/src/libopensc/asn1.c:74:6 + #1 0xa7231b in sc_asn1_find_tag /src/opensc/src/libopensc/asn1.c:489:7 + #2 0x7a9cd7 in piv_compute_signature /src/opensc/src/libopensc/card-piv.c:2410:11 + #3 0xa89336 in sc_compute_signature /src/opensc/src/libopensc/sec.c:62:6 + #4 0x5fc8ed in use_key /src/opensc/src/libopensc/pkcs15-sec.c:155:8 + #5 0x605d8a in sc_pkcs15_compute_signature /src/opensc/src/libopensc/pkcs15-sec.c:742:6 + #6 0x5721fb in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:286:17 + #7 0x4406a3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15 + #8 0x42be02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6 + #9 0x4316ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9 + #10 0x45abe2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f3e8420f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x421fcd in _start (/out/fuzz_pkcs15_reader+0x421fcd) + +Address 0x7f3e81b078a3 is located in stack of thread T0 at offset 163 in frame + #0 0x7a962f in piv_compute_signature /src/opensc/src/libopensc/card-piv.c:2370 + + This frame has 3 object(s): + [32, 160) 'rbuf' (line 2375) <== Memory access at offset 163 overflows this variable + [192, 200) 'bodylen' (line 2377) + [224, 232) 'taglen' (line 2379) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/opensc/src/libopensc/asn1.c:74:6 in sc_asn1_read_tag +Shadow bytes around the buggy address: + 0x0fe850358ec0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe850358ed0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe850358ee0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe850358ef0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe850358f00: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fe850358f10: 00 00 00 00[f2]f2 f2 f2 00 f2 f2 f2 00 f3 f3 f3 + 0x0fe850358f20: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe850358f30: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe850358f40: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe850358f50: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe850358f60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/COMMANDS.md b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/COMMANDS.md new file mode 100644 index 000000000..9eb75e675 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/COMMANDS.md @@ -0,0 +1,127 @@ +# Original Crash Collection: opensc fuzz_pkcs15_reader + +Generated: 2026-04-24 UTC + +Benchmark: `opensc_transplant_fuzz_pkcs15_reader` +Project: `opensc` +Fuzzer: `fuzz_pkcs15_reader` +Sanitizer: `address` + +Target source commit: `6903aebfddc466d966c7b865fae34572bf3ed23e` (2020-07-30) +Target-era base-runner: `gcr.io/oss-fuzz-base/base-runner@sha256:88ceb7b782d6e1e4a126bce5d751c7698493616f006b4b4f5a492f6e0ed0da3e` (2020-01, from `get_base_runner_for_date()`) + +## Semantics + +Each `OSV-*.txt` is a crash on the pristine source tree: +- **Local bugs** (already triggering at target): NAS prebuilt at target + target-era runner. +- **Migration bugs**: from `/mnt/nas/linke/new_migrate/opensc/fuzz_pkcs15_reader/ + bug_transplant/_/transplant_crash.txt` (captured during the transplant + agent's verification at each bug's buggy source commit). +- **OSV-2020-2254**: flagged as local by the migration pipeline, but pristine target + doesn't fire it. Captured at the bug's OSV `introduced` commit + (`9ffb9bae63c8`) with `-runs=100` so libFuzzer's stack-reuse path fires the + SUAR bug. `detect_stack_use_after_return=1` is required. + +## Bug → source commit / OSS-Fuzz commit + +| Bug | Kind | Source commit | OSS-Fuzz commit | +| --- | --- | --- | --- | +| OSV-2020-1046 | migration | `708cedbdad0d` | `auto` | +| OSV-2020-1720 | local | `6903aebfddc4` | `auto` | +| OSV-2020-1836 | local | `6903aebfddc4` | `auto` | +| OSV-2020-1844 | local | `6903aebfddc4` | `auto` | +| OSV-2020-1848 | local | `6903aebfddc4` | `auto` | +| OSV-2020-1860 | local | `6903aebfddc4` | `auto` | +| OSV-2020-1981 | migration | `3ff059a74bcd` | `auto` | +| OSV-2020-1990 | local | `6903aebfddc4` | `auto` | +| OSV-2020-209 | local | `6903aebfddc4` | `auto` | +| OSV-2020-2157 | local | `6903aebfddc4` | `auto` | +| OSV-2020-2178 | local | `6903aebfddc4` | `auto` | +| OSV-2020-2222 | local | `6903aebfddc4` | `auto` | +| OSV-2020-2254 | local* | `9ffb9bae63c8` | `auto` | +| OSV-2020-55 | migration | `55fd3db2b5f2` | `auto` | +| OSV-2020-693 | migration | `7a1e42e13522` | `auto` | +| OSV-2020-885 | local | `6903aebfddc4` | `auto` | +| OSV-2020-969 | migration | `af42a9387413` | `auto` | +| OSV-2021-1017 | migration | `8453c0d99a49` | `auto` | +| OSV-2021-262 | local | `6903aebfddc4` | `auto` | +| OSV-2021-474 | local | `6903aebfddc4` | `auto` | +| OSV-2021-537 | local | `6903aebfddc4` | `auto` | +| OSV-2021-538 | local | `6903aebfddc4` | `auto` | +| OSV-2021-915 | migration | `8453c0d99a49` | `auto` | + +*`OSV-2020-2254` uses its OSV-introduced commit (`9ffb9bae`) instead of target. The +migration pipeline captured a `pkcs15-tcos.c:235:26` UBSAN bounds at target (shadow), +but the OSV report is a `Stack-use-after-return READ 1` at the same line. Reproducing +the authentic SUAR requires the introduced-commit binary with `-runs=100`. + +## Re-run command (migration bugs) + +Migration crashes were captured during the transplant pipeline's per-bug +verification; the authoritative copy lives in `bug_transplant/_/ +transplant_crash.txt` under `/mnt/nas/linke/new_migrate/opensc/fuzz_pkcs15_reader/`. +(No per-bug `crash/` dir was populated for opensc by the pipeline this run.) + +```bash +NAS=/mnt/nas/linke/new_migrate/opensc/fuzz_pkcs15_reader/bug_transplant +OUT=/home/user/oss-fuzz-build/fuzzbench/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes +for bug in \ + OSV-2020-1046 \ + OSV-2020-1981 \ + OSV-2020-55 \ + OSV-2020-693 \ + OSV-2020-969 \ + OSV-2021-1017 \ + OSV-2021-915 \ +; do + cp "$NAS/opensc_${bug}/transplant_crash.txt" "$OUT/${bug}.txt" +done +``` + +## Re-run command (local bugs) + +```bash +TARGET=6903aebfddc466d966c7b865fae34572bf3ed23e +RUNNER_IMAGE='gcr.io/oss-fuzz-base/base-runner@sha256:88ceb7b782d6e1e4a126bce5d751c7698493616f006b4b4f5a492f6e0ed0da3e' +BIN_DIR="/mnt/nas/linke/opensc/opensc-${TARGET}-address" +OUT_DIR='/home/user/oss-fuzz-build/fuzzbench/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes' + +for bug in \ + OSV-2020-1720 \ + OSV-2020-1836 \ + OSV-2020-1844 \ + OSV-2020-1848 \ + OSV-2020-1860 \ + OSV-2020-1990 \ + OSV-2020-209 \ + OSV-2020-2157 \ + OSV-2020-2178 \ + OSV-2020-2222 \ + OSV-2020-885 \ + OSV-2021-262 \ + OSV-2021-474 \ + OSV-2021-537 \ + OSV-2021-538 +; do + TMPD=$(mktemp -d); cp /home/user/oss-fuzz-for-select/pocs/tmp/testcase-${bug} "$TMPD/" + docker run --rm --platform linux/amd64 --shm-size=2g \ + -v "$BIN_DIR":/out:ro -v "$TMPD":/corpus:ro \ + -e ASAN_OPTIONS=abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 \ + "$RUNNER_IMAGE" \ + /out/fuzz_pkcs15_reader "/corpus/testcase-${bug}" -rss_limit_mb=8192 \ + > "${OUT_DIR}/${bug}.txt" 2>&1 + rm -rf "$TMPD" +done + +# OSV-2020-2254: introduced commit + runs=100 +BIN2254="/mnt/nas/linke/opensc/opensc-9ffb9bae63c8b7fbababb8481a83f1b575e59a18-address" +TMPD=$(mktemp -d); cp /home/user/oss-fuzz-for-select/pocs/tmp/testcase-OSV-2020-2254 "$TMPD/" +docker run --rm --platform linux/amd64 --shm-size=2g \ + -v "$BIN2254":/out:ro -v "$TMPD":/corpus:ro \ + -e ASAN_OPTIONS=abort_on_error=1:symbolize=1:detect_leaks=0:detect_stack_use_after_return=1 \ + "$RUNNER_IMAGE" \ + /out/fuzz_pkcs15_reader /corpus/testcase-OSV-2020-2254 -rss_limit_mb=8192 -runs=100 \ + > "${OUT_DIR}/OSV-2020-2254.txt" 2>&1 +rm -rf $TMPD +``` + diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1046.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1046.txt new file mode 100755 index 000000000..b20ef7339 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1046.txt @@ -0,0 +1,74 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 145026563 +INFO: Loaded 1 modules (31631 inline 8-bit counters): 31631 [0x56118b8ae000, 0x56118b8b5b8f), +INFO: Loaded 1 PC tables (31631 PCs): 31631 [0x56118b8b5b90,0x56118b931480), +/out/fuzz_pkcs15_reader: Running 1 inputs 10 time(s) each. +Running: /work/testcase-OSV-2020-1046 +================================================================= +==227141==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7b4994f16018 at pc 0x56118b2c8cdb bp 0x7ffc0f1c32b0 sp 0x7ffc0f1c2a70 +READ of size 496 at 0x7b4994f16018 thread T0 + #0 0x56118b2c8cda in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x56118b395587 in sc_pkcs15emu_object_add /src/opensc/src/libopensc/pkcs15-syn.c:439:2 + #2 0x56118b6e31db in sc_pkcs15emu_coolkey_init /src/opensc/src/libopensc/pkcs15-coolkey.c:674:7 + #3 0x56118b6e0dab in sc_pkcs15emu_coolkey_init_ex /src/opensc/src/libopensc/pkcs15-coolkey.c:729:7 + #4 0x56118b393359 in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #5 0x56118b342312 in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #6 0x56118b30f572 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #7 0x56118b1ac6dd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x56118b197452 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x56118b19d320 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x56118b1c8e52 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f4996916082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x56118b19053d in _start (/out/fuzz_pkcs15_reader+0x18953d) + +Address 0x7b4994f16018 is located in stack of thread T0 at offset 8216 in frame + #0 0x56118b6e10df in sc_pkcs15emu_coolkey_init /src/opensc/src/libopensc/pkcs15-coolkey.c:462 + + This frame has 12 object(s): + [32, 36) 'count' (line 483) + [48, 680) 'pin_info' (line 508) + [816, 3592) 'pin_obj' (line 509) + [3728, 3816) 'coolkey_obj' (line 543) + [3856, 6632) 'obj_obj' (line 544) + [6768, 7120) 'cert_info' (line 545) + [7184, 7680) 'pubkey_info' (line 546) + [7744, 8216) 'prkey_info' (line 547) + [8288, 8296) 'key_type' (line 551) <== Memory access at offset 8216 partially underflows this variable + [8320, 8328) 'obj_class' (line 552) <== Memory access at offset 8216 partially underflows this variable + [8352, 8360) 'len' (line 553) <== Memory access at offset 8216 partially underflows this variable + [8384, 8392) 'cert_object' (line 687) <== Memory access at offset 8216 partially underflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/opensc/src/libopensc/pkcs15-syn.c:439:2 in sc_pkcs15emu_object_add +Shadow bytes around the buggy address: + 0x7b4994f15d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b4994f15e00: f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 + 0x7b4994f15e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b4994f15f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7b4994f15f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7b4994f16000: 00 00 00[f2]f2 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 + 0x7b4994f16080: 00 f2 f2 f2 00 f2 f2 f2 f8 f3 f3 f3 f3 f3 f3 f3 + 0x7b4994f16100: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x7b4994f16180: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x7b4994f16200: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x7b4994f16280: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==227141==ABORTING diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1720.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1720.txt new file mode 100644 index 000000000..9664c1722 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1720.txt @@ -0,0 +1,79 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2962013997 +INFO: Loaded 1 modules (31829 inline 8-bit counters): 31829 [0xf100c0, 0xf17d15), +INFO: Loaded 1 PC tables (31829 PCs): 31829 [0xb9b828,0xc17d78), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1720 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000651 at pc 0x00000050e81d bp 0x7ffd1808eb70 sp 0x7ffd1808e328 +READ of size 2 at 0x602000000651 thread T0 + #0 0x50e81c in strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:482:5 + #1 0x9f3089 in hextoint /src/opensc/src/libopensc/pkcs15-itacns.c:382:2 + #2 0x9f281c in get_name_from_EF_DatiPersonali /src/opensc/src/libopensc/pkcs15-itacns.c:401:18 + #3 0x9f0d32 in itacns_add_data_files /src/opensc/src/libopensc/pkcs15-itacns.c:549:6 + #4 0x9ef113 in itacns_init /src/opensc/src/libopensc/pkcs15-itacns.c:813:6 + #5 0x9ee2b0 in sc_pkcs15emu_itacns_init_ex /src/opensc/src/libopensc/pkcs15-itacns.c:870:9 + #6 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #9 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #10 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #12 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f0ce5dea82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #14 0x420b38 in _start (/out/fuzz_pkcs15_reader+0x420b38) + +0x602000000651 is located 0 bytes to the right of 1-byte region [0x602000000650,0x602000000651) +allocated by thread T0 here: + #0 0x5228fd in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0xa5e460 in sc_der_copy /src/opensc/src/libopensc/asn1.c:2050:16 + #2 0x5add30 in sc_pkcs15_read_data_object /src/opensc/src/libopensc/pkcs15-data.c:60:2 + #3 0x9f0bdc in itacns_add_data_files /src/opensc/src/libopensc/pkcs15-itacns.c:539:7 + #4 0x9ef113 in itacns_init /src/opensc/src/libopensc/pkcs15-itacns.c:813:6 + #5 0x9ee2b0 in sc_pkcs15emu_itacns_init_ex /src/opensc/src/libopensc/pkcs15-itacns.c:870:9 + #6 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #9 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #10 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #12 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f0ce5dea82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:482:5 in strncpy +Shadow bytes around the buggy address: + 0x0c047fff8070: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff8080: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff8090: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa + 0x0c047fff80a0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff80b0: fa fa fd fa fa fa fd fd fa fa 00 00 fa fa 05 fa +=>0x0c047fff80c0: fa fa 00 01 fa fa 01 fa fa fa[01]fa fa fa 00 00 + 0x0c047fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1836.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1836.txt new file mode 100644 index 000000000..10b8d636d --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1836.txt @@ -0,0 +1,79 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2962335173 +INFO: Loaded 1 modules (31829 inline 8-bit counters): 31829 [0xf100c0, 0xf17d15), +INFO: Loaded 1 PC tables (31829 PCs): 31829 [0xb9b828,0xc17d78), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1836 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000676 at pc 0x00000050e81d bp 0x7ffd86debfd0 sp 0x7ffd86deb788 +READ of size 7 at 0x602000000676 thread T0 + #0 0x50e81c in strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:482:5 + #1 0x9f3089 in hextoint /src/opensc/src/libopensc/pkcs15-itacns.c:382:2 + #2 0x9f281c in get_name_from_EF_DatiPersonali /src/opensc/src/libopensc/pkcs15-itacns.c:401:18 + #3 0x9f0d32 in itacns_add_data_files /src/opensc/src/libopensc/pkcs15-itacns.c:549:6 + #4 0x9ef113 in itacns_init /src/opensc/src/libopensc/pkcs15-itacns.c:813:6 + #5 0x9ee2b0 in sc_pkcs15emu_itacns_init_ex /src/opensc/src/libopensc/pkcs15-itacns.c:870:9 + #6 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #9 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #10 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #12 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fa3843e982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #14 0x420b38 in _start (/out/fuzz_pkcs15_reader+0x420b38) + +0x602000000676 is located 0 bytes to the right of 6-byte region [0x602000000670,0x602000000676) +allocated by thread T0 here: + #0 0x5228fd in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0xa5e460 in sc_der_copy /src/opensc/src/libopensc/asn1.c:2050:16 + #2 0x5add30 in sc_pkcs15_read_data_object /src/opensc/src/libopensc/pkcs15-data.c:60:2 + #3 0x9f0bdc in itacns_add_data_files /src/opensc/src/libopensc/pkcs15-itacns.c:539:7 + #4 0x9ef113 in itacns_init /src/opensc/src/libopensc/pkcs15-itacns.c:813:6 + #5 0x9ee2b0 in sc_pkcs15emu_itacns_init_ex /src/opensc/src/libopensc/pkcs15-itacns.c:870:9 + #6 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #9 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #10 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #12 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fa3843e982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:482:5 in strncpy +Shadow bytes around the buggy address: + 0x0c047fff8070: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff8080: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff8090: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa + 0x0c047fff80a0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff80b0: fa fa fd fa fa fa fd fd fa fa 00 00 fa fa 05 fa +=>0x0c047fff80c0: fa fa 00 01 fa fa 01 fa fa fa 06 fa fa fa[06]fa + 0x0c047fff80d0: fa fa 00 00 fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1844.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1844.txt new file mode 100644 index 000000000..fa7f3389d --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1844.txt @@ -0,0 +1,79 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2962723926 +INFO: Loaded 1 modules (31829 inline 8-bit counters): 31829 [0xf100c0, 0xf17d15), +INFO: Loaded 1 PC tables (31829 PCs): 31829 [0xb9b828,0xc17d78), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1844 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000676 at pc 0x00000050e81d bp 0x7ffea987e090 sp 0x7ffea987d848 +READ of size 7 at 0x602000000676 thread T0 + #0 0x50e81c in strncpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:482:5 + #1 0x9f3089 in hextoint /src/opensc/src/libopensc/pkcs15-itacns.c:382:2 + #2 0x9f281c in get_name_from_EF_DatiPersonali /src/opensc/src/libopensc/pkcs15-itacns.c:401:18 + #3 0x9f0d32 in itacns_add_data_files /src/opensc/src/libopensc/pkcs15-itacns.c:549:6 + #4 0x9ef113 in itacns_init /src/opensc/src/libopensc/pkcs15-itacns.c:813:6 + #5 0x9ee2b0 in sc_pkcs15emu_itacns_init_ex /src/opensc/src/libopensc/pkcs15-itacns.c:870:9 + #6 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #9 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #10 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #12 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f85819ec82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #14 0x420b38 in _start (/out/fuzz_pkcs15_reader+0x420b38) + +0x602000000676 is located 0 bytes to the right of 6-byte region [0x602000000670,0x602000000676) +allocated by thread T0 here: + #0 0x5228fd in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0xa5e460 in sc_der_copy /src/opensc/src/libopensc/asn1.c:2050:16 + #2 0x5add30 in sc_pkcs15_read_data_object /src/opensc/src/libopensc/pkcs15-data.c:60:2 + #3 0x9f0bdc in itacns_add_data_files /src/opensc/src/libopensc/pkcs15-itacns.c:539:7 + #4 0x9ef113 in itacns_init /src/opensc/src/libopensc/pkcs15-itacns.c:813:6 + #5 0x9ee2b0 in sc_pkcs15emu_itacns_init_ex /src/opensc/src/libopensc/pkcs15-itacns.c:870:9 + #6 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #9 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #10 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #12 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f85819ec82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:482:5 in strncpy +Shadow bytes around the buggy address: + 0x0c047fff8070: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff8080: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff8090: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa + 0x0c047fff80a0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x0c047fff80b0: fa fa fd fa fa fa fd fd fa fa 00 00 fa fa 05 fa +=>0x0c047fff80c0: fa fa 00 01 fa fa 01 fa fa fa 06 fa fa fa[06]fa + 0x0c047fff80d0: fa fa 00 00 fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1848.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1848.txt new file mode 100644 index 000000000..46d09c760 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1848.txt @@ -0,0 +1,74 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2963232687 +INFO: Loaded 1 modules (31829 inline 8-bit counters): 31829 [0xf100c0, 0xf17d15), +INFO: Loaded 1 PC tables (31829 PCs): 31829 [0xb9b828,0xc17d78), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1848 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000000119 at pc 0x0000009e9f59 bp 0x7fff8bc589f0 sp 0x7fff8bc589e8 +READ of size 1 at 0x606000000119 thread T0 + #0 0x9e9f58 in sc_oberthur_parse_publicinfo /src/opensc/src/libopensc/pkcs15-oberthur.c:458:38 + #1 0x9dee23 in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1040:8 + #2 0x9dc49f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #3 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #4 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #5 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #6 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #7 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #8 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #9 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f963ef7d82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #11 0x420b38 in _start (/out/fuzz_pkcs15_reader+0x420b38) + +0x606000000119 is located 0 bytes to the right of 57-byte region [0x6060000000e0,0x606000000119) +allocated by thread T0 here: + #0 0x522a92 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:154:3 + #1 0x9e0aa1 in sc_oberthur_read_file /src/opensc/src/libopensc/pkcs15-oberthur.c:264:9 + #2 0x9dea6f in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1033:8 + #3 0x9dc49f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #4 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #5 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #6 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #7 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #8 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #10 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f963ef7d82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/opensc/src/libopensc/pkcs15-oberthur.c:458:38 in sc_oberthur_parse_publicinfo +Shadow bytes around the buggy address: + 0x0c0c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c0c7fff8010: 00 00 00 00 00 00 00 02 fa fa fa fa 00 00 00 00 +=>0x0c0c7fff8020: 00 00 00[01]fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1860.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1860.txt new file mode 100644 index 000000000..f78682e4c --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1860.txt @@ -0,0 +1,70 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2963577259 +INFO: Loaded 1 modules (31829 inline 8-bit counters): 31829 [0xf100c0, 0xf17d15), +INFO: Loaded 1 PC tables (31829 PCs): 31829 [0xb9b828,0xc17d78), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1860 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff4fff91e2 at pc 0x000000521d6a bp 0x7fff4ffe85d0 sp 0x7fff4ffe7d98 +WRITE of size 28 at 0x7fff4fff91e2 thread T0 + #0 0x521d69 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0xa98813 in sc_get_response /src/opensc/src/libopensc/apdu.c:475:3 + #2 0xa9499b in sc_transmit /src/opensc/src/libopensc/apdu.c:532:7 + #3 0xa93d23 in sc_transmit_apdu /src/opensc/src/libopensc/apdu.c:624:7 + #4 0xa74894 in iso7816_read_binary /src/opensc/src/libopensc/iso7816.c:156:6 + #5 0x9967aa in idprime_read_binary /src/opensc/src/libopensc/card-idprime.c:542:7 + #6 0x56d135 in sc_read_binary /src/opensc/src/libopensc/card.c:652:7 + #7 0x58ccb2 in sc_pkcs15_bind_internal /src/opensc/src/libopensc/pkcs15.c:1130:9 + #8 0x5915b8 in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1265:8 + #9 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #10 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #11 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #12 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #13 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #14 0x7fda0f96c82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #15 0x420b38 in _start (/out/fuzz_pkcs15_reader+0x420b38) + +Address 0x7fff4fff91e2 is located in stack of thread T0 at offset 65570 in frame + #0 0x99619f in idprime_read_binary /src/opensc/src/libopensc/card-idprime.c:527 + + This frame has 1 object(s): + [32, 65570) 'buffer' (line 537) <== Memory access at offset 65570 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x100069ff71e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x100069ff71f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x100069ff7200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x100069ff7210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x100069ff7220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x100069ff7230: 00 00 00 00 00 00 00 00 00 00 00 00[02]f3 f3 f3 + 0x100069ff7240: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x100069ff7250: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x100069ff7260: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x100069ff7270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x100069ff7280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1981.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1981.txt new file mode 100755 index 000000000..19e752983 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1981.txt @@ -0,0 +1,67 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1699255589 +INFO: Loaded 1 modules (31631 inline 8-bit counters): 31631 [0x55974082f000, 0x559740836b8f), +INFO: Loaded 1 PC tables (31631 PCs): 31631 [0x559740836b90,0x5597408b2480), +/out/fuzz_pkcs15_reader: Running 1 inputs 10 time(s) each. +Running: /work/testcase-OSV-2020-1981 +================================================================= +==459195==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffc7543ae82 at pc 0x559740249d7e bp 0x7ffc7542a2d0 sp 0x7ffc75429a90 +WRITE of size 43246 at 0x7ffc7543ae82 thread T0 + #0 0x559740249d7d in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x55974028f8f1 in fuzz_reader_transmit /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:140:13 + #2 0x5597406d546a in sc_single_transmit /src/opensc/src/libopensc/apdu.c:379:7 + #3 0x5597406d2bd6 in sc_transmit /src/opensc/src/libopensc/apdu.c:515:6 + #4 0x5597406d24a3 in sc_transmit_apdu /src/opensc/src/libopensc/apdu.c:624:7 + #5 0x5597406b9732 in iso7816_read_binary /src/opensc/src/libopensc/iso7816.c:156:6 + #6 0x559740607311 in idprime_read_binary /src/opensc/src/libopensc/card-idprime.c:545:8 + #7 0x5597402a4507 in sc_read_binary /src/opensc/src/libopensc/card.c:652:7 + #8 0x5597402beb08 in sc_pkcs15_bind_internal /src/opensc/src/libopensc/pkcs15.c:1056:9 + #9 0x5597402c32d4 in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1265:8 + #10 0x559740290572 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #11 0x55974012d6dd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #12 0x559740118452 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #13 0x55974011e320 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #14 0x559740149e52 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7fb427ece082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #16 0x55974011153d in _start (/out/fuzz_pkcs15_reader+0x18953d) + +Address 0x7ffc7543ae82 is located in stack of thread T0 at offset 65570 in frame + #0 0x559740606ccf in idprime_read_binary /src/opensc/src/libopensc/card-idprime.c:527 + + This frame has 1 object(s): + [32, 65570) 'buffer' (line 539) <== Memory access at offset 65570 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:140:13 in fuzz_reader_transmit +Shadow bytes around the buggy address: + 0x7ffc7543ac00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7ffc7543ac80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7ffc7543ad00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7ffc7543ad80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7ffc7543ae00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7ffc7543ae80:[02]f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x7ffc7543af00: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x7ffc7543af80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7ffc7543b000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7ffc7543b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7ffc7543b100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==459195==ABORTING diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1990.