[ossfuzz] reproducing use-after-free bug reported by ossfuzz CI on 28.05.19
- Dominant language
- C++
- Stars
- 25.7k
- Forks
- 6.2k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 21
Description
## Description
The ossfuzz nightly CI reported two bugs from it's last run
https://circleci.com/gh/ethereum/solidity/131898
One of them has been filed here https://github.com/ethereum/solidity/issues/6864
Since the other one was hard to triage, I created a dockerfile for easier replication.
Here's the full report as a gist: https://gist.github.com/bshastry/d58ffdd29f3317c83f3db483ac84b407
Dockerfile to use
```
FROM ubuntu:disco
RUN apt update
RUN apt -y install subversion git wget clang-8 cmake libboost-regex-dev libboost-filesystem-dev libboost-test-dev libboost-system-dev libboost-program-options-dev libcvc4-dev libbz2-dev ninja-build zlib1g-dev vim libjsoncpp-dev=1.7.4-\*
RUN git clone https://github.com/ethereum/solidity.git
RUN git clone https://github.com/ethereum/solidity-fuzzing-corpus.git
RUN cd solidity && CC=clang-8 CXX=clang++-8 ./scripts/install_lpm.sh && CC=clang-8 CXX=clang++-8 ./scripts/install_libfuzzer.sh
RUN /src/LPM/external.protobuf/bin/protoc --proto_path=solidity/test/tools/ossfuzz yulProto.proto --cpp_out=solidity/test/tools/ossfuzz
RUN mkdir solidity/build
RUN cd solidity/build && cmake -DOSSFUZZ=1 -DCMAKE_TOOLCHAIN_FILE=cmake/toolchains/libfuzzer.cmake -DCMAKE_CXX_COMPILER=clang++-8 -DCMAKE_C_COMPILER=clang-8 .. && make ossfuzz -j2
RUN wget https://gist.githubusercontent.com/bshastry/409de43438f9ed38d34fc54d89e18474/raw/eaf7ee72c2d8094726180e85a53b55c9f4f8f5cb/list_of_failing_inputs.txt
```
Steps to reproduce use-after-free bug:
```
$ cd
$ docker build . -t ossfuzz
$ docker image ls
$ docker run -it -exec=/bin/bash ossfuzz
$ cat list_of_failing_inputs.txt | xargs ./solidity/build/test/tools/ossfuzz/strictasm_diff_ossfuzz &>> log
$ cat log
```
The details of the use-after-free reported by ASan will be logged to the file in `log` in the root filesystem of the docker container. It can be viewed with a text editor like vim.
## Environment
- Compiler version: latest develop
Contributor guide
Research direction
Start with the Dockerfile in the issue and build the OSS-Fuzz target test/tools/ossfuzz/strictasm_diff_ossfuzz using the listed commands. Run it with list_of_failing_inputs.txt, inspect the resulting log for the AddressSanitizer use-after-free report, and use the linked gist to narrow down the failing input; done is a reproducible report and a clear triage outcome.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cmake, cpp, docker
- Domain
- compilers, security, testing-qa
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100