SYS-OSS/FRET-LibAFL
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix not NUL-terminated argv in libfuzzer_initialize

Browse Source
This commit is contained in:
Andrea Fioraldi 2021-09-27 17:48:06 +02:00
parent 54ac57b6f7
commit a0cdaf71ff
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libafl_qemu/src/emu.rs
View File

@ -141,9 +141,10 @@ extern "C" {
#[allow(clippy::must_use_candidate, clippy::similar_names)] #[allow(clippy::must_use_candidate, clippy::similar_names)]
pub fn init(args: &[String], env: &[(String, String)]) -> i32 { pub fn init(args: &[String], env: &[(String, String)]) -> i32 {
let args: Vec<String> = args.iter().map(|x| x.clone() + "\0").collect();
let argv: Vec<*const u8> = args.iter().map(|x| x.as_bytes().as_ptr()).collect(); let argv: Vec<*const u8> = args.iter().map(|x| x.as_bytes().as_ptr()).collect();
assert!(argv.len() < i32::MAX as usize); assert!(argv.len() < i32::MAX as usize);
let env_strs: Vec<String> = env.iter().map(|(k, v)| format!("{}={}", &k, &v)).collect(); let env_strs: Vec<String> = env.iter().map(|(k, v)| format!("{}={}\0", &k, &v)).collect();
let mut envp: Vec<*const u8> = env_strs.iter().map(|x| x.as_bytes().as_ptr()).collect(); let mut envp: Vec<*const u8> = env_strs.iter().map(|x| x.as_bytes().as_ptr()).collect();
envp.push(null()); envp.push(null());
#[allow(clippy::cast_possible_wrap)] #[allow(clippy::cast_possible_wrap)]

1
libafl_targets/src/libfuzzer.rs
View File

@ -17,6 +17,7 @@ extern "C" {
#[allow(clippy::similar_names)] #[allow(clippy::similar_names)]
#[allow(clippy::must_use_candidate)] // nobody uses that return code... #[allow(clippy::must_use_candidate)] // nobody uses that return code...
pub fn libfuzzer_initialize(args: &[String]) -> i32 { pub fn libfuzzer_initialize(args: &[String]) -> i32 {
let args: Vec<String> = args.iter().map(|x| x.clone() + "\0").collect();
let argv: Vec<*const u8> = args.iter().map(|x| x.as_bytes().as_ptr()).collect(); let argv: Vec<*const u8> = args.iter().map(|x| x.as_bytes().as_ptr()).collect();
assert!(argv.len() < i32::MAX as usize); assert!(argv.len() < i32::MAX as usize);
#[allow(clippy::cast_possible_wrap)] #[allow(clippy::cast_possible_wrap)]