{"action":"created","issue":{"url":"https://api.github.com/repos/radare/radare2/issues/7553","repository_url":"https://api.github.com/repos/radare/radare2","labels_url":"https://api.github.com/repos/radare/radare2/issues/7553/labels{/name}","comments_url":"https://api.github.com/repos/radare/radare2/issues/7553/comments","events_url":"https://api.github.com/repos/radare/radare2/issues/7553/events","html_url":"https://github.com/radare/radare2/issues/7553","id":230194341,"number":7553,"title":"Fuzz testing 2017-05-20","user":{"login":"rwhitworth","id":7214365,"avatar_url":"https://avatars3.githubusercontent.com/u/7214365?v=3","gravatar_id":"","url":"https://api.github.com/users/rwhitworth","html_url":"https://github.com/rwhitworth","followers_url":"https://api.github.com/users/rwhitworth/followers","following_url":"https://api.github.com/users/rwhitworth/following{/other_user}","gists_url":"https://api.github.com/users/rwhitworth/gists{/gist_id}","starred_url":"https://api.github.com/users/rwhitworth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rwhitworth/subscriptions","organizations_url":"https://api.github.com/users/rwhitworth/orgs","repos_url":"https://api.github.com/users/rwhitworth/repos","events_url":"https://api.github.com/users/rwhitworth/events{/privacy}","received_events_url":"https://api.github.com/users/rwhitworth/received_events","type":"User","site_admin":false},"labels":[{"id":205550739,"url":"https://api.github.com/repos/radare/radare2/labels/release","name":"release","color":"009800","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/radare/radare2/milestones/20","html_url":"https://github.com/radare/radare2/milestone/20","labels_url":"https://api.github.com/repos/radare/radare2/milestones/20/labels","id":2267381,"number":20,"title":"1.5.0","description":"","creator":{"login":"radare","id":917142,"avatar_url":"https://avatars2.githubusercontent.com/u/917142?v=3","gravatar_id":"","url":"https://api.github.com/users/radare","html_url":"https://github.com/radare","followers_url":"https://api.github.com/users/radare/followers","following_url":"https://api.github.com/users/radare/following{/other_user}","gists_url":"https://api.github.com/users/radare/gists{/gist_id}","starred_url":"https://api.github.com/users/radare/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/radare/subscriptions","organizations_url":"https://api.github.com/users/radare/orgs","repos_url":"https://api.github.com/users/radare/repos","events_url":"https://api.github.com/users/radare/events{/privacy}","received_events_url":"https://api.github.com/users/radare/received_events","type":"User","site_admin":false},"open_issues":8,"closed_issues":51,"state":"open","created_at":"2017-01-20T16:17:41Z","updated_at":"2017-05-29T09:27:03Z","due_on":"2017-05-29T07:00:00Z","closed_at":null},"comments":3,"created_at":"2017-05-21T03:34:45Z","updated_at":"2017-05-29T10:08:37Z","closed_at":null,"body":"Hello, I was using American Fuzzy Lop (afl-fuzz) to fuzz input to the radare2 program on Linux. Is fixing the issues from these input files something you're interested in? The input files can be found here: https://github.com/rwhitworth/radare2-fuzz\r\n\r\nThe files can be executed as `./radare2 radare2 < id_filename` to cause the issues.  The compiled radare2 binary to be analyzed is also included in the repo.\r\n\r\nLet me know if I can provide any more information to help narrow down this issue.\r\n\r\n* [ ] id:000000,sig:11,src:000085,op:havoc,rep:8\r\n\r\n```\r\n==20820== Memcheck, a memory error detector\r\n==20820== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.\r\n==20820== Using Valgrind-3.10.0 and LibVEX; rerun with -h for copyright info\r\n==20820== Command: ./radare2 radare2\r\n==20820==\r\n -- Connection lost with the license server, your r2 session will terminate soon.