|
| 1 | +# Copyright 2020 Google LLC |
| 2 | +# |
| 3 | +# Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +# you may not use this file except in compliance with the License. |
| 5 | +# You may obtain a copy of the License at |
| 6 | +# |
| 7 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +# |
| 9 | +# Unless required by applicable law or agreed to in writing, software |
| 10 | +# distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +# See the License for the specific language governing permissions and |
| 13 | +# limitations under the License. |
| 14 | +# |
| 15 | +"""Integration code for a LibAFL-based fuzzer.""" |
| 16 | + |
| 17 | +import os |
| 18 | +import subprocess |
| 19 | + |
| 20 | +from fuzzers import utils |
| 21 | + |
| 22 | + |
| 23 | +def prepare_fuzz_environment(input_corpus): |
| 24 | + """Prepare to fuzz with a LibAFL-based fuzzer.""" |
| 25 | + os.environ["ASAN_OPTIONS"] = ( |
| 26 | + "abort_on_error=1:detect_leaks=0:" |
| 27 | + "malloc_context_size=0:symbolize=0:" |
| 28 | + "allocator_may_return_null=1:" |
| 29 | + "detect_odr_violation=0:handle_segv=0:" |
| 30 | + "handle_sigbus=0:handle_abort=0:" |
| 31 | + "handle_sigfpe=0:handle_sigill=0" |
| 32 | + ) |
| 33 | + os.environ["UBSAN_OPTIONS"] = ( |
| 34 | + "abort_on_error=1:" |
| 35 | + "allocator_release_to_os_interval_ms=500:" |
| 36 | + "handle_abort=0:handle_segv=0:" |
| 37 | + "handle_sigbus=0:handle_sigfpe=0:" |
| 38 | + "handle_sigill=0:print_stacktrace=0:" |
| 39 | + "symbolize=0:symbolize_inline_frames=0" |
| 40 | + ) |
| 41 | + # Create at least one non-empty seed to start. |
| 42 | + utils.create_seed_file_for_empty_corpus(input_corpus) |
| 43 | + |
| 44 | + |
| 45 | +def build(): # pylint: disable=too-many-branches,too-many-statements |
| 46 | + """Build benchmark.""" |
| 47 | + os.environ["CC"] = ( |
| 48 | + "/libafl/fuzzers/fuzzbench/fuzzbench_fast/target/release-fuzzbench/libafl_cc" |
| 49 | + ) |
| 50 | + os.environ["CXX"] = ( |
| 51 | + "/libafl/fuzzers/fuzzbench/fuzzbench_fast/target/release-fuzzbench/libafl_cxx" |
| 52 | + ) |
| 53 | + |
| 54 | + os.environ["ASAN_OPTIONS"] = "abort_on_error=0:allocator_may_return_null=1" |
| 55 | + os.environ["UBSAN_OPTIONS"] = "abort_on_error=0" |
| 56 | + |
| 57 | + cflags = ["--libafl"] |
| 58 | + cxxflags = ["--libafl", "--std=c++14"] |
| 59 | + utils.append_flags("CFLAGS", cflags) |
| 60 | + utils.append_flags("CXXFLAGS", cxxflags) |
| 61 | + utils.append_flags("LDFLAGS", cflags) |
| 62 | + |
| 63 | + os.environ["FUZZER_LIB"] = "/stub_rt.a" |
| 64 | + utils.build_benchmark() |
| 65 | + |
| 66 | + |
| 67 | +def fuzz(input_corpus, output_corpus, target_binary): |
| 68 | + """Run fuzzer.""" |
| 69 | + prepare_fuzz_environment(input_corpus) |
| 70 | + dictionary_path = utils.get_dictionary_path(target_binary) |
| 71 | + command = [target_binary] |
| 72 | + if dictionary_path: |
| 73 | + command += ["-x", dictionary_path] |
| 74 | + command += ["-o", output_corpus, "-i", input_corpus] |
| 75 | + fuzzer_env = os.environ.copy() |
| 76 | + fuzzer_env["LD_PRELOAD"] = "/usr/lib/x86_64-linux-gnu/libjemalloc.so.2" |
| 77 | + fuzzer_env["FUZZSHARK_TARGET"] = "tcp" |
| 78 | + print(command) |
| 79 | + subprocess.check_call(command, cwd=os.environ["OUT"], env=fuzzer_env) |
0 commit comments