diff --git a/infra/base-images/base-builder/Dockerfile b/infra/base-images/base-builder/Dockerfile index f7dc0ee4d..40b993165 100644 --- a/infra/base-images/base-builder/Dockerfile +++ b/infra/base-images/base-builder/Dockerfile @@ -181,7 +181,7 @@ WORKDIR $SRC # TODO: switch to -b stable once we can. RUN git clone https://github.com/AFLplusplus/AFLplusplus.git aflplusplus && \ cd aflplusplus && \ - git checkout f4cc718fdc4571f56280a1efad3645125bee2154 + git checkout 5997a4fc09163c1baa186f5a9d00c4c8668a72b1 RUN cd $SRC && \ curl -L -O https://github.com/google/honggfuzz/archive/oss-fuzz.tar.gz && \ diff --git a/infra/base-images/base-builder/compile_afl b/infra/base-images/base-builder/compile_afl index f2f5aa0c4..2764d8d9c 100644 --- a/infra/base-images/base-builder/compile_afl +++ b/infra/base-images/base-builder/compile_afl @@ -21,7 +21,7 @@ # AFL++ settings. export AFL_LLVM_MODE_WORKAROUND=0 -export AFL_ENABLE_DICTIONARY=1 +export AFL_ENABLE_DICTIONARY=0 # Start compiling afl++. echo "Copying precompiled afl++" @@ -45,25 +45,30 @@ export ASAN_OPTIONS="detect_leaks=0:symbolize=0:detect_odr_violation=0:abort_on_ # AFL compile option roulette. It is OK if they all happen together. -# 30% chance for CTX-2 coverage instrumentation (Caller conTeXt sensitive +# 20% chance for CTX-2 coverage instrumentation (Caller conTeXt sensitive # edge coverage). -test $(($RANDOM % 10)) -lt 3 && { +test $(($RANDOM % 100)) -lt 20 && { export AFL_LLVM_INSTRUMENT=CLASSIC,CTX-2 } +# 40% chance to create a dictionary. +test $(($RANDOM % 100)) -lt 40 && { + export AFL_ENABLE_DICTIONARY=1 +} + # 40% chance to perform CMPLOG/REDQUEEN. rm -f "$OUT/afl_cmplog.txt" -test $(($RANDOM % 10)) -lt 4 && { +test $(($RANDOM % 100)) -lt 20 && { export AFL_LLVM_CMPLOG=1 touch "$OUT/afl_cmplog.txt" } -# 10% chance to perform COMPCOV/LAF_INTEL. -test $(($RANDOM % 10)) -lt 1 && { +# 3% chance to perform COMPCOV/LAF_INTEL. +test $(($RANDOM % 100)) -lt 3 && { export AFL_LLVM_LAF_ALL=1 } -# If the targets wants a dictionary - then create one. +# Create a dictionary if one is wanted. test "$AFL_ENABLE_DICTIONARY" = "1" && { export AFL_LLVM_DICT2FILE="$OUT/afl++.dict" } diff --git a/infra/base-images/base-runner/bad_build_check b/infra/base-images/base-runner/bad_build_check index 01f8fbbab..48c9ed474 100755 --- a/infra/base-images/base-runner/bad_build_check +++ b/infra/base-images/base-runner/bad_build_check @@ -90,10 +90,7 @@ function check_engine { echo "BAD BUILD: $FUZZER seems to have only partial coverage instrumentation." fi elif [[ "$FUZZING_ENGINE" == afl ]]; then - # TODO(https://github.com/google/oss-fuzz/issues/2470): Dont use - # AFL_DRIVER_DONT_DEFER by default, support .options files in - # bad_build_check instead. - AFL_DRIVER_DONT_DEFER=1 AFL_NO_UI=1 SKIP_SEED_CORPUS=1 timeout --preserve-status -s INT 20s run_fuzzer $FUZZER_NAME &>$FUZZER_OUTPUT + AFL_FORKSRV_INIT_TMOUT=30000 AFL_NO_UI=1 SKIP_SEED_CORPUS=1 timeout --preserve-status -s INT 35s run_fuzzer $FUZZER_NAME &>$FUZZER_OUTPUT CHECK_PASSED=$(egrep "All set and ready to roll" -c $FUZZER_OUTPUT) if (( $CHECK_PASSED == 0 )); then echo "BAD BUILD: fuzzing $FUZZER with afl-fuzz failed." @@ -136,10 +133,7 @@ function check_startup_crash { SKIP_SEED_CORPUS=1 run_fuzzer $FUZZER_NAME -seed=1337 -runs=$MIN_NUMBER_OF_RUNS &>$FUZZER_OUTPUT CHECK_PASSED=$(egrep "Done $MIN_NUMBER_OF_RUNS runs" -c $FUZZER_OUTPUT) elif [[ "$FUZZING_ENGINE" = afl ]]; then - # TODO(https://github.com/google/oss-fuzz/issues/2470): Dont use - # AFL_DRIVER_DONT_DEFER by default, support .options files in - # bad_build_check instead. - AFL_DRIVER_DONT_DEFER=1 AFL_NO_UI=1 SKIP_SEED_CORPUS=1 timeout --preserve-status -s INT 20s run_fuzzer $FUZZER_NAME &>$FUZZER_OUTPUT + AFL_FORKSRV_INIT_TMOUT=30000 AFL_NO_UI=1 SKIP_SEED_CORPUS=1 timeout --preserve-status -s INT 35s run_fuzzer $FUZZER_NAME &>$FUZZER_OUTPUT if [ $(egrep "target binary (crashed|terminated)" -c $FUZZER_OUTPUT) -eq 0 ]; then CHECK_PASSED=1 fi diff --git a/infra/base-images/base-runner/run_fuzzer b/infra/base-images/base-runner/run_fuzzer index b9bc8d9d6..17cfac0c9 100755 --- a/infra/base-images/base-runner/run_fuzzer +++ b/infra/base-images/base-runner/run_fuzzer @@ -105,15 +105,13 @@ if [[ "$FUZZING_ENGINE" = afl ]]; then export AFL_SKIP_CPUFREQ=1 export AFL_NO_AFFINITY=1 export AFL_FAST_CAL=1 + export AFL_FORKSRV_INIT_TMOUT=30000 # If $OUT/afl_cmplog.txt is present this means the target was compiled for - # CMPLOG. So we have to add the proper parameters to afl-fuzz. `-l 2` is - # CMPLOG level 2, which will colorize larger files but not huge files and - # not enable transform analysis unless there have been several cycles without - # any finds. - test -e "$OUT/afl_cmplog.txt" && AFL_FUZZER_ARGS="$AFL_FUZZER_ARGS -l 2 -c $OUT/$FUZZER" + # CMPLOG. So we have to add the proper parameters to afl-fuzz. + test -e "$OUT/afl_cmplog.txt" && AFL_FUZZER_ARGS="$AFL_FUZZER_ARGS -c $OUT/$FUZZER" # If $OUT/afl++.dict we load it as a dictionary for afl-fuzz. test -e "$OUT/afl++.dict" && AFL_FUZZER_ARGS="$AFL_FUZZER_ARGS -x $OUT/afl++.dict" - # Ensure timeout is a bit large than 1sec as some of the OSS-Fuzz fuzzers + # Ensure timeout is a bit larger than 1sec as some of the OSS-Fuzz fuzzers # are slower than this. AFL_FUZZER_ARGS="$AFL_FUZZER_ARGS -t 5000+" # AFL expects at least 1 file in the input dir.