shinkwhek / microlisp

A lisp interpreter

microlisp's Issues

afl-fuzz: crashes

Just for giggles I put this microlisp through the afl-fuzz fuzzer. Commented out the filetype check to get it to read the generated files. btw, there's a potential "Segmentation fault" in the filetype check as well(!)

After minimizing (afl-tmin) and deduplication (fdupes) reducing 144 "unique" crash code-paths to 39 files; here's the hexdump (no tarballs on github issues) of the found crashers, sorted by filesize:

21.scm <-- empty file
9.scm
00000000  28 3e                                             |(>|
00000002
5.scm
00000000  28 2f                                             |(/|
00000002
4.scm
00000000  28 2b                                             |(+|
00000002
39.scm
00000000  28 3c                                             |(<|
00000002
25.scm
00000000  28 2d                                             |(-|
00000002
14.scm
00000000  28 2a                                             |(*|
00000002
13.scm
00000000  28 3d                                             |(=|
00000002
37.scm
00000000  28 63 64 72                                       |(cdr|
00000004
23.scm
00000000  28 6c 69 73 74                                    |(list|
00000005
86.scm
00000000  28 28 29 29 28 2a                                 |(())(*|
00000006
48.scm
00000000  28 28 29 29 28 3d                                 |(())(=|
00000006
3.scm
00000000  28 28 29 29 28 3c                                 |(())(<|
00000006
22.scm
00000000  28 28 29 29 28 3e                                 |(())(>|
00000006
12.scm
00000000  28 28 29 29 28 2f                                 |(())(/|
00000006
1.scm
00000000  28 64 65 66 69 6e 65                              |(define|
00000007
90.scm
00000000  28 28 28 29 29 29 28 3d                           |((()))(=|
00000008
71.scm
00000000  28 28 28 29 29 29 28 2d                           |((()))(-|
00000008
65.scm
00000000  28 6d 6f 64 20 30 20 30                           |(mod 0 0|
00000008
56.scm
00000000  28 28 29 29 28 6d 6f 64                           |(())(mod|
00000008
102.scm
00000000  28 28 6c 61 6d 62 64 61  20 30 28 2b              |((lambda 0(+|
0000000c
99.scm
00000000  28 28 29 28 29 29 28 64  65 66 69 6e 65           |(()())(define|
0000000d
136.scm
00000000  28 70 72 69 6e 74 27 28  27 28 29 28 3c           |(print'('()(<|
0000000d
33.scm
00000000  28 28 29 28 28 28 28 29  29 29 29 29 28 2d        |(()(((()))))(-|
0000000e
74.scm
00000000  28 70 72 69 6e 74 28 6c  69 73 74 28 70 72 69 6e  |(print(list(prin|
00000010  74                                                |t|
00000011
32.scm
00000000  28 28 64 65 66 69 6e 65  20 30 28 28 29 29 29 29  |((define 0(())))|
00000010  74                                                |t|
00000011
28.scm
00000000  28 64 65 66 69 6e 65 20  30 28 28 28 29 29 29 29  |(define 0((())))|
00000010  6e                                                |n|
00000011
6.scm
00000000  28 70 72 69 6e 74 27 28  27 28 29 28 64 65 66 69  |(print'('()(defi|
00000010  6e 65                                             |ne|
00000012
30.scm
00000000  28 64 65 66 69 6e 65 20  30 28 28 28 28 29 29 29  |(define 0(((()))|
00000010  29 29 6e                                          |))n|
00000013
18.scm
00000000  28 64 65 66 69 6e 65 20  30 28 28 29 28 28 28 29  |(define 0(()((()|
00000010  29 29 29 29 74                                    |))))t|
00000015
112.scm
00000000  28 28 28 28 29 29 28 28  28 28 29 29 28 28 28 28  |(((())(((())((((|
00000010  28 28 29 29 29 29 29 29  28 28 29 29 29 29 29 29  |(())))))(())))))|
00000020  28 2d                                             |(-|
00000022
109.scm
00000000  28 28 28 28 29 29 28 28  28 28 29 29 28 28 28 28  |(((())(((())((((|
00000010  29 29 29 29 29 29 28 28  28 28 29 29 28 28 29 29  |))))))(((())(())|
00000020  29 29 29 29 28 2f                                 |))))(/|
00000026
91.scm
00000000  30 4b 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0K00000000000000|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
*
000000b0  30 30 30 30 30 30 4b 4b  30 30 30 30 30 30 30 30  |000000KK00000000|
000000c0  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
*
00000132
81.scm
00000000  30 78 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0x00000000000000|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
*
00000132
41.scm
00000000  30 4b 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0K00000000000000|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
*
00000132
137.scm
00000000  30 68 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0h00000000000000|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
*
00000132
122.scm
00000000  30 68 30 68 30 30 30 30  30 30 30 30 30 30 30 30  |0h0h000000000000|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
*
00000132
101.scm
00000000  30 6c 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0l00000000000000|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
*
00000132
142.scm
00000000  66 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |f000000000000000|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
*
00000148

Do with it whatever you like, of course. I'm just trying to get acquainted with afl-fuzz. Who knows, maybe I'll send some patches your way as well (no promises).

The first ones seem to be real bugs in the parser when you put in malformed code. The last ones look more like stuffing too much data in some variable-name buffer. There are also 'hangs' found, but I haven't really looked into them if afl-fuzz just happened to figure out an infinite loop in lisp. afl-tmin doesn't really reduce hangs, so they are kid of difficult to eyeball what's happening. Maybe I'll have to try afl-analyze on them.

add GC