| /* |
| american fuzzy lop++ - persistent mode example |
| -------------------------------------------- |
| |
| Originally written by Michal Zalewski |
| |
| Copyright 2015 Google Inc. All rights reserved. |
| |
| Licensed under the Apache License, Version 2.0 (the "License"); |
| you may not use this file except in compliance with the License. |
| You may obtain a copy of the License at: |
| |
| http://www.apache.org/licenses/LICENSE-2.0 |
| |
| This file demonstrates the high-performance "persistent mode" that may be |
| suitable for fuzzing certain fast and well-behaved libraries, provided that |
| they are stateless or that their internal state can be easily reset |
| across runs. |
| |
| To make this work, the library and this shim need to be compiled in LLVM |
| mode using afl-clang-fast (other compiler wrappers will *not* work). |
| |
| */ |
| |
| #include <stdio.h> |
| #include <stdlib.h> |
| #include <unistd.h> |
| #include <signal.h> |
| #include <string.h> |
| #include <limits.h> |
| |
| /* Main entry point. */ |
| |
| /* To ensure checks are not optimized out it is recommended to disable |
| code optimization for the fuzzer harness main() */ |
| #pragma clang optimize off |
| #pragma GCC optimize("O0") |
| |
| int main(int argc, char **argv) { |
| |
| ssize_t len; /* how much input did we read? */ |
| char buf[100]; /* Example-only buffer, you'd replace it with other global or |
| local variables appropriate for your use case. */ |
| |
| /* The number passed to __AFL_LOOP() controls the maximum number of |
| iterations before the loop exits and the program is allowed to |
| terminate normally. This limits the impact of accidental memory leaks |
| and similar hiccups. */ |
| |
| __AFL_INIT(); |
| while (__AFL_LOOP(UINT_MAX)) { |
| |
| /*** PLACEHOLDER CODE ***/ |
| |
| /* STEP 1: Fully re-initialize all critical variables. In our example, this |
| involves zeroing buf[], our input buffer. */ |
| |
| memset(buf, 0, 100); |
| |
| /* STEP 2: Read input data. When reading from stdin, no special preparation |
| is required. When reading from a named file, you need to close |
| the old descriptor and reopen the file first! |
| |
| Beware of reading from buffered FILE* objects such as stdin. Use |
| raw file descriptors or call fopen() / fdopen() in every pass. */ |
| |
| len = read(0, buf, 100); |
| |
| /* STEP 3: This is where we'd call the tested library on the read data. |
| We just have some trivial inline code that faults on 'foo!'. */ |
| |
| /* do we have enough data? */ |
| if (len < 8) continue; |
| |
| if (buf[0] == 'f') { |
| |
| printf("one\n"); |
| if (buf[1] == 'o') { |
| |
| printf("two\n"); |
| if (buf[2] == 'o') { |
| |
| printf("three\n"); |
| if (buf[3] == '!') { |
| |
| printf("four\n"); |
| if (buf[4] == '!') { |
| |
| printf("five\n"); |
| if (buf[5] == '!') { |
| |
| printf("six\n"); |
| abort(); |
| |
| } |
| |
| } |
| |
| } |
| |
| } |
| |
| } |
| |
| } |
| |
| /*** END PLACEHOLDER CODE ***/ |
| |
| } |
| |
| /* Once the loop is exited, terminate normally - AFL will restart the process |
| when this happens, with a clean slate when it comes to allocated memory, |
| leftover file descriptors, etc. */ |
| |
| return 0; |
| |
| } |
| |
