12020-02-05 17:50:20,470 - root - INFO - Fuzzer dex_fuzzer, detected error: INFO: Seed: 1337
2INFO: Loaded 1 modules   (8322 inline 8-bit counters): 8322 [0x8eaaf0, 0x8ecb72),
3INFO: Loaded 1 PC tables (8322 PCs): 8322 [0x661bd8,0x6823f8),
4INFO:        7 files found in /tmp/dex_fuzzer_corpus
5INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 46328 bytes
6INFO: seed corpus: files: 7 min: 1264b max: 46328b total: 136996b rss: 36Mb
7#8	INITED cov: 265 ft: 523 corp: 7/133Kb exec/s: 0 rss: 43Mb
8#10	NEW    cov: 266 ft: 538 corp: 8/147Kb lim: 46328 exec/s: 0 rss: 44Mb L: 13929/46328 MS: 2 ChangeBit-InsertByte-
9#12	NEW    cov: 270 ft: 550 corp: 9/192Kb lim: 46328 exec/s: 0 rss: 44Mb L: 46328/46328 MS: 2 ShuffleBytes-CrossOver-
10#14	NEW    cov: 270 ft: 557 corp: 10/201Kb lim: 46328 exec/s: 0 rss: 45Mb L: 9103/46328 MS: 2 ChangeASCIIInt-EraseBytes-
11#15	NEW    cov: 270 ft: 565 corp: 11/218Kb lim: 46328 exec/s: 0 rss: 45Mb L: 16991/46328 MS: 1 InsertRepeatedBytes-
12#21	NEW    cov: 272 ft: 568 corp: 12/227Kb lim: 46328 exec/s: 0 rss: 45Mb L: 9132/46328 MS: 1 InsertRepeatedBytes-
13#25	NEW    cov: 275 ft: 575 corp: 13/236Kb lim: 46328 exec/s: 0 rss: 45Mb L: 9262/46328 MS: 4 ChangeBinInt-InsertByte-ChangeBit-EraseBytes-
14#26	NEW    cov: 280 ft: 602 corp: 14/244Kb lim: 46328 exec/s: 0 rss: 45Mb L: 9133/46328 MS: 1 InsertByte-
15#44	NEW    cov: 280 ft: 609 corp: 15/254Kb lim: 46328 exec/s: 0 rss: 45Mb L: 9290/46328 MS: 3 ChangeByte-InsertRepeatedBytes-InsertRepeatedBytes-
16#60	NEW    cov: 280 ft: 611 corp: 16/263Kb lim: 46328 exec/s: 0 rss: 45Mb L: 9291/46328 MS: 1 InsertByte-
17#67	NEW    cov: 280 ft: 614 corp: 17/272Kb lim: 46328 exec/s: 0 rss: 45Mb L: 9074/46328 MS: 2 CopyPart-EraseBytes-
18#68	NEW    cov: 280 ft: 617 corp: 18/305Kb lim: 46328 exec/s: 0 rss: 45Mb L: 34216/46328 MS: 1 InsertRepeatedBytes-
19#70	NEW    cov: 280 ft: 618 corp: 19/321Kb lim: 46328 exec/s: 0 rss: 45Mb L: 16543/46328 MS: 2 ChangeASCIIInt-CopyPart-
20#71	NEW    cov: 280 ft: 619 corp: 20/336Kb lim: 46328 exec/s: 0 rss: 45Mb L: 14936/46328 MS: 1 CopyPart-
21#72	NEW    cov: 280 ft: 623 corp: 21/345Kb lim: 46328 exec/s: 0 rss: 45Mb L: 9255/46328 MS: 1 EraseBytes-
22#79	NEW    cov: 280 ft: 628 corp: 22/354Kb lim: 46328 exec/s: 0 rss: 45Mb L: 9263/46328 MS: 2 CopyPart-CMP- DE: "\x00\x00\x00\x00\x00\x00$'"-
23#80	NEW    cov: 280 ft: 632 corp: 23/363Kb lim: 46328 exec/s: 80 rss: 45Mb L: 9312/46328 MS: 1 InsertRepeatedBytes-
24=================================================================
25==12==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62500001b530 at pc 0x00000052138a bp 0x7ffe62db2c10 sp 0x7ffe62db23d8
26READ of size 52 at 0x62500001b530 thread T0
27SCARINESS: 26 (multi-byte-read-heap-buffer-overflow)
28    #0 0x521389 in __asan_memcpy /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3
29    #1 0x567590 in yr_object_set_string /src/yara/libyara/object.c:1122:5
30    #2 0x5afced in dex_parse /src/yara/libyara/modules/dex/dex.c:781:5
31    #3 0x5b4a8b in dex__load /src/yara/libyara/modules/dex/dex.c:1218:7
32    #4 0x56537c in yr_modules_load /src/yara/libyara/modules.c:179:16
33    #5 0x5d6583 in yr_execute_code /src/yara/libyara/exec.c:1276:18
34    #6 0x56f5c0 in yr_scanner_scan_mem_blocks /src/yara/libyara/scanner.c:444:3
35    #7 0x56bf23 in yr_rules_scan_mem_blocks /src/yara/libyara/rules.c:235:12
36    #8 0x56c182 in yr_rules_scan_mem /src/yara/libyara/rules.c:285:10
