/* * Created 17.01.2019 by Tim Rühsen * * Call glob() using data from fuzzer crash file * * Build and execute with instrumented gnulib (amend -I paths as needed): * * clang build (spills out WRITE heap buffer overflow) * export CC=clang-6.0 * export CFLAGS="-O1 -g -fno-omit-frame-pointer -fsanitize=address -fsanitize-address-use-after-scope" * $CC $CFLAGS -I. -Ilib glob_crash2.c -o glob_crash2 lib/.libs/libgnu.a * ./glob_crash2 * * gcc build (spills out READ heap buffer overflow): * export CC=gcc * export CFLAGS="-O1 -g -fno-omit-frame-pointer -fsanitize=address -fsanitize-address-use-after-scope" * $CC $CFLAGS -I. -Ilib glob_crash2.c -o glob_crash2 lib/.libs/libgnu.a * ./glob_crash2 */ #include #include int main(int argc, char **argv) { static const unsigned char data[] = { 0x7e,0x6c,0x70,0x2f,0x83,0x6d,0x65,0x1d,0x75,0xef,0xcc,0xf0,0x74,0x1b,0x03,0x02,0x43, 0x94,0x05,0x33,0x83,0x1a,0xd4,0x4c,0x9f,0xbb,0x62,0xe6,0xb5,0x99,0x75,0x9f,0x26,0x69, 0xc0,0x49,0xb0,0x4b,0x38,0xe8,0x74,0x0c,0xc2,0xd1,0x81,0x46,0x77,0x2f,0x89,0xf1,0xc8, 0x73,0xb3,0x8f,0xf7,0x60,0x63,0xba,0xa5,0x59,0xaa,0xd1,0xa8,0xfc,0xf8,0x20,0xd8,0x12, 0x58,0x61,0x12,0xc6,0x21,0x5b,0xf5,0x93,0x5a,0x7c,0x79,0x34,0xa5,0x01, 0x00 }; glob_t pglob = { .gl_pathc = 0 }; if (glob((const char *) data, GLOB_MARK | GLOB_TILDE, NULL, &pglob) == 0) globfree(&pglob); return 0; }