n0o.com - Personal archive of discovered vulns & writeups.

sqlite3_shadow_table_fuzzer was commited


I have committed my sqlite3_shadow_table_fuzzer to Chromium base, the code can be found here: Commit: https://chromium.googlesource.com/chromium/src/third_party/sqlite/+/4bdcad26cbde7791d53cf7f15715b2805fddf889 Code: https://chromium.googlesource.com/chromium/src/third_party/sqlite/+/4bdcad26cbde7791d53cf7f15715b2805fddf889/fuzz/shadow_table_fuzzer.cc So far, a bunch of bugs or vulnerabilities were found in chromium, some of those issues IDs are 1. Issue 1028722: sqlite3_shadow_table_fuzzer: Heap-buffer-overflow in sqlite3Fts3GetVarint 2. Issue 1029002: sqlite3_shadow_table_fuzzer: ASSERT: pWriter || bIgnoreEmpty 3. Issue 1029027: sqlite3_shadow_table_fuzzer: Heap-buffer-overflow in sqlite3Fts3GetVarint 4. Issue 1029210: sqlite3_shadow_table_fuzzer: Heap-buffer-overflow in sqlite3Fts3Incrmerge 5. Issue 1029506: sqlite3_shadow_table_fuzzer: Use-of-uninitialized-value in fts3IncrmergeHintPop 6. Issue 1030709: sqlite3_shadow_table_fuzzer: Integer-overflow in fts3ChecksumIndex 7. Issue 1035663: sqlite3_shadow_table_fuzzer: Heap-buffer-overflow in fts3IncrmergeHintPop 8. Issue 1035710: sqlite3_shadow_table_fuzzer: Heap-buffer-overflow in sqlite3Fts3GetVarint32 9. Issue 1037786: sqlite3_shadow_table_fuzzer: Undefined-shift in fts3BestSnippet 10. Issue 1038213: sqlite3_shadow_table_fuzzer: Out-of-memory in sqlite3_shadow_table_fuzzer (OOM in SQLite) 11. Issue 1049131: sqlite3_shadow_table_fuzzer: Integer-overflow in fts3SegmentIsMaxLevel 12. Issue 1057441: sqlite3_shadow_table_fuzzer: Use-of-uninitialized-value in fts3ScanInteriorNode 13. Issue 1062965: sqlite3_shadow_table_fuzzer: Integer-overflow in fts3IncrmergeOutputIdx 14. Issue 1204066 in chromium: sqlite3_shadow_table_fuzzer: Integer-overflow in fts3SelectLeaf