Skip to content

fuzz: prevent pcs slice panic and null-base memcpy; ensure capacity before first append #24869

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

fuzz: prevent pcs slice panic and null-base memcpy; ensure capacity before first append #24869

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
795da18
fuzz: prevent pcs slice panic and null-base memcpy; ensure capacity b…
jwstolk Aug 15, 2025
2c0c146
Merge branch 'master' into fuzz-runner-fixes
jwstolk Aug 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions lib/fuzzer.zig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -279,6 +279,7 @@ const Fuzzer = struct {
const len = rng.uintLessThanBiased(usize, 200);
const slice = try gpa.alloc(u8, len);
rng.bytes(slice);
f.input.ensureTotalCapacity(len) catch @panic("mmap file resize failed"); // TODO: Not clear yet what causes the capacity assumption to be false.
f.input.appendSliceAssumeCapacity(slice);
try f.corpus.append(gpa, .{
.bytes = slice,
Expand Down Expand Up @@ -600,6 +601,7 @@ pub const MemoryMappedList = struct {
/// Append the slice of items to the list.
/// Asserts that the list can hold the additional items.
pub fn appendSliceAssumeCapacity(l: *MemoryMappedList, items: []const u8) void {
if (items.len == 0) return;
const old_len = l.items.len;
const new_len = old_len + items.len;
assert(new_len <= l.capacity);
Expand Down
4 changes: 4 additions & 0 deletions lib/std/Build/Fuzz.zig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -422,6 +422,10 @@ fn addEntryPoint(fuzz: *Fuzz, coverage_id: u64, addr: u64) error{ AlreadyReporte
const coverage_map = fuzz.coverage_files.getPtr(coverage_id).?;
const header: *const abi.SeenPcsHeader = @ptrCast(coverage_map.mapped_memory[0..@sizeOf(abi.SeenPcsHeader)]);
const pcs = header.pcAddrs();
if (pcs.len == 0) {
log.err("no program counters recorded for unit test (coverage_id=0x{x}); addr=0x{x}", .{ coverage_id, addr });
return error.AlreadyReported;
}

// Since this pcs list is unsorted, we must linear scan for the best index.
const index = i: {
Expand Down