Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Race condition when target is very fast #1

Open
maxammann opened this issue May 19, 2023 · 0 comments
Open

Race condition when target is very fast #1

maxammann opened this issue May 19, 2023 · 0 comments

Comments

@maxammann
Copy link

maxammann commented May 19, 2023

AFlnwe crashed while fuzzing:

[-] PROGRAM ABORT : Short read from input file
         Location : get_test_case(), afl-fuzz.c:468

When using -f .file the race condition is still present, it just crashes differently, because lseek returns -f because the .file was unlinked and not found.

#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007ffff7dec859 in __GI_abort () at abort.c:79
#2  0x0000555555568196 in DFL_ck_alloc_nozero (size=4294967295) at alloc-inl.h:114
#3  DFL_ck_alloc (size=4294967295) at alloc-inl.h:136
#4  get_test_case (fsize=<optimized out>) at afl-fuzz.c:468
#5  0x000055555556856f in send_over_network () at afl-fuzz.c:578
#6  0x00005555555694cf in run_target (argv=0x7fffffffe980, timeout=40) at afl-fuzz.c:2687
#7  0x000055555556d10f in common_fuzz_stuff (argv=0x7fffffffe980, out_buf=0x5555556b7258 "\026\003\001", len=<optimized out>) at afl-fuzz.c:4906
#8  0x000055555556e902 in fuzz_one (argv=<optimized out>) at afl-fuzz.c:6774
#9  0x0000555555559bb8 in main (argc=29, argv=<optimized out>) at afl-fuzz.c:8396

The latter crash is not fixed by this one: tlspuffin@feaf31c

I fixed it using these two commits:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant