zodf0055980/yuan-fuzz

Fuzzing with the generated argument

yuan-fuzz's Issues

Error while building imagemagick

I'm using gcc 9.3.0 pre-built binaries of clang+llvm 11 for ubuntu 20.04

clang version 11.0.0 (https://github.com/llvm/llvm-project.git 0160ad802e899c2922bc9b29564080c22eb0908c)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /usr/local/clang_11.0.0/bin
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/9
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/9
Candidate multilib: .;@m64
Selected multilib: .;@m64

/usr/local/clang_11.0.0/bin/clang

And here is command I used to build imagemagick

CC=~/Yuan-fuzz/afl-clang-fast CXX=~/Yuan-fuzz/afl-clang-fast++ CFLAGS="-g -O0 -fsanitize=address" CXXFLAGS="-g -O0 -fsanitize=address" ./configure
AFL_USE_ASAN=1 make -j4 && sudo make -j4 install

But I'm encountered error. Any idea why I got error?

/usr/bin/ld: /home/cityoflight/Yuan-fuzz/afl-llvm-rt.o:/home/cityoflight/Yuan-fuzz/llvm_mode/afl-llvm-rt.o.c:60: multiple definition of `__afl_area_initial'; /home/cityoflight/Yuan-fuzz/afl-llvm-rt.o:/home/cityoflight/Yuan-fuzz/llvm_mode/afl-llvm-rt.o.c:60: first defined here

/usr/bin/ld: /home/cityoflight/Yuan-fuzz/afl-llvm-rt.o:/home/cityoflight/Yuan-fuzz/llvm_mode/afl-llvm-rt.o.c:61: multiple definition of `__afl_area_ptr'; /home/cityoflight/Yuan-fuzz/afl-llvm-rt.o:/home/cityoflight/Yuan-fuzz/llvm_mode/afl-llvm-rt.o.c:61: first defined here

/usr/bin/ld: /home/cityoflight/Yuan-fuzz/afl-llvm-rt.o: in function `__afl_auto_init':
/home/cityoflight/Yuan-fuzz/llvm_mode/afl-llvm-rt.o.c:257: multiple definition of `__afl_auto_init'; /home/cityoflight/Yuan-fuzz/afl-llvm-rt.o:/home/cityoflight
/Yuan-fuzz/llvm_mode/afl-llvm-rt.o.c:257: first defined here

/usr/bin/ld: /home/cityoflight/Yuan-fuzz/afl-llvm-rt.o: in function `__afl_manual_init':
/home/cityoflight/Yuan-fuzz/llvm_mode/afl-llvm-rt.o.c:240: multiple definition of `__afl_manual_init'; /home/cityoflight/Yuan-fuzz/afl-llvm-rt.o:/home/cityoflight/Yuan-fuzz/llvm_mode/afl-llvm-rt.o.c:240: first defined here

/usr/bin/ld: /home/cityoflight/Yuan-fuzz/afl-llvm-rt.o: in function `__afl_persistent_loop':
/home/cityoflight/Yuan-fuzz/llvm_mode/afl-llvm-rt.o.c:184: multiple definition of `__afl_persistent_loop'; /home/cityoflight/Yuan-fuzz/afl-llvm-rt.o:/home/cityoflight/Yuan-fuzz/llvm_mode/afl-llvm-rt.o.c:184: first defined here

/usr/bin/ld: /home/cityoflight/Yuan-fuzz/afl-llvm-rt.o:(.tbss+0x0): multiple definition of `__afl_prev_loc'; /home/cityoflight/Yuan-fuzz/afl-llvm-rt.o:(.tbss+0x0): first defined here

/usr/bin/ld: /home/cityoflight/Yuan-fuzz/afl-llvm-rt.o: in function `__sanitizer_cov_trace_pc_guard':
/home/cityoflight/Yuan-fuzz/llvm_mode/afl-llvm-rt.o.c:276: multiple definition of `__sanitizer_cov_trace_pc_guard'; /home/cityoflight/Yuan-fuzz/afl-llvm-rt.o:/home/cityoflight/Yuan-fuzz/llvm_mode/afl-llvm-rt.o.c:276: first defined here

/usr/bin/ld: /home/cityoflight/Yuan-fuzz/afl-llvm-rt.o: in function `__sanitizer_cov_trace_pc_guard_init':
/home/cityoflight/Yuan-fuzz/llvm_mode/afl-llvm-rt.o.c:284: multiple definition of `__sanitizer_cov_trace_pc_guard_init'; /home/cityoflight/Yuan-fuzz/afl-llvm-rt.o:/h
ome/cityoflight/Yuan-fuzz/llvm_mode/afl-llvm-rt.o.c:284: first defined here
clang-11: error: linker command failed with exit code 1 (use -v to see invocation)
make[1]: *** [Makefile:6065: Magick++/lib/libMagick++-6.Q16.la] Error 1
make[1]: Leaving directory '/home/cityoflight/ImageMagick-6.9.11-45'
make: *** [Makefile:5682: all] Error 2

How do crash parameters correspond to crash

for example：djpeg

All the fuzzer die when fuzzing libxml2

I run fuzzing campaign targetting libxml2 with group_seed on and few hours later all the fuzzer die.
I don't know what exactly happen as it doesn't display any error.
Is it mandatory to run group_seed or it's optional?

when I fuzzer libjpeg-turbo module cjpeg use the default xml,some errors happen

add 1154 in group 19
[] run rarget = 412
[] get b'skip'
[] next group 1
[] run target = 1106
[] get b'next'
[] find new path 1155 to 1171
add 1155 in group 25
add 1156 in group 25
add 1157 in group 25
add 1158 in group 25
add 1159 in group 25
add 1160 in group 25
add 1161 in group 25
add 1162 in group 25
add 1163 in group 25
add 1164 in group 25
add 1165 in group 25
add 1166 in group 25
add 1167 in group 25
add 1168 in group 25
add 1169 in group 1
add 1170 in group 25
add 1171 in group 25
[] run rarget = 412
[] get b'skip'
[] group 0 is not interesting
[] run target = 1106
[] get b'skip'
[] run target = 1108
[] get b'next'
[] find new path 1172 to 1187
Traceback (most recent call last):
File "group_seed.py", line 208, in
out = subprocess.check_output(
File "/usr/lib/python3.8/subprocess.py", line 411, in check_output
return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
File "/usr/lib/python3.8/subprocess.py", line 512, in run
raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['./afl-showmap', '-q', '-e', '-o', '/dev/stdout', '-m', 'none', '-t', '500', 'target/libjpeg-turbo/build/cjpeg', '-outfile', '/dev/null', 'fuzzer_out/cjpeg319/queue/id:001183,src:001108,op:havoc,rep:4']' returned non-zero exit status 1.

How to know target options trigger crashes?

I found crashes with yuan-fuzz, but how to know which target argv trigger the crash?