list index out of range when generate a graph by the gen_graph.py

[qhjchc]

Hi, there

The gen_graph.py failed to generate a graph for some binaries in libtiff.

• command
  python3 /home/kscheduler/afl_integration/build_example/gen_graph.py ./tiff2pdf_fix.ll cfg_out_tiff2pdf

• Issue1

Traceback (most recent call last):
  File "/home/kscheduler/afl_integration/build_example/gen_graph.py", line 206, in <module>
    inline_table = inline_counter_table(sys.argv[1])
  File "/home/kscheduler/afl_integration/build_example/gen_graph.py", line 30, in inline_counter_table
    data[0] = data[0].split(' [i8*')[1]
IndexError: list index out of range

I added a if branch "if data != []: to fix this problem, and then face the following issue:

• Issue2

Traceback (most recent call last):
  File "/home/kscheduler/afl_integration/build_example/gen_graph.py", line 251, in <module>
    max_score = max(k.scores())
ValueError: max() arg is an empty sequence

• POC
  tiff2pdf.zip

[Dongdongshe]

Hi, thanks for your interest to K-scheduler. Could you provide file tiff2pdf_fix.ll and directory cfg_out_tiff2pdf to me? Binary compiled with wllvm (tiff2pdf) stores the corresponding llvm IR file in your local directory. I cannot extract the llvm IR file (tiff2pdf_fix.ll) with the single binary (tiff2pdf).

[qhjchc]

Sorry for my carelessness. Attached are the related files :)

kscheduler_tiff2pdf.zip

[Dongdongshe]

I checked the binary and llvm IR file. It seems the binary is not compiled with LLVM coverage sanitizer (https://clang.llvm.org/docs/SanitizerCoverage.html) which instruments every edge and assigns a unique/non-collision edge ID.

A quick check is to scan tiff2pdf_fix.ll and look for any occurrence of function "__sanitizer_cov_trace_pc_guard".

A quick fix is to double-check if your CFLAGS and CXXFLAGS contains "-fsanitize-coverage=trace-pc-guard,no-prune" and recompile libtiff.

For more detail about building a non-wrapper based binary, please check the tutorial at https://github.com/Dongdongshe/K-Scheduler/blob/main/afl_integration/build_example/README(non_wrapper%20based%20program).md.

Let me know if you encounter any other issue.

[qhjchc]

Thanks a lot!