crashes:
  {
      crash {
          target {
              engine: "libfuzzer"
              sanitizer: "address"
              task_dir: "/node_data/crs_scratch/e1c910f9-3f47-4dfb-b082-122f6cb9d87e-cbb93452-5aec-47"
              task_id: "e1c910f9-3f47-4dfb-b082-122f6cb9d87e"
              build_type: FUZZER
              apply_diff: true
          }
          harness_name: "libpng_read_fuzzer"
          crash_token: "OSS_FUZZ_png_handle_iCCP\nOSS_FUZZ_png_read_info\nlibpng_read_fuzzer.cc\n"
          crash_input_path: "/node_data/crs_scratch/e1c910f9-3f47-4dfb-b082-122f6cb9d87e/buttercup_crashes_libpng_read_fuzzer/b65e875f24f2d206a5f9272d7c2ad7a0e64f054ae1ef7e16062cf770070c2c90/address/92c0dd93a38754a0326afdf3255c5f9a912e8634f243b27c1f48531686f3b20b"
          stacktrace: "+ FUZZER=libpng_read_fuzzer\n+ shift\n+ '[' '!' -v TESTCASE ']'\n+ TESTCASE=/testcase\n+ '[' '!' -f /testcase ']'\n+ export RUN_FUZZER_MODE=interactive\n+ RUN_FUZZER_MODE=interactive\n+ export FUZZING_ENGINE=libfuzzer\n+ FUZZING_ENGINE=libfuzzer\n+ export SKIP_SEED_CORPUS=1\n+ SKIP_SEED_CORPUS=1\n+ run_fuzzer libpng_read_fuzzer -runs=100 /testcase\nvm.mmap_rnd_bits = 28\n/out/libpng_read_fuzzer -rss_limit_mb=2560 -timeout=25 -runs=100 /testcase -dict=png.dict < /dev/null\nDictionary: 28 entries\nINFO: Running with entropic power schedule (0xFF, 100).\nINFO: Seed: 4117878429\nINFO: Loaded 1 modules   (5641 inline 8-bit counters): 5641 [0x561561195928, 0x561561196f31), \nINFO: Loaded 1 PC tables (5641 PCs): 5641 [0x561561196f38,0x5615611acfc8), \n/out/libpng_read_fuzzer: Running 1 inputs 100 time(s) each.\nRunning: /testcase\n=================================================================\n==18==ERROR: AddressSanitizer: dynamic-stack-buffer-overflow on address 0x7ffce0754432 at pc 0x5615610dfa9b bp 0x7ffce07543b0 sp 0x7ffce07543a8\nREAD of size 2 at 0x7ffce0754432 thread T0\nSCARINESS: 29 (2-byte-read-dynamic-stack-buffer-overflow)\n    #0 0x5615610dfa9a in OSS_FUZZ_png_handle_iCCP /src/libpng/pngrutil.c:1447:10\n    #1 0x5615610b3dcd in OSS_FUZZ_png_read_info /src/libpng/pngread.c:229:10\n    #2 0x5615610074ae in LLVMFuzzerTestOneInput /src/libpng/contrib/oss-fuzz/libpng_read_fuzzer.cc:156:3\n    #3 0x561561025520 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13\n    #4 0x561561010795 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6\n    #5 0x56156101622f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9\n    #6 0x5615610414d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10\n    #7 0x7fedae19f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 0323ab4806bee6f846d9ad4bccfc29afdca49a58)\n    #8 0x561560f2e83d in _start (/out/libpng_read_fuzzer+0x6c83d)\n\nDEDUP_TOKEN: OSS_FUZZ_png_handle_iCCP--OSS_FUZZ_png_read_info--LLVMFuzzerTestOneInput\nAddress 0x7ffce0754432 is located in stack of thread T0\nSUMMARY: AddressSanitizer: dynamic-stack-buffer-overflow /src/libpng/pngrutil.c:1447:10 in OSS_FUZZ_png_handle_iCCP\nShadow bytes around the buggy address:\n  0x7ffce0754180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ffce0754200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ffce0754280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ffce0754300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ffce0754380: 00 00 00 00 00 00 00 00 ca ca ca ca 00 00 00 00\n=>0x7ffce0754400: 00 00 00 00 00 00[02]cb cb cb cb cb 00 00 00 00\n  0x7ffce0754480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ffce0754500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ffce0754580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ffce0754600: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 f2\n  0x7ffce0754680: f2 f2 f2 f2 00 00 00 00 00 f2 f2 f2 f2 f2 f8 f2\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n==18==ABORTING\n"
