rust-fuzz / afl.rs

🐇 Fuzzing Rust code with American Fuzzy Lop
https://rust-fuzz.github.io/book/afl.html
Apache License 2.0
1.65k stars 107 forks source link

cargo fuzz tmin panics immediately with "called `Option::unwrap()` on a `None` value" #129

Closed a2aaron closed 6 years ago

a2aaron commented 6 years ago

Hello, I've been trying out the rust fuzzer and am exploring some of the features.

I have a small bytebeat parser that I'm running a fuzzer on, with a target called "evaluator". Running cargo fuzz tmin evaluator seems to cause a panic shown below.

Thread 'main' panicked at 'called `Option::unwrap()` on a `None` value', src/libcore/option.rs:335:20
stack backtrace:
   0: std::sys::imp::backtrace::tracing::imp::unwind_backtrace
   1: std::sys_common::backtrace::_print
   2: std::panicking::default_hook::{{closure}}
   3: std::panicking::default_hook
   4: std::panicking::rust_panic_with_hook
   5: std::panicking::begin_panic
   6: std::panicking::begin_panic_fmt
   7: rust_begin_unwind
   8: core::panicking::panic_fmt
   9: core::panicking::panic
  10: cargo_fuzz::main
  11: __rust_maybe_catch_panic
  12: std::rt::lang_start

System specs:

OS: macOS High Sierra (10.13.1) cargo: cargo 0.24.0-nightly (5bb478a51 2017-11-29) fuzzer: cargo-fuzz 0.5.0

frewsxcv commented 6 years ago

did you mean to run cargo afl tmin evaluator? cargo fuzz (for now) uses libfuzzer on the backend which is different from afl

frewsxcv commented 6 years ago

reopen if you're still having issues