Skip to content
This repository was archived by the owner on Oct 25, 2021. It is now read-only.

Testing Native component using Valgrind and AFL

Baranyai Gergely edited this page Nov 8, 2020 · 4 revisions

Testing Native component using Valgrind and AFL

Valgrind

We checked some basic cases with Valgrind, no memory handling problems were found.

  1. Sample file 1.caff

1.caff

  1. Sample file 2.caff

2.caff

  1. Sample file 3.caff

3.caff

  1. Not existing caff file

Not existing caff file

  1. Not existing folder

Not existing folder

AFL

We couldn't do an inspection with 10 cycles, because the execution speed was quite low (appr. 4/sec).

The first inspection

The first inspection took approx. 51 minutes, and 5 unique crashes and 1 unique hang were found. We tried giving these inputs to the program using Valgrind to get more debug information. We have fixed some errors related to memory allocation and input validating.

See the commits for details:

Stats:

start_time        : 1604842648
last_update       : 1604846035
fuzzer_pid        : 3019
cycles_done       : 0
execs_done        : 12255
execs_per_sec     : 2.71
paths_total       : 45
paths_favored     : 3
paths_found       : 42
paths_imported    : 0
max_depth         : 2
cur_path          : 0
pending_favs      : 3
pending_total     : 45
variable_paths    : 0
stability         : 100.00%
bitmap_cvg        : 1.40%
unique_crashes    : 5
unique_hangs      : 1
last_path         : 1604843502
last_crash        : 1604843422
last_hang         : 1604845149
execs_since_crash : 9049
exec_timeout      : 860
afl_banner        : CAFFparserBin
afl_version       : 2.52b
target_mode       : default
command_line      : afl-fuzz -i inputs -o out ./CAFFparserBin @@ out

The second inspection

After fixing the problems that we have found in the first inspection, we run AFL again for appr 56 minutes. No crashes were found, only 2 hangs were found. Result 2

Clone this wiki locally