Skip to content
This repository has been archived by the owner on Mar 22, 2024. It is now read-only.

Fixes buffer overflow in argv-fuzz-inl.h #141

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Fixes buffer overflow in argv-fuzz-inl.h #141

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7938567
Fixed buffer overflow
w1redch4d Jun 22, 2021
c0b8871
fixed buffer overflow issue
w1redch4d Jun 22, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 23 additions & 19 deletions experimental/argv_fuzzing/argv-fuzz-inl.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,42 +41,46 @@
#define _HAVE_ARGV_FUZZ_INL

#include <unistd.h>
#include <ctype.h>

#define AFL_INIT_ARGV() do { argv = afl_init_argv(&argc); } while (0)
#define AFL_INIT_ARGV() \
do { \
\
argv = afl_init_argv(&argc); \
\
} while (0)

#define AFL_INIT_SET0(_p) do { \
#define AFL_INIT_SET0(_p) \
do { \
\
argv = afl_init_argv(&argc); \
argv[0] = (_p); \
if (!argc) argc = 1; \
argv[0] = (_p); \
if (!argc) argc = 1; \
\
} while (0)

#define MAX_CMDLINE_LEN 100000
#define MAX_CMDLINE_PAR 1000
#define MAX_CMDLINE_PAR 50000

static char** afl_init_argv(int* argc) {
static char **afl_init_argv(int *argc) {

static char in_buf[MAX_CMDLINE_LEN];
static char* ret[MAX_CMDLINE_PAR];
static char *ret[MAX_CMDLINE_PAR];

char* ptr = in_buf;
int rc = 1; /* start after argv[0] */
char *ptr = in_buf;
int rc = 0;

if (read(0, in_buf, MAX_CMDLINE_LEN - 2) < 0);
if (read(0, in_buf, MAX_CMDLINE_LEN - 2) < 0) {}

while (*ptr) {
while (*ptr && rc < MAX_CMDLINE_PAR) {

ret[rc] = ptr;
if (ret[rc][0] == 0x02 && !ret[rc][1]) ret[rc]++;
rc++;

/* insert '\0' at the end of ret[rc] on first space-sym */
while (*ptr && !isspace(*ptr)) ptr++;
*ptr = '\0';
while (*ptr)
ptr++;
ptr++;

/* skip more space-syms */
while (*ptr && isspace(*ptr)) ptr++;

rc++;
}

*argc = rc;
Expand Down