ExternalVendorCode/AFLplusplus
1
0
Fork 0
mirror of https://github.com/AFLplusplus/AFLplusplus.git synced 2025-06-15 03:18:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix oob reads, code-format

Browse Source
This commit is contained in:
van Hauser
2020-07-30 17:09:22 +02:00
parent 1ba48a5ba0
commit ea9ba53cdb
5 changed files with 146 additions and 104 deletions
Download Patch File Download Diff File Expand all files Collapse all files

168
examples/aflpp_driver/aflpp_driver.c
View File

@ -14,12 +14,15 @@ cat << EOF > test_fuzzer.cc
#include <stddef.h> #include <stddef.h>
#include <stdint.h> #include <stdint.h>
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
if (size > 0 && data[0] == 'H') if (size > 0 && data[0] == 'H')
if (size > 1 && data[1] == 'I') if (size > 1 && data[1] == 'I')
if (size > 2 && data[2] == '!') if (size > 2 && data[2] == '!')
__builtin_trap(); __builtin_trap();
return 0; return 0;
} }
EOF EOF
# Build your target with -fsanitize-coverage=trace-pc-guard using fresh clang. # Build your target with -fsanitize-coverage=trace-pc-guard using fresh clang.
clang -g -fsanitize-coverage=trace-pc-guard test_fuzzer.cc -c clang -g -fsanitize-coverage=trace-pc-guard test_fuzzer.cc -c
@ -57,46 +60,46 @@ If 1, close stdout at startup. If 2 close stderr; if 3 close both.
#include "config.h" #include "config.h"
#ifdef _DEBUG #ifdef _DEBUG
#include "hash.h" #include "hash.h"
#endif #endif
// Platform detection. Copied from FuzzerInternal.h // Platform detection. Copied from FuzzerInternal.h
#ifdef __linux__ #ifdef __linux__
#define LIBFUZZER_LINUX 1 #define LIBFUZZER_LINUX 1
#define LIBFUZZER_APPLE 0 #define LIBFUZZER_APPLE 0
#define LIBFUZZER_NETBSD 0 #define LIBFUZZER_NETBSD 0
#define LIBFUZZER_FREEBSD 0 #define LIBFUZZER_FREEBSD 0
#define LIBFUZZER_OPENBSD 0 #define LIBFUZZER_OPENBSD 0
#elif __APPLE__ #elif __APPLE__
#define LIBFUZZER_LINUX 0 #define LIBFUZZER_LINUX 0
#define LIBFUZZER_APPLE 1 #define LIBFUZZER_APPLE 1
#define LIBFUZZER_NETBSD 0 #define LIBFUZZER_NETBSD 0
#define LIBFUZZER_FREEBSD 0 #define LIBFUZZER_FREEBSD 0
#define LIBFUZZER_OPENBSD 0 #define LIBFUZZER_OPENBSD 0
#elif __NetBSD__ #elif __NetBSD__
#define LIBFUZZER_LINUX 0 #define LIBFUZZER_LINUX 0
#define LIBFUZZER_APPLE 0 #define LIBFUZZER_APPLE 0
#define LIBFUZZER_NETBSD 1 #define LIBFUZZER_NETBSD 1
#define LIBFUZZER_FREEBSD 0 #define LIBFUZZER_FREEBSD 0
#define LIBFUZZER_OPENBSD 0 #define LIBFUZZER_OPENBSD 0
#elif __FreeBSD__ #elif __FreeBSD__
#define LIBFUZZER_LINUX 0 #define LIBFUZZER_LINUX 0
#define LIBFUZZER_APPLE 0 #define LIBFUZZER_APPLE 0
#define LIBFUZZER_NETBSD 0 #define LIBFUZZER_NETBSD 0
#define LIBFUZZER_FREEBSD 1 #define LIBFUZZER_FREEBSD 1
#define LIBFUZZER_OPENBSD 0 #define LIBFUZZER_OPENBSD 0
#elif __OpenBSD__ #elif __OpenBSD__
#define LIBFUZZER_LINUX 0 #define LIBFUZZER_LINUX 0
#define LIBFUZZER_APPLE 0 #define LIBFUZZER_APPLE 0
#define LIBFUZZER_NETBSD 0 #define LIBFUZZER_NETBSD 0
#define LIBFUZZER_FREEBSD 0 #define LIBFUZZER_FREEBSD 0
#define LIBFUZZER_OPENBSD 1 #define LIBFUZZER_OPENBSD 1
#else #else
#error "Support for your platform has not been implemented" #error "Support for your platform has not been implemented"
#endif #endif
int __afl_sharedmem_fuzzing = 1; int __afl_sharedmem_fuzzing = 1;
extern unsigned int *__afl_fuzz_len; extern unsigned int * __afl_fuzz_len;
extern unsigned char *__afl_fuzz_ptr; extern unsigned char *__afl_fuzz_ptr;
// libFuzzer interface is thin, so we don't include any libFuzzer headers. // libFuzzer interface is thin, so we don't include any libFuzzer headers.
@ -105,11 +108,11 @@ __attribute__((weak)) int LLVMFuzzerInitialize(int *argc, char ***argv);
// Notify AFL about persistent mode. // Notify AFL about persistent mode.
static volatile char AFL_PERSISTENT[] = "##SIG_AFL_PERSISTENT##"; static volatile char AFL_PERSISTENT[] = "##SIG_AFL_PERSISTENT##";
int __afl_persistent_loop(unsigned int); int __afl_persistent_loop(unsigned int);
// Notify AFL about deferred forkserver. // Notify AFL about deferred forkserver.
static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##"; static volatile char AFL_DEFER_FORKSVR[] = "##SIG_AFL_DEFER_FORKSRV##";
void __afl_manual_init(); void __afl_manual_init();
// Use this optionally defined function to output sanitizer messages even if // Use this optionally defined function to output sanitizer messages even if
// user asks to close stderr. // user asks to close stderr.
@ -122,98 +125,121 @@ static FILE *output_file;
// Experimental feature to use afl_driver without AFL's deferred mode. // Experimental feature to use afl_driver without AFL's deferred mode.
// Needs to run before __afl_auto_init. // Needs to run before __afl_auto_init.
__attribute__((constructor(0))) static void __decide_deferred_forkserver(void) { __attribute__((constructor(0))) static void __decide_deferred_forkserver(void) {
if (getenv("AFL_DRIVER_DONT_DEFER")) { if (getenv("AFL_DRIVER_DONT_DEFER")) {
if (unsetenv("__AFL_DEFER_FORKSRV")) { if (unsetenv("__AFL_DEFER_FORKSRV")) {
perror("Failed to unset __AFL_DEFER_FORKSRV"); perror("Failed to unset __AFL_DEFER_FORKSRV");
abort(); abort();
} }
} }
} }
// If the user asks us to duplicate stderr, then do it. // If the user asks us to duplicate stderr, then do it.
static void maybe_duplicate_stderr() { static void maybe_duplicate_stderr() {
char *stderr_duplicate_filename = char *stderr_duplicate_filename =
getenv("AFL_DRIVER_STDERR_DUPLICATE_FILENAME"); getenv("AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
if (!stderr_duplicate_filename) if (!stderr_duplicate_filename) return;
return;
FILE *stderr_duplicate_stream = FILE *stderr_duplicate_stream =
freopen(stderr_duplicate_filename, "a+", stderr); freopen(stderr_duplicate_filename, "a+", stderr);
if (!stderr_duplicate_stream) { if (!stderr_duplicate_stream) {
fprintf( fprintf(
stderr, stderr,
"Failed to duplicate stderr to AFL_DRIVER_STDERR_DUPLICATE_FILENAME"); "Failed to duplicate stderr to AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
abort(); abort();
} }
output_file = stderr_duplicate_stream; output_file = stderr_duplicate_stream;
} }
// Most of these I/O functions were inspired by/copied from libFuzzer's code. // Most of these I/O functions were inspired by/copied from libFuzzer's code.
static void discard_output(int fd) { static void discard_output(int fd) {
FILE *temp = fopen("/dev/null", "w"); FILE *temp = fopen("/dev/null", "w");
if (!temp) if (!temp) abort();
abort();
dup2(fileno(temp), fd); dup2(fileno(temp), fd);
