Null-dereference READ in vdbeCompareMemString |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5652604814229504 Fuzzer: afl_sqlite3_dbfuzz2_fuzzer Fuzz target binary: sqlite3_dbfuzz2_fuzzer Job Type: afl_chrome_asan Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: vdbeCompareMemString sqlite3VdbeRecordCompareWithSkip vdbeRecordCompareString Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=622595:622639 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5652604814229504 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for instructions to reproduce this bug locally.
,
Jan 20
(2 days ago)
Automatically adding ccs based on OWNERS file / target commit history. If this is incorrect, please add ClusterFuzz-Wrong label.
,
Jan 20
(2 days ago)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/0abd626ef136c39711131a2ad9947cb61d6b4b7f (sqlite: Backport a few more bug fixes.). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Jan 20
(2 days ago)
Richard and Dan, can you please take a look at this?
dbfuzz2 test case attached. Stack trace below.
==2024455==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x5592b65de07f bp 0x7ffc516298d0 sp 0x7ffc51629820 T0)
==2024455==The signal is caused by a READ memory access.
==2024455==Hint: address points to the zero page.
SCARINESS: 10 (null-deref)
#0 0x5592b65de07e in vdbeCompareMemString third_party/sqlite/amalgamation/sqlite3.c:79828:26
#1 0x5592b65e34f4 in sqlite3VdbeRecordCompareWithSkip third_party/sqlite/amalgamation/sqlite3.c:80187:16
#2 0x5592b65e2a31 in vdbeRecordCompareString third_party/sqlite/amalgamation/sqlite3.c:80406:17
#3 0x5592b65d0e5c in sqlite3BtreeMovetoUnpacked third_party/sqlite/amalgamation/sqlite3.c:0:15
#4 0x5592b65df294 in btreeMoveto third_party/sqlite/amalgamation/sqlite3.c:63834:8
#5 0x5592b65defc1 in btreeRestoreCursorPosition third_party/sqlite/amalgamation/sqlite3.c:63858:8
#6 0x5592b65e44c2 in btreeNext third_party/sqlite/amalgamation/sqlite3.c:68628:10
#7 0x5592b65b6d89 in sqlite3VdbeExec third_party/sqlite/amalgamation/sqlite3.c:88333:8
#8 0x5592b655e627 in sqlite3Step third_party/sqlite/amalgamation/sqlite3.c:81445:10
#9 0x5592b6556008 in sqlite3_step third_party/sqlite/amalgamation/sqlite3.c:81508:16
#10 0x5592b65669b5 in sqlite3_exec third_party/sqlite/amalgamation/sqlite3.c:118093:12
#11 0x5592b64936c4 in LLVMFuzzerTestOneInput third_party/sqlite/src/test/dbfuzz2.c:95:5
|
|||
►
Sign in to add a comment |
|||
Comment 1 by ClusterFuzz
, Jan 20 (2 days ago)Labels: Test-Predator-Auto-Components