Skip to content

pkg/aflow: codesearch-prepare action crashed due to JSON unmarshal #6680

@yulongzhang

Description

@yulongzhang

Describe the bug
I ran syz-aflow out-of-box and crashed with failed to unmarshal *codesearch.Database: invalid character 'u' after object key:value pair.

To Reproduce
I can reproduce it on recent commits, even on the current HEAD (40acda8).

The aflow config I appended to the downloaded bug json:

  "SyzkallerCommit": "40acda8acc843b8f5cc068eaad3b6b217e5a9de6",
  "ReproOpts": "",
  "FixedBaseCommit": "5260836abb7056beed3f3f0d0e4262c11f36f0d0",
  "Type": "qemu",
  "Syzkaller": ".../Workspace/syzkaller",
  "Image": ".../Workspace/syz-aflow_workdir/disk.raw",
  "CodesearchToolBin": ".../Workspace/syzkaller/bin/syz-codesearch",
  "VM": {
    "cpu": 2,
    "mem": 2048,
    "cmdline": "root=/dev/sda1"
  }

Expected behavior
It should finish the agentic flow without crashing in the middle.

Additional context
I think the culprit code is in tools/clang/codesearch/codesearch.cpp. The TraverseFunctionDecl function simply appends raw type strings without escaping: Func->getType().getAsString().

I looked at the interim JSON bytes, and indeed saw the following:

"type": "void (void  __attribute__((btf_type_tag("user")))*, const void *, unsigned long)"

The "user"'s quote was not escaped, and the character u follows immediately after the first quote, hence the JSON decoder threw the invalid character 'u'. I can send a PR to add the escaping.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugBug in the syzkaller project (e.g. a crash or misbehavior).

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions