[Bug 3190] Segmentation fault in parse.c

https://bugs.exim.org/show_bug.cgi?id=3190

--- Comment #3 from Vitaly <[email protected]> ---
(In reply to Jeremy Harris from comment #1)
> Please say how the "crash input" file was used.

This is my parser_harness.c:

int main(void)
{
    store_init();
    __AFL_INIT();
    while (__AFL_LOOP(1000)) {
        size_t len = __AFL_FUZZ_TESTCASE_LEN;
        unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF;

        if (len == 0 || !buf ) {
            return 0;
        }

        char *buff = (char *)malloc(len + 1);
        memcpy(buff, buf, len);
        buff[len] = '\0';

        parse_fix_phrase(buff, Ustrlen(buff));
    }
    return 0;
}

Then I build harness with afl-clang and run harness:

./src/build-Linux-x86_64/parser_harness < crash.txt

So content of crash file is transferred to parse_fix_phrase().

-- 
You are receiving this mail because:
You are on the CC list for the bug.