      }
      tracer_stacktrace: "+ FUZZER=libpng_read_fuzzer\n+ shift\n+ '[' '!' -v TESTCASE ']'\n+ TESTCASE=/testcase\n+ '[' '!' -f /testcase ']'\n+ export RUN_FUZZER_MODE=interactive\n+ RUN_FUZZER_MODE=interactive\n+ export FUZZING_ENGINE=libfuzzer\n+ FUZZING_ENGINE=libfuzzer\n+ export SKIP_SEED_CORPUS=1\n+ SKIP_SEED_CORPUS=1\n+ run_fuzzer libpng_read_fuzzer -runs=100 /testcase\nvm.mmap_rnd_bits = 28\n/out/libpng_read_fuzzer -rss_limit_mb=2560 -timeout=25 -runs=100 /testcase -dict=png.dict < /dev/null\nDictionary: 28 entries\nINFO: Running with entropic power schedule (0xFF, 100).\nINFO: Seed: 4117878429\nINFO: Loaded 1 modules   (5641 inline 8-bit counters): 5641 [0x561561195928, 0x561561196f31), \nINFO: Loaded 1 PC tables (5641 PCs): 5641 [0x561561196f38,0x5615611acfc8), \n/out/libpng_read_fuzzer: Running 1 inputs 100 time(s) each.\nRunning: /testcase\n=================================================================\n==18==ERROR: AddressSanitizer: dynamic-stack-buffer-overflow on address 0x7ffce0754432 at pc 0x5615610dfa9b bp 0x7ffce07543b0 sp 0x7ffce07543a8\nREAD of size 2 at 0x7ffce0754432 thread T0\nSCARINESS: 29 (2-byte-read-dynamic-stack-buffer-overflow)\n    #0 0x5615610dfa9a in OSS_FUZZ_png_handle_iCCP /src/libpng/pngrutil.c:1447:10\n    #1 0x5615610b3dcd in OSS_FUZZ_png_read_info /src/libpng/pngread.c:229:10\n    #2 0x5615610074ae in LLVMFuzzerTestOneInput /src/libpng/contrib/oss-fuzz/libpng_read_fuzzer.cc:156:3\n    #3 0x561561025520 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13\n    #4 0x561561010795 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6\n    #5 0x56156101622f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9\n    #6 0x5615610414d2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10\n    #7 0x7fedae19f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 0323ab4806bee6f846d9ad4bccfc29afdca49a58)\n    #8 0x561560f2e83d in _start (/out/libpng_read_fuzzer+0x6c83d)\n\nDEDUP_TOKEN: OSS_FUZZ_png_handle_iCCP--OSS_FUZZ_png_read_info--LLVMFuzzerTestOneInput\nAddress 0x7ffce0754432 is located in stack of thread T0\nSUMMARY: AddressSanitizer: dynamic-stack-buffer-overflow /src/libpng/pngrutil.c:1447:10 in OSS_FUZZ_png_handle_iCCP\nShadow bytes around the buggy address:\n  0x7ffce0754180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ffce0754200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ffce0754280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ffce0754300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ffce0754380: 00 00 00 00 00 00 00 00 ca ca ca ca 00 00 00 00\n=>0x7ffce0754400: 00 00 00 00 00 00[02]cb cb cb cb cb 00 00 00 00\n  0x7ffce0754480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ffce0754500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ffce0754580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  0x7ffce0754600: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 f2\n  0x7ffce0754680: f2 f2 f2 f2 00 00 00 00 00 f2 f2 f2 f2 f2 f8 f2\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07 \n  Heap left redzone:       fa\n  Freed heap region:       fd\n  Stack left redzone:      f1\n  Stack mid redzone:       f2\n  Stack right redzone:     f3\n  Stack after return:      f5\n  Stack use after scope:   f8\n  Global redzone:          f9\n  Global init order:       f6\n  Poisoned by user:        f7\n  Container overflow:      fc\n  Array cookie:            ac\n  Intra object redzone:    bb\n  ASan internal:           fe\n  Left alloca redzone:     ca\n  Right alloca redzone:    cb\n==18==ABORTING\n"
  }
submission_index: "my-vuln-id"
