【fuzz】libraw --sanitizer memory use-of-uninitialized-value

【环境信息】
x86
【测试版本】
Name: LibRaw
Version: 0.20.2

【注意事项】
受影响版本排查（受影响/不受影响）
1、master
2、openEuler-20.03-LTS-SP3
3、openEuler-20.03-LTS-SP1
4、openEuler-20.03-LTS-SP2
5、openEuler-20.03-LTS
6、openEuler-21.03
7、openEuler-20.03-LTS-Next
8、openEuler-21.09
9、openEuler-22.03-LTS
10、openEuler-22.03-LTS-Next
11、openEuler-20.09
一、【测试步骤】
1、编译
python3 infra/helper.py build_fuzzers --sanitizer memory libraw
2、执行
python3 infra/helper.py run_fuzzer libraw libraw_fuzzer

【报错信息】
Uninitialized bytes in __interceptor_strchr at offset 108 inside [0x7ffc34064d40, 109)
==11==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x5415f3 in __libcpp_strchr(char const*, int) /usr/local/bin/../include/c++/v1/string.h:73:64
    #1 0x53fe01 in strchr(char*, int) [enable_if:true] /usr/local/bin/../include/c++/v1/string.h:77:54
    #2 0x6d33db in LibRaw::parse_rollei() /src/libraw/src/metadata/misc_parsers.cpp:308:16
    #3 0x6a7f27 in LibRaw::identify() /src/libraw/src/metadata/identify.cpp:654:5
    #4 0x551d99 in LibRaw::open_datastream(LibRaw_abstract_datastream*) /src/libraw/src/utils/open.cpp:390:4
    #5 0x550382 in LibRaw::open_buffer(void*, unsigned long) /src/libraw/src/utils/open.cpp:153:13
    #6 0x523d51 in LLVMFuzzerTestOneInput /src/libraw_fuzzer.cc:41:24
    #7 0x45b541 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15
    #8 0x45ac85 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:470:3
    #9 0x45cd57 in fuzzer::Fuzzer::MutateAndTestOne() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:698:19
    #10 0x45d7d5 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocator<fuzzer::SizedFile> >&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:832:5
    #11 0x44c7ae in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:826:6
    #12 0x474f82 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
    #13 0x7ff6f244e82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #14 0x420eb8 in _start (/out/libraw_fuzzer+0x420eb8)

Uninitialized value was created by an allocation of 'line' in the stack frame of function '_ZN6LibRaw12parse_rolleiEv'
    #0 0x6d2f90 in LibRaw::parse_rollei() /src/libraw/src/metadata/misc_parsers.cpp:296

SUMMARY: MemorySanitizer: use-of-uninitialized-value /usr/local/bin/../include/c++/v1/string.h:73:64 in __libcpp_strchr(char const*, int)
Exiting
MS: 4 InsertByte-InsertByte-CopyPart-CopyPart-; base unit: 026dca7ef1c1134c79f51170b9374d7ddae7db47
0x44,0x53,0x43,0x2d,0x49,0x6d,0x61,0x67,0x65,0xff,0xff,0xd4,0x5,0x5,0x5,0x5,0x49,0x49,0x49,0x24,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x56,0x56,0x56,0x56,0x56,0x56,0x56,0x56,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x23,0x5,0x5,0x5,0x5,0x5,0x82,0x5,0x66,0x74,0x79,0x70,0x63,0x72,0x78,0x20,0x5,0x5,0x56,0x56,0x56,0x56,0x56,0x56,0x56,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x5,0x23,0x5,0x5,0x5,0x5,0x5,0x82,0x5,0x66,0x74,0x79,0x70,0x63,0x3f,0xff,0xff,0xff,0x4d,0xff,
DSC-Image\xff\xff\xd4\x05\x05\x05\x05III$\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05VVVVVVVV\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05#\x05\x05\x05\x05\x05\x82\x05ftypcrx \x05\x05VVVVVVV\x05\x05\x05\x05\x05\x05\x05\x05\x05\x05#\x05\x05\x05\x05\x05\x82\x05ftypc?\xff\xff\xffM\xff
artifact_prefix='./'; Test unit written to ./crash-f16a811782612bf51ab3a01d29bf26aea8ec434e
Base64: RFNDLUltYWdl///UBQUFBUlJSSQFBQUFBQUFBQUFBQUFBQUFVlZWVlZWVlYFBQUFBQUFBQUFIwUFBQUFggVmdHlwY3J4IAUFVlZWVlZWVgUFBQUFBQUFBQUjBQUFBQWCBWZ0eXBjP////03/
【预期结果】
运行无异常

【实际结果】
MemorySanitizer: use-of-uninitialized-value /usr/local/bin/../include/c++/v1/string.h:73:64 in __libcpp_strchr(char const*, int)
Exiting

【复现步骤】
python3 infra/helper.py reproduce libraw libraw_fuzzer crash-f16a811782612bf51ab3a01d29bf26aea8ec434e

src-openEuler/LibRaw

内容风险标识

评论 (1)

src-openEuler/LibRaw .gitee-modal { width: 500px !important; }

内容风险标识