This is a bug report.
I have recently submitted a fuzzer. It can be found here.
The fuzzer exposes a crash with the input {} and variations of this input such as new line inbetween, before and after the curly brackets.
Docker was pulled with the command go get github.com/docker/docker/image prior to running the fuzzer against the target.
Input that causes crash
The fuzzer with the input that causes the crash is to be found below. The only thing that is modified from the fuzzer in the PR is the input passed to store.Create().
package fuzz
import (
"github.com/docker/docker/image"
"os"
"io/ioutil"
"runtime"
"github.com/docker/docker/layer"
)
type mockLayerGetReleaser struct{}
func (ls *mockLayerGetReleaser) Get(layer.ChainID) (layer.Layer, error) {
return nil, nil
}
func (ls *mockLayerGetReleaser) Release(layer.Layer) ([]layer.Metadata, error) {
return nil, nil
}
func FuzzImage(data []byte) int {
tmpdir, err := ioutil.TempDir("", "images-fs-store")
defer os.RemoveAll(tmpdir)
if err != nil {
return -1
}
fsBackend, err := image.NewFSStoreBackend(tmpdir)
if err != nil {
return -1
}
mlgrMap := make(map[string]image.LayerGetReleaser)
mlgrMap[runtime.GOOS] = &mockLayerGetReleaser{}
store, err := image.NewImageStore(fsBackend, mlgrMap)
if err != nil {
return 0
}
_, err = store.Create([]byte(`{}`))
if err != nil {
return 0
}
return 1
}
Stacktrace
signal 11 received but handler not on signal stack
fatal error: non-Go code set up signal handler without SA_ONSTACK flag
runtime stack:
runtime: unexpected return pc for runtime.sigtramp called from 0x7f03988d8390
stack: frame={sp:0x10c00014f528, fp:0x10c00014f580} stack=[0x10c000147458,0x10c00014f858)
000010c00014f428: 000010c00014f448 000000000059f5a5 <runtime.sigNotOnStack+133>
000010c00014f438: 0000000000a2ac1a 0000000000000039
000010c00014f448: 000010c00014f4a0 000000000059e2fb <runtime.adjustSignalStack+411>
000010c00014f458: 000000000000000b 000010c00014f470
000010c00014f468: 000010c00014f4b0 00007f0398ffb000
000010c00014f478: 0000000000000000 0000000000008000
000010c00014f488: 00000000005242b0 000010c00014f6b0
000010c00014f498: 000010c00014f580 000010c00014f518
000010c00014f4a8: 000000000059e05f <runtime.sigtrampgo+319> 000010c00000000b
000010c00014f4b8: 000010c000038000 000010c00014f4d8
000010c00014f4c8: 000010c00014f500 0000000000555eb1 <runtime.nilinterhash+113>
000010c00014f4d8: 0000000000000000 0000000000000000
000010c00014f4e8: 0000000000000000 0000000000000000
000010c00014f4f8: 0000000000000000 000010c000000600
000010c00014f508: 000010c00014f6b0 000010c00014f580
000010c00014f518: 000010c00014f570 00000000005bfa23 <runtime.sigtramp+67>
000010c00014f528: <000000000000000b 000010c00014f6b0
000010c00014f538: 000010c00014f580 000010c00031c680
000010c00014f548: 000010c000000600 000010c000038000
000010c00014f558: 000010c00014f970 000010c00014f570
000010c00014f568: 00000000addc2fb7 000010c00014fdc0
000010c00014f578: !00007f03988d8390 >0000000000000007
000010c00014f588: 0000000000000000 00007f0398ffb000
000010c00014f598: 0000000000000000 0000000000008000
000010c00014f5a8: 0000000000000000 0000000000f84400
000010c00014f5b8: 000010c000000480 0000000000000001
000010c00014f5c8: 000010c00014f970 000010c000038000
000010c00014f5d8: 000010c000000600 000010c00031c680
000010c00014f5e8: 000010c00014fdb0 0000000000000001
000010c00014f5f8: 000010c00014fdc0 00000000addc2fb7
000010c00014f608: 00000000b9fd536a 000010c0002c3900
000010c00014f618: 0000000000000000 000010c00014fb28
000010c00014f628: 00000000009f85e9 <github.com/docker/docker/image.(*store).Create+329> 0000000000010286
000010c00014f638: 002b000000000033 0000000000000004
000010c00014f648: 000000000000000e 0000000000000000
000010c00014f658: 0000000000000018 000010c00014f740
000010c00014f668: 0000000000000009 000010c00014f6c0
000010c00014f678: 000000000070aed1 <encoding/json.(*decodeState).scanWhile+241>
runtime.throw(0xa2ac1a, 0x39)
runtime/panic.go:1116 +0x74
runtime.sigNotOnStack(0xb)
runtime/signal_unix.go:926 +0x85
