musl - Re: buffer overflow in regcomp and a way to find more of those

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150323122553.GO16260@port70.net>
Date: Mon, 23 Mar 2015 13:25:54 +0100
From: Szabolcs Nagy <nsz@...t70.net>
To: Konstantin Serebryany <konstantin.s.serebryany@...il.com>
Cc: Rich Felker <dalias@...c.org>, musl@...ts.openwall.com
Subject: Re: buffer overflow in regcomp and a way to find more of those

* Konstantin Serebryany <konstantin.s.serebryany@...il.com> [2015-03-22 22:02:48 -0700]:
> On Sat, Mar 21, 2015 at 2:03 PM, Szabolcs Nagy <nsz@...t70.net> wrote:
> > i wrote some trivial test cases for
> >
> > __dn_expand
> > __dns_parse
> > __pleval
> > fnmatch
> > inet_pton
> > strptime
> 
> Cool! Is there something you plan to have in the repository or share
> some other way?
> 

(musl does not have extra tools/docs/tests in the main repo,
this is what you want eg for toolchain builds and packaging)

but i plan to release the tests somewhere
(currently they just trivial calls into the relevant libc function)

i don't know what's the best way to fuzz more than one argument
eg fnmatch(pattern, string, flags)

is it ok to just split the input data between the args?
(i havent looked under the hood how the fuzzer mutates the input)

> > #27461772       NEW: 548 B: 0 L: 16 S: 22 I: 0  8283::2:2.8.83.3        16: 56 50 56 51 58 58 50 58 50 46 56 46 56 51 46 51
> > #27469404       NEW: 549 B: 0 L: 24 S: 23 I: 2  8283::2:283:2.8.83.2.833        24: 56 50 56 51 58 58 50 58 50 56 51 58 50 46 56 46 56 51 46 50 46 56 51 51
> > Bus error (core dumped)
> >
> > is there a way to get a reproducer after such a crash?
> >
> 
> the fuzzer relies on asan to call at-crash handler -- this is what
> __sanitizer_set_death_callback is for.
> w/o asan you can set up a signal handler that will print
> fuzzer::Fuzzer::CurrentUnit.
> If everything else fails you can of course re-rerun the fuzzer with
> the same seed.
> 

thanks, sounds good

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.