【fuzz】libraw --sanitizer undefined src/demosaic/dht_demosaic.cpp:29:23: runtime error: division by zero

【环境信息】
x86
【测试版本】
Name: LibRaw
Version: 0.20.2

【注意事项】
受影响版本排查（受影响/不受影响）
1、master
2、openEuler-20.03-LTS-SP3
3、openEuler-20.03-LTS-SP1
4、openEuler-20.03-LTS-SP2
5、openEuler-20.03-LTS
6、openEuler-21.03
7、openEuler-20.03-LTS-Next
8、openEuler-21.09
9、openEuler-22.03-LTS
10、openEuler-22.03-LTS-Next
11、openEuler-20.09
12、openEuler-23.03
一、【测试步骤】
1、编译
python3 infra/helper.py build_fuzzers --sanitizer undefined libraw
2、执行
python3 infra/helper.py run_fuzzer libraw  libraw_fuzzer

【报错信息】
src/demosaic/dht_demosaic.cpp:29:23: runtime error: division by zero
    #0 0x68cd7f in calc_dist(float, float) /src/libraw/src/demosaic/dht_demosaic.cpp:29:23
    #1 0x690ba2 in DHT::get_diag_grb(int, int, int) /src/libraw/src/demosaic/dht_demosaic.cpp:141:9
    #2 0x68d6a9 in DHT::make_diag_dline(int) /src/libraw/src/demosaic/dht_demosaic.cpp:591:11
    #3 0x68d385 in DHT::make_diag_dirs() /src/libraw/src/demosaic/dht_demosaic.cpp:430:5
    #4 0x694fe0 in LibRaw::dht_interpolate() /src/libraw/src/demosaic/dht_demosaic.cpp:1019:7
    #5 0x4bcb2e in LibRaw::dcraw_process() /src/libraw/src/postprocessing/dcraw_process.cpp:171:9
    #6 0x4b17b6 in LLVMFuzzerTestOneInput /src/libraw_fuzzer.cc:57:22
    #7 0x442951 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15
    #8 0x442095 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:470:3
    #9 0x444167 in fuzzer::Fuzzer::MutateAndTestOne() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:698:19
    #10 0x444be5 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocator<fuzzer::SizedFile> >&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:832:5
    #11 0x433bbe in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:826:6
    #12 0x45c392 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
    #13 0x7fb3a78d182f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #14 0x4082c8 in _start (/out/libraw_fuzzer+0x4082c8)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/demosaic/dht_demosaic.cpp:29:23 in 
MS: 1 ChangeBit-; base unit: 4be37798b18369937d476e6033a4d17410e0e304
0x49,0x49,0x9,0x42,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x4d,0x4d,0x45,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x89,0xe7,0xfa,0x58,0x32,0x1b,0x98,0xce,0x0,0x0,0x0,0x0,0x0,0x0,0x42,0x0,0x0,0x0,0x0,0x0,0x0,0x10,0xff,0xa,0x11,0x4d,0x4d,0x45,0x6e,0x0,0x0,0xff,0xff,0xa,0xc1,0x3d,0xff,0xff,0xc1,0x0,0xff,0xff,0x0,
II\x09B\x00\x00\x00\x00\x00\x00\x00MME\x00\x00\x00\x00\x00\x00\x00\x00\x00\x89\xe7\xfaX2\x1b\x98\xce\x00\x00\x00\x00\x00\x00B\x00\x00\x00\x00\x00\x00\x10\xff\x0a\x11MMEn\x00\x00\xff\xff\x0a\xc1=\xff\xff\xc1\x00\xff\xff\x00
artifact_prefix='./'; Test unit written to ./crash-acc1c88ecd2413da30b2afa2b58ceced2a689d43
Base64: SUkJQgAAAAAAAABNTUUAAAAAAAAAAACJ5/pYMhuYzgAAAAAAAEIAAAAAAAAQ/woRTU1FbgAA//8KwT3//8EA//8A
【预期结果】
运行无异常

【实际结果】
timeout

【复现步骤】
python3 infra/helper.py reproduce libraw libraw_fuzzer ./crash-acc1c88ecd2413da30b2afa2b58ceced2a689d43

src-openEuler/LibRaw

内容风险标识

评论 (1)

src-openEuler/LibRaw .gitee-modal { width: 500px !important; }

内容风险标识