-
Notifications
You must be signed in to change notification settings - Fork 1.4k
Description
Describe the bug
I ran syz-aflow out-of-box and crashed with failed to unmarshal *codesearch.Database: invalid character 'u' after object key:value pair.
To Reproduce
I can reproduce it on recent commits, even on the current HEAD (40acda8).
The aflow config I appended to the downloaded bug json:
"SyzkallerCommit": "40acda8acc843b8f5cc068eaad3b6b217e5a9de6",
"ReproOpts": "",
"FixedBaseCommit": "5260836abb7056beed3f3f0d0e4262c11f36f0d0",
"Type": "qemu",
"Syzkaller": ".../Workspace/syzkaller",
"Image": ".../Workspace/syz-aflow_workdir/disk.raw",
"CodesearchToolBin": ".../Workspace/syzkaller/bin/syz-codesearch",
"VM": {
"cpu": 2,
"mem": 2048,
"cmdline": "root=/dev/sda1"
}
Expected behavior
It should finish the agentic flow without crashing in the middle.
Additional context
I think the culprit code is in tools/clang/codesearch/codesearch.cpp. The TraverseFunctionDecl function simply appends raw type strings without escaping: Func->getType().getAsString().
I looked at the interim JSON bytes, and indeed saw the following:
"type": "void (void __attribute__((btf_type_tag("user")))*, const void *, unsigned long)"
The "user"'s quote was not escaped, and the character u follows immediately after the first quote, hence the JSON decoder threw the invalid character 'u'. I can send a PR to add the escaping.