search

googleprojectzero / fuzzilli

A JavaScript Engine Fuzzer
Apache License 2.0
1.86k stars 300 forks source link

JSC fuzzying crash variants :( #334

Closed turnerrocks1 closed 2 years ago

turnerrocks1 commented 2 years ago

I see the logical standpoint of fuzzilli if it detects duplicate crash cases and output the code to a javascript file it'll go to the corpus folder under /Duplicate. The problem I'm having is the 3 different bugs foudn through fuzzying only crashes debug builds weirdly, and i have /Crashes folder of nearly 200 corpus but it's literally a variant of each other trigger the same bug and yielding the same crash logs!!! This is a huge problem as 3 days later since continously fuzzying with multi engine it's the same? Is there a way for me to manually fix this?

saelo commented 2 years ago

Hi! I'm not sure I understand your problem. Fuzzilli will treat a crash as duplicate if it doesn't cover any new edges in the crashes bitmap. This isn't perfect, and will often lead to crashes being seen as unique which are in fact duplicates, but it's cheap and usually good enough. If you don't want duplicates stored at all, it should be enough to comment out this line.

The fact that your crashes only crash in debug builds is quite normal, too. Debug builds have many more runtime assertions enabled, amongst other things that affect crashing behaviour.

turnerrocks1 commented 2 years ago

@saelo Ok so that answers my question perfectly so it's just the way fuzzilli is designed it doesn't analyze crash cases to avoid "same bug different trigger variants of a JavaScript file corpus". Well that's nice to know well last question can i explicitly build JavaScriptCore with the flags from fuzzbuild.sh after running the patch file to build with --release flag so i can fuzz release builds I don't see any reasoning unless your fuzzer relies on debug symbols themselves? I can only see the debug symbols having use if the debugger can only pull crash signal and terminfo through debug builds only?

saelo commented 2 years ago

Yeah, you should be able to just use --release instead of --debug in fuzzbuild.sh to get a release build for fuzzing.

turnerrocks1 commented 2 years ago

@saelo ok thank you btw i pushed a pr request updating the "webkit.patch" please accept when you get a chance