Skip to content
This repository has been archived by the owner on Jun 4, 2024. It is now read-only.

[FUZZ] Nimbus unhandled exception IndexError #40

Closed
6 of 7 tasks
Daft-Wullie opened this issue Jul 14, 2020 · 2 comments
Closed
6 of 7 tasks

[FUZZ] Nimbus unhandled exception IndexError #40

Daft-Wullie opened this issue Jul 14, 2020 · 2 comments
Labels

Comments

@Daft-Wullie
Copy link

Daft-Wullie commented Jul 14, 2020

I've identified a fuzzer crash and am contributing to the security of Ethereum 2!

I've done and provided the following:

  • Checked to see if any other [FUZZ] issue already refers to that crasher
  • Attached the crashing input (either attached to the issue as a .zip or .gz, or as a link to a file sharing service)
  • Noted the beacon-fuzz version or commit used.
  • Provided crash output
  • Noted the command or fuzzer used to generate the crash
  • Name of the original crash file
  • (Optional but optimal) Checked if the crash can be consistently replicated by re-running the input.

Info to Reproduce

  • Command run: e.g. make nimbus docker run -it -v `pwd`/workspace:/eth2fuzz/workspace eth2fuzz_nimbus continuously --filter nimbus

  • Crasher file name: crash-b5e4385dd9d05ab097113e6313d22827c7590347
    crash-b5e4385dd9d05ab097113e6313d22827c7590347.zip

  • Client exercised: nimbus

  • Fuzzing engine used : nimlibfuzzer

Crash output and stacktrace

#91     NEW    cov: 1029 ft: 1819 corp: 25/15674b exec/s: 0 rss: 43Mb L: 301/4096 MS: 2 PersAutoDict-EraseBytes- DE: "\x00\x00\x00\x00\x00\x00\x00\x01"-
fatal.nim(49)            sysFatal
Error: unhandled exception: index -4703124616608923521 not in 0 .. 255 [IndexError]
==7042== ERROR: libFuzzer: fuzz target exited
    #0 0x4612f3  (/eth2fuzz/workspace/nimlibfuzzer/nimbus_proposer_slashing+0x4612f3)
    #1 0x406836  (/eth2fuzz/workspace/nimlibfuzzer/nimbus_proposer_slashing+0x406836)
    #2 0x418227  (/eth2fuzz/workspace/nimlibfuzzer/nimbus_proposer_slashing+0x418227)
    #3 0x7fbb5be740f0  (/lib/x86_64-linux-gnu/libc.so.6+0x430f0)
    #4 0x7fbb5be741e9  (/lib/x86_64-linux-gnu/libc.so.6+0x431e9)
    #5 0x56291f  (/eth2fuzz/workspace/nimlibfuzzer/nimbus_proposer_slashing+0x56291f)
    #6 0x5bf777  (/eth2fuzz/workspace/nimlibfuzzer/nimbus_proposer_slashing+0x5bf777)
    #7 0x5c04e2  (/eth2fuzz/workspace/nimlibfuzzer/nimbus_proposer_slashing+0x5c04e2)
    #8 0x4188d7  (/eth2fuzz/workspace/nimlibfuzzer/nimbus_proposer_slashing+0x4188d7)
    #9 0x423144  (/eth2fuzz/workspace/nimlibfuzzer/nimbus_proposer_slashing+0x423144)
    #10 0x4247af  (/eth2fuzz/workspace/nimlibfuzzer/nimbus_proposer_slashing+0x4247af)
    #11 0x413b6c  (/eth2fuzz/workspace/nimlibfuzzer/nimbus_proposer_slashing+0x413b6c)
    #12 0x406a52  (/eth2fuzz/workspace/nimlibfuzzer/nimbus_proposer_slashing+0x406a52)
    #13 0x7fbb5be52b96  (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #14 0x406aa9  (/eth2fuzz/workspace/nimlibfuzzer/nimbus_proposer_slashing+0x406aa9)

SUMMARY: libFuzzer: fuzz target exited
MS: 5 EraseBytes-CrossOver-ChangeByte-EraseBytes-InsertRepeatedBytes-; base unit: 153eb0b6669de022db041ff122b05a4c70c48010
artifact_prefix='./'; Test unit written to ./crash-b5e4385dd9d05ab097113e6313d22827c7590347

Your Environment

  • Fuzzer ran: eth2fuzz
  • Version/Commit used:
  • Operating System and version: Ubuntu 20.04
@pventuzelo
Copy link
Contributor

Congratz, look valid to me.
Reported here: status-im/nimbus-eth2#1323

@pventuzelo
Copy link
Contributor

Fixed

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

No branches or pull requests

2 participants