SYS-OSS/FRET-LibAFL
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix panic in mmap shmem when full_file_name is less than MAX_MMAP_FILENAME_LEN (#2536)

Browse Source 
* Fix panic in mmap shmem

* duh

* clippy

* fix null bytes

---------

Co-authored-by: Dominik Maier <dmnk@google.com>
This commit is contained in:
Andrea Fioraldi 2024-09-24 03:37:03 +02:00 committed by GitHub
parent bacbffa6c1
commit 72893797b4
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libafl_bolts/src/shmem.rs
View File

@ -694,11 +694,13 @@ pub mod unix_shmem {
/// This will *NOT* automatically delete the shmem files, meaning that it's user's responsibility to delete all `/dev/shm/libafl_*` after fuzzing /// This will *NOT* automatically delete the shmem files, meaning that it's user's responsibility to delete all `/dev/shm/libafl_*` after fuzzing
pub fn new(map_size: usize, rand_id: u32) -> Result<Self, Error> { pub fn new(map_size: usize, rand_id: u32) -> Result<Self, Error> {
unsafe { unsafe {
let full_file_name = format!("/libafl_{}_{}", process::id(), rand_id); let mut full_file_name = format!("/libafl_{}_{}", process::id(), rand_id);
// leave one byte space for the null byte.
full_file_name.truncate(MAX_MMAP_FILENAME_LEN - 1);
let mut filename_path = [0_u8; MAX_MMAP_FILENAME_LEN]; let mut filename_path = [0_u8; MAX_MMAP_FILENAME_LEN];
filename_path filename_path[0..full_file_name.len()]
.copy_from_slice(&full_file_name.as_bytes()[..MAX_MMAP_FILENAME_LEN]); .copy_from_slice(full_file_name.as_bytes());
filename_path[MAX_MMAP_FILENAME_LEN - 1] = 0; // Null terminate! filename_path[full_file_name.len()] = 0; // Null terminate!
log::info!( log::info!(
"{} Creating shmem {} {:#?}", "{} Creating shmem {} {:#?}",
map_size, map_size,