diff --git a/loader/loader.c b/loader/loader.c index 3d11c3322..821872174 100644 --- a/loader/loader.c +++ b/loader/loader.c @@ -4250,9 +4250,13 @@ VkResult get_override_layer_override_paths(struct loader_instance *inst, struct for (uint32_t j = 0; j < prop->override_paths.count; j++) { copy_data_file_info(prop->override_paths.list[j], NULL, 0, &cur_write_ptr); } + + // Subtract one from cur_write_ptr only if something was written so we can set the null terminator + if (*override_paths < cur_write_ptr) { + --cur_write_ptr; + assert(cur_write_ptr - (*override_paths) < (ptrdiff_t)override_path_size); + } // Remove the last path separator - --cur_write_ptr; - assert(cur_write_ptr - (*override_paths) < (ptrdiff_t)override_path_size); *cur_write_ptr = '\0'; loader_log(inst, VULKAN_LOADER_WARN_BIT | VULKAN_LOADER_LAYER_BIT, 0, "Override layer has override paths set to %s", *override_paths); diff --git a/tests/framework/data/fuzz_test_minimized_test_cases/clusterfuzz-testcase-minimized-instance_enumerate_fuzzer-6740380288876544 b/tests/framework/data/fuzz_test_minimized_test_cases/clusterfuzz-testcase-minimized-instance_enumerate_fuzzer-6740380288876544 new file mode 100644 index 000000000..c5a8b7b23 Binary files /dev/null and b/tests/framework/data/fuzz_test_minimized_test_cases/clusterfuzz-testcase-minimized-instance_enumerate_fuzzer-6740380288876544 differ diff --git a/tests/loader_fuzz_tests.cpp b/tests/loader_fuzz_tests.cpp index 8ac252cd2..13936d316 100644 --- a/tests/loader_fuzz_tests.cpp +++ b/tests/loader_fuzz_tests.cpp @@ -212,6 +212,10 @@ TEST(BadJsonInput, ClusterFuzzTestCase_6465902356791296) { // Causes an integer overflow - instance_enumerate_fuzzer: Integer-overflow in parse_value execute_instance_enumerate_fuzzer("clusterfuzz-testcase-minimized-instance_enumerate_fuzzer-6465902356791296"); } +TEST(BadJsonInput, ClusterFuzzTestCase_6740380288876544) { + // Does crash with ASAN + execute_instance_enumerate_fuzzer("clusterfuzz-testcase-minimized-instance_enumerate_fuzzer-6740380288876544"); +} TEST(BadJsonInput, ClusterFuzzTestCase_4512865114259456) { // Does crash with UBSAN and ASAN // malloc(): invalid size (unsorted)