【标题描述】libclamav/upx.c 运行时错误
【环境信息】
硬件信息:
1) X86
软件信息:
1) Name: clamav
Version: 0.103.2
Release: 1
如果有特殊组网,请提供网络拓扑图
【问题复现步骤】
具体操作步骤
python3 infra/helper.py build_fuzzers --sanitizer undefined clamav
python3 infra/helper.py run_fuzzer clamav clamav_scanfile_PE_fuzzer
【预期结果】
30min 运行正常
【实际结果】
/src/clamav-devel/libclamav/upx.c:428:23: runtime error: left shift of 11709110 by 8 places cannot be represented in type 'int32_t' (aka 'int')
#0 0x4f43d5 in upx_inflate2d /src/clamav-devel/libclamav/upx.c:428:23
#1 0x4d993a in cli_scanpe /src/clamav-devel/libclamav/pe.c:3901:17
#2 0x48f2ce in cli_magic_scan /src/clamav-devel/libclamav/scanners.c:4387:48
#3 0x49baea in magic_scan_nested_fmap_type /src/clamav-devel/libclamav/scanners.c:4619:11
#4 0x49b166 in cli_magic_scan_nested_fmap_type /src/clamav-devel/libclamav/scanners.c:4698:15
#5 0x49c454 in scan_common /src/clamav-devel/libclamav/scanners.c:4878:10
#6 0x49afef in cl_scandesc_callback /src/clamav-devel/libclamav/scanners.c:5057:14
#7 0x49ca76 in cl_scanfile_callback /src/clamav-devel/libclamav/scanners.c:5146:11
#8 0x49c9e3 in cl_scanfile /src/clamav-devel/libclamav/scanners.c:5128:12
#9 0x42c4bf in LLVMFuzzerTestOneInput /src/clamav-devel/fuzz/clamav_scanfile_fuzzer.cpp:127:5
#10 0x444586 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:556:15
#11 0x42c801 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:296:6
#12 0x42fbaa in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:776:9
#13 0x42c53a in main /src/libfuzzer/FuzzerMain.cpp:19:10
#14 0x7f7a69aa382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#15 0x40a618 in _start (/out/clamav_scanfile_PE_fuzzer+0x40a618)
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /src/clamav-devel/libclamav/upx.c:428:23 in
【附件信息】
python3 infra/helper.py reproduce clamav clamav_scanfile_PE_fuzzer build/out/clamav/crash-a223d0b4386dce44cacb847e40169dad0b09a226
问题根因:由于参与左移运算的数应为unsigned int类型,否则会报上述runtime error
而该错误指向的行中,参与左移运算的数为int32_t类型;
修改方案:左移前,将运算数强制类型转换为uint32_t类型
此处可能存在不合适展示的内容,页面不予展示。您可通过相关编辑功能自查并修改。
如您确认内容无涉及 不当用语 / 纯广告导流 / 暴力 / 低俗色情 / 侵权 / 盗版 / 虚假 / 无价值内容或违法国家有关法律法规的内容,可点击提交进行申诉,我们将尽快为您处理。
登录 后才可以发表评论