https://bugs.llvm.org/show_bug.cgi?id=32883
Bug ID: 32883
Summary: Stack-overflow in demangler (6)
Product: libc++abi
Version: unspecified
Hardware: All
OS: Linux
Status: NEW
Severity: normal
Priority: P
Component: All Bugs
Assignee: unassignedbugs at nondot.org
Reporter: dungnguy at comp.nus.edu.sg
CC: llvm-bugs at lists.llvm.org, mclow.lists at gmail.com
Dear All,
This bug was found with AFLGo, a directed version of AFL/AFLFast. Thanks also
to Marcel Böhme and Van-Thuan Pham.
First, you need to build the project
(https://github.com/llvm-mirror/libcxxabi/blob/master/fuzz/cxa_demangle_fuzzer.cpp)
to obtain the binary file.
To reproduce:
$ for R in $(seq 1 15000); do printf "R"; done > test; echo "" >> test; cat
test | ./cxa_demangle_fuzzer
Segmentation fault
ASAN says:
==25118==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd2d05ed80 (pc
0x00000084f33b bp 0x7ffd2d05f750 sp 0x7ffd2d05ed80 T0)
#0 0x84f33a in char const* __cxxabiv1::(anonymous
namespace)::parse_builtin_type<__cxxabiv1::(anonymous namespace)::Db>(char
const*, char const*, __cxxabiv1::(anonymous namespace)::Db&)
/src/llvm_libcxxabi/src/cxa_demangle.cpp:379
#1 0x5328ee in char const* __cxxabiv1::(anonymous
namespace)::parse_type<__cxxabiv1::(anonymous namespace)::Db>(char const*, char
const*, __cxxabiv1::(anonymous namespace)::Db&)
/src/llvm_libcxxabi/src/cxa_demangle.cpp:1967:33
#2 0x534565 in char const* __cxxabiv1::(anonymous
namespace)::parse_type<__cxxabiv1::(anonymous namespace)::Db>(char const*, char
const*, __cxxabiv1::(anonymous namespace)::Db&)
/src/llvm_libcxxabi/src/cxa_demangle.cpp:2094:29
#3 0x534565 in char const* __cxxabiv1::(anonymous
namespace)::parse_type<__cxxabiv1::(anonymous namespace)::Db>(char const*, char
const*, __cxxabiv1::(anonymous namespace)::Db&)
/src/llvm_libcxxabi/src/cxa_demangle.cpp:2094:29
#4 0x534565 in char const* __cxxabiv1::(anonymous
namespace)::parse_type<__cxxabiv1::(anonymous namespace)::Db>(char const*, char
const*, __cxxabiv1::(anonymous namespace)::Db&)
/src/llvm_libcxxabi/src/cxa_demangle.cpp:2094:29
...
Regards,
Manh-Dung Nguyen
--
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20170502/8215ade0/attachment-0001.html>