Issue 45628 in oss-fuzz: elfutils:fuzz-libdwfl: Heap-buffer-overflow in strtol

2022-03-19 Thread evv… via monorail via Elfutils-devel
Comment #4 on issue 45628 by evv...@gmail.com: elfutils:fuzz-libdwfl: Heap-buffer-overflow in strtol https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45628#c4 > Hopefully I'll fix the documentation once I've gotten round to it. I opened https://github.com/google/oss-fuzz/pull/7403 where I

Issue 45630 in oss-fuzz: elfutils:fuzz-libelf: Use-of-uninitialized-value in validate_str

2022-03-19 Thread ClusterFuzz-External via monorail via Elfutils-devel
Updates: Labels: Fuzz-Blocker Comment #1 on issue 45630 by ClusterFuzz-External: elfutils:fuzz-libelf: Use-of-uninitialized-value in validate_str https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45630#c1 This crash occurs very frequently on linux platform and is likely preventing t

Re: Some fuzzer workarounds

2022-03-19 Thread Evgeny Vereshchagin via Elfutils-devel
Hi > If they weren't actually tested I think it would make sense to revert them to > avoid getting auto-generated CVEs > until they're in more or less good shape at least. I've just opened https://github.com/google/oss-fuzz/pull/7401 to weed out some false positives. Given that they are "secur