global out of bounds reads in file_stat() / check_dir() #11
Comments
Looks like the same issue everytime actually – it accesses Haven't looked yet where to put the proper fix (as in, should the zero month field be prevented earlier or just handled here). |
Looking at it that function is only called to display information to the user when asking about duplicate file names. Checking date and time fields should also happen but not here. So I just added code to handle the zero month case in |
For the record, this issue is said to be fixed by commit 2aad1c8 . |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
This input file will cause out of bounds reads in fsck.fat:
https://crashes.fuzzing-project.org/dosfstools-date_dos2unix-oob-read-heap
This can be seen with address sanitizer. Now the situation seems a bit tricky, because different combinations of compilers (gcc or clang) and cflags will show different bugs.
This is with CC set to clang (3.7) and CFLAGS="-fsanitize=address -O3":
This is with CC set to gcc (5.2.0) and CFLAGS="-fsanitize=address -O3" (with older gcc 4.9 bug doesn't show up):
This is with clang (3.7) and CFLAGS="-fsanitize=address -g -O3":
So it seems depending on optimizations different bugs are triggered.
The text was updated successfully, but these errors were encountered: