UFO Tutorial

Tested on Mac OSX 10.11.5 and Clang/LLVM-7.0

Install UFO (may take a couple of hours)

git clone -b testpbzip2 git@github.com:parasol-aser/UFO.git
cd UFO
export BRANCH=release_70
git clone http://llvm.org/git/llvm.git -b $BRANCH
git clone http://llvm.org/git/clang.git llvm/tools/clang -b $BRANCH
git clone http://llvm.org/git/clang-tools-extra.git llvm/tools/clang/tools/extra -b $BRANCH
mv compiler-rt llvm/projects/
mkdir build
cd build
cmake -G "Unix Makefiles" ../llvm
make -j8
export PATH=./bin:$PATH
cd ..

Install z3 (may take an hour)

git clone https://github.com/Z3Prover/z3.git
cd z3
python scripts/mk_make.py
cd build
make
sudo make install
cd ..

Run on pbzip2 (pretty fast)

cd test/pbzip2-0.9.4
make
UFO_CALL=1 UFO_ON=1 UFO_TDIR=./ufo_test_trace ./pbzip2 -k -f -p3 ../test.tar
cd ../
java -jar runufo.jar --tdir pbzip2-0.9.4/ufo_test_trace

A list of UAFs will be reported such as the following:

------- #3 use call stack  
consumer(void*) (in pbzip2) (pbzip2.cpp:919) pc: 0x100004f94
  cond_wait(__tsan::ThreadState*, unsigned long, __tsan::ScopedInterceptor*, int (*)(void*, void*, void*), void*, void*, void*) (in libclang_rt.tsan_osx_dynamic.dylib) (sanitizer_atomic_clang_x86.h:83) pc: 0x97dc

------- #0 free call stack  
__sanitizer::LargeMmapAllocator<__sanitizer::NoOpMapUnmapCallback, __sanitizer::LargeMmapAllocatorPtrArrayStatic>::Deallocate(__sanitizer::AllocatorStats*, void*) (in libclang_rt.tsan_osx_dynamic.dylib) (sanitizer_allocator_secondary.h:142) pc: 0x50576
  queueDelete(queue*) (in pbzip2) (pbzip2.cpp:1066) pc: 0x100005f36
    main (in pbzip2) (pbzip2.cpp:1912) pc: 0x10000a3f3