Hi Evgeny, Do you happen to know what clusterfuzz is trying to tell us? The detailed report and reproducer testcase are not accessible (they seems to require a google or github account to login).
It looks like somehow a NULL key got into the search tree. But I cannot figure out how that would happen. Thanks, Mark On Tue, 2023-09-05 at 22:01 -0700, ClusterFuzz-External via monorail via Elfutils-devel wrote: > Status: New > Owner: ---- > CC: elfut...@sourceware.org, da...@adalogics.com, evv...@gmail.com, > izz...@google.com > Labels: ClusterFuzz Stability-Memory-AddressSanitizer Unreproducible > Engine-libfuzzer OS-Linux Proj-elfutils Reported-2023-09-06 > Type: Bug > > New issue 62071 by ClusterFuzz-External: elfutils:fuzz-libdwfl: > Null-dereference READ in chunk_compare > https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62071 > > Detailed Report: https://oss-fuzz.com/testcase?key=5999675550072832 > > Project: elfutils > Fuzzing Engine: libFuzzer > Fuzz Target: fuzz-libdwfl > Job Type: libfuzzer_asan_i386_elfutils > Platform Id: linux > > Crash Type: Null-dereference READ > Crash Address: 0x000000a0 > Crash State: > chunk_compare > __tsearch > elf_getdata_rawchunk > > Sanitizer: address (ASAN) > > Crash Revision: > https://oss-fuzz.com/revisions?job=libfuzzer_asan_i386_elfutils&revision=202308240000 > > Reproducer Testcase: > https://oss-fuzz.com/download?testcase_id=5999675550072832 > > Issue filed automatically. > > See https://google.github.io/oss-fuzz/advanced-topics/reproducing for > instructions to reproduce this bug locally. > > ************************* UNREPRODUCIBLE ************************* > Note: This crash might not be reproducible with the provided testcase. That > said, for the past 14 days, we've been seeing this crash frequently. > > It may be possible to reproduce by trying the following options: > - Run testcase multiple times for a longer duration. > - Run fuzzing without testcase argument to hit the same crash signature. > > If it still does not reproduce, try a speculative fix based on the crash > stacktrace and verify if it works by looking at the crash statistics in the > report. We will auto-close the bug if the crash is not seen for 14 days. > ****************************************************************** > When you fix this bug, please > * mention the fix revision(s). > * state whether the bug was a short-lived regression or an old bug in any > stable releases. > * add any other useful information. > This information can help downstream consumers. > > If you need to contact the OSS-Fuzz team with a question, concern, or any > other feedback, please file an issue at > https://github.com/google/oss-fuzz/issues. Comments on individual Monorail > issues are not monitored. >
