elf toolchaing fuzzers: libelf, libdwarf #64
Labels
Comments
|
tracked in #402 |
44 tasks
jonathanmetzman
pushed a commit
that referenced
this issue
Nov 14, 2022
The `detect_stack_use_after_return=1` option in `ASAN_OPTIONS` set by the runner seemed to cause the fuzzer to not pick up any coverage. I'm not quite sure why this happens. Any guidance would be appreciated. The fuzzer seems stuck with this flag set: `python infra/helper.py run_fuzzer --corpus-dir ../corpus_xst_json/ xs xst_jsonparse -- seed=1` ``` INFO: seed corpus: files: 1728 min: 1b max: 131336b total: 336638b rss: 92Mb #64 pulse cov: 322 ft: 323 corp: 1/1b exec/s: 32 rss: 92Mb #128 pulse cov: 322 ft: 323 corp: 1/1b exec/s: 25 rss: 92Mb #256 pulse cov: 322 ft: 324 corp: 2/8b exec/s: 23 rss: 93Mb #512 pulse cov: 322 ft: 324 corp: 2/8b exec/s: 22 rss: 93Mb #1024 pulse cov: 322 ft: 324 corp: 2/8b exec/s: 22 rss: 93Mb ``` However disabling it seems to make progress, with the same command (note same seed and corpus). After rebuilding image with `detect_stack_use_after_return` disabled: `python infra/helper.py run_fuzzer --corpus-dir ../corpus_xst_json/ xs xst_jsonparse -- seed=1` ``` INFO: seed corpus: files: 1728 min: 1b max: 131336b total: 336638b rss: 92Mb #64 pulse cov: 485 ft: 500 corp: 29/55b exec/s: 32 rss: 93Mb #128 pulse cov: 574 ft: 673 corp: 70/239b exec/s: 25 rss: 93Mb #256 pulse cov: 749 ft: 1060 corp: 132/707b exec/s: 23 rss: 93Mb #512 pulse cov: 834 ft: 1560 corp: 214/1767b exec/s: 22 rss: 93Mb #1024 pulse cov: 953 ft: 2344 corp: 353/5213b exec/s: 22 rss: 93Mb ``` Setting `detect_stack_use_after_return=0` fixed it -- local runs picked up coverage with seed corpus, and even a couple of crashes. Until I work around this it would be preferable to gain some coverage, even if we don't detect `stack-use-after-return` for now.
DavidKorczynski
pushed a commit
that referenced
this issue
Jul 9, 2024
Fixes #54 --------- Co-authored-by: cjx10 <cjxian0304@gmail.com> Co-authored-by: trashvisor <64044176+trashvisor@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
No description provided.
The text was updated successfully, but these errors were encountered: