mirror of
https://github.com/AFLplusplus/AFLplusplus.git
synced 2025-06-06 15:21:32 +00:00
493 lines
10 KiB
C
493 lines
10 KiB
C
/*
|
|
|
|
american fuzzy lop++ - strcmp() / memcmp() CompareCoverage library
|
|
------------------------------------------------------------------
|
|
|
|
Written and maintained by Andrea Fioraldi <andreafioraldi@gmail.com>
|
|
|
|
Copyright 2019-2020 AFLplusplus Project. All rights reserved.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at:
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
This Linux-only companion library allows you to instrument strcmp(),
|
|
memcmp(), and related functions to get compare coverage.
|
|
See README.md for more info.
|
|
|
|
*/
|
|
|
|
#ifndef _GNU_SOURCE
|
|
# define _GNU_SOURCE
|
|
#endif
|
|
#include <dlfcn.h>
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
#include <ctype.h>
|
|
#include <sys/types.h>
|
|
#include <sys/shm.h>
|
|
#include <stdbool.h>
|
|
|
|
#include "types.h"
|
|
#include "config.h"
|
|
|
|
#include "pmparser.h"
|
|
|
|
#ifndef __linux__
|
|
# error "Sorry, this library is Linux-specific for now!"
|
|
#endif /* !__linux__ */
|
|
|
|
/* Change this value to tune the compare coverage */
|
|
|
|
#define MAX_CMP_LENGTH 32
|
|
|
|
static void *__compcov_code_start, *__compcov_code_end;
|
|
|
|
static u8 *__compcov_afl_map;
|
|
|
|
static u32 __compcov_level;
|
|
|
|
static int (*__libc_strcmp)(const char *, const char *);
|
|
static int (*__libc_strncmp)(const char *, const char *, size_t);
|
|
static int (*__libc_strcasecmp)(const char *, const char *);
|
|
static int (*__libc_strncasecmp)(const char *, const char *, size_t);
|
|
static int (*__libc_memcmp)(const void *, const void *, size_t);
|
|
|
|
static int debug_fd = -1;
|
|
|
|
#define MAX_MAPPINGS 1024
|
|
|
|
static struct mapping { void *st, *en; } __compcov_ro[MAX_MAPPINGS];
|
|
|
|
static u32 __compcov_ro_cnt;
|
|
|
|
/* Check an address against the list of read-only mappings. */
|
|
|
|
static u8 __compcov_is_ro(const void *ptr) {
|
|
|
|
u32 i;
|
|
|
|
for (i = 0; i < __compcov_ro_cnt; i++)
|
|
if (ptr >= __compcov_ro[i].st && ptr <= __compcov_ro[i].en) return 1;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
static size_t __strlen2(const char *s1, const char *s2, size_t max_length) {
|
|
|
|
// from https://github.com/googleprojectzero/CompareCoverage
|
|
|
|
size_t len = 0;
|
|
for (; len < max_length && s1[len] != '\0' && s2[len] != '\0'; len++) {}
|
|
return len;
|
|
|
|
}
|
|
|
|
/* Identify the binary boundaries in the memory mapping */
|
|
|
|
static void __compcov_load(void) {
|
|
|
|
__libc_strcmp = dlsym(RTLD_NEXT, "strcmp");
|
|
__libc_strncmp = dlsym(RTLD_NEXT, "strncmp");
|
|
__libc_strcasecmp = dlsym(RTLD_NEXT, "strcasecmp");
|
|
__libc_strncasecmp = dlsym(RTLD_NEXT, "strncasecmp");
|
|
__libc_memcmp = dlsym(RTLD_NEXT, "memcmp");
|
|
|
|
if (getenv("AFL_QEMU_COMPCOV")) { __compcov_level = 1; }
|
|
