Dear Team,
I found that the zlib API crc32_combine_gen64 contains an infinite loop issue.
See the PoC program below, I pass an empty mode of gzopen() and let it return a NULL.
Then gzoffset64(NULL) will return a value of 0xffffffffffffffff.
If the argument passed to crc32_combine_gen64() is 0xffffffffffffffff, it will trap in an infinite loop.
PoC program:
#include <zlib.h>
#include <stdlib.h>
#include <stdio.h>
#include <stdint.h>
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
if(size<54) return 0;
FILE *input_file_ptr = fopen("input_file", "wb");
if (input_file_ptr == NULL) {return 0;}
fwrite(data, sizeof(uint8_t), size, input_file_ptr);
fclose(input_file_ptr);
gzFile file;
// Step 2: Open the gzip file
file = gzopen("input_file", "");
uLong crc32_checksum = crc32_combine_gen64(gzoffset64(file));
// Step 10: Clean up and release resources
gzclose(file);
return 0;
}
Dear Team,
I found that the zlib API
crc32_combine_gen64contains an infinite loop issue.See the PoC program below, I pass an empty mode of
gzopen()and let it return a NULL.Then
gzoffset64(NULL)will return a value of 0xffffffffffffffff.If the argument passed to
crc32_combine_gen64()is 0xffffffffffffffff, it will trap in an infinite loop.PoC program: