aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAlexander Kuznetsov <kuznetsovam@altlinux.org>2024-10-01 14:00:50 +0200
committerSamuel Thibault <samuel.thibault@ens-lyon.org>2024-10-01 14:02:24 +0200
commit8e9e1172d0d6a0d6f54bd67c11f7115277294bbc (patch)
tree865cf563624ad0bc49e9eee73a8e69a29b2f4ace
parent72f85005a2307fd0961543e3cea861ad7a4d201e (diff)
downloadslirp-8e9e1172d0d6a0d6f54bd67c11f7115277294bbc.zip
slirp-8e9e1172d0d6a0d6f54bd67c11f7115277294bbc.tar.gz
slirp-8e9e1172d0d6a0d6f54bd67c11f7115277294bbc.tar.bz2
fuzz: Fix memory leak inside fuzz-main
Found by ALT Linux Team. Signed-off-by: Alexander Kuznetsov <kuznetsovam@altlinux.org> Fixes #80
-rw-r--r--fuzzing/README.md2
-rw-r--r--fuzzing/fuzz-main.c1
2 files changed, 2 insertions, 1 deletions
diff --git a/fuzzing/README.md b/fuzzing/README.md
index a028a98..61a6696 100644
--- a/fuzzing/README.md
+++ b/fuzzing/README.md
@@ -3,7 +3,7 @@
## Current state
We chose to use libFuzzer because of its custom mutator feature, which allows to keep coherent informations inside the packets being sent to libslirp. This ease the process of fuzzing as packets are less likely to be rejected early during processing them.
-In the current state, the `meson.build` file is not compatible with the original one used by libSlirp main repository but it should be easy to merge them in a clean way. Also **in the current state, it seems that there is a memory leak inside the fuzzing code**, which make it run out of memory. The current goal is to find and get rid of this leak to allow fuzzing for longer without the process being interrupted because of it.
+In the current state, the `meson.build` file is not compatible with the original one used by libSlirp main repository but it should be easy to merge them in a clean way.
Six harness are currently available, more are to be added later to focus on other parts of the code :
diff --git a/fuzzing/fuzz-main.c b/fuzzing/fuzz-main.c
index 1de031c..90c9f64 100644
--- a/fuzzing/fuzz-main.c
+++ b/fuzzing/fuzz-main.c
@@ -25,6 +25,7 @@ int main(int argc, char **argv)
g_print("%s...\n", name);
for (j = 0; j < MIN_NUMBER_OF_RUNS; j++) {
if (LLVMFuzzerTestOneInput((void *)buf, size) == EXIT_TEST_SKIP) {
+ g_free(buf);
return EXIT_TEST_SKIP;
}
}