Null Pointer Dereference in __bloom_check via Uninitialized file_bloom in fio

Hi,

We are a team of security researchers at UC Berkeley. We recently
identified a bug in the latest version of the fio library. In
fio/lib/bloom.c, a null pointer dereference exception is triggered on line
103 in the __bloom_check function. It seems that certain inputs cause the
function file_bloom_exists, in the file fio/filehash.c, to call the
function bloom_string on line 103 when the variable file_bloom has yet to
be initialized. file_bloom is passed as the first argument to the
bloom_string function, which itself is located in the fio/lib/bloom.c file.
bloom_string then calls __bloom_check with the null pointer as the first
argument, ultimately leading to the exception.

You may find the original input that caused this error below (please unzip
first), with sha256 checksum
78ac354e97f09a8b5fef7332dc3653a328ae955feded239b95eebaff6db9e553.

Though, the following input is more concise and preserves the same program
behavior:
[global]
numjobs=2
filename=x

Sincerely,
UC Berkeley CyberGym Team