## Summary: [summary of the vulnerability] A heap use after free (or assertion) can be triggered if some allocations fail I am not sure you consider allocations failures to be part of security issues, and I am not sure the issue lies in curl or in openssl, but I still think you want something to be fixed. [Statement clarifying if an AI was used to find the issue or generate the report] I did not use AI ## Affected version [Which curl/libcurl version are you using to reproduce? On which platform? `curl -V` typically generates good output to include] Using commit 48c6927f3b708fc6b6c0cd65d7971380798c8696 ## Steps To Reproduce: [add details for how we can reproduce the issue] Use https://github.com/curl/curl-fuzzer/pull/173 and see the failed runs Run `FUZZ_VERBOSE=1 /out/curl_fuzzer_http repro` with repro being `echo AJ4AAAACfkIAAQAAAAVAMT86PQ== | base64 -d > repro` I see the following stack traces ``` failed malloc(32) #0 0x561a08afee21 in __sanitizer_print_stack_trace /src/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:87:3 #1 0x561a08b33df2 in nalloc_backtrace_exclude(unsigned long, char const*) /src/curl_fuzzer/nallocinc.c:250:9 #2 0x561a08b33df2 in nalloc_fail(unsigned long, char const*) /src/curl_fuzzer/nallocinc.c:278:13 #3 0x561a08b3416e in malloc /src/curl_fuzzer/nallocinc.c:342:9 #4 0x561a090ff417 in CRYPTO_malloc /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/mem.c:211:11 #5 0x561a090ff417 in CRYPTO_zalloc /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/mem.c:231:11 #6 0x561a09192f2a in sk_reserve /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/stack/stack.c:199:25 #7 0x561a091934a8 in OPENSSL_sk_insert /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/stack/stack.c:269:10 #8 0x561a090f75da in numname_insert /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/core_namemap.c:237:10 #9 0x561a090f75da in namemap_add_name /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/core_namemap.c:267:19 #10 0x561a090f8716 in ossl_namemap_add_name /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/core_namemap.c:302:18 #11 0x561a090f8716 in get_legacy_evp_names /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/core_namemap.c:406:15 #12 0x561a090efb56 in doall_util_fn /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/lhash/lhash.c:208:17 #13 0x561a090efb56 in OPENSSL_LH_doall_arg_thunk /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/lhash/lhash.c:239:5 #14 0x561a091290b9 in lh_OBJ_NAME_doall_OBJ_DOALL /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/objects/o_names.c:289:1 #15 0x561a091290b9 in OBJ_NAME_do_all /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/objects/o_names.c:300:5 #16 0x561a090f686f in ossl_namemap_stored /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/core_namemap.c:507:9 #17 0x561a090a485a in inner_evp_generic_fetch /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/evp/evp_fetch.c:261:29 #18 0x561a090a4679 in evp_generic_fetch /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/evp/evp_fetch.c:403:14 #19 0x561a090922a2 in EVP_MD_fetch /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/evp/digest.c:1166:9 #20 0x561a090922a2 in evp_md_init_internal /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/evp/digest.c:266:26 #21 0x561a08cfa599 in my_sha256_init /src/curl/lib/sha256.c:87:7 #22 0x561a08cfa599 in Curl_sha256it /src/curl/lib/sha256.c:497:12 #23 0x561a08ccbee8 in calc_payload_hash /src/curl/lib/http_aws_sigv4.c:455:12 #24 0x561a08ccaaca in Curl_output_aws_sigv4 /src/curl/lib/http_aws_sigv4.c:795:16 #25 0x561a08c9c7ce in output_auth_headers /src/curl/lib/http.c:639:14 #26 0x561a08c9c366 in Curl_http_output_auth /src/curl/lib/http.c:819:14 #27 0x561a08c95db2 in Curl_http /src/curl/lib/http.c:2736:14 #28 0x561a08b89613 in multi_do /src/curl/lib/multi.c:1649:14 #29 0x561a08b89613 in state_do /src/curl/lib/multi.c:2042:14 #30 0x561a08b89613 in multi_runsingle /src/curl/lib/multi.c:2476:12 #31 0x561a08b867b4 in curl_multi_perform /src/curl/lib/multi.c:2739:18 #32 0x561a08b35543 in fuzz_handle_transfer(fuzz_data*) /src/curl_fuzzer/curl_fuzzer.cc:348:3 #33 0x561a08b3491d in LLVMFuzzerTestOneInput /src/curl_fuzzer/curl_fuzzer.cc:103:3 #34 0x561a089e8660 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 #35 0x561a089d38d5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 #36 0x561a089d936f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 #37 0x561a08a04612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 #38 0x7fb95db7e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) #39 0x561a089cbabd in _start (/out/curl_fuzzer_http+0x60cabd) failed malloc(14) #0 0x561a08afee21 in __sanitizer_print_stack_trace /src/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:87:3 #1 0x561a08b33df2 in nalloc_backtrace_exclude(unsigned long, char const*) /src/curl_fuzzer/nallocinc.c:250:9 #2 0x561a08b33df2 in nalloc_fail(unsigned long, char const*) /src/curl_fuzzer/nallocinc.c:278:13 #3 0x561a08b3416e in malloc /src/curl_fuzzer/nallocinc.c:342:9 #4 0x561a090ff2be in CRYPTO_malloc /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/mem.c:211:11 #5 0x561a091034f5 in CRYPTO_strdup /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/o_str.c:28:11 #6 0x561a090f75c7 in numname_insert /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/core_namemap.c:234:20 #7 0x561a090f75c7 in namemap_add_name /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/core_namemap.c:267:19 #8 0x561a090f8716 in ossl_namemap_add_name /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/core_namemap.c:302:18 #9 0x561a090f8716 in get_legacy_evp_names /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/core_namemap.c:406:15 #10 0x561a090efb56 in doall_util_fn /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/lhash/lhash.c:208:17 #11 0x561a090efb56 in OPENSSL_LH_doall_arg_thunk /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/lhash/lhash.c:239:5 #12 0x561a091290b9 in lh_OBJ_NAME_doall_OBJ_DOALL /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/objects/o_names.c:289:1 #13 0x561a091290b9 in OBJ_NAME_do_all /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/objects/o_names.c:300:5 #14 0x561a090f686f in ossl_namemap_stored /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/core_namemap.c:507:9 #15 0x561a090a485a in inner_evp_generic_fetch /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/evp/evp_fetch.c:261:29 #16 0x561a090a4679 in evp_generic_fetch /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/evp/evp_fetch.c:403:14 #17 0x561a090922a2 in EVP_MD_fetch /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/evp/digest.c:1166:9 #18 0x561a090922a2 in evp_md_init_internal /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/evp/digest.c:266:26 #19 0x561a08cfa599 in my_sha256_init /src/curl/lib/sha256.c:87:7 #20 0x561a08cfa599 in Curl_sha256it /src/curl/lib/sha256.c:497:12 #21 0x561a08ccbee8 in calc_payload_hash /src/curl/lib/http_aws_sigv4.c:455:12 #22 0x561a08ccaaca in Curl_output_aws_sigv4 /src/curl/lib/http_aws_sigv4.c:795:16 #23 0x561a08c9c7ce in output_auth_headers /src/curl/lib/http.c:639:14 #24 0x561a08c9c366 in Curl_http_output_auth /src/curl/lib/http.c:819:14 #25 0x561a08c95db2 in Curl_http /src/curl/lib/http.c:2736:14 #26 0x561a08b89613 in multi_do /src/curl/lib/multi.c:1649:14 #27 0x561a08b89613 in state_do /src/curl/lib/multi.c:2042:14 #28 0x561a08b89613 in multi_runsingle /src/curl/lib/multi.c:2476:12 #29 0x561a08b867b4 in curl_multi_perform /src/curl/lib/multi.c:2739:18 #30 0x561a08b35543 in fuzz_handle_transfer(fuzz_data*) /src/curl_fuzzer/curl_fuzzer.cc:348:3 #31 