Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

MemorySanitizer doesn't wrap explicit_bzero #1507

Open
mkj opened this issue Mar 29, 2022 · 1 comment
Open

MemorySanitizer doesn't wrap explicit_bzero #1507

mkj opened this issue Mar 29, 2022 · 1 comment

Comments

@mkj
Copy link

mkj commented Mar 29, 2022

The attached oss-fuzz case for Dropbear SSH reports uninitialised memory. It appears that explicit_bzero() isn't handled correctly by msan, replacing it with plain memset() in dbhelpers.c m_burn() resolves the sanitizer error.

The call in the testcase is coming from ecc_ansi_x963_export() -> zeromem() -> m_burn() -> explicit_bzero().

14630_crash_info_dropbear_Use-of-uninitialized-value.txt

Uninitialized value was created by an allocation of 'buf' in the stack frame of function 'ecc_ansi_x963_export'

Base64 testcase: AgAAAfEAAACFBAHqNMmoriKZ+LgWqFtiHuKXnW+pQTQEZJMbVZogafvfwq/5uWgu7t2uhzzq/WOINVoScyhoWmZgemjurp6R01di+gGRkC0EirjG5EtweiiNIua4hMdoQdR36go+Sr7sDFdHgh0XsNwPIHMCVy8n90AdCH6l/+rSBZDrQf4OUN2gYcnsAQ==

@salzmdan
Copy link

salzmdan commented May 1, 2022

FYI I came across the same issue. I have solved that by
CZ-NIC/knot@564f616

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants