aboutsummaryrefslogtreecommitdiff
path: root/utils/libdislocator
diff options
context:
space:
mode:
authorllzmb <46303940+llzmb@users.noreply.github.com>2021-12-05 19:04:45 +0100
committerllzmb <46303940+llzmb@users.noreply.github.com>2021-12-05 19:40:56 +0100
commitbb506de0b809f97a4221ee1b6e040dcb5f9ca56a (patch)
tree43795b444fccf02e5966d1b6d8411bd4dca5a7cc /utils/libdislocator
parent139db40cfc243d2de4eb1584e41867e5a44a06f9 (diff)
downloadafl++-bb506de0b809f97a4221ee1b6e040dcb5f9ca56a.tar.gz
Fix various missed issues - 1st run
Diffstat (limited to 'utils/libdislocator')
-rw-r--r--utils/libdislocator/README.md29
1 files changed, 14 insertions, 15 deletions
diff --git a/utils/libdislocator/README.md b/utils/libdislocator/README.md
index 64a5f14c..7150c205 100644
--- a/utils/libdislocator/README.md
+++ b/utils/libdislocator/README.md
@@ -10,8 +10,8 @@ heap-related security bugs in several ways:
subsequent PROT_NONE page, causing most off-by-one reads and writes to
immediately segfault,
- - It adds a canary immediately below the allocated buffer, to catch writes
- to negative offsets (won't catch reads, though),
+ - It adds a canary immediately below the allocated buffer, to catch writes to
+ negative offsets (won't catch reads, though),
- It sets the memory returned by malloc() to garbage values, improving the
odds of crashing when the target accesses uninitialized data,
@@ -19,35 +19,34 @@ heap-related security bugs in several ways:
- It sets freed memory to PROT_NONE and does not actually reuse it, causing
most use-after-free bugs to segfault right away,
- - It forces all realloc() calls to return a new address - and sets
- PROT_NONE on the original block. This catches use-after-realloc bugs,
+ - It forces all realloc() calls to return a new address - and sets PROT_NONE
+ on the original block. This catches use-after-realloc bugs,
- - It checks for calloc() overflows and can cause soft or hard failures
- of alloc requests past a configurable memory limit (AFL_LD_LIMIT_MB,
+ - It checks for calloc() overflows and can cause soft or hard failures of
+ alloc requests past a configurable memory limit (AFL_LD_LIMIT_MB,
AFL_LD_HARD_FAIL).
- Optionally, in platforms supporting it, huge pages can be used by passing
USEHUGEPAGE=1 to make.
- - Size alignment to `max_align_t` can be enforced with AFL_ALIGNED_ALLOC=1.
- In this case, a tail canary is inserted in the padding bytes at the end
- of the allocated zone. This reduce the ability of libdislocator to detect
+ - Size alignment to `max_align_t` can be enforced with AFL_ALIGNED_ALLOC=1. In
+ this case, a tail canary is inserted in the padding bytes at the end of the
+ allocated zone. This reduce the ability of libdislocator to detect
off-by-one bugs but also it make slibdislocator compliant to the C standard.
Basically, it is inspired by some of the non-default options available for the
OpenBSD allocator - see malloc.conf(5) on that platform for reference. It is
-also somewhat similar to several other debugging libraries, such as gmalloc
-and DUMA - but is simple, plug-and-play, and designed specifically for fuzzing
-jobs.
+also somewhat similar to several other debugging libraries, such as gmalloc and
+DUMA - but is simple, plug-and-play, and designed specifically for fuzzing jobs.
Note that it does nothing for stack-based memory handling errors. The
-fstack-protector-all setting for GCC / clang, enabled when using AFL_HARDEN,
can catch some subset of that.
The allocator is slow and memory-intensive (even the tiniest allocation uses up
-4 kB of physical memory and 8 kB of virtual mem), making it completely unsuitable
-for "production" uses; but it can be faster and more hassle-free than ASAN / MSAN
-when fuzzing small, self-contained binaries.
+4 kB of physical memory and 8 kB of virtual mem), making it completely
+unsuitable for "production" uses; but it can be faster and more hassle-free than
+ASAN / MSAN when fuzzing small, self-contained binaries.
To use this library, run AFL++ like so: