png-afl fuzzer is broken

[martinlindhe]

The afl fuzzer target in ./png-afl currently exits with SIGABRT as soon as any decoding errors occurs, causing AFL to think for example "CRC mismatch" is a crashing input file.

[HeroicKatora]

I'm currently running the fuzzer for 1 hour straight, this might be a setup issue?

[martinlindhe]

Maybe I'm not expressing myself clearly :)
The fuzzer is running. Its just i find 50 crashes in 1 minute according to afl, but looking at them none are actual crashers.

[martinlindhe]

Seems to me the png-afl\src\main.rs exits with SIGABORT when an error is returned from png decoding.

for file in png-afl/out/crashes/*; do cargo run --example show "$file"; done

[HeroicKatora]

The default memory limit of png is 64MB while the default for afl is 50MB, I think you could need to run the fuzzer with:

cargo afl fuzz -m 100 ./target/release/png-afl

instead.

[HeroicKatora]

The afl fuzzer should run without any crc code enabled, I don't know if this is the case or not. Otherwise, the fuzzer will mostly get stuck on reproducing valid checksums instead of producing interesting file contents.

[martinlindhe]

You're right, raising memory limit is solving the issue I was seeing! 100m not enough for me though, but 200 seems to do it!

[martinlindhe]

Glad I opened this issue, or I would be stuck forever.

The following line disables crc check on decoding https://github.com/image-rs/image-png/blob/master/src/decoder/stream.rs#L245

assuming afl is invoked with env RUSTFLAGS='--cfg fuzzing' set

[HeroicKatora]

That should probably both be explain in a readme in the png-afl directory. Otherwise it's hard to reproduce the setup.

[martinlindhe]

Also not sure this is the correct way to use cfg!().. reading up on it now

[HeroicKatora]

Shouldn't --cfg fuzzing also be provide during built time? if cfg!(fuzzing) gets compiled and not dynamically configured afaik.

[HeroicKatora]

We could also provide an explicit feature in Cargo.toml for this.

[martinlindhe]

It should yes.

Yea, setting the feature in Cargo.toml sounds good to me, less moving parts for the user.