Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fuzzing hangs in QemuProcess::send_payload #4

Open
BiTOk opened this issue Jan 8, 2022 · 0 comments
Open

Fuzzing hangs in QemuProcess::send_payload #4

BiTOk opened this issue Jan 8, 2022 · 0 comments

Comments

@BiTOk
Copy link

BiTOk commented Jan 8, 2022

I'm trying to fuzz libxml2 by your article, but after several minutes AFL++ hangs with the following stacktrace:

#0 0x00007fea4174d9e0 in recv () from /usr/lib/libpthread.so.0
#1 0x000055df7eac5344 in std::sys::unix::net::Socket::recv_with_flags (buf=..., flags=0, self=) at library/std/src/sys/unix/net.rs:245
#2 std::sys::unix::net::Socket::read (buf=..., self=) at library/std/src/sys/unix/net.rs:251
#3 std::os::unix::net::stream::{impl#3}::read (buf=..., self=) at library/std/src/os/unix/net/stream.rs:637
#4 std::os::unix::net::stream::{impl#2}::read (self=, buf=...) at library/std/src/os/unix/net/stream.rs:616
#5 0x000055df7e9a5170 in std::io::default_read_exact ()
#6 0x000055df7e9a287e in fuzz_runner::nyx::qemu_process::QemuProcess::send_payload ()
#7 0x000055df7e99f7a3 in nyx_exec ()
#8 0x000055df7e98e3cb in afl_fsrv_run_target (fsrv=fsrv@entry=0x7fea41407018, timeout=20, stop_soon_p=stop_soon_p@entry=0x7fea41409628 "")
at src/afl-forkserver.c:1315
#9 0x000055df7e964912 in fuzz_run_target (timeout=, fsrv=0x7fea41407018, afl=0x7fea41407010) at src/afl-fuzz-run.c:61
#10 common_fuzz_stuff (afl=0x7fea41407010,
out_buf=0x55df80324758 "??>?\n\377\177\n\n\n\n\367\n\n\n\n\nY=??S", '?' <repeats 13 times>, "I?1>?\205???>\037$?\035????I?'>???P?,?<?a?)Q\037?????*?d", len=126) at src/afl-fuzz-run.c:948
#11 0x000055df7e96f573 in fuzz_one_original (afl=0x7fea41407010) at src/afl-fuzz-one.c:2747
#12 0x000055df7e95e92c in fuzz_one (afl=) at src/afl-fuzz-one.c:5503
#13 main (argc=, argv_orig=, envp=) at src/afl-fuzz.c:2309

Libnyx reads from the socket, but I can't find the place where qemu should write to it.
I use no-PT configuration and 6ee670 version of AFLplusplus-Nyx. How to debug such a bug?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant