google fuzzer-test-suite 数据集每个程序的编译细节

最新推荐文章于 2024-03-26 09:30:12 发布
最新推荐文章于 2024-03-26 09:30:12 发布
阅读量1.5k 收藏 8
点赞数 1
分类专栏： Fuzzing数据集
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/weixin_39368364/article/details/116782887
版权

google fuzzer-test-suite 数据集每个程序的编译细节

编译程序

在custom-build.sh以及common.sh中把FUZZER_ENGINE改成afl。并且把AFL、libfuzzer等的目录位置填好，其他地方不改。
在这里插入图片描述

大部分程序在该程序目录下执行以下命令就可以得到目标程序，有的需要安装一些依赖。目标程序为 程序名称-afl。如果找不到这个程序就crtl+H显示隐藏文件，以-afl结尾的就是目标程序。

   mkdir build
   cd build
   ../build.sh asan

每个程序编译的细节。

boringssl-2016-02-12

在boringssl-2016-02-12目录下执行：

	sudo apt-get update
	sudo apt-get install -y build-essential
	sudo apt-get install cmake
	sudo add-apt-repository ppa:longsleep/golang-backports
	sudo apt-get update
	sudo apt-get install golang-go
	mkdir build
	cd build
	../build.sh asan

编译结束后，build目录中以-afl为结尾的就是可执行程序（可能是boringssl-2016-02-12也有可能是…-afl，按ctrl+H显示隐藏文件就能找到）。
运行：
在这里插入图片描述

用提供的crash文件测试，可以输出AddressSanitizer信息：

./boringssl-2016-02-12-afl ../crash-ffb22c3101db1e53e38fdf630efd3dfd19cbeb84 
======================= INFO =========================
This binary is built for AFL-fuzz.
To run the target function on individual input(s) execute this:
  ./boringssl-2016-02-12-afl < INPUT_FILE
or
  ./boringssl-2016-02-12-afl INPUT_FILE1 [INPUT_FILE2 ... ]
To fuzz with afl-fuzz execute this:
  afl-fuzz [afl-flags] ./boringssl-2016-02-12-afl [-N]
afl-fuzz will run N iterations before re-spawning the process (default: 1000)
======================================================
Reading 41 bytes from ../crash-ffb22c3101db1e53e38fdf630efd3dfd19cbeb84
=================================================================
==3656864==ERROR: AddressSanitizer: heap-use-after-free on address 0x603000000258 at pc 0x00000056a84d bp 0x7fffffffd920 sp 0x7fffffffd918
READ of size 8 at 0x603000000258 thread T0
    #0 0x56a84c in ASN1_STRING_free /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/asn1/asn1_lib.c:459:12
    #1 0x5766ed in ASN1_primitive_free /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/asn1/tasn_fre.c:241:9
    #2 0x576618 in ASN1_primitive_free /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/asn1/tasn_fre.c:236:9
    #3 0x575978 in ASN1_item_free /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/asn1/tasn_fre.c:69:5
    #4 0x4e70bc in sk_pop_free /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/stack/stack.c:142:7
    #5 0x4ce147 in dsa_priv_decode /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/evp/p_dsa_asn1.c:288:3
    #6 0x4dd325 in EVP_PKCS82PKEY /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/pkcs8/pkcs8.c:616:10
    #7 0x4caacb in d2i_AutoPrivateKey /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/evp/evp_asn1.c:151:11
    #8 0x4c7f51 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/fuzz/privkey.cc:5:17
    #9 0x63e798 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #10 0x63e798 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #11 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16
    #12 0x41d6ed in _start (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/boringssl-2016-02-12-afl+0x41d6ed)

0x603000000258 is located 8 bytes inside of 24-byte region [0x603000000250,0x603000000268)
freed by thread T0 here:
    #0 0x495bad in free (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/boringssl-2016-02-12-afl+0x495bad)
    #1 0x4ce13a in dsa_priv_decode /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/evp/p_dsa_asn1.c:287:3
    #2 0x4dd325 in EVP_PKCS82PKEY /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/pkcs8/pkcs8.c:616:10
    #3 0x4caacb in d2i_AutoPrivateKey /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/evp/evp_asn1.c:151:11
    #4 0x4c7f51 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/fuzz/privkey.cc:5:17
    #5 0x63e798 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #6 0x63e798 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #7 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16

previously allocated by thread T0 here:
    #0 0x495e2d in malloc (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/boringssl-2016-02-12-afl+0x495e2d)
    #1 0x56a94d in ASN1_STRING_type_new /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/asn1/asn1_lib.c:443:26
    #2 0x562793 in c2i_ASN1_INTEGER /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/asn1/a_int.c:193:20
    #3 0x57129d in asn1_ex_c2i /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/asn1/tasn_dec.c:905:14
    #4 0x56fc6b in asn1_d2i_ex_primitive /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/asn1/tasn_dec.c:829:10
    #5 0x56d08b in ASN1_item_ex_d2i /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/asn1/tasn_dec.c:207:16
    #6 0x571f7e in asn1_template_noexp_d2i /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/asn1/tasn_dec.c:661:18
    #7 0x56ea80 in asn1_template_ex_d2i /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/asn1/tasn_dec.c:579:16
    #8 0x56cbc0 in ASN1_item_ex_d2i /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/asn1/tasn_dec.c:204:20
    #9 0x56c84e in ASN1_item_d2i /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/asn1/tasn_dec.c:145:9
    #10 0x4cdb94 in dsa_priv_decode /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/evp/p_dsa_asn1.c:198:12
    #11 0x4dd325 in EVP_PKCS82PKEY /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/pkcs8/pkcs8.c:616:10
    #12 0x4caacb in d2i_AutoPrivateKey /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/evp/evp_asn1.c:151:11
    #13 0x4c7f51 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/fuzz/privkey.cc:5:17
    #14 0x63e798 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #15 0x63e798 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #16 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-use-after-free /home/yiru/fuzzer-test-suite/fuzzer-test-suite/boringssl-2016-02-12/build/BUILD/crypto/asn1/asn1_lib.c:459:12 in ASN1_STRING_free
Shadow bytes around the buggy address:
  0x0c067fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c067fff8000: fa fa fd fd fd fd fa fa fd fd fd fa fa fa fd fd
  0x0c067fff8010: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa
  0x0c067fff8020: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa
  0x0c067fff8030: fa fa 00 00 02 fa fa fa 00 00 00 fa fa fa 00 00
=>0x0c067fff8040: 00 00 fa fa fd fd fd fa fa fa fd[fd]fd fa fa fa
  0x0c067fff8050: 00 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3656864==ABORTING

用AFL执行：

afl-fuzz -i ./seeds/ -o ./out/ -m none -d ./boringssl-2016-02-12-afl @@`

AFL -d模式运行五个多小时没有crash，代码覆盖率前两分钟从1.66%上升到1.70，之后没有上升。
在这里插入图片描述

c-ares-CVE-2016-5180

在c-ares-CVE-2016-5180目录下执行：

	mkdir build
	cd build
	../build.sh asan

运行c-ares-CVE-2016-5180-afl:
运行
用AFL测试，不到1分钟测试出1个crash: 在这里插入图片描述
运行这个crash文件：

./c-ares-CVE-2016-5180-afl out/crashes/id\:000000\,sig\:06\,src\:000020+000017\,op\:splice\,rep\:8 
======================= INFO =========================
This binary is built for AFL-fuzz.
To run the target function on individual input(s) execute this:
 ./c-ares-CVE-2016-5180-afl < INPUT_FILE
or
 ./c-ares-CVE-2016-5180-afl INPUT_FILE1 [INPUT_FILE2 ... ]
To fuzz with afl-fuzz execute this:
 afl-fuzz [afl-flags] ./c-ares-CVE-2016-5180-afl [-N]
afl-fuzz will run N iterations before re-spawning the process (default: 1000)
======================================================
Reading 6 bytes from out/crashes/id:000000,sig:06,src:000020+000017,op:splice,rep:8
=================================================================
==2044204==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000025 at pc 0x0000004c7c99 bp 0x7fffffffdd70 sp 0x7fffffffdd68
WRITE of size 1 at 0x603000000025 thread T0
   #0 0x4c7c98 in ares_create_query (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/c-ares-CVE-2016-5180/build/test/c-ares-CVE-2016-5180-afl+0x4c7c98)
   #1 0x4c70e4 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/c-ares-CVE-2016-5180/build/../target.cc:14:3
   #2 0x4c8938 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
   #3 0x4c8938 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
   #4 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16
   #5 0x41c5cd in _start (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/c-ares-CVE-2016-5180/build/test/c-ares-CVE-2016-5180-afl+0x41c5cd)

0x603000000025 is located 0 bytes to the right of 21-byte region [0x603000000010,0x603000000025)
allocated by thread T0 here:
   #0 0x494d0d in malloc (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/c-ares-CVE-2016-5180/build/test/c-ares-CVE-2016-5180-afl+0x494d0d)
   #1 0x4c75ca in ares_create_query (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/c-ares-CVE-2016-5180/build/test/c-ares-CVE-2016-5180-afl+0x4c75ca)
   #2 0x4c70e4 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/c-ares-CVE-2016-5180/build/../target.cc:14:3
   #3 0x4c8938 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
   #4 0x4c8938 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
   #5 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/c-ares-CVE-2016-5180/build/test/c-ares-CVE-2016-5180-afl+0x4c7c98) in ares_create_query
Shadow bytes around the buggy address:
 0x0c067fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 0x0c067fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 0x0c067fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 0x0c067fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 0x0c067fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c067fff8000: fa fa 00 00[05]fa fa fa fa fa fa fa fa fa fa fa
 0x0c067fff8010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 0x0c067fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 0x0c067fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 0x0c067fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 0x0c067fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
 Addressable:           00
 Partially addressable: 01 02 03 04 05 06 07 
 Heap left redzone:       fa
 Freed heap region:       fd
 Stack left redzone:      f1
 Stack mid redzone:       f2
 Stack right redzone:     f3
 Stack after return:      f5
 Stack use after scope:   f8
 Global redzone:          f9
 Global init order:       f6
 Poisoned by user:        f7
 Container overflow:      fc
 Array cookie:            ac
 Intra object redzone:    bb
 ASan internal:           fe
 Left alloca redzone:     ca
 Right alloca redzone:    cb
 Shadow gap:              cc
==2044204==ABORTING
freetype2-2017

在freetype2-2017目录下运行：

sudo apt-get install libarchive-dev
mkdir build
cd build
../build.sh asan

运行程序：
运行
用AFL测试，这个程序主要用于代码覆盖率的获取。

guetzli-2017-3-30

在guetzli-2017-3-30目录下运行

mkdir build
cd build
../build.sh asan

运行编好的程序：
运行
运行提供的crash，触发这个assertion failure：
在这里插入图片描述
用AFL运行半个小时有1个crash，这个crash触发了这个assertion failure。
在这里插入图片描述
在这里插入图片描述

harfbuzz-1.3.2

在 sudo apt install ragel目录下执行以下命令：

 	sudo apt install ragel
	mkdir build
	cd build
	../build.sh asan

运行：
运行
运行提供的crash，触发断言错误：
在这里插入图片描述
用AFL -d模式运行1个半小时，无crash，代码覆盖率一直在增长。
运行

json-2017-02-12

运行编译好的程序：
run
用提供的crash测试，触发这个断言错误：
crash

用AFL测试，15分钟内出现两个crash。
crash在这里插入图片描述
执行发现的crash，二者都触发了断言错误：
在这里插入图片描述在这里插入图片描述

lcms-2017-03-21

在lcms-2017-03-21此目录下执行

	mkdir build
	cd build
	../build.sh asan

得到程序lcms-2017-03-21-afl。（如果没有就 ctrl+H 显示隐藏文件 “…-afl”即为编译好的程序）一下是编译好后build文件夹
build文件夹
运行lcms-2017-03-21-afl：
运行程序
用提供的crash文件运行这个程序，会输出addressSanitizer的输出：

$ ./lcms-2017-03-21-afl ../crash-6a7f7b35fc6de5b19080b1c32588c727caf5d396
======================= INFO =========================
This binary is built for AFL-fuzz.
To run the target function on individual input(s) execute this:
./lcms-2017-03-21-afl < INPUT_FILE
or
 ./lcms-2017-03-21-afl INPUT_FILE1 [INPUT_FILE2 ... ]
To fuzz with afl-fuzz execute this:
 afl-fuzz [afl-flags] ./lcms-2017-03-21-afl [-N]
afl-fuzz will run N iterations before re-spawning the process (default: 1000)
======================================================
Reading 4096 bytes from ../crash->6a7f7b35fc6de5b19080b1c32588c727caf5d396
=================================================================
==1744598==ERROR: AddressSanitizer: heap-buffer-overflow on address >0x60800000098c at pc 0x00000055c8d3 bp 0x7fffffffd550 sp 0x7fffffffd548
READ of size 4 at 0x60800000098c thread T0
   #0 0x55c8d2 in TetrahedralInterpFloat /home/yiru/fuzzer-test-suite/fuzzer->test-suite/lcms-2017-03-21/build/BUILD/src/cmsintrp.c:642:22
   #1 0x57d257 in _LUTeval16 /home/yiru/fuzzer-test-suite/fuzzer-test-suite/lcms-2017-03-21/build/BUILD/src/cmslut.c:1330:14
   #2 0x4f9108 in CachedXFORM /home/yiru/fuzzer-test-suite/fuzzer-test-suite/lcms-2017-03-21/build/BUILD/src/cmsxform.c:525:17
   #3 0x4eff23 in cmsDoTransform /home/yiru/fuzzer-test-suite/fuzzer-test-suite/lcms-2017-03-21/build/BUILD/src/cmsxform.c:189:5
   #4 0x4c7613 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/lcms-2017-03-21/build/../cms_transform_fuzzer.c
   #5 0x5861d8 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
   #6 0x5861d8 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
   #7 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16
   #8 0x41c6bd in _start (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/lcms-2017-03-21/build/lcms-2017-03-21-afl+0x41c6bd)

0x60800000098c is located 12 bytes to the right of 96-byte region [0x608000000920,0x608000000980)
allocated by thread T0 here:
   #0 0x494dfd in malloc (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/lcms-2017-03-21/build/lcms-2017-03-21-afl+0x494dfd)
   #1 0x5440f2 in _cmsMalloc /home/yiru/fuzzer-test-suite/fuzzer-test-suite/lcms-2017-03-21/build/BUILD/src/cmserr.c:267:12
   #2 0x5440f2 in _cmsDupDefaultFn /home/yiru/fuzzer-test-suite/fuzzer-test-suite/lcms-2017-03-21/build/BUILD/src/cmserr.c:171:11
   #3 0x574c98 in CLUTElemDup /home/yiru/fuzzer-test-suite/fuzzer-test-suite/lcms-2017-03-21/build/BUILD/src/cmslut.c:503:56
   #4 0x57fa82 in cmsStageDup /home/yiru/fuzzer-test-suite/fuzzer-test-suite/lcms-2017-03-21/build/BUILD/src/cmslut.c:1257:25
   #5 0x57fa82 in cmsPipelineCat /home/yiru/fuzzer-test-suite/fuzzer-test-suite/lcms-2017-03-21/build/BUILD/src/cmslut.c:1617:56
   #6 0x53e155 in DefaultICCintents /home/yiru/fuzzer-test-suite/fuzzer-test-suite/lcms-2017-03-21/build/BUILD/src/cmscnvrt.c:628:14
   #7 0x4f1414 in cmsCreateExtendedTransform /home/yiru/fuzzer-test-suite/fuzzer-test-suite/lcms-2017-03-21/build/BUILD/src/cmsxform.c:1059:11
   #8 0x4f4be0 in cmsCreateMultiprofileTransformTHR /home/yiru/fuzzer-test-suite/fuzzer-test-suite/lcms-2017-03-21/build/BUILD/src/cmsxform.c:1175:12
   #9 0x4f4be0 in cmsCreateTransformTHR /home/yiru/fuzzer-test-suite/fuzzer-test-suite/lcms-2017-03-21/build/BUILD/src/cmsxform.c:1216:12
   #10 0x4f4be0 in cmsCreateTransform /home/yiru/fuzzer-test-suite/fuzzer-test-suite/lcms-2017-03-21/build/BUILD/src/cmsxform.c:1226:12
   #11 0x4c6f89 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/lcms-2017-03-21/build/../cms_transform_fuzzer.c:31:30
   #12 0x5861d8 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
   #13 0x5861d8 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
   #14 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/yiru/fuzzer-test-suite/fuzzer-test-suite/lcms-2017-03-21/build/BUILD/src/cmsintrp.c:642:22 in TetrahedralInterpFloat
Shadow bytes around the buggy address:
  0x0c107fff80e0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c107fff80f0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c107fff8100: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c107fff8110: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c107fff8120: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c107fff8130: fa [fa] fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c107fff8140: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c107fff8150: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c107fff8160: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c107fff8170: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c107fff8180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
 Addressable:           00
 Partially addressable: 01 02 03 04 05 06 07 
 Heap left redzone:       fa
 Freed heap region:       fd
 Stack left redzone:      f1
 Stack mid redzone:       f2
 Stack right redzone:     f3
 Stack after return:      f5
 Stack use after scope:   f8
 Global redzone:          f9
 Global init order:       f6
 Poisoned by user:        f7
 Container overflow:      fc
 Array cookie:            ac
 Intra object redzone:    bb
 ASan internal:           fe
 Left alloca redzone:     ca
 Right alloca redzone:    cb
 Shadow gap:              cc
==1744598==ABORTING

执行AFL：

afl-fuzz  -i ./seeds/ -o ./out -m none -d ./lcms-2017-03-21-afl @@

用AFL运行一个半小时，没有crash，代码覆盖率保持持续增长。
在这里插入图片描述

libarchive-2017-01-04

编译出现问题，暂时未解决。
在这里插入图片描述

libjpeg-turbo-07-2017
  • 在fuzzer-test-suite根目录下执行
    libjpeg-turbo-07-2017/build.sh asan
  • 生成的程序是：
    程序
  • 运行这个程序：
    ./libjpeg-turbo-07-2017-afl
    运行目标程序- 用AFL测试这个程序，这个程序主要用于代码覆盖率的比较。
    bash afl-fuzz -i ./seeds/ -o ./out/ -m none ./libjpeg-turbo-07-2017-afl @@
libpng-1.2.56

运行程序：
在这里插入图片描述

运行提供的crash，输出如下，只报了一个read_error。

root@prodsec-HP-Z440-Workstation:/home/yiru/fuzzer-test-suite/program/libpng# ./libpng-1.2.56-afl oom-63efa8b5a2adf76dc225d62939db3337ff6774f1 
======================= INFO =========================
This binary is built for AFL-fuzz.
To run the target function on individual input(s) execute this:
  ./libpng-1.2.56-afl < INPUT_FILE
or
  ./libpng-1.2.56-afl INPUT_FILE1 [INPUT_FILE2 ... ]
To fuzz with afl-fuzz execute this:
  afl-fuzz [afl-flags] ./libpng-1.2.56-afl [-N]
afl-fuzz will run N iterations before re-spawning the process (default: 1000)
======================================================
Reading 51 bytes from oom-63efa8b5a2adf76dc225d62939db3337ff6774f1
libpng error: read error
Execution successful
libssh-2017-1272

执行build.sh可能会报无法git到。手动git到本地

pip install abimap
apt-get install libkrb5-dev
pip install gssapi
apt-get install doxygen
mkdir build
cd build
git clone https://git.libssh.org/projects/libssh.git SRC
../build.sh asan
libxml2-v2.9.2

运行

用提供的crash测试：

  • crash-50b12d37d6968a2cd9eb3665d158d9a2fb1f6e28
./libxml2-v2.9.2-afl ../crash-50b12d37d6968a2cd9eb3665d158d9a2fb1f6e28 
======================= INFO =========================
This binary is built for AFL-fuzz.
To run the target function on individual input(s) execute this:
  ./libxml2-v2.9.2-afl < INPUT_FILE
or
  ./libxml2-v2.9.2-afl INPUT_FILE1 [INPUT_FILE2 ... ]
To fuzz with afl-fuzz execute this:
  afl-fuzz [afl-flags] ./libxml2-v2.9.2-afl [-N]
afl-fuzz will run N iterations before re-spawning the process (default: 1000)
======================================================
Reading 60 bytes from ../crash-50b12d37d6968a2cd9eb3665d158d9a2fb1f6e28
=================================================================
==2750611==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x621000002500 at pc 0x000000524432 bp 0x7fffffffdd60 sp 0x7fffffffdd58
READ of size 1 at 0x621000002500 thread T0
    #0 0x524431 in xmlParseXMLDecl /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:10666:2
    #1 0x525dc9 in xmlParseDocument /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:10771:2
    #2 0x53fcbd in xmlDoRead /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:15298:5
    #3 0x4c8057 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/../target.cc:14:18
    #4 0x87cdd8 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #5 0x87cdd8 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #6 0x7ffff7a440b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16
    #7 0x41d83d in _start (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/libxml2-v2.9.2-afl+0x41d83d)

0x621000002500 is located 0 bytes to the right of 4096-byte region [0x621000001500,0x621000002500)
allocated by thread T0 here:
    #0 0x495f7d in malloc (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/libxml2-v2.9.2-afl+0x495f7d)
    #1 0x698be3 in xmlBufCreate /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/buf.c:136:32
    #2 0x792c66 in xmlSwitchInputEncodingInt /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parserInternals.c:1196:34
    #3 0x792ff2 in xmlSwitchToEncodingInt /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parserInternals.c:1272:12
    #4 0x792ff2 in xmlSwitchToEncoding /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parserInternals.c:1300:13
    #5 0x508081 in xmlParseEncodingDecl /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:10462:3
    #6 0x523e2e in xmlParseXMLDecl /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:10630:5
    #7 0x525dc9 in xmlParseDocument /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:10771:2
    #8 0x53fcbd in xmlDoRead /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:15298:5
    #9 0x4c8057 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/../target.cc:14:18
    #10 0x87cdd8 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #11 0x87cdd8 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #12 0x7ffff7a440b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:10666:2 in xmlParseXMLDecl
Shadow bytes around the buggy address:
  0x0c427fff8450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fff8460: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fff8470: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fff8480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fff8490: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c427fff84a0:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff84b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff84c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff84d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff84e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff84f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==2750611==ABORTING
  • crash-d8960e21ca40ea5dc60ad655000842376d4178a1
./libxml2-v2.9.2-afl ../crash-d8960e21ca40ea5dc60ad655000842376d4178a1 
======================= INFO =========================
This binary is built for AFL-fuzz.
To run the target function on individual input(s) execute this:
  ./libxml2-v2.9.2-afl < INPUT_FILE
or
  ./libxml2-v2.9.2-afl INPUT_FILE1 [INPUT_FILE2 ... ]
To fuzz with afl-fuzz execute this:
  afl-fuzz [afl-flags] ./libxml2-v2.9.2-afl [-N]
afl-fuzz will run N iterations before re-spawning the process (default: 1000)
======================================================
Reading 313 bytes from ../crash-d8960e21ca40ea5dc60ad655000842376d4178a1
=================================================================
==2791320==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61900000057b at pc 0x000000744d0b bp 0x7fffffffd0a0 sp 0x7fffffffd098
READ of size 1 at 0x61900000057b thread T0
    #0 0x744d0a in xmlDictComputeFastQKey /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/dict.c:489:18
    #1 0x742b7a in xmlDictQLookup /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/dict.c:1093:12
    #2 0x751822 in xmlSAX2StartElementNs /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/SAX2.c:2238:17
    #3 0x51ed78 in xmlParseStartTag2 /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:9707:6
    #4 0x515e9c in xmlParseElement /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:10069:16
    #5 0x5151d9 in xmlParseContent /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:9982:6
    #6 0x516a98 in xmlParseElement /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:10155:5
    #7 0x5151d9 in xmlParseContent /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:9982:6
    #8 0x516a98 in xmlParseElement /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:10155:5
    #9 0x5264b0 in xmlParseDocument /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:10841:2
    #10 0x53fcbd in xmlDoRead /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:15298:5
    #11 0x4c8057 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/../target.cc:14:18
    #12 0x87cdd8 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #13 0x87cdd8 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #14 0x7ffff7a440b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16
    #15 0x41d83d in _start (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/libxml2-v2.9.2-afl+0x41d83d)

0x61900000057b is located 5 bytes to the left of 1048-byte region [0x619000000580,0x619000000998)
allocated by thread T0 here:
    #0 0x495f7d in malloc (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/libxml2-v2.9.2-afl+0x495f7d)
    #1 0x73f1ab in xmlDictAddString /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/dict.c:270:29
    #2 0x73f1ab in xmlDictLookup /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/dict.c:923:11
    #3 0x509518 in xmlDetectSAX2 /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:1067:21
    #4 0x524e89 in xmlParseDocument /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:10725:5
    #5 0x53fcbd in xmlDoRead /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:15298:5
    #6 0x4c8057 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/../target.cc:14:18
    #7 0x87cdd8 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #8 0x87cdd8 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #9 0x7ffff7a440b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/dict.c:489:18 in xmlDictComputeFastQKey
Shadow bytes around the buggy address:
  0x0c327fff8050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff8070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff8080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c327fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]
  0x0c327fff80b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff80c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff80d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff80e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff80f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==2791320==ABORTING
  • leak-bdbb2857b7a086f003db1c418e1d124181341fb1
./libxml2-v2.9.2-afl ../leak-bdbb2857b7a086f003db1c418e1d124181341fb1 
======================= INFO =========================
This binary is built for AFL-fuzz.
To run the target function on individual input(s) execute this:
  ./libxml2-v2.9.2-afl < INPUT_FILE
or
  ./libxml2-v2.9.2-afl INPUT_FILE1 [INPUT_FILE2 ... ]
To fuzz with afl-fuzz execute this:
  afl-fuzz [afl-flags] ./libxml2-v2.9.2-afl [-N]
afl-fuzz will run N iterations before re-spawning the process (default: 1000)
======================================================
Reading 64 bytes from ../leak-bdbb2857b7a086f003db1c418e1d124181341fb1
Execution successful

=================================================================
==2799042==ERROR: LeakSanitizer: detected memory leaks

Indirect leak of 48 byte(s) in 1 object(s) allocated from:
    #0 0x495f7d in malloc (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/libxml2-v2.9.2-afl+0x495f7d)
    #1 0x59a5e6 in xmlNewDocElementContent /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/valid.c:952:34
    #2 0x4ff354 in xmlParseElementMixedContentDecl /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c
    #3 0x502365 in xmlParseElementContentDecl /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:6624:16
    #4 0x502dca in xmlParseElementDecl /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:6691:12
    #5 0x503e8e in xmlParseMarkupDecl /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:6934:4
    #6 0x527547 in xmlParseInternalSubset /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:8401:6
    #7 0x525cd6 in xmlParseDocument /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:10809:6
    #8 0x53fcbd in xmlDoRead /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:15298:5
    #9 0x4c8057 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/../target.cc:14:18
    #10 0x87cdd8 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #11 0x87cdd8 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #12 0x7ffff7a440b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16

Indirect leak of 48 byte(s) in 1 object(s) allocated from:
    #0 0x495f7d in malloc (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/libxml2-v2.9.2-afl+0x495f7d)
    #1 0x59a5e6 in xmlNewDocElementContent /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/valid.c:952:34
    #2 0x4ff228 in xmlParseElementMixedContentDecl /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:6194:18
    #3 0x502365 in xmlParseElementContentDecl /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:6624:16
    #4 0x502dca in xmlParseElementDecl /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:6691:12
    #5 0x503e8e in xmlParseMarkupDecl /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:6934:4
    #6 0x527547 in xmlParseInternalSubset /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:8401:6
    #7 0x525cd6 in xmlParseDocument /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:10809:6
    #8 0x53fcbd in xmlDoRead /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/BUILD/parser.c:15298:5
    #9 0x4c8057 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/libxml2-v2.9.2/build/../target.cc:14:18
    #10 0x87cdd8 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #11 0x87cdd8 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #12 0x7ffff7a440b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: 96 byte(s) leaked in 2 allocation(s).
llvm-libcxxabi-2017-01-27

这个网址已经无了，GitHub上应该已经合并到llvm-project下了。
在这里插入图片描述
尝试把llvm-project下的libcxxabi拷贝过来成为SRC,然后build.sh asan，
用提供的crash测试，发现没有crash。应该是已经修复了漏洞了。

openssl-1.0.1f

运行编译好的文件：
运行
用提供的crash测试：

./openssl-1.0.1f-afl ../leak-268f0e85f4bc45cbaf4d257222b830eac18977f3 
======================= INFO =========================
This binary is built for AFL-fuzz.
To run the target function on individual input(s) execute this:
  ./openssl-1.0.1f-afl < INPUT_FILE
or
  ./openssl-1.0.1f-afl INPUT_FILE1 [INPUT_FILE2 ... ]
To fuzz with afl-fuzz execute this:
  afl-fuzz [afl-flags] ./openssl-1.0.1f-afl [-N]
afl-fuzz will run N iterations before re-spawning the process (default: 1000)
======================================================
Reading 249 bytes from ../leak-268f0e85f4bc45cbaf4d257222b830eac18977f3
Execution successful

=================================================================
==3079777==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 32 byte(s) in 1 object(s) allocated from:
    #0 0x495e2d in malloc (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/openssl-1.0.1f/build/openssl-1.0.1f-afl+0x495e2d)
    #1 0x57678c in CRYPTO_malloc /home/yiru/fuzzer-test-suite/fuzzer-test-suite/openssl-1.0.1f/build/BUILD/crypto/mem.c:308:8
    #2 0x5cfe18 in sk_new /home/yiru/fuzzer-test-suite/fuzzer-test-suite/openssl-1.0.1f/build/BUILD/crypto/stack/stack.c:125:11
    #3 0x5cfe18 in sk_new_null /home/yiru/fuzzer-test-suite/fuzzer-test-suite/openssl-1.0.1f/build/BUILD/crypto/stack/stack.c:117:9
    #4 0x4dccab in ssl_parse_clienthello_use_srtp_ext /home/yiru/fuzzer-test-suite/fuzzer-test-suite/openssl-1.0.1f/build/BUILD/ssl/d1_srtp.c:345:7
    #5 0x4cd5fe in ssl_parse_clienthello_tlsext /home/yiru/fuzzer-test-suite/fuzzer-test-suite/openssl-1.0.1f/build/BUILD/ssl/t1_lib.c:1419:7
    #6 0x512bbd in ssl3_get_client_hello /home/yiru/fuzzer-test-suite/fuzzer-test-suite/openssl-1.0.1f/build/BUILD/ssl/s3_srvr.c:1180:8
    #7 0x50dcfa in ssl3_accept /home/yiru/fuzzer-test-suite/fuzzer-test-suite/openssl-1.0.1f/build/BUILD/ssl/s3_srvr.c:357:9
    #8 0x4c8062 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/openssl-1.0.1f/build/../target.cc:34:3
    #9 0x7f77a8 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #10 0x7f77a8 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #11 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16

Indirect leak of 32 byte(s) in 1 object(s) allocated from:
    #0 0x495e2d in malloc (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/openssl-1.0.1f/build/openssl-1.0.1f-afl+0x495e2d)
    #1 0x57678c in CRYPTO_malloc /home/yiru/fuzzer-test-suite/fuzzer-test-suite/openssl-1.0.1f/build/BUILD/crypto/mem.c:308:8
    #2 0x5cfe38 in sk_new /home/yiru/fuzzer-test-suite/fuzzer-test-suite/openssl-1.0.1f/build/BUILD/crypto/stack/stack.c:127:17
    #3 0x5cfe38 in sk_new_null /home/yiru/fuzzer-test-suite/fuzzer-test-suite/openssl-1.0.1f/build/BUILD/crypto/stack/stack.c:117:9
    #4 0x4dccab in ssl_parse_clienthello_use_srtp_ext /home/yiru/fuzzer-test-suite/fuzzer-test-suite/openssl-1.0.1f/build/BUILD/ssl/d1_srtp.c:345:7
    #5 0x4cd5fe in ssl_parse_clienthello_tlsext /home/yiru/fuzzer-test-suite/fuzzer-test-suite/openssl-1.0.1f/build/BUILD/ssl/t1_lib.c:1419:7
    #6 0x512bbd in ssl3_get_client_hello /home/yiru/fuzzer-test-suite/fuzzer-test-suite/openssl-1.0.1f/build/BUILD/ssl/s3_srvr.c:1180:8
    #7 0x50dcfa in ssl3_accept /home/yiru/fuzzer-test-suite/fuzzer-test-suite/openssl-1.0.1f/build/BUILD/ssl/s3_srvr.c:357:9
    #8 0x4c8062 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/openssl-1.0.1f/build/../target.cc:34:3
    #9 0x7f77a8 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #10 0x7f77a8 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #11 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: 64 byte(s) leaked in 2 allocation(s).
openssl-1.0.2d

运行编好的程序：
运行
用提供的crash测试触发断言错误：
crash

openssl-1.1.0c
openthread-2018-02-27

需要安装2.68以上的Autoconf。

pcre2-10.00

同样的方法获得pcre2-10.00-afl
用AFL测试在我的环境下跑了近一个小时找到两个crash。
运行图
用程序运行crash，获得AddressSanitizer的输出:

./pcre2-10.00-afl out/crashes/id\:000000\,sig\:06\,src\:006518\,op\:havoc\,rep\:2      ======================= INFO =========================
This binary is built for AFL-fuzz.
To run the target function on individual input(s) execute this:
  ./pcre2-10.00-afl < INPUT_FILE
or
  ./pcre2-10.00-afl INPUT_FILE1 [INPUT_FILE2 ... ]
To fuzz with afl-fuzz execute this:
  afl-fuzz [afl-flags] ./pcre2-10.00-afl [-N]
afl-fuzz will run N iterations before re-spawning the process (default: 1000)
======================================================
Reading 17 bytes from out/crashes/id:000000,sig:06,src:006518,op:havoc,rep:2
=================================================================
==24==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000003f at pc 0x000000559e5d bp 0x7fff48498650 sp 0x7fff48498648
READ of size 1 at 0x60300000003f thread T0
==24==WARNING: invalid path to external symbolizer!
==24==WARNING: Failed to use and restart external symbolizer!
    #0 0x559e5c  (/home/program/pcre2/pcre2-10.00-afl+0x559e5c)
    #1 0x517199  (/home/program/pcre2/pcre2-10.00-afl+0x517199)
    #2 0x576990  (/home/program/pcre2/pcre2-10.00-afl+0x576990)
    #3 0x4c73af  (/home/program/pcre2/pcre2-10.00-afl+0x4c73af)
    #4 0x5776b8  (/home/program/pcre2/pcre2-10.00-afl+0x5776b8)
    #5 0x7f909fdfc83f  (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)
    #6 0x41c5fd  (/home/program/pcre2/pcre2-10.00-afl+0x41c5fd)

0x60300000003f is located 1 bytes to the left of 18-byte region [0x603000000040,0x603000000052)
allocated by thread T0 here:
    #0 0x4c44ad  (/home/program/pcre2/pcre2-10.00-afl+0x4c44ad)
    #1 0x4c6f61  (/home/program/pcre2/pcre2-10.00-afl+0x4c6f61)
    #2 0x5776b8  (/home/program/pcre2/pcre2-10.00-afl+0x5776b8)
    #3 0x7f909fdfc83f  (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/program/pcre2/pcre2-10.00-afl+0x559e5c)
Shadow bytes around the buggy address:
  0x0c067fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c067fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c067fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c067fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c067fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c067fff8000: fa fa 00 00 01 fa fa[fa]00 00 02 fa fa fa 00 00
  0x0c067fff8010: 02 fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==24==ABORTING

用AFL -d模式运行一个半小时能够发现两个crash。

proj4-2017-08-14

运行编译好的程序：在这里插入图片描述用提供的crash测试：leak-7c19589a27e15f3432d245c7685bd518693e70d3

./proj4-2017-08-14-afl ../leak-7c19589a27e15f3432d245c7685bd518693e70d3 
======================= INFO =========================
This binary is built for AFL-fuzz.
To run the target function on individual input(s) execute this:
  ./proj4-2017-08-14-afl < INPUT_FILE
or
  ./proj4-2017-08-14-afl INPUT_FILE1 [INPUT_FILE2 ... ]
To fuzz with afl-fuzz execute this:
  afl-fuzz [afl-flags] ./proj4-2017-08-14-afl [-N]
afl-fuzz will run N iterations before re-spawning the process (default: 1000)
======================================================
Reading 157 bytes from ../leak-7c19589a27e15f3432d245c7685bd518693e70d3
Execution successful

=================================================================
==101559==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 640 byte(s) in 1 object(s) allocated from:
    #0 0x495ead in malloc (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/proj4-2017-08-14/build/proj4-2017-08-14-afl+0x495ead)
    #1 0x4cda86 in pj_malloc /home/yiru/fuzzer-test-suite/fuzzer-test-suite/proj4-2017-08-14/build/BUILD/src/pj_malloc.c:57:21
    #2 0x4cda86 in pj_calloc /home/yiru/fuzzer-test-suite/fuzzer-test-suite/proj4-2017-08-14/build/BUILD/src/pj_malloc.c:80:17
    #3 0x563a9e in pj_urm5 /home/yiru/fuzzer-test-suite/fuzzer-test-suite/proj4-2017-08-14/build/BUILD/src/PJ_urm5.c:39:5
    #4 0x4c9cc7 in pj_init_ctx /home/yiru/fuzzer-test-suite/fuzzer-test-suite/proj4-2017-08-14/build/BUILD/src/pj_init.c:502:17
    #5 0x4c9198 in pj_init_plus_ctx /home/yiru/fuzzer-test-suite/fuzzer-test-suite/proj4-2017-08-14/build/BUILD/src/pj_init.c:409:14
    #6 0x4c8168 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/proj4-2017-08-14/build/BUILD/test/fuzzers/standard_fuzzer.cpp:89:21
    #7 0x571fc8 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #8 0x571fc8 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #9 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16

Indirect leak of 32 byte(s) in 1 object(s) allocated from:
    #0 0x495ead in malloc (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/proj4-2017-08-14/build/proj4-2017-08-14-afl+0x495ead)
    #1 0x4cda86 in pj_malloc /home/yiru/fuzzer-test-suite/fuzzer-test-suite/proj4-2017-08-14/build/BUILD/src/pj_malloc.c:57:21
    #2 0x4cda86 in pj_calloc /home/yiru/fuzzer-test-suite/fuzzer-test-suite/proj4-2017-08-14/build/BUILD/src/pj_malloc.c:80:17
    #3 0x563b3c in pj_projection_specific_setup_urm5 /home/yiru/fuzzer-test-suite/fuzzer-test-suite/proj4-2017-08-14/build/BUILD/src/PJ_urm5.c:41:27
    #4 0x4cb7ed in pj_init_ctx /home/yiru/fuzzer-test-suite/fuzzer-test-suite/proj4-2017-08-14/build/BUILD/src/pj_init.c:726:21
    #5 0x4c9198 in pj_init_plus_ctx /home/yiru/fuzzer-test-suite/fuzzer-test-suite/proj4-2017-08-14/build/BUILD/src/pj_init.c:409:14
    #6 0x4c8168 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/proj4-2017-08-14/build/BUILD/test/fuzzers/standard_fuzzer.cpp:89:21
    #7 0x571fc8 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #8 0x571fc8 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #9 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: 672 byte(s) leaked in 2 allocation(s).

