trailofbits/deepstate

Fuzzers - DeepState_Malloc leaks memory

GrosQuildu opened this issue · 1 comments

Using DeepState_Malloc is hard with fuzzers, because it requires freeing. Now, if we place some ASSERTs before free, we will leak memory. Replacing ASSERT with CHECK introduces some strange behavior:

  • fuzzing with AFL: it leaks memory same as ASSERT
  • fuzzing with libFuzzer: it do not leaks, but also dont crash

Example test:

#include <deepstate/DeepState.hpp>
using namespace deepstate;

TEST(T, T) {
  char *data = (char*)DeepState_Malloc(4096);
  for (int i = 0; i < 15; ++i)
  {
    char out[3] = {};
    snprintf(out, 3, "%02x", data[i]);
    LOG(INFO) << out;
  }
  printf("\n");
  ASSERT_EQ(data[0], 0);  // CHECK_EQ(data[0], 0);
  free(data);
}

see #346

we need the old Malloc for code in C that expects to free pointers it gets, though