Add new fuzz.bin2 program and fix integer overflow for XTAC ##bin

libr/bin/p/bin_xtac.c

@@ -392,6 +392,9 @@ static bool r_bin_xtac_read_xtac_linked_list(RBinXtacObj *bin) {
 	}
 	RBinXtacLinkedListEntry *entry = NULL;
 	ut32 p_xtac_linked_list_entry = bin->header->ptr_to_xtac_linked_list_head;
+	if (p_xtac_linked_list_entry > bin->size) {
+		return false;
+	}
 	do {
 		ut32 p_buffer = p_xtac_linked_list_entry;
 
@@ -426,7 +429,7 @@ static bool r_bin_xtac_read_xtac_linked_list(RBinXtacObj *bin) {
 
 		r_list_append (bin->xtac_linked_list, entry);
 		int a = entry->meta_and_offset;
-		if (a < 1) {
+		if (a < 1 || a > 0xfff) {
 			break;
 		}
 		p_xtac_linked_list_entry += (a * 4);

test/fuzz/fuzz_bin2.c

@@ -0,0 +1,68 @@
+#include <r_core.h>
+#include <r_getopt.h>
+
+static const char *opt_forcebin = NULL;
+
+static void usage() {
+	printf (
+	"Usage: fuzz_bin <libFuzzer flags> <corpora> -- <flags>\n"
+	"\n"
+	"libFuzzer flags: show with -help=1\n"
+	"\n"
+	"Target Flags\n"
+	" -F [binfmt]     force to use that bin plugin (ignore header check)\n"
+	);
+	exit (1);
+}
+
+int LLVMFuzzerInitialize(int *lf_argc, char ***lf_argv) {
+	r_sys_clearenv ();
+	r_sandbox_enable (true);
+	r_sandbox_grain (R_SANDBOX_GRAIN_NONE);
+	r_log_set_quiet (true);
+
+	int argc = *lf_argc;
+	const char **argv = (const char **)(*lf_argv);
+	bool has_args = false;
+	int i, c;
+	for (i = 1; i < argc; i++) {
+		argv++;
+		if (!strcmp ((*lf_argv)[i], "--")) {
+			has_args = true;
+			break;
+		}
+	}
+
+	if (has_args) {
+		*lf_argc = i;
+		argc -= i;
+
+		RGetopt opt;
+		r_getopt_init (&opt, argc, argv, "F:");
+		while ((c = r_getopt_next (&opt)) != -1) {
+			switch (c) {
+			case 'F':
+				opt_forcebin = opt.arg;
+				break;
+			default:
+				usage();
+				break;
+			}
+		}
+
+		if (opt.ind < argc) {
+			usage();
+		}
+	}
+
+	return 0;
+}
+
+int LLVMFuzzerTestOneInput(const ut8 *data, size_t len) {
+	RCore *core = r_core_new ();
+	r_core_cmdf (core, "o malloc://%"PFMT64d, (ut64)len);
+	r_io_write_at (core->io, 0, data, len);
+	r_core_cmd0 (core, "oob");
+	r_core_free (core);
+	return 0;
+}

test/fuzz/meson.build

@@ -1,6 +1,7 @@
 if get_option('enable_libfuzzer')
   targets = [
     'bin',
+    'bin2',
     'dwarf',
     'bin_demangle',
     'ia',