Race condition when target is very fast
Opened this issue · 0 comments
maxammann commented
AFlnwe crashed while fuzzing:
[-] PROGRAM ABORT : Short read from input file
Location : get_test_case(), afl-fuzz.c:468
When using -f .file
the race condition is still present, it just crashes differently, because lseek returns -f
because the .file
was unlinked and not found.
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1 0x00007ffff7dec859 in __GI_abort () at abort.c:79
#2 0x0000555555568196 in DFL_ck_alloc_nozero (size=4294967295) at alloc-inl.h:114
#3 DFL_ck_alloc (size=4294967295) at alloc-inl.h:136
#4 get_test_case (fsize=<optimized out>) at afl-fuzz.c:468
#5 0x000055555556856f in send_over_network () at afl-fuzz.c:578
#6 0x00005555555694cf in run_target (argv=0x7fffffffe980, timeout=40) at afl-fuzz.c:2687
#7 0x000055555556d10f in common_fuzz_stuff (argv=0x7fffffffe980, out_buf=0x5555556b7258 "\026\003\001", len=<optimized out>) at afl-fuzz.c:4906
#8 0x000055555556e902 in fuzz_one (argv=<optimized out>) at afl-fuzz.c:6774
#9 0x0000555555559bb8 in main (argc=29, argv=<optimized out>) at afl-fuzz.c:8396
The latter crash is not fixed by this one: tlspuffin@feaf31c
I fixed it using these two commits: