Re: [Xen-devel] [PATCH v2] fuzz/x86_emulate: fix bounds for input size
On Mon, Feb 26, 2018 at 10:33:40AM +, Wei Liu wrote: > On Fri, Feb 23, 2018 at 11:48:57PM +0100, Paul Semel wrote: > > The maximum size for the input size was set to INPUT_SIZE, which is actually > > the size of the data array inside the fuzz_corpus structure and so was not > > abling user (or AFL) to fill in the whole structure. Changing to > > sizeof(struct fuzz_corpus) correct this problem. > > > > Signed-off-by: Paul Semel > > Acked-by: Wei Liu Applied. Thanks for your patch. ___ Xen-devel mailing list Xen-devel@lists.xenproject.org https://lists.xenproject.org/mailman/listinfo/xen-devel
Re: [Xen-devel] [PATCH v2] fuzz/x86_emulate: fix bounds for input size
Hey George, On 02/27/2018 11:39 AM, George Dunlap wrote: Thanks for the patch. Looking a bit more at the code over the weekend, I figured out what that BUILD_BUG_ON() is for -- in afl_harness.c, we statically allocate a buffer of size INPUT_SIZE to hold the fuzz data. The BUILD_BUG_ON() is to make sure that this buffer is always big enough to hold the minimum input size. And increasing the size accepted by LLVMFuzzerTestOneInput() won't have any effect for anybody using afl-harness, as the size passed in will never be larger than INPUT_SIZE. Thanks for replying me ! Actually, I understood what this BUILD_BUG_ON() was for and I totally agree with you 🙂 Anyway, I am pretty sure that this check is not needed anymore for the new changes I made, as the condition is never reachable anymore. Are you running afl-harness, or are you using fuzz-emul directly some other way (e.g., through Google's fuzzing service)? I am actually not using it, but I discovered this tool some time before, and I am now trying to port the idea on an other emulator project.. 🙂 Anyway, I made much changes on my own version, and if it still does interest you, I can share those changes with you once I'm done with my thing ! -George -- Paul ___ Xen-devel mailing list Xen-devel@lists.xenproject.org https://lists.xenproject.org/mailman/listinfo/xen-devel
Re: [Xen-devel] [PATCH v2] fuzz/x86_emulate: fix bounds for input size
On 02/23/2018 10:48 PM, Paul Semel wrote: > The maximum size for the input size was set to INPUT_SIZE, which is actually > the size of the data array inside the fuzz_corpus structure and so was not > abling user (or AFL) to fill in the whole structure. Changing to > sizeof(struct fuzz_corpus) correct this problem. > > Signed-off-by: Paul Semel Hey Paul, Thanks for the patch. Looking a bit more at the code over the weekend, I figured out what that BUILD_BUG_ON() is for -- in afl_harness.c, we statically allocate a buffer of size INPUT_SIZE to hold the fuzz data. The BUILD_BUG_ON() is to make sure that this buffer is always big enough to hold the minimum input size. And increasing the size accepted by LLVMFuzzerTestOneInput() won't have any effect for anybody using afl-harness, as the size passed in will never be larger than INPUT_SIZE. Are you running afl-harness, or are you using fuzz-emul directly some other way (e.g., through Google's fuzzing service)? -George ___ Xen-devel mailing list Xen-devel@lists.xenproject.org https://lists.xenproject.org/mailman/listinfo/xen-devel
Re: [Xen-devel] [PATCH v2] fuzz/x86_emulate: fix bounds for input size
On Fri, Feb 23, 2018 at 11:48:57PM +0100, Paul Semel wrote: > The maximum size for the input size was set to INPUT_SIZE, which is actually > the size of the data array inside the fuzz_corpus structure and so was not > abling user (or AFL) to fill in the whole structure. Changing to > sizeof(struct fuzz_corpus) correct this problem. > > Signed-off-by: Paul Semel Acked-by: Wei Liu ___ Xen-devel mailing list Xen-devel@lists.xenproject.org https://lists.xenproject.org/mailman/listinfo/xen-devel