0x561a08b3491d in LLVMFuzzerTestOneInput /src/curl_fuzzer/curl_fuzzer.cc:103:3 #32 0x561a089e8660 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 #33 0x561a089d38d5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 #34 0x561a089d936f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 #35 0x561a08a04612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 #36 0x7fb95db7e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) #37 0x561a089cbabd in _start (/out/curl_fuzzer_http+0x60cabd) failed malloc(104) #0 0x561a08afee21 in __sanitizer_print_stack_trace /src/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:87:3 #1 0x561a08b33df2 in nalloc_backtrace_exclude(unsigned long, char const*) /src/curl_fuzzer/nallocinc.c:250:9 #2 0x561a08b33df2 in nalloc_fail(unsigned long, char const*) /src/curl_fuzzer/nallocinc.c:278:13 #3 0x561a08b3416e in malloc /src/curl_fuzzer/nallocinc.c:342:9 #4 0x561a090ff2be in CRYPTO_malloc /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/mem.c:211:11 #5 0x561a0943477e in alloc_new_value /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/hashtable/hashtable.c:604:11 #6 0x561a0943477e in ossl_ht_insert /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/hashtable/hashtable.c:638:14 #7 0x561a090f7812 in namemap_add_name /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/core_namemap.c:276:11 #8 0x561a090f8716 in ossl_namemap_add_name /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/core_namemap.c:302:18 #9 0x561a090f8716 in get_legacy_evp_names /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/core_namemap.c:406:15 #10 0x561a090efb56 in doall_util_fn /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/lhash/lhash.c:208:17 #11 0x561a090efb56 in OPENSSL_LH_doall_arg_thunk /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/lhash/lhash.c:239:5 #12 0x561a091290b9 in lh_OBJ_NAME_doall_OBJ_DOALL /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/objects/o_names.c:289:1 #13 0x561a091290b9 in OBJ_NAME_do_all /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/objects/o_names.c:300:5 #14 0x561a090f686f in ossl_namemap_stored /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/core_namemap.c:507:9 #15 0x561a090a485a in inner_evp_generic_fetch /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/evp/evp_fetch.c:261:29 #16 0x561a090a4679 in evp_generic_fetch /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/evp/evp_fetch.c:403:14 #17 0x561a090922a2 in EVP_MD_fetch /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/evp/digest.c:1166:9 #18 0x561a090922a2 in evp_md_init_internal /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/evp/digest.c:266:26 #19 0x561a08cfa599 in my_sha256_init /src/curl/lib/sha256.c:87:7 #20 0x561a08cfa599 in Curl_sha256it /src/curl/lib/sha256.c:497:12 #21 0x561a08ccbee8 in calc_payload_hash /src/curl/lib/http_aws_sigv4.c:455:12 #22 0x561a08ccaaca in Curl_output_aws_sigv4 /src/curl/lib/http_aws_sigv4.c:795:16 #23 0x561a08c9c7ce in output_auth_headers /src/curl/lib/http.c:639:14 #24 0x561a08c9c366 in Curl_http_output_auth /src/curl/lib/http.c:819:14 #25 0x561a08c95db2 in Curl_http /src/curl/lib/http.c:2736:14 #26 0x561a08b89613 in multi_do /src/curl/lib/multi.c:1649:14 #27 0x561a08b89613 in state_do /src/curl/lib/multi.c:2042:14 #28 0x561a08b89613 in multi_runsingle /src/curl/lib/multi.c:2476:12 #29 0x561a08b867b4 in curl_multi_perform /src/curl/lib/multi.c:2739:18 #30 0x561a08b35543 in fuzz_handle_transfer(fuzz_data*) /src/curl_fuzzer/curl_fuzzer.cc:348:3 #31 0x561a08b3491d in LLVMFuzzerTestOneInput /src/curl_fuzzer/curl_fuzzer.cc:103:3 #32 0x561a089e8660 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 #33 0x561a089d38d5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 #34 0x561a089d936f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 #35 0x561a08a04612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 #36 0x7fb95db7e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) #37 0x561a089cbabd in _start (/out/curl_fuzzer_http+0x60cabd) crypto/core_namemap.c:277: OpenSSL internal error: Assertion failed: ret != 0 ==181== ERROR: libFuzzer: deadly signal #0 0x561a08afee21 in __sanitizer_print_stack_trace /src/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:87:3 #1 0x561a08a03db8 in fuzzer::PrintStackTrace() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerUtil.cpp:210:5 #2 0x561a089e7153 in fuzzer::Fuzzer::CrashCallback() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:231:3 #3 0x7fb95def841f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1441f) (BuildId: 9753720502573b97dbac595b61fd72c2df18e078) #4 0x7fb95db9d00a in raise (/lib/x86_64-linux-gnu/libc.so.6+0x4300a) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) #5 0x7fb95db7c858 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x22858) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) #6 0x561a090f8c8e in OPENSSL_die /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/cryptlib.c:260:5 #7 0x561a090f795f in ossl_assert_int /src/curl_fuzzer/build/openssl/src/openssl_external/include/internal/common.h:47:9 #8 0x561a090f795f in namemap_add_name /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/core_namemap.c:277:10 #9 0x561a090f8716 in ossl_namemap_add_name /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/core_namemap.c:302:18 #10 0x561a090f8716 in get_legacy_evp_names /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/core_namemap.c:406:15 #11 0x561a090efb56 in doall_util_fn /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/lhash/lhash.c:208:17 #12 0x561a090efb56 in OPENSSL_LH_doall_arg_thunk /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/lhash/lhash.c:239:5 #13 0x561a091290b9 in lh_OBJ_NAME_doall_OBJ_DOALL /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/objects/o_names.c:289:1 #14 0x561a091290b9 in OBJ_NAME_do_all /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/objects/o_names.c:300:5 #15 0x561a090f686f in ossl_namemap_stored /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/core_namemap.c:507:9 #16 0x561a090a485a in inner_evp_generic_fetch /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/evp/evp_fetch.c:261:29 #17 0x561a090a4679 in evp_generic_fetch /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/evp/evp_fetch.c:403:14 #18 0x561a090922a2 in EVP_MD_fetch /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/evp/digest.c:1166:9 #19 0x561a090922a2 in evp_md_init_internal /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/evp/digest.c:266:26 #20 0x561a08cfa599 in my_sha256_init /src/curl/lib/sha256.c:87:7 #21 0x561a08cfa599 in Curl_sha256it /src/curl/lib/sha256.c:497:12 #22 0x561a08ccbee8 in calc_payload_hash /src/curl/lib/http_aws_sigv4.c:455:12 #23 0x561a08ccaaca in Curl_output_aws_sigv4 /src/curl/lib/http_aws_sigv4.c:795:16 #24 0x561a08c9c7ce in output_auth_headers /src/curl/lib/http.c:639:14 #25 0x561a08c9c366 in Curl_http_output_auth /src/curl/lib/http.c:819:14 #26 0x561a08c95db2 in Curl_http /src/curl/lib/http.c:2736:14 #27 0x561a08b89613 in multi_do /src/curl/lib/multi.c:1649:14 #28 0x561a08b89613 in state_do /src/curl/lib/multi.c:2042:14 #29 0x561a08b89613 in multi_runsingle /src/curl/lib/multi.c:2476:12 #30 0x561a08b867b4 in curl_multi_perform /src/curl/lib/multi.c:2739:18 #31 0x561a08b35543 in fuzz_handle_transfer(fuzz_data*) /src/curl_fuzzer/curl_fuzzer.cc:348:3 #32 0x561a08b3491d in LLVMFuzzerTestOneInput /src/curl_fuzzer/curl_fuzzer.cc:103:3 #33 0x561a089e8660 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 #34 0x561a089d38d5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6 #35 0x561a089d936f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9 #36 0x561a08a04612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 #37 0x7fb95db7e082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d) #38 0x561a089cbabd in _start (/out/curl_fuzzer_http+0x60cabd) ``` The CI run shows ``` ================================================================= ==23==ERROR: AddressSanitizer: heap-use-after-free on address 0x50700001f528 at pc 0x55df6b54ed4a bp 0x7ffcfa45d090 sp 0x7ffcfa45d088 READ of size 8 at 0x50700001f528 thread T0 SCARINESS: 51 (8-byte-read-heap-use-after-free) #0 0x55df6b54ed49 in EVP_DigestUpdate /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/evp/digest.c:390:15 #1 0x55df6b150692 in Curl_HMAC_init /src/curl/lib/hmac.c:92:5 #2 0x55df6b150ccb in Curl_hmacit /src/curl/lib/hmac.c:154:5 #3 0x55df6b1876a8 in Curl_output_aws_sigv4 /src/curl/lib/http_aws_sigv4.c:925:3 #4 0x55df6b1587ce in output_auth_headers /src/curl/lib/http.c:639:14 #5 0x55df6b158366 in Curl_http_output_auth /src/curl/lib/http.c:819:14 #6 0x55df6b151db2 in Curl_http /src/curl/lib/http.c:2736:14 #7 0x55df6b045613 in multi_do /src/curl/lib/multi.c:1649:14 #8 0x55df6b045613 in state_do /src/curl/lib/multi.c:2042:14 #9 0x55df6b045613 in multi_runsingle /src/curl/lib/multi.c:2476:12 #10 0x55df6b0427b4 in curl_multi_perform /src/curl/lib/multi.c:2739:18 #11 0x55df6aff1543 in fuzz_handle_transfer(fuzz_data*) /src/curl_fuzzer/curl_fuzzer.cc:348:3 #12 0x55df6aff091d in LLVMFuzzerTestOneInput /src/curl_fuzzer/curl_fuzzer.cc:103:3 #13 0x55df6aea4660 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 #14 0x55df6aea3e85 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool, bool*) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:516:7 #15 0x55df6aea5e12 in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::__Fuzzer::vector>&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:829:7 #16 0x55df6aea6102 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector>&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:867:3 #17 0x55df6ae9523b in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:914:6 #18 0x55df6aec0612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 #19 0x7f49f5d65082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 0323ab4806bee6f846d9ad4bccfc29afdca49a58) #20 0x55df6ae87abd in _start (build-out/curl_fuzzer_http+0x60cabd) DEDUP_TOKEN: EVP_DigestUpdate--Curl_HMAC_init--Curl_hmacit 0x50700001f528 is located 24 bytes inside of 72-byte region [0x50700001f510,0x50700001f558) freed by thread T0 here: #0 0x55df6afb0196 in free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3 #1 0x55df6b1b66db in my_sha256_init /src/curl/lib/sha256.c:88:5 #2 0x55df6b15055e in Curl_HMAC_init /src/curl/lib/hmac.c:86:3 #3 0x55df6b150ccb in Curl_hmacit /src/curl/lib/hmac.c:154:5 #4 0x55df6b1876a8 in Curl_output_aws_sigv4 /src/curl/lib/http_aws_sigv4.c:925:3 #5 0x55df6b1587ce in output_auth_headers /src/curl/lib/http.c:639:14 #6 0x55df6b158366 in Curl_http_output_auth /src/curl/lib/http.c:819:14 #7 0x55df6b151db2 in Curl_http /src/curl/lib/http.c:2736:14 #8 0x55df6b045613 in multi_do /src/curl/lib/multi.c:1649:14 #9 0x55df6b045613 in state_do /src/curl/lib/multi.c:2042:14 #10 0x55df6b045613 in multi_runsingle /src/curl/lib/multi.c:2476:12 #11 0x55df6b0427b4 in curl_multi_perform /src/curl/lib/multi.c:2739:18 #12 0x55df6aff1543 in fuzz_handle_transfer(fuzz_data*) /src/curl_fuzzer/curl_fuzzer.cc:348:3 #13 0x55df6aff091d in LLVMFuzzerTestOneInput /src/curl_fuzzer/curl_fuzzer.cc:103:3 #14 0x55df6aea4660 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 #15 0x55df6aea3e85 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool, bool*) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:516:7 #16 0x55df6aea5e12 in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::__Fuzzer::vector>&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:829:7 #17 0x55df6aea6102 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector>&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:867:3 #18 0x55df6ae9523b in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:914:6 #19 0x55df6aec0612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 #20 0x7f49f5d65082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 0323ab4806bee6f846d9ad4bccfc29afdca49a58) DEDUP_TOKEN: __interceptor_free--my_sha256_init--Curl_HMAC_init previously allocated by thread T0 here: #0 0x55df6afb042f in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:68:3 #1 0x55df6aff01a7 in malloc /src/curl_fuzzer/nallocinc.c:346:12 #2 0x55df6b5bb417 in CRYPTO_malloc /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/mem.c:211:11 #3 0x55df6b5bb417 in CRYPTO_zalloc /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/mem.c:231:11 #4 0x55df6b1b6669 in my_sha256_init /src/curl/lib/sha256.c:83:22 #5 0x55df6b15055e in Curl_HMAC_init /src/curl/lib/hmac.c:86:3 #6 0x55df6b150ccb in Curl_hmacit /src/curl/lib/hmac.c:154:5 #7 0x55df6b1876a8 in Curl_output_aws_sigv4 /src/curl/lib/http_aws_sigv4.c:925:3 #8 0x55df6b1587ce in output_auth_headers /src/curl/lib/http.c:639:14 #9 0x55df6b158366 in Curl_http_output_auth /src/curl/lib/http.c:819:14 #10 0x55df6b151db2 in Curl_http /src/curl/lib/http.c:2736:14 #11 0x55df6b045613 in multi_do /src/curl/lib/multi.c:1649:14 #12 0x55df6b045613 in state_do /src/curl/lib/multi.c:2042:14 #13 0x55df6b045613 in multi_runsingle /src/curl/lib/multi.c:2476:12 #14 0x55df6b0427b4 in curl_multi_perform /src/curl/lib/multi.c:2739:18 #15 0x55df6aff1543 in fuzz_handle_transfer(fuzz_data*) /src/curl_fuzzer/curl_fuzzer.cc:348:3 #16 0x55df6aff091d in LLVMFuzzerTestOneInput /src/curl_fuzzer/curl_fuzzer.cc:103:3 #17 0x55df6aea4660 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13 #18 0x55df6aea3e85 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool, bool*) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:516:7 #19 0x55df6aea5e12 in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::__Fuzzer::vector>&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:829:7 #20 0x55df6aea6102 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector>&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:867:3 #21 0x55df6ae9523b in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:914:6 #22 0x55df6aec0612 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10 #23 0x7f49f5d65082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 0323ab4806bee6f846d9ad4bccfc29afdca49a58) DEDUP_TOKEN: __interceptor_malloc--malloc--CRYPTO_malloc SUMMARY: AddressSanitizer: heap-use-after-free /src/curl_fuzzer/build/openssl/src/openssl_external/crypto/evp/digest.c:390:15 in EVP_DigestUpdate Shadow bytes around the buggy address: 0x50700001f280: fa fa fa fa fa fa fa fa fa fa fa fa fd fd fd fd 0x50700001f300: fd fd fd fd fd fd fa fa fa fa 00 00 00 00 00 00 0x50700001f380: 00 00 00 00 fa fa fa fa fd fd fd fd fd fd fd fd 0x50700001f400: fd fd fa fa fa fa fd fd fd fd fd fd fd fd fd fa 0x50700001f480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x50700001f500: fa fa fd fd fd[fd]fd fd fd fd fd fa fa fa fa fa 0x50700001f580: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fd fd 0x50700001f600: fd fd fd fd fd fd fd fa fa fa fa fa 00 00 00 00 0x50700001f680: 00 00 00 00 00 00 fa fa fa fa fd fd fd fd fd fd 0x50700001f700: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd 0x50700001f780: fd fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==23==ABORTING ``` ## Supporting Material/References: [list any additional material (e.g. screenshots, logs, etc.)] * [attachment / reference] ## Impact ## Summary:

curl: Use after free (or assert triggered) with failed allocations in openssl