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1990.txt new file mode 100644 index 000000000..78563089e --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-1990.txt @@ -0,0 +1,74 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2963930817 +INFO: Loaded 1 modules (31829 inline 8-bit counters): 31829 [0xf100c0, 0xf17d15), +INFO: Loaded 1 PC tables (31829 PCs): 31829 [0xb9b828,0xc17d78), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-1990 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000000239 at pc 0x0000009e23bf bp 0x7fff4df91490 sp 0x7fff4df91488 +READ of size 1 at 0x606000000239 thread T0 + #0 0x9e23be in sc_oberthur_parse_privateinfo /src/opensc/src/libopensc/pkcs15-oberthur.c:503:38 + #1 0x9dee23 in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1040:8 + #2 0x9dc49f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #3 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #4 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #5 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #6 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #7 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #8 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #9 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f92e665782f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #11 0x420b38 in _start (/out/fuzz_pkcs15_reader+0x420b38) + +0x606000000239 is located 0 bytes to the right of 57-byte region [0x606000000200,0x606000000239) +allocated by thread T0 here: + #0 0x522a92 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:154:3 + #1 0x9e0aa1 in sc_oberthur_read_file /src/opensc/src/libopensc/pkcs15-oberthur.c:264:9 + #2 0x9dea6f in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1033:8 + #3 0x9dc49f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #4 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #5 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #6 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #7 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #8 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #10 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f92e665782f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/opensc/src/libopensc/pkcs15-oberthur.c:503:38 in sc_oberthur_parse_privateinfo +Shadow bytes around the buggy address: + 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c0c7fff8010: 00 00 00 00 00 00 00 02 fa fa fa fa 00 00 00 00 + 0x0c0c7fff8020: 00 00 00 01 fa fa fa fa 00 00 00 00 00 00 00 01 + 0x0c0c7fff8030: fa fa fa fa 00 00 00 00 00 00 00 01 fa fa fa fa +=>0x0c0c7fff8040: 00 00 00 00 00 00 00[01]fa fa fa fa fa fa fa fa + 0x0c0c7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-209.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-209.txt new file mode 100644 index 000000000..eb00b0355 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-209.txt @@ -0,0 +1,72 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2964294455 +INFO: Loaded 1 modules (31829 inline 8-bit counters): 31829 [0xf100c0, 0xf17d15), +INFO: Loaded 1 PC tables (31829 PCs): 31829 [0xb9b828,0xc17d78), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-209 +================================================================= +==1==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7f2e3e701670 at pc 0x000000769046 bp 0x7fffe50aba50 sp 0x7fffe50aba48 +READ of size 8 at 0x7f2e3e701670 thread T0 + #0 0x769045 in coolkey_apdu_io /src/opensc/src/libopensc/card-coolkey.c:930:17 + #1 0x775844 in coolkey_rsa_op /src/opensc/src/libopensc/card-coolkey.c:1747:6 + #2 0x76f18f in coolkey_compute_crypt /src/opensc/src/libopensc/card-coolkey.c:1859:7 + #3 0xa6ce96 in sc_decipher /src/opensc/src/libopensc/sec.c:46:6 + #4 0x5e1ded in use_key /src/opensc/src/libopensc/pkcs15-sec.c:154:8 + #5 0x5df5d0 in sc_pkcs15_decipher /src/opensc/src/libopensc/pkcs15-sec.c:283:6 + #6 0x5558b2 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:225:17 + #7 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #8 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #10 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f2e41a0382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #12 0x420b38 in _start (/out/fuzz_pkcs15_reader+0x420b38) + +Address 0x7f2e3e701670 is located in stack of thread T0 at offset 624 in frame + #0 0x774e1f in coolkey_rsa_op /src/opensc/src/libopensc/card-coolkey.c:1680 + + This frame has 6 object(s): + [32, 40) 'crypt_out_len_p' (line 1683) + [64, 269) 'params' (line 1685) + [336, 538) 'buf' (line 1688) + [608, 610) 'len_buf' (line 1707) + [624, 632) 'buf_out' (line 1731) <== Memory access at offset 624 is inside this variable + [656, 658) 'len_buf50' (line 1755) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-use-after-scope /src/opensc/src/libopensc/card-coolkey.c:930:17 in coolkey_apdu_io +Shadow bytes around the buggy address: + 0x0fe647cd8270: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0fe647cd8280: f1 f1 f1 f1 00 f2 f2 f2 00 00 00 00 00 00 00 00 + 0x0fe647cd8290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe647cd82a0: 00 05 f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 + 0x0fe647cd82b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fe647cd82c0: 00 00 00 02 f2 f2 f2 f2 f2 f2 f2 f2 f8 f2[f8]f2 + 0x0fe647cd82d0: f2 f2 f8 f3 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe647cd82e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe647cd82f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe647cd8300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe647cd8310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-2157.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-2157.txt new file mode 100644 index 000000000..739c33a4a --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-2157.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2964660941 +INFO: Loaded 1 modules (31829 inline 8-bit counters): 31829 [0xf100c0, 0xf17d15), +INFO: Loaded 1 PC tables (31829 PCs): 31829 [0xb9b828,0xc17d78), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-2157 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f9e58d0dec0 at pc 0x0000009ae3fd bp 0x7fffc4d57190 sp 0x7fffc4d57188 +READ of size 1 at 0x7f9e58d0dec0 thread T0 + #0 0x9ae3fc in insert_key /src/opensc/src/libopensc/pkcs15-tcos.c:142:8 + #1 0x9aab50 in detect_netkey /src/opensc/src/libopensc/pkcs15-tcos.c:308:2 + #2 0x9a9f0b in sc_pkcs15emu_tcos_init_ex /src/opensc/src/libopensc/pkcs15-tcos.c:520:6 + #3 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #4 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #5 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #6 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #7 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #8 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #9 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f9e5bd7f82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #11 0x420b38 in _start (/out/fuzz_pkcs15_reader+0x420b38) + +Address 0x7f9e58d0dec0 is located in stack of thread T0 at offset 3776 in frame + #0 0x9ad87f in insert_key /src/opensc/src/libopensc/pkcs15-tcos.c:102 + + This frame has 4 object(s): + [32, 40) 'f' (line 105) + [64, 536) 'prkey_info' (line 106) + [608, 3384) 'prkey_obj' (line 107) + [3520, 3776) 'buf' (line 126) <== Memory access at offset 3776 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/opensc/src/libopensc/pkcs15-tcos.c:142:8 in insert_key +Shadow bytes around the buggy address: + 0x0ff44b199b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff44b199b90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff44b199ba0: 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 f2 f2 f2 f2 + 0x0ff44b199bb0: f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 + 0x0ff44b199bc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0ff44b199bd0: 00 00 00 00 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 f3 + 0x0ff44b199be0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff44b199bf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff44b199c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff44b199c10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff44b199c20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-2178.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-2178.txt new file mode 100644 index 000000000..db9870098 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-2178.txt @@ -0,0 +1,69 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2964992888 +INFO: Loaded 1 modules (31829 inline 8-bit counters): 31829 [0xf100c0, 0xf17d15), +INFO: Loaded 1 PC tables (31829 PCs): 31829 [0xb9b828,0xc17d78), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-2178 +================================================================= +==1==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f083010eec0 at pc 0x0000009ae99f bp 0x7ffca1c59690 sp 0x7ffca1c59688 +READ of size 1 at 0x7f083010eec0 thread T0 + #0 0x9ae99e in insert_key /src/opensc/src/libopensc/pkcs15-tcos.c:150:20 + #1 0x9aabaf in detect_netkey /src/opensc/src/libopensc/pkcs15-tcos.c:309:2 + #2 0x9a9f0b in sc_pkcs15emu_tcos_init_ex /src/opensc/src/libopensc/pkcs15-tcos.c:520:6 + #3 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #4 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #5 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #6 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #7 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #8 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #9 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f083331e82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #11 0x420b38 in _start (/out/fuzz_pkcs15_reader+0x420b38) + +Address 0x7f083010eec0 is located in stack of thread T0 at offset 3776 in frame + #0 0x9ad87f in insert_key /src/opensc/src/libopensc/pkcs15-tcos.c:102 + + This frame has 4 object(s): + [32, 40) 'f' (line 105) + [64, 536) 'prkey_info' (line 106) + [608, 3384) 'prkey_obj' (line 107) + [3520, 3776) 'buf' (line 126) <== Memory access at offset 3776 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/opensc/src/libopensc/pkcs15-tcos.c:150:20 in insert_key +Shadow bytes around the buggy address: + 0x0fe186019d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe186019d90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe186019da0: 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 f2 f2 f2 f2 + 0x0fe186019db0: f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 + 0x0fe186019dc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0fe186019dd0: 00 00 00 00 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 f3 + 0x0fe186019de0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe186019df0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe186019e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe186019e10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0fe186019e20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-2222.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-2222.txt new file mode 100644 index 000000000..3ef5082a3 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-2222.txt @@ -0,0 +1,57 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2965337244 +INFO: Loaded 1 modules (31829 inline 8-bit counters): 31829 [0xf100c0, 0xf17d15), +INFO: Loaded 1 PC tables (31829 PCs): 31829 [0xb9b828,0xc17d78), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-2222 +================================================================= +==1==ERROR: AddressSanitizer: attempting double-free on 0x6030000003a0 in thread T0: + #0 0x522692 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:127:3 + #1 0x588250 in sc_pkcs15_free_tokeninfo /src/opensc/src/libopensc/pkcs15.c:736:2 + #2 0x588ad2 in sc_pkcs15_card_free /src/opensc/src/libopensc/pkcs15.c:790:2 + #3 0x556d98 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:290:9 + #4 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #5 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #6 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #7 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #8 0x7f9e8e42182f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #9 0x420b38 in _start (/out/fuzz_pkcs15_reader+0x420b38) + +0x6030000003a0 is located 0 bytes inside of 32-byte region [0x6030000003a0,0x6030000003c0) +freed by thread T0 here: + #0 0x522692 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:127:3 + #1 0x99f796 in idprime_get_token_name /src/opensc/src/libopensc/card-idprime.c:451:3 + #2 0x9984a2 in idprime_card_ctl /src/opensc/src/libopensc/card-idprime.c:475:11 + #3 0x574b62 in sc_card_ctl /src/opensc/src/libopensc/card.c:1058:7 + #4 0xa15981 in sc_pkcs15emu_idprime_init /src/opensc/src/libopensc/pkcs15-idprime.c:112:6 + #5 0xa14856 in sc_pkcs15emu_idprime_init_ex /src/opensc/src/libopensc/pkcs15-idprime.c:285:9 + #6 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #9 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #10 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #12 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f9e8e42182f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +previously allocated by thread T0 here: + #0 0x5228fd in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 + #1 0x99f3cc in idprime_get_token_name /src/opensc/src/libopensc/card-idprime.c:444:11 + #2 0x9984a2 in idprime_card_ctl /src/opensc/src/libopensc/card-idprime.c:475:11 + #3 0x574b62 in sc_card_ctl /src/opensc/src/libopensc/card.c:1058:7 + #4 0xa15981 in sc_pkcs15emu_idprime_init /src/opensc/src/libopensc/pkcs15-idprime.c:112:6 + #5 0xa14856 in sc_pkcs15emu_idprime_init_ex /src/opensc/src/libopensc/pkcs15-idprime.c:285:9 + #6 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #9 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #10 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #12 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f9e8e42182f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: double-free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:127:3 in free +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-2254.