if (getenv("AFL_COMPCOV_LEVEL")) {
|
|
|
|
__compcov_level = atoi(getenv("AFL_COMPCOV_LEVEL"));
|
|
|
|
}
|
|
|
|
char *id_str = getenv(SHM_ENV_VAR);
|
|
int shm_id;
|
|
|
|
if (id_str) {
|
|
|
|
shm_id = atoi(id_str);
|
|
__compcov_afl_map = shmat(shm_id, NULL, 0);
|
|
|
|
if (__compcov_afl_map == (void *)-1) exit(1);
|
|
|
|
} else {
|
|
|
|
__compcov_afl_map = calloc(1, MAP_SIZE);
|
|
|
|
}
|
|
|
|
if (getenv("AFL_INST_LIBS")) {
|
|
|
|
__compcov_code_start = (void *)0;
|
|
__compcov_code_end = (void *)-1;
|
|
return;
|
|
|
|
}
|
|
|
|
char *bin_name = getenv("AFL_COMPCOV_BINNAME");
|
|
|
|
procmaps_iterator *maps = pmparser_parse(-1);
|
|
procmaps_struct * maps_tmp = NULL;
|
|
|
|
while ((maps_tmp = pmparser_next(maps)) != NULL) {
|
|
|
|
/* If AFL_COMPCOV_BINNAME is not set pick the first executable segment */
|
|
if (!bin_name || strstr(maps_tmp->pathname, bin_name) != NULL) {
|
|
|
|
if (maps_tmp->is_x) {
|
|
|
|
if (!__compcov_code_start) __compcov_code_start = maps_tmp->addr_start;
|
|
if (!__compcov_code_end) __compcov_code_end = maps_tmp->addr_end;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if ((maps_tmp->is_w && !maps_tmp->is_r) || __compcov_ro_cnt == MAX_MAPPINGS)
|
|
continue;
|
|
|
|
__compcov_ro[__compcov_ro_cnt].st = maps_tmp->addr_start;
|
|
__compcov_ro[__compcov_ro_cnt].en = maps_tmp->addr_end;
|
|
++__compcov_ro_cnt;
|
|
|
|
}
|
|
|
|
pmparser_free(maps);
|
|
|
|
}
|
|
|
|
static void __compcov_trace(u64 cur_loc, const u8 *v0, const u8 *v1, size_t n) {
|
|
|
|
size_t i;
|
|
|
|
if (debug_fd != 1) {
|
|
|
|
char debugbuf[4096];
|
|
snprintf(debugbuf, sizeof(debugbuf), "0x%llx %s %s %zu\n", cur_loc,
|
|
v0 == NULL ? "(null)" : (char *)v0,
|
|
v1 == NULL ? "(null)" : (char *)v1, n);
|
|
write(debug_fd, debugbuf, strlen(debugbuf));
|
|
|
|
}
|
|
|
|
for (i = 0; i < n && v0[i] == v1[i]; ++i) {
|
|
|
|
__compcov_afl_map[cur_loc + i]++;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
/* Check an address against the list of read-only mappings. */
|
|
|
|
static u8 __compcov_is_in_bound(const void *ptr) {
|
|
|
|
return ptr >= __compcov_code_start && ptr < __compcov_code_end;
|
|
|
|
}
|
|
|
|
/* Replacements for strcmp(), memcmp(), and so on. Note that these will be used
|
|
only if the target is compiled with -fno-builtins and linked dynamically. */
|
|
|
|
#undef strcmp
|
|
|
|
int strcmp(const char *str1, const char *str2) {
|
|
|
|
void *retaddr = __builtin_return_address(0);
|
|
|
|
if (__compcov_is_in_bound(retaddr) &&
|
|
!(__compcov_level < 2 && !__compcov_is_ro(str1) &&
|
|
!__compcov_is_ro(str2))) {
|
|
|
|
size_t n = __strlen2(str1, str2, MAX_CMP_LENGTH + 1);
|
|
|
|
if (n <= MAX_CMP_LENGTH) {
|
|
|
|
u64 cur_loc = (u64)retaddr;
|
|
cur_loc = (cur_loc >> 4) ^ (cur_loc << 8);
|
|
cur_loc &= MAP_SIZE - 1;
|
|
|
|
__compcov_trace(cur_loc, str1, str2, n);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return __libc_strcmp(str1, str2);
|
|
|
|
}
|
|
|
|
#undef strncmp
|
|
|
|
int strncmp(const char *str1, const char *str2, size_t len) {
|
|
|
|
void *retaddr = __builtin_return_address(0);
|
|
|
|
if (__compcov_is_in_bound(retaddr) &&
|
|
!(__compcov_level < 2 && !__compcov_is_ro(str1) &&
|
|
!__compcov_is_ro(str2))) {
|
|
|
|
size_t n = __strlen2(str1, str2, MAX_CMP_LENGTH + 1);
|
|
n = MIN(n, len);
|
|
|
|
if (n <= MAX_CMP_LENGTH) {
|
|
|
|
u64 cur_loc = (u64)retaddr;
|
|
cur_loc = (cur_loc >> 4) ^ (cur_loc << 8);
|
|
cur_loc &= MAP_SIZE - 1;
|
|
|
|
__compcov_trace(cur_loc, str1, str2, n);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return __libc_strncmp(str1, str2, len);
|
|
|
|
}
|
|
|
|
#undef strcasecmp
|
|
|
|
int strcasecmp(const char *str1, const char *str2) {
|
|
|
|
void *retaddr = __builtin_return_address(0);
|
|
|
|
if (__compcov_is_in_bound(retaddr) &&
|
|
!(__compcov_level < 2 && !__compcov_is_ro(str1) &&
|
|
!__compcov_is_ro(str2))) {
|
|
|
|
/* Fallback to strcmp, maybe improve in future */
|
|
|
|
size_t n = __strlen2(str1, str2, MAX_CMP_LENGTH + 1);
|
|
|
|
if (n <= MAX_CMP_LENGTH) {
|
|
|
|
u64 cur_loc = (u64)retaddr;
|
|
cur_loc = (cur_loc >> 4) ^ (cur_loc << 8);
|
|
cur_loc &= MAP_SIZE - 1;
|
|
|
|
__compcov_trace(cur_loc, str1, str2, n);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return __libc_strcasecmp(str1, str2);
|
|
|
|
}
|
|
|
|
#undef strncasecmp
|
|
|
|
int strncasecmp(const char *str1, const char *str2, size_t len) {
|
|
|
|
void *retaddr = __builtin_return_address(0);
|
|
|
|
if (__compcov_is_in_bound(retaddr) &&
|
|
!(__compcov_level < 2 && !__compcov_is_ro(str1) &&
|
|
!__compcov_is_ro(str2))) {
|
|
|
|
/* Fallback to strncmp, maybe improve in future */
|
|
|
|
size_t n = __strlen2(str1, str2, MAX_CMP_LENGTH + 1);
|
|
n = MIN(n, len);
|
|
|
|
if (n <= MAX_CMP_LENGTH) {
|
|
|
|
u64 cur_loc = (u64)retaddr;
|
|
cur_loc = (cur_loc >> 4) ^ (cur_loc << 8);
|
|
cur_loc &= MAP_SIZE - 1;
|
|
|
|
__compcov_trace(cur_loc, str1, str2, n);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return __libc_strncasecmp(str1, str2, len);
|
|
|
|
}
|
|
|
|
#undef memcmp
|
|
|
|
int memcmp(const void *mem1, const void *mem2, size_t len) {
|
|
|
|
void *retaddr = __builtin_return_address(0);
|
|
|
|
if (__compcov_is_in_bound(retaddr) &&
|
|
!(__compcov_level < 2 && !__compcov_is_ro(mem1) &&
|
|
!__compcov_is_ro(mem2))) {
|
|
|
|
size_t n = len;
|
|
|
|
if (n <= MAX_CMP_LENGTH) {
|
|
|
|
u64 cur_loc = (u64)retaddr;
|
|
cur_loc = (cur_loc >> 4) ^ (cur_loc << 8);
|
|
cur_loc &= MAP_SIZE - 1;
|
|
|
|
__compcov_trace(cur_loc, mem1, mem2, n);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return __libc_memcmp(mem1, mem2, len);
|
|
|
|
}
|
|
|
|
// TODO bcmp
|
|
|
|
/* Common libraries wrappers (from honggfuzz) */
|
|
|
|
/*
|
|
* Apache's httpd wrappers
|
|
*/
|
|
int ap_cstr_casecmp(const char *s1, const char *s2) {
|
|
|
|
return strcasecmp(s1, s2);
|
|
|
|
}
|
|
|
|
int ap_cstr_casecmpn(const char *s1, const char *s2, size_t n) {
