Skip to content
Commit b42db156 authored by Vlad Tsyrklevich's avatar Vlad Tsyrklevich
Browse files

Fix llvm-special-case-list-fuzzer regexp exception

Summary:
Original oss-fuzz report:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3727#c2

The minimized test case that causes this failure:
5b 5b 5b 3d 47 53 00 5b  3d 5d 5b 5d 0a     [[[=GS.[=][].

Note the string "=GS\x00". The failure happens because the code is
searching the string against an array of known collated names. "GS\x00"
is a hit, but since len takes into account an extra NUL byte, indexing
into cp->name[len] goes one byte past it's allocated memory. Fix this to
use a strlen(cp->name) comparison to account for NUL bytes in the input.

Reviewers: pcc

Reviewed By: pcc

Subscribers: hctim, kcc

Differential Revision: https://reviews.llvm.org/D39380

llvm-svn: 316786
parent 92a2635b
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment