62697e58d9
```
READ of size 2 at 0x602000000091 thread T0
SCARINESS: 14 (2-byte-read-heap-buffer-overflow)
#0 0x4c6fb9 in StrstrCheck(void*, char*, char const*, char const*) /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:580:5
#1 0x4c6df1 in strstr /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:597:5
#2 0x56c9ba in freerdp_assistance_parse_file_buffer /src/FreeRDP/libfreerdp/common/assistance.c:743:6
#3 0x56b58e in parse_file_buffer /src/FreeRDP/libfreerdp/common/test/TestFuzzCommonAssistanceParseFileBuffer.c:11:11
#4 0x56b58e in LLVMFuzzerTestOneInput /src/FreeRDP/libfreerdp/common/test/TestFuzzCommonAssistanceParseFileBuffer.c:20:2
#5 0x43f5e3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15
#6 0x440994 in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::__Fuzzer::vector<fuzzer::SizedFile, std::__Fuzzer::allocator<fuzzer::SizedFile> >&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:804:3
```
32 lines
755 B
C
32 lines
755 B
C
#include <freerdp/assistance.h>
|
|
|
|
static int parse_file_buffer(const uint8_t* Data, size_t Size)
|
|
{
|
|
static const char TEST_MSRC_INCIDENT_PASSWORD_TYPE2[] = "48BJQ853X3B4";
|
|
int status = -1;
|
|
rdpAssistanceFile* file = freerdp_assistance_file_new();
|
|
if (!file)
|
|
return -1;
|
|
|
|
char* buf = calloc(Size + 1, sizeof(char));
|
|
if (buf == NULL)
|
|
goto err;
|
|
memcpy(buf, Data, Size);
|
|
buf[Size] = '\0';
|
|
|
|
status = freerdp_assistance_parse_file_buffer(file, (char*)buf, Size + 1,
|
|
TEST_MSRC_INCIDENT_PASSWORD_TYPE2);
|
|
|
|
err:
|
|
freerdp_assistance_file_free(file);
|
|
free(buf);
|
|
|
|
return status >= 0 ? TRUE : FALSE;
|
|
}
|
|
|
|
int LLVMFuzzerTestOneInput(const uint8_t* Data, size_t Size)
|
|
{
|
|
parse_file_buffer(Data, Size);
|
|
return 0;
|
|
}
|