Fuzzing Environment and Configuration
OS: Ubuntu Linux 22.04 LTS
minutor: v 26.1
AFL++ (American Fuzzy Lop Plus Plus) Standard Fuzzing (explore mode)
Ran fuzzer for about 24 hours to get the following results
Problem 1
Unhandled exception handling on corrupted files. The NBT parser relies heavily on throwing string literals (char const*) when it encounters malformed data, truncated files, or unknown tags. Because these are not caught by the main application logic, feeding Minutor a slightly corrupted file causes the entire application to crash. All the char const* crashes from our output that point to NBT::decode_nbt, NBT::unpack_zlib, and Tag_Compound::Tag_Compound.
Solution
To fix this, these should return false and provide some sort of error message rather than completely crashing the program.
Problem 2
Infinite recursion: The Root Cause: NBT allows for nested data structures (Lists inside of Lists, Compounds inside of Compounds). The current parser blindly follows this nesting. A maliciously crafted file with thousands of nested Tag_List objects will force the program to recursively call setListData until it blows past the operating system's stack size limit, resulting in a crash.
Solution
To fix this, Minutor would need to add some sort of limit check.
Fuzzing Output
crash_triage_report.txt
Fuzzing Environment and Configuration
OS: Ubuntu Linux 22.04 LTS
minutor: v 26.1
AFL++ (American Fuzzy Lop Plus Plus) Standard Fuzzing (explore mode)
Ran fuzzer for about 24 hours to get the following results
Problem 1
Unhandled exception handling on corrupted files. The NBT parser relies heavily on throwing string literals (char const*) when it encounters malformed data, truncated files, or unknown tags. Because these are not caught by the main application logic, feeding Minutor a slightly corrupted file causes the entire application to crash. All the char const* crashes from our output that point to NBT::decode_nbt, NBT::unpack_zlib, and Tag_Compound::Tag_Compound.
Solution
To fix this, these should return false and provide some sort of error message rather than completely crashing the program.
Problem 2
Infinite recursion: The Root Cause: NBT allows for nested data structures (Lists inside of Lists, Compounds inside of Compounds). The current parser blindly follows this nesting. A maliciously crafted file with thousands of nested Tag_List objects will force the program to recursively call setListData until it blows past the operating system's stack size limit, resulting in a crash.
Solution
To fix this, Minutor would need to add some sort of limit check.
Fuzzing Output
crash_triage_report.txt