diff --git a/src/basic/cgroup-util.c b/src/basic/cgroup-util.c index c0962f288f..68ff8ff5a9 100644 --- a/src/basic/cgroup-util.c +++ b/src/basic/cgroup-util.c @@ -1977,6 +1977,14 @@ int cg_slice_to_path(const char *unit, char **ret) { _cleanup_free_ char *escaped = NULL; char n[dash - p + sizeof(".slice")]; +#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION + /* msan doesn't instrument stpncpy, so it thinks + * n is later used unitialized: + * https://github.com/google/sanitizers/issues/926 + */ + zero(n); +#endif + /* Don't allow trailing or double dashes */ if (IN_SET(dash[1], 0, '-')) return -EINVAL; diff --git a/test/fuzz-regressions/fuzz-unit-file/oss-fuzz-6897 b/test/fuzz-regressions/fuzz-unit-file/oss-fuzz-6897 new file mode 100644 index 0000000000..742fd9bfeb --- /dev/null +++ b/test/fuzz-regressions/fuzz-unit-file/oss-fuzz-6897 @@ -0,0 +1,4 @@ +service +[Service] +Slice=%H.slice +TemporaryFileSystem=%c \ No newline at end of file diff --git a/test/fuzz-regressions/fuzz-unit-file/oss-fuzz-6897-evverx b/test/fuzz-regressions/fuzz-unit-file/oss-fuzz-6897-evverx new file mode 100644 index 0000000000..126678e76c --- /dev/null +++ b/test/fuzz-regressions/fuzz-unit-file/oss-fuzz-6897-evverx @@ -0,0 +1,4 @@ +service +[Service] +Slice=abc-def.slice +TemporaryFileSystem=%c diff --git a/test/fuzz-regressions/meson.build b/test/fuzz-regressions/meson.build index c1ea229a24..d36a3574e6 100644 --- a/test/fuzz-regressions/meson.build +++ b/test/fuzz-regressions/meson.build @@ -35,4 +35,6 @@ fuzz_regression_tests = ''' fuzz-unit-file/oss-fuzz-6917 fuzz-unit-file/oss-fuzz-6892 fuzz-unit-file/oss-fuzz-6908 + fuzz-unit-file/oss-fuzz-6897 + fuzz-unit-file/oss-fuzz-6897-evverx '''.split()