blob: fix OOB access in blob_check_type
authorPetr Štetiar <ynezz@true.cz>
Mon, 9 Dec 2019 14:27:16 +0000 (15:27 +0100)
committerPetr Štetiar <ynezz@true.cz>
Wed, 25 Dec 2019 09:31:58 +0000 (10:31 +0100)
commit478597b9f9ae66836759701a9ec708816506d07c
tree97aab389162f8008384a8b38794c869707606119
parent325418a7a3c0e22cfbd6726693d780c1afd9d9c6
blob: fix OOB access in blob_check_type

Found by fuzzer:

 ERROR: AddressSanitizer: SEGV on unknown address 0x602100000455
 The signal is caused by a READ memory access.
     #0 in blob_check_type blob.c:214:43
     #1 in blob_parse_attr blob.c:234:9
     #2 in blob_parse_untrusted blob.c:272:12
     #3 in fuzz_blob_parse tests/fuzzer/test-blob-parse-fuzzer.c:34:2
     #4 in LLVMFuzzerTestOneInput tests/fuzzer/test-blob-parse-fuzzer.c:39:2

Caused by following line:

if (type == BLOB_ATTR_STRING && data[len - 1] != 0)

where len was pointing outside of the data buffer.

Signed-off-by: Petr Štetiar <ynezz@true.cz>
blob.c
tests/cram/test_blob_parse.t
tests/fuzz/corpus/crash-333757b203a44751d3535f24b05f467183a96d09 [new file with mode: 0644]