Issue 43505 in oss-fuzz: elfutils:fuzz-dwfl-core: Use-of-uninitialized-value in handle_file_note

["evv… via monorail" <monorail+v2.2672886254@chromium.org>]

Comment #2 on issue 43505 by evv...@gmail.com: elfutils:fuzz-dwfl-core: Use-of-uninitialized-value in handle_file_note
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43505#c2

I haven't figured out how to reproduce it without clang and MSan yet but here's the backtrace just in case
```
Running: /mnt/scratch0/clusterfuzz/bot/inputs/fuzzer-testcases/crash-19aedce7c369058955d501c7c86af2e6fcb1749c
==7548==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x63a0d7 in handle_file_note /src/elfutils/libdwfl/dwfl_segment_report_module.c:178:7
    #1 0x633493 in dwfl_segment_report_module /src/elfutils/libdwfl/dwfl_segment_report_module.c:776:32
    #2 0x537d5d in dwfl_core_file_report /src/elfutils/libdwfl/core-file.c:563:17
    #3 0x528af5 in LLVMFuzzerTestOneInput /src/fuzz-dwfl-core.c:52:6
    #4 0x455213 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) cxa_noexception.cpp:0
    #5 0x440e52 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6
    #6 0x4466ac in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) cxa_noexception.cpp:0
    #7 0x46f4b2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #8 0x7f69d6c700b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/libc-start.c:308:16
    #9 0x41f60d in _start
  Uninitialized value was created by an allocation of 'u.i' in the stack frame of function 'handle_file_note'
    #0 0x638830 in handle_file_note /src/elfutils/libdwfl/dwfl_segment_report_module.c:152
SUMMARY: MemorySanitizer: use-of-uninitialized-value (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds_elfutils_3ee01cb67db1a71e7adeb7f3f14722ea62f13cd5/revisions/fuzz-dwfl-core+0x63a0d7)
Unique heap origins: 33
Stack depot allocated bytes: 1638400
Unique origin histories: 7
History depot allocated bytes: 196608
```

-- 
You received this message because:
  1. You were specifically CC'd on the issue

You may adjust your notification preferences at:
https://bugs.chromium.org/hosting/settings

Reply to this email to add a comment.