From 166130324898071a08e178dfeb901af44168236e Mon Sep 17 00:00:00 2001 From: van Hauser Date: Tue, 10 Nov 2020 13:43:48 +0100 Subject: fix libfuzzer custom mutator and add introspection function --- custom_mutators/libfuzzer/FuzzerIO.cpp | 7 +++++++ custom_mutators/libfuzzer/FuzzerLoop.cpp | 13 ++++++++++++- custom_mutators/libfuzzer/FuzzerMutate.cpp | 24 ++++++++++++++++++++++-- custom_mutators/libfuzzer/FuzzerMutate.h | 1 + custom_mutators/libfuzzer/Makefile | 5 +++++ custom_mutators/libfuzzer/libfuzzer.cpp | 12 ++++++++++++ 6 files changed, 59 insertions(+), 3 deletions(-) (limited to 'custom_mutators') diff --git a/custom_mutators/libfuzzer/FuzzerIO.cpp b/custom_mutators/libfuzzer/FuzzerIO.cpp index e0c15db4..d8d52b63 100644 --- a/custom_mutators/libfuzzer/FuzzerIO.cpp +++ b/custom_mutators/libfuzzer/FuzzerIO.cpp @@ -83,6 +83,8 @@ void WriteToFile(const std::string &Data, const std::string &Path) { void WriteToFile(const uint8_t *Data, size_t Size, const std::string &Path) { + return; + // Use raw C interface because this function may be called from a sig handler. FILE *Out = fopen(Path.c_str(), "wb"); if (!Out) return; @@ -93,6 +95,8 @@ void WriteToFile(const uint8_t *Data, size_t Size, const std::string &Path) { void AppendToFile(const std::string &Data, const std::string &Path) { + return; + AppendToFile(reinterpret_cast(Data.data()), Data.size(), Path); @@ -100,6 +104,8 @@ void AppendToFile(const std::string &Data, const std::string &Path) { void AppendToFile(const uint8_t *Data, size_t Size, const std::string &Path) { + return; + FILE *Out = fopen(Path.c_str(), "a"); if (!Out) return; fwrite(Data, sizeof(Data[0]), Size, Out); @@ -182,6 +188,7 @@ void Printf(const char *Fmt, ...) { void VPrintf(bool Verbose, const char *Fmt, ...) { + return; if (!Verbose) return; va_list ap; va_start(ap, Fmt); diff --git a/custom_mutators/libfuzzer/FuzzerLoop.cpp b/custom_mutators/libfuzzer/FuzzerLoop.cpp index 201883f0..08fda520 100644 --- a/custom_mutators/libfuzzer/FuzzerLoop.cpp +++ b/custom_mutators/libfuzzer/FuzzerLoop.cpp @@ -206,6 +206,8 @@ void Fuzzer::StaticDeathCallback() { void Fuzzer::DumpCurrentUnit(const char *Prefix) { + return; + if (!CurrentUnitData) return; // Happens when running individual inputs. ScopedDisableMsanInterceptorChecks S; MD.PrintMutationSequence(); @@ -733,6 +735,7 @@ std::string Fuzzer::WriteToOutputCorpus(const Unit &U) { void Fuzzer::WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix) { + return; if (!Options.SaveArtifacts) return; std::string Path = Options.ArtifactPrefix + Prefix + Hash(U); if (!Options.ExactArtifactPath.empty()) @@ -1073,13 +1076,21 @@ void Fuzzer::MinimizeCrashLoop(const Unit &U) { } // namespace fuzzer +#ifdef INTROSPECTION + extern const char *introspection_ptr; +#endif + extern "C" { ATTRIBUTE_INTERFACE size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) { assert(fuzzer::F); - return fuzzer::F->GetMD().DefaultMutate(Data, Size, MaxSize); + size_t r = fuzzer::F->GetMD().DefaultMutate(Data, Size, MaxSize); +#ifdef INTROSPECTION + introspection_ptr = fuzzer::F->GetMD().WriteMutationSequence(); +#endif + return r; } diff --git a/custom_mutators/libfuzzer/FuzzerMutate.cpp b/custom_mutators/libfuzzer/FuzzerMutate.cpp index eebae39b..edfe0455 100644 --- a/custom_mutators/libfuzzer/FuzzerMutate.cpp +++ b/custom_mutators/libfuzzer/FuzzerMutate.cpp @@ -14,6 +14,8 @@ #include "FuzzerMutate.h" #include "FuzzerOptions.h" #include "FuzzerTracePC.h" +#include +#include namespace fuzzer { @@ -100,15 +102,17 @@ size_t MutationDispatcher::Mutate_CustomCrossOver(uint8_t *Data, size_t Size, } + size_t MutationDispatcher::Mutate_ShuffleBytes(uint8_t *Data, size_t Size, size_t MaxSize) { - if (Size > MaxSize || Size == 0) return 0; size_t ShuffleAmount = Rand(std::min(Size, (size_t)8)) + 1; // [1,8] and <= Size. size_t ShuffleStart = Rand(Size - ShuffleAmount); assert(ShuffleStart + ShuffleAmount <= Size); - std::shuffle(Data + ShuffleStart, Data + ShuffleStart + ShuffleAmount, Rand); + unsigned num = std::chrono::system_clock::now().time_since_epoch().count(); + std::shuffle(Data + ShuffleStart, Data + ShuffleStart + ShuffleAmount, std::default_random_engine(num)); + //std::shuffle(Data + ShuffleStart, Data + ShuffleStart + ShuffleAmount, Rand); return Size; } @@ -609,8 +613,24 @@ void MutationDispatcher::PrintRecommendedDictionary() { } +const char *MutationDispatcher::WriteMutationSequence() { + + static std::string buf; + buf = ""; + + for (size_t i = 0; i < CurrentMutatorSequence.size(); i++) { + + buf = buf + " " + CurrentMutatorSequence[i].Name; + + } + + return buf.c_str(); + +} + void MutationDispatcher::PrintMutationSequence(bool Verbose) { + return; Printf("MS: %zd ", CurrentMutatorSequence.size()); size_t EntriesToPrint = Verbose ? CurrentMutatorSequence.size() diff --git a/custom_mutators/libfuzzer/FuzzerMutate.h b/custom_mutators/libfuzzer/FuzzerMutate.h index 37fd6100..6252f265 100644 --- a/custom_mutators/libfuzzer/FuzzerMutate.h +++ b/custom_mutators/libfuzzer/FuzzerMutate.h @@ -26,6 +26,7 @@ public: void StartMutationSequence(); /// Print the current sequence of mutations. Only prints the full sequence /// when Verbose is true. + const char *WriteMutationSequence(); void PrintMutationSequence(bool Verbose = true); /// Return the current sequence of mutations. std::string MutationSequence(); diff --git a/custom_mutators/libfuzzer/Makefile b/custom_mutators/libfuzzer/Makefile index 95402f6c..51263b89 100644 --- a/custom_mutators/libfuzzer/Makefile +++ b/custom_mutators/libfuzzer/Makefile @@ -3,6 +3,11 @@ CFLAGS = -g -O3 -funroll-loops -fPIC -fpermissive -std=c++11 #CFLAGS = -g -O0 -fPIC -fpermissive -std=c++11 CXX ?= clang++ +ifdef INTROSPECTION + $(info Compiling with introspection documentation) + CFLAGS += -DINTROSPECTION=1 +endif + all: libfuzzer-mutator.so FuzzerCrossOver.o: FuzzerCrossOver.cpp diff --git a/custom_mutators/libfuzzer/libfuzzer.cpp b/custom_mutators/libfuzzer/libfuzzer.cpp index 5e37df66..a4f94328 100644 --- a/custom_mutators/libfuzzer/libfuzzer.cpp +++ b/custom_mutators/libfuzzer/libfuzzer.cpp @@ -6,6 +6,10 @@ //#include "debug.h" #include "afl-fuzz.h" +#ifdef INTROSPECTION + const char *introspection_ptr; +#endif + afl_state_t *afl_struct; extern "C" size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize); @@ -133,6 +137,14 @@ extern "C" size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, } +#ifdef INTROSPECTION +extern "C" const char* afl_custom_introspection(my_mutator_t *data) { + + return introspection_ptr; + +} +#endif + /** * Deinitialize everything * -- cgit 1.4.1 From 20a8a93fd193f7526f5e3d0cd1dfa43df9d2c4f6 Mon Sep 17 00:00:00 2001 From: Rumata888 Date: Thu, 12 Nov 2020 01:13:57 +0300 Subject: Fixed symcc custom mutator --- custom_mutators/symcc/symcc.c | 67 +++++++++++++++++------- custom_mutators/symcc/test_examples/file_test.c | 27 ++++++++++ custom_mutators/symcc/test_examples/stdin_test.c | 22 ++++++++ src/afl-fuzz-bitmap.c | 10 ++-- 4 files changed, 101 insertions(+), 25 deletions(-) create mode 100644 custom_mutators/symcc/test_examples/file_test.c create mode 100644 custom_mutators/symcc/test_examples/stdin_test.c (limited to 'custom_mutators') diff --git a/custom_mutators/symcc/symcc.c b/custom_mutators/symcc/symcc.c index 18b475b8..ab3d70ca 100644 --- a/custom_mutators/symcc/symcc.c +++ b/custom_mutators/symcc/symcc.c @@ -1,7 +1,10 @@ +#define _GNU_SOURCE #include #include #include #include +#include +#include #include "config.h" #include "debug.h" #include "afl-fuzz.h" @@ -95,40 +98,66 @@ void afl_custom_queue_new_entry(my_mutator_t * data, const uint8_t *filename_new_queue, const uint8_t *filename_orig_queue) { + int pipefd[2]; + struct stat st; + ACTF("Queueing to symcc: %s", filename_new_queue); + u8 *fn = alloc_printf("%s", filename_new_queue); + if (!(stat(fn, &st) == 0 && S_ISREG(st.st_mode) && st.st_size)) { + PFATAL("Couldn't find enqueued file: %s",fn); + } + + if (afl_struct->fsrv.use_stdin){ + if (pipe(pipefd)==-1) + { + exit(-1); + } + } int pid = fork(); if (pid == -1) return; + + if (pid){ - if (pid) pid = waitpid(pid, NULL, 0); - - if (pid == 0) { + if (afl_struct->fsrv.use_stdin){ - setenv("SYMCC_INPUT_FILE", afl_struct->fsrv.out_file, 1); - - if (afl_struct->fsrv.use_stdin) { - - u8 *fn = alloc_printf("%s/%s", afl_struct->out_dir, filename_new_queue); + close(pipefd[0]); int fd = open(fn, O_RDONLY); - + if (fd >= 0) { - + ssize_t r = read(fd, data->mutator_buf, MAX_FILE); - close(fd); DBG("fn=%s, fd=%d, size=%ld\n", fn, fd, r); if (r <= 0) return; - close(0); - ck_write(0, data->mutator_buf, r, fn); - ck_free(fn); - + close(fd); + if (r>fcntl(pipefd[1],F_GETPIPE_SZ)) fcntl(pipefd[1],F_SETPIPE_SZ,MAX_FILE); + ck_write(pipefd[1], data->mutator_buf, r, filename_new_queue); + } else { + PFATAL("Something happened to the enqueued file before sending its contents to symcc binary"); } + close(pipefd[1]); + ck_free(fn); } + pid = waitpid(pid,NULL, 0); + } + if (pid == 0) { + if (afl_struct->fsrv.use_stdin) { + unsetenv("SYMCC_INPUT_FILE"); + close(pipefd[1]); + dup2(pipefd[0],0); + } + else + { + setenv("SYMCC_INPUT_FILE", afl_struct->fsrv.out_file, 1); + } + DBG("exec=%s\n", data->target); close(1); close(2); dup2(afl_struct->fsrv.dev_null_fd, 1); dup2(afl_struct->fsrv.dev_null_fd, 2); + execvp(data->target, afl_struct->argv); DBG("exec=FAIL\n"); exit(-1); @@ -179,8 +208,8 @@ size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size, struct dirent **nl; int32_t i, done = 0, items = scandir(data->out_dir, &nl, NULL, NULL); - size_t size = 0; - + ssize_t size = 0; + if (items <= 0) return 0; for (i = 0; i < (u32)items; ++i) { @@ -195,9 +224,9 @@ size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size, int fd = open(fn, O_RDONLY); if (fd >= 0) { - size = read(fd, data->mutator_buf, max_size); *out_buf = data->mutator_buf; + close(fd); done = 1; @@ -216,7 +245,7 @@ size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size, free(nl); DBG("FUZZ size=%lu\n", size); - return size; + return (uint32_t)size; } diff --git a/custom_mutators/symcc/test_examples/file_test.c b/custom_mutators/symcc/test_examples/file_test.c new file mode 100644 index 00000000..25271788 --- /dev/null +++ b/custom_mutators/symcc/test_examples/file_test.c @@ -0,0 +1,27 @@ +#include +#include +#include +#include +#include + +int main(int argc, char** argv){ + if (argc<2){ + printf("Need a file argument\n"); + return 1; + } + int fd=open(argv[1],O_RDONLY); + if (fd<0){ + printf("Couldn't open file\n"); + return 1; + } + uint32_t value = 0; + + read(fd,&value,sizeof(value)); + close(fd); + + value=value^0xffffffff; + if (value== 0x11223344) printf("Value one\n"); + if (value == 0x44332211) printf("Value two\n"); + if (value != 0x0) printf("Not zero\n"); + return 0; +} diff --git a/custom_mutators/symcc/test_examples/stdin_test.c b/custom_mutators/symcc/test_examples/stdin_test.c new file mode 100644 index 00000000..be87419b --- /dev/null +++ b/custom_mutators/symcc/test_examples/stdin_test.c @@ -0,0 +1,22 @@ +#include +#include +#include +#include + +int main(int argc, char** argv) +{ + char input_buffer[16]; + uint32_t comparisonValue; + size_t bytesRead; + bytesRead=read(STDIN_FILENO,input_buffer, sizeof(input_buffer)); + if (bytesRead < 0) exit(-1); + comparisonValue=*(uint32_t*)input_buffer; + comparisonValue=comparisonValue^0xff112233; + if (comparisonValue==0x66554493){ + printf("First value\n"); + } + else{ + if (comparisonValue==0x84444415) printf("Second value\n"); + } + return 0; +} diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c index 735420c3..4b29672a 100644 --- a/src/afl-fuzz-bitmap.c +++ b/src/afl-fuzz-bitmap.c @@ -584,7 +584,10 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) { alloc_printf("%s/queue/id_%06u", afl->out_dir, afl->queued_paths); #endif /* ^!SIMPLE_FILES */ - + fd = open(queue_fn, O_WRONLY | O_CREAT | O_EXCL, 0600); + if (unlikely(fd < 0)) { PFATAL("Unable to create '%s'", queue_fn); } + ck_write(fd, mem, len, queue_fn); + close(fd); add_to_queue(afl, queue_fn, len, 0); #ifdef INTROSPECTION @@ -623,11 +626,6 @@ save_if_interesting(afl_state_t *afl, void *mem, u32 len, u8 fault) { } - fd = open(queue_fn, O_WRONLY | O_CREAT | O_EXCL, 0600); - if (unlikely(fd < 0)) { PFATAL("Unable to create '%s'", queue_fn); } - ck_write(fd, mem, len, queue_fn); - close(fd); - if (likely(afl->q_testcase_max_cache_size)) { queue_testcase_store_mem(afl, afl->queue_top, mem); -- cgit 1.4.1 From bb218b330f43fada18b910a7bf2b00c6d1a32b23 Mon Sep 17 00:00:00 2001 From: Rumata888 Date: Thu, 12 Nov 2020 01:29:17 +0300 Subject: Formatted changed/added files --- custom_mutators/symcc/symcc.c | 69 ++++++++++++++---------- custom_mutators/symcc/test_examples/file_test.c | 27 ++++++---- custom_mutators/symcc/test_examples/stdin_test.c | 36 +++++++------ 3 files changed, 81 insertions(+), 51 deletions(-) (limited to 'custom_mutators') diff --git a/custom_mutators/symcc/symcc.c b/custom_mutators/symcc/symcc.c index ab3d70ca..abb58d5e 100644 --- a/custom_mutators/symcc/symcc.c +++ b/custom_mutators/symcc/symcc.c @@ -98,60 +98,74 @@ void afl_custom_queue_new_entry(my_mutator_t * data, const uint8_t *filename_new_queue, const uint8_t *filename_orig_queue) { - int pipefd[2]; + int pipefd[2]; struct stat st; ACTF("Queueing to symcc: %s", filename_new_queue); u8 *fn = alloc_printf("%s", filename_new_queue); if (!(stat(fn, &st) == 0 && S_ISREG(st.st_mode) && st.st_size)) { - PFATAL("Couldn't find enqueued file: %s",fn); + + PFATAL("Couldn't find enqueued file: %s", fn); + } - - if (afl_struct->fsrv.use_stdin){ - if (pipe(pipefd)==-1) - { - exit(-1); - } + + if (afl_struct->fsrv.use_stdin) { + + if (pipe(pipefd) == -1) { exit(-1); } + } + int pid = fork(); if (pid == -1) return; - - if (pid){ - if (afl_struct->fsrv.use_stdin){ + if (pid) { + + if (afl_struct->fsrv.use_stdin) { close(pipefd[0]); int fd = open(fn, O_RDONLY); - + if (fd >= 0) { - + ssize_t r = read(fd, data->mutator_buf, MAX_FILE); DBG("fn=%s, fd=%d, size=%ld\n", fn, fd, r); if (r <= 0) return; close(fd); - if (r>fcntl(pipefd[1],F_GETPIPE_SZ)) fcntl(pipefd[1],F_SETPIPE_SZ,MAX_FILE); + if (r > fcntl(pipefd[1], F_GETPIPE_SZ)) + fcntl(pipefd[1], F_SETPIPE_SZ, MAX_FILE); ck_write(pipefd[1], data->mutator_buf, r, filename_new_queue); + } else { - PFATAL("Something happened to the enqueued file before sending its contents to symcc binary"); + + PFATAL( + "Something happened to the enqueued file before sending its " + "contents to symcc binary"); + } close(pipefd[1]); ck_free(fn); + } - pid = waitpid(pid,NULL, 0); + + pid = waitpid(pid, NULL, 0); + } if (pid == 0) { - if (afl_struct->fsrv.use_stdin) { - unsetenv("SYMCC_INPUT_FILE"); - close(pipefd[1]); - dup2(pipefd[0],0); - } - else - { + + if (afl_struct->fsrv.use_stdin) { + + unsetenv("SYMCC_INPUT_FILE"); + close(pipefd[1]); + dup2(pipefd[0], 0); + + } else { + setenv("SYMCC_INPUT_FILE", afl_struct->fsrv.out_file, 1); - } - + + } + DBG("exec=%s\n", data->target); close(1); close(2); @@ -208,8 +222,8 @@ size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size, struct dirent **nl; int32_t i, done = 0, items = scandir(data->out_dir, &nl, NULL, NULL); - ssize_t size = 0; - + ssize_t size = 0; + if (items <= 0) return 0; for (i = 0; i < (u32)items; ++i) { @@ -224,6 +238,7 @@ size_t afl_custom_fuzz(my_mutator_t *data, uint8_t *buf, size_t buf_size, int fd = open(fn, O_RDONLY); if (fd >= 0) { + size = read(fd, data->mutator_buf, max_size); *out_buf = data->mutator_buf; diff --git a/custom_mutators/symcc/test_examples/file_test.c b/custom_mutators/symcc/test_examples/file_test.c index 25271788..f2b92986 100644 --- a/custom_mutators/symcc/test_examples/file_test.c +++ b/custom_mutators/symcc/test_examples/file_test.c @@ -4,24 +4,33 @@ #include #include -int main(int argc, char** argv){ - if (argc<2){ +int main(int argc, char **argv) { + + if (argc < 2) { + printf("Need a file argument\n"); return 1; + } - int fd=open(argv[1],O_RDONLY); - if (fd<0){ + + int fd = open(argv[1], O_RDONLY); + if (fd < 0) { + printf("Couldn't open file\n"); return 1; + } + uint32_t value = 0; - - read(fd,&value,sizeof(value)); + + read(fd, &value, sizeof(value)); close(fd); - value=value^0xffffffff; - if (value== 0x11223344) printf("Value one\n"); + value = value ^ 0xffffffff; + if (value == 0x11223344) printf("Value one\n"); if (value == 0x44332211) printf("Value two\n"); if (value != 0x0) printf("Not zero\n"); - return 0; + return 