OpenVPN:fix leak in fuzzer
Open
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 12.7k
- Forks
- 2.9k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 62
Description
By looking at the stacktrace:
#0 0x52312d in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
#1 0x559593 in gc_malloc /src/openvpn/src/openvpn/buffer.c:395:33
#2 0x5fbfef in init_route_ipv6_list /src/openvpn/src/openvpn/route.c:839:13
#3 0x556372 in LLVMFuzzerTestOneInput /src/fuzz_route.c:141:9
In case 6 of fuzz_route.c, I noticed that the function init_route_ipv6_list(&rl6, opt6, remote_endpoint, 0, &remote_host, c.es, &c) initializes memory space for rl6. gc, but fails to release the allocated memory after the test ends.
Is that a bug in fuzz target or it was intended there？
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect case 6 and LLVMFuzzerTestOneInput in fuzz_route.c, then trace the allocation from init_route_ipv6_list in src/openvpn/src/openvpn/route.c. Reproduce the reported stack trace with the route fuzz target and determine whether the allocated rl6 memory is released after the test. Done means the leak is resolved or its intentional lifetime is documented and verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- testing-qa
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100