Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bugs in 3rd-party libraries from fuzzing audit #2650

Open
AdamKorcz opened this issue Sep 23, 2024 · 0 comments
Open

Bugs in 3rd-party libraries from fuzzing audit #2650

AdamKorcz opened this issue Sep 23, 2024 · 0 comments

Comments

@AdamKorcz
Copy link
Contributor

Description

Lima recently integrated into OSS-Fuzz which resulted in uncovering a bunch of bugs in 3rd-party libraries. This is a tracker issue for these bugs. The report in this PR contains reproducers for all the bugs, so do check that out.

ID Name Fixed
ADA-LIMA-FUZZ-2024-1 Stack overflow in 3rd-party yaml parser No
ADA-LIMA-FUZZ-2024-2 Type confusion in 3rd-party yaml parser No
ADA-LIMA-FUZZ-2024-3 Memory exhaustion in 3rd-party yaml parser No
ADA-LIMA-FUZZ-2024-4 Index out of range panic in 3rd-party yaml parser No
ADA-LIMA-FUZZ-2024-5 Slice bounds out of range in 3rd-party yaml parser No
ADA-LIMA-FUZZ-2024-6 Integer underflow in 3rd-party yq library No
ADA-LIMA-FUZZ-2024-7 Index out of range in 3rd-party yq library No
ADA-LIMA-FUZZ-2024-8 Index out of range in 3rd-party yq library No
ADA-LIMA-FUZZ-2024-9 Memory exhaustion when evaluating expression No
ADA-LIMA-FUZZ-2024-10 Divide by zero panic No
ADA-LIMA-FUZZ-2024-11 Length of string controllable by user input in 3rd-party yq library No
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant