#include "/home/loydlv/vbd/hopper_bench/re2/cre2.h"
#include <stdlib.h>
#include <string.h>
typedef int64_t i64;
int main() {
void *v0 = cre2_opt_new(); // opt
if (v0 == NULL) return 0;
void *v2 = v0; // opt
cre2_anchor_t v3 = { 288053034, }; // anchor
i64 v4 = 640LL; // m
cre2_opt_set_max_mem(v2, v4); // $relative
cre2_set *v6 = cre2_set_new(v2, v3); // set
if (v6 == NULL) return 0;
cre2_set *v8 = v6; // set
char v9_tmp[] = {77, 92, 80, 123, 77, 99, 125, 43, 50, 71, 58, 73, 8, 90, 102, 82, 108, 62, 50, 0, 0, 0, 0, 0, }; // pattern
char *v9 = malloc(sizeof v9_tmp);
memcpy(v9, v9_tmp, sizeof v9_tmp);
char *v10 = v9; // pattern
int v27 = cre2_set_add_simple(v8, v10); // $relative
int v28 = cre2_set_compile(v8); // $relative
int v31_tmp[] = {-801400760, -1308314430, 1402451838, -960879144, 1974520777, -552581394, 1195814910, -595774769, 994109953, -1768353690, -500381521, -1947593372, -1051774523, -907454282, 1014428481, -2110187081, 633553943, 449537480, 1814070959, 1886959844, 1448186699, 0, }; // match_
int *v31 = malloc(sizeof v31_tmp);
memcpy(v31, v31_tmp, sizeof v31_tmp);
int *v32 = v31; // match_
int v34 = cre2_set_match(v8, NULL, 0, v32, 22); // $relative
cre2_set_delete(v8); // $target
}
Hi,
I found a crash when fuzzing the cre2 by a synthetical harness. The sample code is listed bellow.
The internal implementation of
cre2_set_compile()returns false ifprog_is nullptr, true for success.However, the wrapper
cre2_set_compilecast theboolreturn type toint, which changes the originalmeanings of its internal implementation and may be confusing to developers.
The result is taht the after use of cre2_set_match() will dereference the null
prog_and cause crash, if without checkingthe returned confusing int type variable
v28is true.As the raw meanings fo
cre2_set_compile()is returning ture for success and false for failure, the return type ofcre2_set_compileshould beboolnotint.