Repository: matio/matio
Fuzzing engine: libfuzzer
Fuzz target: matio_fuzzer
Sanitizer: memory
Crash type: Use-of-uninitialized-value

Sanitizer report:
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 4152084099
INFO: Loaded 1 modules   (3754 inline 8-bit counters): 3754 [0x55bc3fd40d28, 0x55bc3fd41bd2), 
INFO: Loaded 1 PC tables (3754 PCs): 3754 [0x55bc3fd41bd8,0x55bc3fd50678), 
/out/matio_fuzzer: Running 1 inputs 1 time(s) each.
Running: /testcase/OSV-2020-1209.poc
==7==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x55bc3fc0fbdd in psnip_safe_size_mul /src/matio/src/./safe-math.h:843:1
    #1 0x55bc3fc0fbdd in SafeMulDims /src/matio/src/mat.c:216:15
    #2 0x55bc3fc0fbdd in Mat_VarFree /src/matio/src/mat.c:1501:9
    #3 0x55bc3fc36681 in Mat_VarReadNextInfo4 /src/matio/src/mat4.c
    #4 0x55bc3fc0e633 in Mat_Open /src/matio/src/mat.c:459:15
    #5 0x55bc3fc0d2c8 in LLVMFuzzerTestOneInput /src/matio_fuzzer.cc:30:18
    #6 0x55bc3fb03230 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
    #7 0x55bc3faee4a5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
    #8 0x55bc3faf3f3f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
    #9 0x55bc3fb1f1e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #10 0x7f8395d8a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 0702430aef5fa3dda43986563e9ffcc47efbd75e)
    #11 0x55bc3fae668d in _start (/out/matio_fuzzer+0x6068d)

DEDUP_TOKEN: psnip_safe_size_mul--SafeMulDims--Mat_VarFree
  Uninitialized value was stored to memory at
    #0 0x55bc3fc0fbd6 in SafeMulDims /src/matio/src/mat.c:216:52
    #1 0x55bc3fc0fbd6 in Mat_VarFree /src/matio/src/mat.c:1501:9
    #2 0x55bc3fc36681 in Mat_VarReadNextInfo4 /src/matio/src/mat4.c
    #3 0x55bc3fc0e633 in Mat_Open /src/matio/src/mat.c:459:15
    #4 0x55bc3fc0d2c8 in LLVMFuzzerTestOneInput /src/matio_fuzzer.cc:30:18
    #5 0x55bc3fb03230 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
    #6 0x55bc3faee4a5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
    #7 0x55bc3faf3f3f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
    #8 0x55bc3fb1f1e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #9 0x7f8395d8a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 0702430aef5fa3dda43986563e9ffcc47efbd75e)

DEDUP_TOKEN: SafeMulDims--Mat_VarFree--Mat_VarReadNextInfo4
  Uninitialized value was created by a heap allocation
    #0 0x55bc3fbb06c2 in malloc /src/llvm-project/compiler-rt/lib/msan/msan_interceptors.cpp:1021:3
    #1 0x55bc3fc36992 in Mat_VarReadNextInfo4 /src/matio/src/mat4.c:868:29
    #2 0x55bc3fc0e633 in Mat_Open /src/matio/src/mat.c:459:15
    #3 0x55bc3fc0d2c8 in LLVMFuzzerTestOneInput /src/matio_fuzzer.cc:30:18
    #4 0x55bc3fb03230 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
    #5 0x55bc3faee4a5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
    #6 0x55bc3faf3f3f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
    #7 0x55bc3fb1f1e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #8 0x7f8395d8a082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 0702430aef5fa3dda43986563e9ffcc47efbd75e)

DEDUP_TOKEN: __interceptor_malloc--Mat_VarReadNextInfo4--Mat_Open
SUMMARY: MemorySanitizer: use-of-uninitialized-value /src/matio/src/./safe-math.h:843:1 in psnip_safe_size_mul
Unique heap origins: 37
Stack depot allocated bytes: 9764880
Unique origin histories: 5
History depot allocated bytes: 196608
Exiting


Fix patch:
diff --git a/src/mat4.c b/src/mat4.c
index a786c21..601a3d6 100644
--- a/src/mat4.c
+++ b/src/mat4.c
@@ -865,7 +865,7 @@ Mat_VarReadNextInfo4(mat_t *mat)
     }
 
     matvar->rank = 2;
-    matvar->dims = (size_t*)malloc(2*sizeof(*matvar->dims));
+    matvar->dims = (size_t*)calloc(2, sizeof(*matvar->dims));
     if ( NULL == matvar->dims ) {
         Mat_VarFree(matvar);
         return NULL;