用AFL -d模式运行五个多小时，没有crash。

在这里插入图片描述

re2-2014-12-09

运行编译好的程序：
![在这里插入图片描述](https://img-blog.csdnimg.cn/20210514101625405.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl8zOTM2ODM2NA==,size_16,color_FFFFFF,t_70

运行提供的crash-a23ed2a04358b9c070c603a5af6ae2b34598664a

./re2-2014-12-09-afl ../crash-a23ed2a04358b9c070c603a5af6ae2b34598664a 
======================= INFO =========================
This binary is built for AFL-fuzz.
To run the target function on individual input(s) execute this:
  ./re2-2014-12-09-afl < INPUT_FILE
or
  ./re2-2014-12-09-afl INPUT_FILE1 [INPUT_FILE2 ... ]
To fuzz with afl-fuzz execute this:
  afl-fuzz [afl-flags] ./re2-2014-12-09-afl [-N]
afl-fuzz will run N iterations before re-spawning the process (default: 1000)
======================================================
Reading 17 bytes from ../crash-a23ed2a04358b9c070c603a5af6ae2b34598664a
re2/dfa.cc:474: DFA out of memory: prog size 17145 mem 2727402
=================================================================
==3887751==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000128 at pc 0x0000005327bb bp 0x7fffffffa1d0 sp 0x7fffffffa1c8
WRITE of size 8 at 0x602000000128 thread T0
    #0 0x5327ba in re2::NFA::Search(re2::StringPiece const&, re2::StringPiece const&, bool, bool, re2::StringPiece*, int) /home/yiru/fuzzer-test-suite/fuzzer-test-suite/re2-2014-12-09/build/BUILD/re2/nfa.cc:532:31
    #1 0x535208 in re2::Prog::SearchNFA(re2::StringPiece const&, re2::StringPiece const&, re2::Prog::Anchor, re2::Prog::MatchKind, re2::StringPiece*, int) /home/yiru/fuzzer-test-suite/fuzzer-test-suite/re2-2014-12-09/build/BUILD/re2/nfa.cc:701:12
    #2 0x4d55cd in re2::RE2::Match(re2::StringPiece const&, int, int, re2::RE2::Anchor, re2::StringPiece*, int) const /home/yiru/fuzzer-test-suite/fuzzer-test-suite/re2-2014-12-09/build/BUILD/re2/re2.cc:768:19
    #3 0x4d01ac in re2::RE2::DoMatch(re2::StringPiece const&, re2::RE2::Anchor, int*, re2::RE2::Arg const* const*, int) const /home/yiru/fuzzer-test-suite/fuzzer-test-suite/re2-2014-12-09/build/BUILD/re2/re2.cc:817:8
    #4 0x4c87c5 in operator() /home/yiru/fuzzer-test-suite/fuzzer-test-suite/re2-2014-12-09/build/BUILD/re2/variadic_function.h:15:12
    #5 0x4c87c5 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/re2-2014-12-09/build/../target.cc:27:5
    #6 0x5607d8 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #7 0x5607d8 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #8 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16
    #9 0x41d83d in _start (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/re2-2014-12-09/build/re2-2014-12-09-afl+0x41d83d)

0x602000000128 is located 8 bytes to the left of 16-byte region [0x602000000130,0x602000000140)
allocated by thread T0 here:
    #0 0x4c56ed in operator new(unsigned long) (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/re2-2014-12-09/build/re2-2014-12-09-afl+0x4c56ed)
    #1 0x52fb1d in AllocThread /home/yiru/fuzzer-test-suite/fuzzer-test-suite/re2-2014-12-09/build/BUILD/re2/nfa.cc:167:9
    #2 0x52fb1d in re2::NFA::AddToThreadq(re2::SparseArray<re2::NFA::Thread*>*, int, int, char const*, char const**) /home/yiru/fuzzer-test-suite/fuzzer-test-suite/re2-2014-12-09/build/BUILD/re2/nfa.cc:234:11
    #3 0x531894 in re2::NFA::Search(re2::StringPiece const&, re2::StringPiece const&, bool, bool, re2::StringPiece*, int) /home/yiru/fuzzer-test-suite/fuzzer-test-suite/re2-2014-12-09/build/BUILD/re2/nfa.cc:585:7
    #4 0x535208 in re2::Prog::SearchNFA(re2::StringPiece const&, re2::StringPiece const&, re2::Prog::Anchor, re2::Prog::MatchKind, re2::StringPiece*, int) /home/yiru/fuzzer-test-suite/fuzzer-test-suite/re2-2014-12-09/build/BUILD/re2/nfa.cc:701:12
    #5 0x4d55cd in re2::RE2::Match(re2::StringPiece const&, int, int, re2::RE2::Anchor, re2::StringPiece*, int) const /home/yiru/fuzzer-test-suite/fuzzer-test-suite/re2-2014-12-09/build/BUILD/re2/re2.cc:768:19
    #6 0x4d01ac in re2::RE2::DoMatch(re2::StringPiece const&, re2::RE2::Anchor, int*, re2::RE2::Arg const* const*, int) const /home/yiru/fuzzer-test-suite/fuzzer-test-suite/re2-2014-12-09/build/BUILD/re2/re2.cc:817:8
    #7 0x4c87c5 in operator() /home/yiru/fuzzer-test-suite/fuzzer-test-suite/re2-2014-12-09/build/BUILD/re2/variadic_function.h:15:12
    #8 0x4c87c5 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/re2-2014-12-09/build/../target.cc:27:5
    #9 0x5607d8 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #10 0x5607d8 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #11 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/yiru/fuzzer-test-suite/fuzzer-test-suite/re2-2014-12-09/build/BUILD/re2/nfa.cc:532:31 in re2::NFA::Search(re2::StringPiece const&, re2::StringPiece const&, bool, bool, re2::StringPiece*, int)
Shadow bytes around the buggy address:
  0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff8000: fa fa fd fd fa fa fd fd fa fa 00 00 fa fa fd fd
  0x0c047fff8010: fa fa fd fd fa fa fd fd fa fa 01 fa fa fa fd fa
=>0x0c047fff8020: fa fa 00 00 fa[fa]00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8030: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8040: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff8050: fa fa 00 00 fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3887751==ABORTING

用AFL -d模式运行一个半小时，没有crash，代码覆盖率持续增长。
在这里插入图片描述

sqlite-2016-11-14

运行编译好的程序
运行运行提供的crash:

  • crash-0adc497ccfcc1a4d5e031b735c599df0cae3f4eb
/sqlite-2016-11-14-afl ../crash-0adc497ccfcc1a4d5e031b735c599df0cae3f4eb 
======================= INFO =========================
This binary is built for AFL-fuzz.
To run the target function on individual input(s) execute this:
  ./sqlite-2016-11-14-afl < INPUT_FILE
or
  ./sqlite-2016-11-14-afl INPUT_FILE1 [INPUT_FILE2 ... ]
To fuzz with afl-fuzz execute this:
  afl-fuzz [afl-flags] ./sqlite-2016-11-14-afl [-N]
afl-fuzz will run N iterations before re-spawning the process (default: 1000)
======================================================
Reading 88 bytes from ../crash-0adc497ccfcc1a4d5e031b735c599df0cae3f4eb
=================================================================
==3326656==ERROR: AddressSanitizer: heap-use-after-free on address 0x6190000028f8 at pc 0x00000084443c bp 0x7fffffffbf70 sp 0x7fffffffbf68
READ of size 8 at 0x6190000028f8 thread T0
    #0 0x84443b in exprAnalyze /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:127734:22
    #1 0x7dfc16 in sqlite3WhereExprAnalyze /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:127858:5
    #2 0x7dfc16 in sqlite3WhereBegin /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:132407:3
    #3 0x6d0a03 in sqlite3Select /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:119628:14
    #4 0x6672b5 in yy_reduce /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:135421:3
    #5 0x52376c in sqlite3Parser /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:136530:7
    #6 0x52376c in sqlite3RunParser /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:137477:7
    #7 0x65de77 in sqlite3Prepare /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:114208:5
    #8 0x51e7ed in sqlite3LockAndPrepare /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:114299:8
    #9 0x51abbf in sqlite3_prepare_v2 /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:114375:8
    #10 0x51abbf in sqlite3_exec /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:109705:10
    #11 0x8dcaa0 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../ossfuzz.c:78:3
    #12 0x8dd778 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #13 0x8dd778 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #14 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16
    #15 0x41d67d in _start (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/sqlite-2016-11-14-afl+0x41d67d)

0x6190000028f8 is located 120 bytes inside of 1032-byte region [0x619000002880,0x619000002c88)
freed by thread T0 here:
    #0 0x495b3d in free (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/sqlite-2016-11-14-afl+0x495b3d)
    #1 0x4cc2a1 in sqlite3_free /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:24358:5
    #2 0x4cc2a1 in sqlite3DbFree /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:24401:3
    #3 0x839233 in whereClauseInsert /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:126538:7
    #4 0x841222 in exprAnalyze /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:127686:16
    #5 0x7dfc16 in sqlite3WhereExprAnalyze /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:127858:5
    #6 0x7dfc16 in sqlite3WhereBegin /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:132407:3
    #7 0x6d0a03 in sqlite3Select /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:119628:14
    #8 0x6672b5 in yy_reduce /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:135421:3
    #9 0x52376c in sqlite3Parser /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:136530:7
    #10 0x52376c in sqlite3RunParser /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:137477:7
    #11 0x65de77 in sqlite3Prepare /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:114208:5
    #12 0x51e7ed in sqlite3LockAndPrepare /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:114299:8
    #13 0x51abbf in sqlite3_prepare_v2 /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:114375:8
    #14 0x51abbf in sqlite3_exec /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:109705:10
    #15 0x8dcaa0 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../ossfuzz.c:78:3
    #16 0x8dd778 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #17 0x8dd778 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #18 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16

previously allocated by thread T0 here:
    #0 0x495dbd in malloc (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/sqlite-2016-11-14-afl+0x495dbd)
    #1 0x8d38c3 in sqlite3MemMalloc /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:20478:7
    #2 0x4ceefd in mallocWithAlarm /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:24147:7
    #3 0x4ceefd in sqlite3Malloc /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:24178:5
    #4 0x541ca5 in dbMallocRawFinish /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:24504:7
    #5 0x8391c3 in sqlite3DbMallocRawNN /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:24572:10
    #6 0x8391c3 in whereClauseInsert /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:126528:14
    #7 0x841222 in exprAnalyze /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:127686:16
    #8 0x7dfc16 in sqlite3WhereExprAnalyze /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:127858:5
    #9 0x7dfc16 in sqlite3WhereBegin /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:132407:3
    #10 0x6d0a03 in sqlite3Select /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:119628:14
    #11 0x6672b5 in yy_reduce /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:135421:3
    #12 0x52376c in sqlite3Parser /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:136530:7
    #13 0x52376c in sqlite3RunParser /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:137477:7
    #14 0x65de77 in sqlite3Prepare /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:114208:5
    #15 0x51e7ed in sqlite3LockAndPrepare /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:114299:8
    #16 0x51abbf in sqlite3_prepare_v2 /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:114375:8
    #17 0x51abbf in sqlite3_exec /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:109705:10
    #18 0x8dcaa0 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../ossfuzz.c:78:3
    #19 0x8dd778 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #20 0x8dd778 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #21 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-use-after-free /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:127734:22 in exprAnalyze
Shadow bytes around the buggy address:
  0x0c327fff84c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c327fff84d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c327fff84e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c327fff84f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c327fff8510: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]
  0x0c327fff8520: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c327fff8530: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c327fff8540: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c327fff8550: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c327fff8560: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3326656==ABORTING
  • crash-1066e42866aad3a04e6851dc494ad54bc31b9f78
./sqlite-2016-11-14-afl ../crash-1066e42866aad3a04e6851dc494ad54bc31b9f78 
======================= INFO =========================
This binary is built for AFL-fuzz.
To run the target function on individual input(s) execute this:
  ./sqlite-2016-11-14-afl < INPUT_FILE
or
  ./sqlite-2016-11-14-afl INPUT_FILE1 [INPUT_FILE2 ... ]
To fuzz with afl-fuzz execute this:
  afl-fuzz [afl-flags] ./sqlite-2016-11-14-afl [-N]
afl-fuzz will run N iterations before re-spawning the process (default: 1000)
======================================================
Reading 64 bytes from ../crash-1066e42866aad3a04e6851dc494ad54bc31b9f78
=================================================================
==3414715==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d0000004b3 at pc 0x00000049520a bp 0x7fffffffcdf0 sp 0x7fffffffc5b8
READ of size 1 at 0x60d0000004b3 thread T0
    #0 0x495209 in __asan_memcpy (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/sqlite-2016-11-14-afl+0x495209)
    #1 0x4d27ea in sqlite3VXPrintf /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c
    #2 0x512ceb in sqlite3VMPrintf /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:25667:3
    #3 0x512ceb in sqlite3ErrorMsg /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:27516:10
    #4 0x5238ca in yy_syntax_error /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:136445:3
    #5 0x5238ca in sqlite3Parser /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:136605:7
    #6 0x5238ca in sqlite3RunParser /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:137477:7
    #7 0x65de77 in sqlite3Prepare /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:114208:5
    #8 0x51e7ed in sqlite3LockAndPrepare /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:114299:8
    #9 0x51abbf in sqlite3_prepare_v2 /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:114375:8
    #10 0x51abbf in sqlite3_exec /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:109705:10
    #11 0x8dcaa0 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../ossfuzz.c:78:3
    #12 0x8dd778 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #13 0x8dd778 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #14 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16
    #15 0x41d67d in _start (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/sqlite-2016-11-14-afl+0x41d67d)

0x60d0000004b3 is located 99 bytes inside of 136-byte region [0x60d000000450,0x60d0000004d8)
freed by thread T0 here:
    #0 0x495b3d in free (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/sqlite-2016-11-14-afl+0x495b3d)
    #1 0x4cc2a1 in sqlite3_free /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:24358:5
    #2 0x4cc2a1 in sqlite3DbFree /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:24401:3
    #3 0x7b1876 in sqlite3NestedParse /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:98638:3
    #4 0x6bd079 in sqlite3CreateIndex /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:101731:5
    #5 0x6691c3 in yy_reduce /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:135304:2
    #6 0x52376c in sqlite3Parser /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:136530:7
    #7 0x52376c in sqlite3RunParser /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:137477:7
    #8 0x65de77 in sqlite3Prepare /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:114208:5
    #9 0x51e7ed in sqlite3LockAndPrepare /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:114299:8
    #10 0x51abbf in sqlite3_prepare_v2 /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:114375:8
    #11 0x51abbf in sqlite3_exec /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:109705:10
    #12 0x8dcaa0 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../ossfuzz.c:78:3
    #13 0x8dd778 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #14 0x8dd778 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #15 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16

previously allocated by thread T0 here:
    #0 0x495dbd in malloc (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/sqlite-2016-11-14-afl+0x495dbd)
    #1 0x8d38c3 in sqlite3MemMalloc /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:20478:7
    #2 0x4ceefd in mallocWithAlarm /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:24147:7
    #3 0x4ceefd in sqlite3Malloc /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:24178:5
    #4 0x541ca5 in dbMallocRawFinish /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:24504:7
    #5 0x54113a in sqlite3DbMallocRawNN /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:24572:10
    #6 0x54113a in sqlite3DbRealloc /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:24584:21
    #7 0x54113a in sqlite3StrAccumEnlarge /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:25523:14
    #8 0x5408c9 in enlargeAndAppend /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:25563:7
    #9 0x4d5dbc in sqlite3StrAccumAppend /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:25581:5
    #10 0x4d5dbc in sqlite3VXPrintf /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:25476:5
    #11 0x7b1501 in sqlite3VMPrintf /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:25667:3
    #12 0x7b1501 in sqlite3NestedParse /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:98628:10
    #13 0x6bd079 in sqlite3CreateIndex /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:101731:5
    #14 0x6691c3 in yy_reduce /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:135304:2
    #15 0x52376c in sqlite3Parser /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:136530:7
    #16 0x52376c in sqlite3RunParser /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:137477:7
    #17 0x65de77 in sqlite3Prepare /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:114208:5
    #18 0x51e7ed in sqlite3LockAndPrepare /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:114299:8
    #19 0x51abbf in sqlite3_prepare_v2 /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:114375:8
    #20 0x51abbf in sqlite3_exec /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:109705:10
    #21 0x8dcaa0 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../ossfuzz.c:78:3
    #22 0x8dd778 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #23 0x8dd778 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #24 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-use-after-free (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/sqlite-2016-11-14-afl+0x495209) in __asan_memcpy
Shadow bytes around the buggy address:
  0x0c1a7fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa
  0x0c1a7fff8050: fa fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00
  0x0c1a7fff8060: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
  0x0c1a7fff8070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c1a7fff8080: fd fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd
=>0x0c1a7fff8090: fd fd fd fd fd fd[fd]fd fd fd fd fa fa fa fa fa
  0x0c1a7fff80a0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c1a7fff80b0: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa
  0x0c1a7fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1a7fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1a7fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3414715==ABORTING
  • leak-b0276985af5aa23c98d9abf33856ce069ef600e2
./sqlite-2016-11-14-afl ../leak-b0276985af5aa23c98d9abf33856ce069ef600e2 
======================= INFO =========================
This binary is built for AFL-fuzz.
To run the target function on individual input(s) execute this:
  ./sqlite-2016-11-14-afl < INPUT_FILE
or
  ./sqlite-2016-11-14-afl INPUT_FILE1 [INPUT_FILE2 ... ]
To fuzz with afl-fuzz execute this:
  afl-fuzz [afl-flags] ./sqlite-2016-11-14-afl [-N]
afl-fuzz will run N iterations before re-spawning the process (default: 1000)
======================================================
Reading 2716 bytes from ../leak-b0276985af5aa23c98d9abf33856ce069ef600e2
Execution successful

=================================================================
==3495696==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 80 byte(s) in 1 object(s) allocated from:
    #0 0x495dbd in malloc (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/sqlite-2016-11-14-afl+0x495dbd)
    #1 0x8d38c3 in sqlite3MemMalloc /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:20478:7
    #2 0x4ceefd in mallocWithAlarm /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:24147:7
    #3 0x4ceefd in sqlite3Malloc /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:24178:5
    #4 0x541ca5 in dbMallocRawFinish /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:24504:7
    #5 0x733862 in sqlite3DbMallocRawNN /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:24572:10
    #6 0x733862 in sqlite3ExprAlloc /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:90536:10
    #7 0x6665f5 in yy_reduce /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:135791:28
    #8 0x52376c in sqlite3Parser /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:136530:7
    #9 0x52376c in sqlite3RunParser /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:137477:7
    #10 0x65de77 in sqlite3Prepare /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:114208:5
    #11 0x51e7ed in sqlite3LockAndPrepare /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:114299:8
    #12 0x51abbf in sqlite3_prepare_v2 /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:114375:8
    #13 0x51abbf in sqlite3_exec /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../sqlite3.c:109705:10
    #14 0x8dcaa0 in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/sqlite-2016-11-14/build/../ossfuzz.c:78:3
    #15 0x8dd778 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #16 0x8dd778 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #17 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: 80 byte(s) leaked in 1 allocation(s).