fclose(temp); fclose(temp);
} }
static void close_stdout() { discard_output(STDOUT_FILENO); } static void close_stdout() {
discard_output(STDOUT_FILENO);
}
// Prevent the targeted code from writing to "stderr" but allow sanitizers and // Prevent the targeted code from writing to "stderr" but allow sanitizers and
// this driver to do so. // this driver to do so.
static void dup_and_close_stderr() { static void dup_and_close_stderr() {
int output_fileno = fileno(output_file); int output_fileno = fileno(output_file);
int output_fd = dup(output_fileno); int output_fd = dup(output_fileno);
if (output_fd <= 0) if (output_fd <= 0) abort();
abort();
FILE *new_output_file = fdopen(output_fd, "w"); FILE *new_output_file = fdopen(output_fd, "w");
if (!new_output_file) if (!new_output_file) abort();
abort(); if (!__sanitizer_set_report_fd) return;
if (!__sanitizer_set_report_fd) __sanitizer_set_report_fd((void *)output_fd);
return;
__sanitizer_set_report_fd((void*)output_fd);
discard_output(output_fileno); discard_output(output_fileno);
} }
// Close stdout and/or stderr if user asks for it. // Close stdout and/or stderr if user asks for it.
static void maybe_close_fd_mask() { static void maybe_close_fd_mask() {
char *fd_mask_str = getenv("AFL_DRIVER_CLOSE_FD_MASK"); char *fd_mask_str = getenv("AFL_DRIVER_CLOSE_FD_MASK");
if (!fd_mask_str) if (!fd_mask_str) return;
return;
int fd_mask = atoi(fd_mask_str); int fd_mask = atoi(fd_mask_str);
if (fd_mask & 2) if (fd_mask & 2) dup_and_close_stderr();
dup_and_close_stderr(); if (fd_mask & 1) close_stdout();
if (fd_mask & 1)
close_stdout();
} }
// Define LLVMFuzzerMutate to avoid link failures for targets that use it // Define LLVMFuzzerMutate to avoid link failures for targets that use it
// with libFuzzer's LLVMFuzzerCustomMutator. // with libFuzzer's LLVMFuzzerCustomMutator.
size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) { size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
//assert(false && "LLVMFuzzerMutate should not be called from afl_driver");
// assert(false && "LLVMFuzzerMutate should not be called from afl_driver");
return 0; return 0;
} }
// Execute any files provided as parameters. // Execute any files provided as parameters.
static int ExecuteFilesOnyByOne(int argc, char **argv) { static int ExecuteFilesOnyByOne(int argc, char **argv) {
unsigned char *buf = malloc(MAX_FILE); unsigned char *buf = malloc(MAX_FILE);
for (int i = 1; i < argc; i++) { for (int i = 1; i < argc; i++) {
int fd = open(argv[i], O_RDONLY); int fd = open(argv[i], O_RDONLY);
if (fd == -1) continue; if (fd == -1) continue;
ssize_t length = read(fd, buf, MAX_FILE); ssize_t length = read(fd, buf, MAX_FILE);
if (length > 0) { if (length > 0) {
printf("Reading %zu bytes from %s\n", length, argv[i]); printf("Reading %zu bytes from %s\n", length, argv[i]);
LLVMFuzzerTestOneInput(buf, length); LLVMFuzzerTestOneInput(buf, length);
printf("Execution successful.\n"); printf("Execution successful.\n");
} }
} }
free(buf); free(buf);
return 0; return 0;
} }
int main(int argc, char **argv) { int main(int argc, char **argv) {
printf( printf(
"======================= INFO =========================\n" "======================= INFO =========================\n"
"This binary is built for AFL-fuzz.\n" "This binary is built for AFL-fuzz.\n"
@ -226,36 +252,39 @@ int main(int argc, char **argv) {
"afl-fuzz will run N iterations before " "afl-fuzz will run N iterations before "
"re-spawning the process (default: 1000)\n" "re-spawning the process (default: 1000)\n"
"======================================================\n", "======================================================\n",
argv[0], argv[0], argv[0]); argv[0], argv[0], argv[0]);
output_file = stderr; output_file = stderr;
maybe_duplicate_stderr(); maybe_duplicate_stderr();
maybe_close_fd_mask(); maybe_close_fd_mask();
if (LLVMFuzzerInitialize) if (LLVMFuzzerInitialize) LLVMFuzzerInitialize(&argc, &argv);
LLVMFuzzerInitialize(&argc, &argv);
// Do any other expensive one-time initialization here. // Do any other expensive one-time initialization here.
uint8_t dummy_input[64] = {0}; uint8_t dummy_input[64] = {0};
memcpy(dummy_input, (void*)AFL_PERSISTENT, sizeof(AFL_PERSISTENT)); memcpy(dummy_input, (void *)AFL_PERSISTENT, sizeof(AFL_PERSISTENT));
memcpy(dummy_input + 32, (void*)AFL_DEFER_FORKSVR, sizeof(AFL_DEFER_FORKSVR)); memcpy(dummy_input + 32, (void *)AFL_DEFER_FORKSVR,
sizeof(AFL_DEFER_FORKSVR));
int N = INT_MAX; int N = INT_MAX;
if (argc == 2 && argv[1][0] == '-') if (argc == 2 && argv[1][0] == '-')
N = atoi(argv[1] + 1); N = atoi(argv[1] + 1);
else if(argc == 2 && (N = atoi(argv[1])) > 0) else if (argc == 2 && (N = atoi(argv[1])) > 0)
printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N); printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
else if (argc > 1) { else if (argc > 1) {
// if (!getenv("AFL_DRIVER_DONT_DEFER")) {
__afl_sharedmem_fuzzing = 0; // if (!getenv("AFL_DRIVER_DONT_DEFER")) {
__afl_manual_init();
// } __afl_sharedmem_fuzzing = 0;
__afl_manual_init();
// }
return ExecuteFilesOnyByOne(argc, argv); return ExecuteFilesOnyByOne(argc, argv);
exit(0); exit(0);
} }
assert(N > 0); assert(N > 0);
// if (!getenv("AFL_DRIVER_DONT_DEFER")) // if (!getenv("AFL_DRIVER_DONT_DEFER"))
__afl_manual_init(); __afl_manual_init();
// Call LLVMFuzzerTestOneInput here so that coverage caused by initialization // Call LLVMFuzzerTestOneInput here so that coverage caused by initialization
@ -264,17 +293,26 @@ int main(int argc, char **argv) {
int num_runs = 0; int num_runs = 0;
while (__afl_persistent_loop(N)) { while (__afl_persistent_loop(N)) {
#ifdef _DEBUG #ifdef _DEBUG
fprintf(stderr, "CLIENT crc: %016llx len: %u\n", hash64(__afl_fuzz_ptr, *__afl_fuzz_len, 0xa5b35705), *__afl_fuzz_len); fprintf(stderr, "CLIENT crc: %016llx len: %u\n",
hash64(__afl_fuzz_ptr, *__afl_fuzz_len, 0xa5b35705),
*__afl_fuzz_len);
fprintf(stderr, "RECV:"); fprintf(stderr, "RECV:");
for (int i = 0; i < *__afl_fuzz_len; i++) for (int i = 0; i < *__afl_fuzz_len; i++)
fprintf(stderr, "%02x", __afl_fuzz_ptr[i]); fprintf(stderr, "%02x", __afl_fuzz_ptr[i]);
fprintf(stderr,"\n"); fprintf(stderr, "\n");
#endif #endif
if (*__afl_fuzz_len) { if (*__afl_fuzz_len) {
num_runs++; num_runs++;
LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len); LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len);
} }
} }
printf("%s: successfully executed %d input(s)\n", argv[0], num_runs); printf("%s: successfully executed %d input(s)\n", argv[0], num_runs);
} }

