On Thu, Feb 22, 2018 at 01:39:01PM +0100, Paul Semel wrote:
> Hello,
> In the x86 instruction emulator fuzzer, when checking wether the input size
> is correct, we are checking for this bounds : DATA_OFFSET < size <
> The fact is that INPUT_SIZE is actually the size of the data buffer in the
> fuzz_corpus structure. This way, AFL is not able to have full control over
> this entry, as we are actually filling this buffer for at most
> If I understand the fuzzer correctly, we really need to give full control on
> this to AFL so that we can get some "random" from it.
> I am wondering if the bounds should rather be :
> DATA_OFFSET < size < sizeof (struct fuzz_corpus)

Yes. I think you're right.

The code has gone through several iterations. It isn't surprising that
we got something messed up in between.

(CC'ing people who modified the code before to sanity-check)

Are you up for writing a patch? I.e. replacing INPUT_SIZE with a sizeof

Also I think the BUILD_BUG_ON in fuzz_minimal_input_size should also be
fixed in a similar fashion.


> but maybe I am missing something here 🙂
> Thanks,
> -- 
> Paul Semel

Xen-devel mailing list

Reply via email to