37    #9 0x5548d2 in LLVMFuzzerTestOneInput /src/yara/tests/oss-fuzz/dex_fuzzer.cc:40:3
38    #10 0x45a3b1 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15
39    #11 0x459ad5 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:470:3
40    #12 0x45be77 in fuzzer::Fuzzer::MutateAndTestOne() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:698:19
41    #13 0x45cc05 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocator<fuzzer::SizedFile> >&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:830:5
42    #14 0x44ac88 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:824:6
43    #15 0x474ab2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
44    #16 0x7f4409b7a82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
45    #17 0x41e348 in _start (out/dex_fuzzer+0x41e348)
46
470x62500001b530 is located 0 bytes to the right of 9264-byte region [0x625000019100,0x62500001b530)
48allocated by thread T0 here:
49    #0 0x521f4d in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
50    #1 0x4331b7 in operator new(unsigned long) (out/dex_fuzzer+0x4331b7)
51    #2 0x459ad5 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:470:3
52    #3 0x45be77 in fuzzer::Fuzzer::MutateAndTestOne() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:698:19
53    #4 0x45cc05 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocator<fuzzer::SizedFile> >&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:830:5
54    #5 0x44ac88 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:824:6
55    #6 0x474ab2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
56    #7 0x7f4409b7a82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
57
58SUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy
59Shadow bytes around the buggy address:
60  0x0c4a7fffb650: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
61  0x0c4a7fffb660: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
62  0x0c4a7fffb670: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
63  0x0c4a7fffb680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
64  0x0c4a7fffb690: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
65=>0x0c4a7fffb6a0: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa
66  0x0c4a7fffb6b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
67  0x0c4a7fffb6c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
68  0x0c4a7fffb6d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
69  0x0c4a7fffb6e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
70  0x0c4a7fffb6f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
71
72Shadow byte legend (one shadow byte represents 8 application bytes):
73  Addressable:           00
74  Partially addressable: 01 02 03 04 05 06 07
75  Heap left redzone:       fa
76  Freed heap region:       fd
77  Stack left redzone:      f1
78  Stack mid redzone:       f2
79  Stack right redzone:     f3
80  Stack after return:      f5
81  Stack use after scope:   f8
82  Global redzone:          f9
83  Global init order:       f6
84  Poisoned by user:        f7
85  Container overflow:      fc
86  Array cookie:            ac
87  Intra object redzone:    bb
88  ASan internal:           fe
89  Left alloca redzone:     ca
90  Right alloca redzone:    cb
91  Shadow gap:              cc
92==12==ABORTING
93MS: 1 InsertByte-; base unit: e91e5af87998bbf9aa64218be0652d64ba4ea89d
94artifact_prefix='./'; Test unit written to ./crash-ad6700613693ef977ff3a8c8f4dae239c3dde6f5
95