runtime.adjustSignalStack(0x10c00000000b, 0x10c000038000, 0x10c00014f4d8, 0x10c00014f500)
runtime/signal_unix.go:516 +0x19b
runtime.sigtrampgo(0xb, 0x10c00014f6b0, 0x10c00014f580)
runtime/signal_unix.go:461 +0x13f
runtime: unexpected return pc for runtime.sigtramp called from 0x7f03988d8390
stack: frame={sp:0x10c00014f528, fp:0x10c00014f580} stack=[0x10c000147458,0x10c00014f858)
000010c00014f428: 000010c00014f448 000000000059f5a5 <runtime.sigNotOnStack+133>
000010c00014f438: 0000000000a2ac1a 0000000000000039
000010c00014f448: 000010c00014f4a0 000000000059e2fb <runtime.adjustSignalStack+411>
000010c00014f458: 000000000000000b 000010c00014f470
000010c00014f468: 000010c00014f4b0 00007f0398ffb000
000010c00014f478: 0000000000000000 0000000000008000
000010c00014f488: 00000000005242b0 000010c00014f6b0
000010c00014f498: 000010c00014f580 000010c00014f518
000010c00014f4a8: 000000000059e05f <runtime.sigtrampgo+319> 000010c00000000b
000010c00014f4b8: 000010c000038000 000010c00014f4d8
000010c00014f4c8: 000010c00014f500 0000000000555eb1 <runtime.nilinterhash+113>
000010c00014f4d8: 0000000000000000 0000000000000000
000010c00014f4e8: 0000000000000000 0000000000000000
000010c00014f4f8: 0000000000000000 000010c000000600
000010c00014f508: 000010c00014f6b0 000010c00014f580
000010c00014f518: 000010c00014f570 00000000005bfa23 <runtime.sigtramp+67>
000010c00014f528: <000000000000000b 000010c00014f6b0
000010c00014f538: 000010c00014f580 000010c00031c680
000010c00014f548: 000010c000000600 000010c000038000
000010c00014f558: 000010c00014f970 000010c00014f570
000010c00014f568: 00000000addc2fb7 000010c00014fdc0
000010c00014f578: !00007f03988d8390 >0000000000000007
000010c00014f588: 0000000000000000 00007f0398ffb000
000010c00014f598: 0000000000000000 0000000000008000
000010c00014f5a8: 0000000000000000 0000000000f84400
000010c00014f5b8: 000010c000000480 0000000000000001
000010c00014f5c8: 000010c00014f970 000010c000038000
000010c00014f5d8: 000010c000000600 000010c00031c680
000010c00014f5e8: 000010c00014fdb0 0000000000000001
000010c00014f5f8: 000010c00014fdc0 00000000addc2fb7
000010c00014f608: 00000000b9fd536a 000010c0002c3900
000010c00014f618: 0000000000000000 000010c00014fb28
000010c00014f628: 00000000009f85e9 <github.com/docker/docker/image.(*store).Create+329> 0000000000010286
000010c00014f638: 002b000000000033 0000000000000004
000010c00014f648: 000000000000000e 0000000000000000
000010c00014f658: 0000000000000018 000010c00014f740
000010c00014f668: 0000000000000009 000010c00014f6c0
000010c00014f678: 000000000070aed1 <encoding/json.(*decodeState).scanWhile+241>
runtime.sigtramp(0x7, 0x0, 0x7f0398ffb000, 0x0, 0x8000, 0x0, 0xf84400, 0x10c000000480, 0x1, 0x10c00014f970, ...)
runtime/sys_linux_amd64.s:409 +0x43
goroutine 34 [syscall, locked to thread]:
runtime.goexit()
runtime/asm_amd64.s:1374 +0x1 fp=0x10c000047fe8 sp=0x10c000047fe0 pc=0x5bde01
goroutine 17 [running, locked to thread]:
goroutine running on other thread; stack unavailable
AddressSanitizer:DEADLYSIGNAL
=================================================================
==11==ERROR: AddressSanitizer: ABRT on unknown address 0x00000000000b (pc 0x0000005bf681 bp 0x10c00014f360 sp 0x10c00014f348 T0)
SCARINESS: 10 (signal)
#0 0x5bf681 in runtime.raise runtime/sys_linux_amd64.s:165
DEDUP_TOKEN: runtime.raise
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: ABRT runtime/sys_linux_amd64.s:165 in runtime.raise
==11==ABORTING
MS: 0 ; base unit: 0000000000000000000000000000000000000000
This is a bug report.
I have recently submitted a fuzzer. It can be found here.
The fuzzer exposes a crash with the input
{}and variations of this input such as new line inbetween, before and after the curly brackets.Docker was pulled with the command
go get github.com/docker/docker/imageprior to running the fuzzer against the target.Input that causes crash
The fuzzer with the input that causes the crash is to be found below. The only thing that is modified from the fuzzer in the PR is the input passed to
store.Create().Stacktrace