• via Digitalmars-d-bugs (21/21) Sep 05 2016 https://issues.dlang.org/show_bug.cgi?id=16469

via Digitalmars-d-bugs <digitalmars-d-bugs puremagic.com> writes:

https://issues.dlang.org/show_bug.cgi?id=16469

          Issue ID: 16469
           Summary: Segmentation fault in bigAlloc with negative size
           Product: D
           Version: D2
          Hardware: x86
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P1
         Component: dmd
          Assignee: nobody puremagic.com
          Reporter: cpicard openmailbox.org

The following snippet segfaults with DMD 2.071.1 when compiled with no flag:

    void main() {
        auto buf = new ubytes[-18];
    }

For some reasons values between 0 and -17 cause OutOfMemoryError but no
segfault.

This was found while fuzzing arsd/png.d with afl (American Fuzzy Loop).

--