Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Better support for large map_size #25

Closed
acdxvfsvd opened this issue May 22, 2023 · 1 comment
Closed

Better support for large map_size #25

acdxvfsvd opened this issue May 22, 2023 · 1 comment

Comments

@acdxvfsvd
Copy link

By default ld_preload_fuzz reads host_config.bitmap_size from the configuration and maps a memory area with the corresponding size, then it overwrites agent_config.coverage_bitmap_size when processing an LTO-compiled binary but doesn't reallocate the memory.

trace_buffer = mmap((void*)NULL, host_config.bitmap_size, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0);
memset(trace_buffer, 0xff, host_config.bitmap_size);
// ...
if (get_harness_state()->afl_mode && __afl_final_loc_ptr){
    unsigned int map_size = __afl_final_loc == 0 ? 65536 : __afl_final_loc;
    agent_config.coverage_bitmap_size = map_size;
}

There is no such argument about bitmap_size when generating configuration using nyx_config_gen.py, so the value will come from the included default_config_kernel.ron, which is 0x10000.
This works well in most cases but may crash when the map_size of the binary is larger than 0x10000. It would be great to reallocate the memory after detecting the map_size, or just add an argument to the config generator for customizing the map_size.

@schumilo
Copy link
Member

schumilo commented Aug 3, 2023

I was able to successfully reproduce the bug and it seems that my patch has now fixed the issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants