rust-fuzz / libfuzzer

Rust bindings and utilities for LLVM’s libFuzzer
Apache License 2.0
206 stars 44 forks source link

Is there any way to distinct panic(abnormal exit) from std::process::exit(normal exit)? #72

Closed StevenJiang1110 closed 3 years ago

StevenJiang1110 commented 3 years ago

Hello, I wonder if there's any way to avoid default exit when encountering std::process::exit. For example, I have fuzz target as below.

fuzz_target!(|data: &[u8]| {
    if data.len() < 3 {
        std::process::exit(0); //normal exit
    }
    if data[3] == 0x12 {
        panic!("got it"); //abnormal crash
    }
});

I want to catch only the abnormal crash but ignore th normal exit(Maybe rewriting fuzz target is a good idea, but the real function to fuzz is very complicated. afl.rs will ignore the normal exit by default, but libfuzzer seems something different). I wonder if there's anyway to avoid exit fuzzer when encountering std::process::exit without rewriting fuzz target. Thanks a lot.

alex commented 3 years ago

There isn't -- std::process::exit directly calls a syscall to exit the process, meaning once it happens no more Rust code is run at all (see https://doc.rust-lang.org/stable/std/process/fn.exit.html for details).

The correct way to handle this is not to call exit() in code-under-fuzz.