fix(cmplog): handle non-power-of-2 comparison sizes from AFL++ GCC plugin#3740
Open
akshaytheflash wants to merge 1 commit intoAFLplusplus:mainfrom
Open
fix(cmplog): handle non-power-of-2 comparison sizes from AFL++ GCC plugin#3740akshaytheflash wants to merge 1 commit intoAFLplusplus:mainfrom
akshaytheflash wants to merge 1 commit intoAFLplusplus:mainfrom
Conversation
…ugin
AFL++'s GCC cmplog plugin (afl-gcc-cmplog-pass.so.cc) can report comparison
sizes that are not powers of 2, e.g. 24-bit (shape=2), 40-bit (shape=4),
48-bit (shape=5), 56-bit (shape=6), via the hookN variant. The clang plugin
rounds these up to the next power of 2, but the GCC plugin reports the actual
size, causing LibAFL to panic with 'Invalid CmpLog shape {shape}'.
Fix both CmpLogMap::values_of and AflppCmpLogMap::values_of to treat:
- shape 2 (24-bit) as U32 (same as clang plugin)
- shapes 4/5/6 (40/48/56-bit) as U64 (same as clang plugin)
For any remaining unknown shapes, emit a warning instead of panicking.
Fixes AFLplusplus#3729
Member
|
did you just feed other people's issue and PR into LLM and made another PR out of it? |
Author
It didn't even pass the test cases bro, leave me alone 🥀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
AFL++'s GCC cmplog plugin (
afl-gcc-cmplog-pass.so.cc) can report integercomparison sizes that are not powers of 2 via the
hookNvariant. Forexample, a 24-bit comparison gets
shape = 2, 40-bit getsshape = 4, etc.The clang plugin rounds these up to the nearest power of 2 (so 24-bit becomes
32-bit), but the GCC plugin reports the actual byte size. When LibAFL encounters
these shapes, it panics with:
Both
CmpLogMap::values_ofandAflppCmpLogMap::values_ofonly handled shapes0,1,3,7(corresponding to 1, 2, 4, 8 bytes), and panicked on anythingelse.
Fix
Round non-power-of-2 sizes up to the next supported power of 2, matching the
clang plugin's behavior:
For any remaining truly unknown shapes (beyond 64-bit, which is a separate
TODO), emit a
log::warn!instead of panicking, making the fuzzer resilientrather than crashing.
References