add afl-fuzz -y fuzz length support
MODIFY
docs/Changelog.md
docs/Changelog.md
@@ -11,6 +11,9 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
### Version ++4.01a (dev)
- fix */build_...sh scripts to work outside of git
- new custom_mutator: libafl with token fuzzing :)
+ - afl-fuzz:
+ - new commandline option -y to set min and max length of generated
+ fuzz inputs
- frida_mode:
- update to new frida release, handles now c++ throw/catch

MODIFY
include/afl-fuzz.h
include/afl-fuzz.h
@@ -726,6 +726,9 @@ typedef struct afl_state {
/* queue entries ready for splicing count (len > 4) */
u32 ready_for_splicing_count;
+ /* min/max length for generated fuzzing inputs */
+ u32 min_length, max_length;
+
/* This is the user specified maximum size to use for the testcase cache */
u64 q_testcase_max_cache_size;
@@ -1090,12 +1093,12 @@ int statsd_format_metric(afl_state_t *afl, char *buff, size_t bufflen);
/* Run */
-fsrv_run_result_t fuzz_run_target(afl_state_t *, afl_forkserver_t *fsrv, u32);
-void write_to_testcase(afl_state_t *, void *, u32);
-u8 calibrate_case(afl_state_t *, struct queue_entry *, u8 *, u32, u8);
void sync_fuzzers(afl_state_t *);
+u32 write_to_testcase(afl_state_t *, void *, u32, u32);
+u8 calibrate_case(afl_state_t *, struct queue_entry *, u8 *, u32, u8);
u8 trim_case(afl_state_t *, struct queue_entry *, u8 *);
u8 common_fuzz_stuff(afl_state_t *, u8 *, u32);
+fsrv_run_result_t fuzz_run_target(afl_state_t *, afl_forkserver_t *fsrv, u32);
/* Fuzz one */

MODIFY
src/afl-fuzz-bitmap.c
src/afl-fuzz-bitmap.c
@@ -633,7 +633,7 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
if (afl->fsrv.exec_tmout < afl->hang_tmout) {
u8 new_fault;
- write_to_testcase(afl, mem, len);
+ len = write_to_testcase(afl, mem, len, 0);
new_fault = fuzz_run_target(afl, &afl->fsrv, afl->hang_tmout);
classify_counts(&afl->fsrv);

MODIFY
src/afl-fuzz-cmplog.c
src/afl-fuzz-cmplog.c
@@ -49,7 +49,7 @@ u8 common_fuzz_cmplog_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
u8 fault;
- write_to_testcase(afl, out_buf, len);
+ len = write_to_testcase(afl, out_buf, len, 0);
fault = fuzz_run_target(afl, &afl->cmplog_fsrv, afl->fsrv.exec_tmout);

MODIFY
src/afl-fuzz-init.c
src/afl-fuzz-init.c
@@ -617,11 +617,10 @@ void read_foreign_testcases(afl_state_t *afl, int first) {
}
- write_to_testcase(afl, mem, st.st_size);
+ u32 len = write_to_testcase(afl, mem, st.st_size, 1);
fault = fuzz_run_target(afl, &afl->fsrv, afl->fsrv.exec_tmout);
afl->syncing_party = foreign_name;
- afl->queued_imported +=
- save_if_interesting(afl, mem, st.st_size, fault);
+ afl->queued_imported += save_if_interesting(afl, mem, len, fault);
afl->syncing_party = 0;
munmap(mem, st.st_size);
close(fd);

MODIFY
src/afl-fuzz-mutators.c
src/afl-fuzz-mutators.c
@@ -428,7 +428,7 @@ u8 trim_case_custom(afl_state_t *afl, struct queue_entry *q, u8 *in_buf,
if (likely(retlen)) {
- write_to_testcase(afl, retbuf, retlen);
+ retlen = write_to_testcase(afl, retbuf, retlen, 0);
fault = fuzz_run_target(afl, &afl->fsrv, afl->fsrv.exec_tmout);
++afl->trim_execs;

