[Bug Report] Heap buffer-overflow in prase function in btoruntrace.c about boolector

[mpreiner]

@wcventure Thanks for reporting the bug! What tools did you use to find it?

[wcventure]

Hi @mpreiner

I Use AddressSanitizer(https://clang.llvm.org/docs/AddressSanitizer.html) to dump the backtrace.
This tool is integrated in LLVM.

You can compile the program with ASAN, and then reproduce the bug with the test case I gave you.

change the line in confiugre.sh.

#!/bin/sh
#--------------------------------------------------------------------------#

BUILDDIR=build

#--------------------------------------------------------------------------#

asan=yes
debug=yes
check=no
log=no
shared=no
prefix=

asan=no -> asan=yes

[mpreiner]

Yes, I know about ASAN (you can configure Boolector with ./configure.sh --asan for that). What I actually meant was what input fuzzer/tool did you use to craft the failing inputs?

[wcventure]

I use AFL, a well-known fuzzing tool.