diff options
author | Vlad Tsyrklevich <vlad@tsyrklevich.net> | 2017-10-27 19:15:13 +0000 |
---|---|---|
committer | Vlad Tsyrklevich <vlad@tsyrklevich.net> | 2017-10-27 19:15:13 +0000 |
commit | 80394a6ae9cef39ea00794141dce55f18536f811 (patch) | |
tree | 42467792b770878035ab4849b6fd7d27bf911ec6 /unittests | |
parent | 93d857e6a901f124458f00c728f656c6ab347810 (diff) |
Fix llvm-special-case-list-fuzzer regexp exception
Summary:
Original oss-fuzz report:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3727#c2
The minimized test case that causes this failure:
5b 5b 5b 3d 47 53 00 5b 3d 5d 5b 5d 0a [[[=GS.[=][].
Note the string "=GS\x00". The failure happens because the code is
searching the string against an array of known collated names. "GS\x00"
is a hit, but since len takes into account an extra NUL byte, indexing
into cp->name[len] goes one byte past it's allocated memory. Fix this to
use a strlen(cp->name) comparison to account for NUL bytes in the input.
Reviewers: pcc
Reviewed By: pcc
Subscribers: hctim, kcc
Differential Revision: https://reviews.llvm.org/D39380
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@316786 91177308-0d34-0410-b5e6-96231b3b80d8
Diffstat (limited to 'unittests')
-rw-r--r-- | unittests/Support/RegexTest.cpp | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/unittests/Support/RegexTest.cpp b/unittests/Support/RegexTest.cpp index 5e3ce39f005..7e44a3c0614 100644 --- a/unittests/Support/RegexTest.cpp +++ b/unittests/Support/RegexTest.cpp @@ -171,4 +171,12 @@ TEST_F(RegexTest, MatchInvalid) { EXPECT_FALSE(r1.match("X")); } +// https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3727 +TEST_F(RegexTest, OssFuzz3727Regression) { + // Wrap in a StringRef so the NUL byte doesn't terminate the string + Regex r(StringRef("[[[=GS\x00[=][", 10)); + std::string Error; + EXPECT_FALSE(r.isValid(Error)); +} + } |