google / google/gopacket

bug

Open
#945 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
6.8k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

Testcase id: 105013
Job: gopacket_libfuzzer_ubsan
Crash Type: Index out of range
isSecurity: False
Crash state: binary.littleEndian.Uint32
gopacket.(*lazyPacket).decodeNextLayer
gopacket.(*lazyPacket).Layers
Poc: 105013.testcase
engine: libFuzzer
fully_qualified_name: libFuzzer_fuzz_layers
target: fuzz_layers
name: libFuzzer
[Environment] UBSAN_OPTIONS=exitcode=77
+----------------------------------------Release Build Stacktrace----------------------------------------+
Command: /clusterfuzz/run_bot/clusterfuzz/bot/builds/gopacket_libfuzzer_ubsan/custom/fuzz_layers -rss_limit_mb=2560 -timeout=60 -runs=100 /clusterfuzz/run_bot/clusterfuzz/bot/inputs/fuzzer-testcases/crash-af5bae60717023643946301b13a4fe914f81695b
Time ran: 0.0238800048828125

INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 999592865
INFO: 9512 Extra Counters
/clusterfuzz/run_bot/clusterfuzz/bot/builds/gopacket_libfuzzer_ubsan/custom/fuzz_layers: Running 1 inputs 100 time(s) each.
Running: /clusterfuzz/run_bot/clusterfuzz/bot/inputs/fuzzer-testcases/crash-af5bae60717023643946301b13a4fe914f81695b
panic: runtime error: index out of range [3] with length 2

goroutine 17 [running, locked to thread]:
encoding/binary.littleEndian.Uint32(...)
encoding/binary/binary.go:64
github.com/google/gopacket/layers.(*RadioTap).DecodeFromBytes(0xc000258000, {0xc00017e000, 0x1e, 0x1e}, {0x7f4df4018858, 0xc000140160})
github.com/google/gopacket/layers/radiotap.go:843 +0x1705
github.com/google/gopacket/layers.decodingLayerDecoder({0x6ed178, 0xc000258000}, {0xc00017e000, 0x1e, 0x1e}, {0x6edb70, 0xc000140160})
github.com/google/gopacket/layers/base.go:39 +0x88
github.com/google/gopacket/layers.decodeRadioTap({0xc00017e000, 0x1e, 0x1e}, {0x6edb70, 0xc000140160})
github.com/google/gopacket/layers/radiotap.go:680 +0x70
github.com/google/gopacket.DecodeFunc.Decode(0x0, {0xc00017e000, 0x7f4df400f118, 0x9}, {0x6edb70, 0xc000140160})
github.com/google/gopacket/decode.go:87 +0x4d
github.com/google/gopacket.LayerType.Decode(0x40, {0xc00017e000, 0x1e, 0x1e}, {0x6edb70, 0xc000140160})
github.com/google/gopacket/layertype.go:95 +0x12d
github.com/google/gopacket.(*lazyPacket).decodeNextLayer(0xc000140160)
github.com/google/gopacket/packet.go:527 +0x18b
github.com/google/gopacket.(*lazyPacket).Layers(0xc000140160)
github.com/google/gopacket/packet.go:564 +0x3e
github.com/google/gopacket/layers.FuzzLayer({0x256b390, 0x21, 0x21})
github.com/google/gopacket/layers/fuzz_layer.go:32 +0x15e
main.LLVMFuzzerTestOneInput(...)
./main.3389650602.go:21
UndefinedBehaviorSanitizer:DEADLYSIGNAL
==184284==ERROR: UndefinedBehaviorSanitizer: ABRT on unknown address 0x03e80002cfdc (pc 0x0000005122a1 bp 0x00c0000e6960 sp 0x00c0000e6948 T184284)
#0 0x5122a1 in runtime.raise.abi0 runtime/sys_linux_amd64.s:165

UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: ABRT (/clusterfuzz/run_bot/clusterfuzz/bot/builds/gopacket_libfuzzer_ubsan/custom/fuzz_layers+0x5122a1)
==184284==ABORTING

+----------------------------------------Release Build Unsymbolized Stacktrace (diff)----------------------------------------+

UndefinedBehaviorSanitizer:DEADLYSIGNAL
==184284==ERROR: UndefinedBehaviorSanitizer: ABRT on unknown address 0x03e80002cfdc (pc 0x0000005122a1 bp 0x00c0000e6960 sp 0x00c0000e6948 T184284)
#0 0x5122a1 (/clusterfuzz/run_bot/clusterfuzz/bot/builds/gopacket_libfuzzer_ubsan/custom/fuzz_layers+0x5122a1)

UndefinedBehaviorSanitizer can not provide additional info.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.