From b223e2977844badb012d9ba75915ae9fd3615323 Mon Sep 17 00:00:00 2001 From: yhirose Date: Fri, 1 May 2026 21:34:03 +0900 Subject: [PATCH] Add OSS-Fuzz #508370122 reproducer to client_fuzzer corpus Same root cause as #508342856 (fixed in 2d2efe4): an oversized Content-Length value (here 4467440718547775) caused res.body.reserve() to attempt a multi-petabyte allocation. The UBSAN fuzzer job surfaced it as a std::bad_alloc-driven abort, while the ASAN job for #508342856 reported it as allocation-size-too-big. The payload_max_length_ cap introduced in 2d2efe4 already addresses both. --- ...usterfuzz-testcase-minimized-client_fuzzer-6561074643271680 | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 test/fuzzing/corpus/clusterfuzz-testcase-minimized-client_fuzzer-6561074643271680 diff --git a/test/fuzzing/corpus/clusterfuzz-testcase-minimized-client_fuzzer-6561074643271680 b/test/fuzzing/corpus/clusterfuzz-testcase-minimized-client_fuzzer-6561074643271680 new file mode 100644 index 0000000..f3a98be --- /dev/null +++ b/test/fuzzing/corpus/clusterfuzz-testcase-minimized-client_fuzzer-6561074643271680 @@ -0,0 +1,3 @@ + HTTP/1.1 777 +Content-Length:446744071854775 +