libfuzzer heap overflow in malloc

Question

I am trying out my hand at libfuzzer and I am facing 'heap overflow' at malloc. The code snippet is as follows

int LLVMFuzzerTestOneInput(
    const unsigned char * Data,
    size_t Size
) {
    initialize_state_before_fuzzing();

    size_t charOffset = 0;
    size_t testValueSize = 0;
    size_t arrayLength = 0;
    size_t arrayLength2 = 0;
    const size_t FIXED_BUFFER_SIZE = 4096;

    if (Size == 0)
      return 0;
    uint8_t *testValue_1 = malloc(Size);
    testValueSize = Size;
    for (size_t i = 0; i < testValueSize && charOffset < Size; i++) {
        testValue_1[i] = (uint8_t) Data[charOffset];
        charOffset++;
    }

The overflow happens when Data="" and Size = 7. My question is why does libfuzzer give data that is not equal to the size? How to avoid this?

Also, even if Data is NULL, why does malloc cause heap overflow?

Please add minimal, complete and verifiable example in your question. — H.S., Jul 09 '23 at 14:26
You need to provide a [MCVE]. When `Data` is the empty string and `Size` is 7, it looks like your loop attempts an out of bounds array access with `Data[charOffset]` as `charOffset` is incremented each time through the loop. When `Data` is `NULL`, `Data[charOffset]` attempts to dereference a null pointer. — ad absurdum, Jul 09 '23 at 14:40

Tom · Accepted Answer · 2023-07-10T02:26:48.360

Based on your description, I think the key point where the error occurred is that you did not check if Data is NULL when executing function LLVMFuzzerTestOneInput and without guarantee sizeof(Data) / sizeof(Data[0]) >= size.

When you check if Data is NULL at execute function LLVMFuzzerTestOneInput before, and the value of size is suitable, at here such as Size = 7, the problem may be disappear.

You can call function LLVMFuzzerTestOneInput(Data, Size) only when Data is not equal to NULL and sizeof(Data) / sizeof(Data[0]) >= size.

like this:

...
...

    if ((Data != NULL) && (sizeof(Data) / sizeof(Data[0])) >= size)
    {
        LLVMFuzzerTestOneInput(Data, Size);
    }
    else
    {

          // something else that you want to do
    }
...
...

And check if testValue_1 is NULL that return value by malloc in LLVMFuzzerTestOneInput function.

Like this:

    uint8_t *testValue_1 = malloc(Size);
    if(testValue_1 == NULL)
    {
        printf("testValue_1 malloc failed, no space\n");
        exit(1);
    }

If possible, please provide additional information, such as code snippets and error messages

libfuzzer heap overflow in malloc

1 Answers1