commit 73f0dde6d0d53b09325cf13b4d0f1cce0fa3eaaf
author Ben Clayton <bclayton@google.com> Mon Jul 19 10:38:39 2021 +0000
committer Tint LUCI CQ <tint-scoped@luci-project-accounts.iam.gserviceaccount.com> Mon Jul 19 10:38:39 2021 +0000
tree d28b1b51426ef80b22530b81e43cda54ace2ca80
parent 890363145a67ba606faaa2c2037f7f2156f76bda

fuzzers: Fix memcpy in Reader::read

We were copying to the address-of the `out` pointer parameter, not the actual pointer.
It's seriously troubling that the fuzzers didn't fail sooner on this.

Fixed: chromium:1230266
Fixed: chromium:1230352
Fixed: chromium:1230356
Fixed: chromium:1230358
Fixed: chromium:1230376
Fixed: chromium:1230377
Fixed: chromium:1230378
Fixed: chromium:1230384
Fixed: chromium:1230395
Fixed: chromium:1230406
Change-Id: I4f67f10127e89f873ab628e5af76b7455d113276
Reviewed-on: https://dawn-review.googlesource.com/c/tint/+/58681
Auto-Submit: Ben Clayton <bclayton@google.com>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Commit-Queue: Ben Clayton <bclayton@google.com>
Kokoro: Kokoro <noreply+kokoro@google.com>

fuzzers/tint_common_fuzzer.cc

diff --git a/fuzzers/tint_common_fuzzer.cc b/fuzzers/tint_common_fuzzer.cc
index 2a626dd..9e36291 100644
--- a/fuzzers/tint_common_fuzzer.cc
+++ b/fuzzers/tint_common_fuzzer.cc
@@ -115,7 +115,7 @@
     mark_failed();
     return;
   }
-  memcpy(&out, data_, n);
+  memcpy(out, data_, n);
   data_ += n;
   size_ -= n;
 }