bool arch_launchChild(honggfuzz_t * hfuzz, char *fileName) { /* * Kill the children when fuzzer dies (e.g. due to Ctrl+C) */ if (prctl(PR_SET_PDEATHSIG, (long)SIGKILL, 0L, 0L, 0L) == -1) { PLOG_E("prctl(PR_SET_PDEATHSIG, SIGKILL) failed"); return false; } /* * Kill a process which corrupts its own heap (with ABRT) */ if (setenv("MALLOC_CHECK_", "3", 1) == -1) { PLOG_E("setenv(MALLOC_CHECK_=3) failed"); return false; } /* * Tell asan to ignore SEGVs */ if (setenv ("ASAN_OPTIONS", "allow_user_segv_handler=1:handle_segv=0:abort_on_error=1:allocator_may_return_null=1", 1) == -1) { PLOG_E("setenv(ASAN_OPTIONS) failed"); return false; } const char *msan_options = "exit_code=" HF_MSAN_EXIT_CODE_STR ":report_umrs=0:wrap_signals=0:print_stats=1"; if (hfuzz->msanReportUMRS == true) { msan_options = "exit_code=" HF_MSAN_EXIT_CODE_STR ":report_umrs=1:wrap_signals=0:print_stats=1"; } if (setenv("MSAN_OPTIONS", msan_options, 1) == -1) { PLOG_E("setenv(MSAN_OPTIONS) failed"); return false; } /* * Disable ASLR */ if (hfuzz->disableRandomization && personality(ADDR_NO_RANDOMIZE) == -1) { PLOG_E("personality(ADDR_NO_RANDOMIZE) failed"); return false; } #define ARGS_MAX 512 char *args[ARGS_MAX + 2]; char argData[PATH_MAX] = { 0 }; int x; for (x = 0; x < ARGS_MAX && hfuzz->cmdline[x]; x++) { if (!hfuzz->fuzzStdin && strcmp(hfuzz->cmdline[x], _HF_FILE_PLACEHOLDER) == 0) { args[x] = fileName; } else if (!hfuzz->fuzzStdin && strstr(hfuzz->cmdline[x], _HF_FILE_PLACEHOLDER)) { const char *off = strstr(hfuzz->cmdline[x], _HF_FILE_PLACEHOLDER); snprintf(argData, PATH_MAX, "%.*s%s", (int)(off - hfuzz->cmdline[x]), hfuzz->cmdline[x], fileName); args[x] = argData; } else { args[x] = hfuzz->cmdline[x]; } } args[x++] = NULL; LOG_D("Launching '%s' on file '%s'", args[0], fileName); /* * Set timeout (prof), real timeout (2*prof), and rlimit_cpu (2*prof) */ if (hfuzz->tmOut) { /* * Set the CPU rlimit to twice the value of the time-out */ struct rlimit rl = { .rlim_cur = hfuzz->tmOut * 2, .rlim_max = hfuzz->tmOut * 2, }; if (setrlimit(RLIMIT_CPU, &rl) == -1) { PLOG_E("Couldn't enforce the RLIMIT_CPU resource limit"); return false; } } /* * The address space limit. If big enough - roughly the size of RAM used */ if (hfuzz->asLimit) { struct rlimit64 rl = { .rlim_cur = hfuzz->asLimit * 1024ULL * 1024ULL, .rlim_max = hfuzz->asLimit * 1024ULL * 1024ULL, }; if (prlimit64(0, RLIMIT_AS, &rl, NULL) == -1) { PLOG_D("Couldn't enforce the RLIMIT_AS resource limit, ignoring"); } } for (size_t i = 0; i < ARRAYSIZE(hfuzz->envs) && hfuzz->envs[i]; i++) { putenv(hfuzz->envs[i]); } if (hfuzz->nullifyStdio) { util_nullifyStdio(); } if (hfuzz->fuzzStdin) { /* * Uglyyyyyy ;) */ if (!util_redirectStdin(fileName)) { return false; } } /* * Wait for the ptrace to attach */ syscall(__NR_tkill, syscall(__NR_gettid), SIGSTOP); execvp(args[0], args); util_recoverStdio(); LOG_F("Failed to create new '%s' process", args[0]); return false; } static void arch_sigFunc(int signo, siginfo_t * si, void *dummy) { if (signo != SIGALRM) { LOG_E("Signal != SIGALRM (%d)", signo); } return; if (si == NULL) { return; } if (dummy == NULL) { return; } } static void arch_removeTimer(timer_t * timerid) { timer_delete(*timerid); } static bool arch_setTimer(timer_t * timerid) { struct sigevent sevp = { .sigev_value.sival_ptr = timerid, .sigev_signo = SIGALRM, .sigev_notify = SIGEV_THREAD_ID | SIGEV_SIGNAL, ._sigev_un._tid = syscall(__NR_gettid), }; if (timer_create(CLOCK_REALTIME, &sevp, timerid) == -1) { PLOG_E("timer_create(CLOCK_REALTIME) failed"); return false; } /* * Kick in every 200ms, starting with the next second */ const struct itimerspec ts = { .it_value = {.tv_sec = 1,.tv_nsec = 0}, .it_interval = {.tv_sec = 0,.tv_nsec = 200000000,}, }; if (timer_settime(*timerid, 0, &ts, NULL) == -1) { PLOG_E("timer_settime() failed"); timer_delete(*timerid); return false; } sigset_t smask; sigemptyset(&smask); struct sigaction sa = { .sa_handler = NULL, .sa_sigaction = arch_sigFunc, .sa_mask = smask, .sa_flags = SA_SIGINFO, .sa_restorer = NULL, }; if (sigaction(SIGALRM, &sa, NULL) == -1) { PLOG_E("sigaction(SIGALRM) failed"); return false; } return true; } static void arch_checkTimeLimit(honggfuzz_t * hfuzz, fuzzer_t * fuzzer) { int64_t curMillis = util_timeNowMillis(); int64_t diffMillis = curMillis - fuzzer->timeStartedMillis; if (diffMillis > (hfuzz->tmOut * 1000)) { LOG_W("PID %d took too much time (limit %ld s). Sending SIGKILL", fuzzer->pid, hfuzz->tmOut); kill(fuzzer->pid, SIGKILL); __sync_fetch_and_add(&hfuzz->timeoutedCnt, 1UL); } }
bool arch_launchChild(honggfuzz_t * hfuzz, char *fileName) { #define ARGS_MAX 512 char *args[ARGS_MAX + 2]; char argData[PATH_MAX] = { 0 }; int x; for (x = 0; x < ARGS_MAX && hfuzz->cmdline[x]; x++) { if (!hfuzz->fuzzStdin && strcmp(hfuzz->cmdline[x], _HF_FILE_PLACEHOLDER) == 0) { args[x] = fileName; } else if (!hfuzz->fuzzStdin && strstr(hfuzz->cmdline[x], _HF_FILE_PLACEHOLDER)) { const char *off = strstr(hfuzz->cmdline[x], _HF_FILE_PLACEHOLDER); snprintf(argData, PATH_MAX, "%.*s%s", (int)(off - hfuzz->cmdline[x]), hfuzz->cmdline[x], fileName); args[x] = argData; } else { args[x] = hfuzz->cmdline[x]; } } args[x++] = NULL; LOG_D("Launching '%s' on file '%s'", args[0], fileName); /* * Set timeout (prof), real timeout (2*prof), and rlimit_cpu (2*prof) */ if (hfuzz->tmOut) { struct itimerval it; /* * The hfuzz->tmOut is real CPU usage time... */ it.it_value.tv_sec = hfuzz->tmOut; it.it_value.tv_usec = 0; it.it_interval.tv_sec = 0; it.it_interval.tv_usec = 0; if (setitimer(ITIMER_PROF, &it, NULL) == -1) { PLOG_E("Couldn't set the ITIMER_PROF timer"); return false; } /* * ...so, if a process sleeps, this one should * trigger a signal... */ it.it_value.tv_sec = hfuzz->tmOut * 2UL; it.it_value.tv_usec = 0; it.it_interval.tv_sec = 0; it.it_interval.tv_usec = 0; if (setitimer(ITIMER_REAL, &it, NULL) == -1) { PLOG_E("Couldn't set the ITIMER_REAL timer"); return false; } /* * ..if a process sleeps and catches SIGPROF/SIGALRM * rlimits won't help either */ struct rlimit rl; rl.rlim_cur = hfuzz->tmOut * 2; rl.rlim_max = hfuzz->tmOut * 2; if (setrlimit(RLIMIT_CPU, &rl) == -1) { PLOG_E("Couldn't enforce the RLIMIT_CPU resource limit"); return false; } } /* * The address space limit. If big enough - roughly the size of RAM used */ if (hfuzz->asLimit) { struct rlimit rl; rl.rlim_cur = hfuzz->asLimit * 1024UL * 1024UL; rl.rlim_max = hfuzz->asLimit * 1024UL * 1024UL; if (setrlimit(RLIMIT_AS, &rl) == -1) { PLOG_D("Couldn't enforce the RLIMIT_AS resource limit, ignoring"); } } if (hfuzz->nullifyStdio) { util_nullifyStdio(); } if (hfuzz->fuzzStdin) { /* * Uglyyyyyy ;) */ if (!util_redirectStdin(fileName)) { return false; } } for (size_t i = 0; i < ARRAYSIZE(hfuzz->envs) && hfuzz->envs[i]; i++) { putenv(hfuzz->envs[i]); } execvp(args[0], args); util_recoverStdio(); LOG_F("Failed to create new '%s' process", args[0]); return false; }
bool arch_launchChild(honggfuzz_t * hfuzz, char *fileName) { if (!arch_enablePtrace(hfuzz)) { return false; } #ifdef __linux__ #include <sys/prctl.h> #include <sys/personality.h> /* * Kill a process (with ABRT) which corrupts its own heap */ if (setenv("MALLOC_CHECK_", "3", 1) == -1) { LOGMSG_P(l_ERROR, "setenv(MALLOC_CHECK_=3) failed"); return false; } /* * Kill the children when fuzzer dies (e.g. due to Ctrl+C) */ if (prctl(PR_SET_PDEATHSIG, (long)SIGKILL, 0L, 0L, 0L) == -1) { LOGMSG_P(l_ERROR, "prctl(PR_SET_PDEATHSIG, SIGKILL) failed"); return false; } /* * Disable ASLR */ if (personality(ADDR_NO_RANDOMIZE) == -1) { LOGMSG_P(l_ERROR, "personality(ADDR_NO_RANDOMIZE) failed"); return false; } #endif /* __linux__ */ #define ARGS_MAX 512 char *args[ARGS_MAX + 2]; int x; char *pCurArg = NULL; char argData[PATH_MAX] = { 0 }; for (x = 0; x < ARGS_MAX && hfuzz->cmdline[x]; x++) { pCurArg = hfuzz->cmdline[x]; if (!hfuzz->fuzzStdin && strcmp(pCurArg, FILE_PLACEHOLDER) == 0) { args[x] = fileName; } else if (!hfuzz->fuzzStdin && strstr(pCurArg, CON_FILE_PLACEHOLDER) != NULL) { const char *off = strstr(hfuzz->cmdline[x], CON_FILE_PLACEHOLDER); snprintf(argData, PATH_MAX, "%.*s=%s", (off - pCurArg), pCurArg, fileName); args[x] = argData; } else { args[x] = hfuzz->cmdline[x]; } } args[x++] = NULL; LOGMSG(l_DEBUG, "Launching '%s' on file '%s'", args[0], fileName); /* * Set timeout (prof), real timeout (2*prof), and rlimit_cpu (2*prof) */ if (hfuzz->tmOut) { struct itimerval it; /* * The hfuzz->tmOut is real CPU usage time... */ it.it_value.tv_sec = hfuzz->tmOut; it.it_value.tv_usec = 0; it.it_interval.tv_sec = 0; it.it_interval.tv_usec = 0; if (setitimer(ITIMER_PROF, &it, NULL) == -1) { LOGMSG_P(l_ERROR, "Couldn't set the ITIMER_PROF timer"); return false; } /* * ...so, if a process sleeps, this one should * trigger a signal... */ it.it_value.tv_sec = hfuzz->tmOut * 2UL; it.it_value.tv_usec = 0; it.it_interval.tv_sec = 0; it.it_interval.tv_usec = 0; if (setitimer(ITIMER_REAL, &it, NULL) == -1) { LOGMSG_P(l_ERROR, "Couldn't set the ITIMER_REAL timer"); return false; } /* * ..if a process sleeps and catches SIGPROF/SIGALRM * rlimits won't help either */ struct rlimit rl; rl.rlim_cur = hfuzz->tmOut * 2; rl.rlim_max = hfuzz->tmOut * 2; if (setrlimit(RLIMIT_CPU, &rl) == -1) { LOGMSG_P(l_ERROR, "Couldn't enforce the RLIMIT_CPU resource limit"); return false; } } /* * The address space limit. If big enough - roughly the size of RAM used */ if (hfuzz->asLimit) { struct rlimit rl; rl.rlim_cur = hfuzz->asLimit * 1024UL * 1024UL; rl.rlim_max = hfuzz->asLimit * 1024UL * 1024UL; if (setrlimit(RLIMIT_AS, &rl) == -1) { LOGMSG_P(l_DEBUG, "Couldn't encforce the RLIMIT_AS resource limit, ignoring"); } } if (hfuzz->nullifyStdio) { util_nullifyStdio(); } if (hfuzz->fuzzStdin) { /* Uglyyyyyy ;) */ if (!util_redirectStdin(fileName)) { return false; } } execvp(args[0], args); util_recoverStdio(); LOGMSG(l_FATAL, "Failed to create new '%s' process", args[0]); return false; }