Environment
- OS: Ubuntu 22.04
- Compiler: clang 13.0.1
- Sanitizers: AddressSanitizer (ASan) + UndefinedBehaviorSanitizer (UBSan)
Build Instructions
export CC=clang-13
export CXX=clang++-13
export CXXFLAGS="${CXXFLAGS} -std=c++17 -stdlib=libstdc++ -fsanitize=address -O1 -g"
export CFLAGS="${CFLAGS} -fsanitize=address -O1 -g"
export LDFLAGS="${LDFLAGS} -fsanitize=address"
export LIB_FUZZING_ENGINE="-fsanitize=fuzzer"
sed -i 's/CMAKE_CXX_STANDARD 11/CMAKE_CXX_STANDARD 17/g' CMakeLists.txt
sed -i 's/std::random/\/\/std::random/g' test/*.cpp
mkdir build && cd build
cmake .. -DBUILD_SHARED=OFF -DBUILD_MIXED=ON
make -j $(nproc)
Reproduction
Run the fuzzer with a crafted input file:
Observed Behavior
Program crashes with ASan/UBSan report:
==1081242==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000085e5ac bp 0x7ffd3faebe10 sp 0x7ffd3faebb00 T0)
==1081242==The signal is caused by a READ memory access.
==1081242==Hint: address points to the zero page.
#0 0x85e5ac in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_data() const /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/basic_string.h:195:28
#1 0x85e5ac in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::c_str() const /usr/bin/../lib/gcc/x86_64-linux-gnu/11/../../../../include/c++/11/bits/basic_string.h:2321:16
#2 0x85e5ac in OpenBabel::ChemKinFormat::ReadReactionQualifierLines(std::istream&, OpenBabel::OBReaction*) /root/openbabel/src/formats/chemkinformat.cpp:626:33
#3 0x852319 in OpenBabel::ChemKinFormat::ReadMolecule(OpenBabel::OBBase*, OpenBabel::OBConversion*) /root/openbabel/src/formats/chemkinformat.cpp:207:8
#4 0x86e92b in OpenBabel::ChemKinFormat::ReadChemObject(OpenBabel::OBConversion*) /root/openbabel/src/formats/chemkinformat.cpp:123:14
#5 0x5b247b in OpenBabel::OBConversion::Convert() /root/openbabel/src/obconversion.cpp:542:30
#6 0x5b140c in OpenBabel::OBConversion::Convert(std::istream*, std::ostream*) /root/openbabel/src/obconversion.cpp:478:17
#7 0x5a5c18 in LLVMFuzzerTestOneInput /root/openbabel/test/fuzz/fuzz_convert.cpp:35:14
...
Root Cause Analysis
ChemKinFormat::ReadReactionQualifierLines assumes a non-null std::string when calling c_str() for token comparison/processing. With malformed input, a null pointer reaches this code path, leading to a null dereference.
The attached file contains a proof-of-concept.
poc.zip
Environment
Build Instructions
Reproduction
Run the fuzzer with a crafted input file:
Observed Behavior
Program crashes with ASan/UBSan report:
Root Cause Analysis
ChemKinFormat::ReadReactionQualifierLines assumes a non-null std::string when calling c_str() for token comparison/processing. With malformed input, a null pointer reaches this code path, leading to a null dereference.
The attached file contains a proof-of-concept.
poc.zip