Project

General

Profile

Actions
Copy link

Bug #3570

closed

rfb: invalid AppLayerResult use

Added by Victor Julien over 4 years ago. Updated over 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Sascha Steinbiss
Target version:
6.0.0beta1
Affected Versions:
Effort:
Difficulty:
Label:

Description

Oss-Fuzz found some input to the RFB parser that triggers the (currently very unforgiving) checks on AppLayerResult.

fuzz_applayerparserparse: app-layer-parser.c:1268: AppLayerParserParse: Assertion `!(res.needed + res.consumed < input_len)' failed.


(gdb) f 4
#4  0x000055555594bc4e in AppLayerParserParse (tv=0x0, alp_tctx=0x61a00025bc80, f=0x613000555e40, alproto=24, flags=10 '\n', input=0x6020003eefd0 "\377\377\377\377", input_len=4) at app-layer-parser.c:1268
1268                BUG_ON(res.needed + res.consumed < input_len);
(gdb) p res
$1 = {status = 1, consumed = 0, needed = 3}

To reproduce:
./src/fuzz_applayerparserparse ~/Downloads/clusterfuzz-testcase-minimized-fuzz_applayerparserparse-5148616533737472

Compile with '--enable-fuzztargets'.

Files

clusterfuzz-testcase-minimized-fuzz_applayerparserparse-5148616533737472 (51 Bytes) clusterfuzz-testcase-minimized-fuzz_applayerparserparse-5148616533737472 Victor Julien, 03/29/2020 03:27 PM
Actions
Copy link

Also available in: Atom PDF