ziggy 1.7.0

A multi-fuzzer management utility for all of your Rust fuzzing needs 🧑‍🎤
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124

use crate::{Build, Common, util::Context};
use anyhow::{Context as _, Result, bail};
use console::style;
use std::{env, process};

impl Build {
    /// Build the fuzzers
    pub fn build(&self, common: &Common) -> Result<(), anyhow::Error> {
        // No fuzzers for you
        if self.no_afl && self.no_honggfuzz {
            bail!("Pick at least one fuzzer");
        }

        let cx = Context::new(common, self.target.clone())?;

        if !self.no_afl {
            eprintln!("    {} afl", style("Building").red().bold());
            let target_dir = format!("--target-dir={}", cx.target_dir.join("afl"));
            let mut afl_args = vec![
                "afl",
                "build",
                "--features=ziggy/afl",
                &target_dir,
                "--bin",
                &cx.bin_target,
            ];

            // Add the --release argument if self.release is true
            if self.release {
                assert!(!self.asan, "cannot use --release for ASAN builds");
                afl_args.push("--release");
            }

            let mut rust_flags = env::var("RUSTFLAGS").unwrap_or_default();
            let mut rust_doc_flags = env::var("RUSTDOCFLAGS").unwrap_or_default();

            // First fuzzer we build: AFL++
            let run = common
                .cargo()
                .args(&afl_args)
                .env("AFL_QUIET", "1")
                .env("AFL_LLVM_CMPLOG", "1") // for afl.rs feature "plugins"
                .env("RUSTFLAGS", &rust_flags)
                .env("RUSTDOCFLAGS", &rust_doc_flags)
                .spawn()?
                .wait()
                .context("Error spawning afl build command")?;

            if !run.success() {
                bail!("Error building afl fuzzer: Exited with {:?}", run.code());
            }

            let asan_target_str = format!("--target={}", target_triple::TARGET);

            // If ASAN is enabled, build both a sanitized binary and a non-sanitized binary.
            if self.asan {
                eprintln!("    {} afl (ASan)", style("Building").red().bold());
                if env::var("AFL_OPT_LEVEL").is_ok_and(|opt_level| opt_level != "0") {
                    eprintln!("    Warning: ignoring AFL_OPT_LEVEL and setting it to 0");
                }
                afl_args.push(&asan_target_str);
                afl_args.extend(["-Z", "build-std"]);
                rust_flags.push_str(" -Zsanitizer=address ");
                rust_flags.push_str("-Copt-level=0");
                rust_doc_flags.push_str(" -Zsanitizer=address ");

                let run = common
                    .cargo()
                    .args(afl_args)
                    .env("AFL_QUIET", "1")
                    // need to specify for afl.rs so that we build with -Copt-level=0
                    .env("AFL_OPT_LEVEL", "0")
                    .env("AFL_LLVM_CMPLOG", "1") // for afl.rs feature "plugins"
                    .env("RUSTFLAGS", rust_flags)
                    .env("RUSTDOCFLAGS", rust_doc_flags)
                    .spawn()?
                    .wait()
                    .context("Error spawning afl build command")?;

                if !run.success() {
                    bail!("Error building afl fuzzer: Exited with {:?}", run.code());
                }
            }

            eprintln!("    {} afl", style("Finished").cyan().bold());
        }

        if !self.no_honggfuzz {
            assert!(
                !self.asan,
                "Cannot build honggfuzz with ASAN for the moment. use --no-honggfuzz"
            );
            eprintln!("    {} honggfuzz", style("Building").red().bold());

            // Second fuzzer we build: Honggfuzz
            let run = common
                .cargo()
                .args(["hfuzz", "build", "--bin", &cx.bin_target])
                .env("CARGO_TARGET_DIR", cx.target_dir.join("honggfuzz"))
                .env("HFUZZ_BUILD_ARGS", "--features=ziggy/honggfuzz")
                .env("RUSTFLAGS", env::var("RUSTFLAGS").unwrap_or_default())
                .stdout(process::Stdio::piped())
                .spawn()?
                .wait()
                .context("Error spawning hfuzz build command")?;

            if !run.success() {
                bail!(
                    "Error building honggfuzz fuzzer: Exited with {:?}",
                    run.code()
                );
            }

            eprintln!("    {} honggfuzz", style("Finished").cyan().bold());
        }

        assert!(
            std::env::var("AFL_LLVM_CMPGLOG").is_err(),
            "Even the mighty may fall, especially on 77b2c27a59bb858045c4db442989ce8f20c8ee11"
        );

        Ok(())
    }
}