Skip to contentSkip to conversation

fuzzing dtc with AFL

DISCUSSION Anton Blanchard 2 participants 6 messages Jan 2, 2016 – Jan 12, 2016 2 messages not in the archive

lore
Share & tools
lore

Anton Blanchard

author
#0 lore raw

Hi David,

I wanted something to test AFL with, and since dtc is simple, self contained and checked out on my laptop, I attacked it. It found a number of interesting testcases:

A divide by zero issue:

# ./dtc test1.dts 
Floating point exception

An issue parsing octals:

# ./dtc test2.dts 
dtc: dtc-lexer.l:156: yylex: Assertion `!(*e) || !e[strspn(e, "UL")]'
failed.
Aborted

An issue with null escape characters:

# ./dtc test3.dts 
dtc: util.c:155: get_escape_char: Assertion `c' failed.
Aborted

and a SEGV:

# ./dtc test4.dts 
Segmentation fault

Anton

#1 lore raw
Quoted 3 lines · Anton Blanchard

Hi David,

I wanted something to test AFL with, and since dtc is simple, self

What's AFL?

Quoted 17 lines

contained and checked out on my laptop, I attacked it. It found a number of interesting testcases:

A divide by zero issue:

# ./dtc test1.dts 
Floating point exception

An issue parsing octals:

# ./dtc test2.dts 
dtc: dtc-lexer.l:156: yylex: Assertion `!(*e) || !e[strspn(e, "UL")]'
failed.
Aborted

An issue with null escape characters:

Quoted 8 lines
# ./dtc test3.dts 
dtc: util.c:155: get_escape_char: Assertion `c' failed.
Aborted

and a SEGV:

# ./dtc test4.dts 
Segmentation fault

Nice catches all. I'll try to debug these in detail soon.

Signature · 4 lines
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson
#3 lore raw
In reply to a message not in the archive
Quoted 28 lines · David Gibson
Quoted 3 lines · Anton Blanchard

Hi David,

I wanted something to test AFL with, and since dtc is simple, self

What's AFL?

Quoted 21 lines

contained and checked out on my laptop, I attacked it. It found a number of interesting testcases:

A divide by zero issue:

# ./dtc test1.dts 
Floating point exception

An issue parsing octals:

# ./dtc test2.dts 
dtc: dtc-lexer.l:156: yylex: Assertion `!(*e) || !e[strspn(e, "UL")]'
failed.
Aborted

An issue with null escape characters:

# ./dtc test3.dts 
dtc: util.c:155: get_escape_char: Assertion `c' failed.
Aborted
Quoted 6 lines
Quoted 4 lines

and a SEGV:

# ./dtc test4.dts 
Segmentation fault

Nice catches all. I'll try to debug these in detail soon.

I've now commited fixes (and test cases) for all of these to the master tree.

Signature · 4 lines
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson
author
#5 lore raw
In reply to a message not in the archive
Quoted 3 lines

I've now commited fixes (and test cases) for all of these to the master tree.

Thanks David! It's looking much better, but the fuzzer did trip on another divide by zero, this time a modulo:

/dts-v1/;

/ {
        x = <(0%0)>
};

Anton

#6 lore raw
Quoted 4 lines · Anton Blanchard
Quoted 3 lines

I've now commited fixes (and test cases) for all of these to the master tree.

Quoted 8 lines

Thanks David! It's looking much better, but the fuzzer did trip on another divide by zero, this time a modulo:

/dts-v1/;

/ {
        x = <(0%0)>
};

Oops, really should have thought of that case at the same time. Oh well, fixed now.

Signature · 4 lines
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson