Skip to content

FDP misuses: ConsumeBytes and sizes #301

Open
@oliverchang

Description

@oliverchang

A lot of our current generated fuzz targets have the following misuse of FDP:

  const size_t src_size = stream.ConsumeIntegralInRange<size_t>(0, 1024);
  std::vector<uint8_t> src = stream.ConsumeBytes<uint8_t>(src_size);

  // Call the function being tested.
  func(src.data(), src_size);

This makes an assumption that stream.ConsumeBytes will always return the requested number of bytes. This is not the case -- it will return at most the number of bytes remaining in the input stream.

This will lead to false positive crashes.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions