Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NULL pointer dereference issue in glib-datatype example in jsonsl #43

Open
yunho-kim opened this issue Sep 11, 2018 · 0 comments
Open

Comments

@yunho-kim
Copy link

Dear Mark Nunberg,
We have found a NULL pointer dereference issue in glib-datatype example in jsonsl.
The crash input is automatically generated by our test generation tool FOCAL.
You can find crash2.json in crash2.zip

Here are details to reproduce the NULL pointer dereference.

  • OS & Compiler
    Ubuntu Linux 16.04 x64 and GCC 5.4.0
  • Build command
    $ CFLAGS="-fsanitize=address" make clean check
    $ cd examples && CFLAGS="-fsanitize=address" make clean all && cd -
  • Run command
    $ ./examples/glib-datatypes crash2.json
  • Outputs
==== crash2.json ====
L1 +LIST       @0
   L2 +LIST       @1
... omitted ... 
      L3 +STRING     @3836
Got error at pos 3837: WEIRD_WHITESPACE
ASAN:SIGSEGV
=================================================================
==28967==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fcedea57746 bp 0x7ffc3f8b5060 sp 0x7ffc3f8b47e8 T0)
    #0 0x7fcedea57745  (/lib/x86_64-linux-gnu/libc.so.6+0x8b745)
    #1 0x7fcedf1171a5  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x701a5)
    #2 0x40d3f4  (/home/yhkim/jsonsl/examples/glib-datatypes+0x40d3f4)
    #3 0x402730  (/home/yhkim/jsonsl/examples/glib-datatypes+0x402730)
    #4 0x40d766  (/home/yhkim/jsonsl/examples/glib-datatypes+0x40d766)
    #5 0x40daff  (/home/yhkim/jsonsl/examples/glib-datatypes+0x40daff)
    #6 0x7fcede9ec82f  (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #7 0x4015a8  (/home/yhkim/jsonsl/examples/glib-datatypes+0x4015a8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ??:0 ??
==28967==ABORTING
Aborted
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant