Describe the bug
verifier_fuzzer.exe crash-0453e1624bfaa415598db12a53e1c3745d5e4625.o
==9992== ERROR: libFuzzer: fuzz target exited
#0 0x7ffc953bca4d (C:\artifacts\clang_rt.asan_dbg_dynamic-x86_64.dll+0x18005ca4d)
#1 0x7ff6be115caf in fuzzer::PrintStackTrace(void) D:\a_work\1\s\src\vctools\crt\asan\llvm\compiler-rt\lib\fuzzer\FuzzerUtil.cpp:210
#2 0x7ff6be12b33f in fuzzer::Fuzzer::ExitCallback(void) D:\a_work\1\s\src\vctools\crt\asan\llvm\compiler-rt\lib\fuzzer\FuzzerLoop.cpp:250
#3 0x7ffc992d2930 (C:\Windows\SYSTEM32\ucrtbased.dll+0x1800b2930)
#4 0x7ffc992d2104 (C:\Windows\SYSTEM32\ucrtbased.dll+0x1800b2104)
#5 0x7ffc992d2256 (C:\Windows\SYSTEM32\ucrtbased.dll+0x1800b2256)
#6 0x7ffc992d2b43 (C:\Windows\SYSTEM32\ucrtbased.dll+0x1800b2b43)
#7 0x7ffc992d19a4 (C:\Windows\SYSTEM32\ucrtbased.dll+0x1800b19a4)
#8 0x7ffc992d170c (C:\Windows\SYSTEM32\ucrtbased.dll+0x1800b170c)
#9 0x7ffc992d1786 (C:\Windows\SYSTEM32\ucrtbased.dll+0x1800b1786)
#10 0x7ffc992d1b4f (C:\Windows\SYSTEM32\ucrtbased.dll+0x1800b1b4f)
#11 0x7ffc992d1f05 (C:\Windows\SYSTEM32\ucrtbased.dll+0x1800b1f05)
#12 0x7ff6be241164 in crab::z_number::operator unsigned __int64(void) const D:\a\ebpf-for-windows\ebpf-for-windows\external\ebpf-verifier\src\crab_utils\bignums.hpp:45
#13 0x7ff6be233646 in crab::domains::kill_and_find_var D:\a\ebpf-for-windows\ebpf-for-windows\external\ebpf-verifier\src\crab\array_domain.cpp:455
#14 0x7ff6be2305db in crab::domains::array_domain_t::store_type(class crab::domains::SplitDBM &, class linear_expression_t const &, class linear_expression_t const &, class linear_expression_t const &) D:\a\ebpf-for-windows\ebpf-for-windows\external\ebpf-verifier\src\crab\array_domain.cpp:574
#15 0x7ff6be2309b5 in crab::domains::array_domain_t::store_type(class crab::domains::SplitDBM &, class linear_expression_t const &, class linear_expression_t const &, struct asm_syntax::Reg const &) D:\a\ebpf-for-windows\ebpf-for-windows\external\ebpf-verifier\src\crab\array_domain.cpp:593
#16 0x7ff6be26d8c9 in ebpf_domain_t::do_store_stack<int, struct asm_syntax::Reg, class crab::variable_t>(class crab::domains::SplitDBM &, int, int const &, struct asm_syntax::Reg, class crab::variable_t, class std::optional const &) D:\a\ebpf-for-windows\ebpf-for-windows\external\ebpf-verifier\src\crab\ebpf_domain.cpp:1150
#17 0x7ff6be26d422 in ebpf_domain_t::do_mem_store<struct asm_syntax::Reg, class crab::variable_t>(struct asm_syntax::Mem const &, struct asm_syntax::Reg, class crab::variable_t, class std::optional const &) D:\a\ebpf-for-windows\ebpf-for-windows\external\ebpf-verifier\src\crab\ebpf_domain.cpp:1253
#18 0x7ff6be25281b in ebpf_domain_t::operator()(struct asm_syntax::Mem const &) D:\a\ebpf-for-windows\ebpf-for-windows\external\ebpf-verifier\src\crab\ebpf_domain.cpp:1237
#19 0x7ff6be275de4 in std::invoke<class ebpf_domain_t &, struct asm_syntax::Mem const &>(class ebpf_domain_t &, struct asm_syntax::Mem const &) C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.29.30133\include\type_traits:1534
#20 0x7ff6be268a64 in std::_Variant_dispatcher<struct std::integer_sequence<unsigned __int64, 8>>::_Dispatch2<void, class ebpf_domain_t &, class std::variant<struct asm_syntax::Undefined, struct asm_syntax::Bin, struct asm_syntax::Un, struct asm_syntax::LoadMapFd, struct asm_syntax::Call, struct asm_syntax::Exit, struct asm_syntax::Jmp, struct asm_syntax::Mem, struct asm_syntax::Packet, struct asm_syntax::LockAdd, struct asm_syntax::Assume, struct asm_syntax::Assert> const &, 0>(class ebpf_domain_t &, class std::variant<struct asm_syntax::Undefined, struct asm_syntax::Bin, struct asm_syntax::Un, struct asm_syntax::LoadMapFd, struct asm_syntax::Call, struct asm_syntax::Exit, struct asm_syntax::Jmp, struct asm_syntax::Mem, struct asm_syntax::Packet, struct asm_syntax::LockAdd, struct asm_syntax::Assume, struct asm_syntax::Assert> const &) C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.29.30133\include\variant:1499
