diff options
| author | Dmitry Vyukov <dvyukov@google.com> | 2022-06-20 10:44:45 +0200 |
|---|---|---|
| committer | Dmitry Vyukov <dvyukov@google.com> | 2022-06-20 13:25:11 +0200 |
| commit | ffa8ac3a590fe2a10eab5fb47a18c0e3393fa730 (patch) | |
| tree | f21882a562a8061e8de319d7da4483493b94c15e /prog/test | |
| parent | 6bc654432e118601d676876d83964b604758bf3a (diff) | |
prog: fix out-of-bounds access in any blob mutation
If we grow any blob during mutation, we allocate a new address for it
(so that it does not overlap with other data).
To do this we call analyze after the mutation.
However, after mutation the blob can grow out of bounds of the data area
and analyze will cause out-of-bounds access during marking of existing
allocations.
Fix this by calling analyze before we mutate the blob.
Also while we are here use the proper call for analyze.
Currently we always analyze only the first call,
which is wrong (probably a latent TODO from initial implementation).
Fixes #3206
Diffstat (limited to 'prog/test')
| -rw-r--r-- | prog/test/fuzz_test.go | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/prog/test/fuzz_test.go b/prog/test/fuzz_test.go index 3774b2fba..f01905ea3 100644 --- a/prog/test/fuzz_test.go +++ b/prog/test/fuzz_test.go @@ -23,6 +23,13 @@ mutate7() mutate8() `, `E`, + ` +test$str0(&(0x7f0000ffffd5)=ANY=[0]) +test$res2() +test$res2() +test$res2() +test$res2() +`, } { t.Logf("test #%v: %q", i, data) inp := []byte(data)[:len(data):len(data)] |