Andrey Slepykh created DIRAPI-403:
-------------------------------------
Summary: OutOfMemory error in Asn1Decoder for LDAP messages
Key: DIRAPI-403
URL: https://issues.apache.org/jira/browse/DIRAPI-403
Project: Directory Client API
Issue Type: Bug
Affects Versions: 2.1.6
Reporter: Andrey Slepykh
Attachments: OutOfMemoryReproducer.java
Hi, we have found Out Of Memory error while fuzzing Asn1Decoder for LDAP
messages.
Steps to reproduce:
1. Download Apache Directory LDAP API v2.1.6:
{code:java}
wget wget
https://github.com/apache/directory-ldap-api/archive/refs/tags/2.1.6.tar.gz
tar xf 2.1.6.tar.gz && rm 2.1.6.tar.gz{code}
2. Compile the project (we used jdk-11 and mvn-3.9.6):
{code:java}
cd directory-ldap-api-2.1.6
mvn clean package{code}
3. Get the reproducer:
{code:java}
mkdir fuzz && cd fuzz
mv <path/to/reproducer>/OutOfMemoryReproducer.java .{code}
4. Compile the reproducer
{code:java}
javac -cp
../asn1/ber/target/classes/:../asn1/api/target/classes/:../ldap/codec/core/target/classes/:../ldap/model/target/classes/:../ldap/codec/core/target/classes/
./OutOfMemoryReproducer.java{code}
5. Reproduce the error:
{code:java}
java -Xmx2000m -cp
.:../asn1/ber/target/classes/:../asn1/api/target/classes/:../ldap/codec/core/target/classes/:../ldap/model/target/classes/:../ldap/codec/core/target/classes/:../util/target/classes/:../util/target/classes/:../integ-osgi/target/dependency/slf4j-api-1.7.36.jar:../i18n/target/classes/:../integ-osgi/target/dependency/mina-core-2.2.3.jar
OutOfMemoryReproducer{code}
We think that 2000 MB is a reasonable limit and the program should not take
more.
Found by Linux Verification Center (portal.linuxtesting.ru) with Jazzer.
Author L.Reviakin (l.revia...@fobos-nt.ru)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@directory.apache.org
For additional commands, e-mail: dev-h...@directory.apache.org
