Fuzzing libpng

[deathholes]

Hi,
I'm trying to fuzz libpng using AFLGo. I'm using the method mentioned by michal here :
https://groups.google.com/forum/#!topic/afl-users/thZScGa6Qt0

But I'm unable to compile the readpng.c file.
Can you elaborate on how you fuzzed the libpng library?

[mboehme]

Can you be more specific? What is the compilation error?

[thuanpv]

Hi @deathholes
In our experiments, we fuzzed pngtest, not readpng. The command is similar to the link you mentioned

CC=selected_compiler ./configure --disable-shared
make clean all check

In LibPNG, there are some test programs like pngtest, pngimage, pngunknow, timepng ...You can try to fuzz them.
Hope it helps

[deathholes]

I'm trying to mimic the run from your paper (libpng, CVE-ID : 2015-8540). I'm running a single instance of AFLGo. My run is going on for more than 30 mins and still I've not found the error. I've tried running it multiple times (30 mins max) but with no results. The paper mentioned that the mean TTE was 26s. Am I missing something here?
P.S. I'm fuzzing pngtest using the method mentioned in the link above.

[thuanpv]

Some bug may not cause the subject program (pngtest) to crash so you cannot see it on the AFL output screen. To check these types of bug, you can compile LibPNG with ASAN and run the subject program (asan version) with the test cases generated by AFL.