nus-apr / cerberus

Research Acceleration Platform that provides interface to multiple state-of-the-art program analysis tools including but not limited to fuzzing, static analysis and program repair.
MIT License
65 stars 30 forks source link

[composite-workflows] Incorrect crash-location & fix-location provided in Vulnfix driver #180

Closed Hzxin closed 5 months ago

Hzxin commented 6 months ago

Description

[Branch] composite-workflows #345d1b4 [Benchmark] Vulnloc new-localization #b2f5423 [Tool] Vulnfix [Task-profile] TP1 [Container-profile] CP1

In the Vulnloc benchmark, the exact fix-location/crash-location is provided during instrumentation but was removed in recent commit.

In the current driver, this part of the code will set fix-location & crash-location based on the error_file & fix-line obtain from localization.

However, referring to coreutils/gnubug-19784/config && libjpeg/CVE-2012-2806/config && binutilS/CVE-2017-15025/config and a few other examples, the crash-locations & fix-locations can be different from the error_file & fix-line obtained from localization.

The above will cause Vulnfix to fail or generate no patch for the above bugs.

Hzxin commented 6 months ago

Additional:

[Bug] coreutil-gnubug-26545 [Related Code] a623637 image

[Description] Referring to meta-data for gnubug-26545.

image

In the benchmark test folder, there are 1.txt && exploit files.

Before the change, since exploit list is empty, it will use the provided exploit file in the folder. However, after the change, the exploit path will be set to the failing-test-file, which is "1".