Always memset newly reallocated memory

Fuzz testing found a case where memory was left uninitialized after
calling loader_realloc, causing a crash due to reading of that memory.
The fix is to *always* memset newly reallocated memory, since a value of
zero is a good default value, especially if that memory is for a list.
This commit removes the redundant memsets, since realloc now has the
responsibility to initialize memory.

Author: charles-lunarg

loader/allocation.c

@@ -98,6 +98,10 @@ void *loader_realloc(const VkAllocationCallbacks *pAllocator, void *pMemory, siz
 #endif
     } else {
         pNewMem = realloc(pMemory, size);
+        // Clear out the newly allocated memory
+        if (size > orig_size) {
+            memset((uint8_t *)pNewMem + orig_size, 0, size - orig_size);
+        }
     }
     return pNewMem;
 }

loader/loader.c

@@ -323,8 +323,6 @@ VkResult append_str_to_string_list(const struct loader_instance *inst, struct lo
             loader_instance_heap_free(inst, str);  // Must clean up in case of failure
             return VK_ERROR_OUT_OF_HOST_MEMORY;
         }
-        // Null out the new space
-        memset(string_list->list + string_list->allocated_count, 0, string_list->allocated_count);
         string_list->allocated_count *= 2;
     }
     string_list->list[string_list->count++] = str;
@@ -439,7 +437,6 @@ VkResult loader_append_layer_property(const struct loader_instance *inst, struct
             goto out;
         }
         layer_list->list = new_ptr;
-        memset((uint8_t *)layer_list->list + layer_list->capacity, 0, layer_list->capacity);
         layer_list->capacity *= 2;
     }
     memcpy(&layer_list->list[layer_list->count], layer_property, sizeof(struct loader_layer_properties));

tests/framework/data/fuzz_test_minimized_test_cases/clusterfuzz-testcase-instance_create_fuzzer-5817896795701248

@@ -200,6 +200,9 @@ TEST(BadJsonInput, ClusterFuzzTestCase_6353004288081920) {
     // Stack overflow due to recursive meta layers
     execute_instance_create_fuzzer("clusterfuzz-testcase-minimized-instance_create_fuzzer-6353004288081920");
 }
+TEST(BadJsonInput, ClusterFuzzTestCase_5817896795701248) {
+    execute_instance_create_fuzzer("clusterfuzz-testcase-instance_create_fuzzer-5817896795701248");
+}
 TEST(BadJsonInput, ClusterFuzzTestCase_6465902356791296) {
     // Does crash with UBSAN
     // Doesn't crash with ASAN