[Low] Arbitrary C code injection via unsanitized --entry in generated fuzzer.c

[donjon-cerberus-sandbox]

Location

• File: src/cgen/emit.zig
• Lines: 267-270

Classification

Property	Value
Severity	High
Category	Other
CWE	CWE-CWE-94
OWASP	A03:2021-Injection
Confidence	Suspected
Likelihood	Medium

Technical Description

The code generator writes the caller-supplied entry_name directly into emitted C source without validating that it is a legal C identifier or escaping metacharacters. The same unsanitized value is later emitted again in the generated libFuzzer entrypoint call. Because entry_name comes from the CLI (--entry) in src/main.zig, an attacker who can influence invocation parameters can inject arbitrary C tokens, declarations, or statements into fuzzer.c. In automated build/fuzzing pipelines that generate and then compile this file, this becomes code injection into the compilation unit and can be escalated to arbitrary code execution during the build or when the compiled artifact is run.

Vulnerable Code

// Write the forward declaration for the user's harness function.
const fwd_decl = try std.fmt.allocPrint(allocator, "int {s}(const uint8_t *data, size_t size);\n\n", .{entry_name});
defer allocator.free(fwd_decl);
try file.writeAll(fwd_decl);

Impact

User input: attacker who can supply CLI arguments to the tool can inject arbitrary C code into the generated fuzzer.c, potentially executing code in downstream CI/build systems when the generated file is compiled and linked. This can compromise build agents, tamper with generated fuzzers, and affect any environment that automatically trusts and compiles Absolution output.

Remediation

Validate entry_name before code generation and reject any value that is not a strict C identifier (for example ^[A-Za-z_][A-Za-z0-9_]*$). Do not interpolate arbitrary strings into emitted code. Apply the same validation at argument parsing time so invalid names fail early.

---

Created by Cerberus Merlin