forked from OSchip/llvm-project
29 lines
1.0 KiB
C++
29 lines
1.0 KiB
C++
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
|
|
// See https://llvm.org/LICENSE.txt for license information.
|
|
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
|
|
// Triggers the bug described here:
|
|
// https://github.com/google/oss-fuzz/issues/2369#issuecomment-490240627
|
|
//
|
|
// In a nutshell, MSan's parameter shadow does not get unpoisoned before calls
|
|
// to LLVMFuzzerTestOneInput. This test case causes the parameter shadow to be
|
|
// poisoned by the call to foo(), which will trigger an MSan false positive on
|
|
// the Size == 0 check if the parameter shadow is still poisoned.
|
|
#include <cstdint>
|
|
#include <cstdio>
|
|
#include <cstdlib>
|
|
#include <cstring>
|
|
|
|
volatile int zero = 0;
|
|
__attribute__((noinline)) int foo(int arg1, int arg2) { return zero; }
|
|
|
|
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
|
|
if (Size == 0)
|
|
return 0;
|
|
|
|
// Pass uninitialized values to foo(). Since foo doesn't do anything with
|
|
// them, MSan should not report an error here.
|
|
int a, b;
|
|
return foo(a, b);
|
|
}
|