Skip to content

Commit e15be12

Browse files
PBetzlerPBetzler
committed
updated example to new naming schema
1 parent 1fe0ec2 commit e15be12

File tree

7 files changed

+127
-7
lines changed

7 files changed

+127
-7
lines changed

‎.cifuzz-findings/predictive_ant/crashing-input

33 Bytes
Binary file not shown.

‎.cifuzz-findings/predictive_ant/finding.json

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"name": "predictive_ant",
3+
"type": "WARNING",
4+
"input_data": "inGKcf+S3ESO5gI73P///zvc/////////wEBAP9DjuaC",
5+
"logs": [
6+
"Slow input: 27 seconds for processing",
7+
"artifact_prefix='/tmp/libfuzzer-out-3809360830/'; Test unit written to .cifuzz-findings/predictive_ant/crashing-input",
8+
"Base64: inGKcf+S3ESO5gI73P///zvc/////////wEBAP9DjuaC",
9+
"In loop at position: 0 of 922747137",
10+
"In loop at position: 100000000 of 922747137",
11+
"In loop at position: 200000000 of 922747137",
12+
"In loop at position: 300000000 of 922747137",
13+
"In loop at position: 400000000 of 922747137",
14+
"In loop at position: 500000000 of 922747137",
15+
"In loop at position: 600000000 of 922747137",
16+
"In loop at position: 700000000 of 922747137",
17+
"In loop at position: 800000000 of 922747137",
18+
"In loop at position: 900000000 of 922747137"
19+
],
20+
"details": "Slow input detected. Processing time: 27 s",
21+
"more_details": {
22+
"id": "slow_input"
23+
},
24+
"created_at": "2024-09-12T17:54:29.70674698+02:00",
25+
"input_file": ".cifuzz-findings/predictive_ant/crashing-input",
26+
"fuzz_test": "slow_input_checks_fuzz_test"
27+
}

‎.cifuzz-findings/unruffled_labrador/crashing-input

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Attacker~#;�����

‎.cifuzz-findings/unruffled_labrador/finding.json

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
{
2+
"name": "unruffled_labrador",
3+
"type": "CRASH",
4+
"input_data": "QXR0YWNrZXJ+IzutsbOzsw==",
5+
"logs": [
6+
"==59462==ERROR: AddressSanitizer: global-buffer-overflow on address 0x58f4a8007dc5 at pc 0x58f4a71e2a34 bp 0x7ffc609b03c0 sp 0x7ffc609afb80",
7+
"WRITE of size 8 at 0x58f4a8007dc5 thread T0",
8+
" #0 0x58f4a71e2a33 in __asan_memcpy (/home/philip/Code/examples/c-cpp-example/.cifuzz-build/libfuzzer/address+undefined/src/simple_examples/simple_checks_fuzz_test+0x16ba33) (BuildId: 8cecfc4051a1a8d091763e4d316dd04ebc33f259)",
9+
" #1 0x58f4a722c922 in trigger_global_buffer_overflow(std::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e const\u0026) /home/philip/Code/examples/c-cpp-example/src/simple_examples/explore_me.cpp:40:3",
10+
" #2 0x58f4a722c922 in ExploreSimpleChecks(int, int, std::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e \u003e) /home/philip/Code/examples/c-cpp-example/src/simple_examples/explore_me.cpp:15:11",
11+
" #3 0x58f4a722a1dc in LLVMFuzzerTestOneInputNoReturn(unsigned char const*, unsigned long) /home/philip/Code/examples/c-cpp-example/src/simple_examples/simple_checks_test.cpp:24:3",
12+
" #4 0x58f4a722a7b7 in LLVMFuzzerTestOneInput /home/philip/Code/examples/c-cpp-example/src/simple_examples/simple_checks_test.cpp:18:1",
13+
" #5 0x58f4a7131c20 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/philip/Code/examples/c-cpp-example/.cifuzz-build/libfuzzer/address+undefined/src/simple_examples/simple_checks_fuzz_test+0xbac20) (BuildId: 8cecfc4051a1a8d091763e4d316dd04ebc33f259)",
14+
" #6 0x58f4a7131395 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool, bool*) (/home/philip/Code/examples/c-cpp-example/.cifuzz-build/libfuzzer/address+undefined/src/simple_examples/simple_checks_fuzz_test+0xba395) (BuildId: 8cecfc4051a1a8d091763e4d316dd04ebc33f259)",
15+
" #7 0x58f4a7133026 in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::vector\u003cfuzzer::SizedFile, std::allocator\u003cfuzzer::SizedFile\u003e \u003e\u0026) (/home/philip/Code/examples/c-cpp-example/.cifuzz-build/libfuzzer/address+undefined/src/simple_examples/simple_checks_fuzz_test+0xbc026) (BuildId: 8cecfc4051a1a8d091763e4d316dd04ebc33f259)",
16+
" #8 0x58f4a7133593 in fuzzer::Fuzzer::Loop(std::vector\u003cfuzzer::SizedFile, std::allocator\u003cfuzzer::SizedFile\u003e \u003e\u0026) (/home/philip/Code/examples/c-cpp-example/.cifuzz-build/libfuzzer/address+undefined/src/simple_examples/simple_checks_fuzz_test+0xbc593) (BuildId: 8cecfc4051a1a8d091763e4d316dd04ebc33f259)",
17+
" #9 0x58f4a712189f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/philip/Code/examples/c-cpp-example/.cifuzz-build/libfuzzer/address+undefined/src/simple_examples/simple_checks_fuzz_test+0xaa89f) (BuildId: 8cecfc4051a1a8d091763e4d316dd04ebc33f259)",
18+
" #10 0x58f4a714a932 in main (/home/philip/Code/examples/c-cpp-example/.cifuzz-build/libfuzzer/address+undefined/src/simple_examples/simple_checks_fuzz_test+0xd3932) (BuildId: 8cecfc4051a1a8d091763e4d316dd04ebc33f259)",
19+
" #11 0x7fa793829d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58:16",
20+
" #12 0x7fa793829e3f in __libc_start_main ../csu/libc-start.c:392:3",
21+
" #13 0x58f4a7116e14 in _start (/home/philip/Code/examples/c-cpp-example/.cifuzz-build/libfuzzer/address+undefined/src/simple_examples/simple_checks_fuzz_test+0x9fe14) (BuildId: 8cecfc4051a1a8d091763e4d316dd04ebc33f259)",
22+
"",
23+
"0x58f4a8007dc5 is located 0 bytes after global variable 'gBuffer' defined in '/home/philip/Code/examples/c-cpp-example/src/simple_examples/explore_me.cpp' (0x58f4a8007dc0) of size 5",
24+
"SUMMARY: AddressSanitizer: global-buffer-overflow (/home/philip/Code/examples/c-cpp-example/.cifuzz-build/libfuzzer/address+undefined/src/simple_examples/simple_checks_fuzz_test+0x16ba33) (BuildId: 8cecfc4051a1a8d091763e4d316dd04ebc33f259) in __asan_memcpyShadow bytes around the buggy address:",
25+
" 0x58f4a8007b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
26+
" 0x58f4a8007b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
27+
" 0x58f4a8007c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
28+
" 0x58f4a8007c80: 00 00 00 00 00 00 00 00 01 f9 f9 f9 00 00 00 00",
29+
" 0x58f4a8007d00: f9 f9 f9 f9 00 f9 f9 f9 00 f9 f9 f9 00 f9 f9 f9",
30+
"=\u003e0x58f4a8007d80: 00 00 00 00 00 f9 f9 f9[05]f9 f9 f9 00 00 00 00",
31+
" 0x58f4a8007e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
32+
" 0x58f4a8007e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
33+
" 0x58f4a8007f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
34+
" 0x58f4a8007f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
35+
" 0x58f4a8008000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00",
36+
"Shadow byte legend (one shadow byte represents 8 application bytes):",
37+
" Addressable: 00",
38+
" Partially addressable: 01 02 03 04 05 06 07 ",
39+
" Heap left redzone: fa",
40+
" Freed heap region: fd",
41+
" Stack left redzone: f1",
42+
" Stack mid redzone: f2",
43+
" Stack right redzone: f3",
44+
" Stack after return: f5",
45+
" Stack use after scope: f8",
46+
" Global redzone: f9",
47+
" Global init order: f6",
48+
" Poisoned by user: f7",
49+
" Container overflow: fc",
50+
" Array cookie: ac",
51+
" Intra object redzone: bb",
52+
" ASan internal: fe",
53+
" Left alloca redzone: ca",
54+
" Right alloca redzone: cb",
55+
"==59462==ABORTING",
56+
"MS: 0 ; base unit: 0000000000000000000000000000000000000000",
57+
"0x41,0x74,0x74,0x61,0x63,0x6b,0x65,0x72,0x7e,0x23,0x3b,0xad,0xb1,0xb3,0xb3,0xb3,",
58+
"Attacker~#;\\255\\261\\263\\263\\263",
59+
"artifact_prefix='/tmp/libfuzzer-out-4219054219/'; Test unit written to .cifuzz-findings/unruffled_labrador/crashing-input",
60+
"Base64: QXR0YWNrZXJ+IzutsbOzsw=="
61+
],
62+
"details": "global-buffer-overflow on address 0x58f4a8007dc5 at pc 0x58f4a71e2a34 bp 0x7ffc609b03c0 sp 0x7ffc609afb80",
63+
"more_details": {
64+
"id": "global_buffer_overflow"
65+
},
66+
"created_at": "2024-09-12T17:52:52.026384581+02:00",
67+
"input_file": ".cifuzz-findings/unruffled_labrador/crashing-input",
68+
"stack_trace": [
69+
{
70+
"SourceFile": "src/simple_examples/explore_me.cpp",
71+
"Line": 40,
72+
"Column": 3,
73+
"FrameNumber": 1,
74+
"Function": "trigger_global_buffer_overflow"
75+
},
76+
{
77+
"SourceFile": "src/simple_examples/explore_me.cpp",
78+
"Line": 15,
79+
"Column": 11,
80+
"FrameNumber": 2,
81+
"Function": "ExploreSimpleChecks"
82+
},
83+
{
84+
"SourceFile": "src/simple_examples/simple_checks_test.cpp",
85+
"Line": 24,
86+
"Column": 3,
87+
"FrameNumber": 3,
88+
"Function": "LLVMFuzzerTestOneInputNoReturn"
89+
}
90+
],
91+
"fuzz_test": "simple_checks_fuzz_test"
92+
}

‎.gitignore

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ lcov.info
1111
!.cifuzz-findings/
1212

1313
.cifuzz-findings/*
14-
!.cifuzz-findings/awesome_gnu/
15-
.cifuzz-findings/awesome_gnu/.lock
16-
!.cifuzz-findings/philosophical_capybara/
17-
.cifuzz-findings/philosophical_capybara/.lock
14+
!.cifuzz-findings/unruffled_labrador/
15+
.cifuzz-findings/unruffled_labrador/.lock
16+
!.cifuzz-findings/predictive_ant/
17+
.cifuzz-findings/predictive_ant/.lock

‎src/advanced_examples/slow_input_checks_test.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,15 @@
55
#include <gtest/gtest.h>
66

77
TEST(ExploreSlowInputsChecks, FirstTest) {
8-
8+
99
EXPECT_NO_THROW(ExploreSlowInputsChecks(23323, 100));
1010
}
1111

1212
TEST(ExploreSlowInputsChecks, SecondTest) {
1313
EXPECT_NO_THROW(ExploreSlowInputsChecks(1324153, 192198));
1414
}
1515

16-
DEBUG_FINDING(philosophical_capybara)
16+
DEBUG_FINDING(predictive_ant)
1717
FUZZ_TEST(const uint8_t *data, size_t size) {
1818
FuzzedDataProvider fdp(data, size);
1919
long a = fdp.ConsumeIntegral<int>();

‎src/simple_examples/simple_checks_test.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ TEST(ExploreSimpleChecksTests, MaintainerTest) {
1313
EXPECT_NO_THROW(ExploreSimpleChecks(20, -10, "Maintainer"));
1414
}
1515

16-
DEBUG_FINDING(awesome_gnu)
16+
DEBUG_FINDING(unruffled_labrador)
1717

1818
FUZZ_TEST(const uint8_t *data, size_t size) {
1919
FuzzedDataProvider fdp(data, size);

0 commit comments

Comments
 (0)