argotorg / argotorg/solidity

[ossfuzz] reproducing use-after-free bug reported by ossfuzz CI on 28.05.19

Open
#6,870 5 comments 0 reactions 0 assignees View on GitHub
bug :bug:
Dominant language
C++
Stars
25.7k
Forks
6.2k
Avg merge
1d 11h
Merged PRs (30d)
21

Description

## Description

The ossfuzz nightly CI reported two bugs from it's last run

https://circleci.com/gh/ethereum/solidity/131898

One of them has been filed here https://github.com/ethereum/solidity/issues/6864

Since the other one was hard to triage, I created a dockerfile for easier replication.

Here's the full report as a gist: https://gist.github.com/bshastry/d58ffdd29f3317c83f3db483ac84b407

Dockerfile to use
```
FROM ubuntu:disco

RUN apt update
RUN apt -y install subversion git wget clang-8 cmake libboost-regex-dev libboost-filesystem-dev libboost-test-dev libboost-system-dev libboost-program-options-dev libcvc4-dev libbz2-dev ninja-build zlib1g-dev vim libjsoncpp-dev=1.7.4-\*
RUN git clone https://github.com/ethereum/solidity.git
RUN git clone https://github.com/ethereum/solidity-fuzzing-corpus.git
RUN cd solidity && CC=clang-8 CXX=clang++-8 ./scripts/install_lpm.sh && CC=clang-8 CXX=clang++-8 ./scripts/install_libfuzzer.sh
RUN /src/LPM/external.protobuf/bin/protoc --proto_path=solidity/test/tools/ossfuzz yulProto.proto --cpp_out=solidity/test/tools/ossfuzz
RUN mkdir solidity/build
RUN cd solidity/build && cmake -DOSSFUZZ=1 -DCMAKE_TOOLCHAIN_FILE=cmake/toolchains/libfuzzer.cmake -DCMAKE_CXX_COMPILER=clang++-8 -DCMAKE_C_COMPILER=clang-8 .. && make ossfuzz -j2
RUN wget https://gist.githubusercontent.com/bshastry/409de43438f9ed38d34fc54d89e18474/raw/eaf7ee72c2d8094726180e85a53b55c9f4f8f5cb/list_of_failing_inputs.txt
```

Steps to reproduce use-after-free bug:

```
$ cd
$ docker build . -t ossfuzz
$ docker image ls
$ docker run -it -exec=/bin/bash ossfuzz
$ cat list_of_failing_inputs.txt | xargs ./solidity/build/test/tools/ossfuzz/strictasm_diff_ossfuzz &>> log
$ cat log
```

The details of the use-after-free reported by ASan will be logged to the file in `log` in the root filesystem of the docker container. It can be viewed with a text editor like vim.

## Environment

- Compiler version: latest develop

Contributor guide

Open the contributing guide

Research direction

Start with the Dockerfile in the issue and build the OSS-Fuzz target test/tools/ossfuzz/strictasm_diff_ossfuzz using the listed commands. Run it with list_of_failing_inputs.txt, inspect the resulting log for the AddressSanitizer use-after-free report, and use the linked gist to narrow down the failing input; done is a reproducible report and a clear triage outcome.

Written by the indexing model from the issue text.

Assessment

Tech stack
cmake, cpp, docker
Domain
compilers, security, testing-qa
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.