Closed Ikrk closed 12 months ago
Changing the panic_function
to:
pub fn panic_function(input1: u8) {
if input1 == b'a' {
let a = vec![1, 2, 3];
println!("{:?}", a[4]); // array out of bounds
}
if input1 == b'b' {
std::panic::panic_any(4); // another panic
}
}
actually finds three unique crashes. So it seems to be related to how honggfuzz actually calculates the stack signature. AFL on the other hand uses executed edges to decide about crash uniqueness.
Closing the issue as it seems to be related to the upstream project.
Hi, I have a minimal code example where I would expect to find three unique crashes. However the fuzzer classifies the bugs as identical and therefore only one unique crash file is saved.
--save_all
option to honggfuzz to save all crashes, I can find all expected three crash cases (input1 = 97, input2 = 254 or 255), so it does not look the code was somehow optimized to prevent the bugs. However the crash names are all with the same filenameSIGABRT.PC.7ffff7c8e83c.STACK.d0d9781a0.CODE.-6.ADDR.0.INSTR.mov____%eax,%ebx.2023-08-30.15:55:32.535662.fuzz
besides the time-stamp.My setup:
Any help or hints are appreciated.