Segfault in imap_done when calling curl_multi_remove_handle() #1953
Description
I did this
Added curl_multi_remove_handle() to the fuzzer and checked it against CI.
I expected the following
Not to hit a segfault...
Broken build is here: https://travis-ci.org/curl/curl-fuzzer/jobs/283918193
Verbose logs add on some context:
root@kali:/src/curl-fuzzer# FUZZ_VERBOSE=yes ./curl_fuzzer curl_fuzz_data/oss-fuzz-gen-00070fdad78b9d907fce00d63d2933bd0328daa5 2>&1 | asan_symbolize
* WARNING: Using weak random seed
* STATE: INIT => CONNECT handle 0x62a000000208; line 1422 (connection #-5000)
* Added connection 0. The cache now contains 1 members
* STATE: CONNECT => WAITRESOLVE handle 0x62a000000208; line 1458 (connection #0)
* Expire cleared
* multi_done
ASAN:DEADLYSIGNAL
=================================================================
==18886==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000064ecc1 bp 0x7ffd338b4ff0 sp 0x7ffd338b4da0 T0)
==18886==The signal is caused by a READ memory access.
==18886==Hint: address points to the zero page.
#0 0x64ecc0 in Curl_pp_vsendf /src/curl/lib/pingpong.c:171
#1 0x64ecc0 in ?? ??:0
#2 0x64f717 in Curl_pp_sendf /src/curl/lib/pingpong.c:255
#3 0x64f717 in ?? ??:0
#4 0x632eda in imap_done /src/curl/lib/imap.c:1467
#5 0x632eda in ?? ??:0
#6 0x52d82b in multi_done /src/curl/lib/multi.c:563
#7 0x52d82b in ?? ??:0
#8 0x52c8e6 in curl_multi_remove_handle /src/curl/lib/multi.c:725
#9 0x52c8e6 in ?? ??:0
#10 0x5173ae in _Z20fuzz_handle_transferP9fuzz_data /src/curl-fuzzer/curl_fuzzer.cc:710
#11 0x5173ae in ?? ??:0
#12 0x5136a7 in LLVMFuzzerTestOneInput /src/curl-fuzzer/curl_fuzzer.cc:89
#13 0x5136a7 in ?? ??:0
#14 0x6a4b6e in main /src/curl-fuzzer/standalone_fuzz_target_runner.cc:63
#15 0x6a4b6e in ?? ??:0
#16 0x7f4c114242b0 in __libc_start_main ??:?
#17 0x7f4c114242b0 in ?? ??:0
#18 0x41b7a9 in _start ??:?
#19 0x41b7a9 in ?? ??:0
The issue appears to be calling this code:
/* End the APPEND command first by sending an empty line */
result = Curl_pp_sendf(&conn->proto.imapc.pp, "%s", "");
From gdb, pp.conn is NULL, and therefore we get a segfault when trying to deref a NULL pointer in Curl_pp_vsendf
(gdb) p conn->proto.imapc.pp
$3 = {cache = 0x0, cache_size = 0, nread_resp = 0, linestart_resp = 0x0, pending_resp = false,
sendthis = 0x0, sendleft = 0, sendsize = 0, response = {tv_sec = 0, tv_usec = 0}, response_time = 0,
conn = 0x0, statemach_act = 0x0, endofresp = 0x0}
curl/libcurl version
devel
operating system
kali + ubuntu.