#21 0x7ff6be26b378 in std::_Visit_strategy<2>::_Visit2<void, struct std::_Meta_list<struct std::integer_sequence<unsigned __int64, 0>, struct std::integer_sequence<unsigned __int64, 1>, struct std::integer_sequence<unsigned __int64, 2>, struct std::integer_sequence<unsigned __int64, 3>, struct std::integer_sequence<unsigned __int64, 4>, struct std::integer_sequence<unsigned __int64, 5>, struct std::integer_sequence<unsigned __int64, 6>, struct std::integer_sequence<unsigned __int64, 7>, struct std::integer_sequence<unsigned __int64, 8>, struct std::integer_sequence<unsigned __int64, 9>, struct std::integer_sequence<unsigned __int64, 10>, struct std::integer_sequence<unsigned __int64, 11>, struct std::integer_sequence<unsigned __int64, 12>>, class ebpf_domain_t &, class std::variant<struct asm_syntax::Undefined, struct asm_syntax::Bin, struct asm_syntax::Un, struct asm_syntax::LoadMapFd, struct asm_syntax::Call, struct asm_syntax::Exit, struct asm_syntax::Jmp, struct asm_syntax::Mem, struct asm_syntax::Packet, struct asm_syntax::LockAdd, struct asm_syntax::Assume, struct asm_syntax::Assert> const &>(unsigned __int64, class ebpf_domain_t &, class std::variant<struct asm_syntax::Undefined, struct asm_syntax::Bin, struct asm_syntax::Un, struct asm_syntax::LoadMapFd, struct asm_syntax::Call, struct asm_syntax::Exit, struct asm_syntax::Jmp, struct asm_syntax::Mem, struct asm_syntax::Packet, struct asm_syntax::LockAdd, struct asm_syntax::Assume, struct asm_syntax::Assert> const &) C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.29.30133\include\variant:1614
#22 0x7ff6be26b61b in std::_Visit_impl<13, void, struct std::_Meta_list<struct std::integer_sequence<unsigned __int64, 0>, struct std::integer_sequence<unsigned __int64, 1>, struct std::integer_sequence<unsigned __int64, 2>, struct std::integer_sequence<unsigned __int64, 3>, struct std::integer_sequence<unsigned __int64, 4>, struct std::integer_sequence<unsigned __int64, 5>, struct std::integer_sequence<unsigned __int64, 6>, struct std::integer_sequence<unsigned __int64, 7>, struct std::integer_sequence<unsigned __int64, 8>, struct std::integer_sequence<unsigned __int64, 9>, struct std::integer_sequence<unsigned __int64, 10>, struct std::integer_sequence<unsigned __int64, 11>, struct std::integer_sequence<unsigned __int64, 12>>, class ebpf_domain_t &, class std::variant<struct asm_syntax::Undefined, struct asm_syntax::Bin, struct asm_syntax::Un, struct asm_syntax::LoadMapFd, struct asm_syntax::Call, struct asm_syntax::Exit, struct asm_syntax::Jmp, struct asm_syntax::Mem, struct asm_syntax::Packet, struct asm_syntax::LockAdd, struct asm_syntax::Assume, struct asm_syntax::Assert> const &>(class ebpf_domain_t &, class std::variant<struct asm_syntax::Undefined, struct asm_syntax::Bin, struct asm_syntax::Un, struct asm_syntax::LoadMapFd, struct asm_syntax::Call, struct asm_syntax::Exit, struct asm_syntax::Jmp, struct asm_syntax::Mem, struct asm_syntax::Packet, struct asm_syntax::LockAdd, struct asm_syntax::Assume, struct asm_syntax::Assert> const &) C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.29.30133\include\variant:1659
#23 0x7ff6be277b3d in std::visit<class ebpf_domain_t &, class std::variant<struct asm_syntax::Undefined, struct asm_syntax::Bin, struct asm_syntax::Un, struct asm_syntax::LoadMapFd, struct asm_syntax::Call, struct asm_syntax::Exit, struct asm_syntax::Jmp, struct asm_syntax::Mem, struct asm_syntax::Packet, struct asm_syntax::LockAdd, struct asm_syntax::Assume, struct asm_syntax::Assert> const &, void>(class ebpf_domain_t &, class std::variant<struct asm_syntax::Undefined, struct asm_syntax::Bin, struct asm_syntax::Un, struct asm_syntax::LoadMapFd, struct asm_syntax::Call, struct asm_syntax::Exit, struct asm_syntax::Jmp, struct asm_syntax::Mem, struct asm_syntax::Packet, struct asm_syntax::LockAdd, struct asm_syntax::Assume, struct asm_syntax::Assert> const &) C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.29.30133\include\variant:1677
#24 0x7ff6be24fd19 in ebpf_domain_t::operator()(class crab::basic_block_t const &, bool) D:\a\ebpf-for-windows\ebpf-for-windows\external\ebpf-verifier\src\crab\ebpf_domain.cpp:594
#25 0x7ff6be28d907 in crab::interleaved_fwd_fixpoint_iterator_t::transform_to_post(struct crab::label_t const &, class ebpf_domain_t) D:\a\ebpf-for-windows\ebpf-for-windows\external\ebpf-verifier\src\crab\fwd_analyzer.cpp:73
#26 0x7ff6be281007 in crab::interleaved_fwd_fixpoint_iterator_t::operator()(struct crab::label_t const &) D:\a\ebpf-for-windows\ebpf-for-windows\external\ebpf-verifier\src\crab\fwd_analyzer.cpp:147
#27 0x7ff6be285c14 in std::invoke<class crab::interleaved_fwd_fixpoint_iterator_t &, struct crab::label_t &>(class crab::interleaved_fwd_fixpoint_iterator_t &, struct crab::label_t &) C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.29.30133\include\type_traits:1534
#28 0x7ff6be283204 in std::_Variant_dispatcher<struct std::integer_sequence<unsigned __int64, 2>>::_Dispatch2<void, class crab::interleaved_fwd_fixpoint_iterator_t &, class std::variant<class std::shared_ptr, struct crab::label_t> &, 0>(class crab::interleaved_fwd_fixpoint_iterator_t &, class std::variant<class std::shared_ptr, struct crab::label_t> &) C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.29.30133\include\variant:1499
#29 0x7ff6be28494c in std::_Visit_strategy<1>::_Visit2<void, struct std::_Meta_list<struct std::integer_sequence<unsigned __int64, 0>, struct std::integer_sequence<unsigned __int64, 1>, struct std::integer_sequence<unsigned __int64, 2>>, class crab::interleaved_fwd_fixpoint_iterator_t &, class std::variant<class std::shared_ptr, struct crab::label_t> &>(unsigned __int64, class crab::interleaved_fwd_fixpoint_iterator_t &, class std::variant<class std::shared_ptr, struct crab::label_t> &) C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.29.30133\include\variant:1605
#30 0x7ff6be284a7b in std::_Visit_impl<3, void, struct std::_Meta_list<struct std::integer_sequence<unsigned __int64, 0>, struct std::integer_sequence<unsigned __int64, 1>, struct std::integer_sequence<unsigned __int64, 2>>, class crab::interleaved_fwd_fixpoint_iterator_t &, class std::variant<class std::shared_ptr, struct crab::label_t> &>(class crab::interleaved_fwd_fixpoint_iterator_t &, class std::variant<class std::shared_ptr, struct crab::label_t> &) C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.29.30133\include\variant:1659
#31 0x7ff6be285dcd in std::visit<class crab::interleaved_fwd_fixpoint_iterator_t &, class std::variant<class std::shared_ptr, struct crab::label_t> &, void>(class crab::interleaved_fwd_fixpoint_iterator_t &, class std::variant<class std::shared_ptr, struct crab::label_t> &) C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\MSVC\14.29.30133\include\variant:1677