用AFL -d模式运行一个半小时没有crash，代码覆盖率从第4分钟之后就没有增加了。
在这里插入图片描述

vorbis-2017-12-11

运行编译好的程序
在这里插入图片描述

运行提供的crash:

  • crash-8c5dea6410b0fb0b21ff968a9966a0bd7956405f
 ./vorbis-2017-12-11-afl ../crash-8c5dea6410b0fb0b21ff968a9966a0bd7956405f 
======================= INFO =========================
This binary is built for AFL-fuzz.
To run the target function on individual input(s) execute this:
  ./vorbis-2017-12-11-afl < INPUT_FILE
or
  ./vorbis-2017-12-11-afl INPUT_FILE1 [INPUT_FILE2 ... ]
To fuzz with afl-fuzz execute this:
  afl-fuzz [afl-flags] ./vorbis-2017-12-11-afl [-N]
afl-fuzz will run N iterations before re-spawning the process (default: 1000)
======================================================
Reading 4096 bytes from ../crash-8c5dea6410b0fb0b21ff968a9966a0bd7956405f
=================================================================
==3088035==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61d000006280 at pc 0x000000511bd0 bp 0x7fffffffbf80 sp 0x7fffffffbf78
READ of size 16 at 0x61d000006280 thread T0
    #0 0x511bcf in vorbis_book_decodev_add /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/codebook.c:407:17
    #1 0x54e37a in _01inverse /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/res0.c:693:20
    #2 0x552044 in res1_inverse /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/res0.c:757:12
    #3 0x559b9a in mapping0_inverse /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/mapping0.c:748:5
    #4 0x4d13ca in _fetch_and_process_packet /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/vorbisfile.c:705:15
    #5 0x4d32b7 in ov_read_filter /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/vorbisfile.c:1976:15
    #6 0x4d3f45 in ov_read /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/vorbisfile.c:2096:10
    #7 0x4c71ed in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/SRC/oss-fuzz/projects/vorbis/decode_fuzzer.cc:41:19
    #8 0x4c7d18 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #9 0x4c7d18 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #10 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16
    #11 0x41c6ad in _start (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/vorbis-2017-12-11-afl+0x41c6ad)

0x61d000006280 is located 0 bytes to the right of 2048-byte region [0x61d000005a80,0x61d000006280)
allocated by thread T0 here:
    #0 0x494ded in malloc (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/vorbis-2017-12-11-afl+0x494ded)
    #1 0x4dd666 in _vorbis_block_alloc /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/block.c:115:20
    #2 0x4f1d6e in vorbis_synthesis /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/synthesis.c:82:16
    #3 0x4d13ca in _fetch_and_process_packet /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/vorbisfile.c:705:15
    #4 0x4d32b7 in ov_read_filter /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/vorbisfile.c:1976:15
    #5 0x4d3f45 in ov_read /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/vorbisfile.c:2096:10
    #6 0x4c71ed in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/SRC/oss-fuzz/projects/vorbis/decode_fuzzer.cc:41:19
    #7 0x4c7d18 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #8 0x4c7d18 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #9 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/codebook.c:407:17 in vorbis_book_decodev_add
Shadow bytes around the buggy address:
  0x0c3a7fff8c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a7fff8c10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a7fff8c20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a7fff8c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a7fff8c40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c3a7fff8c50:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a7fff8c60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a7fff8c70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a7fff8c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3a7fff8c90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a7fff8ca0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3088035==ABORTING
  • crash-23c2d78e497bf4aebe5859e3092657cb0af4c299
./vorbis-2017-12-11-afl ../crash-23c2d78e497bf4aebe5859e3092657cb0af4c299 
======================= INFO =========================
This binary is built for AFL-fuzz.
To run the target function on individual input(s) execute this:
  ./vorbis-2017-12-11-afl < INPUT_FILE
or
  ./vorbis-2017-12-11-afl INPUT_FILE1 [INPUT_FILE2 ... ]
To fuzz with afl-fuzz execute this:
  afl-fuzz [afl-flags] ./vorbis-2017-12-11-afl [-N]
afl-fuzz will run N iterations before re-spawning the process (default: 1000)
======================================================
Reading 3990 bytes from ../crash-23c2d78e497bf4aebe5859e3092657cb0af4c299
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3088224==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x00000054e25f bp 0x7fffffffbff0 sp 0x7fffffffbe40 T0)
==3088224==The signal is caused by a READ memory access.
==3088224==Hint: this fault was caused by a dereference of a high value address (see register values below).  Dissassemble the provided pc to learn which register was used.
    #0 0x54e25f in _01inverse /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/res0.c:690:35
    #1 0x552044 in res1_inverse /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/res0.c:757:12
    #2 0x559b9a in mapping0_inverse /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/mapping0.c:748:5
    #3 0x4d13ca in _fetch_and_process_packet /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/vorbisfile.c:705:15
    #4 0x4d32b7 in ov_read_filter /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/vorbisfile.c:1976:15
    #5 0x4d3f45 in ov_read /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/vorbisfile.c:2096:10
    #6 0x4c71ed in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/SRC/oss-fuzz/projects/vorbis/decode_fuzzer.cc:41:19
    #7 0x4c7d18 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #8 0x4c7d18 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #9 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16
    #10 0x41c6ad in _start (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/vorbis-2017-12-11-afl+0x41c6ad)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/res0.c:690:35 in _01inverse
==3088224==ABORTING
  • crash-e86e0482b8d66f924e50e62f5d7cc36a0acb03a7
/vorbis-2017-12-11-afl ../crash-e86e0482b8d66f924e50e62f5d7cc36a0acb03a7 
======================= INFO =========================
This binary is built for AFL-fuzz.
To run the target function on individual input(s) execute this:
  ./vorbis-2017-12-11-afl < INPUT_FILE
or
  ./vorbis-2017-12-11-afl INPUT_FILE1 [INPUT_FILE2 ... ]
To fuzz with afl-fuzz execute this:
  afl-fuzz [afl-flags] ./vorbis-2017-12-11-afl [-N]
afl-fuzz will run N iterations before re-spawning the process (default: 1000)
======================================================
Reading 321 bytes from ../crash-e86e0482b8d66f924e50e62f5d7cc36a0acb03a7
=================================================================
==3088301==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000000980 at pc 0x00000051261e bp 0x7fffffffbd90 sp 0x7fffffffbd88
READ of size 4 at 0x619000000980 thread T0
    #0 0x51261d in vorbis_book_decodevv_add /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/codebook.c:479:24
    #1 0x554464 in res2_inverse /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/res0.c:843:18
    #2 0x559b9a in mapping0_inverse /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/mapping0.c:748:5
    #3 0x4d13ca in _fetch_and_process_packet /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/vorbisfile.c:705:15
    #4 0x4d32b7 in ov_read_filter /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/vorbisfile.c:1976:15
    #5 0x4d3f45 in ov_read /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/vorbisfile.c:2096:10
    #6 0x4c71ed in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/SRC/oss-fuzz/projects/vorbis/decode_fuzzer.cc:41:19
    #7 0x4c7d18 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #8 0x4c7d18 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #9 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16
    #10 0x41c6ad in _start (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/vorbis-2017-12-11-afl+0x41c6ad)

0x619000000980 is located 0 bytes to the right of 1024-byte region [0x619000000580,0x619000000980)
allocated by thread T0 here:
    #0 0x494ded in malloc (/home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/vorbis-2017-12-11-afl+0x494ded)
    #1 0x4dd666 in _vorbis_block_alloc /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/block.c:115:20
    #2 0x4f1d6e in vorbis_synthesis /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/synthesis.c:82:16
    #3 0x4d13ca in _fetch_and_process_packet /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/vorbisfile.c:705:15
    #4 0x4d32b7 in ov_read_filter /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/vorbisfile.c:1976:15
    #5 0x4d3f45 in ov_read /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/vorbisfile.c:2096:10
    #6 0x4c71ed in LLVMFuzzerTestOneInput /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/SRC/oss-fuzz/projects/vorbis/decode_fuzzer.cc:41:19
    #7 0x4c7d18 in ExecuteFilesOnyByOne /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:216:5
    #8 0x4c7d18 in main /home/yiru/fuzzer-test-suite/libfuzzer/libfuzzer-workshop/libFuzzer/Fuzzer/afl/afl_driver.cpp:253:12
    #9 0x7ffff7a600b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/yiru/fuzzer-test-suite/fuzzer-test-suite/vorbis-2017-12-11/build/BUILD/vorbis/lib/codebook.c:479:24 in vorbis_book_decodevv_add
Shadow bytes around the buggy address:
  0x0c327fff80e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff80f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c327fff8130:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c327fff8150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff8160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff8170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c327fff8180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3088301==ABORTING

用AFL -d模式测试，运行6个小时，没有crash。
在这里插入图片描述

woff2-2016-05-06

运行编译好的程序：
在这里插入图片描述
测试提供的crash,有AddressSanitizer输出，提供的oom那个文件执行后没有报错。
用AFL运行一个半小时，没有crash，代码覆盖率也很低。
在这里插入图片描述

wpantund-2018-02-27

用coverage模式编译：

用c-ares这个程序测试，因为它能很快出现crash。初始测试用例为空文件时，afl版本的程序1分钟内能够发现crash。

  1. 尝试：custom-build.sh中FUZZING_ENGINE为afl, common.sh中FUZZING_ENGINE为coverage，build.sh asan
    编译结果运行：
    在这里插入图片描述
    用AFL跑出来的crash测试，有AddressSanitizer信息输出。
    用AFL测试，使用-Q模式会报forkserver超时。不适用-Q模式会报没有插桩。使用-n模式可以跑。跑半个小时出现了crash。运行跑出来的crash有AddressSanitizer信息输出。
    在这里插入图片描述

  2. 尝试：common.sh中FUZZING_ENGINE为coverage，build.sh
    此时不加asan这个选项，不会执行custom-build.sh中的逻辑,
    编译结果运行同上。用AFL跑出来的crash测试，没有crash输出。用AFL测试，使用-Q模式可以跑。但是跑了两个小时没有crash。

  3. 尝试：custom-build.sh中FUZZING_ENGINE为libfuzzer, common.sh中FUZZING_ENGINE为coverage，build.sh asan。用AFL跑出来的crash测试，有AddressSanitizer信息输出。用AFL测试，使用-Q模式会报forkserver超时。不适用-Q模式会报没有插桩。使用-n模式可以跑。跑了两个小时没有crash。

