Join GitHub today
[AFL] r2 crash in r_bin_java_read_next_attr_from_buffer #1833
I did some fuzzing of the handling of Java class files and got a bunch of crashes.
crash file : https://www.dropbox.com/sh/466tsvrq8qrewyj/AADlSLWhLbhzqMqN9n1G2L0wa/java/1/id_000002%2Csig_11%2Csrc_000000%2Cop_flip4%2Cpos_354?dl=1
The sz value in r_bin_java_code_attr_new is clearly too large. which will result in a crash in r_bin_java_read_next_attr_from_buffer.
Another function, r_bin_java_read_next_attr, checks that the size is inside the bounds of the buffer before calling r_bin_java_read_next_attr_from_buffer, but r_bin_java_code_attr_new does no such checking.