timoreo/olm
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix a fuzzing harness double free when input is of size 0.

Browse source 
Consider the case when the input is size 0. In this case, `count` and
`buffer_pos` will be 0 as well. The `realloc` call in the `count == 0`
branch will then effectively become a free.

However, `realloc` can sometimes return `NULL` when a 0 is passed for
the size. The current code assumes that this only happens on a memory
allocation error and breaks out of the loop. This then becomes a double
free because the buffer is freed a second time, causing an abort.

The intent of the `realloc` is probably to downsize the buffer to fit
the data exactly in order to make incorrect memory access more obvious.
This commit skips this downsizing if the size of the input data is 0.
This commit is contained in:
Denis Kasak 2021-05-10 13:05:57 +02:00 committed by Hubert Chathi
parent 15f65283c7
commit 8d1cfd207a
1 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
fuzzers/include/fuzzing.hh
View file

@ -24,9 +24,11 @@ ssize_t read_file(
);
if (count < 0) break;
if (count == 0) {
uint8_t * return_buffer = (uint8_t *) realloc(current_buffer, buffer_pos);
if (return_buffer == NULL) break;
*buffer = return_buffer;
if (buffer_pos != 0) {
current_buffer = (uint8_t *) realloc(current_buffer, buffer_pos);
if (current_buffer == NULL) break;
}
*buffer = current_buffer;
return buffer_pos;
}
buffer_pos += count;