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-2254.txt new file mode 100644 index 000000000..fc5e77bb4 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-2254.txt @@ -0,0 +1,68 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3054499116 +INFO: Loaded 1 modules (31828 inline 8-bit counters): 31828 [0xf100c0, 0xf17d14), +INFO: Loaded 1 PC tables (31828 PCs): 31828 [0xb9b788,0xc17cc8), +/out/fuzz_pkcs15_reader: Running 1 inputs 100 time(s) each. +Running: /corpus/testcase-OSV-2020-2254 +================================================================= +==1==ERROR: AddressSanitizer: stack-use-after-return on address 0x7fda7dd0e005 at pc 0x0000009b037e bp 0x7ffc3d62d0f0 sp 0x7ffc3d62d0e8 +READ of size 1 at 0x7fda7dd0e005 thread T0 + #0 0x9b037d in insert_pin /src/opensc/src/libopensc/pkcs15-tcos.c:235:26 + #1 0x9abb03 in detect_idkey /src/opensc/src/libopensc/pkcs15-tcos.c:402:2 + #2 0x9a9f58 in sc_pkcs15emu_tcos_init_ex /src/opensc/src/libopensc/pkcs15-tcos.c:521:6 + #3 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #4 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #5 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #6 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #7 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #8 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #9 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fda80ee882f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #11 0x420b38 in _start (/out/fuzz_pkcs15_reader+0x420b38) + +Address 0x7fda7dd0e005 is located in stack of thread T0 at offset 5 in frame + #0 0x9ad87f in insert_key /src/opensc/src/libopensc/pkcs15-tcos.c:102 + + This frame has 4 object(s): + [32, 40) 'f' (line 105) + [64, 536) 'prkey_info' (line 106) + [608, 3384) 'prkey_obj' (line 107) + [3520, 3776) 'buf' (line 126) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-use-after-return /src/opensc/src/libopensc/pkcs15-tcos.c:235:26 in insert_pin +Shadow bytes around the buggy address: + 0x0ffbcfb99bb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffbcfb99bc0: 00 00 00 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 + 0x0ffbcfb99bd0: f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffbcfb99be0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ffbcfb99bf0: 00 00 00 00 f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 +=>0x0ffbcfb99c00:[f5]f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffbcfb99c10: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffbcfb99c20: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffbcfb99c30: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffbcfb99c40: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ffbcfb99c50: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-55.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-55.txt new file mode 100755 index 000000000..748fd88ce --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-55.txt @@ -0,0 +1,65 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 1281583568 +INFO: Loaded 1 modules (31828 inline 8-bit counters): 31828 [0xf100c0, 0xf17d14), +INFO: Loaded 1 PC tables (31828 PCs): 31828 [0xb9b7e8,0xc17d28), +/out/fuzz_pkcs15_reader: Running 1 inputs 10 time(s) each. +Running: /work/testcase-OSV-2020-55 +================================================================= +==76420==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd3aeaf425 at pc 0x000000521d6a bp 0x7ffd3aeaf110 sp 0x7ffd3aeae8d8 +WRITE of size 52545 at 0x7ffd3aeaf425 thread T0 + #0 0x521d69 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x664631 in tcos_decipher /src/opensc/src/libopensc/card-tcos.c:649:2 + #2 0xa6ce46 in sc_decipher /src/opensc/src/libopensc/sec.c:46:6 + #3 0x5e1ded in use_key /src/opensc/src/libopensc/pkcs15-sec.c:154:8 + #4 0x5df5d0 in sc_pkcs15_decipher /src/opensc/src/libopensc/pkcs15-sec.c:283:6 + #5 0x5558b2 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:225:17 + #6 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #7 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #8 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #9 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7f1ddc50a83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) + #11 0x420b38 in _start (/out/fuzz_pkcs15_reader+0x420b38) + +Address 0x7ffd3aeaf425 is located in stack of thread T0 at offset 773 in frame + #0 0x663daf in tcos_decipher /src/opensc/src/libopensc/card-tcos.c:621 + + This frame has 3 object(s): + [32, 136) 'apdu' (line 623) + [176, 437) 'rbuf' (line 624) + [512, 773) 'sbuf' (line 625) <== Memory access at offset 773 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x1000275cde30: 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 00 00 00 00 + 0x1000275cde40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x1000275cde50: 00 00 00 00 00 00 00 00 00 00 05 f2 f2 f2 f2 f2 + 0x1000275cde60: f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 + 0x1000275cde70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x1000275cde80: 00 00 00 00[05]f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 + 0x1000275cde90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x1000275cdea0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x1000275cdeb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x1000275cdec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x1000275cded0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==76420==ABORTING diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-693.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-693.txt new file mode 100755 index 000000000..00355af04 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-693.txt @@ -0,0 +1,75 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3545274070 +INFO: Loaded 1 modules (31631 inline 8-bit counters): 31631 [0x561ac2be9000, 0x561ac2bf0b8f), +INFO: Loaded 1 PC tables (31631 PCs): 31631 [0x561ac2bf0b90,0x561ac2c6c480), +/out/fuzz_pkcs15_reader: Running 1 inputs 10 time(s) each. +Running: /work/testcase-OSV-2020-693 +================================================================= +==113942==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b524cde05f9 at pc 0x561ac26e4eeb bp 0x7ffef5a95ed0 sp 0x7ffef5a95ec8 +READ of size 1 at 0x7b524cde05f9 thread T0 + #0 0x561ac26e4eea in parse_sec_attr_44 /src/opensc/src/libopensc/card-setcos.c:791:21 + #1 0x561ac26e001c in setcos_select_file /src/opensc/src/libopensc/card-setcos.c:933:4 + #2 0x561ac2661fa9 in sc_select_file /src/opensc/src/libopensc/card.c:865:6 + #3 0x561ac2669a84 in sc_enum_apps /src/opensc/src/libopensc/dir.c:173:6 + #4 0x561ac2677c9e in sc_pkcs15_bind_internal /src/opensc/src/libopensc/pkcs15.c:958:9 + #5 0x561ac267d2d4 in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1265:8 + #6 0x561ac264a572 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #7 0x561ac24e76dd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x561ac24d2452 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x561ac24d8320 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x561ac2503e52 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f324dab7082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x561ac24cb53d in _start (/out/fuzz_pkcs15_reader+0x18953d) + +0x7b524cde05f9 is located 1 bytes after 8-byte region [0x7b524cde05f0,0x7b524cde05f8) +allocated by thread T0 here: + #0 0x561ac260641c in realloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:81:3 + #1 0x561ac2a53e6e in sc_file_set_sec_attr /src/opensc/src/libopensc/sc.c:698:15 + #2 0x561ac2a7f6ff in iso7816_process_fci /src/opensc/src/libopensc/iso7816.c:437:23 + #3 0x561ac26e0b13 in setcos_process_fci /src/opensc/src/libopensc/card-setcos.c:965:10 + #4 0x561ac2a78a61 in iso7816_select_file /src/opensc/src/libopensc/iso7816.c:617:4 + #5 0x561ac26dfc11 in setcos_select_file /src/opensc/src/libopensc/card-setcos.c:923:6 + #6 0x561ac2661fa9 in sc_select_file /src/opensc/src/libopensc/card.c:865:6 + #7 0x561ac2669a84 in sc_enum_apps /src/opensc/src/libopensc/dir.c:173:6 + #8 0x561ac2677c9e in sc_pkcs15_bind_internal /src/opensc/src/libopensc/pkcs15.c:958:9 + #9 0x561ac267d2d4 in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1265:8 + #10 0x561ac264a572 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #11 0x561ac24e76dd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #12 0x561ac24d2452 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #13 0x561ac24d8320 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #14 0x561ac2503e52 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #15 0x7f324dab7082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/opensc/src/libopensc/card-setcos.c:791:21 in parse_sec_attr_44 +Shadow bytes around the buggy address: + 0x7b524cde0300: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fa + 0x7b524cde0380: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa + 0x7b524cde0400: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa + 0x7b524cde0480: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa + 0x7b524cde0500: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa +=>0x7b524cde0580: fa fa fd fa fa fa fd fd fa fa 00 00 fa fa 00[fa] + 0x7b524cde0600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b524cde0680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b524cde0700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b524cde0780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x7b524cde0800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==113942==ABORTING diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-885.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-885.txt new file mode 100644 index 000000000..f872adbe8 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-885.txt @@ -0,0 +1,72 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2965916358 +INFO: Loaded 1 modules (31829 inline 8-bit counters): 31829 [0xf100c0, 0xf17d15), +INFO: Loaded 1 PC tables (31829 PCs): 31829 [0xb9b828,0xc17d78), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2020-885 +================================================================= +==1==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7f8090101670 at pc 0x000000769046 bp 0x7fff5fd32590 sp 0x7fff5fd32588 +READ of size 8 at 0x7f8090101670 thread T0 + #0 0x769045 in coolkey_apdu_io /src/opensc/src/libopensc/card-coolkey.c:930:17 + #1 0x775844 in coolkey_rsa_op /src/opensc/src/libopensc/card-coolkey.c:1747:6 + #2 0x76f18f in coolkey_compute_crypt /src/opensc/src/libopensc/card-coolkey.c:1859:7 + #3 0xa6d466 in sc_compute_signature /src/opensc/src/libopensc/sec.c:62:6 + #4 0x5e1ded in use_key /src/opensc/src/libopensc/pkcs15-sec.c:154:8 + #5 0x5ea535 in sc_pkcs15_compute_signature /src/opensc/src/libopensc/pkcs15-sec.c:705:6 + #6 0x556780 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:279:17 + #7 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #8 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #10 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f809343582f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #12 0x420b38 in _start (/out/fuzz_pkcs15_reader+0x420b38) + +Address 0x7f8090101670 is located in stack of thread T0 at offset 624 in frame + #0 0x774e1f in coolkey_rsa_op /src/opensc/src/libopensc/card-coolkey.c:1680 + + This frame has 6 object(s): + [32, 40) 'crypt_out_len_p' (line 1683) + [64, 269) 'params' (line 1685) + [336, 538) 'buf' (line 1688) + [608, 610) 'len_buf' (line 1707) + [624, 632) 'buf_out' (line 1731) <== Memory access at offset 624 is inside this variable + [656, 658) 'len_buf50' (line 1755) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-use-after-scope /src/opensc/src/libopensc/card-coolkey.c:930:17 in coolkey_apdu_io +Shadow bytes around the buggy address: + 0x0ff092018270: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x0ff092018280: f1 f1 f1 f1 00 f2 f2 f2 00 00 00 00 00 00 00 00 + 0x0ff092018290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff0920182a0: 00 05 f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 + 0x0ff0920182b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0ff0920182c0: 00 00 00 02 f2 f2 f2 f2 f2 f2 f2 f2 f8 f2[f8]f2 + 0x0ff0920182d0: f2 f2 f8 f3 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff0920182e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff0920182f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff092018300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0ff092018310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-969.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-969.txt new file mode 100755 index 000000000..946b31d5d --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2020-969.txt @@ -0,0 +1,61 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 780316718 +INFO: Loaded 1 modules (31632 inline 8-bit counters): 31632 [0x56215cce4000, 0x56215ccebb90), +INFO: Loaded 1 PC tables (31632 PCs): 31632 [0x56215ccebb90,0x56215cd67490), +/out/fuzz_pkcs15_reader: Running 1 inputs 10 time(s) each. +Running: /work/testcase-OSV-2020-969 +================================================================= +==301574==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7bef94415660 at pc 0x56215c864a89 bp 0x7ffc1a4251d0 sp 0x7ffc1a4251c8 +WRITE of size 4 at 0x7bef94415660 thread T0 + #0 0x56215c864a88 in pgp_parse_algo_attr_blob /src/opensc/src/libopensc/card-openpgp.c:616:18 + #1 0x56215c8607ec in pgp_get_card_features /src/opensc/src/libopensc/card-openpgp.c:783:9 + #2 0x56215c850f20 in pgp_init /src/opensc/src/libopensc/card-openpgp.c:482:2 + #3 0x56215c752f13 in sc_connect_card /src/opensc/src/libopensc/card.c:358:8 + #4 0x56215c745556 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:209:5 + #5 0x56215c5e26dd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #6 0x56215c5cd452 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #7 0x56215c5d3320 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #8 0x56215c5fee52 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #9 0x7fef96563082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #10 0x56215c5c653d in _start (/out/fuzz_pkcs15_reader+0x18953d) + +Address 0x7bef94415660 is located in stack of thread T0 at offset 96 in frame + #0 0x56215c863acf in pgp_parse_algo_attr_blob /src/opensc/src/libopensc/card-openpgp.c:569 + + This frame has 1 object(s): + [32, 96) 'oid' (line 570) <== Memory access at offset 96 overflows this variable +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/opensc/src/libopensc/card-openpgp.c:616:18 in pgp_parse_algo_attr_blob +Shadow bytes around the buggy address: + 0x7bef94415380: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7bef94415400: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7bef94415480: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7bef94415500: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7bef94415580: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 +=>0x7bef94415600: f1 f1 f1 f1 00 00 00 00 00 00 00 00[f3]f3 f3 f3 + 0x7bef94415680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7bef94415700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7bef94415780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7bef94415800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7bef94415880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==301574==ABORTING diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2021-1017.