Crash found by American Fuzzy Lop fuzzer
- From: Alexander Nasonov <alnsn@xxxxxxxxx>
- To: luajit@xxxxxxxxxxxxx
- Date: Sat, 21 Feb 2015 10:07:53 +0000
Hi Mike,
The program below crashes LuaJIT 2.0 and 2.1 on my haswell
notebook running NetBSD-current when jit is on.
I found it with the American Fuzzy Lop fuzzer while playing with
pflua module https://github.com/Igalia/pflua.
local ffi = require "ffi"
local function compiled_prog(P, length)
local A = 0
local X = 0
local T = 0
A = 0
A = 3180253
X = bit.tobit(length)
X = bit.tobit(length)
A = 0
A = 814144773
A = 2576980121
X = bit.tobit(length)
X = bit.tobit(length)
T = bit.tobit((X+2147483647))
if T < 0 or T + 4 > length then return 0 end
--print(T,T+4)
A = bit.bor(bit.lshift(P[T], 24),bit.lshift(P[T+1], 16), bit.lshift(P[T+2],
8), P[T+3])
error("end of bpf")
end
local packet = "123"
local bytes = ffi.new("uint8_t[?]", #packet + 2, packet)
for i = 0, 1023 do
bytes[0] = bit.band(i, 255)
bytes[1] = bit.rshift(i, 8)
compiled_prog(bytes, #packet)
end
Alex
Other related posts:
