Skip to content
This repository has been archived by the owner on Oct 11, 2023. It is now read-only.

conflict between Centipede's and ASAN's interceptors #213

Open
kcc opened this issue Sep 19, 2022 · 0 comments
Open

conflict between Centipede's and ASAN's interceptors #213

kcc opened this issue Sep 19, 2022 · 0 comments

Comments

@kcc
Copy link
Contributor

kcc commented Sep 19, 2022

Centipede intercepts memcmp (and will intercept more in future).
Sanitizers (ASAN, etc) also intercept the same functions.
The way we currently build binaries for Centipede's --extra_binaries= makes these interceptors conflict.

% cat memcmp_fuzz.cc 
#include <cstdint>
#include <cstddef>
#include <cstring>

volatile auto M = &memcmp;

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  char x[3] = {'z', 'z', 'z'};
  if (size != 2) return 0;
  M(x, data, 3);  // should trigger an ASAN report.
  return 0;
}

% clang -O2 -fsanitize=address,fuzzer ./memcmp_fuzz.cc -o lf
% ./lf zz  2>&1 | grep ERROR 
==3371320==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000032 at pc 0x56499c281f3c bp 0x7ffc82201d00 sp 0x7ffc822014b0

libFuzzer+ASAN can easily detect a buffer overflow inside memcmp.

% clang++ @$CENTIPEDE/clang-flags.txt -c memcmp_fuzz.cc 
% clang++ memcmp_fuzz.o ./bazel-bin/libcentipede_runner.pic.a -fsanitize=address -ldl -lrt -lpthread -o memcmp_centipede
% ./memcmp_centipede zz
Centipede fuzz target runner; argv[0]: ./memcmp_centipede flags: (null)
Not using RLIMIT_AS; VmSize is 20480Gb, suspecting ASAN/MSAN/TSAN
<no report>

Internally, we build Centipede's runner together with the target, and the #if !defined(ADDRESS_SANITIZER) inside runner_interceptors.cc avoids this problem.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant