【fuzz】use-of-uninitialized-value

【环境信息】
x86
【测试版本】
Name: libsass
Version: 3.5.4
Release: 4
【注意事项】
受影响版本排查（受影响/不受影响）
1、master
2、openEuler-LTS-20.03
3、openEuler-LTS-20.03-SP1
4、openEuler-LTS-20.03-Next
5、openEuler-20.09
【测试步骤】
1、编译
python3 infra/helper.py build_fuzzers --sanitizer memory libsass
2、执行
python3 infra/helper.py run_fuzzer libsass data_context_fuzzer -rss_limit_mb=0
【报错信息】
```
==13==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x56e326 in Sass::handle_error(Sass_Context*) /src/libsass/src/sass_context.cpp:81:38
    #1 0x55fa45 in handle_errors /src/libsass/src/sass_context.cpp:207:18
    #2 0x55fa45 in sass_parse_block /src/libsass/src/sass_context.cpp:253:19
    #3 0x55fa45 in sass_compiler_parse /src/libsass/src/sass_context.cpp:483:22
    #4 0x55d84e in sass_compile_context(Sass_Context*, Sass::Context*) /src/libsass/src/sass_context.cpp:371:7
    #5 0x55d48a in sass_compile_data_context /src/libsass/src/sass_context.cpp:456:12
    #6 0x559047 in LLVMFuzzerTestOneInput /src/data_context_fuzzer.cc:26:3
    #7 0x490611 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15
    #8 0x48fd55 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:470:3
    #9 0x491e27 in fuzzer::Fuzzer::MutateAndTestOne() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:698:19
    #10 0x4928a5 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocator<fuzzer::SizedFile> >&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:832:5
    #11 0x48187e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:826:6
    #12 0x4aa052 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
    #13 0x7fb86dbbd82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #14 0x455f88 in _start (/out/data_context_fuzzer+0x455f88)

Uninitialized value was created by a heap allocation
    #0 0x5099dd in malloc /src/llvm-project/compiler-rt/lib/msan/msan_interceptors.cpp:901:3
    #1 0x558e96 in LLVMFuzzerTestOneInput /src/data_context_fuzzer.cc:4:29
    #2 0x490611 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15
    #3 0x48fd55 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:470:3
    #4 0x491e27 in fuzzer::Fuzzer::MutateAndTestOne() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:698:19
    #5 0x4928a5 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocator<fuzzer::SizedFile> >&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:832:5
    #6 0x48187e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:826:6
    #7 0x4aa052 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
    #8 0x7fb86dbbd82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: MemorySanitizer: use-of-uninitialized-value /src/libsass/src/sass_context.cpp:81:38 in Sass::handle_error(Sass_Context*)
Unique heap origins: 4847
Stack depot allocated bytes: 792488
Unique origin histories: 1616
History depot allocated bytes: 38784
Exiting
MS: 1 ChangeBinInt-; base unit: b7338988044eec4761d552baddaecea1b928947c
0x9d,0x9c,0xf1,0x9d,
\x9d\x9c\xf1\x9d
artifact_prefix='./'; Test unit written to ./crash-46b881641fa27e6a451467e36388b30e3c81c217
Base64: nZzxnQ==
```
【问题复现】
python infra/helper.py reproduce libsass data_context_fuzzer crash-46b881641fa27e6a451467e36388b30e3c81c217

src-openEuler/libsass
关闭

内容风险标识

评论 (5)

src-openEuler/libsass关闭 .gitee-modal { width: 500px !important; }

内容风险标识