MODIFY
src/afl-fuzz-run.c
src/afl-fuzz-run.c
@@ -73,8 +73,8 @@ fuzz_run_target(afl_state_t *afl, afl_forkserver_t *fsrv, u32 timeout) {
old file is unlinked and a new one is created. Otherwise, afl->fsrv.out_fd is
rewound and truncated. */
-void __attribute__((hot))
-write_to_testcase(afl_state_t *afl, void *mem, u32 len) {
+u32 __attribute__((hot))
+write_to_testcase(afl_state_t *afl, void *mem, u32 len, u32 fix) {
#ifdef _AFL_DOCUMENT_MUTATIONS
s32 doc_fd;
@@ -120,16 +120,39 @@ write_to_testcase(afl_state_t *afl, void *mem, u32 len) {
});
+ if (unlikely(new_size < afl->min_length && !fix)) {
+
+ new_size = afl->min_length;
+
+ } else if (unlikely(new_size > afl->max_length)) {
+
+ new_size = afl->max_length;
+
+ }
+
/* everything as planned. use the potentially new data. */
afl_fsrv_write_to_testcase(&afl->fsrv, new_mem, new_size);
+ len = new_size;
} else {
+ if (unlikely(len < afl->min_length && !fix)) {
+
+ len = afl->min_length;
+
+ } else if (unlikely(len > afl->max_length)) {
+
+ len = afl->max_length;
+
+ }
+
/* boring uncustom. */
afl_fsrv_write_to_testcase(&afl->fsrv, mem, len);
}
+ return len;
+
}
/* The same, but with an adjustable gap. Used for trimming. */
@@ -346,7 +369,7 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
/* we need a dummy run if this is LTO + cmplog */
if (unlikely(afl->shm.cmplog_mode)) {
- write_to_testcase(afl, use_mem, q->len);
+ (void)write_to_testcase(afl, use_mem, q->len, 1);
fault = fuzz_run_target(afl, &afl->fsrv, use_tmout);
@@ -389,7 +412,7 @@ u8 calibrate_case(afl_state_t *afl, struct queue_entry *q, u8 *use_mem,
u64 cksum;
- write_to_testcase(afl, use_mem, q->len);
+ (void)write_to_testcase(afl, use_mem, q->len, 1);
fault = fuzz_run_target(afl, &afl->fsrv, use_tmout);
@@ -700,7 +723,7 @@ void sync_fuzzers(afl_state_t *afl) {
/* See what happens. We rely on save_if_interesting() to catch major
errors and save the test case. */
- write_to_testcase(afl, mem, st.st_size);
+ (void)write_to_testcase(afl, mem, st.st_size, 1);
fault = fuzz_run_target(afl, &afl->fsrv, afl->fsrv.exec_tmout);
@@ -943,7 +966,7 @@ common_fuzz_stuff(afl_state_t *afl, u8 *out_buf, u32 len) {
u8 fault;
- write_to_testcase(afl, out_buf, len);
+ len = write_to_testcase(afl, out_buf, len, 0);
fault = fuzz_run_target(afl, &afl->fsrv, afl->fsrv.exec_tmout);

MODIFY
src/afl-fuzz-state.c
src/afl-fuzz-state.c
@@ -102,6 +102,8 @@ void afl_state_init(afl_state_t *afl, uint32_t map_size) {
afl->stats_avg_exec = 0;
afl->skip_deterministic = 1;
afl->cmplog_lvl = 2;
+ afl->min_length = 1;
+ afl->max_length = MAX_FILE;
#ifndef NO_SPLICING
afl->use_splicing = 1;
#endif

MODIFY
src/afl-fuzz.c
src/afl-fuzz.c
@@ -155,6 +155,9 @@ static void usage(u8 *argv0, int more_help) {
"\n"
"Mutator settings:\n"
+ " -y [min-]max - set minimum and maximum length of generated fuzzing "
+ "input.\n"
+ " default: 1-%lu\n"
" -D - enable deterministic fuzzing (once per queue entry)\n"
" -L minutes - use MOpt(imize) mode and set the time limit for "
"entering the\n"
@@ -204,7 +207,7 @@ static void usage(u8 *argv0, int more_help) {
"(0-...)\n"
" -e ext - file extension for the fuzz test input file (if "
"needed)\n\n",
- argv0, EXEC_TIMEOUT, MEM_LIMIT, FOREIGN_SYNCS_MAX);
+ argv0, EXEC_TIMEOUT, MEM_LIMIT, MAX_FILE, FOREIGN_SYNCS_MAX);
if (more_help > 1) {
@@ -529,11 +532,36 @@ int main(int argc, char **argv_orig, char **envp) {
while ((opt = getopt(
argc, argv,
- "+Ab:B:c:CdDe:E:hi:I:f:F:l:L:m:M:nNOXYo:p:RQs:S:t:T:UV:Wx:Z")) >
+ "+Ab:B:c:CdDe:E:hi:I:f:F:l:L:m:M:nNOo:p:RQs:S:t:T:UV:WXx:Yy:Z")) >
0) {
switch (opt) {
+ case 'y': {
+
+ u8 *sep;
+ if (!(sep = strchr(optarg, '-')) && !(sep = strchr(optarg, ':'))) {
+
+ afl->max_length = atoi(optarg);
+
+ } else {
+
+ afl->min_length = atoi(optarg);
+ afl->max_length = atoi(sep + 1);
+
+ }
+
+ if (afl->min_length < 1 || afl->max_length > MAX_FILE ||
+ afl->min_length > afl->max_length) {
+
+ FATAL("Illegal min/max length values: %s", optarg);
+
+ }
+
+ break;
+
+ }
+
case 'Z':
afl->old_seed_selection = 1;
break;
@@ -1622,6 +1650,16 @@ int main(int argc, char **argv_orig, char **envp) {
}
+ OKF("Generating fuzz data with a a length of min=%u max=%u", afl->min_length,
+ afl->max_length);
+ u32 min_alloc = MAX(64U, afl->min_length);
+ afl_realloc(AFL_BUF_PARAM(in_scratch), min_alloc);
+ afl_realloc(AFL_BUF_PARAM(in), min_alloc);
+ afl_realloc(AFL_BUF_PARAM(out_scratch), min_alloc);
+ afl_realloc(AFL_BUF_PARAM(out), min_alloc);
+ afl_realloc(AFL_BUF_PARAM(eff), min_alloc);
+ afl_realloc(AFL_BUF_PARAM(ex), min_alloc);
+
afl->fsrv.use_fauxsrv = afl->non_instrumented_mode == 1 || afl->no_forkserver;
#ifdef __linux__

add afl-fuzz -y fuzz length support