2025246 - Missing case in ssl_SetAuthKeyBits triggers internal_error_alert

Status: NEW

(NSS :: Libraries, defect, P3)

Description

[Dennis Jackson]

https://oss-fuzz.com/testcase-detail/6392973232504832

==1141==ERROR: AddressSanitizer: ABRT on unknown address 0x053900000475 (pc 0x7c0af2ce900b bp 0x7ffead0ac5e0 sp 0x7ffead0ac360 T0)
	    #0 0x7c0af2ce900b in raise /build/glibc-LcI20x/glibc-2.31/sysdeps/unix/sysv/linux/raise.c:51:1
	    #1 0x7c0af2cc8858 in abort /build/glibc-LcI20x/glibc-2.31/stdlib/abort.c:79:7
	    #2 0x5918a45cfffb in PR_Assert nspr/pr/src/io/prlog.c:556:3
	    #3 0x5918a46fc905 in tls13_FatalError nss/lib/ssl/tls13con.c:139:5
	    #4 0x5918a47843d6 in ssl_SetAuthKeyBits nss/lib/ssl/ssl3con.c:0
	    #5 0x5918a47846c7 in ssl3_HandleServerSpki nss/lib/ssl/ssl3con.c:11905:20
	    #6 0x5918a47835e9 in ssl3_AuthCertificate nss/lib/ssl/ssl3con.c:11932:14
	    #7 0x5918a4783289 in ssl3_CompleteHandleCertificate nss/lib/ssl/ssl3con.c:11767:14
	    #8 0x5918a478b257 in ssl3_HandleCertificate nss/lib/ssl/ssl3con.c:11635:12
	    #9 0x5918a478b257 in ssl3_HandlePostHelloHandshakeMessage nss/lib/ssl/ssl3con.c:12971:18
	    #10 0x5918a478b257 in ssl3_HandleHandshakeMessage nss/lib/ssl/ssl3con.c:12911:22
	    #11 0x5918a4750b22 in dtls_HandleHandshakeMessage nss/lib/ssl/dtlscon.c:252:12
	    #12 0x5918a4750b22 in dtls_HandleHandshake nss/lib/ssl/dtlscon.c:364:18
	    #13 0x5918a47926f1 in ssl3_HandleNonApplicationData nss/lib/ssl/ssl3con.c:13625:22
	    #14 0x5918a47963e6 in ssl3_HandleRecord nss/lib/ssl/ssl3con.c:13987:10
	    #15 0x5918a47bc8fe in ssl3_GatherCompleteHandshake nss/lib/ssl/ssl3gthr.c:560:18
	    #16 0x5918a47c32f5 in ssl_GatherRecord1stHandshake nss/lib/ssl/sslcon.c:73:10
	    #17 0x5918a46d4544 in ssl_Do1stHandshake nss/lib/ssl/sslsecur.c:43:14
	    #18 0x5918a46d65d4 in SSL_ForceHandshake nss/lib/ssl/sslsecur.c:431:14
	    #19 0x5918a46c3fa7 in TlsCommon::DoHandshake(PRFileDesc*, bool) nss/fuzz/targets/lib/tls/common.cc:57:10
	    #20 0x5918a46bff5f in LLVMFuzzerTestOneInput nss/fuzz/targets/tls_client.cc:58:3
	    #21 0x5918a4e093bd in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13
	    #22 0x5918a4df4132 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6
	    #23 0x5918a4dfa000 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9
	    #24 0x5918a4e25b32 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
	    #25 0x7c0af2cca082 in __libc_start_main /build/glibc-LcI20x/glibc-2.31/csu/libc-start.c:308:16
	    #26 0x5918a45d87cd in _start

The fuzzer has found its way to a switch statement that doesn't cover the new case of mldsa.

Comment 1

[Dennis Jackson]

Attachment: clusterfuzz-testcase-minimized-dtls-client-6392973232504832