\r\nA: ebp zf pf sf cf of rbp\r\nR: ebp rbp\r\nW: ebp zf pf sf cf of rbp\r\nN:\r\nA: ebp zf pf sf cf of rbp\r\nR: ebp rbp\r\nW: ebp zf pf sf cf of rbp\r\nN:\r\n[0x00003be0]> ==20820==\r\n==20820== HEAP SUMMARY:\r\n==20820==     in use at exit: 67,495 bytes in 1,031 blocks\r\n==20820==   total heap usage: 173,855 allocs, 172,824 frees, 245,202,002 bytes allocated\r\n==20820==\r\n==20820== LEAK SUMMARY:\r\n==20820==    definitely lost: 28,183 bytes in 513 blocks\r\n==20820==    indirectly lost: 19,242 bytes in 498 blocks\r\n==20820==      possibly lost: 0 bytes in 0 blocks\r\n==20820==    still reachable: 20,070 bytes in 20 blocks\r\n==20820==         suppressed: 0 bytes in 0 blocks\r\n==20820== Rerun with --leak-check=full to see details of leaked memory\r\n==20820==\r\n==20820== For counts of detected and suppressed errors, rerun with: -v\r\n==20820== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)\r\n```\r\n\r\n* [x] id:000001,sig:11,sync:r2,src:003579\r\n\r\n```\r\n==2715== Memcheck, a memory error detector\r\n==2715== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.\r\n==2715== Using Valgrind-3.10.0 and LibVEX; rerun with -h for copyright info\r\n==2715== Command: ./radare2 radare2\r\n==2715==\r\n==2715== Invalid read of size 8\r\n==2715==    at 0x50D2C20: cmd_info (cmd_info.c:445)\r\n==2715==    by 0x51D5A2B: r_cmd_call (cmd_api.c:226)\r\n==2715==    by 0x5162A66: r_core_cmd_subst_i (cmd.c:2134)\r\n==2715==    by 0x50AD3FB: r_core_cmd_subst (cmd.c:1365)\r\n==2715==    by 0x50A935D: r_core_cmd (cmd.c:2783)\r\n==2715==    by 0x5091C1A: r_core_prompt_exec (core.c:1918)\r\n==2715==    by 0x1106F3: main (radare2.c:1225)\r\n==2715==  Address 0xa6ba160 is 64 bytes inside a block of size 216 free'd\r\n==2715==    at 0x4C29E90: free (vg_replace_malloc.c:473)\r\n==2715==    by 0x5DBA971: r_bin_object_free (bin.c:614)\r\n==2715==    by 0x96AA3D6: r_list_delete (list.c:93)\r\n==2715==    by 0x96AA3D6: r_list_purge (list.c:62)\r\n==2715==    by 0x96AA3D6: r_list_free (list.c:72)\r\n==2715==    by 0x5DBA4D7: r_bin_reload (bin.c:945)\r\n==2715==    by 0x5167FDE: r_core_bin_reload (file.c:308)\r\n==2715==    by 0x50D28FA: cmd_info (cmd_info.c:292)\r\n==2715==    by 0x51D5A2B: r_cmd_call (cmd_api.c:226)\r\n==2715==    by 0x5162A66: r_core_cmd_subst_i (cmd.c:2134)\r\n==2715==    by 0x50AD3FB: r_core_cmd_subst (cmd.c:1365)\r\n==2715==    by 0x50A935D: r_core_cmd (cmd.c:2783)\r\n==2715==    by 0x5091C1A: r_core_prompt_exec (core.c:1918)\r\n==2715==    by 0x1106F3: main (radare2.c:1225)\r\n==2715==\r\n==2715==\r\n==2715== HEAP SUMMARY:\r\n==2715==     in use at exit: 442,222 bytes in 1,722 blocks\r\n==2715==   total heap usage: 291,799 allocs, 290,077 frees, 330,390,370 bytes allocated\r\n==2715==\r\n==2715== LEAK SUMMARY:\r\n==2715==    definitely lost: 36,837 bytes in 624 blocks\r\n==2715==    indirectly lost: 239,380 bytes in 1,078 blocks\r\n==2715==      possibly lost: 163,641 bytes in 1 blocks\r\n==2715==    still reachable: 2,364 bytes in 19 blocks\r\n==2715==         suppressed: 0 bytes in 0 blocks\r\n==2715== Rerun with --leak-check=full to see details of leaked memory\r\n==2715==\r\n==2715== For counts of detected and suppressed errors, rerun with: -v\r\n==2715== ERROR SUMMARY: 11 errors from 1 contexts (suppressed: 0 from 0)\r\n```\r\n\r\n\r\n* [ ] id:000000,sig:11,src:000039+001343,op:splice,rep:64\r\nThis input causes radare2 to go into the background of the shell, so output from valgrind is a bit odd. 'fg' is required.\r\n```\r\n==29773== Memcheck, a memory error detector\r\n==29773== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.\r\n==29773== Using Valgrind-3.10.0 and LibVEX; rerun with -h for copyright info\r\n==29773== Command: ./radare2 radare2\r\n==29773==\r\n==10852== HEAP SUMMARY:\r\n==10852==     in use at exit: 84,817 bytes in 1,215 blocks\r\n==10852==   total heap usage: 174,926 allocs, 173,711 frees, 248,889,674 bytes allocated\r\n==10852==\r\n==10852== LEAK SUMMARY:\r\n==10852==    definitely lost: 44,725 bytes in 611 blocks\r\n==10852==    indirectly lost: 20,022 bytes in 584 blocks\r\n==10852==      possibly lost: 0 bytes in 0 blocks\r\n==10852==    still reachable: 20,070 bytes in 20 blocks\r\n==10852==         suppressed: 0 bytes in 0 blocks\r\n==10852== Rerun with --leak-check=full to see details of leaked memory\r\n==10852==\r\n==10852== For counts of detected and suppressed errors, rerun with: -v\r\n==10852== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)\r\n```\r\n\r\n\r\n* [x] id:000001,sig:11,src:000875+000422,op:splice,rep:16\r\n```\r\n==17167== Memcheck, a memory error detector\r\n==17167== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.