ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-15 03:18:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

write target errors to out_dir/error.txt

Browse Source
This commit is contained in:
vanhauser-thc
2021-06-07 09:26:53 +02:00
parent a5ff9f1beb
commit 92fcef4520
4 changed files with 116 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

134
instrumentation/afl-compiler-rt.o.c
View File

@ -83,15 +83,15 @@ extern ssize_t _kern_write(int fd, off_t pos, const void *buffer,
size_t bufferSize);
#endif // HAIKU
static u8 __afl_area_initial[MAP_INITIAL_SIZE];
static u8 * __afl_area_ptr_dummy = __afl_area_initial;
static u8 * __afl_area_ptr_backup = __afl_area_initial;
static u8 __afl_area_initial[MAP_INITIAL_SIZE];
static u8 *__afl_area_ptr_dummy = __afl_area_initial;
static u8 *__afl_area_ptr_backup = __afl_area_initial;
u8 * __afl_area_ptr = __afl_area_initial;
u8 * __afl_dictionary;
u8 * __afl_fuzz_ptr;
static u32 __afl_fuzz_len_dummy;
u32 *__afl_fuzz_len = &__afl_fuzz_len_dummy;
u8 * __afl_area_ptr = __afl_area_initial;
u8 * __afl_dictionary;
u8 * __afl_fuzz_ptr;
static u32 __afl_fuzz_len_dummy;
u32 * __afl_fuzz_len = &__afl_fuzz_len_dummy;
u32 __afl_final_loc;
u32 __afl_map_size = MAP_SIZE;
@ -99,8 +99,8 @@ u32 __afl_dictionary_len;
u64 __afl_map_addr;
// for the __AFL_COVERAGE_ON/__AFL_COVERAGE_OFF features to work:
int __afl_selective_coverage __attribute__((weak));
int __afl_selective_coverage_start_off __attribute__((weak));
int __afl_selective_coverage __attribute__((weak));
int __afl_selective_coverage_start_off __attribute__((weak));
static int __afl_selective_coverage_temp = 1;
#if defined(__ANDROID__) || defined(__HAIKU__)
@ -630,6 +630,30 @@ static void __afl_unmap_shm(void) {
}
void write_error(char *text) {
u8 * o = getenv("__AFL_OUT_DIR");
char *e = strerror(errno);
if (o) {
char buf[4096];
snprintf(buf, sizeof(buf), "%s/error.txt", o);
FILE *f = fopen(buf, "a");
if (f) {
fprintf(f, "Error(%s): %s\n", text, e);
fclose(f);
}
}
fprintf(stderr, "Error(%s): %s\n", text, e);
}
#ifdef __linux__
static void __afl_start_snapshots(void) {
@ -656,7 +680,12 @@ static void __afl_start_snapshots(void) {
if (__afl_sharedmem_fuzzing || (__afl_dictionary_len && __afl_dictionary)) {
if (read(FORKSRV_FD, &was_killed, 4) != 4) { _exit(1); }
if (read(FORKSRV_FD, &was_killed, 4) != 4) {
write_error("read to afl-fuzz");
_exit(1);
}
if (__afl_debug) {
@ -725,7 +754,12 @@ static void __afl_start_snapshots(void) {
} else {
/* Wait for parent by reading from the pipe. Abort if read fails. */
if (read(FORKSRV_FD, &was_killed, 4) != 4) _exit(1);
if (read(FORKSRV_FD, &was_killed, 4) != 4) {
write_error("reading from afl-fuzz");
_exit(1);
}
}
@ -762,7 +796,12 @@ static void __afl_start_snapshots(void) {
if (child_stopped && was_killed) {
child_stopped = 0;
if (waitpid(child_pid, &status, 0) < 0) _exit(1);
if (waitpid(child_pid, &status, 0) < 0) {
write_error("child_stopped && was_killed");
_exit(1); // TODO why exit?
}
}
@ -771,7 +810,12 @@ static void __afl_start_snapshots(void) {
/* Once woken up, create a clone of our process. */
child_pid = fork();
if (child_pid < 0) _exit(1);
if (child_pid < 0) {
write_error("fork");
_exit(1);
}
/* In child process: close fds, resume execution. */
@ -811,9 +855,19 @@ static void __afl_start_snapshots(void) {
/* In parent process: write PID to pipe, then wait for child. */
if (write(FORKSRV_FD + 1, &child_pid, 4) != 4) _exit(1);
if (write(FORKSRV_FD + 1, &child_pid, 4) != 4) {
if (waitpid(child_pid, &status, WUNTRACED) < 0) _exit(1);
write_error("write to afl-fuzz");
_exit(1);
}
if (waitpid(child_pid, &status, WUNTRACED) < 0) {
write_error("waitpid");
_exit(1);
}
/* In persistent mode, the child stops itself with SIGSTOP to indicate
a successful run. In this case, we want to wake it up without forking
@ -823,7 +877,12 @@ static void __afl_start_snapshots(void) {
/* Relay wait status to pipe, then loop back. */
if (write(FORKSRV_FD + 1, &status, 4) != 4) _exit(1);
if (write(FORKSRV_FD + 1, &status, 4) != 4) {
write_error("writing to afl-fuzz");
_exit(1);
}
}
@ -956,7 +1015,12 @@ static void __afl_start_forkserver(void) {
} else {
if (read(FORKSRV_FD, &was_killed, 4) != 4) _exit(1);
if (read(FORKSRV_FD, &was_killed, 4) != 4) {
write_error("read from afl-fuzz");
_exit(1);
}
}
@ -993,7 +1057,12 @@ static void __afl_start_forkserver(void) {
if (child_stopped && was_killed) {
child_stopped = 0;
if (waitpid(child_pid, &status, 0) < 0) _exit(1);
if (waitpid(child_pid, &status, 0) < 0) {
write_error("child_stopped && was_killed");
_exit(1);
}
}
@ -1002,7 +1071,12 @@ static void __afl_start_forkserver(void) {
/* Once woken up, create a clone of our process. */
child_pid = fork();
if (child_pid < 0) _exit(1);
if (child_pid < 0) {
write_error("fork");
_exit(1);
}
/* In child process: close fds, resume execution. */
@ -1031,11 +1105,20 @@ static void __afl_start_forkserver(void) {
/* In parent process: write PID to pipe, then wait for child. */
if (write(FORKSRV_FD + 1, &child_pid, 4) != 4) _exit(1);
if (write(FORKSRV_FD + 1, &child_pid, 4) != 4) {
if (waitpid(child_pid, &status, is_persistent ? WUNTRACED : 0) < 0)
write_error("write to afl-fuzz");
_exit(1);
}
if (waitpid(child_pid, &status, is_persistent ? WUNTRACED : 0) < 0) {
write_error("waitpid");
_exit(1);
}
/* In persistent mode, the child stops itself with SIGSTOP to indicate
a successful run. In this case, we want to wake it up without forking
again. */
@ -1044,7 +1127,12 @@ static void __afl_start_forkserver(void) {
/* Relay wait status to pipe, then loop back. */
if (write(FORKSRV_FD + 1, &status, 4) != 4) _exit(1);
if (write(FORKSRV_FD + 1, &status, 4) != 4) {
write_error("writing to afl-fuzz");
_exit(1);
}
}

