-
-
Notifications
You must be signed in to change notification settings - Fork 11.1k
Closed
Labels
branch: masterApplies to master branchApplies to master branchseverity: importantImportant bugs affecting a released versionImportant bugs affecting a released versionseverity: regressionThe issue/pr is a regression from previous released versionThe issue/pr is a regression from previous released versiontriaged: bugThe issue/pr is/fixes a bugThe issue/pr is/fixes a bug
Milestone
Description
We've got these new reports from oss-fuzz:
Command: /mnt/scratch0/clusterfuzz/resources/platform/linux/unshare -c -n /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-afl_openssl_ff70abc60babf4fe76efe17679112693fb04b8d6/revisions/smime /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash
Time ran: 0.12897181510925293
AddressSanitizer:DEADLYSIGNAL
=================================================================
==254==ERROR: AddressSanitizer: FPE on unknown address 0x5ba57025962c (pc 0x5ba57025962c bp 0x7ffd6b1c0170 sp 0x7ffd6b1c00f0 T0)
#0 0x5ba57025962c in evp_encodeblock_int [openssl/crypto/evp/enc_b64_scalar.c:252](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/evp/enc_b64_scalar.c#L252):45
#1 0x5ba56ff1e2a5 in EVP_EncodeFinal [openssl/crypto/evp/encode.c:458](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/evp/encode.c#L458):15
#2 0x5ba56fec7f3b in b64_ctrl [openssl/crypto/evp/bio_b64.c:490](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/evp/bio_b64.c#L490):13
#3 0x5ba56fab1830 in BIO_ctrl [openssl/crypto/bio/bio_lib.c:673](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/bio/bio_lib.c#L673):11
#4 0x5ba56fd6da34 in b64_read_asn1 [openssl/crypto/asn1/asn_mime.c:150](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/asn1/asn_mime.c#L150):11
#5 0x5ba56fd6ba94 in SMIME_read_ASN1_ex [openssl/crypto/asn1/asn_mime.c:532](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/asn1/asn_mime.c#L532):16
#6 0x5ba56fb34cd2 in SMIME_read_PKCS7_ex [openssl/crypto/pkcs7/pk7_mime.c:63](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/pkcs7/pk7_mime.c#L63):20
#7 0x5ba56fb34cd2 in SMIME_read_PKCS7 [openssl/crypto/pkcs7/pk7_mime.c:72](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/pkcs7/pk7_mime.c#L72):12
#8 0x5ba56faabfc8 in FuzzerTestOneInput [openssl/fuzz/smime.c:25](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/fuzz/smime.c#L25):17
#9 0x5ba56faac909 in ExecuteFilesOnyByOne /src/aflplusplus/utils/aflpp_driver/aflpp_driver.c:267:7
#10 0x5ba56faac709 in LLVMFuzzerRunDriver /src/aflplusplus/utils/aflpp_driver/aflpp_driver.c:0
#11 0x5ba56faac2ab in main /src/aflplusplus/utils/aflpp_driver/aflpp_driver.c:323:10
#12 0x79feeefb9082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/libc-start.c:308:16
#13 0x5ba56f9c49ad in _start
==254==Register values:
rax = 0x0000000000000001 rbx = 0x0000767eee4e01a0 rcx = 0x000077deee4e00ac rdx = 0x0000000000000000
rdi = 0x00005ba5703e3260 rsi = 0x000077deee4e00a8 rbp = 0x00007ffd6b1c0170 rsp = 0x00007ffd6b1c00f0
r8 = 0x0000000000000000 r9 = 0x0000000000000004 r10 = 0x0000000000000000 r11 = 0x0000767eee4e01a8
r12 = 0x00005ba570531000 r13 = 0x0000000000000000 r14 = 0x0000000000000001 r15 = 0x0000000000000000
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-afl_openssl_ff70abc60babf4fe76efe17679112693fb04b8d6/revisions/smime+0xa5962c)
==254==ABORTING
Command: /mnt/scratch0/clusterfuzz/resources/platform/linux/unshare -c -n /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_openssl_739f5b31cbf3110c8aecbe889ffb79e7169c04a5/revisions/smime -rss_limit_mb=2560 -timeout=60 -runs=100 /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-b8fe9ea12f7d29a1bc0ebd74fcd9973abf2f158a
Time ran: 0.24312973022460938
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 721438481
INFO: Loaded 1 modules (101442 inline 8-bit counters): 101442 [0x5804124809a8, 0x5804124995ea),
INFO: Loaded 1 PC tables (101442 PCs): 101442 [0x5804124995f0,0x580412625a10),
/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_openssl_739f5b31cbf3110c8aecbe889ffb79e7169c04a5/revisions/smime: Running 1 inputs 100 time(s) each.
Running: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-b8fe9ea12f7d29a1bc0ebd74fcd9973abf2f158a
crypto/evp/enc_b64_scalar.c:252:45: runtime error: division by zero
#0 0x5804121b28b2 in evp_encodeblock_int [openssl/crypto/evp/enc_b64_scalar.c:252](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/evp/enc_b64_scalar.c#L252):45
#1 0x580411f8a1b8 in EVP_EncodeFinal [openssl/crypto/evp/encode.c:458](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/evp/encode.c#L458):15
#2 0x580411f5c8e7 in b64_ctrl [openssl/crypto/evp/bio_b64.c:490](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/evp/bio_b64.c#L490):13
#3 0x580411cf2d13 in BIO_ctrl [openssl/crypto/bio/bio_lib.c:673](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/bio/bio_lib.c#L673):11
#4 0x580411e9835e in b64_read_asn1 [openssl/crypto/asn1/asn_mime.c:150](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/asn1/asn_mime.c#L150):11
#5 0x580411e966f5 in SMIME_read_ASN1_ex [openssl/crypto/asn1/asn_mime.c:532](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/asn1/asn_mime.c#L532):16
#6 0x580411d357b6 in SMIME_read_PKCS7_ex [openssl/crypto/pkcs7/pk7_mime.c:63](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/pkcs7/pk7_mime.c#L63):20
#7 0x580411d357b6 in SMIME_read_PKCS7 [openssl/crypto/pkcs7/pk7_mime.c:72](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/pkcs7/pk7_mime.c#L72):12
#8 0x580411c58f16 in FuzzerTestOneInput [openssl/fuzz/smime.c:25](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/fuzz/smime.c#L25):17
#9 0x580411c750ed in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13
#10 0x580411c5fe62 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6
#11 0x580411c65d30 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9
#12 0x580411c91862 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
#13 0x7da94bd7e082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/libc-start.c:308:16
#14 0x580411c2ba3d in _start
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior crypto/evp/enc_b64_scalar.c:252:45
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
branch: masterApplies to master branchApplies to master branchseverity: importantImportant bugs affecting a released versionImportant bugs affecting a released versionseverity: regressionThe issue/pr is a regression from previous released versionThe issue/pr is a regression from previous released versiontriaged: bugThe issue/pr is/fixes a bugThe issue/pr is/fixes a bug