mirror of
https://github.com/asg017/sqlite-vec.git
synced 2026-04-25 08:46:49 +02:00
0dd0765cc6
Targeted fuzzer for two-argument vector functions (vec_distance_*, vec_add, vec_sub) that binds a valid JSON vector as arg1 and fuzz data as arg2. This exercises the error path in ensure_vector_match() where the first vector parses successfully (with sqlite3_free cleanup) but the second fails, triggering the buggy aCleanup(a) call on line 1031 of sqlite-vec.c (should be aCleanup(*a)). The fuzzer catches this immediately — ASAN reports "bad-free" when sqlite3_free is called on a stack address. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| corpus | ||
| targets | ||
| .gitignore | ||
| exec.c | ||
| exec.dict | ||
| json.c | ||
| Makefile | ||
| metadata-columns.c | ||
| numpy.c | ||
| numpy.dict | ||
| README.md | ||
| scalar-functions.c | ||
| scalar-functions.dict | ||
| shadow-corrupt.c | ||
| vec-each.c | ||
| vec-mismatch.c | ||
| vec0-create-full.c | ||
| vec0-create.c | ||
| vec0-create.dict | ||
| vec0-operations.c | ||
ASAN_OPTIONS=detect_leaks=1 ./targets/vec0_create \
-dict=./vec0-create.dict -max_total_time=5 \
./corpus/vec0-create
export PATH="/opt/homebrew/opt/llvm/bin:$PATH"
export LDFLAGS="-L/opt/homebrew/opt/llvm/lib"
export CPPFLAGS="-I/opt/homebrew/opt/llvm/include"
LDFLAGS="-L/opt/homebrew/opt/llvm/lib/c++ -Wl,-rpath,/opt/homebrew/opt/llvm/lib/c++"