From dfaf20a5e2ea926e96f74678521d7e8706fb4db7 Mon Sep 17 00:00:00 2001 From: Peter Foley Date: Tue, 2 Nov 2021 17:41:37 -0400 Subject: [PATCH] Avoid calling strlen on uninitialized data (#6747) GetINCHIfromINCHI calls strlen on szOptions, which leads to undefined behavior as it's not a valid null-terminated byte string. Explicitly NULL out the char* to avoid this. --- projects/inchi/inchi_input_fuzzer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/projects/inchi/inchi_input_fuzzer.c b/projects/inchi/inchi_input_fuzzer.c index 6cacedfcc..d038da2a5 100644 --- a/projects/inchi/inchi_input_fuzzer.c +++ b/projects/inchi/inchi_input_fuzzer.c @@ -40,6 +40,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { inchi_InputINCHI inpInChI; inpInChI.szInChI = szINCHISource; + inpInChI.szOptions = NULL; inchi_Output out; GetINCHIfromINCHI(&inpInChI, &out);