Summary
The fuzz_parser target hits an OOM on a specific corrupted input where the parser enters a path that causes a vector to grow exponentially — doubling from ~2MB through ~1GB until the 2GB allocation fails.
Reproduction
The triggering corpus is attached. To reproduce:
gn gen out/Fuzz --args="use_libfuzzer=true"
ninja -C out/Fuzz fuzz_parser
./out/Fuzz/fuzz_parser <corpus_file> -runs=1
Stack trace (from CI)
libFuzzer: out-of-memory (malloc(2147483648))
__sanitizer_print_stack_trace
__sanitizer::RunMallocHooks
__asan::Allocator::Allocate
__asan::asan_memalign
strace confirms exponential doubling
mmap(2,101,248)
mmap(4,198,400)
mmap(16,781,312)
mmap(33,558,528)
mmap(67,112,960)
mmap(134,221,824)
mmap(268,439,552)
mmap(536,875,008)
mmap(1,073,745,920)
Related: PR #43 fixed a similar parser recursion/OOM issue.
Summary
The fuzz_parser target hits an OOM on a specific corrupted input where the parser enters a path that causes a vector to grow exponentially — doubling from ~2MB through ~1GB until the 2GB allocation fails.
Reproduction
The triggering corpus is attached. To reproduce:
Stack trace (from CI)
strace confirms exponential doubling
Related: PR #43 fixed a similar parser recursion/OOM issue.