Google oss-fuzz issues 02/2026-04/2026

[djb-rwth]

These seem to be related to the latest code changes.
Please check and try to fix them accordingly.

GOF #488729177

=================================================================
==14==ERROR: AddressSanitizer: stack-use-after-return on address 0x7fde5d6a3fa2 at pc 0x56432dedcc97 bp 0x7ffec19bba70 sp 0x7ffec19bba68
READ of size 2 at 0x7fde5d6a3fa2 thread T0
SCARINESS: 52 (2-byte-read-stack-use-after-return)
    #0 0x56432dedcc96 in mark_alt_bonds_and_taut_groups /src/inchi/INCHI-1-SRC/INCHI_BASE/src/ichi_bns.c:5976:86
    #1 0x56432df61225 in Create_INChI /src/inchi/INCHI-1-SRC/INCHI_BASE/src/ichimake.c:3929:15
    #2 0x56432e0f9746 in MakeOneInChIOutOfStrFromINChI /src/inchi/INCHI-1-SRC/INCHI_BASE/src/ichirvr1.c:5326:14
    #3 0x56432e0c416e in RestoreAtomMakeBNS /src/inchi/INCHI-1-SRC/INCHI_BASE/src/ichirvr4.c:3252:15
    #4 0x56432e0c57e3 in OneInChI2Atom /src/inchi/INCHI-1-SRC/INCHI_BASE/src/ichirvr4.c:3513:11
    #5 0x56432e042e3d in InChI2Atom /src/inchi/INCHI-1-SRC/INCHI_BASE/src/ichirvr7.c:229:11
    #6 0x56432e046640 in AllInchiToStructure /src/inchi/INCHI-1-SRC/INCHI_BASE/src/ichirvr7.c:1146:23
    #7 0x56432e022277 in ConvertInChI2Struct /src/inchi/INCHI-1-SRC/INCHI_BASE/src/ichiread.c:11357:11
    #8 0x56432e00b393 in ReadWriteInChI /src/inchi/INCHI-1-SRC/INCHI_BASE/src/ichiread.c:1056:23
    #9 0x56432de15420 in GetStructFromINCHIEx /src/inchi/INCHI-1-SRC/INCHI_API/libinchi/src/inchi_dll.c:2709:16
    #10 0x56432de142f1 in GetStructFromINCHI /src/inchi/INCHI-1-SRC/INCHI_API/libinchi/src/inchi_dll.c:2864:11
    #11 0x56432de0675e in LLVMFuzzerTestOneInput /src/inchi_input_fuzzer.c:49:3
    #12 0x56432dca3e8d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13
    #13 0x56432dc8ec02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6
    #14 0x56432dc94ad0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9
    #15 0x56432dcc0602 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #16 0x7fde5d879082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d)
    #17 0x56432dc87ced in _start (/out/inchi_input_fuzzer+0x16dced)

DEDUP_TOKEN: mark_alt_bonds_and_taut_groups--Create_INChI--MakeOneInChIOutOfStrFromINChI
Address 0x7fde5d6a3fa2 is located in stack of thread T0 at offset 4002 in frame
    #0 0x56432dfe478f in MakeIsoAtomString /src/inchi/INCHI-1-SRC/INCHI_BASE/src/ichiprt2.c:1706

DEDUP_TOKEN: MakeIsoAtomString
  This frame has 1 object(s):
    [32, 2080) 'szValue' (line 1709) <== Memory access at offset 4002 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-use-after-return /src/inchi/INCHI-1-SRC/INCHI_BASE/src/ichi_bns.c:5976:86 in mark_alt_bonds_and_taut_groups
Shadow bytes around the buggy address:
  0x7fde5d6a3d00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x7fde5d6a3d80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x7fde5d6a3e00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x7fde5d6a3e80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x7fde5d6a3f00: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
=>0x7fde5d6a3f80: f5 f5 f5 f5[f5]f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x7fde5d6a4000: f1 f1 f1 f1 00 00 f2 f2 00 00 00 00 00 00 00 00
  0x7fde5d6a4080: 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 00 00 00 00
  0x7fde5d6a4100: 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 00 00
  0x7fde5d6a4180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fde5d6a4200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==14==ABORTING

