Hi,
Please ignore this. This was tested on one of the popular forks so while
testing I have changed into the wrong directory.
Best,
Erhad
On Thursday, July 9th, 2026 at 4:03 PM, daemon via Tinycc-devel
<[email protected]> wrote:
> Hello,
>
> I was fuzzing simple program that uses tcc_compiler_string using libFuzzer
> and stumbled upon the SIGSEGV which I have confirmed with tcc -c
> /path/to/the/crashfile.
>
> Below is an output of ASAN and the crash file is attached.
>
> ./tcc -c /tmp/tinycc/crash-5171d24b3dd0cd8b2cf26cc01e8f4020cbdc20ce_wrapped
> /tmp/tinycc/crash-5171d24b3dd0cd8b2cf26cc01e8f4020cbdc20ce_wrapped:3:
> warning: initializer-string for array is too long
> =================================================================
> ==16491==ERROR: AddressSanitizer: negative-size-param: (size=-1)
> #0 0x000100bb5984 in __asan_memcpy+0x284
> (libclang_rt.asan_osx_dynamic.dylib:arm64+0x51984)
> #1 0x0001002e1bd8 in decl_initializer tccgen.c:7857
> #2 0x0001002e3c50 in decl_designator tccgen.c:7547
> #3 0x0001002e1eb8 in decl_initializer tccgen.c:7896
> #4 0x0001002e3c50 in decl_designator tccgen.c:7547
> #5 0x0001002e1eb8 in decl_initializer tccgen.c:7896
> #6 0x0001002db180 in decl_initializer_alloc tccgen.c:8198
> #7 0x0001002edd50 in decl0 tccgen.c:8589
> #8 0x0001002ec418 in decl tccgen.c:8607
> #9 0x0001002c094c in tccgen_compile tccgen.c:836
> #10 0x00010027b49c in tcc_compile libtcc.c:750
> #11 0x00010027ed84 in tcc_add_file_internal libtcc.c:1207
> #12 0x00010027e990 in tcc_add_file libtcc.c:1233
> #13 0x00010028555c in main tcc.c:351 #14 0x000181acfda0 in start+0x1b4c
> (dyld:arm64e+0x1fda0)
>
> I did not analyze the root cause of this. Additionally, is it okay for you
> that I request CVE for this. Looking forward to your answer.
>
> Kind regards,
> Erhad
_______________________________________________
Tinycc-devel mailing list
[email protected]
https://lists.nongnu.org/mailman/listinfo/tinycc-devel
