Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix overflow when checking EOF #6

Merged
merged 1 commit into from
May 21, 2024

Conversation

DavidKorczynski
Copy link
Contributor

@DavidKorczynski DavidKorczynski commented May 21, 2024

The fuzzer added in #5 finds an overflow fairly fast, with the following stacktrace:

==13==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000014114 at pc 0x55c3024c35fc bp 0x7fff7b16ca30 sp 0x7fff7b16ca28                                                                                                                                             
READ of size 1 at 0x502000014114 thread T0                                                                                                                                                                                                                                         
SCARINESS: 12 (1-byte-read-heap-buffer-overflow)                                                                                                                                                                                                                                   
    #0 0x55c3024c35fb in sql3lexer_next /src/sqlite-createtable-parser/sql3parse_table.c:435:15                                                                                                                                                                                    
    #1 0x55c3024c0656 in sql3parse /src/sqlite-createtable-parser/sql3parse_table.c:1240:25
    #2 0x55c3024c0656 in sql3parse_table /src/sqlite-createtable-parser/sql3parse_table.c:1546:23
    #3 0x55c3024b5316 in LLVMFuzzerTestOneInput /src/fuzzer.c:24:25      

The input to sqlparse_table is: "/**"

This fixes it by extending IS_EOF to also check if the offset has increased beyond the buffer. Can confirm the fuzzer can run now for an extended period of time without findings issues.

Signed-off-by: David Korczynski <[email protected]>
@marcobambini marcobambini merged commit 368ffba into marcobambini:master May 21, 2024
1 check failed
@marcobambini
Copy link
Owner

Thanks @DavidKorczynski!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants