Rooba
/
oss-fuzz
mirror of https://github.com/google/oss-fuzz.git
1
1
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix infinite loop in fuzzer_exo (#7265) 

readBuffer returns -1 in return type size_t, which wraps. Because
of that, the comparison was not triggering when it should

Credit: Oss-Fuzz
Issue: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24002
This commit is contained in:
Martijn van Beurden 2022-02-11 20:08:42 +01:00 committed by GitHub
parent e618a7870f
commit 2436e38a72
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
projects/flac/fuzzer_exo.cpp
View File

@ -466,11 +466,8 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
int buffer_size = streamInfo.max_blocksize * streamInfo.channels * 2;
assert(buffer_size >= 0); // Not expected
auto buffer = new uint8_t[buffer_size];
int runs = 0;
while (parser.readBuffer(buffer, buffer_size) >= buffer_size) {
runs++;
continue;
}
while (parser.readBuffer(buffer, buffer_size) < ((size_t)-1));
delete[] buffer;
return 0;