Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Stability is not 100% even with an empty fuzzing target #152

Open
pedrocr opened this issue Feb 22, 2019 · 3 comments
Open

Stability is not 100% even with an empty fuzzing target #152

pedrocr opened this issue Feb 22, 2019 · 3 comments

Comments

@pedrocr
Copy link
Contributor

pedrocr commented Feb 22, 2019

When fuzzing rawloader I'm getting these warnings on startup:

[!] WARNING: Instrumentation output varies across runs.

and when running the fuzzer stability is around 68% which is extremely low. Even an empty fuzzing target like this:

#[macro_use]
extern crate afl;

fn main() {
  fuzz!(|data: &[u8]| {
  });
}

Only shows 93 or 94% stability. Am I doing something wrong or is there a bug somewhere?

@pedrocr
Copy link
Contributor Author

pedrocr commented Feb 22, 2019

Apparently lazy_static is something that needs to be handled carefully for afl. It ends up only being initialized inside the loop instead of only once. It's easy to work around in this codebase but it may be something that needs to be fixed more fully for other codebases to work well.

@pedrocr pedrocr closed this as completed Feb 22, 2019
@pedrocr
Copy link
Contributor Author

pedrocr commented Feb 22, 2019

Having kept at it I'm now hitting ~90% stability only. Since the empty fuzz target is showing ~94% this seems like a bug somewhere in how afl.rs is doing the instrumentation.

@pedrocr pedrocr reopened this Feb 22, 2019
@pedrocr pedrocr changed the title Stability is low even in code that should not vary Stability is not 100% even with an empty fuzzing target Feb 22, 2019
@pedrocr
Copy link
Contributor Author

pedrocr commented Feb 22, 2019

Apparently this happens because of the panic hook as well. Without it stability goes back to 100%.

pedrocr added a commit to pedrocr/afl.rs that referenced this issue Feb 22, 2019
If your fuzzing code catches panics somewhere inside its code the hook
would turn those into crashes. Allow disabling the hook by adding a
fuzz_nohook! macro.

Fixes rust-fuzz#150
Fixes rust-fuzz#152
pedrocr added a commit to pedrocr/afl.rs that referenced this issue Feb 22, 2019
If your fuzzing code catches panics somewhere inside its code the hook
would turn those into crashes. Allow disabling the hook by adding a
fuzz_nohook! macro.

Fixes rust-fuzz#150
Fixes rust-fuzz#152
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant