diff options
| author | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2019-02-26 13:00:35 +0100 |
|---|---|---|
| committer | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2019-02-26 13:00:35 +0100 |
| commit | eafadd069c4e30ed62173123326a7237448615d1 (patch) | |
| tree | d9147d59505b059731b57226293a53adc4c08aa9 /src/fuzz | |
| parent | d26eef9252677bfe06ed76eedc11db3001283814 (diff) | |
| download | systemd-eafadd069c4e30ed62173123326a7237448615d1.tar.gz | |
fuzz-journal-stream: avoid assertion failure on samples which don't fit in pipe
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11587.
We had a sample which was large enough that write(2) failed to push all the
data into the pipe, and an assert failed. The code could be changed to use
a loop, but then we'd need to interleave writes and sd_event_run (to process
the journal). I don't think the complexity is worth it — fuzzing works best
if the sample is not too huge anyway. So let's just reject samples above 64k,
and tell oss-fuzz about this limit.
Diffstat (limited to 'src/fuzz')
| -rw-r--r-- | src/fuzz/fuzz-journald-stream.c | 2 | ||||
| -rw-r--r-- | src/fuzz/fuzz-journald-stream.options | 2 |
2 files changed, 3 insertions, 1 deletions
diff --git a/src/fuzz/fuzz-journald-stream.c b/src/fuzz/fuzz-journald-stream.c index 5d6c8eb8ca..bc53964139 100644 --- a/src/fuzz/fuzz-journald-stream.c +++ b/src/fuzz/fuzz-journald-stream.c @@ -15,7 +15,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { StdoutStream *stream; int v; - if (size == 0) + if (size == 0 || size > 65536) return 0; if (!getenv("SYSTEMD_LOG_LEVEL")) diff --git a/src/fuzz/fuzz-journald-stream.options b/src/fuzz/fuzz-journald-stream.options new file mode 100644 index 0000000000..678d526b1e --- /dev/null +++ b/src/fuzz/fuzz-journald-stream.options @@ -0,0 +1,2 @@ +[libfuzzer] +max_len = 65536 |