Direct-leak in ec_group_new |
|||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5297781836611584 Fuzzer: webcrypto_ec_import_key_spki_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Direct-leak Crash Address: Crash State: ec_group_new EC_GROUP_new_curve_GFp ec_group_new_from_data Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv95LSciO_-qXhD7GALC-LV17RXYV2DC4rzxrOSQL4ig8q-ql1mJlb31PC86RCVN1bspnWEmeXIbcTQ03WcVIy67ATkIFpqOhnvm22LPqVwnZWzwHzLcAULmgwwBrWsZmpuzwKGU0UkBKe1QHGfpMZM6Gbxl5FQ Filer: mmoroz See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Apr 15 2016
David, mind taking a look? Thanks!
,
Apr 15 2016
Another question to David: is this something you can add a boringssl fuzz target for?
,
Apr 15 2016
This should be reachable from the X.509 fuzzer, but yeah we should have fuzzers that cover these functions and some others directly ( https://bugs.chromium.org/p/boringssl/issues/detail?id=15 ).
,
Apr 15 2016
Oh, pfft. Yeah, I forgot to free the group in one codepath of the new parsers. https://boringssl-review.googlesource.com/7685
,
Apr 15 2016
The following revision refers to this bug: https://boringssl.googlesource.com/boringssl.git/+/919610b4c43ab394977eba70ceec66aaa0070472 commit 919610b4c43ab394977eba70ceec66aaa0070472 Author: David Benjamin <davidben@google.com> Date: Fri Apr 15 19:34:30 2016 Fix memory leak on invalid ecPublicKey parameters. One of the codepaths didn't free the group. Found by libFuzzer. BUG= chromium:603893 Change-Id: Icb81f2f89a8c1a52e29069321498986b193a0e56 Reviewed-on: https://boringssl-review.googlesource.com/7685 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: Adam Langley <agl@google.com> [modify] https://crrev.com/919610b4c43ab394977eba70ceec66aaa0070472/crypto/evp/evp_tests.txt [modify] https://crrev.com/919610b4c43ab394977eba70ceec66aaa0070472/crypto/evp/p_ec_asn1.c
,
Apr 15 2016
(I'll go ahead and mark this as fixed, though it won't show up until the next DEPS roll.)
,
Apr 21 2016
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by mmoroz@chromium.org
, Apr 15 2016Owner: eroman@chromium.org