{"action":"created","issue":{"url":"https://api.github.com/repos/ocaml/ocaml/issues/504","repository_url":"https://api.github.com/repos/ocaml/ocaml","labels_url":"https://api.github.com/repos/ocaml/ocaml/issues/504/labels{/name}","comments_url":"https://api.github.com/repos/ocaml/ocaml/issues/504/comments","events_url":"https://api.github.com/repos/ocaml/ocaml/issues/504/events","html_url":"https://github.com/ocaml/ocaml/pull/504","id":140189631,"number":504,"title":"Instrumentation for american fuzzy lop (afl-fuzz)","user":{"login":"stedolan","id":79765,"avatar_url":"https://avatars.githubusercontent.com/u/79765?v=3","gravatar_id":"","url":"https://api.github.com/users/stedolan","html_url":"https://github.com/stedolan","followers_url":"https://api.github.com/users/stedolan/followers","following_url":"https://api.github.com/users/stedolan/following{/other_user}","gists_url":"https://api.github.com/users/stedolan/gists{/gist_id}","starred_url":"https://api.github.com/users/stedolan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stedolan/subscriptions","organizations_url":"https://api.github.com/users/stedolan/orgs","repos_url":"https://api.github.com/users/stedolan/repos","events_url":"https://api.github.com/users/stedolan/events{/privacy}","received_events_url":"https://api.github.com/users/stedolan/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ocaml/ocaml/labels/caml-weekly-news","name":"caml-weekly-news","color":"c7def8"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":19,"created_at":"2016-03-11T13:56:16Z","updated_at":"2016-10-19T19:47:07Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/ocaml/ocaml/pulls/504","html_url":"https://github.com/ocaml/ocaml/pull/504","diff_url":"https://github.com/ocaml/ocaml/pull/504.diff","patch_url":"https://github.com/ocaml/ocaml/pull/504.patch"},"body":"[american fuzzy lop](http://lcamtuf.coredump.cx/afl/) is a fuzzer that very effectively finds bugs by instrumenting programs, observing which execution paths test cases trigger, and permuting test cases to find more interesting execution paths. It's found bugs in [many, many](http://lcamtuf.coredump.cx/afl/#bugs) pieces of software.\r\n\r\nThis patch adds support to `ocamlopt` for generating `afl-fuzz` compatible instrumentation, as well as minimal runtime support to communicate with the fuzzer. An [earlier version](https://github.com/stedolan/ocaml/commits/fuzzing) of this patch has already found a couple of minor bugs in the OCaml compiler (see tag \"afl\" on mantis).\r\n\r\nThe changes are:\r\n\r\n - Add an option `-afl-instrument` to `ocamlopt`, which enables instrumentation (as well as the more advanced `-afl-inst-ratio` for controlling generation)\r\n\r\n- Add a configure option `-afl-instrument` to enable instrumentation for all binaries built (useful for installing as an opam switch to fuzz large pieces of software)\r\n\r\n- When running under `afl-fuzz`, programs which die with `caml_fatal_error` or uncaught exceptions call `abort()` rather than `exit(2)`\r\n\r\nThe inner workings of afl's instrumentation are described [here](http://lcamtuf.coredump.cx/afl/technical_details.txt). In short, `afl-fuzz` sets up a shared memory segment which is mapped by the instrumented binary (code living in `asmrun/afl.c`). The instrumented binary repeatedly forks and runs using input that afl-fuzz generates. Every time a conditional branch is taken, the fact is logged in the shared memory segment by a short piece of code inserted at the start of each branch target (code living in `cmmgen.ml`).\r\n\r\n\r\nFor an example of usage, compile [this file](https://gist.github.com/stedolan/a51d6a5c013c18eac55a) with `-afl-instrument`, and fuzz with afl:\r\n\r\n    mkdir input\r\n    echo asdf > input/testcase\r\n    mkdir output\r\n    afl-fuzz -i input -o output ./readline\r\n\r\nBy inspecting instrumentation output, the fuzzer finds the crashing input in a couple of minutes."},"comment":{"url":"https://api.github.com/repos/ocaml/ocaml/issues/comments/254920342","html_url":"https://github.com/ocaml/ocaml/pull/504#issuecomment-254920342","issue_url":"https://api.github.com/repos/ocaml/ocaml/issues/504","id":254920342,"user":{"login":"gasche","id":426238,"avatar_url":"https://avatars.githubusercontent.com/u/426238?v=3","gravatar_id":"","url":"https://api.github.com/users/gasche","html_url":"https://github.com/gasche","followers_url":"https://api.github.com/users/gasche/followers","following_url":"https://api.github.com/users/gasche/following{/other_user}","gists_url":"https://api.github.com/users/gasche/gists{/gist_id}","starred_url":"https://api.github.com/users/gasche/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gasche/subscriptions","organizations_url":"https://api.github.com/users/gasche/orgs","repos_url":"https://api.github.com/users/gasche/repos","events_url":"https://api.github.com/users/gasche/events{/privacy}","received_events_url":"https://api.github.com/users/gasche/received_events","type":"User","site_admin":false},"created_at":"2016-10-19T19:47:07Z","updated_at":"2016-10-19T19:47:07Z","body":"(The indecision around this minor question left in the air of whether to have a configuration flag for a default setting is the only thing that makes me not click the \"Merge pull request\" button right now. If someone else could bring some decision power of the form \"I would (strongly) prefer if did it <this> way\", it could help resolve the indecision.)"}}
{"actor":{"display_login":"gasche"}}