16
examples/aflpp_driver/aflpp_driver_test.c
View File

@ -6,18 +6,20 @@
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
fprintf(stderr, "FUNC crc: %016llx len: %lu\n", hash64((u8*)Data, (unsigned int) Size, (unsigned long long int) 0xa5b35705), Size); fprintf(stderr, "FUNC crc: %016llx len: %lu\n",
hash64((u8 *)Data, (unsigned int)Size,
if (Size < 5) (unsigned long long int)0xa5b35705),
return 0; Size);
if (Size < 5) return 0;
if (Data[0] == 'F') if (Data[0] == 'F')
if (Data[1] == 'A') if (Data[1] == 'A')
if (Data[2] == '$') if (Data[2] == '$')
if (Data[3] == '$') if (Data[3] == '$')
if (Data[4] == '$') if (Data[4] == '$') abort();
abort();
return 0; return 0;
} }

55
src/afl-fuzz-queue.c
View File

@ -139,7 +139,8 @@ static u8 check_if_text(struct queue_entry *q) {
// non-overlong 2-byte // non-overlong 2-byte
if (((0xC2 <= buf[offset + 0] && buf[offset + 0] <= 0xDF) && if (((0xC2 <= buf[offset + 0] && buf[offset + 0] <= 0xDF) &&
(0x80 <= buf[offset + 1] && buf[offset + 1] <= 0xBF))) { (0x80 <= buf[offset + 1] && buf[offset + 1] <= 0xBF)) &&
len - offset > 1) {
offset += 2; offset += 2;
utf8++; utf8++;
@ -149,18 +150,19 @@ static u8 check_if_text(struct queue_entry *q) {
} }
// excluding overlongs // excluding overlongs
if ((buf[offset + 0] == 0xE0 && if ((len - offset > 2) &&
(0xA0 <= buf[offset + 1] && buf[offset + 1] <= 0xBF) && ((buf[offset + 0] == 0xE0 &&
(0x80 <= buf[offset + 2] && (0xA0 <= buf[offset + 1] && buf[offset + 1] <= 0xBF) &&
buf[offset + 2] <= 0xBF)) || // straight 3-byte (0x80 <= buf[offset + 2] &&
(((0xE1 <= buf[offset + 0] && buf[offset + 0] <= 0xEC) || buf[offset + 2] <= 0xBF)) || // straight 3-byte
buf[offset + 0] == 0xEE || buf[offset + 0] == 0xEF) && (((0xE1 <= buf[offset + 0] && buf[offset + 0] <= 0xEC) ||
(0x80 <= buf[offset + 1] && buf[offset + 1] <= 0xBF) && buf[offset + 0] == 0xEE || buf[offset + 0] == 0xEF) &&
(0x80 <= buf[offset + 2] && (0x80 <= buf[offset + 1] && buf[offset + 1] <= 0xBF) &&
buf[offset + 2] <= 0xBF)) || // excluding surrogates (0x80 <= buf[offset + 2] &&
(buf[offset + 0] == 0xED && buf[offset + 2] <= 0xBF)) || // excluding surrogates
(0x80 <= buf[offset + 1] && buf[offset + 1] <= 0x9F) && (buf[offset + 0] == 0xED &&
(0x80 <= buf[offset + 2] && buf[offset + 2] <= 0xBF))) { (0x80 <= buf[offset + 1] && buf[offset + 1] <= 0x9F) &&
(0x80 <= buf[offset + 2] && buf[offset + 2] <= 0xBF)))) {
offset += 3; offset += 3;
utf8++; utf8++;
@ -170,19 +172,20 @@ static u8 check_if_text(struct queue_entry *q) {
} }
// planes 1-3 // planes 1-3
if ((buf[offset + 0] == 0xF0 && if ((len - offset > 3) &&
(0x90 <= buf[offset + 1] && buf[offset + 1] <= 0xBF) && ((buf[offset + 0] == 0xF0 &&
(0x80 <= buf[offset + 2] && buf[offset + 2] <= 0xBF) && (0x90 <= buf[offset + 1] && buf[offset + 1] <= 0xBF) &&
(0x80 <= buf[offset + 3] && (0x80 <= buf[offset + 2] && buf[offset + 2] <= 0xBF) &&
buf[offset + 3] <= 0xBF)) || // planes 4-15 (0x80 <= buf[offset + 3] &&
((0xF1 <= buf[offset + 0] && buf[offset + 0] <= 0xF3) && buf[offset + 3] <= 0xBF)) || // planes 4-15
(0x80 <= buf[offset + 1] && buf[offset + 1] <= 0xBF) && ((0xF1 <= buf[offset + 0] && buf[offset + 0] <= 0xF3) &&
(0x80 <= buf[offset + 2] && buf[offset + 2] <= 0xBF) && (0x80 <= buf[offset + 1] && buf[offset + 1] <= 0xBF) &&
(0x80 <= buf[offset + 3] && buf[offset + 3] <= 0xBF)) || // plane 16 (0x80 <= buf[offset + 2] && buf[offset + 2] <= 0xBF) &&
(buf[offset + 0] == 0xF4 && (0x80 <= buf[offset + 3] && buf[offset + 3] <= 0xBF)) || // plane 16
(0x80 <= buf[offset + 1] && buf[offset + 1] <= 0x8F) && (buf[offset + 0] == 0xF4 &&
(0x80 <= buf[offset + 2] && buf[offset + 2] <= 0xBF) && (0x80 <= buf[offset + 1] && buf[offset + 1] <= 0x8F) &&
(0x80 <= buf[offset + 3] && buf[offset + 3] <= 0xBF))) { (0x80 <= buf[offset + 2] && buf[offset + 2] <= 0xBF) &&
(0x80 <= buf[offset + 3] && buf[offset + 3] <= 0xBF)))) {
offset += 4; offset += 4;
utf8++; utf8++;

