Fix four fuzzer-found over-reads and a leak in the filter, URL, and IDNA parsers - #499
Merged
Conversation
xroche
force-pushed
the
fix-parser-fuzz-bugs
branch
3 times, most recently
from
July 7, 2026 13:15
559c88f to
c675050
Compare
…rsers libFuzzer harnesses over the pure hostile-input parsers surfaced four pre-existing defects, each reachable from crawled content: - strjoker (htsfilters.c): a unique-match pattern like *(( forces max=1 even when the subject is empty, so the matcher recurses one byte past the subject's NUL. Clamp max to the subject length. - ident_url_absolute (htslib.c): a bare file:// URL leaves the path pointer on the terminating NUL, and p[1] then reads past it. Short-circuit on *p == 0. - ident_url_absolute (htslib.c): the length guard bounds only the host, so a short-host/long-path URL overruns fil[HTS_URLMAXSIZE*2] and trips the htssafe abort (a would-be overflow). Reject an over-long URL up front. - hts_convertStringUTF8ToIDNA (htscharset.c): a malformed UTF-8 sequence in a multi-label host aborts the per-segment encode without freeing the segment integer buffer. Free it on the error path. Tests: new identurl self-test drives ident_url_absolute (file:// and an internally-built over-long URL, since the CLI caps arguments); filter gains empty-subject cases; idna gains a malformed-encode probe. The two over-reads and the abort are negative-controlled (they trap under ASan / abort on the unpatched engine); the IDNA leak's deterministic control is the LeakSanitizer fuzz job in the follow-up fuzzing PR. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com>
xroche
force-pushed
the
fix-parser-fuzz-bugs
branch
from
July 7, 2026 16:05
c675050 to
9a63b4a
Compare
This was referenced Jul 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
libFuzzer harnesses over the pure hostile-input parsers turned up four pre-existing bugs, all reachable from crawled content:
strjokerread a byte past an empty subject on a*(...)pattern;ident_url_absoluteread past a barefile://URL and copied an over-long path into the fixedfil[](aborting through the htssafe guard); and the IDNA encoder leaked a segment buffer on malformed UTF-8. Each is a small bounds or cleanup fix to an internal parser, with no API or format change.Tests: a new
identurlself-test, empty-subject filter cases, and an IDNA malformed-encode check. The over-reads trap under ASan, the over-long URL aborts on any build, and the leak is caught by the fuzz PR's LeakSanitizer job.