Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Generalize the project to other fuzzers: AFL and Honggfuzz #102

Merged
merged 56 commits into from
Apr 25, 2018

Conversation

PaulGrandperrin
Copy link
Member

@PaulGrandperrin PaulGrandperrin commented Apr 21, 2018

This is far from perfect (all targets are compiled at once) but it works and it's easy to work with (look at and add targets).

All the targets have been ported with only 1 or 2 exceptions that were broken and not easily fixable.
All seeds have been moved over too.
I added a few more targets like url and proc_macro2.

closes #100
closes #98
closes #66 I guess
closes #34 not relevant anymore
closes #73

Copy link
Member

@killercup killercup left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wow this looks super cool!

notifications:
email:
recipients:
- paul.grandperrin@gmail.com
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do you really want to get these mails? :)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe not 😄 , I'll see if it's too much!

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, I'm pretty sure this settings means you and you alone will be responsible for our CI, though 😄

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I won't hesitate to ping people if needed ;-)


sh -ve gen-targets-src.sh

cargo install afl honggfuzz --force --verbose
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not sure how long this takes, but you might want to add cache: cargo to travis.yml and check if the latest version is already installed here to speed it up (can totally be in another PR though)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I didn't know about cache: cargo. Is it really useful when always running on the latest nightly?

Copy link
Member

@killercup killercup Apr 21, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm, good point. It'll probably only cache the crate sources. Not sure how much time the downloads take

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since the crates are downloaded from git, I don't think it'll change a lot but I guess there are no drawbacks in our use-case, right?

extern crate zip;
extern crate zopfli;

// many function bodies are copied from https://github.com/rust-fuzz/targets
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

will no longer a helpful comment i guess :)


// many function bodies are copied from https://github.com/rust-fuzz/targets

#[inline(always)]
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not sure how much I like a huge file with ALL the fuzzer functions and then also have them be #[inline(always)]… but I can't think of a good pragmatic alternative, so let's leave it like this for now

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Exactly same feeling here.
I haven't figured out what would be the best solution but I'm planning to do something about it.

I think it's ok for now.

@killercup
Copy link
Member

Just ran the continuous script on may macbook for a bit and after a while it failed to compile targets because cc failed with "posix_spawn failed: Resource temporarily unavailable". This is apparently because of a hard limit of processes per user was reached. Fuzz targets don't seem to be properly killed. (I was able to solve this temporarily with pkill -f hfuzz_target.)

@PaulGrandperrin
Copy link
Member Author

Oh, that's unexpected!
I'll try to reproduce on Linux.
Anyway, I wouldn't recommend serious fuzzing on macOS as it is less well instrumented and it seems to me that it's potentially far slower.
However I have very weak experience to back that up:

  • the fuzzing part of my honggfuzz tests on travis are quite slower on macOS
  • fuzzing is way slower on my high sierra guest VM than on my debian host (but that's to be expected)

If you have Linux natively installed your apple box, I would interrested in a fair benchmark ;-)

@PaulGrandperrin
Copy link
Member Author

I cannot repro on Linux.
Could you check that the leaked targets are zombie processes?

@killercup
Copy link
Member

So, at some point it seems to stop killing processes:

$ ps x | grep fuzz
 3004   ??  Ss     0:04.17 hfuzz_target/x86_64-apple-darwin/release/chrono_read
 3005   ??  Ss     0:04.04 hfuzz_target/x86_64-apple-darwin/release/chrono_read
 3006   ??  Ss     0:04.03 hfuzz_target/x86_64-apple-darwin/release/chrono_read
 3007   ??  Ss     0:04.00 hfuzz_target/x86_64-apple-darwin/release/chrono_read
 3061   ??  Ss     0:06.78 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_blake2b
 3062   ??  Ss     0:06.76 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_blake2b
 3063   ??  Ss     0:06.72 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_blake2b
 3064   ??  Ss     0:06.75 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_blake2b
 3135   ??  Ss     0:06.64 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_blake2s
 3136   ??  Ss     0:06.60 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_blake2s
 3137   ??  Ss     0:06.59 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_blake2s
 3138   ??  Ss     0:06.59 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_blake2s
 3305   ??  Ss     0:10.19 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_md2
 3306   ??  Ss     0:10.19 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_md2
 3307   ??  Ss     0:10.19 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_md2
 3308   ??  Ss     0:10.18 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_md2
 3350   ??  Ss     0:05.70 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_md4
 3351   ??  Ss     0:05.62 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_md4
 3352   ??  Ss     0:05.70 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_md4
 3353   ??  Ss     0:05.60 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_md4
 3394   ??  Ss     0:05.62 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_md5
 3395   ??  Ss     0:05.50 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_md5
 3396   ??  Ss     0:05.61 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_md5
 3397   ??  Ss     0:05.66 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_md5
 3467   ??  Ss     0:06.08 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_ripemd160
 3468   ??  Ss     0:06.06 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_ripemd160
 3469   ??  Ss     0:05.97 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_ripemd160
 3470   ??  Ss     0:05.98 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_ripemd160
 3509   ??  Ss     0:05.73 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_sha1
 3510   ??  Ss     0:05.82 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_sha1
 3511   ??  Ss     0:05.84 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_sha1
 3512   ??  Ss     0:05.69 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_sha1
 3552   ??  Ss     0:05.57 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_sha2_256
 3553   ??  Ss     0:05.51 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_sha2_256
 3554   ??  Ss     0:05.55 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_sha2_256
 3555   ??  Ss     0:05.57 hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_sha2_256
 2656 s010  S+     0:00.13 ruby ./continuous-fuzzing.rb
 3515 s010  S+     0:00.00 /bin/sh -e ./fuzz-with-honggfuzz.sh crypto_hashes_sha2_256
 3538 s010  R+     0:15.09 hfuzz_target/honggfuzz -W hfuzz_workspace/crypto_hashes_sha2_256 -f hfuzz_workspace/crypto_hashes_sha2_256/input -P --run_time 10 -- hfuzz_target/x86_64-apple-darwin/release/crypto_hashes_sha2_256
 3559 s011  S+     0:00.00 grep --color=auto fuzz

Which is pretty weird, but should not block this PR -- it's a new feature and if we have to tell people to be careful, then so be it.

@frewsxcv
Copy link
Member

love this, thanks so much @PaulGrandperrin! as per the previous convo, looks like there might a bug to work out, but agreed it shouldn't block this. 🎉

bors r+

bors bot added a commit that referenced this pull request Apr 25, 2018
102: Generalize the project to other fuzzers: AFL and Honggfuzz r=frewsxcv a=PaulGrandperrin

This is far from perfect (all targets are compiled at once) but it works and it's easy to work with (look at and add targets).

All the targets have been ported with only 1 or 2 exceptions that were broken and not easily fixable.
All seeds have been moved over too.
I added a few more targets like `url` and `proc_macro2`.

closes #100 
closes #98 
closes #66 I guess
closes #34 not relevant anymore
closes #73 

Co-authored-by: Paul Grandperrin <paul.grandperrin@gmail.com>
@bors
Copy link
Contributor

bors bot commented Apr 25, 2018

Build succeeded

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
3 participants