aboutsummaryrefslogtreecommitdiff
path: root/src/afl-fuzz-python.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/afl-fuzz-python.c')
-rw-r--r--src/afl-fuzz-python.c130
1 files changed, 86 insertions, 44 deletions
diff --git a/src/afl-fuzz-python.c b/src/afl-fuzz-python.c
index d3027d2b..12c3a09d 100644
--- a/src/afl-fuzz-python.c
+++ b/src/afl-fuzz-python.c
@@ -29,19 +29,28 @@
#ifdef USE_PYTHON
static void *unsupported(afl_state_t *afl, unsigned int seed) {
+
FATAL("Python Mutator cannot be called twice yet");
return NULL;
+
}
-size_t fuzz_py(void *py_mutator, u8 **buf, size_t buf_size, u8 *add_buf,
- size_t add_buf_size, size_t max_size) {
+/* sorry for this makro...
+it just fills in `&py_mutator->something_buf, &py_mutator->something_size`. */
+#define BUF_PARAMS(name) \
+ (void **)&((py_mutator_t *)py_mutator)->name##_buf, \
+ &((py_mutator_t *)py_mutator)->name##_size
+
+size_t fuzz_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf,
+ u8 *add_buf, size_t add_buf_size, size_t max_size) {
size_t mutated_size;
PyObject *py_args, *py_value;
py_args = PyTuple_New(3);
+ py_mutator_t *py = (py_mutator_t *)py_mutator;
/* buf */
- py_value = PyByteArray_FromStringAndSize(*buf, buf_size);
+ py_value = PyByteArray_FromStringAndSize(buf, buf_size);
if (!py_value) {
Py_DECREF(py_args);
@@ -77,29 +86,29 @@ size_t fuzz_py(void *py_mutator, u8 **buf, size_t buf_size, u8 *add_buf,
PyTuple_SetItem(py_args, 2, py_value);
- py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_FUZZ], py_args);
+ py_value = PyObject_CallObject(py->py_functions[PY_FUNC_FUZZ], py_args);
Py_DECREF(py_args);
if (py_value != NULL) {
mutated_size = PyByteArray_Size(py_value);
- if (buf_size < mutated_size) *buf = ck_realloc(*buf, mutated_size);
- memcpy(*buf, PyByteArray_AsString(py_value), mutated_size);
+ *out_buf = ck_maybe_grow(BUF_PARAMS(fuzz), mutated_size);
+
+ memcpy(*out_buf, PyByteArray_AsString(py_value), mutated_size);
Py_DECREF(py_value);
return mutated_size;
} else {
PyErr_Print();
- FATAL("Call failed");
+ FATAL("python custom fuzz: call failed");
}
}
-
static py_mutator_t *init_py_module(afl_state_t *afl, u8 *module_name) {
if (!module_name) return NULL;
@@ -124,8 +133,8 @@ static py_mutator_t *init_py_module(afl_state_t *afl, u8 *module_name) {
if (py_module != NULL) {
u8 py_notrim = 0, py_idx;
+ /* init, required */
py_functions[PY_FUNC_INIT] = PyObject_GetAttrString(py_module, "init");
- py_functions[PY_FUNC_DEINIT] = PyObject_GetAttrString(py_module, "deinit");
py_functions[PY_FUNC_FUZZ] = PyObject_GetAttrString(py_module, "fuzz");
py_functions[PY_FUNC_PRE_SAVE] =
PyObject_GetAttrString(py_module, "pre_save");
@@ -142,6 +151,7 @@ static py_mutator_t *init_py_module(afl_state_t *afl, u8 *module_name) {
PyObject_GetAttrString(py_module, "queue_get");
py_functions[PY_FUNC_QUEUE_NEW_ENTRY] =
PyObject_GetAttrString(py_module, "queue_new_entry");
+ py_functions[PY_FUNC_DEINIT] = PyObject_GetAttrString(py_module, "deinit");
for (py_idx = 0; py_idx < PY_FUNC_COUNT; ++py_idx) {
@@ -223,7 +233,8 @@ void finalize_py_module(void *py_mutator) {
}
-static void init_py(afl_state_t *afl, py_mutator_t *py_mutator, unsigned int seed) {
+static void init_py(afl_state_t *afl, py_mutator_t *py_mutator,
+ unsigned int seed) {
PyObject *py_args, *py_value;
@@ -244,7 +255,8 @@ static void init_py(afl_state_t *afl, py_mutator_t *py_mutator, unsigned int see
PyTuple_SetItem(py_args, 0, py_value);
