search

AngoraFuzzer / Angora

Angora is a mutation-based fuzzer. The main goal of Angora is to increase branch coverage by solving path constraints without symbolic execution.
Apache License 2.0
916 stars 166 forks source link

crash when synchronizing with AFL #29

Closed lmrs2 closed 5 years ago

lmrs2 commented 5 years ago

Hi

I'm trying to run in parallel angora and afl, since there's an option in the source code. But angora crashes. Steps to reproduce:

wget http://xmlsoft.org/sources/libxml2-2.9.8.tar.gz sudo apt-get install python-dev sudo apt-get install libtool cd libxml2-2.9.8​ autoreconf --install autoconf CC=/path/to/afl-clang-fast ./configure --without-zlib --disable-shared [...] compile for afl

reproduce the above but compile for angora.

then run:

timeout 24h /path/to/afl-fuzz -i in/ -o with_afl -S afl1 ./xmllint.afl @@ timeout 24h /path/to/angora/bin/fuzzer --input ./in/ --sync_afl --output with_afl/ -t ./xmllint.track -- ./xmllint.fast @@ 2 ERROR angora::executor::executor > Crash or hang while tracking! -- Crash, id: 0

Note: I don't think this has anything to do with libxml... it's just the first one I tried :)

spinpx commented 5 years ago

Thanks for your feedback. Sorry I can't reproduce this in my PC.

Does running angora without sync with AFL crash? And please ensure that ./xmllint.track won't crash with any input.

Here is how I build

CXX=/home/xx/angora/bin/angora-clang++     \
CC=/home/xx/angora/bin/angora-clang \
LD=/home/xx/angora/bin/angora-clang  \
./configure --with-threads=off --with-http=no --with-ftp=no --with-python=no --without-zlib --prefix=path-to-install --disable-shared --enable-static

I ran AFL and Angora with commands the same as you.

lmrs2 commented 5 years ago

seems the problem was because of the stack limit (ulimit -s) being set to unlimited on my machine. Setting it to 8092 fixed the problem. Not sure why...