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2021-1017.txt new file mode 100755 index 000000000..cfc8e09b8 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2021-1017.txt @@ -0,0 +1,77 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2907784161 +INFO: Loaded 1 modules (31631 inline 8-bit counters): 31631 [0x55c5160d4000, 0x55c5160dbb8f), +INFO: Loaded 1 PC tables (31631 PCs): 31631 [0x55c5160dbb90,0x55c516157480), +/out/fuzz_pkcs15_reader: Running 1 inputs 10 time(s) each. +Running: /work/testcase-OSV-2021-1017 +================================================================= +==625659==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffde196f6bf at pc 0x55c515aeed7e bp 0x7ffde196e830 sp 0x7ffde196dff0 +WRITE of size 33 at 0x7ffde196f6bf thread T0 + #0 0x55c515aeed7d in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 + #1 0x55c515d046f7 in piv_compute_signature /src/opensc/src/libopensc/card-piv.c:2423:6 + #2 0x55c515f58811 in sc_compute_signature /src/opensc/src/libopensc/sec.c:62:6 + #3 0x55c515baa159 in use_key /src/opensc/src/libopensc/pkcs15-sec.c:154:8 + #4 0x55c515bb12d9 in sc_pkcs15_compute_signature /src/opensc/src/libopensc/pkcs15-sec.c:711:6 + #5 0x55c515b35d94 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:279:17 + #6 0x55c5159d26dd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #7 0x55c5159bd452 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #8 0x55c5159c3320 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #9 0x55c5159eee52 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #10 0x7fa5c4201082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #11 0x55c5159b653d in _start (/out/fuzz_pkcs15_reader+0x18953d) + +Address 0x7ffde196f6bf is located in stack of thread T0 at offset 223 in frame + #0 0x55c515b34f2f in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:186 + + This frame has 16 object(s): + [32, 40) 'ctx' (line 187) + [64, 72) 'card' (line 188) + [96, 104) 'p15card' (line 189) + [128, 136) 'in' (line 213) + [160, 168) 'param' (line 213) + [192, 194) 'in_len' (line 214) + [208, 210) 'param_len' (line 214) + [224, 65759) 'buf' (line 218) <== Memory access at offset 223 partially underflows this variable + [66016, 66024) 'i' (line 219) + [66048, 66064) 'decipher_flags' (line 221) + [66080, 66096) 'wrap_flags' (line 233) + [66112, 66120) 'l' (line 239) + [66144, 68920) 'target_key' (line 240) + [69056, 69496) 'skey_info' (line 241) + [69568, 69570) 'len' (line 242) + [69584, 69656) 'signature_flags' (line 264) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/opensc/src/libopensc/card-piv.c:2423:6 in piv_compute_signature +Shadow bytes around the buggy address: + 0x7ffde196f400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7ffde196f480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7ffde196f500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7ffde196f580: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 + 0x7ffde196f600: 00 f2 f2 f2 00 f2 f2 f2 00 f2 f2 f2 00 f2 f2 f2 +=>0x7ffde196f680: 00 f2 f2 f2 02 f2 02[f2]00 00 00 00 00 00 00 00 + 0x7ffde196f700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7ffde196f780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7ffde196f800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7ffde196f880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x7ffde196f900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==625659==ABORTING diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2021-262.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2021-262.txt new file mode 100644 index 000000000..86a6ef619 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2021-262.txt @@ -0,0 +1,78 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2966231970 +INFO: Loaded 1 modules (31829 inline 8-bit counters): 31829 [0xf100c0, 0xf17d15), +INFO: Loaded 1 PC tables (31829 PCs): 31829 [0xb9b828,0xc17d78), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-262 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60c000000180 at pc 0x000000521cb7 bp 0x7fff48b92210 sp 0x7fff48b919d8 +READ of size 254 at 0x60c000000180 thread T0 + #0 0x521cb6 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x9e7605 in sc_pkcs15emu_oberthur_add_data /src/opensc/src/libopensc/pkcs15-oberthur.c:898:2 + #2 0x9e2b50 in sc_oberthur_parse_privateinfo /src/opensc/src/libopensc/pkcs15-oberthur.c:531:9 + #3 0x9dee23 in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1040:8 + #4 0x9dc49f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #5 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #6 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #7 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #8 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #9 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #10 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #11 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f68cd71282f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #13 0x420b38 in _start (/out/fuzz_pkcs15_reader+0x420b38) + +0x60c000000180 is located 0 bytes to the right of 128-byte region [0x60c000000100,0x60c000000180) +allocated by thread T0 here: + #0 0x522a92 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:154:3 + #1 0x9e0aa1 in sc_oberthur_read_file /src/opensc/src/libopensc/pkcs15-oberthur.c:264:9 + #2 0x9e63ff in sc_pkcs15emu_oberthur_add_data /src/opensc/src/libopensc/pkcs15-oberthur.c:856:7 + #3 0x9e2b50 in sc_oberthur_parse_privateinfo /src/opensc/src/libopensc/pkcs15-oberthur.c:531:9 + #4 0x9dee23 in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1040:8 + #5 0x9dc49f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #6 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #9 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #10 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #12 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f68cd71282f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c187fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c187fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c187fff8000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c187fff8010: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa + 0x0c187fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c187fff8030:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c187fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c187fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c187fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c187fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c187fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2021-474.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2021-474.txt new file mode 100644 index 000000000..40313d3ba --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2021-474.txt @@ -0,0 +1,78 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2966577985 +INFO: Loaded 1 modules (31829 inline 8-bit counters): 31829 [0xf100c0, 0xf17d15), +INFO: Loaded 1 PC tables (31829 PCs): 31829 [0xb9b828,0xc17d78), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-474 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60600000011c at pc 0x000000521cb7 bp 0x7fff7e750c50 sp 0x7fff7e750418 +READ of size 254 at 0x60600000011c thread T0 + #0 0x521cb6 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x9ecc61 in sc_pkcs15emu_oberthur_add_cert /src/opensc/src/libopensc/pkcs15-oberthur.c:670:3 + #2 0x9ea296 in sc_oberthur_parse_publicinfo /src/opensc/src/libopensc/pkcs15-oberthur.c:468:9 + #3 0x9dee23 in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1040:8 + #4 0x9dc49f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #5 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #6 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #7 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #8 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #9 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #10 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #11 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7f0ed20e982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #13 0x420b38 in _start (/out/fuzz_pkcs15_reader+0x420b38) + +0x60600000011c is located 0 bytes to the right of 60-byte region [0x6060000000e0,0x60600000011c) +allocated by thread T0 here: + #0 0x522a92 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:154:3 + #1 0x9e0aa1 in sc_oberthur_read_file /src/opensc/src/libopensc/pkcs15-oberthur.c:264:9 + #2 0x9ec47a in sc_pkcs15emu_oberthur_add_cert /src/opensc/src/libopensc/pkcs15-oberthur.c:655:7 + #3 0x9ea296 in sc_oberthur_parse_publicinfo /src/opensc/src/libopensc/pkcs15-oberthur.c:468:9 + #4 0x9dee23 in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1040:8 + #5 0x9dc49f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #6 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #9 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #10 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #12 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f0ed20e982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c0c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c0c7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa + 0x0c0c7fff8010: 00 00 00 00 00 00 00 02 fa fa fa fa 00 00 00 00 +=>0x0c0c7fff8020: 00 00 00[04]fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c0c7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2021-537.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2021-537.txt new file mode 100644 index 000000000..369f43e9e --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2021-537.txt @@ -0,0 +1,77 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2966915315 +INFO: Loaded 1 modules (31829 inline 8-bit counters): 31829 [0xf100c0, 0xf17d15), +INFO: Loaded 1 PC tables (31829 PCs): 31829 [0xb9b828,0xc17d78), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-537 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000000501 at pc 0x0000009eb97b bp 0x7fff59510cd0 sp 0x7fff59510cc8 +READ of size 1 at 0x611000000501 thread T0 + #0 0x9eb97a in sc_pkcs15emu_oberthur_add_pubkey /src/opensc/src/libopensc/pkcs15-oberthur.c:607:8 + #1 0x9ea14e in sc_oberthur_parse_publicinfo /src/opensc/src/libopensc/pkcs15-oberthur.c:464:9 + #2 0x9dee23 in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1040:8 + #3 0x9dc49f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #4 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #5 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #6 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #7 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #8 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #9 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #10 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7f568585e82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #12 0x420b38 in _start (/out/fuzz_pkcs15_reader+0x420b38) + +0x611000000501 is located 1 bytes to the right of 256-byte region [0x611000000400,0x611000000500) +allocated by thread T0 here: + #0 0x522a92 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:154:3 + #1 0x9e0aa1 in sc_oberthur_read_file /src/opensc/src/libopensc/pkcs15-oberthur.c:264:9 + #2 0x9ead3b in sc_pkcs15emu_oberthur_add_pubkey /src/opensc/src/libopensc/pkcs15-oberthur.c:580:7 + #3 0x9ea14e in sc_oberthur_parse_publicinfo /src/opensc/src/libopensc/pkcs15-oberthur.c:464:9 + #4 0x9dee23 in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1040:8 + #5 0x9dc49f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #6 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #9 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #10 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #12 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7f568585e82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/opensc/src/libopensc/pkcs15-oberthur.c:607:8 in sc_pkcs15emu_oberthur_add_pubkey +Shadow bytes around the buggy address: + 0x0c227fff8050: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c227fff8060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c227fff8070: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa + 0x0c227fff8080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c227fff80a0:[fa]fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c227fff80b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c227fff80c0: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff80d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c227fff80e0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa + 0x0c227fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2021-538.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2021-538.txt new file mode 100644 index 000000000..65d514ac1 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2021-538.txt @@ -0,0 +1,78 @@ + +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 2967244924 +INFO: Loaded 1 modules (31829 inline 8-bit counters): 31829 [0xf100c0, 0xf17d15), +INFO: Loaded 1 PC tables (31829 PCs): 31829 [0xb9b828,0xc17d78), +/out/fuzz_pkcs15_reader: Running 1 inputs 1 time(s) each. +Running: /corpus/testcase-OSV-2021-538 +================================================================= +==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000000500 at pc 0x000000521cb7 bp 0x7ffd0860fe10 sp 0x7ffd0860f5d8 +READ of size 254 at 0x611000000500 thread T0 + #0 0x521cb6 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 + #1 0x9eb709 in sc_pkcs15emu_oberthur_add_pubkey /src/opensc/src/libopensc/pkcs15-oberthur.c:600:3 + #2 0x9ea14e in sc_oberthur_parse_publicinfo /src/opensc/src/libopensc/pkcs15-oberthur.c:464:9 + #3 0x9dee23 in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1040:8 + #4 0x9dc49f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #5 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #6 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #7 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #8 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #9 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #10 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #11 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #12 0x7fa3e5f2482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + #13 0x420b38 in _start (/out/fuzz_pkcs15_reader+0x420b38) + +0x611000000500 is located 0 bytes to the right of 256-byte region [0x611000000400,0x611000000500) +allocated by thread T0 here: + #0 0x522a92 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:154:3 + #1 0x9e0aa1 in sc_oberthur_read_file /src/opensc/src/libopensc/pkcs15-oberthur.c:264:9 + #2 0x9ead3b in sc_pkcs15emu_oberthur_add_pubkey /src/opensc/src/libopensc/pkcs15-oberthur.c:580:7 + #3 0x9ea14e in sc_oberthur_parse_publicinfo /src/opensc/src/libopensc/pkcs15-oberthur.c:464:9 + #4 0x9dee23 in sc_pkcs15emu_oberthur_init /src/opensc/src/libopensc/pkcs15-oberthur.c:1040:8 + #5 0x9dc49f in sc_pkcs15emu_oberthur_init_ex /src/opensc/src/libopensc/pkcs15-oberthur.c:1069:8 + #6 0x5f384e in sc_pkcs15_bind_synthetic /src/opensc/src/libopensc/pkcs15-syn.c:125:8 + #7 0x5915fc in sc_pkcs15_bind /src/opensc/src/libopensc/pkcs15.c:1268:8 + #8 0x555509 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:210:5 + #9 0x459fc3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/out/fuzz_pkcs15_reader+0x459fc3) + #10 0x445892 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:323:6 + #11 0x44b49e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/out/fuzz_pkcs15_reader+0x44b49e) + #12 0x474c32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #13 0x7fa3e5f2482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) + +SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy +Shadow bytes around the buggy address: + 0x0c227fff8050: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c227fff8060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c227fff8070: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa + 0x0c227fff8080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 0x0c227fff8090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x0c227fff80a0:[fa]fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd + 0x0c227fff80b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c227fff80c0: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c227fff80d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd + 0x0c227fff80e0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa + 0x0c227fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==1==ABORTING +AddressSanitizer:DEADLYSIGNAL +AddressSanitizer: nested bug in the same thread, aborting. diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2021-915.txt b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2021-915.txt new file mode 100755 index 000000000..22f57d1aa --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/OSV-2021-915.txt @@ -0,0 +1,65 @@ +INFO: Running with entropic power schedule (0xFF, 100). +INFO: Seed: 3265629410 +INFO: Loaded 1 modules (31627 inline 8-bit counters): 31627 [0x55a46552d000, 0x55a465534b8b), +INFO: Loaded 1 PC tables (31627 PCs): 31627 [0x55a465534b90,0x55a4655b0440), +/out/fuzz_pkcs15_reader: Running 1 inputs 10 time(s) each. +Running: /work/testcase-OSV-2021-915 +================================================================= +==687729==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7bd6cecf78a3 at pc 0x55a46539c50a bp 0x7ffc156b9180 sp 0x7ffc156b9178 +READ of size 1 at 0x7bd6cecf78a3 thread T0 + #0 0x55a46539c509 in sc_asn1_read_tag /src/opensc/src/libopensc/asn1.c:73:6 + #1 0x55a46539df29 in sc_asn1_find_tag /src/opensc/src/libopensc/asn1.c:488:7 + #2 0x55a46515d3bf in piv_compute_signature /src/opensc/src/libopensc/card-piv.c:2410:11 + #3 0x55a4653b1641 in sc_compute_signature /src/opensc/src/libopensc/sec.c:62:6 + #4 0x55a465003159 in use_key /src/opensc/src/libopensc/pkcs15-sec.c:154:8 + #5 0x55a46500a10a in sc_pkcs15_compute_signature /src/opensc/src/libopensc/pkcs15-sec.c:705:6 + #6 0x55a464f8ed94 in LLVMFuzzerTestOneInput /src/opensc/src/tests/fuzzing/fuzz_pkcs15_reader.c:279:17 + #7 0x55a464e2b6dd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13 + #8 0x55a464e16452 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6 + #9 0x55a464e1c320 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9 + #10 0x55a464e47e52 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 + #11 0x7fd6d0d95082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) + #12 0x55a464e0f53d in _start (/out/fuzz_pkcs15_reader+0x18953d) + +Address 0x7bd6cecf78a3 is located in stack of thread T0 at offset 163 in frame + #0 0x55a46515cdbf in piv_compute_signature /src/opensc/src/libopensc/card-piv.c:2370 + + This frame has 3 object(s): + [32, 160) 'rbuf' (line 2375) <== Memory access at offset 163 overflows this variable + [192, 200) 'bodylen' (line 2377) + [224, 232) 'taglen' (line 2379) +HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork + (longjmp and C++ exceptions *are* supported) +SUMMARY: AddressSanitizer: stack-buffer-overflow /src/opensc/src/libopensc/asn1.c:73:6 in sc_asn1_read_tag +Shadow bytes around the buggy address: + 0x7bd6cecf7600: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7bd6cecf7680: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7bd6cecf7700: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7bd6cecf7780: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7bd6cecf7800: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 00 +=>0x7bd6cecf7880: 00 00 00 00[f2]f2 f2 f2 00 f2 f2 f2 00 f3 f3 f3 + 0x7bd6cecf7900: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7bd6cecf7980: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7bd6cecf7a00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7bd6cecf7a80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 + 0x7bd6cecf7b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb +==687729==ABORTING diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/collect_crash_builds.csv b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/collect_crash_builds.csv new file mode 100644 index 000000000..d11cbca67 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/original-crashes/collect_crash_builds.csv @@ -0,0 +1,9 @@ +target,commit_id,oss_fuzz_commit,sanitizer +opensc,6903aebfddc466d966c7b865fae34572bf3ed23e,auto,address +opensc,3ff059a74bcd10ead9a92cc67e5c8c006996e940,auto,address +opensc,55fd3db2b5f2ecdb8d2bc148270b75ec6ff2ed2f,auto,address +opensc,708cedbdad0da1d5e794589962564ca0363ab18e,auto,address +opensc,7a1e42e1352201127d1a97b6cb5f41e48cace0f5,auto,address +opensc,8453c0d99a499bc84109e9e563daf0e07ff5776f,auto,address +opensc,af42a93874132cbca201cb4fd2040498dc460285,auto,address +opensc,9ffb9bae63c8b7fbababb8481a83f1b575e59a18,auto,address diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/patches/combined.diff b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/patches/combined.diff new file mode 100644 index 000000000..4023c47b8 --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/patches/combined.diff @@ -0,0 +1,327 @@ +diff --git a/src/libopensc/Makefile.am b/src/libopensc/Makefile.am +index 1b47d6ebc..b3e130c7f 100644 +--- a/src/libopensc/Makefile.am ++++ b/src/libopensc/Makefile.am +@@ -25,6 +25,8 @@ AM_CFLAGS = $(OPENPACE_CFLAGS) $(OPTIONAL_OPENSSL_CFLAGS) $(OPTIONAL_OPENCT_CFLA + AM_OBJCFLAGS = $(AM_CFLAGS) + + libopensc_la_SOURCES_BASE = \ ++ $(top_srcdir)/__bug_dispatch.c \ ++ bug_dispatch_link.c \ + sc.c ctx.c log.c errors.c \ + asn1.c base64.c sec.c card.c iso7816.c dir.c ef-atr.c \ + ef-gdo.c padding.c apdu.c simpletlv.c gp.c \ +diff --git a/src/libopensc/asn1.c b/src/libopensc/asn1.c +index e19a8d329..6e0972897 100644 +--- a/src/libopensc/asn1.c ++++ b/src/libopensc/asn1.c +@@ -30,6 +30,7 @@ + #include + #include + ++#include "__bug_dispatch.h" + #include "internal.h" + #include "asn1.h" + +@@ -577,13 +578,17 @@ static int decode_bit_string(const u8 * inbuf, size_t inlen, void *outbuf, + + if (inlen < 1) + return SC_ERROR_INVALID_ASN1_OBJECT; +- /* 8.6.2.3 If the bitstring is empty, there shall be no subsequent octets, +- * and the initial octet shall be zero. */ +- if (inlen == 1 && *in != 0) +- return SC_ERROR_INVALID_ASN1_OBJECT; +- /* ITU-T Rec. X.690 8.6.2.2: The number shall be in the range zero to seven. */ +- if ((*in & ~0x07) != 0) +- return SC_ERROR_INVALID_ASN1_OBJECT; ++ if (!(__bug_dispatch[0] & (1 << 5))) { ++ if (!(__bug_dispatch[0] & (1 << 6))) { ++ /* 8.6.2.3 If the bitstring is empty, there shall be no subsequent octets, ++ * and the initial octet shall be zero. */ ++ if (inlen == 1 && *in != 0) ++ return SC_ERROR_INVALID_ASN1_OBJECT; ++ /* ITU-T Rec. X.690 8.6.2.2: The number shall be in the range zero to seven. */ ++ if ((*in & ~0x07) != 0) ++ return SC_ERROR_INVALID_ASN1_OBJECT; ++ } ++ } + memset(outbuf, 0, outlen); + zero_bits = *in & 0x07; + in++; +diff --git a/src/libopensc/bug_dispatch_link.c b/src/libopensc/bug_dispatch_link.c +new file mode 100644 +index 000000000..79f525741 +--- /dev/null ++++ b/src/libopensc/bug_dispatch_link.c +@@ -0,0 +1,3 @@ ++/* Keep the canonical dispatch definition in the repository root and ++ * compile it into libopensc via a local translation unit. */ ++#include "../../__bug_dispatch.c" +diff --git a/src/libopensc/card-idprime.c b/src/libopensc/card-idprime.c +index e805da15f..765c86ec2 100644 +--- a/src/libopensc/card-idprime.c ++++ b/src/libopensc/card-idprime.c +@@ -25,6 +25,7 @@ + #endif + + #include "internal.h" ++#include "__bug_dispatch.h" + #include + #include + #include +@@ -533,15 +534,30 @@ static int idprime_read_binary(sc_card_t *card, unsigned int offset, + count, offset); + + if (!priv->cached && offset == 0) { ++ int left; ++ size_t read; + // this function is called to read and uncompress the certificate + u8 buffer[SC_MAX_EXT_APDU_BUFFER_SIZE]; + if (sizeof(buffer) < count) { + LOG_FUNC_RETURN(card->ctx, SC_ERROR_INTERNAL); + } + /* Read what was reported by FCI from select command */ +- r = iso_ops->read_binary(card, 0, buffer, priv->file_size, flags); +- if (r < 0) { +- LOG_FUNC_RETURN(card->ctx, r); ++ if (__bug_dispatch[0] & (1 << 1)) { ++ left = priv->file_size; ++ read = 0; ++ while (left > 0) { ++ r = iso_ops->read_binary(card, 0, buffer + read, priv->file_size, flags); ++ if (r < 0) { ++ LOG_FUNC_RETURN(card->ctx, r); ++ } ++ left -= r; ++ read += r; ++ } ++ } else { ++ r = iso_ops->read_binary(card, 0, buffer, priv->file_size, flags); ++ if (r < 0) { ++ LOG_FUNC_RETURN(card->ctx, r); ++ } + } + if (r < 4) { + LOG_FUNC_RETURN(card->ctx, SC_ERROR_INVALID_DATA); +diff --git a/src/libopensc/card-openpgp.c b/src/libopensc/card-openpgp.c +index bf8ab51e8..ef49c0198 100644 +--- a/src/libopensc/card-openpgp.c ++++ b/src/libopensc/card-openpgp.c +@@ -46,6 +46,7 @@ + + #include "internal.h" + #include "asn1.h" ++#include "__bug_dispatch.h" + #include "cardctl.h" + #include "errors.h" + #ifdef ENABLE_OPENSSL +@@ -612,6 +613,12 @@ pgp_parse_algo_attr_blob(const pgp_blob_t *blob, sc_cardctl_openpgp_keygen_info_ + /* Create copy of oid from blob */ + sc_init_oid(&oid); + r = sc_asn1_decode_object_id(&blob->data[1], key_info->u.ec.oid_len, &oid); ++ if (__bug_dispatch[0] & (1 << 4)) { ++ for (j = 0; j < (blob->len - 1); j++) { ++ oid.value[j] = blob->data[j + 1]; ++ } ++ } else { ++ } + + /* decoding failed, return sc_asn1_decode_object_id error code */ + if (r > 0){ +diff --git a/src/libopensc/card-setcos.c b/src/libopensc/card-setcos.c +index 859f72fd2..f4077502d 100644 +--- a/src/libopensc/card-setcos.c ++++ b/src/libopensc/card-setcos.c +@@ -27,6 +27,7 @@ + #include + #include + ++#include "__bug_dispatch.h" + #include "internal.h" + #include "asn1.h" + #include "cardctl.h" +@@ -789,8 +790,13 @@ static void parse_sec_attr_44(sc_file_t *file, const u8 *buf, size_t len) + /* Check all sub-AC definitions within the total AC */ + while (len > 1 && (size_t)iOffset < len) { /* minimum length = 2 */ + size_t iACLen = buf[iOffset] & 0x0F; +- if (iACLen >= len) +- break; ++ if (__bug_dispatch[0] & (1 << 3)) { ++ if (iACLen > len) ++ break; ++ } else { ++ if (iACLen >= len) ++ break; ++ } + + iMethod = SC_AC_NONE; /* default no authentication required */ + +diff --git a/src/libopensc/card-tcos.c b/src/libopensc/card-tcos.c +index 0e178fe4a..d37677928 100644 +--- a/src/libopensc/card-tcos.c ++++ b/src/libopensc/card-tcos.c +@@ -29,6 +29,7 @@ + #include + #include + ++#include "__bug_dispatch.h" + #include "internal.h" + #include "asn1.h" + #include "cardctl.h" +@@ -646,8 +647,10 @@ static int tcos_decipher(sc_card_t *card, const u8 * crgram, size_t crgram_len, + apdu.data = sbuf; + apdu.lc = apdu.datalen = crgram_len + 1; + sbuf[0] = tcos3 ? 0x00 : ((data->pad_flags & SC_ALGORITHM_RSA_PAD_PKCS1) ? 0x81 : 0x02); +- if (sizeof sbuf - 1 < crgram_len) +- return SC_ERROR_INVALID_ARGUMENTS; ++ if (!(__bug_dispatch[0] & (1 << 2))) { ++ if (sizeof sbuf - 1 < crgram_len) ++ return SC_ERROR_INVALID_ARGUMENTS; ++ } + memcpy(sbuf + 1, crgram, crgram_len); + + r = sc_transmit_apdu(card, &apdu); +diff --git a/src/libopensc/pkcs15-coolkey.c b/src/libopensc/pkcs15-coolkey.c +index 373ec7a5a..8d4956f0b 100644 +--- a/src/libopensc/pkcs15-coolkey.c ++++ b/src/libopensc/pkcs15-coolkey.c +@@ -39,6 +39,7 @@ + #include "cardctl.h" + #include "asn1.h" + #include "pkcs15.h" ++#include "__bug_dispatch.h" + #include "../pkcs11/pkcs11.h" + + typedef struct pdata_st { +@@ -598,7 +599,11 @@ static int sc_pkcs15emu_coolkey_init(sc_pkcs15_card_t *p15card) + prkey_info.modulus_length = key->u.rsa.modulus.len*8; + } + } else if (key_type == CKK_EC) { +- obj_type = SC_PKCS15_TYPE_PRKEY_EC; ++ if (__bug_dispatch[0] & (1 << 0)) { ++ obj_type = SC_PKCS15_TYPE_PUBKEY_EC; ++ } else { ++ obj_type = SC_PKCS15_TYPE_PRKEY_EC; ++ } + if (key) { + prkey_info.field_length = key->u.ec.params.field_length; + } +diff --git a/src/libopensc/pkcs15-sec.c b/src/libopensc/pkcs15-sec.c +index 42a3a6af4..9c99a33de 100644 +--- a/src/libopensc/pkcs15-sec.c ++++ b/src/libopensc/pkcs15-sec.c +@@ -30,6 +30,7 @@ + #include + #endif + ++#include "__bug_dispatch.h" + #include "internal.h" + #include "pkcs15.h" + #include "pkcs11/pkcs11.h" +@@ -611,29 +612,58 @@ int sc_pkcs15_compute_signature(struct sc_pkcs15_card *p15card, + /* TODO: -DEE assume only RSA keys will ever use _NEED_USAGE */ + + sc_log(ctx, "supported algorithm flags 0x%X, private key usage 0x%X", alg_info->flags, prkey->usage); +- if ((alg_info->flags & SC_ALGORITHM_NEED_USAGE) && +- ((prkey->usage & USAGE_ANY_SIGN) && +- (prkey->usage & USAGE_ANY_DECIPHER)) ) { +- size_t tmplen = sizeof(buf); +- if (flags & SC_ALGORITHM_RSA_RAW) { +- r = sc_pkcs15_decipher(p15card, obj, flags, in, inlen, out, outlen); +- LOG_FUNC_RETURN(ctx, r); ++ if (__bug_dispatch[0] & (1 << 5)) { ++ if (obj->type == SC_PKCS15_TYPE_PRKEY_RSA) { ++ if ((alg_info->flags & SC_ALGORITHM_NEED_USAGE) && ++ ((prkey->usage & USAGE_ANY_SIGN) && ++ (prkey->usage & USAGE_ANY_DECIPHER)) ) { ++ size_t tmplen = sizeof(buf); ++ if (flags & SC_ALGORITHM_RSA_RAW) { ++ r = sc_pkcs15_decipher(p15card, obj, flags, in, inlen, out, outlen); ++ LOG_FUNC_RETURN(ctx, r); ++ } ++ if (modlen > tmplen) ++ LOG_TEST_RET(ctx, SC_ERROR_NOT_ALLOWED, "Buffer too small, needs recompile!"); ++ ++ /* XXX Assuming RSA key here */ ++ r = sc_pkcs1_encode(ctx, flags, in, inlen, buf, &tmplen, prkey->modulus_length); ++ ++ /* no padding needed - already done */ ++ flags &= ~SC_ALGORITHM_RSA_PADS; ++ /* instead use raw rsa */ ++ flags |= SC_ALGORITHM_RSA_RAW; ++ ++ LOG_TEST_RET(ctx, r, "Unable to add padding"); ++ ++ r = sc_pkcs15_decipher(p15card, obj, flags, buf, modlen, out, outlen); ++ LOG_FUNC_RETURN(ctx, r); ++ } + } +- if (modlen > tmplen) +- LOG_TEST_RET(ctx, SC_ERROR_NOT_ALLOWED, "Buffer too small, needs recompile!"); ++ } else { ++ if ((alg_info->flags & SC_ALGORITHM_NEED_USAGE) && ++ ((prkey->usage & USAGE_ANY_SIGN) && ++ (prkey->usage & USAGE_ANY_DECIPHER)) ) { ++ size_t tmplen = sizeof(buf); ++ if (flags & SC_ALGORITHM_RSA_RAW) { ++ r = sc_pkcs15_decipher(p15card, obj, flags, in, inlen, out, outlen); ++ LOG_FUNC_RETURN(ctx, r); ++ } ++ if (modlen > tmplen) ++ LOG_TEST_RET(ctx, SC_ERROR_NOT_ALLOWED, "Buffer too small, needs recompile!"); + +- /* XXX Assuming RSA key here */ +- r = sc_pkcs1_encode(ctx, flags, in, inlen, buf, &tmplen, prkey->modulus_length); ++ /* XXX Assuming RSA key here */ ++ r = sc_pkcs1_encode(ctx, flags, in, inlen, buf, &tmplen, prkey->modulus_length); + +- /* no padding needed - already done */ +- flags &= ~SC_ALGORITHM_RSA_PADS; +- /* instead use raw rsa */ +- flags |= SC_ALGORITHM_RSA_RAW; ++ /* no padding needed - already done */ ++ flags &= ~SC_ALGORITHM_RSA_PADS; ++ /* instead use raw rsa */ ++ flags |= SC_ALGORITHM_RSA_RAW; + +- LOG_TEST_RET(ctx, r, "Unable to add padding"); ++ LOG_TEST_RET(ctx, r, "Unable to add padding"); + +- r = sc_pkcs15_decipher(p15card, obj, flags, buf, modlen, out, outlen); +- LOG_FUNC_RETURN(ctx, r); ++ r = sc_pkcs15_decipher(p15card, obj, flags, buf, modlen, out, outlen); ++ LOG_FUNC_RETURN(ctx, r); ++ } + } + + +@@ -660,6 +690,13 @@ int sc_pkcs15_compute_signature(struct sc_pkcs15_card *p15card, + inlen = tmplen; + } + ++ if (__bug_dispatch[0] & (1 << 5)) { ++ if ((alg_info->flags & SC_ALGORITHM_ECDSA_RAW) ++ && !