[llvm-bugs] [Bug 43435] New: Fuzzer crashed while fuzzing Mosquitto lib

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=43435

            Bug ID: 43435
           Summary: Fuzzer crashed while fuzzing Mosquitto lib
           Product: compiler-rt
           Version: unspecified
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: fuzzer
          Assignee: unassignedbugs at nondot.org
          Reporter: huangyu.hw at foxmail.com
                CC: llvm-bugs at lists.llvm.org

Hi,
Here comes a bug while fuzzing Mosquitto lib, I would like to know the solution
or the group/person I can contact.

Step1. compile the lib

#:~/fuzz/fuzzmqtt/mosquitto$ ls
about.html       doc                   Makefile            security
aclfile.example  docker                man                 SECURITY.md
appveyor.yml     edl-v10               misc                service
buildtest.py     epl-v10               mosquitto.conf      set-version.sh
ChangeLog.txt    examples              Mosquitto.podspec   snap
client           installer             notice.html         src
CMakeLists.txt   lib                   pskfile.example     test
compiling.txt    libmosquitto.pc.in    pwfile.example      THANKS.txt
config.h         libmosquittopp.pc.in  readme.md           travis-configure.sh
config.mk        LICENSE.txt           readme-tests.md     travis-install.sh
CONTRIBUTING.md  logo                  readme-windows.txt  www


#:~/fuzz/fuzzmqtt/mosquitto$ sudo make install CC="clang -O2
-fno-omit-frame-pointer -g -fsanitize=address
-fsanitize-coverage=trace-pc-guard,trace-cmp,trace-gep,trace-div" -j2

Step2. compile the fuzzer

#:~/fuzz/fuzzmqtt/mosquitto/lib$ clang -g -O1 -fsanitize=fuzzer,address
mos_fuzzer.cc -o mos_fuzzer -lmosquitto

Step3. Run the fuzzer and got the bug

#~/fuzz/fuzzmqtt/mosquitto/lib$ ./mos_fuzzer 
INFO: Seed: 106983829
INFO: Loaded 1 modules   (2337 guards): 2337 [0x7f157cd816b0, 0x7f157cd83b34), 
INFO: Loaded 1 modules   (1 inline 8-bit counters): 1 [0x787f80, 0x787f81), 
INFO: Loaded 1 PC tables (1 PCs): 1 [0x565af8,0x565b08), 
ERROR: The size of coverage PC tables does not match the
number of instrumented PCs. This might be a compiler bug,
please contact the libFuzzer developers.
Also check https://bugs.llvm.org/show_bug.cgi?id=34636
for possible workarounds (tl;dr: don't use the old GNU ld)

The fuzzer code is as follow


#include "stdio.h"
#include "mosquitto.h"
#include "assert.h"
#include "stdint.h"
#include "stddef.h"
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {

    bool clean_session = true;
    struct mosquitto *mosq = NULL;
    mosquitto_lib_init();
    void *data_1=(void *)data;
    mosq = mosquitto_new(NULL, clean_session, data_1);
    mosquitto_destroy(mosq);
    mosquitto_lib_cleanup();
    return 0;
}

Thank you

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20190925/cb3f06eb/attachment.html>