llvm dev - Oct 2020 - Question about libFuzzer

Hello, i hope this is the right place to ask. I'm currently working on my
bachelor thesis which compares fuzzing tools.So i used libFuzzer to test some
files (with AdressSanitizer)It found heap buffer overflow. How i understand is
that the input which cause this error, should be written in the crash file.But
my crash file is empty. So does that mean, that libFuzzer found the overflow
without an input or where can i find the input which caused the buffer overflow?
Sincerely Yours 
Wingkin Mak
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.llvm.org/pipermail/llvm-dev/attachments/20201012/7401b6d3/attachment.html>

Hello,

When it found some defect, it should print a line like this:

artifact_prefix='./'; Test unit written to
./crash-b13e8756b13a00cf168300179061fb4b91fefbed
(see: http://llvm.org/docs/LibFuzzer.html)

That file should contain a data caused a crash, you can even try it
out with calling your fuzzer binary ./test
./crash-b13e8756b13a00cf168300179061fb4b91fefbed (using it as an
argument will cause it to run with that input).
The generated file prefix can be other than `crash-`, based on quick
grepping in source:

FuzzerLoop.cpp
132:  DumpCurrentUnit("oom-");
176:void Fuzzer::DumpCurrentUnit(const char *Prefix) {
193:  DumpCurrentUnit("crash-");
238:  DumpCurrentUnit("crash-");
252:  DumpCurrentUnit("crash-");
298:    DumpCurrentUnit("timeout-");
317:  DumpCurrentUnit("oom-");
559:  DumpCurrentUnit("crash-");
693:    DumpCurrentUnit("leak-");

Maybe your unit under test has heap overflow with empty string ?

--
Kokan

On Tue, 13 Oct 2020 at 05:05, Wingkin Mak via llvm-dev
<llvm-dev at lists.llvm.org> wrote:
>
> Hello,
> i hope this is the right place to ask. I'm currently working on my
bachelor thesis which compares fuzzing tools.
> So i used libFuzzer to test some files (with AdressSanitizer)
> It found heap buffer overflow. How i understand is that the input which
cause this error, should be written in the crash file.
> But my crash file is empty. So does that mean, that libFuzzer found the
overflow without an input or where can i find the input which caused the buffer
overflow?
>
> Sincerely Yours
>
> Wingkin Mak
> _______________________________________________
> LLVM Developers mailing list
> llvm-dev at lists.llvm.org
> https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev