123 Star 0 Fork 13

src-openEuler/opusfile

【fuzz】use-of-uninitialized-value

已完成
缺陷
创建于  
2020-12-01 12:07

【环境信息】
x86
【测试版本】
Name: opusfile
Version: 0.11
Release: 2
【注意事项】
受影响版本排查(受影响/不受影响)
1、master
2、openEuler-LTS-20.03
3、openEuler-LTS-20.03-SP1
4、openEuler-LTS-20.03-Next
5、openEuler-20.09
【测试步骤】
1、编译
python3 infra/helper.py build_fuzzers --sanitizer memory opusfile
2、执行
python3 infra/helper.py run_fuzzer opusfile opusfile_fuzzer -rss_limit_mb=0
【报错信息】

#3694365        REDUCE cov: 64 ft: 98 corp: 18/11153b lim: 4096 exec/s: 10319 rss: 249Mb L: 4096/4096 MS: 2 CrossOver-CMP- DE: "S*\xe9\x94"-
Uninitialized bytes in MemcmpInterceptorCommon at offset 0 inside [0x7fff31ca6ef0, 4)
==13==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x4d5afe in memcmp /src/llvm-project/compiler-rt/lib/msan/../sanitizer_common/sanitizer_common_interceptors.inc:877:10
    #1 0x56b32c in ogg_sync_pageseek (/out/opusfile_fuzzer+0x56b32c)
    #2 0x544c2e in op_get_next_page /src/opusfile/src/opusfile.c:192:10
    #3 0x5433b8 in op_fetch_headers /src/opusfile/src/opusfile.c:577:8
    #4 0x52f163 in op_open1 /src/opusfile/src/opusfile.c:1555:9
    #5 0x52e8d2 in op_test_callbacks /src/opusfile/src/opusfile.c:1606:9
    #6 0x52fcd6 in op_open_callbacks /src/opusfile/src/opusfile.c:1623:6
    #7 0x530410 in op_open_close_on_failure /src/opusfile/src/opusfile.c:1643:6
    #8 0x5306bc in op_open_memory /src/opusfile/src/opusfile.c:1656:10
    #9 0x521156 in LLVMFuzzerTestOneInput /src/opusfile_fuzzer.c:28:21
    #10 0x4589d1 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15
    #11 0x458115 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:470:3
    #12 0x45a1e7 in fuzzer::Fuzzer::MutateAndTestOne() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:698:19
    #13 0x45ac65 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocator<fuzzer::SizedFile> >&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:832:5
    #14 0x449c3e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:826:6
    #15 0x472412 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
    #16 0x7f2b5b9f282f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #17 0x41e348 in _start (/out/opusfile_fuzzer+0x41e348)

  Uninitialized value was created by an allocation of 'op' in the stack frame of function 'op_fetch_headers_impl'
    #0 0x545290 in op_fetch_headers_impl /src/opusfile/src/opusfile.c:479

SUMMARY: MemorySanitizer: use-of-uninitialized-value /src/llvm-project/compiler-rt/lib/msan/../sanitizer_common/sanitizer_common_interceptors.inc:877:10 in memcmp
Exiting
MS: 1 ShuffleBytes-; base unit: 7ad6badc7f6183245188ffe9997c3fb4b1bfd87e
artifact_prefix='./'; Test unit written to ./crash-27dee5063df1205fedd18a946d4e909f325ec2fb

【问题复现】
python infra/helper.py reproduce opusfile opusfile_fuzzer crash-27dee5063df1205fedd18a946d4e909f325ec2fb

评论 (4)

jinjin 创建了缺陷 4年前
jinjin 关联仓库设置为src-openEuler/opusfile 4年前
展开全部操作日志
jinjin 负责人设置为small_leek 4年前
jinjin 里程碑设置为openEuler-20.03-LTS-SP1-round-2 4年前
jinjin 关联分支设置为openEuler-20.03-LTS-SP1 4年前

问题出在op_fetch_headers_impl中的op变量(局部变量),该变量存在使用前未赋值的情况,对其赋初值即可。
修改前:
输入图片说明
修改后:
输入图片说明

fuzz用例经长时间运行后也没有报错,已知就这一处告警,请知!

small_leek 任务状态待办的 修改为已完成 4年前

登录 后才可以发表评论

状态
负责人
项目
里程碑
Pull Requests
关联的 Pull Requests 被合并后可能会关闭此 issue
分支
开始日期   -   截止日期
-
置顶选项
优先级
预计工期 (小时)
参与者(3)
5329419 openeuler ci bot 1632792936 maminjie-maminjie jinjin-yanglijin
1
https://gitee.com/src-openeuler/opusfile.git
git@gitee.com:src-openeuler/opusfile.git
src-openeuler
opusfile
opusfile

搜索帮助