Yiru Zhao
关注
  • 1
    点赞
  • 踩
  • 8
    收藏
    觉得还不错? 一键收藏
  • 2
    评论
专栏目录
Path-Fuzzer-V4:主机，IP，域，URL路径模糊器
05-09
路径模糊器V4 多目标（主机，IP，域，URL /路径模糊器） 适用于Linux和Windows 支持SSL和过期的SSL链接。 支持Web > 192.0.0.1:5454或非默认端口 支持主机：端口或不端口。 该工具可针对已知响应进行自定义， 您可以编辑和取消标记需要使用的行。
android Google地图不能定位问题解决
03-03
本帖最后由 espressocafe 于 2011-12-11 12:00 编辑 此GMS包中包括下列全套完整的谷歌服务： 　　·电子市场（不是最新版，可安装完以后用电子市场升级） 　　·谷歌邮件（不是最新版，可安装完以后用电子市场升级） 　　·谷歌日历同步 　　·谷歌联系人同步 　　·谷歌地图（5.12.1，不是最新版，最新版是6.0.1，可安装完以后用电子市场升级） 　　·谷歌纵横 　　·谷歌导航 　　·谷歌搜索 　　·谷歌本地搜索 　　·谷歌语音（不是最新版，可安装完以后用电子市场升级） 　　·谷歌Talk 　　刷入前请务必确保手机已经安装Root Explorer或类似软件，且已经Root。用数据线连接电脑，连接模式为仅充电，USB调试模式已打开。（这个连接电脑就是正常的开机连入电脑，不是进什么hboot或什么recovery） 　　 　　安装方法： 　　1.将附件下载并解压到X:\adb，因为前期如果您刷机，肯定在您的某块盘上有adb这个文件夹，没有？~~~呃，在别人的教程里下载adb吧，您是怎么root并安装RE的?好吧，您赢了，我已经把adb这个4个文件一并放在包里了。 检查，X:\adb目录里面是否有adb.exe、fastboot.exe等文件，应该不少于4个，咱们这个包解出来是个叫app的文件夹，也在adb目录里，app文件夹进去就是一些后缀名为apk、xml、so的文件，保证他们没有在下层文件夹中。 好了，如果你是XP系统，请按下Win+R，输入CMD回车，然后输入以下命令： cd\ x: (这个X如果是c的话就省略了吧，我的是D，就是换到d盘) cd adb 进入adb文件夹了吧？ 如果是win7,简单多了，在图形界面进入X:\adb目录，按住SHIFT键同时点鼠标右键，选在此处打开命令行，呃，也进来了吧？ 2.依次输入以下命令： adb shell mkdir sdcard/temp/ （在您手机sd卡上建立了一个叫temp的文件夹） adb push app sdcard/temp/ （把您adb目录下app文件夹中的所有内容拷贝到手机sd卡temp目录中） adb shell （看提示符，是不是已经变成$了？） su （嗯，这下变成#了吧？） 好啦，为了防止出错，有经验的同学可以继续以命令行方式输入cp sdcard/temp/*.apk /system/app/，cp sdcard/temp/*.so /system/lib/，cp sdcard/temp/*.xml /system/etc/permissions/，cp sdcard/temp/*.jar /system/framework/而没经验的同学请先不要管电脑上的命令了，拿起手机打开RE，找到sdcard，进去后找到temp文件夹，进入，用多选模式，把文件夹中的所有的apk文件（一大堆）移动到/system/app文件夹中，把所有的so文件（2个还是3个？）移动到/system/lib文件夹中，把所有的xml 文件（好像就1个）移动到 /system/etc/permissions文件夹中，把所有的jar文件（好像也就1个）移动到/system/framework文件夹中。好了么？sd卡上的temp文件夹也可以顺手删除了，使命已经完成了。别忘了Root Explorer要点击左上角的按钮切换到Mount R/O状态，否则写不进去啊。 好啦，还要统一改一下拷入系统那些文件的权限，都回到电脑上来，那个#还在闪呢！输入： chmod 644 /system/lib/*.so /system/app/*.apk /system/framework/*.jar /system/etc/permissions/*.xml，成功了的表现就是系统给你重复了一遍……（好2啊~~~~） 至此GMS包已全部刷入完毕，重启手机即可。如出现mkdir failed for sdcard/temp/,File exists的提示，则表明手机已经存在temp这个文件夹了，那么继续进行下面的操作即可。
学习libfuzzer使用（一）
Alicheche的博客
10-13 821
模糊测试工具libfuzzer使用，参考官方文档和其他博客汇总整理
探秘Google的Fuzzer Test Suite：提升软件安全性与稳定性
最新发布
gitblog_00010的博客
03-26 525
探秘Google的Fuzzer Test Suite：提升软件安全性与稳定性 项目地址:https://gitcode.com/google/fuzzer-test-suite 在软件开发中，测试是保证代码质量、性能和安全性的关键环节，特别是对于那些涉及大量数据输入和处理的应用程序而言。而模糊测试（Fuzz Testing）作为一种动态测试方法，通过生成随机输入来发现程序中的错误和漏洞。现在，让...
经典 Fuzzer 工具 AFL 模糊测试指南
热门推荐
个人笔记
03-30 1万+
AFL（American Fuzzy Lop）是由安全研究员Michał Zalewski 开发的一款基于覆盖引导（Coverage-guided）的模糊测试工具。通过记录输入样本的代码覆盖率，不断对输入进行变异，从而达到更高的代码覆盖率。AFL 采用新型的编译时插桩和遗传算法自动发现新的测试用例，这些用例会触发目标二进制文件中的新内部状态。这大大改善了模糊测试的代码覆盖范围。 从源码编译程序时...
Evaluating Fuzz Testing
04-05 968
1 介绍 信息量太大回头再写。。 # 一天后更新 不想写了差不多就下面这些内容吧。。 2 背景 2.1 fuzzing流程 fuzzing的核心算法 initSeedCorpus：初始化新的输入 isDone：决定fuzzing是否停止 choose：从队列中选择至少一个种子输入进行变异 mutate：从至少一个种子输入和观察到的现象中产生新的候选种子 eval：评价程序的种子产生观察现象 is...
What is Fuzz Testing?
井底之蛙
09-19 2311
What is Fuzz Testing?Fuzz testing or Fuzzing is a software testing technique, often used to discover security weaknesses in applications and protocols. The basic idea is to attach the inputs of a
google fuzzer-test-suite
学术渣渣的博客
05-08 1359
Google fuzzer-test-suite数据集 数据集下载地址 https://github.com/google/fuzzer-test-suite 数据集介绍 Google fuzzer-test-suite has applications spanning various domains like image processing, SQL, json parsing, etc. This test suite is inspired by real-life application
[论文分享] PATA: Fuzzing with Path Aware Taint Analysis
fa1c4的blog
06-07 1204
PATA: Fuzzing with Path Aware Taint Analysis 概述 方法 实验 总结
将AFLGo用于谷歌的fuzzer-test-suite
qq_39209008的博客
08-20 610
将AFLGo应用于谷歌的fuzzer-test-suite
转：libFuzzer Tutorial(libFuzzer教程)
weixin_30242907的博客
07-06 834
转：https://github.com/google/fuzzer-test-suite/blob/master/tutorial/libFuzzerTutorial.md 本文在Ubuntu16下测试成功。由于windows配置复杂，暂时未尝试。目前应用于开源。 Introduction In this tutorial you will learn how to useli...
AFL-Visualization
05-21
AFL可视化 这是我在2020年5月完成的一个项目，数据集来自kaggle 。
nuf-fuzzer-开源
04-26
nuf-fuzzer是基于mangleme模糊器概念的功能强大的浏览器模糊器。 可以对html标签，css标签，javascript函数和DOM对象进行模糊处理。
Lazy Fuzzer-crx插件
04-01
语言:English 帮助模糊各种输入字段 使用穿透测试的辅助易用功能。
APIFuzzer-0.9.11-py3-none-any.whl.zip
03-11
APIFuzzer-0.9.11-py3-none-any.whl.zip
APIFuzzer-0.9.13-py3-none-any.whl.zip
03-11
APIFuzzer-0.9.13-py3-none-any.whl.zip
针对Google 的 fuzzer-test-suite 的 pcre2-10.00 编译失败的解决方法
weixin_40502018的博客
12-08 106
我们需要源码，即图中最后两个链接，此处我们选择了tar包。中下载操作注释，之后在相应的路径下重新执行此文件即可！以上操作全部正确完成之后，我们只需要将文件。失效，导致编译无法进行下去！，我们知道我们需要手动下载。祝大家都成功安装配置。
漏洞挖掘论文常用数据集
kelxLZ的博客
04-02 2500
Author：ZERO-A-ONE Date：2021-03-31 一、简介 最近因为写有关于模糊测试的论文，需要相关数据集，故进行了一些调研和收集，此贴长期更新于Gtihub，地址如下 https://github.com/ZERO-A-ONE/Fuzzing-data-set.git 一般来说漏洞挖掘的论文一般会有两方面的数据展示： 常用的测试数据集，也就是本贴主要收集的 常用软件，也就是面对真实软件的漏洞挖掘情况 二、数据集 cb-multios：基于DARPA Challenge的测试数.
test 404 http fuzzer
09-06
test 404 http fuzzer，全称为测试404 HTTP模糊测试工具。它是一种用于测试Web应用程序的工具，旨在模拟和探测HTTP 404错误页面的功能和安全性。 测试404 HTTP模糊测试工具通过向Web应用程序发送各种特定的HTTP请求来评估应用程序对错误页面的处理和响应。这些请求中包含了一些经过精心设计的特殊字符、攻击字符串和其他异常情况，以测试应用程序是否能够正确地处理这些情况。这有助于检测潜在的安全漏洞和错误处理机制。 这个工具的主要作用是帮助提高Web应用程序的安全性，通过模拟攻击者可能使用的恶意输入来测试应用程序的强壮性。通过检测和修复这些潜在的漏洞，开发人员可以提高应用程序的安全性，减少潜在的风险。 测试404 HTTP模糊测试工具通常会提供一系列预定义的模糊测试模板，开发人员可以根据需要进行定制。它还会生成详细的报告，列出发现的问题和建议的修复措施。 总而言之，测试404 HTTP模糊测试工具是一种帮助开发人员测试Web应用程序的工具，它通过模拟攻击者可能使用的特殊字符和攻击字符串来评估应用程序对错误页面的处理和安全性。它可以提高应用程序的安全性，减少潜在的漏洞和风险。

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论 2
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值