LyleMi / LyleMi/aflnw

网络服务挂掉之后,afl没有检测到崩溃,依然继续执行fuzz

Open
#1 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
47
Forks
10
PR merge metrics
No merged PRs in 30d

Description

您这里的代码很明朗,如果无法建立tcp连接,则程序crash。
````
int ret = connect(
server_fd, (const struct sockaddr *)&server_listen_addr,
sizeof(struct sockaddr)
);
printf("send ret %d\n", ret);
if (ret < 0)
{
crash();
}
````

但是我在测试过程中,发现只有系统崩溃时才会停止,如果服务挂掉(端口挂),fuzz依然继续.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing the connect() failure path shown in the issue and how crash() signals AFL when the network service is unavailable. Reproduce the case where the service port is down, then compare it with a system crash. Done means AFL detects the service failure and stops fuzzing instead of continuing.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking, testing-qa
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.