Re: Null Pointer Dereference in __bloom_check via Uninitialized file_bloom in fio

Hi,

Just want to follow up and resurface the email. Please let me know if
you need any additional information from my end.

Best,
Zhun

On Sun, Jun 15, 2025 at 1:12 AM CyberGym <[email protected]> wrote:
>
> Hi,
>
> We are a team of security researchers at UC Berkeley. We recently identified a bug in the latest version of the fio library. In fio/lib/bloom.c, a null pointer dereference exception is triggered on line 103 in the __bloom_check function. It seems that certain inputs cause the function file_bloom_exists, in the file fio/filehash.c, to call the function bloom_string on line 103 when the variable file_bloom has yet to be initialized. file_bloom is passed as the first argument to the bloom_string function, which itself is located in the fio/lib/bloom.c file. bloom_string then calls __bloom_check with the null pointer as the first argument, ultimately leading to the exception.
>
> You may find the original input that caused this error below (please unzip first), with sha256 checksum 78ac354e97f09a8b5fef7332dc3653a328ae955feded239b95eebaff6db9e553.
>
> Though, the following input is more concise and preserves the same program behavior:
> [global]
> numjobs=2
> filename=x
>
> Sincerely,
> UC Berkeley CyberGym Team