selinux:selabel_file_text-fuzzer: Null-dereference READ in selabel_file_text-fuzzer
Stephen Smalley <[email protected]>
| Newsgroups | org.kernel.vger.selinux |
|---|---|
| Message-ID | <CAEjxPJ5i7G79aw6d7L_fnvr8zgsxPnmW8bFEJ6NCXWerrSvvYA@mail.gmail.com> |
This is oss-fuzz issue 547975134. Crash stacktrace below and
reproducer attached.
Last Tested Stacktrace on revision
728eab370eb3b9fea0ac577f0cca18efac29d238 (19 lines)
+----------------------------------------Release Build
Stacktrace----------------------------------------+
Command: /mnt/scratch0/clusterfuzz/resources/platform/linux/unshare -c
-n /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-afl_selinux_32ddf78d9f476617df7a8f4cf22b4d9340aef874/revisions/selabel_file_text-fuzzer
/mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash
Time ran: 0.021557331085205078
AddressSanitizer:DEADLYSIGNAL
=================================================================
==250==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
(pc 0x79f00f1efc0b bp 0x75f00d5d0920 sp 0x7ffe4c7c1e30 T0)
==250==The signal is caused by a READ memory access.
==250==Hint: address points to the zero page.
#0 0x79f00f1efc0b (<unknown module>)
==250==Register values:
rax = 0x00007ffe4c7c1e30 rbx = 0x000076100e6e0031 rcx =
0x0000000000000001 rdx = 0x0000000000000000
rdi = 0x000076100e6e002f rsi = 0x0000000000000000 rbp =
0x000075f00d5d0920 rsp = 0x00007ffe4c7c1e30
r8 = 0x000079f00f1efbe3 r9 = 0x00007fffffffff01 r10 =
0x00007fffffffff01 r11 = 0x00000ed881cd4001
r12 = 0x000075f00d5d0920 r13 = 0x0000000000989680 r14 =
0x000075f00ddd0020 r15 = 0x000075f00ddd8030
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (<unknown module>)
==250==ABORTING
Original Stacktrace on revision
eeebedb36cfe60837e6e81d28a346510fdca1541 (26 lines)
[Environment] ASAN_OPTIONS=exitcode=77
+----------------------------------------Release Build
Stacktrace----------------------------------------+
Command: /mnt/scratch0/clusterfuzz/resources/platform/linux/unshare -c
-n /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_selinux_32ddf78d9f476617df7a8f4cf22b4d9340aef874/revisions/selabel_file_text-fuzzer
-runs=100 /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/871230c698ec205c1c7a8f90fc46ae5a6de6d92db2c1dd129429d61e78dcrash
Time ran: 0.040129899978637695
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 4049782056
INFO: Loaded 1 modules (32641 inline 8-bit counters): 32641
[0x5ca6bf693fe0, 0x5ca6bf69bf61),
INFO: Loaded 1 PC tables (32641 PCs): 32641 [0x5ca6bf69bf68,0x5ca6bf71b778),
/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_selinux_32ddf78d9f476617df7a8f4cf22b4d9340aef874/revisions/selabel_file_text-fuzzer:
Running 1 inputs 100 time(s) each.
Running: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/871230c698ec205c1c7a8f90fc46ae5a6de6d92db2c1dd129429d61e78dcrash
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1228==ERROR: AddressSanitizer: SEGV on unknown address
0x000000000000 (pc 0x7b2302c42c0b bp 0x7723010d0920 sp 0x7ffd3a6f1390
T0)
==1228==The signal is caused by a READ memory access.
==1228==Hint: address points to the zero page.
#0 0x7b2302c42c0b (<unknown module>)
==1228==Register values:
rax = 0x00007ffd3a6f1390 rbx = 0x00007743021e00b1 rcx =
0x0000000000000001 rdx = 0x0000000000000000
rdi = 0x00007743021e00af rsi = 0x0000000000000000 rbp =
0x00007723010d0920 rsp = 0x00007ffd3a6f1390
r8 = 0x00007b2302c42be3 r9 = 0x00007fffffffff01 r10 =
0x00007fffffffff01 r11 = 0x00000efee0434001
r12 = 0x00007723010d0920 r13 = 0x0000000000989680 r14 =
0x00007723018d0020 r15 = 0x00007723018d8030
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (<unknown module>)
==1228==ABORTING
clusterfuzz-testcase-minimized-selabel_file_text-fuzzer-5721256067137536
(application/octet-stream, 22 B) - not displayed