Skip to content

Oops, the program crashed with one of the test cases provided.  #1733

@cnitlrt

Description

@cnitlrt

Hello, I have encountered an error, I tried to solve it but failed

environment

Distributor ID:	Ubuntu
Description:	Ubuntu 20.04 LTS
Release:	20.04
Codename:	focal

source

afl-gcc test.c -o 1 -fsanitize=address -g -static-libasan

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, const char *argv[]) {
    char *s = (char*)malloc(100);
    strcpy(s, "Hello world!");
    printf("string is: %s\n", s);
    return 0;
}

After I set the environment variable, running the file directly will not report an error. The following is the environment variable I set
ASAN_OPTIONS="disable_coredump=0:unmap_shadow_on_exit=1:abort_on_error=1:detect_leaks=0:symbolize=1:detect_odr_violation=0:print_stacktrace=1"
But when I use afl-fuzz to run it will report an error

ASAN_OPTIONS="disable_coredump=0:unmap_shadow_on_exit=1:abort_on_error=1:detect_leaks=0:symbolize=1:detect_odr_violation=0:print_stacktrace=1" AFL_DEBUG=1 afl-fuzz -i in -o out -m none -- ./1
[+] Enabled environment variable AFL_DEBUG with value 1
[+] Enabled environment variable AFL_DEBUG with value 1
afl-fuzz++4.06a based on afl by Michal Zalewski and a large online community
[+] afl++ is maintained by Marc "van Hauser" Heuse, Heiko "hexcoder" Eißfeldt, Andrea Fioraldi and Dominik Maier
[+] afl++ is open source, get it at https://github.com/AFLplusplus/AFLplusplus
[+] NOTE: This is v3.x which changes defaults and behaviours - see README.md
[+] Enabled environment variable ASAN_OPTIONS with value disable_coredump=0:unmap_shadow_on_exit=1:abort_on_error=1:detect_leaks=0:symbolize=1:detect_odr_violation=0:print_stacktrace=1
[+] No -M/-S set, autoconfiguring for "-S default"
[*] Getting to work...
[+] Using exponential power schedule (FAST)
[+] Enabled testcache with 50 MB
[+] Generating fuzz data with a length of min=1 max=1048576
[*] Checking core_pattern...
[!] WARNING: Could not check CPU scaling governor
[+] You have 4 CPU cores and 6 runnable tasks (utilization: 150%).
[*] Setting up output directories...
[+] Output directory exists but deemed OK to reuse.
[*] Deleting old session data...
[+] Output dir cleanup successful.
[*] Checking CPU core loadout...
[+] Found a free CPU core, try binding to #0.
[*] Scanning 'in'...
[+] Loaded a total of 1 seeds.
[*] Creating hard links for all input files...
[*] Validating target binary...
[*] Spinning up the fork server...
[+] All right - fork server is up.
[*] Extended forkserver functions received (00000000).
[*] No auto-generated dictionary tokens to reuse.
[*] Attempting dry run with 'id:000000,time:0,execs:0,orig:1'...
[D] DEBUG: calibration stage 1/7
string is: Hello world!

=================================================================
==2816702==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 100 byte(s) in 1 object(s) allocated from:
    #0 0x564be3462218 in malloc (/home/ubuntu/1+0xf3218)
    #1 0x564be33774c9 in main /home/ubuntu/1.c:6
    #2 0x7f7ae6c67082 in __libc_start_main ../csu/libc-start.c:308
    #3 0x564be337758d in _start (/home/ubuntu/1+0x858d)

SUMMARY: AddressSanitizer: 100 byte(s) leaked in 1 allocation(s).

[-] Oops, the program crashed with one of the test cases provided. There are
    several possible explanations:

    - The test case causes known crashes under normal working conditions. If
      so, please remove it. The fuzzer should be seeded with interesting
      inputs - but not ones that cause an outright crash.

    - In QEMU persistent mode the selected address(es) for the loop are not
      properly cleaning up variables and memory. Try adding
      AFL_QEMU_PERSISTENT_GPR=1 or select better addresses in the binary.

    - Least likely, there is a horrible bug in the fuzzer. If other options
      fail, poke <[email protected]> for troubleshooting tips.
[!] WARNING: Test case 'id:000000,time:0,execs:0,orig:1' results in a crash, skipping
[+] All test cases processed.

[-] PROGRAM ABORT : We need at least one valid input seed that does not crash!
         Location : main(), src/afl-fuzz.c:2262

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions