Skip to content

Regressions from the new Base64 encoder #29518

@t8m

Description

@t8m

We've got these new reports from oss-fuzz:

Command: /mnt/scratch0/clusterfuzz/resources/platform/linux/unshare -c -n /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-afl_openssl_ff70abc60babf4fe76efe17679112693fb04b8d6/revisions/smime /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash
	Time ran: 0.12897181510925293
	
	AddressSanitizer:DEADLYSIGNAL
	=================================================================
	==254==ERROR: AddressSanitizer: FPE on unknown address 0x5ba57025962c (pc 0x5ba57025962c bp 0x7ffd6b1c0170 sp 0x7ffd6b1c00f0 T0)
	    #0 0x5ba57025962c in evp_encodeblock_int [openssl/crypto/evp/enc_b64_scalar.c:252](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/evp/enc_b64_scalar.c#L252):45
	    #1 0x5ba56ff1e2a5 in EVP_EncodeFinal [openssl/crypto/evp/encode.c:458](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/evp/encode.c#L458):15
	    #2 0x5ba56fec7f3b in b64_ctrl [openssl/crypto/evp/bio_b64.c:490](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/evp/bio_b64.c#L490):13
	    #3 0x5ba56fab1830 in BIO_ctrl [openssl/crypto/bio/bio_lib.c:673](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/bio/bio_lib.c#L673):11
	    #4 0x5ba56fd6da34 in b64_read_asn1 [openssl/crypto/asn1/asn_mime.c:150](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/asn1/asn_mime.c#L150):11
	    #5 0x5ba56fd6ba94 in SMIME_read_ASN1_ex [openssl/crypto/asn1/asn_mime.c:532](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/asn1/asn_mime.c#L532):16
	    #6 0x5ba56fb34cd2 in SMIME_read_PKCS7_ex [openssl/crypto/pkcs7/pk7_mime.c:63](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/pkcs7/pk7_mime.c#L63):20
	    #7 0x5ba56fb34cd2 in SMIME_read_PKCS7 [openssl/crypto/pkcs7/pk7_mime.c:72](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/pkcs7/pk7_mime.c#L72):12
	    #8 0x5ba56faabfc8 in FuzzerTestOneInput [openssl/fuzz/smime.c:25](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/fuzz/smime.c#L25):17
	    #9 0x5ba56faac909 in ExecuteFilesOnyByOne /src/aflplusplus/utils/aflpp_driver/aflpp_driver.c:267:7
	    #10 0x5ba56faac709 in LLVMFuzzerRunDriver /src/aflplusplus/utils/aflpp_driver/aflpp_driver.c:0
	    #11 0x5ba56faac2ab in main /src/aflplusplus/utils/aflpp_driver/aflpp_driver.c:323:10
	    #12 0x79feeefb9082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/libc-start.c:308:16
	    #13 0x5ba56f9c49ad in _start
	
	==254==Register values:
	rax = 0x0000000000000001  rbx = 0x0000767eee4e01a0  rcx = 0x000077deee4e00ac  rdx = 0x0000000000000000
	rdi = 0x00005ba5703e3260  rsi = 0x000077deee4e00a8  rbp = 0x00007ffd6b1c0170  rsp = 0x00007ffd6b1c00f0
	 r8 = 0x0000000000000000   r9 = 0x0000000000000004  r10 = 0x0000000000000000  r11 = 0x0000767eee4e01a8
	r12 = 0x00005ba570531000  r13 = 0x0000000000000000  r14 = 0x0000000000000001  r15 = 0x0000000000000000
	AddressSanitizer can not provide additional info.
	SUMMARY: AddressSanitizer: FPE (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-afl_openssl_ff70abc60babf4fe76efe17679112693fb04b8d6/revisions/smime+0xa5962c)
	==254==ABORTING
Command: /mnt/scratch0/clusterfuzz/resources/platform/linux/unshare -c -n /mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_openssl_739f5b31cbf3110c8aecbe889ffb79e7169c04a5/revisions/smime -rss_limit_mb=2560 -timeout=60 -runs=100 /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-b8fe9ea12f7d29a1bc0ebd74fcd9973abf2f158a
	Time ran: 0.24312973022460938
	
	INFO: Running with entropic power schedule (0xFF, 100).
	INFO: Seed: 721438481
	INFO: Loaded 1 modules   (101442 inline 8-bit counters): 101442 [0x5804124809a8, 0x5804124995ea),
	INFO: Loaded 1 PC tables (101442 PCs): 101442 [0x5804124995f0,0x580412625a10),
	/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_openssl_739f5b31cbf3110c8aecbe889ffb79e7169c04a5/revisions/smime: Running 1 inputs 100 time(s) each.
	Running: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-b8fe9ea12f7d29a1bc0ebd74fcd9973abf2f158a
	crypto/evp/enc_b64_scalar.c:252:45: runtime error: division by zero
	    #0 0x5804121b28b2 in evp_encodeblock_int [openssl/crypto/evp/enc_b64_scalar.c:252](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/evp/enc_b64_scalar.c#L252):45
	    #1 0x580411f8a1b8 in EVP_EncodeFinal [openssl/crypto/evp/encode.c:458](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/evp/encode.c#L458):15
	    #2 0x580411f5c8e7 in b64_ctrl [openssl/crypto/evp/bio_b64.c:490](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/evp/bio_b64.c#L490):13
	    #3 0x580411cf2d13 in BIO_ctrl [openssl/crypto/bio/bio_lib.c:673](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/bio/bio_lib.c#L673):11
	    #4 0x580411e9835e in b64_read_asn1 [openssl/crypto/asn1/asn_mime.c:150](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/asn1/asn_mime.c#L150):11
	    #5 0x580411e966f5 in SMIME_read_ASN1_ex [openssl/crypto/asn1/asn_mime.c:532](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/asn1/asn_mime.c#L532):16
	    #6 0x580411d357b6 in SMIME_read_PKCS7_ex [openssl/crypto/pkcs7/pk7_mime.c:63](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/pkcs7/pk7_mime.c#L63):20
	    #7 0x580411d357b6 in SMIME_read_PKCS7 [openssl/crypto/pkcs7/pk7_mime.c:72](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/crypto/pkcs7/pk7_mime.c#L72):12
	    #8 0x580411c58f16 in FuzzerTestOneInput [openssl/fuzz/smime.c:25](https://github.com/openssl/openssl/blob/323e48b6fbfe5f7cf6c49aab20478ef95387bbf1/fuzz/smime.c#L25):17
	    #9 0x580411c750ed in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13
	    #10 0x580411c5fe62 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6
	    #11 0x580411c65d30 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9
	    #12 0x580411c91862 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
	    #13 0x7da94bd7e082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/libc-start.c:308:16
	    #14 0x580411c2ba3d in _start
	
	SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior crypto/evp/enc_b64_scalar.c:252:45

Metadata

Metadata

Assignees

Labels

branch: masterApplies to master branchseverity: importantImportant bugs affecting a released versionseverity: regressionThe issue/pr is a regression from previous released versiontriaged: bugThe issue/pr is/fixes a bug

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions