lima-vm / lima-vm/lima

Bugs in 3rd-party libraries from fuzzing audit

Open
#2,650 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
21.9k
Forks
957
Avg merge
2d 6h
Merged PRs (30d)
53

Description

### Description

Lima recently integrated into OSS-Fuzz which resulted in uncovering a bunch of bugs in 3rd-party libraries. This is a tracker issue for these bugs. The report in [this PR](https://github.com/lima-vm/lima/pull/2649) contains reproducers for all the bugs, so do check that out.

| ID | Name | Fixed |
|---|-------------------------------------------------|--------------|
| ADA-LIMA-FUZZ-2024-1 | Stack overflow in 3rd-party yaml parser | No |
| ADA-LIMA-FUZZ-2024-2 | Type confusion in 3rd-party yaml parser | No |
| ADA-LIMA-FUZZ-2024-3 | Memory exhaustion in 3rd-party yaml parser | No |
| ADA-LIMA-FUZZ-2024-4 | Index out of range panic in 3rd-party yaml parser | No |
| ADA-LIMA-FUZZ-2024-5 | Slice bounds out of range in 3rd-party yaml parser | No |
| ADA-LIMA-FUZZ-2024-6 | Integer underflow in 3rd-party yq library | No |
| ADA-LIMA-FUZZ-2024-7 | Index out of range in 3rd-party yq library | No |
| ADA-LIMA-FUZZ-2024-8 | Index out of range in 3rd-party yq library | No |
| ADA-LIMA-FUZZ-2024-9 | Memory exhaustion when evaluating expression | No |
| ADA-LIMA-FUZZ-2024-10 | Divide by zero panic | No |
| ADA-LIMA-FUZZ-2024-11 | Length of string controllable by user input in 3rd-party yq library | No |

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.