2
src/afl-analyze.c
View File

@ -225,7 +225,6 @@ static s32 write_to_file(u8 *path, u8 *mem, u32 len) {
}
/* Handle timeout signal. */
static void handle_timeout(int sig) {
@ -238,7 +237,6 @@ static void handle_timeout(int sig) {
}
/* Execute target application. Returns exec checksum, or 0 if program
times out. */

7
src/afl-fuzz-stats.c
View File

@ -768,7 +768,7 @@ void show_stats(afl_state_t *afl) {
SAYF(bVR bH bSTOP cCYA
" cycle progress " bSTG bH10 bH5 bH2 bH2 bH2 bHB bH bSTOP cCYA
" map coverage" bSTG bHT bH20 bH2 bVL "\n");
" map coverage" bSTG bHT bH20 bH2 bVL "\n");
/* This gets funny because we want to print several variable-length variables
together, but then cram them into a fixed-width field - so we need to
@ -873,9 +873,8 @@ void show_stats(afl_state_t *afl) {
/* Aaaalmost there... hold on! */
SAYF(bVR bH cCYA bSTOP
" fuzzing strategy yields " bSTG bH10 bH2 bHT bH10 bH2 bH bHB bH bSTOP cCYA
" path geometry " bSTG bH5 bH2 bVL "\n");
SAYF(bVR bH cCYA bSTOP " fuzzing strategy yields " bSTG bH10 bH2 bHT bH10 bH2
bH bHB bH bSTOP cCYA " path geometry " bSTG bH5 bH2 bVL "\n");
if (unlikely(afl->custom_only)) {

2
src/afl-fuzz.c
View File

@ -1205,6 +1205,8 @@ int main(int argc, char **argv_orig, char **envp) {
}
setenv("__AFL_OUT_DIR", afl->out_dir, 1);
if (get_afl_env("AFL_DISABLE_TRIM")) { afl->disable_trim = 1; }
if (getenv("AFL_NO_UI") && getenv("AFL_FORCE_UI")) {