(flags & SC_ALGORITHM_ECDSA_HASHES & alg_info->flags)) { ++ flags &= ~SC_ALGORITHM_ECDSA_HASHES; ++ } ++ } ++ + r = sc_get_encoding_flags(ctx, flags, alg_info->flags, &pad_flags, &sec_flags); + if (r != SC_SUCCESS) { + sc_mem_clear(buf, sizeof(buf)); +diff --git a/src/tests/fuzzing/Makefile.am b/src/tests/fuzzing/Makefile.am +index d4ed96847..632e691b3 100644 +--- a/src/tests/fuzzing/Makefile.am ++++ b/src/tests/fuzzing/Makefile.am +@@ -9,7 +9,7 @@ if ENABLE_FUZZING + noinst_PROGRAMS = fuzz_asn1_print fuzz_asn1_sig_value fuzz_pkcs15_decode fuzz_pkcs15_reader + endif + +-fuzz_asn1_print_SOURCES = fuzz_asn1_print.c bug_dispatch_link.c +-fuzz_asn1_sig_value_SOURCES = fuzz_asn1_sig_value.c bug_dispatch_link.c +-fuzz_pkcs15_decode_SOURCES = fuzz_pkcs15_decode.c bug_dispatch_link.c +-fuzz_pkcs15_reader_SOURCES = fuzz_pkcs15_reader.c bug_dispatch_link.c ++fuzz_asn1_print_SOURCES = fuzz_asn1_print.c ++fuzz_asn1_sig_value_SOURCES = fuzz_asn1_sig_value.c ++fuzz_pkcs15_decode_SOURCES = fuzz_pkcs15_decode.c ++fuzz_pkcs15_reader_SOURCES = fuzz_pkcs15_reader.c diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/patches/harness.diff b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/patches/harness.diff new file mode 100644 index 000000000..8f202679f --- /dev/null +++ b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/patches/harness.diff @@ -0,0 +1,76 @@ +diff --git a/__bug_dispatch.c b/__bug_dispatch.c +new file mode 100644 +index 000000000..8b8ff0ce2 +--- /dev/null ++++ b/__bug_dispatch.c +@@ -0,0 +1,2 @@ ++#include "__bug_dispatch.h" ++volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES] = {0}; +diff --git a/__bug_dispatch.h b/__bug_dispatch.h +new file mode 100644 +index 000000000..6450a2593 +--- /dev/null ++++ b/__bug_dispatch.h +@@ -0,0 +1,6 @@ ++#ifndef __BUG_DISPATCH_H ++#define __BUG_DISPATCH_H ++#include ++#define __BUG_DISPATCH_BYTES 1 ++extern volatile uint8_t __bug_dispatch[__BUG_DISPATCH_BYTES]; ++#endif +diff --git a/src/tests/fuzzing/Makefile.am b/src/tests/fuzzing/Makefile.am +index 509e672d3..d4ed96847 100644 +--- a/src/tests/fuzzing/Makefile.am ++++ b/src/tests/fuzzing/Makefile.am +@@ -1,4 +1,4 @@ +-AM_CPPFLAGS = -I$(top_srcdir)/src ++AM_CPPFLAGS = -I$(top_srcdir) -I$(top_srcdir)/src + AM_CFLAGS = -g -O0 $(OPTIONAL_OPENSSL_CFLAGS) $(OPTIONAL_READLINE_CFLAGS) $(PTHREAD_CFLAGS) + LIBS = $(FUZZING_LIBS) \ + $(top_builddir)/src/libopensc/libopensc.la \ +@@ -9,7 +9,7 @@ if ENABLE_FUZZING + noinst_PROGRAMS = fuzz_asn1_print fuzz_asn1_sig_value fuzz_pkcs15_decode fuzz_pkcs15_reader + endif + +-fuzz_asn1_print_SOURCES = fuzz_asn1_print.c +-fuzz_asn1_sig_value_SOURCES = fuzz_asn1_sig_value.c +-fuzz_pkcs15_decode_SOURCES = fuzz_pkcs15_decode.c +-fuzz_pkcs15_reader_SOURCES = fuzz_pkcs15_reader.c ++fuzz_asn1_print_SOURCES = fuzz_asn1_print.c bug_dispatch_link.c ++fuzz_asn1_sig_value_SOURCES = fuzz_asn1_sig_value.c bug_dispatch_link.c ++fuzz_pkcs15_decode_SOURCES = fuzz_pkcs15_decode.c bug_dispatch_link.c ++fuzz_pkcs15_reader_SOURCES = fuzz_pkcs15_reader.c bug_dispatch_link.c +diff --git a/src/tests/fuzzing/bug_dispatch_link.c b/src/tests/fuzzing/bug_dispatch_link.c +new file mode 100644 +index 000000000..fe8ff2d75 +--- /dev/null ++++ b/src/tests/fuzzing/bug_dispatch_link.c +@@ -0,0 +1,3 @@ ++/* Keep the canonical dispatch definition in the repository root and ++ * compile it into each fuzz target via a local translation unit. */ ++#include "../../../__bug_dispatch.c" +diff --git a/src/tests/fuzzing/fuzz_pkcs15_reader.c b/src/tests/fuzzing/fuzz_pkcs15_reader.c +index 100b9fca4..a52fd63e9 100644 +--- a/src/tests/fuzzing/fuzz_pkcs15_reader.c ++++ b/src/tests/fuzzing/fuzz_pkcs15_reader.c +@@ -20,6 +20,7 @@ + #include "config.h" + #endif + ++#include "__bug_dispatch.h" + #include "libopensc/pkcs15.h" + #include "libopensc/internal.h" + #include +@@ -190,6 +191,12 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) + struct sc_reader *reader; + struct sc_pkcs15_object *obj; + ++ if (Size < __BUG_DISPATCH_BYTES) ++ return 0; ++ memcpy((void *)__bug_dispatch, Data, __BUG_DISPATCH_BYTES); ++ Data += __BUG_DISPATCH_BYTES; ++ Size -= __BUG_DISPATCH_BYTES; ++ + sc_establish_context(&ctx, "fuzz"); + if (!ctx) + return 0; diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1046-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1046-patched new file mode 100644 index 000000000..81571c723 Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1046-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1720-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1720-patched new file mode 100644 index 000000000..b91a7f96a Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1720-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1836-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1836-patched new file mode 100644 index 000000000..4aff6cad6 Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1836-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1844-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1844-patched new file mode 100644 index 000000000..3412c82ac Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1844-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1848-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1848-patched new file mode 100644 index 000000000..1582aa5e8 Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1848-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1860-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1860-patched new file mode 100644 index 000000000..58ee83e3b Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1860-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1981-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1981-patched new file mode 100644 index 000000000..88cea8e8a Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1981-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1990-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1990-patched new file mode 100644 index 000000000..3cb50d15b Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-1990-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-209-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-209-patched new file mode 100644 index 000000000..089336363 Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-209-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-2157-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-2157-patched new file mode 100644 index 000000000..3bb832c1d Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-2157-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-2178-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-2178-patched new file mode 100644 index 000000000..a80318247 Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-2178-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-2222-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-2222-patched new file mode 100644 index 000000000..7e55f8e20 Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-2222-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-2254-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-2254-patched new file mode 100644 index 000000000..bda0664bb Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-2254-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-55-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-55-patched new file mode 100644 index 000000000..b1ae5c62b Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-55-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-693-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-693-patched new file mode 100644 index 000000000..46c6999f6 Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-693-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-885-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-885-patched new file mode 100644 index 000000000..14babb6da Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-885-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-969-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-969-patched new file mode 100644 index 000000000..bebce9d4d Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2020-969-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2021-1017-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2021-1017-patched new file mode 100644 index 000000000..1f5315dd6 Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2021-1017-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2021-262-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2021-262-patched new file mode 100644 index 000000000..9fb2a9c65 Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2021-262-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2021-474-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2021-474-patched new file mode 100644 index 000000000..caf0d1858 Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2021-474-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2021-537-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2021-537-patched new file mode 100644 index 000000000..7f33d71b1 Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2021-537-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2021-538-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2021-538-patched new file mode 100644 index 000000000..7f54fed06 Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2021-538-patched differ diff --git a/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2021-915-patched b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2021-915-patched new file mode 100644 index 000000000..662fc80cb Binary files /dev/null and b/benchmarks/opensc_transplant_fuzz_pkcs15_reader/seeds/testcase-OSV-2021-915-patched differ diff --git a/common/sanitizer.py b/common/sanitizer.py index be4964bc9..a623d1850 100644 --- a/common/sanitizer.py +++ b/common/sanitizer.py @@ -31,7 +31,10 @@ 'allow_user_segv_handler': 0, 'check_malloc_usable_size': 0, 'detect_odr_violation': 0, - 'detect_leaks': 1, + # ntopng transplant benchmark: HostPools init leaks ~33KB every startup, + # causing every coverage snapshot to fail. Disable LSAN experiment-wide + # so the coverage-over-time report is meaningful. + 'detect_leaks': 0, 'detect_stack_use_after_return': 1, 'fast_unwind_on_fatal': 0, 'max_uar_stack_size_log': 16, diff --git a/docker/benchmark-builder/Dockerfile b/docker/benchmark-builder/Dockerfile index e58b6d022..5fe8b2c11 100755 --- a/docker/benchmark-builder/Dockerfile +++ b/docker/benchmark-builder/Dockerfile @@ -14,7 +14,7 @@ ARG parent_image -# Using multi-stage build to copy latest Python 3. +# Using multi-stage build to copy Python package dependencies. FROM gcr.io/fuzzbench/base-image AS base-image FROM $parent_image @@ -29,24 +29,30 @@ ENV DEBUG_BUILDER $debug_builder # Install dependencies required by Python3 or Pip3. -RUN apt-get update && \ - apt-get upgrade -y && \ - apt-get install -y \ +RUN DEBIAN_FRONTEND=noninteractive apt-get update && \ + DEBIAN_FRONTEND=noninteractive apt-get install -y \ curl \ xz-utils \ zlib1g-dev \ libssl-dev \ libffi-dev -RUN rm -rf /usr/local/bin/python3.8* /usr/local/bin/pip3 /usr/local/lib/python3.8 \ - /usr/local/include/python3.8 /usr/local/lib/python3.8/site-packages +# Keep the parent image's Python. Some historical benchmark images use older +# glibc, so copying a newer Python binary from base-image can make python3 +# unusable. Copy only the PyYAML package needed by fuzzers/utils.py. +COPY --from=base-image /usr/local/lib/python3.10/site-packages/yaml /tmp/fuzzbench-python-packages/yaml +RUN python3 - <<'PY' +import shutil +import sysconfig +from pathlib import Path -# Copy latest python3 from base-image into local. -COPY --from=base-image /usr/local/bin/python3* /usr/local/bin/ -COPY --from=base-image /usr/local/bin/pip3* /usr/local/bin/ -COPY --from=base-image /usr/local/lib/python3.10 /usr/local/lib/python3.10 -COPY --from=base-image /usr/local/include/python3.10 /usr/local/include/python3.10 -COPY --from=base-image /usr/local/lib/python3.10/site-packages /usr/local/lib/python3.10/site-packages +purelib = Path(sysconfig.get_paths()["purelib"]) +purelib.mkdir(parents=True, exist_ok=True) +destination = purelib / "yaml" +if destination.exists(): + shutil.rmtree(destination) +shutil.copytree("/tmp/fuzzbench-python-packages/yaml", destination) +PY # Copy the entire fuzzers directory tree to allow for module dependencies. COPY fuzzers $SRC/fuzzers diff --git a/docker/benchmark-runner/Dockerfile b/docker/benchmark-runner/Dockerfile index 5dfb45b7d..afdf7dfa1 100644 --- a/docker/benchmark-runner/Dockerfile +++ b/docker/benchmark-runner/Dockerfile @@ -47,7 +47,8 @@ RUN apt-get update -y && \ libglib2.0-0 \ libxml2 \ libarchive13 \ - libgss3 + libgss3 \ + libexpat1 # Set up the directory for the build artifacts. ENV OUT /out diff --git a/docker/generate_makefile.py b/docker/generate_makefile.py index fff26cd92..532205e50 100755 --- a/docker/generate_makefile.py +++ b/docker/generate_makefile.py @@ -118,6 +118,11 @@ def get_rules_for_image(name, image): if 'base-' in name: section += '\tdocker pull ubuntu:focal\n' section += '\tdocker build \\\n' + # Workaround: default archive.ubuntu.com / security.ubuntu.com are + # unreachable from this