How can I make AFL++ allow to use llvm-symbolizer?

[junwha0511]

Hi guys,
Currently I'm trying to use modified Address sanitizer with utilizing the llvm-symbolizer related feature.
But I figured out that inside AFL++, the llvm-symbolizer is not working correctly.
For example, if I run the afl-fuzz with crash input, (also, with AFL_DEBUG=1)

The llvm-symbolizer does not work correctly.

As I know, AFL++ automatically set the ASAN_OPTIONS which contains symbolize=0,
so tried again with ASAN_OPTIONS=symbolize=0:abort_on_error=1, but I got the same result.

I really want to use llvm-symbolizer with AFL++ because I need to automatically check the call stack in my tool.

Is there anyone can help me?

Thank you.

[vanhauser-thc]

why would you need the symbolizer when fuzzing? did you make your own modifications to afl++?
outside of afl-fuzz you can set any asan options you want, also symbolize=1 which is a very good idea to follow up found crashes.

[vanhauser-thc]

No it doesnt. just look at the code.
it just terminates with an error if it sees symbolize=1 and AFL_DEBUG is unset.

[junwha0511]

I see. I thought I missed some part of AFL++, but according to your answer, it seems it's my local problem. I'll try to find a problem.
Thank you much!

[junwha0511]

I'm sorry to bother you. But as I think, there is something that suppress AFL++ to enable llvm-symbolizer other than the simple termination code.
https://github.com/AFLplusplus/AFLplusplus/blob/stable/src/afl-fuzz-init.c#L2499
I think this line is what you've mentioned, and I couldn't see that message when I set the ASAN_OPTIONS with symbolize=1 because I enabled AFL_DEBUG=1.

Here is my simple buggy code experimented on the docker image aflplusplus/aflplusplus:stable.

#include<stdlib.h>
#include<stdio.h>
int main() {
        int *a = (int*) malloc(sizeof(int)*10);
        int idx;
        scanf("%d", &idx);
        printf("idx: %d\n", idx);
        a[idx] = 39877896;
        free(a);
        if (idx >= 10)
        printf("%d\n", a[idx]);
        return 0;
}

if input index is greater than 10, address sanitizer will detect heap buffer overflow from this example.
I compiled this with afl-clang-fast bof.c -fsanitize=address -g
(the other weird point is that, it was not enabled Address sanitizer when I set AFL_USE_ASAN=1)

I made 3, 9, 10 as input, and set ASAN_OPTIONS=abort_on_error=1:symbolize=1 and AFL_DEBUG=1.
Then, I run the fuzzer.
afl-fuzz -i input -o output -- ./a.out

According to what you told me, there must be normally working llvm-symbolizer, but it shows following result.

I didn't touched both LLVM and AFL++ inside the deployed docker image, but llvm-symbolizer didn't work. (also, I enrolled to add /usr/lib/llvm-14/bin to PATH and tried again, but same result was there)

Can I get some advice on what you think the problem is?

[vanhauser-thc]

I think its a behaviour in asan.
if you check /proc/fuzzed_pid/environ while fuzzing you will see that ASAN_OPTIONS is untouched. so if asan doesnt show the lines in the source that is a decision within asan for a reason I don't know.

[junwha0511]

It was not the behaviour in asan, but it was sanitizer flag overwritten problem.

in src/afl-forkserver.c, afl++ set abort_on_error and symbolize for all the four sanitizer flags, ASAN_OPTIONS, LSAN_OPTIONS, MSAN_OPTIONS, and UBSAN OPTIONS.

And it is problematic because the four sanitizers internally share the sanitizer common options. For this reason, my ASAN_OPTION symbolize=0 has been overwritten by three sanitizer's other options.

In my case, symbolize=1 was discouraged by AFL++, thus it can be considered as tirvial problem.
But I think this implementation is something that needs to be fixed because what the user has set up in one sanitizer has a potential risk of overwriting by AFL++ initialization.

Thank you again for your help.