GOF #489561592

=================================================================
==14==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 16 byte(s) in 1 object(s) allocated from:
    #0 0x55b26dc039a9 in calloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:74:3
    #1 0x55b26dc57293 in SetInChIExtInputByExtOrigAtData /src/inchi/INCHI-1-SRC/INCHI_API/libinchi/src/inchi_dll.c:3323:41
    #2 0x55b26dc56b43 in GetStructFromINCHIEx /src/inchi/INCHI-1-SRC/INCHI_API/libinchi/src/inchi_dll.c:2753:24
    #3 0x55b26dc552f1 in GetStructFromINCHI /src/inchi/INCHI-1-SRC/INCHI_API/libinchi/src/inchi_dll.c:2864:11
    #4 0x55b26dc4775e in LLVMFuzzerTestOneInput /src/inchi_input_fuzzer.c:49:3
    #5 0x55b26dae4e8d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13
    #6 0x55b26dacfc02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6
    #7 0x55b26dad5ad0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9
    #8 0x55b26db01602 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #9 0x7fb98d57c082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d)

DEDUP_TOKEN: __interceptor_calloc--SetInChIExtInputByExtOrigAtData--GetStructFromINCHIEx
SUMMARY: AddressSanitizer: 16 byte(s) leaked in 1 allocation(s).

INFO: a leak has been found in the initial corpus.

INFO: to ignore leaks on libFuzzer side use -detect_leaks=0.

GOF #490920729

=================================================================
==14==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 2 byte(s) in 1 object(s) allocated from:
    #0 0x561701ad27e4 in malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:67:3
    #1 0x561701d676fe in CreateNeighList /src/inchi/INCHI-1-SRC/INCHI_BASE/src/ichisort.c:866:29
    #2 0x561701c2a1df in GetBaseCanonRanking /src/inchi/INCHI-1-SRC/INCHI_BASE/src/ichican2.c:5358:16
    #3 0x561701c7259e in Create_INChI /src/inchi/INCHI-1-SRC/INCHI_BASE/src/ichimake.c:4251:11
    #4 0x561701b5dcec in CreateOneComponentINChI /src/inchi/INCHI-1-SRC/INCHI_BASE/src/runichi.c:1936:14
    #5 0x561701b5b565 in CreateOneStructureINChI /src/inchi/INCHI-1-SRC/INCHI_BASE/src/runichi.c:1498:16
    #6 0x561701b5858e in ProcessOneStructure /src/inchi/INCHI-1-SRC/INCHI_BASE/src/runichi.c:405:17
    #7 0x561701e0c3e4 in MakeInChIOutOfStrFromINChI2 /src/inchi/INCHI-1-SRC/INCHI_BASE/src/ichirvr1.c:5820:11
    #8 0x561701dd5a2a in OneInChI2Atom /src/inchi/INCHI-1-SRC/INCHI_BASE/src/ichirvr4.c:3550:15
    #9 0x561701d52e3d in InChI2Atom /src/inchi/INCHI-1-SRC/INCHI_BASE/src/ichirvr7.c:229:11
    #10 0x561701d56640 in AllInchiToStructure /src/inchi/INCHI-1-SRC/INCHI_BASE/src/ichirvr7.c:1146:23
    #11 0x561701d32277 in ConvertInChI2Struct /src/inchi/INCHI-1-SRC/INCHI_BASE/src/ichiread.c:11357:11
    #12 0x561701d1b393 in ReadWriteInChI /src/inchi/INCHI-1-SRC/INCHI_BASE/src/ichiread.c:1056:23
    #13 0x561701b25420 in GetStructFromINCHIEx /src/inchi/INCHI-1-SRC/INCHI_API/libinchi/src/inchi_dll.c:2709:16
    #14 0x561701b242f1 in GetStructFromINCHI /src/inchi/INCHI-1-SRC/INCHI_API/libinchi/src/inchi_dll.c:2864:11
    #15 0x561701b1675e in LLVMFuzzerTestOneInput /src/inchi_input_fuzzer.c:49:3
    #16 0x5617019b3e8d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13
    #17 0x56170199ec02 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6
    #18 0x5617019a4ad0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:865:9
    #19 0x5617019d0602 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #20 0x7f58f33c9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 5792732f783158c66fb4f3756458ca24e46e827d)

DEDUP_TOKEN: __interceptor_malloc--CreateNeighList--GetBaseCanonRanking
SUMMARY: AddressSanitizer: 2 byte(s) leaked in 1 allocation(s).

INFO: a leak has been found in the initial corpus.

INFO: to ignore leaks on libFuzzer side use -detect_leaks=0.