Catenacyber iofix (tinyobjloader#304)

syoyo · catenacyber · web-flow · commit 0ed6c38f20c6 · 2021-04-08T18:57:52.000+09:00
* Prevent integer overflow in tryParseDouble

* Add regression test data to be run by fuzz target

* Add simple regression test runner.

Co-authored-by: Philippe Antoine &lt;contact@catenacyber.fr&gt;
diff --git a/fuzzer/README.md b/fuzzer/README.md
@@ -45,3 +45,7 @@ cf libfuzzer.info for all options
 ```
 $ ./fuzz_ParseFromString -rss_limit_mb=2000
 ```
+
+## Regression tests
+
+See `regression_runner/`
diff --git a/fuzzer/regression_runner/Makefile b/fuzzer/regression_runner/Makefile
@@ -0,0 +1,2 @@
+all:
+	clang++ -fsanitize=address,undefined ../../loader_example.cc
diff --git a/fuzzer/regression_runner/README.md b/fuzzer/regression_runner/README.md
@@ -0,0 +1,11 @@
+# Run fuzzer regression tests
+
+Currently we only support Linux + clang.
+
+## How to run
+
+```
+$ make
+$ ./a.out ../regressions/<regression_file>
+```
+
diff --git a/fuzzer/regressions/clusterfuzz-testcase-minimized-fuzz_ParseFromString-4877060179886080 b/fuzzer/regressions/clusterfuzz-testcase-minimized-fuzz_ParseFromString-4877060179886080
diff --git a/tiny_obj_loader.h b/tiny_obj_loader.h
@@ -941,6 +941,10 @@ static bool tryParseDouble(const char *s, const char *s_end, double *result) {
     read = 0;
     end_not_reached = (curr != s_end);
     while (end_not_reached && IS_DIGIT(*curr)) {
+      if (exponent > std::numeric_limits<int>::max()/10) {
+        // Integer overflow
+        goto fail;
+      }
       exponent *= 10;
       exponent += static_cast<int>(*curr - 0x30);
       curr++;

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+all:`
	`2`	`+ clang++ -fsanitize=address,undefined ../../loader_example.cc`