selinux:selabel_file_text-fuzzer: Null-dereference READ in selabel_file_text-fuzzer

Stephen Smalley <[email protected]>
Newsgroups org.kernel.vger.selinux
Message-ID <CAEjxPJ5i7G79aw6d7L_fnvr8zgsxPnmW8bFEJ6NCXWerrSvvYA@mail.gmail.com>
This is oss-fuzz issue 547975134. Crash stacktrace below and
reproducer attached.

Last Tested Stacktrace on revision
728eab370eb3b9fea0ac577f0cca18efac29d238 (19 lines)
+----------------------------------------Release Build
Stacktrace----------------------------------------+
Command: /mnt/scratch0/clusterfuzz/resources/platform/linux/unshare -c
-n /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-afl_selinux_32ddf78d9f476617df7a8f4cf22b4d9340aef874/revisions/selabel_file_text-fuzzer
/mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash
Time ran: 0.021557331085205078
AddressSanitizer:DEADLYSIGNAL
=================================================================
==250==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
(pc 0x79f00f1efc0b bp 0x75f00d5d0920 sp 0x7ffe4c7c1e30 T0)
==250==The signal is caused by a READ memory access.
==250==Hint: address points to the zero page.
    #0 0x79f00f1efc0b  (<unknown module>)
==250==Register values:
rax = 0x00007ffe4c7c1e30  rbx = 0x000076100e6e0031  rcx =
0x0000000000000001  rdx = 0x0000000000000000
rdi = 0x000076100e6e002f  rsi = 0x0000000000000000  rbp =
0x000075f00d5d0920  rsp = 0x00007ffe4c7c1e30
 r8 = 0x000079f00f1efbe3   r9 = 0x00007fffffffff01  r10 =
0x00007fffffffff01  r11 = 0x00000ed881cd4001
r12 = 0x000075f00d5d0920  r13 = 0x0000000000989680  r14 =
0x000075f00ddd0020  r15 = 0x000075f00ddd8030
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (<unknown module>)
==250==ABORTING
Original Stacktrace on revision
eeebedb36cfe60837e6e81d28a346510fdca1541 (26 lines)
[Environment] ASAN_OPTIONS=exitcode=77
+----------------------------------------Release Build
Stacktrace----------------------------------------+
Command: /mnt/scratch0/clusterfuzz/resources/platform/linux/unshare -c
-n /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_selinux_32ddf78d9f476617df7a8f4cf22b4d9340aef874/revisions/selabel_file_text-fuzzer
-runs=100 /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/871230c698ec205c1c7a8f90fc46ae5a6de6d92db2c1dd129429d61e78dcrash
Time ran: 0.040129899978637695
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 4049782056
INFO: Loaded 1 modules   (32641 inline 8-bit counters): 32641
[0x5ca6bf693fe0, 0x5ca6bf69bf61),
INFO: Loaded 1 PC tables (32641 PCs): 32641 [0x5ca6bf69bf68,0x5ca6bf71b778),
/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_selinux_32ddf78d9f476617df7a8f4cf22b4d9340aef874/revisions/selabel_file_text-fuzzer:
Running 1 inputs 100 time(s) each.
Running: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/871230c698ec205c1c7a8f90fc46ae5a6de6d92db2c1dd129429d61e78dcrash
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1228==ERROR: AddressSanitizer: SEGV on unknown address
0x000000000000 (pc 0x7b2302c42c0b bp 0x7723010d0920 sp 0x7ffd3a6f1390
T0)
==1228==The signal is caused by a READ memory access.
==1228==Hint: address points to the zero page.
    #0 0x7b2302c42c0b  (<unknown module>)
==1228==Register values:
rax = 0x00007ffd3a6f1390  rbx = 0x00007743021e00b1  rcx =
0x0000000000000001  rdx = 0x0000000000000000
rdi = 0x00007743021e00af  rsi = 0x0000000000000000  rbp =
0x00007723010d0920  rsp = 0x00007ffd3a6f1390
 r8 = 0x00007b2302c42be3   r9 = 0x00007fffffffff01  r10 =
0x00007fffffffff01  r11 = 0x00000efee0434001
r12 = 0x00007723010d0920  r13 = 0x0000000000989680  r14 =
0x00007723018d0020  r15 = 0x00007723018d8030
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (<unknown module>)
==1228==ABORTING
clusterfuzz-testcase-minimized-selabel_file_text-fuzzer-5721256067137536 (application/octet-stream, 22 B) - not displayed
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.