Rooba
/
oss-fuzz
mirror of https://github.com/google/oss-fuzz.git
1
1
Fork 0
Code Issues Packages Projects Releases Wiki Activity

afl++: increase forkserver timeout (#5784)

This commit is contained in:
van Hauser 2021-05-24 22:43:34 +02:00 committed by GitHub
parent f053e761ec
commit 878a05a092
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 19 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
infra/base-images/base-builder/Dockerfile
View File

@ -181,7 +181,7 @@ WORKDIR $SRC
# TODO: switch to -b stable once we can.
RUN git clone https://github.com/AFLplusplus/AFLplusplus.git aflplusplus && \
cd aflplusplus && \
git checkout f4cc718fdc4571f56280a1efad3645125bee2154
git checkout 5997a4fc09163c1baa186f5a9d00c4c8668a72b1
RUN cd $SRC && \
curl -L -O https://github.com/google/honggfuzz/archive/oss-fuzz.tar.gz && \

19
infra/base-images/base-builder/compile_afl
View File

@ -21,7 +21,7 @@
# AFL++ settings.
export AFL_LLVM_MODE_WORKAROUND=0
export AFL_ENABLE_DICTIONARY=1
export AFL_ENABLE_DICTIONARY=0
# Start compiling afl++.
echo "Copying precompiled afl++"
@ -45,25 +45,30 @@ export ASAN_OPTIONS="detect_leaks=0:symbolize=0:detect_odr_violation=0:abort_on_
# AFL compile option roulette. It is OK if they all happen together.
# 30% chance for CTX-2 coverage instrumentation (Caller conTeXt sensitive
# 20% chance for CTX-2 coverage instrumentation (Caller conTeXt sensitive
# edge coverage).
test $(($RANDOM % 10)) -lt 3 && {
test $(($RANDOM % 100)) -lt 20 && {
export AFL_LLVM_INSTRUMENT=CLASSIC,CTX-2
}
# 40% chance to create a dictionary.
test $(($RANDOM % 100)) -lt 40 && {
export AFL_ENABLE_DICTIONARY=1
}
# 40% chance to perform CMPLOG/REDQUEEN.
rm -f "$OUT/afl_cmplog.txt"
test $(($RANDOM % 10)) -lt 4 && {
test $(($RANDOM % 100)) -lt 20 && {
export AFL_LLVM_CMPLOG=1
touch "$OUT/afl_cmplog.txt"
}
# 10% chance to perform COMPCOV/LAF_INTEL.
test $(($RANDOM % 10)) -lt 1 && {
# 3% chance to perform COMPCOV/LAF_INTEL.
test $(($RANDOM % 100)) -lt 3 && {
export AFL_LLVM_LAF_ALL=1
}
# If the targets wants a dictionary - then create one.
# Create a dictionary if one is wanted.
test "$AFL_ENABLE_DICTIONARY" = "1" && {
export AFL_LLVM_DICT2FILE="$OUT/afl++.dict"
}

10
infra/base-images/base-runner/bad_build_check
View File

@ -90,10 +90,7 @@ function check_engine {
echo "BAD BUILD: $FUZZER seems to have only partial coverage instrumentation."
fi
elif [[ "$FUZZING_ENGINE" == afl ]]; then
# TODO(https://github.com/google/oss-fuzz/issues/2470): Dont use
# AFL_DRIVER_DONT_DEFER by default, support .options files in
# bad_build_check instead.
AFL_DRIVER_DONT_DEFER=1 AFL_NO_UI=1 SKIP_SEED_CORPUS=1 timeout --preserve-status -s INT 20s run_fuzzer $FUZZER_NAME &>$FUZZER_OUTPUT
AFL_FORKSRV_INIT_TMOUT=30000 AFL_NO_UI=1 SKIP_SEED_CORPUS=1 timeout --preserve-status -s INT 35s run_fuzzer $FUZZER_NAME &>$FUZZER_OUTPUT
CHECK_PASSED=$(egrep "All set and ready to roll" -c $FUZZER_OUTPUT)
if (( $CHECK_PASSED == 0 )); then
echo "BAD BUILD: fuzzing $FUZZER with afl-fuzz failed."
@ -136,10 +133,7 @@ function check_startup_crash {
SKIP_SEED_CORPUS=1 run_fuzzer $FUZZER_NAME -seed=1337 -runs=$MIN_NUMBER_OF_RUNS &>$FUZZER_OUTPUT
CHECK_PASSED=$(egrep "Done $MIN_NUMBER_OF_RUNS runs" -c $FUZZER_OUTPUT)
elif [[ "$FUZZING_ENGINE" = afl ]]; then
# TODO(https://github.com/google/oss-fuzz/issues/2470): Dont use
# AFL_DRIVER_DONT_DEFER by default, support .options files in
# bad_build_check instead.
AFL_DRIVER_DONT_DEFER=1 AFL_NO_UI=1 SKIP_SEED_CORPUS=1 timeout --preserve-status -s INT 20s run_fuzzer $FUZZER_NAME &>$FUZZER_OUTPUT
AFL_FORKSRV_INIT_TMOUT=30000 AFL_NO_UI=1 SKIP_SEED_CORPUS=1 timeout --preserve-status -s INT 35s run_fuzzer $FUZZER_NAME &>$FUZZER_OUTPUT
if [ $(egrep "target binary (crashed|terminated)" -c $FUZZER_OUTPUT) -eq 0 ]; then
CHECK_PASSED=1
fi

10
infra/base-images/base-runner/run_fuzzer
View File

@ -105,15 +105,13 @@ if [[ "$FUZZING_ENGINE" = afl ]]; then
export AFL_SKIP_CPUFREQ=1
export AFL_NO_AFFINITY=1
export AFL_FAST_CAL=1
export AFL_FORKSRV_INIT_TMOUT=30000
# If $OUT/afl_cmplog.txt is present this means the target was compiled for
# CMPLOG. So we have to add the proper parameters to afl-fuzz. `-l 2` is
# CMPLOG level 2, which will colorize larger files but not huge files and
# not enable transform analysis unless there have been several cycles without
# any finds.
test -e "$OUT/afl_cmplog.txt" && AFL_FUZZER_ARGS="$AFL_FUZZER_ARGS -l 2 -c $OUT/$FUZZER"
# CMPLOG. So we have to add the proper parameters to afl-fuzz.
test -e "$OUT/afl_cmplog.txt" && AFL_FUZZER_ARGS="$AFL_FUZZER_ARGS -c $OUT/$FUZZER"
# If $OUT/afl++.dict we load it as a dictionary for afl-fuzz.
test -e "$OUT/afl++.dict" && AFL_FUZZER_ARGS="$AFL_FUZZER_ARGS -x $OUT/afl++.dict"
# Ensure timeout is a bit large than 1sec as some of the OSS-Fuzz fuzzers
# Ensure timeout is a bit larger than 1sec as some of the OSS-Fuzz fuzzers
# are slower than this.
AFL_FUZZER_ARGS="$AFL_FUZZER_ARGS -t 5000+"
# AFL expects at least 1 file in the input dir.