Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Crash found by AFL #32

Closed
frewsxcv opened this issue Oct 25, 2015 · 0 comments
Closed

Crash found by AFL #32

frewsxcv opened this issue Oct 25, 2015 · 0 comments

Comments

@frewsxcv
Copy link

test case

    #[test]
    fn test_fuzz() {
        assert_deserializes(vec![
            (Err(DeserializationError::InvalidValue), b"\x30\x86\xcd\x98\x81\xcd\xcd\x0a\xcd\x0a".to_vec())
        ], |deserializer| {
            return deserializer.read_sequence(|d| {
                Ok((try!(d.read_int::<i64>()),
                    try!(d.read_octet_string()),
                    try!(d.read_object_identifier()),
                    try!(d.read_bool())))
            });
        });
    }

run test

coreyf@frewbook-pro ~/D/r/rust-asn1 (master) [101]> cargo test test_fuzz
     Running target/debug/asn1-7ff997e9ea245d04

running 1 test
Process didn't exit successfully: `/Users/coreyf/Development/rust/rust-asn1/target/debug/asn1-7ff997e9ea245d04 test_fuzz` (signal: 4)

lldb backtrace

coreyf@frewbook-pro ~/D/r/rust-asn1 (master) [127]>
lldb /Users/coreyf/Development/rust/rust-asn1/target/debug/asn1-7ff997e9ea245d04 test_fuzz
(lldb) target create "/Users/coreyf/Development/rust/rust-asn1/target/debug/asn1-7ff997e9ea245d04"
Current executable set to '/Users/coreyf/Development/rust/rust-asn1/target/debug/asn1-7ff997e9ea245d04' (x86_64).
(lldb) settings set -- target.run-args  "test_fuzz"
(lldb) run
Process 78929 launched: '/Users/coreyf/Development/rust/rust-asn1/target/debug/asn1-7ff997e9ea245d04' (x86_64)

running 1 test
Process 78929 stopped
* thread #2: tid = 0x264423, 0x00000001000ac004 asn1-7ff997e9ea245d04`oom::h60a2387de2f8f1f2fub + 4, name = 'deserializer::tests::test_fuzz', stop reason = EXC_BAD_INSTRUCTION (code=EXC_I386_INVOP, subcode=0x0)
    frame #0: 0x00000001000ac004 asn1-7ff997e9ea245d04`oom::h60a2387de2f8f1f2fub + 4
asn1-7ff997e9ea245d04`oom::h60a2387de2f8f1f2fub:
->  0x1000ac004 <+4>: ud2
    0x1000ac006 <+6>: nopw   %cs:(%rax,%rax)

asn1-7ff997e9ea245d04`__rust_allocate:
    0x1000ac010 <+0>: pushq  %rbp
    0x1000ac011 <+1>: movq   %rsp, %rbp
(lldb) bt
* thread #2: tid = 0x264423, 0x00000001000ac004 asn1-7ff997e9ea245d04`oom::h60a2387de2f8f1f2fub + 4, name = 'deserializer::tests::test_fuzz', stop reason = EXC_BAD_INSTRUCTION (code=EXC_I386_INVOP, subcode=0x0)
  * frame #0: 0x00000001000ac004 asn1-7ff997e9ea245d04`oom::h60a2387de2f8f1f2fub + 4
    frame #1: 0x0000000100004abc asn1-7ff997e9ea245d04`asn1::raw_vec::RawVec<T>::with_capacity(cap=226054896471306) + 156 at raw_vec.rs:103
    frame #2: 0x0000000100004a00 asn1-7ff997e9ea245d04`asn1::vec::Vec<T>::with_capacity(capacity=226054896471306) + 32 at vec.rs:282
    frame #3: 0x0000000100004950 asn1-7ff997e9ea245d04`asn1::vec::from_elem<u8>(elem='\0', n=226054896471306) + 48 at vec.rs:1058
    frame #4: 0x000000010002863f asn1-7ff997e9ea245d04`asn1::deserializer::Deserializer::_read_with_tag<(i64, collections::vec::Vec<u8>, asn1::utils::ObjectIdentifier, bool),closure>(self=0x0000700000403828, expected_tag='0', body=(__0 = 0x0000700000403590)) + 703 at deserializer.rs:92
    frame #5: 0x000000010002834d asn1-7ff997e9ea245d04`asn1::deserializer::Deserializer::read_sequence<closure,(i64, collections::vec::Vec<u8>, asn1::utils::ObjectIdentifier, bool)>(self=0x0000700000403828, v=closure @ 0x0000700000403590) + 77 at deserializer.rs:164
    frame #6: 0x0000000100027760 asn1-7ff997e9ea245d04`fnfn(deserializer=0x0000700000403828) + 64 at deserializer.rs:378
    frame #7: 0x0000000100027707 asn1-7ff997e9ea245d04`asn1::ops::impls::&'a F.Fn<A>::call(self=0x0000700000403848, args=(&mut asn1::deserializer::Deserializer) @ 0x0000700000403690) + 39 at ops.rs:1760
    frame #8: 0x000000010002735b asn1-7ff997e9ea245d04`asn1::deserializer::from_vec<&closure,(i64, collections::vec::Vec<u8>, asn1::utils::ObjectIdentifier, bool)>(data=Vec<u8> @ 0x0000700000403850, f=0x0000700000403ae0) + 171 at deserializer.rs:173
    frame #9: 0x0000000100025f3c asn1-7ff997e9ea245d04`asn1::deserializer::tests::assert_deserializes<(i64, collections::vec::Vec<u8>, asn1::utils::ObjectIdentifier, bool),closure>(values=Vec<(core::result::Result<(i64, collections::vec::Vec<u8>, asn1::utils::ObjectIdentifier, bool), asn1::deserializer::DeserializationError>, collections::vec::Vec<u8>)> @ 0x0000700000403ae8, f=closure @ 0x0000700000403ae0) + 492 at deserializer.rs:191
    frame #10: 0x0000000100025cfb asn1-7ff997e9ea245d04`asn1::deserializer::tests::test_fuzz + 347 at deserializer.rs:375
    frame #11: 0x000000010008226c asn1-7ff997e9ea245d04`boxed::_$LT$impl$GT$::call_box::call_box::h13072048137075833162 + 28
    frame #12: 0x0000000100084971 asn1-7ff997e9ea245d04`sys_common::unwind::try::try_fn::try_fn::h751026771818371460 + 433
    frame #13: 0x00000001000a7929 asn1-7ff997e9ea245d04`__rust_try + 9
    frame #14: 0x00000001000a58cf asn1-7ff997e9ea245d04`sys_common::unwind::try::inner_try::h2088a2c04cd75530O7r + 111
    frame #15: 0x0000000100084d6b asn1-7ff997e9ea245d04`boxed::_$LT$impl$GT$::call_box::call_box::h9872188538580151393 + 411
    frame #16: 0x00000001000a92fe asn1-7ff997e9ea245d04`sys::thread::_$LT$impl$GT$::new::thread_start::h72c909587b43bc6f8tw + 142
    frame #17: 0x00007fff94c049b1 libsystem_pthread.dylib`_pthread_body + 131
    frame #18: 0x00007fff94c0492e libsystem_pthread.dylib`_pthread_start + 168
    frame #19: 0x00007fff94c02385 libsystem_pthread.dylib`thread_start + 13
@alex alex closed this as completed in f3a98a0 Oct 25, 2015
alex added a commit that referenced this issue Oct 25, 2015
fixed #32 -- exit early on obscenely large values
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant