1

在对 Mosquitto lib 进行模糊测试时出现了一个错误，我想知道解决方案。

步骤1。编译库

#:~/fuzz/fuzzmqtt/mosquitto$ ls
about.html       doc                   Makefile            security
aclfile.example  docker                man                 SECURITY.md
appveyor.yml     edl-v10               misc                service
buildtest.py     epl-v10               mosquitto.conf      set-version.sh
ChangeLog.txt    examples              Mosquitto.podspec   snap
client           installer             notice.html         src
CMakeLists.txt   lib                   pskfile.example     test
compiling.txt    libmosquitto.pc.in    pwfile.example      THANKS.txt
config.h         libmosquittopp.pc.in  readme.md           travis-configure.sh
config.mk        LICENSE.txt           readme-tests.md     travis-install.sh
CONTRIBUTING.md  logo                  readme-windows.txt  www


#:~/fuzz/fuzzmqtt/mosquitto$ sudo make install CC="clang -O2 -fno-omit-frame-pointer -g -fsanitize=address -fsanitize-coverage=trace-pc-guard,trace-cmp,trace-gep,trace-div" -j2

第2步。编译模糊器

#:~/fuzz/fuzzmqtt/mosquitto/lib$ clang -g -O1 -fsanitize=fuzzer,address mos_fuzzer.cc -o mos_fuzzer -lmosquitto

第三步。运行模糊器并得到错误

#~/fuzz/fuzzmqtt/mosquitto/lib$ ./mos_fuzzer 
INFO: Seed: 106983829
INFO: Loaded 1 modules   (2337 guards): 2337 [0x7f157cd816b0, 0x7f157cd83b34), 
INFO: Loaded 1 modules   (1 inline 8-bit counters): 1 [0x787f80, 0x787f81), 
INFO: Loaded 1 PC tables (1 PCs): 1 [0x565af8,0x565b08), 
ERROR: The size of coverage PC tables does not match the
number of instrumented PCs. This might be a compiler bug,
please contact the libFuzzer developers.
Also check https://bugs.llvm.org/show_bug.cgi?id=34636
for possible workarounds (tl;dr: don't use the old GNU ld)

代码如下

#include "stdio.h"
#include "mosquitto.h"
#include "assert.h"
#include "stdint.h"
#include "stddef.h"
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {

    bool clean_session = true;
    struct mosquitto *mosq = NULL;
    mosquitto_lib_init();
    void *data_1=(void *)data;
    mosq = mosquitto_new(NULL, clean_session, data_1);
    mosquitto_destroy(mosq);
    mosquitto_lib_cleanup();
    return 0;
}

谢谢

4

0 回答 0