bug#23549: parted needs to be afl-fuzzed (crash found on Debian, 3.2-15)

Jacek Wielemborek <[email protected]>
Newsgroups gmane.comp.gnu.parted.bugs
Message-ID <[email protected]>
Hello,

The following base64-encoded device crashes parted 3.2 on "print all":

C+WpQf////8AAAAQAAAAAAAA5/8AAAAEAAAAAAAgAgAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAABkAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABkAAAAAAAAAAAAAADqAAAAAAAA
AAAAAAAA/gAAAAD////5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAABGAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAEAAAAA+////wAAAAAAAGQAQAAAAAAAAAAAAAAA
AACJiYmJiYmJiYmJiYmJDgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAA//9//wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIgAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAOoA
AAAAAAAAAAAAAAAAAAAARgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AACrAAAAAPH/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAD////qAAAAAAAAAAAAAAAA8hZWDgAAAAAAAAAAAAAAAAARAAAIAAD+AAAA
AP////kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA5h0AAAAAAAAAAAAAAAAA
AAAAAAAAAO7iAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAHgAAAAAAAAAAZAAAAAAAAAAAAAAFAAAAAAAAAAAAAAAAAAAAAADm////
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE
AgAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAP////roAAAA
AAAAABsAIwAAAO//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAABkAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAiAAAAAAAAAAAAAAB/AAAAAAAAAAAAAAAAAAAAAAAAAOb/HwAA
AAAAAAAA7v///wAAAAAAAAAfAAAAAAAAAAAAAP////8AAAAAAAAAAAAAAAAA
6f8AAAAAAAAAAAAAAAAAAABkAAAZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAHAAAAAAAA

Here's an archive of input files I started fuzzing with:

H4sIAB21OVcAA+3VT2xURRgA8NlNBSOKJEbicSR48dJ9r7tvvRlCipAQg6RF
DxystEqluGb/kBg51JJw0IQ70XDyIuVADAeMUD0YbxrDyRDizQOQcJCbJq1v
/0AsCS1pu2DT32/z9pv9Zt7Mt2+SeZPpYOi3Uq5aqXRi7sHYaSdpNcmG0mpW
zfNJ+xNipe+V5VqN5lg9xlCv1ZpLjVuuf52aTAffn5ya6Osa7Q3OyuWH7X/6
n/3PKpWsvf/VoUqIpb5W1bPB9//vy2Hbmd+uhIuXQzjz+5kf/5kLJ38Im74L
xbtf33p5Uwhzc5tfG2htOfXzts/m5ze37t7efql4sfB9OPnt9OfNwhf7i7+8
cCucDOH2/JP+KxvKV1dO/NSOxXAqvwp5q7CCWUbPr21VrDf5+f/Bx30+2JY8
/5NStuj9n7/4OznnPyyrEO7MLyy0z/7hFdw9en54z754YNfBkfZMh/PM678+
P9Wdt+verDt6cWcvXho9e33vhRv7z92Mx6425maLvfx07zp9bWR2BQUBAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAYzG8Z188sOvgSAiFcDj/
/epbu5/p5Hv9hV7c0Ys7e/HS6Nnrey/c2H/uZjx2tTE3+0ovP927Tl8bme1/
9azWZDrYaH3U3zVKuaxc7sTc4piUsnY7SatJNpRW8yu0c2k5xFJ/y+pqNZpj
9RhDvVZrLjVuuf516o03R+OBsXpzYjzuzh9F7Xg88slULMWxqWb+fXQ8lmNj
4kjMd6VvCvdbT99vPfUoN7773B931r6c/58XX7rf7D6rgRDXYt7rc8c/XIt5
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANaTyXRw/MTR/q5R
ymXlcifmFseklLXbSVpNsqG0mmVZ6OSqIZb6W1ZXq9Ecq8cY6rVac6lxy/Wv
U1v+/GbXQu6hAwY637H4uArinj3L5DetZvK/th/aupr7AQAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAANaryXTwvcZ4f9co5bJyuRNzi2NSytrt
JK0m2VBarab5uKRUqSYhlvpbVler0RyrxxjqtVpzqXHL9W9Qbw8fmhl4lIHF
EGIe7o2dfqB729bCqmq4+Gyhu0Bc8TQbypcz78x8OnFo5knXAQAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALBa/wLdzr7yAFgCAA==

I used my afl-sid project [1] to generate the ASAN-augmented build and
the following command line to find a crash in 20 minutes:

afl-fuzz -d -i i2 -o o -m none -- parted -s @@ print all

I couldn't reproduce the crash on Fedora 23 (3.26-16).

Let me know if you need any more help fuzzing - I'll be happy to help.

Cheers,
d33tah

[1] https://github.com/d33tah/aflize
signature.asc (application/pgp-signature, 819 B)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJXObcfAAoJEGlViymZXJRvNZwP+gJeJIPa0vBUpHuaesOyXwD9
DDfvCFMGWGY+QLTATRoZ5QYvGxkTvGhdsSltgPf8jWFLBtwB8l3GJaB21CUlwphB
NV/ablvJzA+V0iQVeuIC8jjuRGjoP17q1/6DnLbHGNdLQBfzDkDyVqLxJU12trwO
Qyxne5tTjCA3SldFrfeu+1xX3U22YXItxEQeDoU4ej/LnaZ+R9rz7ESso9pCP2N8
VbgUwcwCopM49KYdwv6dOWAqqeL6nHaqxZQ385iFqzQxIqe/rF2yX5Uz2ogTdtSQ
/XegBD5D1d0B/6Xjoc19XdWN/ZgrGhoOvSuEOZ9+FfCn6cqPzbHvIg7/tSY3I8OU
bufUZ/+BKxfuNrAcMdEUIf51N9tfsmfa0U72Z/PcO5cvur2i8uE/9i0vRPuWm6i4
z6tMpXkE3Qy9FdyCHV3l+DohDd/z2Dy91ROTUy9fP8gkUz4k2Ac0D61IjvmkGWPh
LTadhiBw1s7ZPwq255aClNrzXQPFVbn26Mg5lny1mPpR9vuCpmVh1g6xwmMyZixF
oZhY7XeUWM27Ojhi098jqua3VkxKWpGffBnWrPX8zaolF9vez2vdD+atSHV8R2RT
6wtXu7GEpiR4N37Cbwf+pMCmdbO8CopeJYBnt+W81ZCJB6h2uEkvslWcZBcYOuJt
Z17/o+PzJhL7wAwogBO5
=S+0k
-----END PGP SIGNATURE-----
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.