Google Git
Sign in
llvm / libfuzzer / ec3a006e2b10743694463cf97bd3b1f802f53122
commitec3a006e2b10743694463cf97bd3b1f802f53122[log] [tgz]
authorFabian Meumertzheim <meumertzheim@code-intelligence.com>Fri Apr 30 09:16:43 2021 -0700
committerCopybara-Service <copybara-worker@google.com>Sun May 09 19:11:01 2021 -0700
treeb73fe55c03bd301f6e0ecf919b5cbc310954efd3
parent978a3f644af00159b9280009341cf881d2abdb03 [diff]
[libFuzzer] Fix off-by-one error in ApplyDictionaryEntry

In the overwrite branch of MutationDispatcher::ApplyDictionaryEntry in
FuzzerMutate.cpp, the index Idx at which W.size() bytes are overwritten
with the word W is chosen uniformly at random in the interval
[0, Size - W.size()). This means that Idx + W.size() will always be
strictly less than Size, i.e., the last byte of the current unit will
never be overwritten.

This is fixed by adding 1 to the exclusive upper bound.

Addresses https://bugs.llvm.org/show_bug.cgi?id=49989.

Reviewed By: morehouse

Differential Revision: https://reviews.llvm.org/D101625

GitOrigin-RevId: 62e4dca94e25668c9f70abc7e524328fd5c6d5c9
1 file changed
tree: b73fe55c03bd301f6e0ecf919b5cbc310954efd3
  1. afl/
  2. dataflow/
  3. scripts/
  4. standalone/
  5. tests/
  6. build.sh
  7. FuzzedDataProvider.h
  8. FuzzerBuiltins.h
  9. FuzzerBuiltinsMsvc.h
  10. FuzzerCommand.h
  11. FuzzerCorpus.h
  12. FuzzerCrossOver.cpp
  13. FuzzerDataFlowTrace.cpp
  14. FuzzerDataFlowTrace.h
  15. FuzzerDefs.h
  16. FuzzerDictionary.h
  17. FuzzerDriver.cpp
  18. FuzzerExtFunctions.def
  19. FuzzerExtFunctions.h
  20. FuzzerExtFunctionsDlsym.cpp
  21. FuzzerExtFunctionsWeak.cpp
  22. FuzzerExtFunctionsWindows.cpp
  23. FuzzerExtraCounters.cpp
  24. FuzzerFlags.def
  25. FuzzerFork.cpp
  26. FuzzerFork.h
  27. FuzzerInterceptors.cpp
  28. FuzzerInterface.h
  29. FuzzerInternal.h
  30. FuzzerIO.cpp
  31. FuzzerIO.h
  32. FuzzerIOPosix.cpp
  33. FuzzerIOWindows.cpp
  34. FuzzerLoop.cpp
  35. FuzzerMain.cpp
  36. FuzzerMerge.cpp
  37. FuzzerMerge.h
  38. FuzzerMutate.cpp
  39. FuzzerMutate.h
  40. FuzzerOptions.h
  41. FuzzerPlatform.h
  42. FuzzerRandom.h
  43. FuzzerSHA1.cpp
  44. FuzzerSHA1.h
  45. FuzzerTracePC.cpp
  46. FuzzerTracePC.h
  47. FuzzerUtil.cpp
  48. FuzzerUtil.h
  49. FuzzerUtilDarwin.cpp
  50. FuzzerUtilFuchsia.cpp
  51. FuzzerUtilLinux.cpp
  52. FuzzerUtilPosix.cpp
  53. FuzzerUtilWindows.cpp
  54. FuzzerValueBitMap.h
  55. LICENSE.TXT
  56. README.txt