search

hgarrereyn / GraphFuzz

GraphFuzz is an experimental framework for building structure-aware, library API fuzzers.
https://hgarrereyn.github.io/GraphFuzz
MIT License
249 stars 25 forks source link

feature: informal output to cerr for automation #9

Closed NikLeberg closed 2 years ago

NikLeberg commented 2 years ago

As stated in #8 output while converting the graph representation of a crash to code is interleaved with informal output from GraphFuzz.

This change aims to separate the output by letting GraphFuzz only output to std::cerr. This together with the fact that also libFuzzer only ever prints to stderr (see: here) allows for redirecting the stdout to a file that only has the code for reproducing the crash. For example with:

./fuzz_write crash-<hash> | tee crash.cpp

I'm going to test this in my own projects. Because of that this is a draft. Seems to work. :)

NikLeberg commented 2 years ago

Hey @hgarrereyn, I now sometimes (around 50% of the time) have a doubled output when I run the writer. It seems as if libFuzzer is running the crash twice. Have you noticed something similar somehow?

hgarrereyn commented 2 years ago

Yeah I noticed the double output as well. I'm pretty sure this is a libFuzzer thing and not a GraphFuzz thing. I spent some time looking into it a while ago but wasn't able to identify the underlying issue. It might be worth invoking LLVMFuzzerTestOneInput directly for the fuzz_write harness at some point.

NikLeberg commented 2 years ago

I played around a bit with a debug libFuzzer build. The second call to LLVMFuzzerTestOneInput comes from an invocation of TryDetectingAMemoryLeak. Under some circumstances libFuzzer thinks a leak happened and tries to check this. With an additional command line flag -detect_leaks=0 this mechanism is disabled. Maybe GraphFuzz could set this flag automatically for a fuzz_write harness?