Skip to content

Commit

Permalink
fuzz: unpoison result of mutate_{byte,integer}()
Browse files Browse the repository at this point in the history
LLVMFuzzerMutate() may return data marked as uninitialized but our value
mutators assume that the entire region is initialized. MSAN recently got
stricter in how it checks use of these potentially uninitialized values.
Manually unpoison the response from LLVMFuzzerMutate() for these two
functions.
  • Loading branch information
LDVG committed May 10, 2024
1 parent f315e8c commit a4ddd91
Showing 1 changed file with 6 additions and 0 deletions.
6 changes: 6 additions & 0 deletions fuzz/mutator_aux.c
Original file line number Diff line number Diff line change
Expand Up @@ -135,12 +135,18 @@ void
mutate_byte(uint8_t *b)
{
LLVMFuzzerMutate(b, sizeof(*b), sizeof(*b));
#ifdef WITH_MSAN
__msan_unpoison(b, sizeof(*b));
#endif
}

void
mutate_int(int *i)
{
LLVMFuzzerMutate((uint8_t *)i, sizeof(*i), sizeof(*i));
#ifdef WITH_MSAN
__msan_unpoison(i, sizeof(*i));
#endif
}

void
Expand Down

0 comments on commit a4ddd91

Please sign in to comment.