Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Using minivec causes the fuzzer to SEGV. #4

Closed
hbina opened this issue Feb 12, 2021 · 1 comment
Closed

Using minivec causes the fuzzer to SEGV. #4

hbina opened this issue Feb 12, 2021 · 1 comment

Comments

@hbina
Copy link
Owner

hbina commented Feb 12, 2021

Checkout branch feat/using-fuzzers-and-minivec.
Perform fuzzing with cargo +nightly fuzz run fuzz_target_1.
See that it SEGV on the simplest input.
Using standard Vec does not cause this problem.
I suspect the implementation of drain is faulty.

   Compiling applejack-fuzz v0.0.0 (/home/hbina/git/applejack/fuzz)
    Finished release [optimized] target(s) in 1.56s
    Finished release [optimized] target(s) in 0.00s
     Running `fuzz/target/x86_64-unknown-linux-gnu/release/fuzz_target_1 -artifact_prefix=/home/hbina/git/applejack/fuzz/artifacts/fuzz_target_1/ /home/hbina/git/applejack/fuzz/corpus/fuzz_target_1`
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 1066036984
INFO: Loaded 1 modules   (1418 inline 8-bit counters): 1418 [0x55f184dbf712, 0x55f184dbfc9c), 
INFO: Loaded 1 PC tables (1418 PCs): 1418 [0x55f184dbfca0,0x55f184dc5540), 
INFO:     1623 files found in /home/hbina/git/applejack/fuzz/corpus/fuzz_target_1
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
INFO: seed corpus: files: 1623 min: 1b max: 4040b total: 471343b rss: 31Mb
AddressSanitizer:DEADLYSIGNAL
=================================================================
==135950==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x55f184c0958b bp 0x7ffd424b8570 sp 0x7ffd424b8000 T0)
==135950==The signal is caused by a WRITE memory access.
==135950==Hint: address points to the zero page.
    #0 0x55f184c0958b  (/home/hbina/git/applejack/fuzz/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0xec58b)
    #1 0x55f184c09981  (/home/hbina/git/applejack/fuzz/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0xec981)
    #2 0x55f184c0b922  (/home/hbina/git/applejack/fuzz/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0xee922)
    #3 0x55f184c1e260  (/home/hbina/git/applejack/fuzz/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0x101260)
    #4 0x55f184c1debf  (/home/hbina/git/applejack/fuzz/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0x100ebf)
    #5 0x55f184c28a28  (/home/hbina/git/applejack/fuzz/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0x10ba28)
    #6 0x55f184c2db90  (/home/hbina/git/applejack/fuzz/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0x110b90)
    #7 0x55f184c30446  (/home/hbina/git/applejack/fuzz/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0x113446)
    #8 0x55f184c308b7  (/home/hbina/git/applejack/fuzz/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0x1138b7)
    #9 0x55f184c1a557  (/home/hbina/git/applejack/fuzz/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0xfd557)
    #10 0x55f184b488d6  (/home/hbina/git/applejack/fuzz/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0x2b8d6)
    #11 0x7f208e600cb1  (/lib/x86_64-linux-gnu/libc.so.6+0x28cb1)
    #12 0x55f184b48a7d  (/home/hbina/git/applejack/fuzz/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0x2ba7d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/home/hbina/git/applejack/fuzz/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0xec58b) 
==135950==ABORTING
MS: 0 ; base unit: 0000000000000000000000000000000000000000
0xe6,0xa4,
\xe6\xa4
artifact_prefix='/home/hbina/git/applejack/fuzz/artifacts/fuzz_target_1/'; Test unit written to /home/hbina/git/applejack/fuzz/artifacts/fuzz_target_1/crash-51943bd7f498abd3bde33971a15101f8445fe8d1
Base64: 5qQ=

────────────────────────────────────────────────────────────────────────────────

Failing input:

	fuzz/artifacts/fuzz_target_1/crash-51943bd7f498abd3bde33971a15101f8445fe8d1

Output of `std::fmt::Debug`:

	[230, 164]

Reproduce with:

	cargo fuzz run fuzz_target_1 fuzz/artifacts/fuzz_target_1/crash-51943bd7f498abd3bde33971a15101f8445fe8d1

Minimize test case with:

	cargo fuzz tmin fuzz_target_1 fuzz/artifacts/fuzz_target_1/crash-51943bd7f498abd3bde33971a15101f8445fe8d1

────────────────────────────────────────────────────────────────────────────────

Error: Fuzz target exited with exit code: 1
@hbina
Copy link
Owner Author

hbina commented Feb 13, 2021

Fix awaiting author approval cmazakas/minivec#19

@hbina hbina closed this as completed Feb 28, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant