fdu-sec / NestFuzz

A structure-aware grey box fuzzer based on modeling the input processing logic.
Apache License 2.0
156 stars 12 forks source link

Error when running a simple test #11

Open Toruforx opened 1 month ago

Toruforx commented 1 month ago

Hi! I wrote a simple multithreading test program that compiles correctly with NestFuzz, but when running the binary, it encounters an error in loop_handlers. After debugging, I found that the issue arises from creating new threads within the loop, leading to a problem with loop_handler's stack unwinding. How can I fix these errors?

Here's the code for the test program:

#include <stdio.h>
#include <pthread.h>
void* threadFunction(void* arg) {
    int threadId = *((int*)arg);
    for (int i = 0; i < 5; i++) {
        printf("Thread %d: %d\n", threadId, i);
    }
    pthread_exit(NULL);
}

int main() {
    pthread_t threads[5];
    int threadIds[5] = {1, 2, 3, 4, 5};
    for(int i = 0; i < 5; i ++)
        pthread_create(&threads[i], NULL, threadFunction, &threadIds[i]);
    for (int i = 0; i < 5; i++) 
        pthread_join(threads[i], NULL);
    return 0;
}

Here's the error message:

Thread 1: 0
Thread 2: 0
Thread 2: 1
Thread 1: 1
Thread 2: 2
Thread 4: 0
Thread 1: 2
Thread 3: 0
Thread 4: 1
Thread 1: 3
Thread 2: 3
Thread 4: 2
Thread 5: 0
Thread 3: 1
Thread 5: 1
Thread 3: 2
Thread 2: 4
Thread 3: 3
Thread 4: 3
thread '<unnamed>' panicked at runtime/src/loop_handlers.rs:599:21:
[ERR] :pop error! incorrect Hash 2781282620 #[ERR]
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
fatal runtime error: failed to initiate panic, error 5

The execution speed of multithreading can be random, so I suggest running it multiple times to observe the errors.

fdu-sec commented 1 month ago

The current version of NestFuzz does not support multithreaded programs. This limitation arises because we use a tree structure to model the program's processing logic. However, the thread switching inherent in multithreaded programs can disrupt the balance of this tree.