On Thu, Feb 22, 2018 at 01:39:01PM +0100, Paul Semel wrote:
> In the x86 instruction emulator fuzzer, when checking wether the input size
> is correct, we are checking for this bounds : DATA_OFFSET < size <
> The fact is that INPUT_SIZE is actually the size of the data buffer in the
> fuzz_corpus structure. This way, AFL is not able to have full control over
> this entry, as we are actually filling this buffer for at most
> INPUT_SIZE - DATA_OFFSET.
> If I understand the fuzzer correctly, we really need to give full control on
> this to AFL so that we can get some "random" from it.
> I am wondering if the bounds should rather be :
> DATA_OFFSET < size < sizeof (struct fuzz_corpus)
Yes. I think you're right.
The code has gone through several iterations. It isn't surprising that
we got something messed up in between.
(CC'ing people who modified the code before to sanity-check)
Are you up for writing a patch? I.e. replacing INPUT_SIZE with a sizeof
Also I think the BUILD_BUG_ON in fuzz_minimal_input_size should also be
fixed in a similar fashion.
> but maybe I am missing something here 🙂
> Paul Semel
Xen-devel mailing list