google / google/libprotobuf-mutator

unknown fields fuzzed

Open
#179 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
667
Forks
134
PR merge metrics
No merged PRs in 30d

Description

Hi,

I found an interesting crash on OSS-Fuzz after bumping libprotobuf-mutator to the latest commit:
https://github.com/envoyproxy/envoy/blob/011945dcf92b8a461ab4ba309fa2bebeffc15895/bazel/repository_locations.bzl#L166

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23823
Opening the testcase, we have
```
fkidd:[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [....]
}
```

Which is not a valid protobuf for the message https://github.com/envoyproxy/envoy/blob/master/test/common/http/header_map_impl_fuzz.proto

The stack trace looks something like:
```
#246 0x3eb856c in google::protobuf::TextFormat::Parser::ParserImpl::SkipFieldValue() /proc/self/cwd/external/com_google_protobuf/src/google/protobuf/text_format.cc:830:11
--
  | #247 0x3eb856c in google::protobuf::TextFormat::Parser::ParserImpl::SkipFieldValue() /proc/self/cwd/external/com_google_protobuf/src/google/protobuf/text_format.cc:830:11
  | #248 0x3eb856c in google::protobuf::TextFormat::Parser::ParserImpl::SkipFieldValue() /proc/self/cwd/external/com_google_protobuf/src/google/protobuf/text_format.cc:830:11
  |  
  | SUMMARY: AddressSanitizer: stack-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc in strlen
  | ==1==ABORTING
```

I can reproduce the testcase locally, but what I'm curious about is why the testcase was generated in the first place.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.