GNU bug report logs - #31935
2 crashes in diffutills commit version 576645c

Previous Next

Full log

Message #11 received at 31935 <at> debbugs.gnu.org (full text, mbox):

From: Jim Meyering <jim <at> meyering.net>
To: Hongxu Chen <leftcopy.chx <at> gmail.com>
Cc: 31935 <at> debbugs.gnu.org
Subject: Re: [bug-diffutils] bug#31935: 2 crashes in diffutills commit version
 576645c
Date: Fri, 28 Dec 2018 17:37:12 -0800

[Message part 1 (text/plain, inline)]

On Fri, Dec 28, 2018 at 5:13 PM Jim Meyering <jim <at> meyering.net> wrote:
>
> On Fri, Jun 22, 2018 at 7:49 AM Hongxu Chen <leftcopy.chx <at> gmail.com> wrote:
> >     We found with our fuzzer 2 crashes on diffutils version 576645c: one is a heap-buffer-overflow at util.c:1249, another is an invalid read resulting from `output_1_line' at util.c:1274.
> >     The executing command is: `./diff -a --strip-trailing-cr $file add.wasm` where $file is the poc file (I attached them as  *.input.txt); "add.wasm" is also attached however it seems that content of the comparison file is not important.
>
> Thank you for fuzz-testing diffutils.
> FYI, here is a reproducer for the limit[-1]-related UMR bugs:
>
>   valgrind src/diff -a --strip-trailing-cr <(printf '\r') <(echo a)
>
> I've attached a patch:

That patch was provably incomplete.
I ran this (adding -u to the above) and found one new UMR. Guarding
yet another [-1] reference fixes it.
There are still numerous unguarded [-1] references, so this updated
patch is doubtless still incomplete:

for i in hbo*; do echo $i; valgrind --quiet src/diff -u -a
--strip-trailing-cr $i add.wasm > /dev/null; echo $?; done

[diffutils-UMR.diff (application/octet-stream, attachment)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.