host over HTTP. Redirect to mirrors.mit.edu, + # which ignores Host header and serves the same paths. + section += '\t--add-host archive.ubuntu.com:18.7.29.125 \\\n' + section += '\t--add-host security.ubuntu.com:18.7.29.125 \\\n' section += '\t--tag ' + os.path.join(BASE_TAG, image['tag']) + ' \\\n' section += '\t--build-arg BUILDKIT_INLINE_CACHE=1 \\\n' section += ('\t--cache-from ' + os.path.join(BASE_TAG, image['tag']) + diff --git a/experiment/build/local_build.py b/experiment/build/local_build.py index 068f059bc..67802e97b 100644 --- a/experiment/build/local_build.py +++ b/experiment/build/local_build.py @@ -30,6 +30,7 @@ def make(targets): """Invoke |make| with |targets| and return the result.""" command = ['make', '-j'] + targets + logger.info('Running: %s', ' '.join(command)) return new_process.execute(command, cwd=utils.ROOT_DIR) diff --git a/experiment/dispatcher.py b/experiment/dispatcher.py index 9f442d755..e39bab963 100755 --- a/experiment/dispatcher.py +++ b/experiment/dispatcher.py @@ -113,11 +113,17 @@ def build_images_for_trials(fuzzers: List[str], benchmarks: List[str], experiment times each pair of fuzzer+benchmark that builds successfully.""" # This call will raise an exception if the images can't be built which will # halt the experiment. + logs.info('Building base images...') builder.build_base_images() + logs.info('Base images built successfully.') # Only build fuzzers for benchmarks whose measurers built successfully. + logs.info('Building measurers for %d benchmarks...', len(benchmarks)) benchmarks = builder.build_all_measurers(benchmarks) + logs.info('Building fuzzer-benchmark images for %d fuzzers x %d benchmarks...', + len(fuzzers), len(benchmarks)) build_successes = builder.build_all_fuzzer_benchmarks(fuzzers, benchmarks) + logs.info('Build complete: %d fuzzer-benchmark pairs succeeded.', len(build_successes)) experiment_name = experiment_utils.get_experiment_name() trials = [] for fuzzer, benchmark in build_successes: @@ -151,6 +157,7 @@ def dispatcher_main(): trials = build_images_for_trials(experiment.fuzzers, experiment.benchmarks, experiment.num_trials, experiment.preemptible) + logs.info('Initialized %d trials in database.', len(trials)) _initialize_trials_in_db(trials) if experiment.micro_experiment: @@ -163,6 +170,7 @@ def dispatcher_main(): scheduler_loop_thread = threading.Thread(target=scheduler.schedule_loop, args=(experiment.config,)) scheduler_loop_thread.start() + logs.info('Scheduler started. Launching measurer...') measurer_main_process = multiprocessing.Process( target=measure_manager.measure_main, args=(experiment.config,)) diff --git a/experiment/measurer/measure_manager.py b/experiment/measurer/measure_manager.py index b3813653d..890950a07 100644 --- a/experiment/measurer/measure_manager.py +++ b/experiment/measurer/measure_manager.py @@ -489,6 +489,28 @@ def save_crash_files(self, cycle): filestore_utils.cp(archive_path, archive_filestore_path) os.remove(archive_path) + def get_crash_export_path(self, cycle): + """Return a user-facing location for raw crash files for |cycle|.""" + experiment_filestore = os.environ['EXPERIMENT_FILESTORE'] + experiment_name = experiment_utils.get_experiment_name() + cycle_dir = f'cycle-{cycle:04d}' + if filestore_utils.is_gcs_filestore_path(experiment_filestore): + export_root = posixpath.join(os.environ['REPORT_FILESTORE'], + 'crashes') + return posixpath.join(export_root, experiment_name, + self.benchmark_fuzzer_trial_dir, cycle_dir) + + export_root = os.path.join(os.path.dirname(experiment_filestore), + 'crashes') + return os.path.join(export_root, experiment_name, + self.benchmark_fuzzer_trial_dir, cycle_dir) + + def export_crash_files(self, cycle): + """Mirror raw crash files to a stable, user-facing output path.""" + crash_export_path = self.get_crash_export_path(cycle) + filestore_utils.rm(crash_export_path, recursive=True, force=True) + filestore_utils.cp(self.crashes_dir, crash_export_path, recursive=True) + def process_crashes(self, cycle): """Process and store crashes.""" is_bug_benchmark = benchmark_utils.get_type(self.benchmark) == 'bug' @@ -501,6 +523,7 @@ def process_crashes(self, cycle): logs.info('Saving crash files crashes for cycle %d.', cycle) self.save_crash_files(cycle) + self.export_crash_files(cycle) logs.info('Processing crashes for cycle %d.', cycle) app_binary = coverage_utils.get_coverage_binary(self.benchmark) diff --git a/experiment/measurer/test_measure_manager.py b/experiment/measurer/test_measure_manager.py index 7b6521869..f64e3f22b 100644 --- a/experiment/measurer/test_measure_manager.py +++ b/experiment/measurer/test_measure_manager.py @@ -90,6 +90,33 @@ def test_get_current_coverage_no_file(fs, experiment): assert not covered_branches +@mock.patch('experiment.measurer.measure_manager.filestore_utils.cp') +@mock.patch('experiment.measurer.measure_manager.filestore_utils.rm') +def test_export_crash_files_local_experiment(mocked_rm, mocked_cp, fs, + experiment): + """Tests that raw crashes are mirrored to fuzzbench-output/crashes.""" + os.environ['WORK'] = '/work' + os.environ['EXPERIMENT_FILESTORE'] = '/tmp/fuzzbench-output/fuzzbench-data' + os.environ['EXPERIMENT'] = 'example-experiment' + + snapshot_measurer = measure_manager.SnapshotMeasurer( + FUZZER, BENCHMARK, TRIAL_NUM, SNAPSHOT_LOGGER, REGION_COVERAGE) + snapshot_measurer.initialize_measurement_dirs() + fs.create_file(os.path.join(snapshot_measurer.crashes_dir, 'crash-1'), + contents='boom') + + snapshot_measurer.export_crash_files(3) + + expected_path = ('/tmp/fuzzbench-output/crashes/example-experiment/' + 'benchmark-a-fuzzer-a/trial-12/cycle-0003') + mocked_rm.assert_called_once_with(expected_path, + recursive=True, + force=True) + mocked_cp.assert_called_once_with(snapshot_measurer.crashes_dir, + expected_path, + recursive=True) + + @mock.patch('common.new_process.execute') def test_generate_profdata_create(mocked_execute, experiment, fs): """Tests that generate_profdata can run the correct command.""" diff --git a/experiment/run_experiment.py b/experiment/run_experiment.py index 6475eeb34..0d14801b2 100644 --- a/experiment/run_experiment.py +++ b/experiment/run_experiment.py @@ -534,7 +534,7 @@ def start(self): command = [ 'docker', 'run', - '-ti', + '-i', '--rm', '-v', '/var/run/docker.sock:/var/run/docker.sock', @@ -542,6 +542,8 @@ def start(self): shared_experiment_filestore_arg, '-v', shared_report_filestore_arg, + '-e', + 'DOCKER_API_VERSION=1.40', ] + environment_args + [ '--shm-size=2g', '--cap-add=SYS_PTRACE', @@ -553,7 +555,7 @@ def start(self): 'rsync -r ' '"${EXPERIMENT_FILESTORE}/${EXPERIMENT}/input/" ${WORK} && ' 'mkdir ${WORK}/src && ' - 'tar -xvzf ${WORK}/src.tar.gz -C ${WORK}/src && ' + 'tar -xzf ${WORK}/src.tar.gz -C ${WORK}/src && ' 'PYTHONPATH=${WORK}/src python3 ' '${WORK}/src/experiment/dispatcher.py || ' '/bin/bash' # Open shell if experiment fails. diff --git a/fuzzers/afl/fuzzer.py b/fuzzers/afl/fuzzer.py index 18cb71229..65fddb589 100755 --- a/fuzzers/afl/fuzzer.py +++ b/fuzzers/afl/fuzzer.py @@ -111,7 +111,9 @@ def run_afl_fuzz(input_corpus, '-m', 'none', '-t', - '1000+', # Use same default 1 sec timeout, but add '+' to skip hangs. + # Bumped from 1000+ to 5000+ so ghostscript's slower PDF seeds survive + # AFL's dry-run under CPU contention (load spikes during experiment start). + '5000+', ] # Use '-d' to skip deterministic mode, as long as it it compatible with # additional flags. diff --git a/fuzzers/aflplusplus/fuzzer.py b/fuzzers/aflplusplus/fuzzer.py index 7016da75e..f1565e822 100755 --- a/fuzzers/aflplusplus/fuzzer.py +++ b/fuzzers/aflplusplus/fuzzer.py @@ -21,6 +21,18 @@ from fuzzers import utils +LLVM_BUILD_MODES = { + 'tracepc', 'pcguard', 'classic', 'native', 'lto', 'cmplog', 'dict2file', + 'laf', 'autodict', 'ctx', 'ctx1', 'ctx2', 'ctx3', 'ctx4', 'ngram2', + 'ngram3', 'ngram4', 'ngram5', 'ngram6', 'ngram7', 'ngram8', 'ngram16', +} + + +def llvm_mode_available(): + """Return whether this AFL++ build contains LLVM instrumentation support.""" + return os.path.exists('/afl/afl-llvm-pass.so') + + def get_cmplog_build_directory(target_directory): """Return path to CmpLog target directory.""" return os.path.join(target_directory, 'cmplog') @@ -56,6 +68,13 @@ def build(*args): # pylint: disable=too-many-branches,too-many-statements if 'gcc' not in build_modes: build_modes[0] = 'native' + if any(mode in LLVM_BUILD_MODES for mode in build_modes): + if not llvm_mode_available() and 'qemu' not in build_modes: + print('AFL++ LLVM mode unavailable; using GCC-plugin mode.') + build_modes = ['gcc'] + [ + mode for mode in build_modes if mode not in LLVM_BUILD_MODES + ] + # Instrumentation coverage modes: if 'lto' in build_modes: os.environ['CC'] = '/afl/afl-clang-lto' @@ -87,6 +106,8 @@ def build(*args): # pylint: disable=too-many-branches,too-many-statements os.environ['CFLAGS'] = '' os.environ['CXXFLAGS'] = '' os.environ['CPPFLAGS'] = '' + os.environ['CC'] = '/afl/afl-gcc-fast' + os.environ['CXX'] = '/afl/afl-g++-fast' else: os.environ['CC'] = '/afl/afl-clang-fast' os.environ['CXX'] = '/afl/afl-clang-fast++' diff --git a/fuzzers/coverage/builder.Dockerfile b/fuzzers/coverage/builder.Dockerfile index 470fb57b6..a182d545a 100644 --- a/fuzzers/coverage/builder.Dockerfile +++ b/fuzzers/coverage/builder.Dockerfile @@ -22,6 +22,8 @@ ENV LF_PATH /tmp/libfuzzer.zip # https://github.com/google/fuzzbench/blob/cf86138081ec705a47ce0a4bab07b5737292e7e0/fuzzers/coverage/patch.diff # applied. +RUN apt-get update && apt-get install -y wget unzip + RUN wget https://storage.googleapis.com/fuzzbench-artifacts/libfuzzer-coverage.zip -O $LF_PATH && \ echo "cc78179f6096cae4b799d0cc9436f000cc0be9b1fb59500d16b14b1585d46b61 $LF_PATH" | sha256sum --check --status && \ mkdir /tmp/libfuzzer && \ @@ -29,4 +31,4 @@ RUN wget https://storage.googleapis.com/fuzzbench-artifacts/libfuzzer-coverage.z unzip $LF_PATH && \ bash build.sh && \ cp libFuzzer.a /usr/lib && \ - rm -rf /tmp/libfuzzer $LF_PATH \ No newline at end of file + rm -rf /tmp/libfuzzer $LF_PATH diff --git a/fuzzers/honggfuzz/builder.Dockerfile b/fuzzers/honggfuzz/builder.Dockerfile index 11a483288..87fcedae4 100644 --- a/fuzzers/honggfuzz/builder.Dockerfile +++ b/fuzzers/honggfuzz/builder.Dockerfile @@ -31,6 +31,8 @@ RUN apt-get update -y && \ RUN git clone https://github.com/google/honggfuzz.git /honggfuzz && \ cd /honggfuzz && \ git checkout oss-fuzz && \ - CFLAGS="-O3 -funroll-loops" make && \ + sed -i 's|LOG_F("Couldn.t attach to pid=%d", (int)run->pid);|LOG_W("Couldn'"'"'t attach to pid=%d (raced with signal); skipping this run", (int)run->pid); return;|' linux/arch.c && \ + grep -n 'skipping this run' linux/arch.c && \ + CFLAGS="-O3 -funroll-loops -D_HF_LINUX_NO_BFD" make && \ touch empty_lib.c && \ - cc -c -o empty_lib.o empty_lib.c \ No newline at end of file + cc -c -o empty_lib.o empty_lib.c diff --git a/fuzzers/honggfuzz/fuzzer.py b/fuzzers/honggfuzz/fuzzer.py index 7a75a17fd..36d83349d 100644 --- a/fuzzers/honggfuzz/fuzzer.py +++ b/fuzzers/honggfuzz/fuzzer.py @@ -48,6 +48,9 @@ def fuzz(input_corpus, output_corpus, target_binary): command = [ './honggfuzz', '--persistent', + # Raise per-input timeout from the 1s default — heavy transplant targets + # (ghostscript) need headroom for each run. + '--timeout', '25', '--rlimit_rss', '2048', '--sanitizers_del_report=true', diff --git a/fuzzers/libafl/builder.Dockerfile b/fuzzers/libafl/builder.Dockerfile index f0136ff46..24dab796c 100644 --- a/fuzzers/libafl/builder.Dockerfile +++ b/fuzzers/libafl/builder.Dockerfile @@ -15,11 +15,22 @@ ARG parent_image FROM $parent_image -# Uninstall old Rust & Install the latest one. -RUN if which rustup; then rustup self uninstall -y; fi && \ +# Remove any preexisting Rust install (parent image ships one at /rust), +# then install a fresh nightly toolchain under fixed root paths. Pinning +# RUSTUP_HOME/CARGO_HOME avoids cross-device rename errors when /rust is +# on a different overlay layer than the container's writable root. +ENV RUSTUP_HOME=/root/.rustup \ + CARGO_HOME=/root/.cargo \ + PATH=/root/.cargo/bin:$PATH +RUN rm -f /usr/local/bin/cargo /usr/local/bin/rustc /usr/local/bin/rustup && \ + rm -rf /rust /home/agent/.cargo /home/agent/.rustup \ + /root/.cargo /root/.rustup && \ curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > /rustup.sh && \ - sh /rustup.sh --default-toolchain nightly-2024-08-12 -y && \ - rm /rustup.sh + sh /rustup.sh --default-toolchain nightly-2025-08-15 -y --no-modify-path && \ + rm /rustup.sh && \ + ln -s /root/.cargo/bin/cargo /usr/local/bin/cargo && \ + ln -s /root/.cargo/bin/rustc /usr/local/bin/rustc && \ + ln -s /root/.cargo/bin/rustup /usr/local/bin/rustup # Install dependencies. RUN apt-get update && \ @@ -32,7 +43,7 @@ RUN apt-get update && \ apt-utils apt-transport-https ca-certificates joe curl && \ wget https://apt.llvm.org/llvm.sh && chmod +x llvm.sh && ./llvm.sh 17 -RUN wget https://gist.githubusercontent.com/tokatoka/26f4ba95991c6e33139999976332aa8e/raw/698ac2087d58ce5c7a6ad59adce58dbfdc32bd46/createAliases.sh && chmod u+x ./createAliases.sh && ./createAliases.sh +RUN wget https://gist.githubusercontent.com/tokatoka/26f4ba95991c6e33139999976332aa8e/raw/698ac2087d58ce5c7a6ad59adce58dbfdc32bd46/createAliases.sh && chmod u+x ./createAliases.sh && ./createAliases.sh # Download libafl. RUN git clone https://github.com/AFLplusplus/LibAFL /libafl @@ -46,7 +57,7 @@ RUN cd /libafl && \ unset CFLAGS CXXFLAGS && \ export LIBAFL_EDGES_MAP_SIZE=2621440 && \ cd ./fuzzers/fuzzbench/fuzzbench && \ - PATH="/root/.cargo/bin/:$PATH" cargo build --profile release-fuzzbench --features no_link_main + cargo build --profile release-fuzzbench --features no_link_main # Auxiliary weak references. RUN cd /libafl/fuzzers/fuzzbench/fuzzbench && \ diff --git a/fuzzers/symcc_aflplusplus/builder.Dockerfile b/fuzzers/symcc_aflplusplus/builder.Dockerfile index 5bdc0c175..f2bd89210 100644 --- a/fuzzers/symcc_aflplusplus/builder.Dockerfile +++ b/fuzzers/symcc_aflplusplus/builder.Dockerfile @@ -17,7 +17,7 @@ FROM $parent_image # Install libstdc++ to use llvm_mode. RUN apt-get update && \ - apt-get install -y wget libstdc++-5-dev libtool-bin automake flex bison \ + apt-get install -y wget libstdc++-10-dev libtool-bin automake flex bison \ libglib2.0-dev libpixman-1-dev python3-setuptools unzip \ apt-utils apt-transport-https ca-certificates diff --git a/requirements.txt b/requirements.txt index ca7b933cf..737fdd564 100644 --- a/requirements.txt +++ b/requirements.txt @@ -24,6 +24,7 @@ scipy==1.9.2 seaborn==0.13.2 sqlalchemy==1.4.41 protobuf==3.20.3 +setuptools>=65.0.0,<78.0.0 # Needed for development. pylint==2.15.4