llvm.org GIT mirror llvm / 80394a6
Fix llvm-special-case-list-fuzzer regexp exception Summary: Original oss-fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3727#c2 The minimized test case that causes this failure: 5b 5b 5b 3d 47 53 00 5b 3d 5d 5b 5d 0a [[[=GS.[=][]. Note the string "=GS\x00". The failure happens because the code is searching the string against an array of known collated names. "GS\x00" is a hit, but since len takes into account an extra NUL byte, indexing into cp->name[len] goes one byte past it's allocated memory. Fix this to use a strlen(cp->name) comparison to account for NUL bytes in the input. Reviewers: pcc Reviewed By: pcc Subscribers: hctim, kcc Differential Revision: https://reviews.llvm.org/D39380 git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@316786 91177308-0d34-0410-b5e6-96231b3b80d8 Vlad Tsyrklevich 1 year, 9 months ago
2 changed file(s) with 10 addition(s) and 2 deletion(s). Raw diff Collapse all Expand all
10071007 {
10081008 char *sp = p->next;
10091009 struct cname *cp;
1010 int len;
1010 size_t len;
10111011
10121012 while (MORE() && !SEETWO(endc, ']'))
10131013 NEXT();
10171017 }
10181018 len = p->next - sp;
10191019 for (cp = cnames; cp->name != NULL; cp++)
1020 if (strncmp(cp->name, sp, len) == 0 && cp->name[len] == '\0')
1020 if (strncmp(cp->name, sp, len) == 0 && strlen(cp->name) == len)
10211021 return(cp->code); /* known name */
10221022 if (len == 1)
10231023 return(*sp); /* single character */
170170 EXPECT_FALSE(r1.match("X"));
171171 }
172172
173 // https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3727
174 TEST_F(RegexTest, OssFuzz3727Regression) {
175 // Wrap in a StringRef so the NUL byte doesn't terminate the string
176 Regex r(StringRef("[[[=GS\x00[=][", 10));
177 std::string Error;
178 EXPECT_FALSE(r.isValid(Error));
173179 }
180
181 }