Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Panic during Regexp.MatchString fuzzing #41073

Closed
Zenithar opened this issue Aug 27, 2020 · 1 comment
Closed

Panic during Regexp.MatchString fuzzing #41073

Zenithar opened this issue Aug 27, 2020 · 1 comment

Comments

@Zenithar
Copy link

@Zenithar Zenithar commented Aug 27, 2020

Context

I was doing some fuzz testing on my object parsers, and I discovered this bug.

My environment :

GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/zenithar/Library/Caches/go-build"
GOENV="/Users/zenithar/Library/Application Support/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GOMODCACHE="/Users/zenithar/go/1.15.0/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/zenithar/go/1.15.0"
GOPRIVATE=""
GOPROXY="direct"
GOROOT="/Users/zenithar/.goenv/versions/1.15.0"
GOSUMDB="off"
GOTMPDIR=""
GOTOOLDIR="/Users/zenithar/.goenv/versions/1.15.0/pkg/tool/darwin_amd64"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/vg/_ywxksk16ys745ct1zt0y0w40000gn/T/go-build059686385=/tmp/go-build -gno-record-gcc-switches -fno-common"

Steps to reproduce

Create a file with this content

package main

import "regexp"

func main() {
	re := &regexp.Regexp{}
	re.MatchString("")
}

I understand that a Regexp struct should not be built directly but that's what the fuzzer do and found this ^^

When executing go run bug.go :

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0x106fb59]

goroutine 1 [running]:
regexp.(*machine).match(0xc000114000, 0x10a6c80, 0xc0001140c0, 0x0, 0x10000010f0238)
	/Users/zenithar/.goenv/versions/1.15.0/src/regexp/exec.go:222 +0x319
regexp.(*Regexp).doExecute(0xc000110000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
	/Users/zenithar/.goenv/versions/1.15.0/src/regexp/exec.go:542 +0x17d
regexp.(*Regexp).doMatch(...)
	/Users/zenithar/.goenv/versions/1.15.0/src/regexp/exec.go:514
regexp.(*Regexp).MatchString(...)
	/Users/zenithar/.goenv/versions/1.15.0/src/regexp/regexp.go:525
main.main()
	/Users/zenithar/gobug/bug.go:7 +0x78
exit status 2

After investigation, it looks like m.p.Start has a nil p property. (src/regexp/exec.go - https://github.com/golang/go/blob/master/src/regexp/exec.go#L222)

Capture d’écran 2020-08-27 à 14 30 30

@FiloSottile
Copy link
Member

@FiloSottile FiloSottile commented Aug 27, 2020

As you mention, the zero value of regexp.Regexp is not usable, so that code is not supposed to work and a panic is to be expected.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
2 participants
You can’t perform that action at this time.