fix oob reads, code-format
MODIFY
examples/aflpp_driver/aflpp_driver.c
examples/aflpp_driver/aflpp_driver.c
@@ -14,12 +14,15 @@ cat << EOF > test_fuzzer.cc
#include <stddef.h>
#include <stdint.h>
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+
if (size > 0 && data[0] == 'H')
if (size > 1 && data[1] == 'I')
if (size > 2 && data[2] == '!')
__builtin_trap();
return 0;
+
}
+
EOF
# Build your target with -fsanitize-coverage=trace-pc-guard using fresh clang.
clang -g -fsanitize-coverage=trace-pc-guard test_fuzzer.cc -c
@@ -122,98 +125,121 @@ static FILE *output_file;
// Experimental feature to use afl_driver without AFL's deferred mode.
// Needs to run before __afl_auto_init.
__attribute__((constructor(0))) static void __decide_deferred_forkserver(void) {
+
if (getenv("AFL_DRIVER_DONT_DEFER")) {
+
if (unsetenv("__AFL_DEFER_FORKSRV")) {
+
perror("Failed to unset __AFL_DEFER_FORKSRV");
abort();
+
}
+
}
+
}
// If the user asks us to duplicate stderr, then do it.
static void maybe_duplicate_stderr() {
+
char *stderr_duplicate_filename =
getenv("AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
- if (!stderr_duplicate_filename)
- return;
+ if (!stderr_duplicate_filename) return;
FILE *stderr_duplicate_stream =
freopen(stderr_duplicate_filename, "a+", stderr);
if (!stderr_duplicate_stream) {
+
fprintf(
stderr,
"Failed to duplicate stderr to AFL_DRIVER_STDERR_DUPLICATE_FILENAME");
abort();
+
}
+
output_file = stderr_duplicate_stream;
+
}
// Most of these I/O functions were inspired by/copied from libFuzzer's code.
static void discard_output(int fd) {
+
FILE *temp = fopen("/dev/null", "w");
- if (!temp)
- abort();
+ if (!temp) abort();
dup2(fileno(temp), fd);
fclose(temp);
+
}
-static void close_stdout() { discard_output(STDOUT_FILENO); }
+static void close_stdout() {
+
+ discard_output(STDOUT_FILENO);
+
+}
// Prevent the targeted code from writing to "stderr" but allow sanitizers and
// this driver to do so.
static void dup_and_close_stderr() {
+
int output_fileno = fileno(output_file);
int output_fd = dup(output_fileno);
- if (output_fd <= 0)
- abort();
+ if (output_fd <= 0) abort();
FILE *new_output_file = fdopen(output_fd, "w");
- if (!new_output_file)
- abort();
- if (!__sanitizer_set_report_fd)
- return;
+ if (!new_output_file) abort();
+ if (!__sanitizer_set_report_fd) return;
__sanitizer_set_report_fd((void *)output_fd);
discard_output(output_fileno);
+
}
// Close stdout and/or stderr if user asks for it.
static void maybe_close_fd_mask() {
+
char *fd_mask_str = getenv("AFL_DRIVER_CLOSE_FD_MASK");
- if (!fd_mask_str)
- return;
+ if (!fd_mask_str) return;
int fd_mask = atoi(fd_mask_str);
- if (fd_mask & 2)
- dup_and_close_stderr();
- if (fd_mask & 1)
- close_stdout();
+ if (fd_mask & 2) dup_and_close_stderr();
+ if (fd_mask & 1) close_stdout();
+
}
// Define LLVMFuzzerMutate to avoid link failures for targets that use it
// with libFuzzer's LLVMFuzzerCustomMutator.
size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
+
// assert(false && "LLVMFuzzerMutate should not be called from afl_driver");
return 0;
+
}
// Execute any files provided as parameters.
static int ExecuteFilesOnyByOne(int argc, char **argv) {
+
unsigned char *buf = malloc(MAX_FILE);
for (int i = 1; i < argc; i++) {
+
int fd = open(argv[i], O_RDONLY);
if (fd == -1) continue;
ssize_t length = read(fd, buf, MAX_FILE);
if (length > 0) {
+
printf("Reading %zu bytes from %s\n", length, argv[i]);
LLVMFuzzerTestOneInput(buf, length);
printf("Execution successful.\n");
+
}
+
}
+
free(buf);
return 0;
+
}
int main(int argc, char **argv) {
+
printf(
"======================= INFO =========================\n"
"This binary is built for AFL-fuzz.\n"
@@ -231,26 +257,29 @@ int main(int argc, char **argv) {
output_file = stderr;
maybe_duplicate_stderr();
maybe_close_fd_mask();
- if (LLVMFuzzerInitialize)
- LLVMFuzzerInitialize(&argc, &argv);
+ if (LLVMFuzzerInitialize) LLVMFuzzerInitialize(&argc, &argv);
// Do any other expensive one-time initialization here.
uint8_t dummy_input[64] = {0};
memcpy(dummy_input, (void *)AFL_PERSISTENT, sizeof(AFL_PERSISTENT));
- memcpy(dummy_input + 32, (void*)AFL_DEFER_FORKSVR, sizeof(AFL_DEFER_FORKSVR));
+ memcpy(dummy_input + 32, (void *)AFL_DEFER_FORKSVR,
+ sizeof(AFL_DEFER_FORKSVR));
int N = INT_MAX;
if (argc == 2 && argv[1][0] == '-')
N = atoi(argv[1] + 1);
else if (argc == 2 && (N = atoi(argv[1])) > 0)
printf("WARNING: using the deprecated call style `%s %d`\n", argv[0], N);
else if (argc > 1) {
+
// if (!getenv("AFL_DRIVER_DONT_DEFER")) {
+
__afl_sharedmem_fuzzing = 0;
__afl_manual_init();
// }
return ExecuteFilesOnyByOne(argc, argv);
exit(0);
+
}
assert(N > 0);
@@ -264,17 +293,26 @@ int main(int argc, char **argv) {
int num_runs = 0;
while (__afl_persistent_loop(N)) {
+
#ifdef _DEBUG
- fprintf(stderr, "CLIENT crc: %016llx len: %u\n", hash64(__afl_fuzz_ptr, *__afl_fuzz_len, 0xa5b35705), *__afl_fuzz_len);
+ fprintf(stderr, "CLIENT crc: %016llx len: %u\n",
+ hash64(__afl_fuzz_ptr, *__afl_fuzz_len, 0xa5b35705),
+ *__afl_fuzz_len);
fprintf(stderr, "RECV:");
for (int i = 0; i < *__afl_fuzz_len; i++)
fprintf(stderr, "%02x", __afl_fuzz_ptr[i]);
fprintf(stderr, "\n");
#endif
if (*__afl_fuzz_len) {
+
num_runs++;
LLVMFuzzerTestOneInput(__afl_fuzz_ptr, *__afl_fuzz_len);
+
}
+
}
+
printf("%s: successfully executed %d input(s)\n", argv[0], num_runs);
+
}
+