#32 0x7ff6be280c18 in crab::run_forward_analyzer(class crab::cfg_t &, class ebpf_domain_t const &, bool) D:\a\ebpf-for-windows\ebpf-for-windows\external\ebpf-verifier\src\crab\fwd_analyzer.cpp:130
#33 0x7ff6be1920aa in get_ebpf_report(class std::basic_ostream<char, struct std::char_traits> &, class crab::cfg_t &, struct program_info, struct ebpf_verifier_options_t const *) D:\a\ebpf-for-windows\ebpf-for-windows\external\ebpf-verifier\src\crab_verifier.cpp:158
#34 0x7ff6be190b6a in ebpf_verify_program(class std::basic_ostream<char, struct std::char_traits> &, class std::vector<class std::tuple<struct crab::label_t, class std::variant<struct asm_syntax::Undefined, struct asm_syntax::Bin, struct asm_syntax::Un, struct asm_syntax::LoadMapFd, struct asm_syntax::Call, struct asm_syntax::Exit, struct asm_syntax::Jmp, struct asm_syntax::Mem, struct asm_syntax::Packet, struct asm_syntax::LockAdd, struct asm_syntax::Assume, struct asm_syntax::Assert>, class std::optional>, class std::allocator<class std::tuple<struct crab::label_t, class std::variant<struct asm_syntax::Undefined, struct asm_syntax::Bin, struct asm_syntax::Un, struct asm_syntax::LoadMapFd, struct asm_syntax::Call, struct asm_syntax::Exit, struct asm_syntax::Jmp, struct asm_syntax::Mem, struct asm_syntax::Packet, struct asm_syntax::LockAdd, struct asm_syntax::Assume, struct asm_syntax::Assert>, class std::optional>>> const &, struct program_info const &, struct ebpf_verifier_options_t const *, struct ebpf_verifier_stats_t *) D:\a\ebpf-for-windows\ebpf-for-windows\external\ebpf-verifier\src\crab_verifier.cpp:230
#35 0x7ff6bdf3b5cb in _ebpf_api_elf_verify_section_from_stream D:\a\ebpf-for-windows\ebpf-for-windows\libs\api\Verifier.cpp:504
#36 0x7ff6bdf655f5 in ebpf_api_elf_verify_section_from_memory D:\a\ebpf-for-windows\ebpf-for-windows\libs\api\Verifier.cpp:553
#37 0x7ff6bdefefbb in LLVMFuzzerTestOneInput D:\a\ebpf-for-windows\ebpf-for-windows\tests\libfuzzer\verifier\libfuzz_harness.cpp:16
#38 0x7ff6be12b1cf in fuzzer::Fuzzer::ExecuteCallback(unsigned char const *, unsigned __int64) D:\a_work\1\s\src\vctools\crt\asan\llvm\compiler-rt\lib\fuzzer\FuzzerLoop.cpp:559
#39 0x7ff6be1035cd in fuzzer::RunOneTest(class fuzzer::Fuzzer *, char const *, unsigned __int64) D:\a_work\1\s\src\vctools\crt\asan\llvm\compiler-rt\lib\fuzzer\FuzzerDriver.cpp:301
#40 0x7ff6be0fe6b6 in fuzzer::FuzzerDriver(int *, char ***, int (__cdecl *)(unsigned char const *, unsigned __int64)) D:\a_work\1\s\src\vctools\crt\asan\llvm\compiler-rt\lib\fuzzer\FuzzerDriver.cpp:803
#41 0x7ff6be0f3cb2 in main D:\a_work\1\s\src\vctools\crt\asan\llvm\compiler-rt\lib\fuzzer\FuzzerMain.cpp:20
#42 0x7ff6be0ef968 in invoke_main D:\a_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
#43 0x7ff6be0ef8bd in __scrt_common_main_seh D:\a_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
#44 0x7ff6be0ef77d in __scrt_common_main D:\a_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:330
#45 0x7ff6be0ef9dd in mainCRTStartup D:\a_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_main.cpp:16
#46 0x7ffcca227033 (C:\Windows\System32\KERNEL32.DLL+0x180017033)
#47 0x7ffccc022650 (C:\Windows\SYSTEM32\ntdll.dll+0x180052650)
SUMMARY: libFuzzer: fuzz target exited
crash-0453e1624bfaa415598db12a53e1c3745d5e4625.o.zip
OS information
No response
Steps taken to reproduce bug
verifier_fuzzer.exe crash-0453e1624bfaa415598db12a53e1c3745d5e4625.o
Expected behavior
Fails verification
Actual outcome
Crashes
Additional details
No response
bug triaged