Features/asan sync

.github/workflows/ci.yml

@@ -4,20 +4,20 @@ on:
   push:
   pull_request:
 
-env: 
+env:
   CARGO_TERM_COLOR: always
 
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Cargo sort
         run: cargo install cargo-sort && cargo sort --check
       - name: Format
         run: cargo fmt --check
       - name: Clippy
-        run: cargo clippy --workspace --all-targets -- -D warnings 
+        run: cargo clippy --workspace --all-targets -- -D warnings
   build_and_test:
     name: Rust project - latest
     runs-on: ubuntu-latest
@@ -28,10 +28,11 @@ jobs:
           - beta
           - nightly
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - run: sudo apt-get update
       - run: sudo apt-get install binutils-dev libunwind-dev gnuplot
       - run: rustup update ${{ matrix.toolchain }} && rustup default ${{ matrix.toolchain }}
-      - run: cargo install cargo-afl honggfuzz grcov 
+      - run: rustup component add rust-src
+      - run: cargo install cargo-afl honggfuzz grcov
       - run: cargo install --path . --verbose
-      - run: cargo test --verbose
+      - run: cargo test --verbose -- --show-output

Cargo.toml

@@ -10,11 +10,12 @@ repository = "https://github.com/srlabs/ziggy/"
 members = [
     ".",
     "examples/arbitrary",
+    "examples/asan",
     "examples/url",
 ]
 
 [dependencies]
-afl = { version = "0.15.10", default-features = false, optional = true }
+afl = { version = "0.15.11", default-features = false, optional = true }
 anyhow = { version = "1.0.83", optional = true }
 cargo_metadata = { version = "0.18.1", optional = true }
 clap = { version = "4.5.4", features = ["cargo", "derive", "env"], optional = true }

examples/asan/.gitignore

@@ -0,0 +1,2 @@
+output
+Cargo.lock

examples/asan/Cargo.toml

@@ -0,0 +1,7 @@
+[package]
+name = "asan-fuzz"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+ziggy = { path = "../../", default-features = false }

examples/asan/README.md

@@ -0,0 +1,21 @@
+# Ziggy example - URL
+
+First, install the tooling:
+
+```
+cargo install cargo-afl honggfuzz ziggy
+```
+
+ASAN mode is only available when using Rust Nightly.
+
+To fuzz, run in this directory:
+
+```
+cargo +nightly ziggy fuzz --asan
+```
+
+Note: 
+The the runner must use ``--asan`` too!
+```
+cargo +nightly ziggy run --asan
+```

examples/asan/src/main.rs

@@ -0,0 +1,11 @@
+fn main() {
+    ziggy::fuzz!(|data: &[u8]| {
+        if data.len() < 4 {
+            return;
+        }
+        if data[0] == b'f' && data[1] == b'u' && data[2] == b'z' && data[3] == b'z' {
+            let xs = [0, 1, 2, 3];
+            let _y = unsafe { *xs.as_ptr().offset(4) };
+        }
+    });
+}

src/bin/cargo-ziggy/build.rs

@@ -3,6 +3,11 @@ use anyhow::{anyhow, Context, Result};
 use console::style;
 use std::{env, process};
 
+/// Target for ASAN builds
+/// Note: we need to supply a target due to -Z build-std
+/// Note: we need to use -Z build-std or else many macros cannot be built when using ASAN
+pub const ASAN_TARGET: &str = "x86_64-unknown-linux-gnu";
+
 impl Build {
     /// Build the fuzzers
     pub fn build(&self) -> Result<(), anyhow::Error> {
@@ -26,16 +31,36 @@ impl Build {
 
             // Add the --release argument if self.release is true
             if self.release {
+                assert!(!self.release, "cannot use --release for ASAN builds");
                 afl_args.push("--release");
                 info!("Building in release mode");
             }
 
-            // Second fuzzer we build: AFL++
+            let opt_level = env::var("AFL_OPT_LEVEL").unwrap_or("0".to_string());
+            let mut rust_flags = env::var("RUSTFLAGS").unwrap_or_default();
+            let mut rust_doc_flags = env::var("RUSTDOCFLAGS").unwrap_or_default();
+            let asan_target_str = format!("--target={ASAN_TARGET}");
+            let opt_level_str = format!("-Copt-level={opt_level}");
+
+            if self.asan {
+                info!("Building with ASAN");
+                assert_eq!(opt_level, "0", "AFL_OPT_LEVEL must be 0 for ASAN builds");
+                afl_args.push(&asan_target_str);
+                afl_args.extend(["-Z", "build-std"]);
+                rust_flags.push_str(" -Zsanitizer=address ");
+                rust_flags.push_str(&opt_level_str);
+                rust_doc_flags.push_str(" -Zsanitizer=address ")
+            };
+
+            // First fuzzer we build: AFL++
             let run = process::Command::new(cargo.clone())
                 .args(afl_args)
                 .env("AFL_QUIET", "1")
+                // need to specify for afl.rs so that we build with -Copt-level=0
+                .env("AFL_OPT_LEVEL", opt_level)
                 .env("AFL_LLVM_CMPGLOG", "1") // for afl.rs feature "plugins"
-                .env("RUSTFLAGS", env::var("RUSTFLAGS").unwrap_or_default())
+                .env("RUSTFLAGS", rust_flags)
+                .env("RUSTDOCFLAGS", rust_doc_flags)
                 .spawn()?
                 .wait()
                 .context("Error spawning afl build command")?;
@@ -51,6 +76,10 @@ impl Build {
         }
 
         if !self.no_honggfuzz {
+            assert_eq!(
+                self.no_afl, self.asan,
+                "Cannot build honggfuzz with ASAN for the moment. use --no-honggfuzz"
+            );
             eprintln!("    {} honggfuzz", style("Building").red().bold());
 
             let mut hfuzz_args = vec!["hfuzz", "build"];
@@ -61,7 +90,7 @@ impl Build {
                 info!("Building in release mode");
             }
 
-            // Third fuzzer we build: Honggfuzz
+            // Second fuzzer we build: Honggfuzz
             let run = process::Command::new(cargo)
                 .args(hfuzz_args)
                 .env("CARGO_TARGET_DIR", "./target/honggfuzz")