AFL "(odd, check syntax!) "
I am trying to fuzz pngquant using AFL and noticed that I am seeing the odd, check syntax! warning. A previous answer says that AFL is probably not reading the input file I specified. I am able to invoke pngquant by providing the png file located in the same input sample directory I used while fuzzing with AFL.
The AFL command I executed is:
afl-fuzz -i ./in-filtered -o ./out -x ./dictionary/png.dict -- pngquant @@
The AFL documentation mentions that the odd, check syntax! warning may pop up when AFL is not able to find new paths.
Additionally, I notice that the warning pops up as soon as AFL begins using the havoc fuzzing strategy, the images below show that the cycle counts start incrementing as soon as the fuzzer begins using havoc.
This is because of incorrect usage of pngquant.
When using pngquant, it produces an output file with your results, when you do it twice you will encounter an error:
➜ pngquant git:(master) ✗ ./pngquant ./test/img/metadata.png
➜ pngquant git:(master) ✗ ./pngquant ./test/img/metadata.png
error: './test/img/metadata-fs8.png' exists; not overwriting
AFL has no chance to explore the target, since it gets blocked every time.
After a quick look, the easiest fix is like this:
afl-fuzz -i ./in -o ./out -- ./pngquant -f -- @@
This forces pngquant to overwrite the resultfile and therefore enables afl-fuzz. However, be aware that this produces a lot of IO. So try to circumvent this using /dev/null or similar tricks.
Happy fuzzing!
- Why is the '&' operator needed for an int variable but not for an array in C?
- The `write` syscall in C writes to an unexpected position
- populating an array at compile time in C
- Why does carg(-0) return -pi?
- Why is the initialization of this structure global variable wrong?
- Efficient linked list design for a C file manager
- Function with a malloc on a pointer declared in main()
- structure padding on 64bit machine
- Malloc and memcpy struct plus array
- PInvoke has unbalanced the stack
- fast check if the difference between two int32_t is 1 or 0
- Is there any difference between stating the "alignas" keyword in struct definition VS array of struct definition?
- Is it possible to read a file in parallel by extending this function?
- How to organize the receive msg and user current input in C network such that it's clean
- How to use regular expressions in C
- Is there a cross-platform way to determine if a device is powered via PSU or external battery in C?
- jmp to address in inline AVR C
- How to compile x64 code with Visual Studio in command line?
- Difference between target and target data? How to do teams/threads configurations without teams directive?
- cast without * operator
- Are different translation units allowed to define structures with the same name?
- Not a constant initializer element?
- 2 Functions in 1 main program(Visual Studio 2013)
- Using free with pointer to middle of allocation
- How does C/CPP know how to point to "next" struct node when the struct node is not yet defined?
- why does linker have a tougher task in C++ compared to C?
- Is a 32 bit integer on a 16 bit machine possible?
- g-wan not updating dependencies of servlets
- Compiler circular reference
- Compiling Options in Code Blocks