3
src/afl-fuzz-redqueen.c
View File

@ -269,8 +269,7 @@ static long long strntoll(const char *str, size_t sz, char **end, int base) {
long long ret; long long ret;
const char *beg = str; const char *beg = str;
for (; beg && sz && *beg == ' '; beg++, sz--) for (; beg && sz && *beg == ' '; beg++, sz--) {};
;
if (!sz || sz >= sizeof(buf)) { if (!sz || sz >= sizeof(buf)) {

8
test/test-floatingpoint.c
View File

@ -17,10 +17,10 @@ int main(void) {
int len = __AFL_FUZZ_TESTCASE_LEN; int len = __AFL_FUZZ_TESTCASE_LEN;
if (len != sizeof(float)) return 1; if (len != sizeof(float)) return 1;
/* 15 + 1/2 = 15.5 */ /* 15 + 1/2 = 15.5 */
/* 15 + 1/2 + 1/8 = 15.625 */ /* 15 + 1/2 + 1/8 = 15.625 */
/* 15 + 1/2 + 1/8 + 1/32 = 15.65625 */ /* 15 + 1/2 + 1/8 + 1/32 = 15.65625 */
/* 15 + 1/2 + 1/8 + 1/32 + 1/128 = 15.6640625 */ /* 15 + 1/2 + 1/8 + 1/32 + 1/128 = 15.6640625 */
if ((-*magic == 15.0 + 0.5 + 0.125 + 0.03125 + 0.0078125)) abort(); if ((-*magic == 15.0 + 0.5 + 0.125 + 0.03125 + 0.0078125)) abort();
} }