- py_value = PyObject_CallObject(py_mutator->py_functions[PY_FUNC_INIT], py_args);
+ py_value =
+ PyObject_CallObject(py_mutator->py_functions[PY_FUNC_INIT], py_args);
Py_DECREF(py_args);
@@ -283,15 +295,16 @@ void deinit_py(void *py_mutator) {
void load_custom_mutator_py(afl_state_t *afl, char *module_name) {
afl->mutator = ck_alloc(sizeof(struct custom_mutator));
+ afl->mutator->pre_save_buf = NULL;
+ afl->mutator->pre_save_size = 0;
afl->mutator->name = module_name;
ACTF("Loading Python mutator library from '%s'...", module_name);
py_mutator_t *py_mutator;
py_mutator = init_py_module(afl, module_name);
- if (!py_mutator) {
- FATAL("Failed to load python mutator.");
- }
+ afl->mutator->data = py_mutator;
+ if (!py_mutator) { FATAL("Failed to load python mutator."); }
PyObject **py_functions = py_mutator->py_functions;
@@ -334,44 +347,50 @@ void load_custom_mutator_py(afl_state_t *afl, char *module_name) {
}
-
size_t pre_save_py(void *py_mutator, u8 *buf, size_t buf_size, u8 **out_buf) {
- size_t out_buf_size;
- PyObject *py_args, *py_value;
+ size_t py_out_buf_size;
+ PyObject * py_args, *py_value;
+ py_mutator_t *py = (py_mutator_t *)py_mutator;
+
py_args = PyTuple_New(1);
py_value = PyByteArray_FromStringAndSize(buf, buf_size);
if (!py_value) {
Py_DECREF(py_args);
- FATAL("Failed to convert arguments");
+ FATAL("Failed to convert arguments in custom pre_save");
}
PyTuple_SetItem(py_args, 0, py_value);
- py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_PRE_SAVE], py_args);
+ py_value = PyObject_CallObject(
+ ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_PRE_SAVE], py_args);
Py_DECREF(py_args);
if (py_value != NULL) {
- out_buf_size = PyByteArray_Size(py_value);
- *out_buf = malloc(out_buf_size);
- memcpy(*out_buf, PyByteArray_AsString(py_value), out_buf_size);
+ py_out_buf_size = PyByteArray_Size(py_value);
+
+ ck_maybe_grow(BUF_PARAMS(pre_save), py_out_buf_size);
+
+ memcpy(py->pre_save_buf, PyByteArray_AsString(py_value), py_out_buf_size);
Py_DECREF(py_value);
- return out_buf_size;
+
+ *out_buf = py->pre_save_buf;
+ return py_out_buf_size;
} else {
PyErr_Print();
- FATAL("Call failed");
+ FATAL("Python custom mutator: pre_save call failed.");
}
}
-u32 init_trim_py(void *py_mutator, u8 *buf, size_t buf_size) {
+s32 init_trim_py(void *py_mutator, u8 *buf, size_t buf_size) {
PyObject *py_args, *py_value;
@@ -386,7 +405,8 @@ u32 init_trim_py(void *py_mutator, u8 *buf, size_t buf_size) {
PyTuple_SetItem(py_args, 0, py_value);
- py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_INIT_TRIM], py_args);
+ py_value = PyObject_CallObject(
+ ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_INIT_TRIM], py_args);
Py_DECREF(py_args);
if (py_value != NULL) {
@@ -408,7 +428,7 @@ u32 init_trim_py(void *py_mutator, u8 *buf, size_t buf_size) {
}
-u32 post_trim_py(void *py_mutator, u8 success) {
+s32 post_trim_py(void *py_mutator, u8 success) {
PyObject *py_args, *py_value;
@@ -424,7 +444,8 @@ u32 post_trim_py(void *py_mutator, u8 success) {
PyTuple_SetItem(py_args, 0, py_value);
- py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_POST_TRIM], py_args);
+ py_value = PyObject_CallObject(
+ ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_POST_TRIM], py_args);
Py_DECREF(py_args);
if (py_value != NULL) {
@@ -446,19 +467,21 @@ u32 post_trim_py(void *py_mutator, u8 success) {
}
-void trim_py(void *py_mutator, u8 **out_buf, size_t *out_buf_size) {
+size_t trim_py(void *py_mutator, u8 **out_buf) {
