The original c intepreter was fuzzed wi

I should investigage fuzzing. about go.vm HOT 2 CLOSED

skx commented on July 23, 2024

I should investigage fuzzing.

from go.vm.

Comments (2)

skx commented on July 23, 2024

Fuzzing was simple to add via go-fuzz. Just create fuzz/fuzz.go:

   // +build gofuzz
   
   package fuzz
   
   import (
   	"github.com/skx/go.vm/cpu"
   )
   
   func Fuzz(data []byte) int {
   	c := cpu.NewCPU()
   	c.LoadBytes(data)
   	c.Run()
   	return 0
   }

Unfortunately that was too simple!

   $ go get github.com/dvyukov/go-fuzz/go-fuzz
   $ go get github.com/dvyukov/go-fuzz/go-fuzz-build
   $ go-fuzz-build github.com/skx/go.vm/fuzz
   $ go-fuzz -bin=fuzz-fuzz.zip -workdir=workdir

Immediately 100+ "crashes" were detected:

     frodo ~/go/src/github.com/skx/go.vm/workdir/crashers $ ../../go.vm execute 8efd86fb78a56a5145ed7739dcb00c78581c5375
     Loading file: 8efd86fb78a56a5145ed7739dcb00c78581c5375
     Unrecognized/Unimplemented opcode 74 at IP 0000

So to fuzz properly we need to remove all unrecognized handlers. As a quick hack I removed the default handler from cpu/cpu.go:

   index fc3c0e5..2af7d2d 100644
   --- a/cpu/cpu.go
   +++ b/cpu/cpu.go
   @@ -681,9 +681,9 @@ func (c *CPU) Run() {
                           if fn != nil {
                                   fn(c, num)
                           }
   -               default:
   -                       fmt.Printf("Unrecognized/Unimplemented opcode %02X at IP %04X\n", op.Value(),        c.ip)
   -                       os.Exit(1)
   +                       //              default:
   +                       //                      fmt.Printf("Unrecognized/Unimplemented opcode %02X at IP        %04X\n", op.Value(), c.ip)
   +                       //                      os.Exit(1)
                   }

                   // Ensure our instruction-pointer wraps around.

With that done no immediate crashes, but of course they will come. I expect to see failures if a fuzzer tries to store an int into a register outside the correct bounds, etc.

from go.vm.

skx commented on July 23, 2024

I think I've documented this enough now to close, invalid-traps, etc will cause termination. Patching the os.Exit( calls to allow fuzzing to continue is a trivial operation...

from go.vm.

Related Issues (8)

Recommend Projects