0; + } + diff --git a/custom_mutators/symcc/test_examples/stdin_test.c b/custom_mutators/symcc/test_examples/stdin_test.c index be87419b..3acfc523 100644 --- a/custom_mutators/symcc/test_examples/stdin_test.c +++ b/custom_mutators/symcc/test_examples/stdin_test.c @@ -3,20 +3,26 @@ #include #include -int main(int argc, char** argv) -{ - char input_buffer[16]; - uint32_t comparisonValue; - size_t bytesRead; - bytesRead=read(STDIN_FILENO,input_buffer, sizeof(input_buffer)); - if (bytesRead < 0) exit(-1); - comparisonValue=*(uint32_t*)input_buffer; - comparisonValue=comparisonValue^0xff112233; - if (comparisonValue==0x66554493){ +int main(int argc, char **argv) { + + char input_buffer[16]; + uint32_t comparisonValue; + size_t bytesRead; + bytesRead = read(STDIN_FILENO, input_buffer, sizeof(input_buffer)); + if (bytesRead < 0) exit(-1); + comparisonValue = *(uint32_t *)input_buffer; + comparisonValue = comparisonValue ^ 0xff112233; + if (comparisonValue == 0x66554493) { + printf("First value\n"); - } - else{ - if (comparisonValue==0x84444415) printf("Second value\n"); - } - return 0; + + } else { + + if (comparisonValue == 0x84444415) printf("Second value\n"); + + } + + return 0; + } + -- cgit 1.4.1 From c05c5b787b77e537eae256905c13809f56d213d4 Mon Sep 17 00:00:00 2001 From: Rumata888 Date: Thu, 12 Nov 2020 02:36:08 +0300 Subject: Fixed name collision problem --- custom_mutators/symcc/symcc.c | 41 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 40 insertions(+), 1 deletion(-) (limited to 'custom_mutators') diff --git a/custom_mutators/symcc/symcc.c b/custom_mutators/symcc/symcc.c index abb58d5e..531a462b 100644 --- a/custom_mutators/symcc/symcc.c +++ b/custom_mutators/symcc/symcc.c @@ -24,6 +24,7 @@ typedef struct my_mutator { afl_state_t *afl; u8 * mutator_buf; u8 * out_dir; + u8 * tmp_dir; u8 * target; uint32_t seed; @@ -57,10 +58,11 @@ my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) { if (!(data->out_dir = getenv("SYMCC_OUTPUT_DIR"))) { data->out_dir = alloc_printf("%s/symcc", afl->out_dir); - setenv("SYMCC_OUTPUT_DIR", data->out_dir, 1); } + data->tmp_dir = alloc_printf("%s/tmp", data->out_dir); + setenv("SYMCC_OUTPUT_DIR", data->tmp_dir, 1); int pid = fork(); if (pid == -1) return NULL; @@ -86,6 +88,10 @@ my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) { if (mkdir(data->out_dir, 0755)) PFATAL("Could not create directory %s", data->out_dir); + + if (mkdir(data->tmp_dir, 0755)) + PFATAL("Could not create directory %s", data->tmp_dir); + DBG("out_dir=%s, target=%s\n", data->out_dir, data->target); return data; @@ -150,6 +156,39 @@ void afl_custom_queue_new_entry(my_mutator_t * data, pid = waitpid(pid, NULL, 0); + // At this point we need to transfer files to output dir, since their names + // collide and symcc will just overwrite them + + struct dirent **nl; + int32_t items = scandir(data->tmp_dir, &nl, NULL, NULL); + u8 * origin_name = basename(filename_new_queue); + int32_t i; + if (items > 0) { + + for (i = 0; i < (u32)items; ++i) { + + struct stat st; + u8 *source_name = alloc_printf("%s/%s", data->tmp_dir, nl[i]->d_name); + u8 *destination_name = + alloc_printf("%s/%s.