114 Star 0 Fork 14

src-openEuler / LibRaw

 / 详情

【fuzz】libraw --sanitizer undefined UndefinedBehaviorSanitizer

已验收
缺陷
创建于  
2022-02-23 11:18

【环境信息】
x86
【测试版本】
Name: LibRaw
Version: 0.20.2

【注意事项】
受影响版本排查(受影响/不受影响)
1、master
2、openEuler-20.03-LTS-SP3
3、openEuler-20.03-LTS-SP1
4、openEuler-20.03-LTS-SP2
5、openEuler-20.03-LTS
6、openEuler-21.03
7、openEuler-20.03-LTS-Next
8、openEuler-21.09
9、openEuler-22.03-LTS
10、openEuler-22.03-LTS-Next
11、openEuler-20.09
一、【测试步骤】
1、编译
python3 infra/helper.py build_fuzzers --sanitizer undefined libraw
2、执行
python3 infra/helper.py run_fuzzer libraw libraw_cr2_fuzzer

【报错信息】
src/decoders/decoders_dcraw.cpp:374:18: runtime error: shift exponent -1 is negative
#0 0x56ba35 in LibRaw::ljpeg_diff(unsigned short*) /src/libraw/src/decoders/decoders_dcraw.cpp:374:18
#1 0x56d38f in LibRaw::ljpeg_row_unrolled(int, jhead*) /src/libraw/src/decoders/decoders_dcraw.cpp:483:16
#2 0x56bbc3 in LibRaw::ljpeg_row(int, jhead*) /src/libraw/src/decoders/decoders_dcraw.cpp:386:12
#3 0x56dfc9 in LibRaw::lossless_jpeg_load_raw() /src/libraw/src/decoders/decoders_dcraw.cpp:565:12
#4 0x4b4aef in LibRaw::unpack() /src/libraw/src/decoders/unpack.cpp:287:7
#5 0x4b16a0 in LLVMFuzzerTestOneInput /src/libraw_fuzzer.cc:47:20
#6 0x442951 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15
#7 0x442095 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:470:3
#8 0x4446e7 in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::__Fuzzer::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocatorfuzzer::SizedFile >&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:765:7
#9 0x4448e9 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocatorfuzzer::SizedFile >&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:794:3
#10 0x433bbe in fuzzer::FuzzerDriver(int*, char***, int ()(unsigned char const, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:826:6
#11 0x45c392 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
#12 0x7fdf653a082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#13 0x4082c8 in _start (/out/libraw_cr2_fuzzer+0x4082c8)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/decoders/decoders_dcraw.cpp:374:18 in
MS: 0 ; base unit: 0000000000000000000000000000000000000000
artifact_prefix='./'; Test unit written to ./crash-356e043f31f7d1eeb25d20e7bd38bf7da8083b98
【预期结果】
运行无异常

【实际结果】
UndefinedBehaviorSanitizer

【复现步骤】
python3 infra/helper.py reproduce libraw libraw_cr2_fuzzer crash-356e043f31f7d1eeb25d20e7bd38bf7da8083b98

评论 (1)

wangxiaoya 创建了缺陷
wangxiaoya 修改了标题
wangxiaoya 修改了标题
wangxiaoya 修改了描述
wangxiaoya 上传了附件crash-356e043f31f7d1eeb25d20e7bd38bf7da8083b98
wangxiaoya 关联仓库设置为src-openEuler/LibRaw
wangxiaoya 负责人设置为small_leek
展开全部操作日志
xu_ping 任务状态待办的 修改为已完成
DisNight 添加了
 
sig/Programming-lang
标签
wangxiaoya 任务状态已完成 修改为已验收

登录 后才可以发表评论

状态
负责人
项目
里程碑
Pull Requests
关联的 Pull Requests 被合并后可能会关闭此 issue
分支
开始日期   -   截止日期
-
置顶选项
优先级
预计工期 (小时)
参与者(2)
1
https://gitee.com/src-openeuler/LibRaw.git
git@gitee.com:src-openeuler/LibRaw.git
src-openeuler
LibRaw
LibRaw

搜索帮助