AFLplusplus / LibAFL

Advanced Fuzzing Library - Slot your Fuzzer together in Rust! Scales across cores and machines. For Windows, Android, MacOS, Linux, no_std, ...
Other
2.03k stars 319 forks source link

Fix i2srandreplace #2504

Closed mineo333 closed 2 months ago

mineo333 commented 2 months ago

There is an issue in I2SRandReplace where not all indexes are checked. We can go all the way to =len-sizeof(cmp_val_size). This is because when we extract the word from the bytes, we do i..i+sizeof(cmp_val_size) which is equivalent to len-sizeof(cmp_val_size)..len which is valid.

tokatoka commented 2 months ago
                    let mut size = core::cmp::min(v.0.len(), len - i);
                    while size != 0 {
                        if v.0[0..size] == input.bytes()[i..i + size] {

here should be len, too?

mineo333 commented 2 months ago

I don't think so because that would result in an overflow somtimes.

If we made that len, then if v.0.len > len, then we would compare v.0[0..len] == bytes[i..i+len] which would overflow. Then len-i ensures that doesn't happen as we are, at maximum, allowed to have bytes[i..i+len-i] = bytes[i..len] on the rhs.