diff options
| author | Kostya Serebryany <kcc@google.com> | 2016-05-29 15:58:57 +0000 |
|---|---|---|
| committer | Kostya Serebryany <kcc@google.com> | 2016-05-29 15:58:57 +0000 |
| commit | 4795210f9c7b0f583ca785a033daea4adf0cf6ff (patch) | |
| tree | 6bebfb04d401871481a54f00bf372e6cdc0dd5f9 | |
| parent | 7ea9b6d7832c1b99a0da1b0d70e0e885ebe44ea3 (diff) | |
| download | bcm5719-llvm-4795210f9c7b0f583ca785a033daea4adf0cf6ff.tar.gz bcm5719-llvm-4795210f9c7b0f583ca785a033daea4adf0cf6ff.zip | |
[libFuzzer] fix a use-after-free (!) in libFuzzer caused by r270905: that CL caused a push_back in the main corpus invalidating the vector<> iterators in rare cases.
llvm-svn: 271186
| -rw-r--r-- | llvm/lib/Fuzzer/FuzzerLoop.cpp | 2 | ||||
| -rw-r--r-- | llvm/lib/Fuzzer/test/fuzzer-threaded.test | 11 |
2 files changed, 8 insertions, 5 deletions
diff --git a/llvm/lib/Fuzzer/FuzzerLoop.cpp b/llvm/lib/Fuzzer/FuzzerLoop.cpp index fb75a9bb223..f615642d32c 100644 --- a/llvm/lib/Fuzzer/FuzzerLoop.cpp +++ b/llvm/lib/Fuzzer/FuzzerLoop.cpp @@ -655,7 +655,7 @@ void Fuzzer::TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size, // Run the target once again, but with lsan disabled so that if there is // a real leak we do not report it twice. __lsan_disable(); - RunOneAndUpdateCorpus(Data, Size); + RunOne(Data, Size); __lsan_enable(); if (!HasMoreMallocsThanFrees) return; // a leak is unlikely. if (NumberOfLeakDetectionAttempts++ > 1000) { diff --git a/llvm/lib/Fuzzer/test/fuzzer-threaded.test b/llvm/lib/Fuzzer/test/fuzzer-threaded.test index c58a33456cc..e2c823cda1a 100644 --- a/llvm/lib/Fuzzer/test/fuzzer-threaded.test +++ b/llvm/lib/Fuzzer/test/fuzzer-threaded.test @@ -1,7 +1,10 @@ CHECK: Done 1000 runs in -RUN: LLVMFuzzer-ThreadedTest -use_traces=1 -runs=1000 2>&1 | FileCheck %s -RUN: LLVMFuzzer-ThreadedTest -use_traces=1 -runs=1000 2>&1 | FileCheck %s -RUN: LLVMFuzzer-ThreadedTest -use_traces=1 -runs=1000 2>&1 | FileCheck %s -RUN: LLVMFuzzer-ThreadedTest -use_traces=1 -runs=1000 2>&1 | FileCheck %s +# TODO(kcc): re-enable leak detection here. +# Currently laak detection makes run counts imprecise. + +RUN: LLVMFuzzer-ThreadedTest -use_traces=1 -runs=1000 -detect_leaks=0 2>&1 | FileCheck %s +RUN: LLVMFuzzer-ThreadedTest -use_traces=1 -runs=1000 -detect_leaks=0 2>&1 | FileCheck %s +RUN: LLVMFuzzer-ThreadedTest -use_traces=1 -runs=1000 -detect_leaks=0 2>&1 | FileCheck %s +RUN: LLVMFuzzer-ThreadedTest -use_traces=1 -runs=1000 -detect_leaks=0 2>&1 | FileCheck %s |
