123 Star 0 Fork 27

src-openEuler / clamav

 / 详情

【fuzz】libclamav/upx.c 运行时错误

已完成
缺陷
创建于  
2021-05-16 15:38

【标题描述】libclamav/upx.c 运行时错误
【环境信息】
硬件信息:
1) X86
软件信息:
1) Name: clamav
Version: 0.103.2
Release: 1

如果有特殊组网,请提供网络拓扑图
【问题复现步骤】
具体操作步骤
python3 infra/helper.py build_fuzzers --sanitizer undefined clamav
python3 infra/helper.py run_fuzzer clamav clamav_scanfile_PE_fuzzer
【预期结果】
30min 运行正常
【实际结果】

/src/clamav-devel/libclamav/upx.c:428:23: runtime error: left shift of 11709110 by 8 places cannot be represented in type 'int32_t' (aka 'int')
    #0 0x4f43d5 in upx_inflate2d /src/clamav-devel/libclamav/upx.c:428:23
    #1 0x4d993a in cli_scanpe /src/clamav-devel/libclamav/pe.c:3901:17
    #2 0x48f2ce in cli_magic_scan /src/clamav-devel/libclamav/scanners.c:4387:48
    #3 0x49baea in magic_scan_nested_fmap_type /src/clamav-devel/libclamav/scanners.c:4619:11
    #4 0x49b166 in cli_magic_scan_nested_fmap_type /src/clamav-devel/libclamav/scanners.c:4698:15
    #5 0x49c454 in scan_common /src/clamav-devel/libclamav/scanners.c:4878:10
    #6 0x49afef in cl_scandesc_callback /src/clamav-devel/libclamav/scanners.c:5057:14
    #7 0x49ca76 in cl_scanfile_callback /src/clamav-devel/libclamav/scanners.c:5146:11
    #8 0x49c9e3 in cl_scanfile /src/clamav-devel/libclamav/scanners.c:5128:12
    #9 0x42c4bf in LLVMFuzzerTestOneInput /src/clamav-devel/fuzz/clamav_scanfile_fuzzer.cpp:127:5
    #10 0x444586 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:556:15
    #11 0x42c801 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:296:6
    #12 0x42fbaa in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:776:9
    #13 0x42c53a in main /src/libfuzzer/FuzzerMain.cpp:19:10
    #14 0x7f7a69aa382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #15 0x40a618 in _start (/out/clamav_scanfile_PE_fuzzer+0x40a618)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /src/clamav-devel/libclamav/upx.c:428:23 in

【附件信息】
python3 infra/helper.py reproduce clamav clamav_scanfile_PE_fuzzer build/out/clamav/crash-a223d0b4386dce44cacb847e40169dad0b09a226

评论 (1)

jinjin 创建了缺陷
jinjin 负责人设置为small_leek
jinjin 优先级设置为次要
jinjin 关联仓库设置为src-openEuler/clamav
jinjin 修改了描述
jinjin 修改了标题
jinjin 上传了附件crash-a223d0b4386dce44cacb847e40169dad0b09a226
jinjin 修改了描述
jinjin 修改了描述
jinjin 修改了描述
展开全部操作日志

问题根因:由于参与左移运算的数应为unsigned int类型,否则会报上述runtime error
而该错误指向的行中,参与左移运算的数为int32_t类型;

修改方案:左移前,将运算数强制类型转换为uint32_t类型

参考案例: https://github.com/team-charls/charls/issues/21

登录 后才可以发表评论

状态
负责人
项目
里程碑
Pull Requests
关联的 Pull Requests 被合并后可能会关闭此 issue
分支
开始日期   -   截止日期
-
置顶选项
优先级
预计工期 (小时)
参与者(2)
1
https://gitee.com/src-openeuler/clamav.git
git@gitee.com:src-openeuler/clamav.git
src-openeuler
clamav
clamav

搜索帮助