AFLplusplus / LibAFL

Advanced Fuzzing Library - Slot your Fuzzer together in Rust! Scales across cores and machines. For Windows, Android, MacOS, Linux, no_std, ...
Other
1.96k stars 300 forks source link

Some ARM firmware does not contain __ctype_tolower #2413

Closed Zofyan closed 1 month ago

Zofyan commented 1 month ago

string.c of libqasan calls the tolower function which later tries to call __ctype_tolower from libc. This function does not always exist in firmware however; one firmware that does not contain it is this one for example https://archive.org/details/Linksys_EA6300_1.1.40_e2ec7 Instead, a function named __ctype_tolower_loc is found. image

For my own project, I have created a fork in which I created a custom tolower function and call that instead. I would assume that this not the desired long-term solution, but this is the commit: https://github.com/Zofyan/LibAFL-bzero-patch/commit/439a3e29b2c1c6e9ae5a4f6e99c6435c056e4859

If this happens to be an acceptable solution, In will create a PR.

PS: this problem is probably caused by me picking the wrong cross-compiler, but tracking down the right one can be tricky for (older) firmware with limited information. Hence, making libqasan more compiler agnostic might make it easier to use in such cases.

rmalmain commented 1 month ago

Thank you for the report. I think we don't really have a choice other than reimplementing in that case, indeed. I don't mind including it in the library.

However, your implementation doesn't seem right to me, I think we should stick to the tolower signature and documentation.

Also, I can see a loop in your code that should not be there IMHO.

You can have a look to newlib implementation for example, it should be a good inspiration. The closer it is to a well-tested code, the less likely it will be a problem in the future.

domenukk commented 1 month ago

Please don't use the newlib implementation or look at it, since it's GPL code and will taint our codebase. Use bionic https://cs.android.com/android/platform/superproject/main/+/main:prebuilts/vndk/v32/arm/include/generated-headers/bionic/libc/libc/android_vendor.32_arm_armv7-a-neon_shared/gen/include/bits/ctype_inlines.h;l=144?q=tolower%20bionic or MUSL or any other library as a starting point

Zofyan commented 1 month ago

You are right; this fix was quickly thrown together and not really tested but I got the signature wrong indeed; mine works on a NULL terminated string while the original works on a unsigned char.

Since a fix is desired, I will open a PR soon with a bionic based library

rmalmain commented 1 month ago

Thank you!

Zofyan commented 1 month ago

The fix should be ready: https://github.com/AFLplusplus/LibAFL/pull/2421