【fuzz】use-of-uninitialized-value

【环境信息】
x86
【测试版本】
Name:          opusfile
Version:       0.11
Release:       2
【注意事项】
受影响版本排查（受影响/不受影响）
1、master
2、openEuler-LTS-20.03
3、openEuler-LTS-20.03-SP1
4、openEuler-LTS-20.03-Next
5、openEuler-20.09
【测试步骤】
1、编译
python3 infra/helper.py build_fuzzers --sanitizer memory opusfile
2、执行
python3 infra/helper.py run_fuzzer opusfile opusfile_fuzzer -rss_limit_mb=0
【报错信息】
```
#3694365        REDUCE cov: 64 ft: 98 corp: 18/11153b lim: 4096 exec/s: 10319 rss: 249Mb L: 4096/4096 MS: 2 CrossOver-CMP- DE: "S*\xe9\x94"-
Uninitialized bytes in MemcmpInterceptorCommon at offset 0 inside [0x7fff31ca6ef0, 4)
==13==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x4d5afe in memcmp /src/llvm-project/compiler-rt/lib/msan/../sanitizer_common/sanitizer_common_interceptors.inc:877:10
    #1 0x56b32c in ogg_sync_pageseek (/out/opusfile_fuzzer+0x56b32c)
    #2 0x544c2e in op_get_next_page /src/opusfile/src/opusfile.c:192:10
    #3 0x5433b8 in op_fetch_headers /src/opusfile/src/opusfile.c:577:8
    #4 0x52f163 in op_open1 /src/opusfile/src/opusfile.c:1555:9
    #5 0x52e8d2 in op_test_callbacks /src/opusfile/src/opusfile.c:1606:9
    #6 0x52fcd6 in op_open_callbacks /src/opusfile/src/opusfile.c:1623:6
    #7 0x530410 in op_open_close_on_failure /src/opusfile/src/opusfile.c:1643:6
    #8 0x5306bc in op_open_memory /src/opusfile/src/opusfile.c:1656:10
    #9 0x521156 in LLVMFuzzerTestOneInput /src/opusfile_fuzzer.c:28:21
    #10 0x4589d1 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15
    #11 0x458115 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:470:3
    #12 0x45a1e7 in fuzzer::Fuzzer::MutateAndTestOne() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:698:19
    #13 0x45ac65 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocator<fuzzer::SizedFile> >&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:832:5
    #14 0x449c3e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:826:6
    #15 0x472412 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
    #16 0x7f2b5b9f282f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #17 0x41e348 in _start (/out/opusfile_fuzzer+0x41e348)

Uninitialized value was created by an allocation of 'op' in the stack frame of function 'op_fetch_headers_impl'
    #0 0x545290 in op_fetch_headers_impl /src/opusfile/src/opusfile.c:479

SUMMARY: MemorySanitizer: use-of-uninitialized-value /src/llvm-project/compiler-rt/lib/msan/../sanitizer_common/sanitizer_common_interceptors.inc:877:10 in memcmp
Exiting
MS: 1 ShuffleBytes-; base unit: 7ad6badc7f6183245188ffe9997c3fb4b1bfd87e
artifact_prefix='./'; Test unit written to ./crash-27dee5063df1205fedd18a946d4e909f325ec2fb
```
【问题复现】
python infra/helper.py reproduce opusfile opusfile_fuzzer crash-27dee5063df1205fedd18a946d4e909f325ec2fb

src-openEuler/opusfile

内容风险标识

评论 (4)

src-openEuler/opusfile .gitee-modal { width: 500px !important; }

内容风险标识