Markus Zoppelt3 min read

AI-automated Fuzzing Found a Dynamic Stack Buffer Overflow in abseil-cpp

A dynamic stack buffer overflow vulnerability in the Abseil C++ library (abseil-cpp) was autonomously identified through AI-enhanced fuzz testing using CI Fuzz’s AI Test Agent and has been fully addressed with a patch. This post dives into the vulnerability, its discovery, and its implications for systems relying on this widely-used library.

Discovery

A stack buffer overflow was detected in the Abseil C++ library (abseil-cpp) within the absl::debugging_internal::ParseLocalNameSuffix function. The discovery was made through CI Fuzz and its AI Test Agent called Spark, which uncovers bugs without human intervention.

Notably, the Abseil repository already employed fuzz testing, yet Spark identified this previously undetected issue and improved test coverage, highlighting the power of AI-automated security testing.

Vulnerability Description

The vulnerability stems from insufficient bounds checking in the ParseLocalNameSuffix function, located in absl/debugging/internal/demangle.cc. During a rollback after a parsing failure, the code writes a null terminator (\0) to the output buffer (state->out) without verifying that the current index (state->parse_state.out_cur_idx) is within the buffer’s allocated size. This results in a dynamic stack buffer overflow, potentially causing memory corruption or crashes when processing malformed input. However, the issue does not allow arbitrary code execution or direct control over the overwritten memory content.

Technical Details

The overflow occurs when state->parse_state.out_cur_idx exceeds the allocated buffer size (state->parse_state.out_size), which can happen with small or malformed inputs during demangling. The patch introduces a bounds check to ensure the write only occurs within the valid buffer range:

if (state->parse_state.append && state->parse_state.out_cur_idx < state->parse_state.out_size) {

  state->out[state->parse_state.out_cur_idx] = '\0';

}

This fix prevents the overflow by validating the index against the buffer’s size, tracked in the State structure.

Potential Impact

The abseil-cpp library is a foundational component in numerous C++ projects, including Google’s internal systems, open-source software, and performance-critical applications. This vulnerability affects the demangling functionality, which parses mangled C++ symbol names. The issue manifests as a dynamic stack buffer overflow, potentially leading to crashes or undefined behavior in specific edge cases. While it does not enable direct exploitation (e.g., remote code execution), it could destabilize applications processing untrusted or malformed input.

High-Performance Systems: Applications relying on abseil-cpp for debugging or symbol handling may encounter this issue.
Developer Tools: Tools using Abseil’s demangler to process C++ symbols could crash or behave unpredictably.
Embedded Systems: Devices with constrained memory using this library might be particularly sensitive to stack corruption.

The patch ensures robust bounds checking, stabilizing these use cases.

Real-World Impact

Although the overflow is limited to a single byte write beyond the buffer and does not allow attackers to inject malicious data, it could still disrupt service reliability. For instance, a crash in a production environment processing mangled names (e.g., _ZZ2wwE) could lead to downtime. The Abseil team’s existing fuzz testing infrastructure caught many issues, but CI Fuzz, with its AI Test Agent, identified this corner case, demonstrating the value of AI in enhancing coverage beyond traditional methods. The fix is already merged in commit fd86aa7.

Mitigation

The vulnerability has been patched as of March 03, 2025, with the bounds check added to ParseLocalNameSuffix. The fix will be available in an upcoming release of abseil-cpp. Users are urged to update to the latest version once the patch is released. For those building from source, applying the suggested mitigation (shown above) is recommended. The Abseil team has been notified, and commit fd86aa7 addresses this issue.

Reproducer

This code snippet triggers the vulnerable behavior when compiled with AddressSanitizer (ASAN):

#include <assert.h>
#include "absl/debugging/internal/demangle.h" 

int main() { 
    std::string mangled_name = "_ZZ2wwE";
    size_t buffer_size = 1; // Small buffer triggers overflow
    char demangled_output[buffer_size]; 
    absl::debugging_internal::Demangle(mangled_name.c_str(), demangled_output, 
buffer_size);      
}

When run with ASAN, it produces a stack trace indicating a dynamic-stack-buffer-overflow at line 2833, confirming the out-of-bounds write. Buffer sizes of 1 or 2 bytes reliably reproduce the issue.

AI in Vulnerability Detection

This discovery underscores the effectiveness of AI-automated fuzz testing. While abseil-cpp already utilized fuzzing, CI Fuzz, with its AI Test Agent, pinpointed this subtle bounds-checking flaw by generating targeted inputs (e.g., _ZZ2wwE) and enhancing test coverage. Traditional fuzzing missed this edge case, but the AI Test Agent’s autonomous exploration of rollback paths exposed the vulnerability.

Book a call with our team to see how CI Fuzz can uncover hidden bugs in your codebase with a single command.

Book a call