Skip to content

Commit fa32879

Browse files
committed
tests: [fuzz] fix potential null dereference
There is a possibility that zstate.msg = NULL, which is set in inflateInit2() function. In that case, we should not compare against another string. Signed-off-by: Pablo de Lara <[email protected]>
1 parent 768b772 commit fa32879

File tree

1 file changed

+5
-4
lines changed

1 file changed

+5
-4
lines changed

tests/fuzz/igzip_checked_inflate_fuzz_test.c

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -59,10 +59,11 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
5959
/* If zlib errors, assert isal errors, excluding a few
6060
* cases where zlib is overzealous and when zlib notices
6161
* an error faster than isal */
62-
assert(iret < 0 || strcmp(zstate.msg, z_msg_invalid_code_set) == 0 ||
63-
strcmp(zstate.msg, z_msg_invalid_dist_set) == 0 ||
64-
strcmp(zstate.msg, z_msg_invalid_lit_len_set) == 0 ||
65-
(iret == ISAL_END_INPUT && zstate.avail_in < 3));
62+
assert(iret < 0 || (iret == ISAL_END_INPUT && zstate.avail_in < 3) ||
63+
(zstate.msg != NULL &&
64+
(strcmp(zstate.msg, z_msg_invalid_code_set) == 0 ||
65+
strcmp(zstate.msg, z_msg_invalid_dist_set) == 0 ||
66+
strcmp(zstate.msg, z_msg_invalid_lit_len_set) == 0)));
6667

6768
} else
6869
/* If zlib did not finish or error, assert isal did not finish

0 commit comments

Comments
 (0)