Skip to content

Commit

Permalink
fuzz: unpoison result of mutate_{byte,int}()
Browse files Browse the repository at this point in the history
LLVMFuzzerMutate() may return data marked as uninitialized but our value
mutators assume that the entire region is initialized. MSAN recently got
stricter in how it checks use of these potentially uninitialized values.
Manually unpoison the response from LLVMFuzzerMutate() for these two
functions.
  • Loading branch information
LDVG committed May 10, 2024
1 parent c23ed8c commit 543ae58
Showing 1 changed file with 6 additions and 0 deletions.
6 changes: 6 additions & 0 deletions fuzz/mutator_aux.c
Original file line number Diff line number Diff line change
Expand Up @@ -135,12 +135,18 @@ void
mutate_byte(uint8_t *b)
{
LLVMFuzzerMutate(b, sizeof(*b), sizeof(*b));
#ifdef WITH_MSAN
__msan_unpoison(b, sizeof(*b));
#endif
}

void
mutate_int(int *i)
{
LLVMFuzzerMutate((uint8_t *)i, sizeof(*i), sizeof(*i));
#ifdef WITH_MSAN
__msan_unpoison(i, sizeof(*i));
#endif
}

void
Expand Down

0 comments on commit 543ae58

Please sign in to comment.