You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
after testing one of the harnesses provided on the OSS-Fuzz repository (clamav_dbload_YARA_fuzzer).
More specifically, the program performs a left shift of 4 places of a variable of type ‘int’, but the result cannot be represented by the destination type ‘int’.
To reproduce the error, simply run the given binary with the testcase files with a command like: `./clamav_dbload_YARA_fuzzer /path_to_testcases/input
The program has been tested on the standard Docker image provided on OSS-Fuzz using Ubuntu 20.04, providing AFL++ as fuzzing engine and build flag --sanitizer=undefined.
The hash commit used to perform the tests is 25ca17b
Environment
OS: Linux
Version/Distribution: Ubuntu 20.04
Architecture: x86_64
The text was updated successfully, but these errors were encountered:
Describe the bug
We found an undefined-behavior caused by a left shift operation in function
cli_hex2num()
clamav/libclamav/str.c
Line 211 in 19b25ce
More specifically, the program performs a left shift of 4 places of a variable of type ‘int’, but the result cannot be represented by the destination type ‘int’.
How to reproduce the problem
In the attached archive you will find:
To reproduce the error, simply run the given binary with the testcase files with a command like: `./clamav_dbload_YARA_fuzzer /path_to_testcases/input
The program has been tested on the standard Docker image provided on OSS-Fuzz using Ubuntu 20.04, providing AFL++ as fuzzing engine and build flag
--sanitizer=undefined
.The hash commit used to perform the tests is
25ca17b
Environment
The text was updated successfully, but these errors were encountered: