Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Null pointer dereference when start #198

Open
WhereIsOops opened this issue Dec 13, 2021 · 0 comments
Open

Null pointer dereference when start #198

WhereIsOops opened this issue Dec 13, 2021 · 0 comments

Comments

@WhereIsOops
Copy link

WhereIsOops commented Dec 13, 2021

When I started lpm, some errors occurred.
INFO: found LLVMFuzzerCustomMutator (0x5589a0). Disabling -len_control by default.
INFO: Seed: 1522032693
INFO: Loaded 1 modules (2066 inline 8-bit counters): 2066 [0x61fba0, 0x6203b2),
INFO: Loaded 1 PC tables (2066 PCs): 2066 [0x5c53e8,0x5cd508),
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
AddressSanitizer:DEADLYSIGNAL

==1903==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000000000 bp 0x7ffe4ffb63e0 sp 0x7ffe4ffb63b8 T0)
==1903==Hint: pc points to the zero page.
==1903==The signal is caused by a READ memory access.
==1903==Hint: address points to the zero page.
#0 0x0 ()
#1 0x7f509b9d83bf (/lib/x86_64-linux-gnu/libpthread.so.0+0x153bf)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ()
==1903==ABORTING
MS: 0 ; base unit: 0000000000000000000000000000000000000000

Call traceback is as fllow:
#0 0x0000000000000000 in ?? ()
#1 0x00000000005969cc in google::protobuf::Message::GetDescriptor (this=0x7fffffffdba0) at external.protobuf/include/google/protobuf/message.h:356
#2 0x0000000000592e3e in protobuf_mutator::(anonymous namespace)::CastToAny (message=0x7fffffffdba0) at ../src/mutator.cc:387
#3 0x0000000000592dea in protobuf_mutator::(anonymous namespace)::UnpackIfAny (message=...) at ../src/mutator.cc:399
#4 0x00000000005905dd in protobuf_mutator::(anonymous namespace)::UnpackAny (message=..., result=0x7fffffffdab8) at ../src/mutator.cc:404
#5 0x0000000000590521 in protobuf_mutator::Mutator::Fix (this=0xf7ba40 <protobuf_mutator::libfuzzer::(anonymous namespace)::GetMutator()::mutator>, message=0x7fffffffdba0) at ../src/mutator.cc:630
#6 0x000000000058532c in protobuf_mutator::libfuzzer::LoadProtoInput (binary=false, data=0x6020000000b0 "\276", size=0, input=0x7fffffffdba0) at /usr/local/include/libprotobuf-mutator/src/libfuzzer/libfuzzer_macro.cc:230
#7 0x00000000005591c1 in LLVMFuzzerTestOneInput (data=0x6020000000b0 "\276", size=0) at json_generator.cpp:11
#8 0x000000000045f732 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) () at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/iostream:74
#9 0x0000000000460ba7 in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::__Fuzzer::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocatorfuzzer::SizedFile >&) () at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/iostream:74
#10 0x000000000046101a in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocatorfuzzer::SizedFile >&) () at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/iostream:74
#11 0x0000000000450d26 in fuzzer::FuzzerDriver(int*, char***, int ()(unsigned char const, unsigned long)) () at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/iostream:74
#12 0x0000000000478973 in main () at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/iostream:74
#13 0x00007ffff77910b3 in __libc_start_main (main=0x478950

, argc=1, argv=0x7fffffffe378, init=, fini=, rtld_fini=, stack_end=0x7fffffffe368) at ../csu/libc-start.c:308
#14 0x000000000042554e in _start () at /usr/bin/../lib/gcc/x86_64-linux-gnu/9/../../../../include/c++/9/iostream:74

crash happend when call qword ptr [rcx + 0x98],The address is null.
image

clang :Ubuntu clang version 11.0.0-2~ubuntu20.04.1 Target: x86_64-pc-linux-gnu
protobuf:libprotoc 3.19.1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant