google / google/libprotobuf-mutator
Null pointer dereference when start
- Dominant language
- C++
- Stars
- 667
- Forks
- 134
- PR merge metrics
- No merged PRs in 30d
Description
When I started lpm, some errors occurred.
INFO: found LLVMFuzzerCustomMutator (0x5589a0). Disabling -len_control by default.
INFO: Seed: 1522032693
INFO: Loaded 1 modules (2066 inline 8-bit counters): 2066 [0x61fba0, 0x6203b2),
INFO: Loaded 1 PC tables (2066 PCs): 2066 [0x5c53e8,0x5cd508),
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1903==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000000000 bp 0x7ffe4ffb63e0 sp 0x7ffe4ffb63b8 T0)
==1903==Hint: pc points to the zero page.
==1903==The signal is caused by a READ memory access.
==1903==Hint: address points to the zero page.
#0 0x0 ()
#1 0x7f509b9d83bf (/lib/x86_64-linux-gnu/libpthread.so.0+0x153bf)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ()
==1903==ABORTING
MS: 0 ; base unit: 0000000000000000000000000000000000000000
Call traceback is as fllow:
#0 0x0000000000000000 in ?? ()
#1 0x00000000005969cc in google::protobuf::Message::GetDescriptor (this=0x7fffffffdba0) at external.protobuf/include/google/protobuf/message.h:356
#2 0x0000000000592e3e in protobuf_mutator::(anonymous namespace)::CastToAny (message=0x7fffffffdba0) at ../src/mutator.cc:387
#3 0x0000000000592dea in protobuf_mutator::(anonymous namespace)::UnpackIfAny (message=...) at ../src/mutator.cc:399
#4 0x00000000005905dd in protobuf_mutator::(anonymous namespace)::UnpackAny (message=..., result=0x7fffffffdab8) at ../src/mutator.cc:404
#5 0x0000000000590521 in protobuf_mutator::Mutator::Fix (this=0xf7ba40 , message=0x7fffffffdba0) at ../src/mutator.cc:630
#6 0x000000000058532c in protobuf_mutator::libfuzzer::LoadProtoInput (binary=false, data=0x6020000000b0 "\276", size=0, input=0x7fffffffdba0) at /usr/local/include/libprotobuf-mutator/src/libfuzzer/libfuzzer_macro.cc:230
#7 0x00000000005591c1 in LLVMFuzzerTestOneInput (data=0x6020000000b0 "\276", size=0) at json_generator.cpp:11
#8 0x000000000045f732 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) () at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/iostream:74
#9 0x0000000000460ba7 in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::__Fuzzer::vector >&) () at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/iostream:74
#10 0x000000000046101a in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector >&) () at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/iostream:74
#11 0x0000000000450d26 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) () at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/iostream:74
#12 0x0000000000478973 in main () at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/iostream:74
#13 0x00007ffff77910b3 in __libc_start_main (main=0x478950 , argc=1, argv=0x7fffffffe378, init=, fini=, rtld_fini=, stack_end=0x7fffffffe368) at ../csu/libc-start.c:308
#14 0x000000000042554e in _start () at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/iostream:74
crash happend when call qword ptr [rcx + 0x98],The address is null.

clang :Ubuntu clang version 11.0.0-2~ubuntu20.04.1 Target: x86_64-pc-linux-gnu
protobuf:libprotoc 3.19.1
Contributor guide
Assessment
This issue has not been assessed yet.