[Crash-utility] fuzzing crash(8)

[Dave Anderson]

----- "Dave Anderson" <anderson at redhat.com> wrote:

> ----- "Adrien Kunysz" <adk at redhat.com> wrote:
> 
> > Adrien Kunysz wrote:
> > > Actually that patch fixes all the crashes I found with my previous round
> > > of black box fuzzing on x86_64 (using zzuf if anyone is interested).  I
> > > am currently playing with bunny 
> > > (http://code.google.com/p/bunny-the-fuzzer/) but I am a bit doubtful it
> > > will find anything useful in any decent amount of time without some
> > > manual work, oh well CPU time is cheap :)
> >
> > I wasn't expecting Bunny to find anything for a few days but it only took
> > about three hours :)
> >
> > If we take the same x86_64 vmcore again:
> >
> > 00000000  7f 45 4c 46 02 01 01 00  00 00 00 00 00 00 00 00  |.ELF............|
> > 00000010  04 00 3e 00 01 00 00 00  00 00 00 00 00 00 00 00  |..>.............|
> > 00000020  40 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |@...............|
> > 00000030  00 00 00 00 40 00 38 00  03 80 00 00 00 00 00 00  |.... at .8.........|
> >
> > and mess a bit with byte 0x39:
> >
> > 00000000  7f 45 4c 46 02 01 01 00  00 00 00 00 00 00 00 00  |.ELF............|
> > 00000010  04 00 3e 00 01 00 00 00  00 00 00 00 00 00 00 00  |..>.............|
> > 00000020  40 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |@...............|
> > 00000030  00 00 00 00 40 00 38 00  03 00 00 00 00 00 00 00  |.... at .8.........|

You've got the two dumps above backwards, but as it turns out, a manual corruption
of the ELF header's e_phnum field should be pretty easy to handle -- try the attached
patch.

Thanks,
  Dave

-------------- next part --------------
A non-text attachment was scrubbed...
Name: netdump2.patch
Type: text/x-patch
Size: 820 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/crash-utility/attachments/20091203/0dabaef7/attachment.bin>