Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Panic during Regexp.MatchString fuzzing #41073

Closed
Zenithar opened this issue Aug 27, 2020 · 1 comment
Closed

Panic during Regexp.MatchString fuzzing #41073

Zenithar opened this issue Aug 27, 2020 · 1 comment
Labels
FrozenDueToAge

Comments

@Zenithar
Copy link

Zenithar commented Aug 27, 2020 •
edited

Context

I was doing some fuzz testing on my object parsers, and I discovered this bug.

My environment :

GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/zenithar/Library/Caches/go-build"
GOENV="/Users/zenithar/Library/Application Support/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GOMODCACHE="/Users/zenithar/go/1.15.0/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/zenithar/go/1.15.0"
GOPRIVATE=""
GOPROXY="direct"
GOROOT="/Users/zenithar/.goenv/versions/1.15.0"
GOSUMDB="off"
GOTMPDIR=""
GOTOOLDIR="/Users/zenithar/.goenv/versions/1.15.0/pkg/tool/darwin_amd64"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/vg/_ywxksk16ys745ct1zt0y0w40000gn/T/go-build059686385=/tmp/go-build -gno-record-gcc-switches -fno-common"

Steps to reproduce

Create a file with this content

package main

import "regexp"

func main() {
	re := &regexp.Regexp{}
	re.MatchString("")
}

I understand that a Regexp struct should not be built directly but that's what the fuzzer do and found this ^^

When executing go run bug.go :

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0x106fb59]

goroutine 1 [running]:
regexp.(*machine).match(0xc000114000, 0x10a6c80, 0xc0001140c0, 0x0, 0x10000010f0238)
	/Users/zenithar/.goenv/versions/1.15.0/src/regexp/exec.go:222 +0x319
regexp.(*Regexp).doExecute(0xc000110000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
	/Users/zenithar/.goenv/versions/1.15.0/src/regexp/exec.go:542 +0x17d
regexp.(*Regexp).doMatch(...)
	/Users/zenithar/.goenv/versions/1.15.0/src/regexp/exec.go:514
regexp.(*Regexp).MatchString(...)
	/Users/zenithar/.goenv/versions/1.15.0/src/regexp/regexp.go:525
main.main()
	/Users/zenithar/gobug/bug.go:7 +0x78
exit status 2

After investigation, it looks like m.p.Start has a nil p property. (src/regexp/exec.go - https://github.com/golang/go/blob/master/src/regexp/exec.go#L222)

Capture d’écran 2020-08-27 à 14 30 30
@FiloSottile
Copy link
Contributor

As you mention, the zero value of regexp.Regexp is not usable, so that code is not supposed to work and a panic is to be expected.

@golang golang locked and limited conversation to collaborators Aug 27, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@Zenithar @FiloSottile @gopherbot