Fixed symcc custom mutator
MODIFY
custom_mutators/symcc/symcc.c
custom_mutators/symcc/symcc.c
+#define _GNU_SOURCE
#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
#include "config.h"
#include "debug.h"
#include "afl-fuzz.h"
@@ -95,33 +98,58 @@ void afl_custom_queue_new_entry(my_mutator_t * data,
const uint8_t *filename_new_queue,
const uint8_t *filename_orig_queue) {
+ int pipefd[2];
+ struct stat st;
+ ACTF("Queueing to symcc: %s", filename_new_queue);
+ u8 *fn = alloc_printf("%s", filename_new_queue);
+ if (!(stat(fn, &st) == 0 && S_ISREG(st.st_mode) && st.st_size)) {
+ PFATAL("Couldn't find enqueued file: %s",fn);
+ }
+
+ if (afl_struct->fsrv.use_stdin){
+ if (pipe(pipefd)==-1)
+ {
+ exit(-1);
+ }
+ }
int pid = fork();
if (pid == -1) return;
- if (pid) pid = waitpid(pid, NULL, 0);
-
- if (pid == 0) {
-
- setenv("SYMCC_INPUT_FILE", afl_struct->fsrv.out_file, 1);
+ if (pid){
if (afl_struct->fsrv.use_stdin){
- u8 *fn = alloc_printf("%s/%s", afl_struct->out_dir, filename_new_queue);
+ close(pipefd[0]);
int fd = open(fn, O_RDONLY);
if (fd >= 0) {
ssize_t r = read(fd, data->mutator_buf, MAX_FILE);
- close(fd);
DBG("fn=%s, fd=%d, size=%ld\n", fn, fd, r);
if (r <= 0) return;
- close(0);
- ck_write(0, data->mutator_buf, r, fn);
- ck_free(fn);
+ close(fd);
+ if (r>fcntl(pipefd[1],F_GETPIPE_SZ)) fcntl(pipefd[1],F_SETPIPE_SZ,MAX_FILE);
+ ck_write(pipefd[1], data->mutator_buf, r, filename_new_queue);
+ } else {
+ PFATAL("Something happened to the enqueued file before sending its contents to symcc binary");
+ }
+ close(pipefd[1]);
+ ck_free(fn);
+ }
+ pid = waitpid(pid,NULL, 0);
}
+ if (pid == 0) {
+ if (afl_struct->fsrv.use_stdin) {
+ unsetenv("SYMCC_INPUT_FILE");
+ close(pipefd[1]);
+ dup2(pipefd[0],0);
+ }
+ else
+ {
+ setenv("SYMCC_INPUT_FILE", afl_struct->fsrv.out_file, 1);
}
DBG("exec=%s\n", data->target);
@@ -129,6 +157,7 @@ void afl_custom_queue_new_entry(my_mutator_t * data,
close(2);
dup2(afl_struct->fsrv.dev_null_fd, 1);
dup2(afl_struct->fsrv.dev_null_fd, 2);
+
execvp(data->target, afl_struct->argv);
DBG("exec=FAIL\n");
exit(-1);
@@ -179,7 +208,7 @@ size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
struct dirent **nl;
int32_t i, done = 0, items = scandir(data->out_dir, &nl, NULL, NULL);
- size_t size = 0;
+ ssize_t size = 0;
if (items <= 0) return 0;
@@ -195,9 +224,9 @@ size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
int fd = open(fn, O_RDONLY);
if (fd >= 0) {
-
size = read(fd, data->mutator_buf, max_size);
*out_buf = data->mutator_buf;
+
close(fd);
done = 1;
@@ -216,7 +245,7 @@ size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size,
free(nl);
DBG("FUZZ size=%lu\n", size);
- return size;
+ return (uint32_t)size;
}

ADD
custom_mutators/symcc/test_examples/file_test.c
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <fcntl.h>
+
+int main(int argc, char** argv){
+ if (argc<2){
+ printf("Need a file argument\n");
+ return 1;
+ }
+ int fd=open(argv[1],O_RDONLY);
+ if (fd<0){
+ printf("Couldn't open file\n");
+ return 1;
+ }
+ uint32_t value = 0;
+
+ read(fd,&value,sizeof(value));
+ close(fd);
+
+ value=value^0xffffffff;
+ if (value== 0x11223344) printf("Value one\n");
+ if (value == 0x44332211) printf("Value two\n");
+ if (value != 0x0) printf("Not zero\n");
+ return 0;
+}

ADD
custom_mutators/symcc/test_examples/stdin_test.c
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+int main(int argc, char** argv)
+{
+ char input_buffer[16];
+ uint32_t comparisonValue;
+ size_t bytesRead;
+ bytesRead=read(STDIN_FILENO,input_buffer, sizeof(input_buffer));
+ if (bytesRead < 0) exit(-1);
+ comparisonValue=*(uint32_t*)input_buffer;
+ comparisonValue=comparisonValue^0xff112233;
+ if (comparisonValue==0x66554493){
+ printf("First value\n");
+ }
+ else{
+ if (comparisonValue==0x84444415) printf("Second value\n");
+ }
+ return 0;
+}

MODIFY
src/afl-fuzz-bitmap.c
src/afl-fuzz-bitmap.c
@@ -584,7 +584,10 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
alloc_printf("%s/queue/id_%06u", afl->out_dir, afl->queued_paths);
#endif /* ^!SIMPLE_FILES */
-
+ fd = open(queue_fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
+ if (unlikely(fd < 0)) { PFATAL("Unable to create '%s'", queue_fn); }
+ ck_write(fd, mem, len, queue_fn);
+ close(fd);
add_to_queue(afl, queue_fn, len, 0);
#ifdef INTROSPECTION
@@ -623,11 +626,6 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) {
}
- fd = open(queue_fn, O_WRONLY | O_CREAT | O_EXCL, 0600);
- if (unlikely(fd < 0)) { PFATAL("Unable to create '%s'", queue_fn); }
- ck_write(fd, mem, len, queue_fn);
- close(fd);
-
if (likely(afl->q_testcase_max_cache_size)) {
queue_testcase_store_mem(afl, afl->queue_top, mem);

Fixed symcc custom mutator