Page MenuHomePhabricator

Fix llvm-special-case-list-fuzzer regexp exception

Authored by vlad.tsyrklevich on Oct 27 2017, 11:50 AM.



Original oss-fuzz report:

The minimized test case that causes this failure:
5b 5b 5b 3d 47 53 00 5b 3d 5d 5b 5d 0a [[[=GS.[=][].

Note the string "=GS\x00". The failure happens because the code is
searching the string against an array of known collated names. "GS\x00"
is a hit, but since len takes into account an extra NUL byte, indexing
into cp->name[len] goes one byte past it's allocated memory. Fix this to
use a strlen(cp->name) comparison to account for NUL bytes in the input.

Diff Detail


Event Timeline

  • Add regression test
pcc accepted this revision.Oct 27 2017, 12:10 PM


Should this fix also be sent upstream?

This revision is now accepted and ready to land.Oct 27 2017, 12:10 PM
This revision was automatically updated to reflect the committed changes.