MODIFY
examples/aflpp_driver/aflpp_driver_test.c
examples/aflpp_driver/aflpp_driver_test.c
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
- fprintf(stderr, "FUNC crc: %016llx len: %lu\n", hash64((u8*)Data, (unsigned int) Size, (unsigned long long int) 0xa5b35705), Size);
+ fprintf(stderr, "FUNC crc: %016llx len: %lu\n",
+ hash64((u8 *)Data, (unsigned int)Size,
+ (unsigned long long int)0xa5b35705),
+ Size);
- if (Size < 5)
- return 0;
+ if (Size < 5) return 0;
if (Data[0] == 'F')
if (Data[1] == 'A')
if (Data[2] == '$')
if (Data[3] == '$')
- if (Data[4] == '$')
- abort();
+ if (Data[4] == '$') abort();
return 0;
}
+

MODIFY
src/afl-fuzz-queue.c
src/afl-fuzz-queue.c
@@ -139,7 +139,8 @@ static u8 check_if_text(struct queue_entry *q) {
// non-overlong 2-byte
if (((0xC2 <= buf[offset + 0] && buf[offset + 0] <= 0xDF) &&
- (0x80 <= buf[offset + 1] && buf[offset + 1] <= 0xBF))) {
+ (0x80 <= buf[offset + 1] && buf[offset + 1] <= 0xBF)) &&
+ len - offset > 1) {
offset += 2;
utf8++;
@@ -149,7 +150,8 @@ static u8 check_if_text(struct queue_entry *q) {
}
// excluding overlongs
- if ((buf[offset + 0] == 0xE0 &&
+ if ((len - offset > 2) &&
+ ((buf[offset + 0] == 0xE0 &&
(0xA0 <= buf[offset + 1] && buf[offset + 1] <= 0xBF) &&
(0x80 <= buf[offset + 2] &&
buf[offset + 2] <= 0xBF)) || // straight 3-byte
@@ -160,7 +162,7 @@ static u8 check_if_text(struct queue_entry *q) {
buf[offset + 2] <= 0xBF)) || // excluding surrogates
(buf[offset + 0] == 0xED &&
(0x80 <= buf[offset + 1] && buf[offset + 1] <= 0x9F) &&
- (0x80 <= buf[offset + 2] && buf[offset + 2] <= 0xBF))) {
+ (0x80 <= buf[offset + 2] && buf[offset + 2] <= 0xBF)))) {
offset += 3;
utf8++;
@@ -170,7 +172,8 @@ static u8 check_if_text(struct queue_entry *q) {
}
// planes 1-3
- if ((buf[offset + 0] == 0xF0 &&
+ if ((len - offset > 3) &&
+ ((buf[offset + 0] == 0xF0 &&
(0x90 <= buf[offset + 1] && buf[offset + 1] <= 0xBF) &&
(0x80 <= buf[offset + 2] && buf[offset + 2] <= 0xBF) &&
(0x80 <= buf[offset + 3] &&
@@ -182,7 +185,7 @@ static u8 check_if_text(struct queue_entry *q) {
(buf[offset + 0] == 0xF4 &&
(0x80 <= buf[offset + 1] && buf[offset + 1] <= 0x8F) &&
(0x80 <= buf[offset + 2] && buf[offset + 2] <= 0xBF) &&
- (0x80 <= buf[offset + 3] && buf[offset + 3] <= 0xBF))) {
+ (0x80 <= buf[offset + 3] && buf[offset + 3] <= 0xBF)))) {
offset += 4;
utf8++;

MODIFY
src/afl-fuzz-redqueen.c
src/afl-fuzz-redqueen.c
@@ -269,8 +269,7 @@ static long long strntoll(const char *str, size_t sz, char **end, int base) {
long long ret;
const char *beg = str;
- for (; beg && sz && *beg == ' '; beg++, sz--)
- ;
+ for (; beg && sz && *beg == ' '; beg++, sz--) {};
if (!sz || sz >= sizeof(buf)) {

fix oob reads, code-format