basic/ellipsize: do not assume the string is NUL-terminated when length is given
authorZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Sat, 9 Jun 2018 11:41:44 +0000 (13:41 +0200)
committerZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Mon, 11 Jun 2018 08:04:10 +0000 (10:04 +0200)
commit21e4e3e06fb06dafda5a0d084824df79f07aeb46
treea690e6b3cd88ade5eaa1ab7ea604f46bf671a291
parent4215ed6dbdd701280bd3726ce1087d5319a47aa0
basic/ellipsize: do not assume the string is NUL-terminated when length is given

oss-fuzz flags this as:

==1==WARNING: MemorySanitizer: use-of-uninitialized-value

0. 0x7fce77519ca5 in ascii_is_valid systemd/src/basic/utf8.c:252:9
1. 0x7fce774d203c in ellipsize_mem systemd/src/basic/string-util.c:544:13
2. 0x7fce7730a299 in print_multiline systemd/src/shared/logs-show.c:244:37
3. 0x7fce772ffdf3 in output_short systemd/src/shared/logs-show.c:495:25
4. 0x7fce772f5a27 in show_journal_entry systemd/src/shared/logs-show.c:1077:15
5. 0x7fce772f66ad in show_journal systemd/src/shared/logs-show.c:1164:29
6. 0x4a2fa0 in LLVMFuzzerTestOneInput systemd/src/fuzz/fuzz-journal-remote.c:64:21
...

I didn't reproduce the issue, but this looks like an obvious error: the length
is specified, so we shouldn't use the string with any functions for normal
C-strings.
src/basic/format-table.c
src/basic/string-util.c
test/fuzz-regressions/fuzz-journal-remote/oss-fuzz-8659 [new file with mode: 0644]
test/fuzz-regressions/meson.build