PyObject *py_args, *py_value;
+ size_t ret;
py_args = PyTuple_New(0);
- py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_TRIM], py_args);
+ py_value = PyObject_CallObject(
+ ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_TRIM], py_args);
Py_DECREF(py_args);
if (py_value != NULL) {
- *out_buf_size = PyByteArray_Size(py_value);
- *out_buf = malloc(*out_buf_size);
- memcpy(*out_buf, PyByteArray_AsString(py_value), *out_buf_size);
+ ret = PyByteArray_Size(py_value);
+ *out_buf = ck_maybe_grow(BUF_PARAMS(trim), ret);
+ memcpy(*out_buf, PyByteArray_AsString(py_value), ret);
Py_DECREF(py_value);
} else {
@@ -468,17 +491,19 @@ void trim_py(void *py_mutator, u8 **out_buf, size_t *out_buf_size) {
}
+ return ret;
+
}
-size_t havoc_mutation_py(void *py_mutator, u8 **buf, size_t buf_size,
- size_t max_size) {
+size_t havoc_mutation_py(void *py_mutator, u8 *buf, size_t buf_size,
+ u8 **out_buf, size_t max_size) {
size_t mutated_size;
PyObject *py_args, *py_value;
py_args = PyTuple_New(2);
/* buf */
- py_value = PyByteArray_FromStringAndSize(*buf, buf_size);
+ py_value = PyByteArray_FromStringAndSize(buf, buf_size);
if (!py_value) {
Py_DECREF(py_args);
@@ -503,17 +528,28 @@ size_t havoc_mutation_py(void *py_mutator, u8 **buf, size_t buf_size,
PyTuple_SetItem(py_args, 1, py_value);
- py_value =
- PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_HAVOC_MUTATION], py_args);
+ py_value = PyObject_CallObject(
+ ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_HAVOC_MUTATION],
+ py_args);
Py_DECREF(py_args);
if (py_value != NULL) {
mutated_size = PyByteArray_Size(py_value);
- if (buf_size < mutated_size) *buf = ck_realloc(*buf, mutated_size);
+ if (mutated_size <= buf_size) {
- memcpy(*buf, PyByteArray_AsString(py_value), mutated_size);
+ /* We reuse the input buf here. */
+ *out_buf = buf;
+
+ } else {
+
+ /* A new buf is needed... */
+ *out_buf = ck_maybe_grow(BUF_PARAMS(havoc), mutated_size);
+
+ }
+
+ memcpy(*out_buf, PyByteArray_AsString(py_value), mutated_size);
Py_DECREF(py_value);
return mutated_size;
@@ -533,7 +569,9 @@ u8 havoc_mutation_probability_py(void *py_mutator) {
py_args = PyTuple_New(0);
py_value = PyObject_CallObject(
- ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_HAVOC_MUTATION_PROBABILITY], py_args);
+ ((py_mutator_t *)py_mutator)
+ ->py_functions[PY_FUNC_HAVOC_MUTATION_PROBABILITY],
+ py_args);
Py_DECREF(py_args);
if (py_value != NULL) {
@@ -573,7 +611,8 @@ u8 queue_get_py(void *py_mutator, const u8 *filename) {
PyTuple_SetItem(py_args, 0, py_value);
// Call Python function
- py_value = PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_QUEUE_GET], py_args);
+ py_value = PyObject_CallObject(
+ ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_QUEUE_GET], py_args);
Py_DECREF(py_args);
if (py_value != NULL) {
@@ -642,8 +681,9 @@ void queue_new_entry_py(void *py_mutator, const u8 *filename_new_queue,
PyTuple_SetItem(py_args, 1, py_value);
// Call
- py_value =
- PyObject_CallObject(((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_QUEUE_NEW_ENTRY], py_args);
+ py_value = PyObject_CallObject(
+ ((py_mutator_t *)py_mutator)->py_functions[PY_FUNC_QUEUE_NEW_ENTRY],
+ py_args);
Py_DECREF(py_args);
if (py_value == NULL) {
@@ -655,5 +695,7 @@ void queue_new_entry_py(void *py_mutator, const u8 *filename_new_queue,
}
+#undef BUF_PARAMS
+
#endif /* USE_PYTHON */
generated by cgit v1.2.3 (git 2.25.1) at 2026-01-29 02:28:00 +0000