IntelLabs / kafl.fuzzer

kAFL Fuzzer
Other
33 stars 16 forks source link

ValueError: no such random number exist #56

Closed Wenzel closed 1 year ago

Wenzel commented 1 year ago

Facing an exception in havoc_handler.py:dict_insert_sequence:

Process Worker 0:
ValueError: no such random number exist

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "multiprocessing/process.py", line 314, in _bootstrap
  File "multiprocessing/process.py", line 108, in run
  File "kafl_fuzzer/worker/worker.py", line 36, in worker_loader
  File "kafl_fuzzer/worker/worker.py", line 131, in start
  File "kafl_fuzzer/worker/worker.py", line 155, in loop
  File "kafl_fuzzer/worker/worker.py", line 92, in handle_node
  File "kafl_fuzzer/worker/state_logic.py", line 99, in process_node
  File "kafl_fuzzer/worker/state_logic.py", line 191, in handle_initial
  File "kafl_fuzzer/technique/havoc.py", line 61, in mutate_seq_havoc_array
  File "kafl_fuzzer/technique/havoc_handler.py", line 322, in havoc_dict_insert
  File "kafl_fuzzer/technique/havoc_handler.py", line 302, in dict_insert_sequence
SystemError: <built-in function len> returned a result with an exception set

The above exception can be traced back to fastrand library: https://github.com/lemire/fastrand/blob/master/fastrandmodule.c#L73

Wenzel commented 1 year ago

image This behavior is triggered when len(data) - len(entry) is negative, and max() is evaluated to 0: https://github.com/IntelLabs/kafl.fuzzer/blob/master/kafl_fuzzer/technique/havoc_handler.py#L301

the rand.int() function is therefore called with a limit of 0, and fails with ValueError.

For some reason, the exception isn't catched by the try except block. Maybe the C implementation doesn't respect CPython expectations ?

In the end, it makes the worker fail.