Add a New Comment (Rich Markup)
Fixed in the repository (03b73146). Thank you.
I also found a couple more via afl-fuzz (minimized). Looks like cflow is sensitive to a missing closing brace, which is consistent with Brian's find. $ cat test1.c m{int r(a(n){}e $ cflow test1.c Segmentation fault $ cat test2.c e(S,t)e(S{ $ cflow test2.c Segmentation fault There's an unmatched open brace there
afl-tmin reduces the malformed file to a short string: n{void y(r(i){}a (might aid in debugging...)
I'm fuzzing cflow with american fuzzy lop (http://lcamtuf.coredump.cx/afl/). I compiled the app using afl-gcc like so: CC=/path/to/afl-gcc ./configure AFL_HARDEN=1 make Here is the valgrind and gdb output: =8312== Invalid read of size 8 ==8312== at 0x43142A: expression (parser.c:1154) ==8312== by 0x43A16E: parse_variable_declaration (parser.c:636) ==8312== by 0x43410C: maybe_parm_list (parser.c:434) ==8312== by 0x43507F: dirdcl (parser.c:804) ==8312== by 0x439AAE: parse_variable_declaration (parser.c:734) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x434AB4: maybe_parm_list (parser.c:432) ==8312== by 0x43507F: dirdcl (parser.c:804) ==8312== by 0x439AAE: parse_variable_declaration (parser.c:734) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x43B8D4: yyparse (parser.c:432) ==8312== by 0x402DA4: main (main.c:796) ==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd ==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427) ==8312== by 0x4401B0: delete_level_autos (symbol.c:206) ==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130) ==8312== by 0x4425A3: delete_autos (symbol.c:276) ==8312== by 0x432D8A: func_body (parser.c:941) ==8312== by 0x434AB4: maybe_parm_list (parser.c:432) ==8312== by 0x43507F: dirdcl (parser.c:804) ==8312== by 0x439AAE: parse_variable_declaration (parser.c:734) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x43B8D4: yyparse (parser.c:432) ==8312== by 0x402DA4: main (main.c:796) ==8312== ==8312== Invalid read of size 8 ==8312== at 0x41D42E: linked_list_append (linked-list.c:24) ==8312== by 0x43148D: expression (parser.c:1155) ==8312== by 0x43A16E: parse_variable_declaration (parser.c:636) ==8312== by 0x43410C: maybe_parm_list (parser.c:434) ==8312== by 0x43507F: dirdcl (parser.c:804) ==8312== by 0x439AAE: parse_variable_declaration (parser.c:734) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x434AB4: maybe_parm_list (parser.c:432) ==8312== by 0x43507F: dirdcl (parser.c:804) ==8312== by 0x439AAE: parse_variable_declaration (parser.c:734) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x43B8D4: yyparse (parser.c:432) ==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd ==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427) ==8312== by 0x4401B0: delete_level_autos (symbol.c:206) ==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130) ==8312== by 0x4425A3: delete_autos (symbol.c:276) ==8312== by 0x432D8A: func_body (parser.c:941) ==8312== by 0x434AB4: maybe_parm_list (parser.c:432) ==8312== by 0x43507F: dirdcl (parser.c:804) ==8312== by 0x439AAE: parse_variable_declaration (parser.c:734) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x43B8D4: yyparse (parser.c:432) ==8312== by 0x402DA4: main (main.c:796) ==8312== ==8312== Invalid write of size 8 ==8312== at 0x41D604: linked_list_append (linked-list.c:28) ==8312== by 0x43148D: expression (parser.c:1155) ==8312== by 0x43A16E: parse_variable_declaration (parser.c:636) ==8312== by 0x43410C: maybe_parm_list (parser.c:434) ==8312== by 0x43507F: dirdcl (parser.c:804) ==8312== by 0x439AAE: parse_variable_declaration (parser.c:734) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x434AB4: maybe_parm_list (parser.c:432) ==8312== by 0x43507F: dirdcl (parser.c:804) ==8312== by 0x439AAE: parse_variable_declaration (parser.c:734) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x43B8D4: yyparse (parser.c:432) ==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd ==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427) ==8312== by 0x4401B0: delete_level_autos (symbol.c:206) ==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130) ==8312== by 0x4425A3: delete_autos (symbol.c:276) ==8312== by 0x432D8A: func_body (parser.c:941) ==8312== by 0x434AB4: maybe_parm_list (parser.c:432) ==8312== by 0x43507F: dirdcl (parser.c:804) ==8312== by 0x439AAE: parse_variable_declaration (parser.c:734) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x43B8D4: yyparse (parser.c:432) ==8312== by 0x402DA4: main (main.c:796) ==8312== ==8312== Invalid read of size 8 ==8312== at 0x431A1A: expression (parser.c:1140) ==8312== by 0x432A2E: func_body (parser.c:909) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x434AB4: maybe_parm_list (parser.c:432) ==8312== by 0x43507F: dirdcl (parser.c:804) ==8312== by 0x439AAE: parse_variable_declaration (parser.c:734) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x43B8D4: yyparse (parser.c:432) ==8312== by 0x402DA4: main (main.c:796) ==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd ==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427) ==8312== by 0x4401B0: delete_level_autos (symbol.c:206) ==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130) ==8312== by 0x4425A3: delete_autos (symbol.c:276) ==8312== by 0x432D8A: func_body (parser.c:941) ==8312== by 0x434AB4: maybe_parm_list (parser.c:432) ==8312== by 0x43507F: dirdcl (parser.c:804) ==8312== by 0x439AAE: parse_variable_declaration (parser.c:734) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x43B8D4: yyparse (parser.c:432) ==8312== by 0x402DA4: main (main.c:796) ==8312== ==8312== Invalid read of size 8 ==8312== at 0x41D42E: linked_list_append (linked-list.c:24) ==8312== by 0x431B55: expression (parser.c:1141) ==8312== by 0x432A2E: func_body (parser.c:909) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x434AB4: maybe_parm_list (parser.c:432) ==8312== by 0x43507F: dirdcl (parser.c:804) ==8312== by 0x439AAE: parse_variable_declaration (parser.c:734) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x43B8D4: yyparse (parser.c:432) ==8312== by 0x402DA4: main (main.c:796) ==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd ==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427) ==8312== by 0x4401B0: delete_level_autos (symbol.c:206) ==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130) ==8312== by 0x4425A3: delete_autos (symbol.c:276) ==8312== by 0x432D8A: func_body (parser.c:941) ==8312== by 0x434AB4: maybe_parm_list (parser.c:432) ==8312== by 0x43507F: dirdcl (parser.c:804) ==8312== by 0x439AAE: parse_variable_declaration (parser.c:734) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x43B8D4: yyparse (parser.c:432) ==8312== by 0x402DA4: main (main.c:796) ==8312== ==8312== Invalid read of size 8 ==8312== at 0x431A1A: expression (parser.c:1140) ==8312== by 0x43A16E: parse_variable_declaration (parser.c:636) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x434AB4: maybe_parm_list (parser.c:432) ==8312== by 0x43507F: dirdcl (parser.c:804) ==8312== by 0x439AAE: parse_variable_declaration (parser.c:734) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x43B8D4: yyparse (parser.c:432) ==8312== by 0x402DA4: main (main.c:796) ==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd ==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427) ==8312== by 0x4401B0: delete_level_autos (symbol.c:206) ==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130) ==8312== by 0x4425A3: delete_autos (symbol.c:276) ==8312== by 0x432D8A: func_body (parser.c:941) ==8312== by 0x434AB4: maybe_parm_list (parser.c:432) ==8312== by 0x43507F: dirdcl (parser.c:804) ==8312== by 0x439AAE: parse_variable_declaration (parser.c:734) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x43B8D4: yyparse (parser.c:432) ==8312== by 0x402DA4: main (main.c:796) ==8312== ==8312== Invalid read of size 8 ==8312== at 0x41D42E: linked_list_append (linked-list.c:24) ==8312== by 0x431B55: expression (parser.c:1141) ==8312== by 0x43A16E: parse_variable_declaration (parser.c:636) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x434AB4: maybe_parm_list (parser.c:432) ==8312== by 0x43507F: dirdcl (parser.c:804) ==8312== by 0x439AAE: parse_variable_declaration (parser.c:734) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x43B8D4: yyparse (parser.c:432) ==8312== by 0x402DA4: main (main.c:796) ==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd ==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427) ==8312== by 0x4401B0: delete_level_autos (symbol.c:206) ==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130) ==8312== by 0x4425A3: delete_autos (symbol.c:276) ==8312== by 0x432D8A: func_body (parser.c:941) ==8312== by 0x434AB4: maybe_parm_list (parser.c:432) ==8312== by 0x43507F: dirdcl (parser.c:804) ==8312== by 0x439AAE: parse_variable_declaration (parser.c:734) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x43B8D4: yyparse (parser.c:432) ==8312== by 0x402DA4: main (main.c:796) ==8312== ==8312== Invalid read of size 8 ==8312== at 0x43142A: expression (parser.c:1154) ==8312== by 0x432A2E: func_body (parser.c:909) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x434AB4: maybe_parm_list (parser.c:432) ==8312== by 0x43507F: dirdcl (parser.c:804) ==8312== by 0x439AAE: parse_variable_declaration (parser.c:734) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x43B8D4: yyparse (parser.c:432) ==8312== by 0x402DA4: main (main.c:796) ==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd ==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427) ==8312== by 0x4401B0: delete_level_autos (symbol.c:206) ==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130) ==8312== by 0x4425A3: delete_autos (symbol.c:276) ==8312== by 0x432D8A: func_body (parser.c:941) ==8312== by 0x434AB4: maybe_parm_list (parser.c:432) ==8312== by 0x43507F: dirdcl (parser.c:804) ==8312== by 0x439AAE: parse_variable_declaration (parser.c:734) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x43B8D4: yyparse (parser.c:432) ==8312== by 0x402DA4: main (main.c:796) ==8312== ==8312== Invalid read of size 8 ==8312== at 0x41D42E: linked_list_append (linked-list.c:24) ==8312== by 0x43148D: expression (parser.c:1155) ==8312== by 0x432A2E: func_body (parser.c:909) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x434AB4: maybe_parm_list (parser.c:432) ==8312== by 0x43507F: dirdcl (parser.c:804) ==8312== by 0x439AAE: parse_variable_declaration (parser.c:734) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x43B8D4: yyparse (parser.c:432) ==8312== by 0x402DA4: main (main.c:796) ==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd ==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427) ==8312== by 0x4401B0: delete_level_autos (symbol.c:206) ==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130) ==8312== by 0x4425A3: delete_autos (symbol.c:276) ==8312== by 0x432D8A: func_body (parser.c:941) ==8312== by 0x434AB4: maybe_parm_list (parser.c:432) ==8312== by 0x43507F: dirdcl (parser.c:804) ==8312== by 0x439AAE: parse_variable_declaration (parser.c:734) ==8312== by 0x432C09: func_body (parser.c:919) ==8312== by 0x43B8D4: yyparse (parser.c:432) ==8312== by 0x402DA4: main (main.c:796) ==8312== rpermutF() <ins *rpermutF (int n) at id:000000,sig:11,src:000001,op:havoc,rep:16:2> (R): malloc() size() rpermutF() <ins *rpermutF (int n) at id:000000,sig:11,src:000001,op:havoc,rep:16:2> (recursive: see 1) rand() warning: Can't read pathname for load map: Input/output error. Core was generated by `/home/geeknik/cflow-1.4/src/cflow id:000000,sig:11,src:000001,op:havoc,rep:16'. Program terminated with signal 11, Segmentation fault. #0 0x000000000041e2c0 in data_in_list (data=0x69aff0, list=0x20) at linked-list.c:144 144 for (p = linked_list_head(list); p; p = p->next) (gdb) bt #0 0x000000000041e2c0 in data_in_list (data=0x69aff0, list=0x20) at linked-list.c:144 #1 0x0000000000431436 in reference (line=<optimized out>, name=<optimized out>) at parser.c:1154 #2 expression () at parser.c:475 #3 0x000000000043a16f in parse_variable_declaration (ident=ident@entry=0x7fffffffe080, parm=parm@entry=1) at parser.c:636 #4 0x000000000043410d in parse_declaration (parm=1, ident=0x7fffffffe080) at parser.c:434 #5 maybe_parm_list (parm_cnt_return=parm_cnt_return@entry=0x7fffffffe13c) at parser.c:873 #6 0x0000000000435080 in dirdcl (idptr=idptr@entry=0x7fffffffe130) at parser.c:804 #7 0x00000000004373d6 in dcl (idptr=idptr@entry=0x7fffffffe130) at parser.c:771 #8 0x0000000000439aaf in parse_dcl (maybe_knr=0, ident=0x7fffffffe130) at parser.c:734 #9 parse_variable_declaration (ident=ident@entry=0x7fffffffe130, parm=parm@entry=0) at parser.c:610 #10 0x0000000000432c0a in func_body () at parser.c:919 #11 0x0000000000433a77 in parse_function_declaration (ident=<optimized out>, parm=<optimized out>) at parser.c:531 #12 0x0000000000434ab5 in parse_declaration (parm=1, ident=0x7fffffffe160) at parser.c:432 #13 maybe_parm_list (parm_cnt_return=parm_cnt_return@entry=0x7fffffffe21c) at parser.c:873 #14 0x0000000000435080 in dirdcl (idptr=idptr@entry=0x7fffffffe210) at parser.c:804 #15 0x00000000004373d6 in dcl (idptr=idptr@entry=0x7fffffffe210) at parser.c:771 #16 0x0000000000439aaf in parse_dcl (maybe_knr=0, ident=0x7fffffffe210) at parser.c:734 #17 parse_variable_declaration (ident=ident@entry=0x7fffffffe210, parm=parm@entry=0) at parser.c:610 #18 0x0000000000432c0a in func_body () at parser.c:919 #19 0x0000000000433a77 in parse_function_declaration (ident=<optimized out>, parm=<optimized out>) at parser.c:531 #20 0x000000000043b8d5 in parse_declaration (parm=0, ident=0x7fffffffe240) at parser.c:432 #21 yyparse () at parser.c:385 #22 0x0000000000402da5 in main (argc=2, argv=0x7fffffffe378) at main.c:796 #23 0x00007ffff7a6fead in __libc_start_main (main=<optimized out>, argc=<optimized out>, ubp_av=<optimized out>, ---Type <return> to continue, or q <return> to quit--- init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe368) at libc-start.c:244 #24 0x0000000000402ed9 in _start () (gdb) i r rax 0x0 0 rbx 0x0 0 rcx 0x69b920 6928672 rdx 0x69b930 6928688 rsi 0x20 32 rdi 0x69aff0 6926320 rbp 0x69aff0 0x69aff0 rsp 0x7fffffffdff0 0x7fffffffdff0 r8 0x69b920 6928672 r9 0x10 16 r10 0xc 12 r11 0xb 11 r12 0x1a 26 r13 0x48 72 r14 0x0 0 r15 0x0 0 rip 0x41e2c0 0x41e2c0 <data_in_list+88> eflags 0x10202 [ IF RF ] cs 0x33 51 ss 0x2b 43 ds 0x0 0 es 0x0 0 fs 0x0 0 gs 0x0 0 I've attached the test case and the core dump.
(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)
Attach Files: Comment:
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Only logged-in users can vote.
Please enter the title of George Orwell's famous dystopian book (it's a date):
Follow 4 latest changes.
Copyright © 2023 Free Software Foundation, Inc. Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved. The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team. Source Code
Powered by Savane 3.11