Skip to content
This repository was archived by the owner on Apr 30, 2021. It is now read-only.
This repository was archived by the owner on Apr 30, 2021. It is now read-only.

Add a way to save hard crashes #10

Open

Description

@jvoisin

While fuzzing some python stuff, I've found several heap-corruption issues. Unfortunately, since the whole Python thingy is crashing in a weird way, the crashing input isn't saved, and this is annoying.

It would be nice to have a way (maybe hidden behind a flag) to keep this kind of crashes.

Activity

  1. yevgenypats commented on Dec 18, 2019

    @yevgenypats

    heap-corruption issues in the runtime itself? this is cool!(would love to see that when possible/fixed). The only way I can think of saving those kind of crashes are saving each time the last input on disk but that will kind of slow the whole thing down. Do you have some kind of reproduction for this? maybe it's just running out of memory?

  2. jvoisin commented on Dec 18, 2019

    @jvoisin
    ContributorAuthor

    I thought about keeping everything, but it would murder the performances.
    A better way would be to have a better monitoring of the fuzzee's process, to detect this kind of issues, and dump the input.

    I'm currently trying to run my fuzzer in an ASAN environment, to see if I can reproduce this.

  3. yevgenypats commented on Dec 18, 2019

    @yevgenypats

    If you have a reproduction you can share I'll be happy to take a look at this. sounds like an interesting case-study.

  4. jvoisin commented on Dec 18, 2019

    @jvoisin
    ContributorAuthor

    You can always use something like this I guess:

    import ctypes
    
    i = ctypes.c_char(b'a')
    j = ctypes.pointer(i)
    c = 0
    while True:
        j[c] = b'a'
        c += 1
  5. yevgenypats commented on Dec 19, 2019

    @yevgenypats

    Ah got it, you meant code that uses cbindings. That makes more sense now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions