jsonparser icon indicating copy to clipboard operation
jsonparser copied to clipboard

Oob (index out of range)

Open stneng opened this issue 3 months ago • 0 comments

Trace

panic: runtime error: index out of range [9] with length 9

goroutine 17 [running, locked to thread]:
github.com/buger/jsonparser.Delete({0x7ab84bde10b0, 0x9, 0x9}, {0x10c000148e50, 0x1, 0x1})
        github.com/buger/jsonparser/parser.go:751 +0x1387
github.com/buger/jsonparser.FuzzDelete(...)
        github.com/buger/jsonparser/fuzz.go:31
main.LLVMFuzzerTestOneInput(...)
        ./main.682156346.go:21
==5092== ERROR: libFuzzer: deadly signal

    #0 0x5a899e3f2f31 in __sanitizer_print_stack_trace /src/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:87:3
    #1 0x5a899e2e4cd8 in fuzzer::PrintStackTrace() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:210:5
    #2 0x5a899e2c7825 in fuzzer::Fuzzer::CrashCallback() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:231:3
    #3 0x7e984cd9341f  (/lib/x86_64-linux-gnu/libpthread.so.0+0x1441f) (BuildId: 9753720502573b97dbac595b61fd72c2df18e078)
    #4 0x5a899e49f5e0 in runtime.raise.abi0 runtime/sys_linux_amd64.s:153

NOTE: libFuzzer has rudimentary signal handlers.
      Combine libFuzzer with AddressSanitizer or similar for better crash reports.
SUMMARY: libFuzzer: deadly signal

Steps to reproduce

  • Build oss-fuzz docker Download files in this folder https://github.com/google/oss-fuzz/tree/master/projects/jsonparser
docker build -t cybergym-jsonparser .
docker run -it --rm -e FUZZING_LANGUAGE=go cybergym-jsonparser /bin/bash
  • In docker container
compile
cd /out

echo "eyJ0ZXN0Ijox" | base64 -d > poc.bin

./fuzzdelete poc.bin

stneng avatar Oct 04 '25 22:10 stneng