\r\n==17167== Using Valgrind-3.10.0 and LibVEX; rerun with -h for copyright info\r\n==17167== Command: ./radare2 radare2\r\n==17167==\r\n==17167== Jump to the invalid address stated on the next line\r\n==17167==    at 0x0: ???\r\n==17167==    by 0x96E159F: r_print_format_register (p_format.c:1100)\r\n==17167==    by 0x96E159F: r_print_format (p_format.c:1961)\r\n==17167==    by 0x5107DF1: cmd_meta_hsdmf (cmd_meta.c:507)\r\n==17167==    by 0x5107DF1: cmd_meta (cmd_meta.c:785)\r\n==17167==    by 0x51D5A2B: r_cmd_call (cmd_api.c:226)\r\n==17167==    by 0x515F962: r_core_cmd_subst_i (cmd.c:2175)\r\n==17167==    by 0x50AD3FB: r_core_cmd_subst (cmd.c:1365)\r\n==17167==    by 0x50A935D: r_core_cmd (cmd.c:2783)\r\n==17167==    by 0x520B958: r_core_visual_define (vmenus.c:2528)\r\n==17167==    by 0x51822C5: r_core_visual_cmd (visual.c:1667)\r\n==17167==    by 0x518A010: r_core_visual (visual.c:2725)\r\n==17167==    by 0x510FE1D: cmd_visual (cmd.c:974)\r\n==17167==    by 0x51D5A2B: r_cmd_call (cmd_api.c:226)\r\n==17167==  Address 0x0 is not stack'd, malloc'd or (recently) free'd\r\n==17167==\r\n==17167==\r\n==17167== Process terminating with default action of signal 11 (SIGSEGV)\r\n==17167==  Bad permissions for mapped region at address 0x0\r\n==17167==    at 0x0: ???\r\n==17167==    by 0x96E159F: r_print_format_register (p_format.c:1100)\r\n==17167==    by 0x96E159F: r_print_format (p_format.c:1961)\r\n==17167==    by 0x5107DF1: cmd_meta_hsdmf (cmd_meta.c:507)\r\n==17167==    by 0x5107DF1: cmd_meta (cmd_meta.c:785)\r\n==17167==    by 0x51D5A2B: r_cmd_call (cmd_api.c:226)\r\n==17167==    by 0x515F962: r_core_cmd_subst_i (cmd.c:2175)\r\n==17167==    by 0x50AD3FB: r_core_cmd_subst (cmd.c:1365)\r\n==17167==    by 0x50A935D: r_core_cmd (cmd.c:2783)\r\n==17167==    by 0x520B958: r_core_visual_define (vmenus.c:2528)\r\n==17167==    by 0x51822C5: r_core_visual_cmd (visual.c:1667)\r\n==17167==    by 0x518A010: r_core_visual (visual.c:2725)\r\n==17167==    by 0x510FE1D: cmd_visual (cmd.c:974)\r\n==17167==    by 0x51D5A2B: r_cmd_call (cmd_api.c:226)\r\n==17167== HEAP SUMMARY:\r\n==17167==     in use at exit: 3,346,408 bytes in 39,534 blocks\r\n==17167==   total heap usage: 172,944 allocs, 133,410 frees, 237,311,662 bytes allocated\r\n==17167==\r\n==17167== LEAK SUMMARY:\r\n==17167==    definitely lost: 26,040 bytes in 310 blocks\r\n==17167==    indirectly lost: 18,510 bytes in 440 blocks\r\n==17167==      possibly lost: 0 bytes in 0 blocks\r\n==17167==    still reachable: 3,301,858 bytes in 38,784 blocks\r\n==17167==         suppressed: 0 bytes in 0 blocks\r\n==17167== Rerun with --leak-check=full to see details of leaked memory\r\n==17167==\r\n==17167== For counts of detected and suppressed errors, rerun with: -v\r\n==17167== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)\r\n```"},"comment":{"url":"https://api.github.com/repos/radare/radare2/issues/comments/304625227","html_url":"https://github.com/radare/radare2/issues/7553#issuecomment-304625227","issue_url":"https://api.github.com/repos/radare/radare2/issues/7553","id":304625227,"user":{"login":"radare","id":917142,"avatar_url":"https://avatars2.githubusercontent.com/u/917142?v=3","gravatar_id":"","url":"https://api.github.com/users/radare","html_url":"https://github.com/radare","followers_url":"https://api.github.com/users/radare/followers","following_url":"https://api.github.com/users/radare/following{/other_user}","gists_url":"https://api.github.com/users/radare/gists{/gist_id}","starred_url":"https://api.github.com/users/radare/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/radare/subscriptions","organizations_url":"https://api.github.com/users/radare/orgs","repos_url":"https://api.github.com/users/radare/repos","events_url":"https://api.github.com/users/radare/events{/privacy}","received_events_url":"https://api.github.com/users/radare/received_events","type":"User","site_admin":false},"created_at":"2017-05-29T10:08:37Z","updated_at":"2017-05-29T10:08:37Z","body":"cant reproduce, can u show a backtrace?"}}
{"actor":{"display_login":"radare"}}