Hello, I was fuzzing simple program that uses tcc_compiler_string using libFuzzer and stumbled upon the SIGSEGV which I have confirmed with tcc -c /path/to/the/crashfile.
Below is an output of ASAN and the crash file is attached. ./tcc -c /tmp/tinycc/crash-5171d24b3dd0cd8b2cf26cc01e8f4020cbdc20ce_wrapped /tmp/tinycc/crash-5171d24b3dd0cd8b2cf26cc01e8f4020cbdc20ce_wrapped:3: warning: initializer-string for array is too long ================================================================= ==16491==ERROR: AddressSanitizer: negative-size-param: (size=-1) #0 0x000100bb5984 in __asan_memcpy+0x284 (libclang_rt.asan_osx_dynamic.dylib:arm64+0x51984) #1 0x0001002e1bd8 in decl_initializer tccgen.c:7857 #2 0x0001002e3c50 in decl_designator tccgen.c:7547 #3 0x0001002e1eb8 in decl_initializer tccgen.c:7896 #4 0x0001002e3c50 in decl_designator tccgen.c:7547 #5 0x0001002e1eb8 in decl_initializer tccgen.c:7896 #6 0x0001002db180 in decl_initializer_alloc tccgen.c:8198 #7 0x0001002edd50 in decl0 tccgen.c:8589 #8 0x0001002ec418 in decl tccgen.c:8607 #9 0x0001002c094c in tccgen_compile tccgen.c:836 #10 0x00010027b49c in tcc_compile libtcc.c:750 #11 0x00010027ed84 in tcc_add_file_internal libtcc.c:1207 #12 0x00010027e990 in tcc_add_file libtcc.c:1233 #13 0x00010028555c in main tcc.c:351 #14 0x000181acfda0 in start+0x1b4c (dyld:arm64e+0x1fda0) I did not analyze the root cause of this. Additionally, is it okay for you that I request CVE for this. Looking forward to your answer. Kind regards, Erhad
crash-5171d24b3dd0cd8b2cf26cc01e8f4020cbdc20ce_wrapped
Description: Binary data
_______________________________________________ Tinycc-devel mailing list [email protected] https://lists.nongnu.org/mailman/listinfo/tinycc-devel
