diff --git a/testing/multi_sanitizer_fuzz_target.cc b/testing/multi_sanitizer_fuzz_target.cc index 10b40b2..4838e32 100644 --- a/testing/multi_sanitizer_fuzz_target.cc +++ b/testing/multi_sanitizer_fuzz_target.cc @@ -20,6 +20,7 @@ #include // NOLINT [[maybe_unused]] static volatile void *sink; +[[maybe_unused]] static volatile int int_sink; extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { if (size != 3) return 0; // Make bugs easy to discover. @@ -45,5 +46,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ++racy_var; t.join(); } + // mcm => buffer overflow inside memcmp + if (data[0] == 'm' && data[1] == 'c' && data[2] == 'm') { + int_sink = memcmp(data, "mcm123", 6); + } return 0; }