|
|
|
|
return strncasecmp(s1, s2, n);
|
|
|
|
}
|
|
|
|
int apr_cstr_casecmp(const char *s1, const char *s2) {
|
|
|
|
return strcasecmp(s1, s2);
|
|
|
|
}
|
|
|
|
int apr_cstr_casecmpn(const char *s1, const char *s2, size_t n) {
|
|
|
|
return strncasecmp(s1, s2, n);
|
|
|
|
}
|
|
|
|
/*
|
|
* *SSL wrappers
|
|
*/
|
|
int CRYPTO_memcmp(const void *m1, const void *m2, size_t len) {
|
|
|
|
return memcmp(m1, m2, len);
|
|
|
|
}
|
|
|
|
int OPENSSL_memcmp(const void *m1, const void *m2, size_t len) {
|
|
|
|
return memcmp(m1, m2, len);
|
|
|
|
}
|
|
|
|
int OPENSSL_strcasecmp(const char *s1, const char *s2) {
|
|
|
|
return strcasecmp(s1, s2);
|
|
|
|
}
|
|
|
|
int OPENSSL_strncasecmp(const char *s1, const char *s2, size_t len) {
|
|
|
|
return strncasecmp(s1, s2, len);
|
|
|
|
}
|
|
|
|
int32_t memcmpct(const void *s1, const void *s2, size_t len) {
|
|
|
|
return memcmp(s1, s2, len);
|
|
|
|
}
|
|
|
|
/*
|
|
* libXML wrappers
|
|
*/
|
|
int xmlStrncmp(const char *s1, const char *s2, int len) {
|
|
|
|
if (len <= 0) { return 0; }
|
|
if (s1 == s2) { return 0; }
|
|
if (s1 == NULL) { return -1; }
|
|
if (s2 == NULL) { return 1; }
|
|
return strncmp(s1, s2, (size_t)len);
|
|
|
|
}
|
|
|
|
int xmlStrcmp(const char *s1, const char *s2) {
|
|
|
|
if (s1 == s2) { return 0; }
|
|
if (s1 == NULL) { return -1; }
|
|
if (s2 == NULL) { return 1; }
|
|
return strcmp(s1, s2);
|
|
|
|
}
|
|
|
|
int xmlStrEqual(const char *s1, const char *s2) {
|
|
|
|
if (s1 == s2) { return 1; }
|
|
if (s1 == NULL) { return 0; }
|
|
if (s2 == NULL) { return 0; }
|
|
if (strcmp(s1, s2) == 0) { return 1; }
|
|
return 0;
|
|
|
|
}
|
|
|
|
int xmlStrcasecmp(const char *s1, const char *s2) {
|
|
|
|
if (s1 == s2) { return 0; }
|
|
if (s1 == NULL) { return -1; }
|
|
if (s2 == NULL) { return 1; }
|
|
return strcasecmp(s1, s2);
|
|
|
|
}
|
|
|
|
int xmlStrncasecmp(const char *s1, const char *s2, int len) {
|
|
|
|
if (len <= 0) { return 0; }
|
|
if (s1 == s2) { return 0; }
|
|
if (s1 == NULL) { return -1; }
|
|
if (s2 == NULL) { return 1; }
|
|
return strncasecmp(s1, s2, (size_t)len);
|
|
|
|
}
|
|
|
|
const char *xmlStrcasestr(const char *haystack, const char *needle) {
|
|
|
|
if (haystack == NULL) { return NULL; }
|
|
if (needle == NULL) { return NULL; }
|
|
return strcasestr(haystack, needle);
|
|
|
|
}
|
|
|
|
/*
|
|
* Samba wrappers
|
|
*/
|
|
int memcmp_const_time(const void *s1, const void *s2, size_t n) {
|
|
|
|
return memcmp(s1, s2, n);
|
|
|
|
}
|
|
|
|
bool strcsequal(const void *s1, const void *s2) {
|
|
|
|
if (s1 == s2) { return true; }
|
|
if (!s1 || !s2) { return false; }
|
|
return (strcmp(s1, s2) == 0);
|
|
|
|
}
|
|
|
|
/* Init code to open init the library. */
|
|
|
|
__attribute__((constructor)) void __compcov_init(void) {
|
|
|
|
if (getenv("AFL_QEMU_COMPCOV_DEBUG") != NULL)
|
|
debug_fd =
|
|
open("compcov.debug", O_WRONLY | O_CREAT | O_TRUNC | O_SYNC, 0644);
|
|
|
|
__compcov_load();
|
|
|
|
}
|
|
|