search

AFLplusplus / LibAFL

Advanced Fuzzing Library - Slot your Fuzzer together in Rust! Scales across cores and machines. For Windows, Android, MacOS, Linux, no_std, ...
Other
2.03k stars 319 forks source link

libafl_qemu::asan::init_with_asan can produce incorrect command-line argument list #824

Closed epi052 closed 1 year ago

epi052 commented 2 years ago

IMPORTANT

  1. You have verified that the issue to be present in the current main branch Yes

Thank you for making LibAFL better! You're welcome :grin:

Describe the bug When passing arguments to init_with_asan, the function makes a potentially incorrect assumption about what is in args[0]. It assumes that it's either a flag or positional argument. So, when passed an argument that expects a value, the LD_PRELOAD=......libqasan.so is inserted between the argument and its intended value.

Example: given the command line args -L ../jammy-rootfs ./build/bin/tiffinfo.

note: these args were generated from libafl::bolts::cli with qemu_cli feature enabled

init_with_asan will produce the following argument list

["-L\0", "-E\0", "LD_PRELOAD=/home/epi/fuzzing-101-solutions/exercise-4/build/libqasan.so\0", "../jammy-rootfs\0", "./build/bin/tiffinfo\0"]

The offending code is here (i believe) https://github.com/AFLplusplus/LibAFL/blob/main/libafl_qemu/src/asan.rs#L154

Workaround: remove the space between the param and its value -L../jammy-rootfs ./build/bin/tiffinfo

i guess adding a value for the expected qemu binary would work also.
derp -L ../jammy-rootfs ./build/bin/tiffinfo

Figuring out the workaround took altering libafl_qemu itself and adding prints to determine out what was happening, so documenting it here until a fix lands/for those that come after.

andreafioraldi commented 2 years ago

Hey @epi052 , to me this seems not a bug as args[0] can never be -L, but it is the program binary. I'm using init_with_asan now and it works, it is libafl::bolts::cli that generates invalid argv lists.

epi052 commented 2 years ago

ok, so we're assuming that everything for init_with_asan is a full on qemu command that starts with the qemu binary itself

libafl-bin-with-qemu -L ... ./target

I probably knew that at some point, lol.

Since cli args are just sent based on user-input, i could add a check that looks for the first arg and at least makes sure it's an executable file and fails to parse if it's not.

domenukk commented 1 year ago

Closing for now as it doesn't seem to be a bug