Tracking issue for bam fuzzing

[tnuha]

Description

The following archive unifies different crashes discovered with the recent bam fuzzing campaign:

summary.zip

Each is accompanied with a report for that particular crash, with error reporting from panda3d and ASAN.

Unique Crashes: 12
Total Crashes: 13000

• crash 1: SEGV in TypedObject::is_of_type (bam fuzzing) #1832
• crash 2: SEGV in AtomicAdjustDummyImpl::get (bam fuzzing) #1840
• crash 3: SEGV in GeomVertexArrayFormat::compare_to (bam fuzzing) #1831
• crash 4: SEGV in GeomVertexArrayFormat::is_registered (bam fuzzing) #1820
• crash 5: SEGV in ConstPointerTo<GeomVertexArrayFormat>::operator* (bam fuzzing) #1830
• crash 6: SEGV in PointerToVoid::operator== (bam fuzzing) #1836
• crash 7: SEGV in GeomVertexArrayFormat::is_data_subset_of (bam fuzzing) #1834
• crash 8: heap-buffer-overflow in ReversedNumericData::store_value (bam fuzzing) #1833
• crash 9: SEGV in GeomVertexArrayFormat::is_data_subset_of (bam fuzzing) #1834
• crash 10: SEGV in patomic<int>::load (bam fuzzing) #1837
• crash 11: SEGV in GeomVertexFormat::do_register (bam fuzzing) #1835
• crash 12: SEGV in BamReader::resolve_object_pointers (bam fuzzing) #1839

This is part of a fuzzing campaign we performed at the University of Utah. You can see the harness for this particular interface here.
More detail regarding our fuzzing setup can be found in our README.

Environment

• Operating system: Ubuntu 24.04
• System architecture: impacts both ARM and x86_64
• Panda3D version: 6b72d7a
• Installation method: built from source
• Compiler: afl-clang++