Hi,
after fuzzing gnupg2 with afl for one night, I found 2 invalid shift in iobuf.c.
To reproduce them, you need to build the source code with flag '-
fsanitize=undefined' and then execute command ./gnupg2 $file'.
You will see the following error information:
iobuf.c:875:38: runtime error: left shift of negative value -1
iobuf.c:876:38: runtime error: left shift of negative value -1
Description
Description
Details
Details
- Version
- git
Event Timeline
Comment Actions
That is EOF and the iobuf_get in line 877 will this also return EOF and thus
size is not anymore used. Don't you get the error message then?
[I know that those pesky compilers may remove the rest of the code as soon as
they notice something undefined. This is VERY troublesome and the reason why I
run the STACK utility from time to time to catch actual removed code. The end
of defensive programming.]