%s", data->out_dir, origin_name, nl[i]->d_name); + DBG("test=%s\n", fn); + if (stat(source_name, &st) == 0 && S_ISREG(st.st_mode) && st.st_size) { + + rename(source_name, destination_name); + DBG("found=%s\n", source_name); + + } + + ck_free(source_name); + ck_free(destination_name); + free(nl[i]); + + } + + free(nl); + + } + } if (pid == 0) { -- cgit 1.4.1 From ffe41e6fcec3e6228770c8fe11ec67b8cfb4878c Mon Sep 17 00:00:00 2001 From: hexcoder- Date: Thu, 12 Nov 2020 20:26:53 +0100 Subject: fix two mem leaks detected by cppcheck --- custom_mutators/honggfuzz/honggfuzz.c | 1 + custom_mutators/libfuzzer/libfuzzer.cpp | 1 + unicorn_mode/unicornafl | 2 +- 3 files changed, 3 insertions(+), 1 deletion(-) (limited to 'custom_mutators') diff --git a/custom_mutators/honggfuzz/honggfuzz.c b/custom_mutators/honggfuzz/honggfuzz.c index bde922c6..b4f07258 100644 --- a/custom_mutators/honggfuzz/honggfuzz.c +++ b/custom_mutators/honggfuzz/honggfuzz.c @@ -37,6 +37,7 @@ my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) { if ((data->mutator_buf = malloc(MAX_FILE)) == NULL) { + free(data); perror("mutator_buf alloc"); return NULL; diff --git a/custom_mutators/libfuzzer/libfuzzer.cpp b/custom_mutators/libfuzzer/libfuzzer.cpp index a4f94328..dc1fbeb2 100644 --- a/custom_mutators/libfuzzer/libfuzzer.cpp +++ b/custom_mutators/libfuzzer/libfuzzer.cpp @@ -50,6 +50,7 @@ extern "C" my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) { if ((data->mutator_buf = (u8 *)malloc(MAX_FILE)) == NULL) { + free(data); perror("mutator_buf alloc"); return NULL; diff --git a/unicorn_mode/unicornafl b/unicorn_mode/unicornafl index 0bf26f6c..c6d66471 160000 --- a/unicorn_mode/unicornafl +++ b/unicorn_mode/unicornafl @@ -1 +1 @@ -Subproject commit 0bf26f6c2601e1c1c84998551ed7d50b4108fbdf +Subproject commit c6d6647161a32bae88785a618fcd828d1711d9e6 -- cgit 1.4.1 From 35fd6847fe99c2f7bbec247c71b44babcdcab2b8 Mon Sep 17 00:00:00 2001 From: hexcoder- Date: Thu, 12 Nov 2020 21:51:44 +0100 Subject: another two mem leaks --- custom_mutators/radamsa/radamsa-mutator.c | 1 + custom_mutators/symcc/symcc.c | 1 + 2 files changed, 2 insertions(+) (limited to 'custom_mutators') diff --git a/custom_mutators/radamsa/radamsa-mutator.c b/custom_mutators/radamsa/radamsa-mutator.c index 82d28001..624ace3d 100644 --- a/custom_mutators/radamsa/radamsa-mutator.c +++ b/custom_mutators/radamsa/radamsa-mutator.c @@ -33,6 +33,7 @@ my_mutator_t *afl_custom_init(afl_t *afl, unsigned int seed) { if ((data->mutator_buf = malloc(MAX_FILE)) == NULL) { + free(data); perror("mutator_buf alloc"); return NULL; diff --git a/custom_mutators/symcc/symcc.c b/custom_mutators/symcc/symcc.c index 18b475b8..f32f98f8 100644 --- a/custom_mutators/symcc/symcc.c +++ b/custom_mutators/symcc/symcc.c @@ -41,6 +41,7 @@ my_mutator_t *afl_custom_init(afl_state_t *afl, unsigned int seed) { if ((data->mutator_buf = malloc(MAX_FILE)) == NULL) { + free(data); perror("mutator_buf alloc"); return NULL; -- cgit 1.4.1 From 622f942555772c9d15569ecdd77a67d1a2f6bd78 Mon Sep 17 00:00:00 2001 From: Rumata888 Date: Fri, 13 Nov 2020 14:54:36 +0300 Subject: Fixed memleaks, change exit to PFATAL --- custom_mutators/symcc/symcc.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) (limited to 'custom_mutators') diff --git a/custom_mutators/symcc/symcc.c b/custom_mutators/symcc/symcc.c index 531a462b..54a7fbb0 100644 --- a/custom_mutators/symcc/symcc.c +++ b/custom_mutators/symcc/symcc.c @@ -110,13 +110,19 @@ void afl_custom_queue_new_entry(my_mutator_t * data, u8 *fn = alloc_printf("%s", filename_new_queue); if (!