Skip to content

parser: exponential vector growth OOM on specific fuzz input #103

Description

@sentomk

Summary

The fuzz_parser target hits an OOM on a specific corrupted input where the parser enters a path that causes a vector to grow exponentially — doubling from ~2MB through ~1GB until the 2GB allocation fails.

Reproduction

The triggering corpus is attached. To reproduce:

gn gen out/Fuzz --args="use_libfuzzer=true"
ninja -C out/Fuzz fuzz_parser
./out/Fuzz/fuzz_parser <corpus_file> -runs=1

Stack trace (from CI)

libFuzzer: out-of-memory (malloc(2147483648))
__sanitizer_print_stack_trace
__sanitizer::RunMallocHooks
__asan::Allocator::Allocate
__asan::asan_memalign

strace confirms exponential doubling

mmap(2,101,248)
mmap(4,198,400)
mmap(16,781,312)
mmap(33,558,528)
mmap(67,112,960)
mmap(134,221,824)
mmap(268,439,552)
mmap(536,875,008)
mmap(1,073,745,920)

Related: PR #43 fixed a similar parser recursion/OOM issue.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions