google / google/libprotobuf-mutator
unknown fields fuzzed
- Dominant language
- C++
- Stars
- 667
- Forks
- 134
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
I found an interesting crash on OSS-Fuzz after bumping libprotobuf-mutator to the latest commit:
https://github.com/envoyproxy/envoy/blob/011945dcf92b8a461ab4ba309fa2bebeffc15895/bazel/repository_locations.bzl#L166
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23823
Opening the testcase, we have
```
fkidd:[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [....]
}
```
Which is not a valid protobuf for the message https://github.com/envoyproxy/envoy/blob/master/test/common/http/header_map_impl_fuzz.proto
The stack trace looks something like:
```
#246 0x3eb856c in google::protobuf::TextFormat::Parser::ParserImpl::SkipFieldValue() /proc/self/cwd/external/com_google_protobuf/src/google/protobuf/text_format.cc:830:11
--
| #247 0x3eb856c in google::protobuf::TextFormat::Parser::ParserImpl::SkipFieldValue() /proc/self/cwd/external/com_google_protobuf/src/google/protobuf/text_format.cc:830:11
| #248 0x3eb856c in google::protobuf::TextFormat::Parser::ParserImpl::SkipFieldValue() /proc/self/cwd/external/com_google_protobuf/src/google/protobuf/text_format.cc:830:11
|
| SUMMARY: AddressSanitizer: stack-overflow /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc in strlen
| ==1==ABORTING
```
I can reproduce the testcase locally, but what I'm curious about is why the testcase was generated in the first place.
Contributor guide
Assessment
This issue has not been assessed yet.