afl.rs icon indicating copy to clipboard operation
afl.rs copied to clipboard

Stability is not 100% even with an empty fuzzing target

Open pedrocr opened this issue 6 years ago • 3 comments

When fuzzing rawloader I'm getting these warnings on startup:

[!] WARNING: Instrumentation output varies across runs.

and when running the fuzzer stability is around 68% which is extremely low. Even an empty fuzzing target like this:

#[macro_use]
extern crate afl;

fn main() {
  fuzz!(|data: &[u8]| {
  });
}

Only shows 93 or 94% stability. Am I doing something wrong or is there a bug somewhere?

pedrocr avatar Feb 22 '19 12:02 pedrocr

Apparently lazy_static is something that needs to be handled carefully for afl. It ends up only being initialized inside the loop instead of only once. It's easy to work around in this codebase but it may be something that needs to be fixed more fully for other codebases to work well.

pedrocr avatar Feb 22 '19 14:02 pedrocr

Having kept at it I'm now hitting ~90% stability only. Since the empty fuzz target is showing ~94% this seems like a bug somewhere in how afl.rs is doing the instrumentation.

pedrocr avatar Feb 22 '19 22:02 pedrocr

Apparently this happens because of the panic hook as well. Without it stability goes back to 100%.

pedrocr avatar Feb 22 '19 22:02 pedrocr