(stat(fn, &st) == 0 && S_ISREG(st.st_mode) && st.st_size)) { + ck_free(fn); PFATAL("Couldn't find enqueued file: %s", fn); } if (afl_struct->fsrv.use_stdin) { - if (pipe(pipefd) == -1) { exit(-1); } + if (pipe(pipefd) == -1) { + + ck_free(fn); + PFATAL("Couldn't create a pipe for interacting with symcc child process"); + + } } @@ -135,6 +141,7 @@ void afl_custom_queue_new_entry(my_mutator_t * data, ssize_t r = read(fd, data->mutator_buf, MAX_FILE); DBG("fn=%s, fd=%d, size=%ld\n", fn, fd, r); + ck_free(fn); if (r <= 0) return; close(fd); if (r > fcntl(pipefd[1], F_GETPIPE_SZ)) @@ -143,6 +150,8 @@ void afl_custom_queue_new_entry(my_mutator_t * data, } else { + ck_free(fn); + PFATAL( "Something happened to the enqueued file before sending its " "contents to symcc binary"); @@ -150,7 +159,6 @@ void afl_custom_queue_new_entry(my_mutator_t * data, } close(pipefd[1]); - ck_free(fn); } -- cgit 1.4.1 From 9d22c8a02ca9043e62c250a32d5affdaeab11dcd Mon Sep 17 00:00:00 2001 From: Rumata888 Date: Tue, 17 Nov 2020 12:00:06 +0300 Subject: Fixed fd leak on early exit and closed pipes before early exits and PFATAL --- custom_mutators/symcc/symcc.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'custom_mutators') diff --git a/custom_mutators/symcc/symcc.c b/custom_mutators/symcc/symcc.c index 54a7fbb0..acec29da 100644 --- a/custom_mutators/symcc/symcc.c +++ b/custom_mutators/symcc/symcc.c @@ -142,8 +142,14 @@ void afl_custom_queue_new_entry(my_mutator_t * data, ssize_t r = read(fd, data->mutator_buf, MAX_FILE); DBG("fn=%s, fd=%d, size=%ld\n", fn, fd, r); ck_free(fn); - if (r <= 0) return; close(fd); + if (r <= 0) { + + close(pipefd[1]); + return; + + } + if (r > fcntl(pipefd[1], F_GETPIPE_SZ)) fcntl(pipefd[1], F_SETPIPE_SZ, MAX_FILE); ck_write(pipefd[1], data->mutator_buf, r, filename_new_queue); @@ -151,7 +157,7 @@ void afl_custom_queue_new_entry(my_mutator_t * data, } else { ck_free(fn); - + close(pipefd[1]); PFATAL( "Something happened to the enqueued file before sending its " "contents to symcc binary"); -- cgit 1.4.1 From d042a63ab43545a5038fe46d11fef1bde8327028 Mon Sep 17 00:00:00 2001 From: hexcoder- Date: Tue, 17 Nov 2020 20:09:52 +0100 Subject: micro optimization: allocate only when needed --- custom_mutators/symcc/symcc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'custom_mutators') diff --git a/custom_mutators/symcc/symcc.c b/custom_mutators/symcc/symcc.c index 9c6c0cb8..a609dafb 100644 --- a/custom_mutators/symcc/symcc.c +++ b/custom_mutators/symcc/symcc.c @@ -184,18 +184,18 @@ void afl_custom_queue_new_entry(my_mutator_t * data, struct stat st; u8 *source_name = alloc_printf("%s/%s", data->tmp_dir, nl[i]->d_name); - u8 *destination_name = - alloc_printf("%s/%s.%s", data->out_dir, origin_name, nl[i]->d_name); DBG("test=%s\n", fn); if (stat(source_name, &st) == 0 && S_ISREG(st.st_mode) && st.st_size) { + u8 *destination_name = + alloc_printf("%s/%s.%s", data->out_dir, origin_name, nl[i]->d_name); rename(source_name, destination_name); + ck_free(destination_name); DBG("found=%s\n", source_name); } ck_free(source_name); - ck_free(destination_name); free(nl[i]); } -- cgit 1.4.1