Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

UndefinedBehaviorSanitizer: invalid left shift in protobuf-c.c:2086 #506

Closed
pietroborrello opened this issue Apr 29, 2022 · 1 comment
Closed
Milestone

Comments

@pietroborrello
Copy link

Describe the bug

UndefinedBehaviorSanitizer: invalid left shift in protobuf-c.c:2086

To Reproduce

Built protobuf-c using clang-10 according to the oss-fuzz script with CXXFLAGS='-O1 -fsanitize=address -fsanitize=array-bounds,bool,builtin,enum,float-divide-by-zero,function,integer-divide-by-zero,null,object-size,return,returns-nonnull-attribute,shift,signed-integer-overflow,unreachable,vla-bound,vptr'

commit: f224ab2

UBSAN Output
$ ./protobuf-c-fuzzer id:000003,sig:06,src:000024,time:945,op:havoc,rep:16,trial:4
INFO: Seed: 1244782513
INFO: Loaded 1 modules   (3433 inline 8-bit counters): 3433 [0x5b06c3, 0x5b142c), 
INFO: Loaded 1 PC tables (3433 PCs): 3433 [0x5587f8,0x565e88), 
protobuf-c-fuzzer: Running 1 inputs 1 time(s) each.
Running: id:000003,sig:06,src:000024,time:945,op:havoc,rep:16,trial:4
protobuf-c/protobuf-c.c:2086:29: runtime error: left shift of 65 by 25 places cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior protobuf-c/protobuf-c.c:2086:29 in 
Executed id:000003,sig:06,src:000024,time:945,op:havoc,rep:16,trial:4 in 1 ms

testcases that trigger the issue:
protobuf-c.zip

@carnil
Copy link

carnil commented Jun 25, 2022

It looks that CVE-2022-33070 is associated with this issue.

@edmonds edmonds added this to the 1.4.1 milestone Jul 10, 2022
@edmonds edmonds closed this as completed Jul 10, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants