Skip to content

crash caused by confusing return type of cre2_set_compile #27

Description

@hopper-vul

Hi,
I found a crash when fuzzing the cre2 by a synthetical harness. The sample code is listed bellow.

The internal implementation of cre2_set_compile() returns false if prog_ is nullptr, true for success.
However, the wrapper cre2_set_compile cast the bool return type to int, which changes the original
meanings of its internal implementation and may be confusing to developers.

The result is taht the after use of cre2_set_match() will dereference the null prog_ and cause crash, if without checking
the returned confusing int type variable v28 is true.

As the raw meanings fo cre2_set_compile() is returning ture for success and false for failure, the return type of cre2_set_compile should be bool not int.

#include "/home/loydlv/vbd/hopper_bench/re2/cre2.h"
#include <stdlib.h>
#include <string.h>
typedef int64_t i64;
int main() {
    void *v0 = cre2_opt_new(); // opt
    if (v0 == NULL) return 0;
    void *v2 = v0; // opt
    cre2_anchor_t v3 = { 288053034,  }; // anchor
    i64 v4 = 640LL; // m
    cre2_opt_set_max_mem(v2, v4); // $relative
    cre2_set *v6 = cre2_set_new(v2, v3); // set
    if (v6 == NULL) return 0;
    cre2_set *v8 = v6; // set
    char v9_tmp[] = {77, 92, 80, 123, 77, 99, 125, 43, 50, 71, 58, 73, 8, 90, 102, 82, 108, 62, 50, 0, 0, 0, 0, 0, }; // pattern
    char *v9 = malloc(sizeof v9_tmp);
    memcpy(v9, v9_tmp, sizeof v9_tmp);
    char *v10 = v9; // pattern
    int v27 = cre2_set_add_simple(v8, v10); // $relative
    int v28 = cre2_set_compile(v8); // $relative
    int v31_tmp[] = {-801400760, -1308314430, 1402451838, -960879144, 1974520777, -552581394, 1195814910, -595774769, 994109953, -1768353690, -500381521, -1947593372, -1051774523, -907454282, 1014428481, -2110187081, 633553943, 449537480, 1814070959, 1886959844, 1448186699, 0, }; // match_
    int *v31 = malloc(sizeof v31_tmp);
    memcpy(v31, v31_tmp, sizeof v31_tmp);
    int *v32 = v31; // match_
    int v34 = cre2_set_match(v8, NULL, 0, v32, 22); // $relative
    cre2_set_delete(v8); // $target
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions