microsoft / onefuzz

A self-hosted Fuzzing-As-A-Service platform
MIT License
2.82k stars 198 forks source link

Don't bail on dangling breakpoint #3492

Closed tevoinea closed 1 year ago

tevoinea commented 1 year ago

Information

Provide detailed reproduction steps (if any)

We bail!() when we handle an EXCEPTION_BREAKPOINT callback for a breakpoint we didn't register.

https://github.com/microsoft/onefuzz/blob/830b4790787b47c09445bab12f2f0ac3e823ca17/src/agent/coverage/src/record/windows.rs#L137-L140

This can happen, for example, from ASAN instrumented binaries since it will call __debugbreak() if a debugger is attached.

https://github.com/gcc-mirror/gcc/blob/d8bdc978dc9cd4a6210997edacedb954375af70d/libsanitizer/sanitizer_common/sanitizer_win.cpp#L840-L841

Expected result

What is the expected result of the above steps?

Instead of bail!()-ing, we should:

Actual result

What is the actual result of the above steps?

AB#165518