From 7938567be451474c113b615ae54420db6b7b48b0 Mon Sep 17 00:00:00 2001 From: No-Cellist-7780 Date: Tue, 22 Jun 2021 10:37:30 -0700 Subject: [PATCH 1/2] Fixed buffer overflow --- experimental/argv_fuzzing/argv-fuzz-inl.h | 44 ++++++++++++----------- 1 file changed, 24 insertions(+), 20 deletions(-) diff --git a/experimental/argv_fuzzing/argv-fuzz-inl.h b/experimental/argv_fuzzing/argv-fuzz-inl.h index 81d4e11c2..cda743e70 100644 --- a/experimental/argv_fuzzing/argv-fuzz-inl.h +++ b/experimental/argv_fuzzing/argv-fuzz-inl.h @@ -41,42 +41,46 @@ #define _HAVE_ARGV_FUZZ_INL #include -#include -#define AFL_INIT_ARGV() do { argv = afl_init_argv(&argc); } while (0) +#define AFL_INIT_ARGV() \ + do { \ + \ + argv = afl_init_argv(&argc); \ + \ + } while (0) -#define AFL_INIT_SET0(_p) do { \ +#define AFL_INIT_SET0(_p) \ + do { \ + \ argv = afl_init_argv(&argc); \ - argv[0] = (_p); \ - if (!argc) argc = 1; \ + argv[0] = (_p); \ + if (!argc) argc = 1; \ + \ } while (0) #define MAX_CMDLINE_LEN 100000 -#define MAX_CMDLINE_PAR 1000 +#define MAX_CMDLINE_PAR 50000 -static char** afl_init_argv(int* argc) { +static char **afl_init_argv(int *argc) { static char in_buf[MAX_CMDLINE_LEN]; - static char* ret[MAX_CMDLINE_PAR]; + static char *ret[MAX_CMDLINE_PAR]; - char* ptr = in_buf; - int rc = 1; /* start after argv[0] */ + char *ptr = in_buf; + int rc = 0; - if (read(0, in_buf, MAX_CMDLINE_LEN - 2) < 0); + if (read(0, in_buf, MAX_CMDLINE_LEN - 2) < 0) {} - while (*ptr) { + while (*ptr && rc < MAX_CMDLINE_PAR) { ret[rc] = ptr; + if (ret[rc][0] == 0x02 && !ret[rc][1]) ret[rc]++; + rc++; - /* insert '\0' at the end of ret[rc] on first space-sym */ - while (*ptr && !isspace(*ptr)) ptr++; - *ptr = '\0'; + while (*ptr) + ptr++; ptr++; - /* skip more space-syms */ - while (*ptr && isspace(*ptr)) ptr++; - - rc++; } *argc = rc; @@ -88,4 +92,4 @@ static char** afl_init_argv(int* argc) { #undef MAX_CMDLINE_LEN #undef MAX_CMDLINE_PAR -#endif /* !_HAVE_ARGV_FUZZ_INL */ +#endif /* !_HAVE_ARGV_FUZZ_INL */ \ No newline at end of file From c0b887117efd8e7eb4a39417dc9fc35356941fa8 Mon Sep 17 00:00:00 2001 From: No-Cellist-7780 Date: Tue, 22 Jun 2021 10:41:51 -0700 Subject: [PATCH 2/2] fixed buffer overflow issue --- experimental/argv_fuzzing/argv-fuzz-inl.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/experimental/argv_fuzzing/argv-fuzz-inl.h b/experimental/argv_fuzzing/argv-fuzz-inl.h index cda743e70..995d2114e 100644 --- a/experimental/argv_fuzzing/argv-fuzz-inl.h +++ b/experimental/argv_fuzzing/argv-fuzz-inl.h @@ -92,4 +92,4 @@ static char **afl_init_argv(int *argc) { #undef MAX_CMDLINE_LEN #undef MAX_CMDLINE_PAR -#endif /* !_HAVE_ARGV_FUZZ_INL */ \ No newline at end of file +#endif /* !_HAVE_ARGV_FUZZ_INL */