GerbilSoft/zlib-ng
1
Fork 0
mirror of https://github.com/GerbilSoft/zlib-ng.git synced 2025-06-18 11:35:35 -04:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add test for CVE-2002-0059

Browse Source 
CVE-2002-0059 was a double free in inflation. [0]

This makes sure we don't accidentally reintroduce it.

zlib-1.1.3 was download and fuzz tested using AFL[1].
This crashing case (test.gz) was discovered, and using gdb it was
confirmed to be a double free in the expected place.

The test script looks for a normal error exit (status code 1),
and fails if any other code is returned.

[0] http://www.cvedetails.com/cve/CVE-2002-0059/
[1] http://lcamtuf.coredump.cx/afl/

Signed-off-by: Daniel Axtens <dja@axtens.net>
This commit is contained in:
Daniel Axtens 2015-04-27 16:17:21 +10:00 committed by Hans Kristian Rosbach
parent d7fdc511e1
commit 821dd3d85d
3 changed files with 26 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
test/CVE-2002-0059/test.gz Normal file
View File

Binary file not shown.

5
test/Makefile.in
View File

@ -45,7 +45,10 @@ test64:
fi; \
rm -f $$TMP64
cvetests: testCVE-2003-0107
cvetests: testCVE-2003-0107 testCVEinputs
testCVEinputs:
@$(SRCDIR)/testCVEinputs.sh
testCVE-2003-0107: CVE-2003-0107$(EXE)
@if ./CVE-2003-0107$(EXE); then \

22
test/testCVEinputs.sh Executable file
View File

@ -0,0 +1,22 @@
#!/bin/bash
TESTDIR="$(dirname "$0")"
CVEs="CVE-2002-0059"
for CVE in $CVEs; do
fail=0
for testcase in ${TESTDIR}/${CVE}/*.gz; do
../minigzip -d < "$testcase"
# we expect that a 1 error code is OK
# for a vulnerable failure we'd expect 134 or similar
if [ $? -ne 1 ]; then
fail=1
fi
done
if [ $fail -eq 0 ]; then
echo " --- zlib not vulnerable to $CVE ---";
else
echo " --- zlib VULNERABLE to $CVE ---"; exit 1;
fi
done