You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
97 lines
3.1 KiB
97 lines
3.1 KiB
1 month ago
|
/*
|
||
|
|
Copyright 2015 Google LLC All rights reserved.
|
||
|
|
|
||
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||
|
|
you may not use this file except in compliance with the License.
|
||
|
|
You may obtain a copy of the License at:
|
||
|
|
|
||
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
||
|
|
|
||
|
|
Unless required by applicable law or agreed to in writing, software
|
||
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||
|
|
See the License for the specific language governing permissions and
|
||
|
|
limitations under the License.
|
||
|
|
*/
|
||
|
|
|
||
|
|
/*
|
||
|
|
american fuzzy lop - persistent mode example
|
||
|
|
--------------------------------------------
|
||
|
|
|
||
|
|
Written and maintained by Michal Zalewski <lcamtuf@google.com>
|
||
|
|
|
||
|
|
This file demonstrates the high-performance "persistent mode" that may be
|
||
|
|
suitable for fuzzing certain fast and well-behaved libraries, provided that
|
||
|
|
they are stateless or that their internal state can be easily reset
|
||
|
|
across runs.
|
||
|
|
|
||
|
|
To make this work, the library and this shim need to be compiled in LLVM
|
||
|
|
mode using afl-clang-fast (other compiler wrappers will *not* work).
|
||
|
|
*/
|
||
|
|
|
||
|
|
#include <stdio.h>
|
||
|
|
#include <stdlib.h>
|
||
|
|
#include <unistd.h>
|
||
|
|
#include <signal.h>
|
||
|
|
#include <string.h>
|
||
|
|
|
||
|
|
|
||
|
|
/* Main entry point. */
|
||
|
|
|
||
|
|
int main(int argc, char** argv) {
|
||
|
|
|
||
|
|
char buf[100]; /* Example-only buffer, you'd replace it with other global or
|
||
|
|
local variables appropriate for your use case. */
|
||
|
|
|
||
|
|
/* The number passed to __AFL_LOOP() controls the maximum number of
|
||
|
|
iterations before the loop exits and the program is allowed to
|
||
|
|
terminate normally. This limits the impact of accidental memory leaks
|
||
|
|
and similar hiccups. */
|
||
|
|
|
||
|
|
while (__AFL_LOOP(1000)) {
|
||
|
|
|
||
|
|
/*** PLACEHOLDER CODE ***/
|
||
|
|
|
||
|
|
/* STEP 1: Fully re-initialize all critical variables. In our example, this
|
||
|
|
involves zeroing buf[], our input buffer. */
|
||
|
|
|
||
|
|
memset(buf, 0, 100);
|
||
|
|
|
||
|
|
/* STEP 2: Read input data. When reading from stdin, no special preparation
|
||
|
|
is required. When reading from a named file, you need to close
|
||
|
|
the old descriptor and reopen the file first!
|
||
|
|
|
||
|
|
Beware of reading from buffered FILE* objects such as stdin. Use
|
||
|
|
raw file descriptors or call fopen() / fdopen() in every pass. */
|
||
|
|
|
||
|
|
read(0, buf, 100);
|
||
|
|
|
||
|
|
/* STEP 3: This is where we'd call the tested library on the read data.
|
||
|
|
We just have some trivial inline code that faults on 'foo!'. */
|
||
|
|
|
||
|
|
if (buf[0] == 'f') {
|
||
|
|
printf("one\n");
|
||
|
|
if (buf[1] == 'o') {
|
||
|
|
printf("two\n");
|
||
|
|
if (buf[2] == 'o') {
|
||
|
|
printf("three\n");
|
||
|
|
if (buf[3] == '!') {
|
||
|
|
printf("four\n");
|
||
|
|
abort();
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/*** END PLACEHOLDER CODE ***/
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
/* Once the loop is exited, terminate normally - AFL will restart the process
|
||
|
|
when this happens, with a clean slate when it comes to allocated memory,
|
||
|
|
leftover file descriptors, etc. */
|
||
|
|
|
||
|
|
return 0;
|
||
|
|
|
||
|
|
}
|