| Message ID | 20170925142648.25959-3-george.dunlap@citrix.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
>>> On 25.09.17 at 16:26, <george.dunlap@citrix.com> wrote: > Once feof() returns true for a stream, it will continue to return true > for that stream until clearerr() is called (or the stream is closed > and re-opened). > > In llvm-clang-fast-mode, the same file descriptor is used for each > iteration of the loop, meaning that the "Input too large" check was > broken -- feof() would return true even if the fread() hadn't hit the > end of the file. The result is that AFL generates testcases of > arbitrary size. > > Fix this by clearing the error after each iteration. > > Signed-off-by: George Dunlap <george.dunlap@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
diff --git a/tools/fuzz/x86_instruction_emulator/afl-harness.c b/tools/fuzz/x86_instruction_emulator/afl-harness.c index 154869336a..b4d15451b5 100644 --- a/tools/fuzz/x86_instruction_emulator/afl-harness.c +++ b/tools/fuzz/x86_instruction_emulator/afl-harness.c @@ -97,6 +97,8 @@ int main(int argc, char **argv) fclose(fp); fp = NULL; } + else + clearerr(fp); LLVMFuzzerTestOneInput(input, size); }
Once feof() returns true for a stream, it will continue to return true for that stream until clearerr() is called (or the stream is closed and re-opened). In llvm-clang-fast-mode, the same file descriptor is used for each iteration of the loop, meaning that the "Input too large" check was broken -- feof() would return true even if the fread() hadn't hit the end of the file. The result is that AFL generates testcases of arbitrary size. Fix this by clearing the error after each iteration. Signed-off-by: George Dunlap <george.dunlap@citrix.com> --- Changes in v2: - Actually fix the root issue rather than working around it This is a candidate for backport to 4.9. CC: Ian Jackson <ian.jackson@citrix.com> CC: Wei Liu <wei.liu2@citrix.com> CC: Andrew Cooper <andrew.cooper3@citrix.com> CC: Jan Beulich <jbeulich@suse.com> --- tools/fuzz/x86_instruction_emulator/afl-harness.c | 2 ++ 1 file changed, 2 insertions(+)