-
Notifications
You must be signed in to change notification settings - Fork 77
Description
I have been able to generate a harness for the samples\toy_example, which looks similar to the harness in the example. However, in addition to the issues pointed out in #56, the generated harness is not compilable, and does not quite make sense (to me). The relevant part of the code is follows:
typedef __int64 (__cdecl *test_func_t)(void *);
void fuzz_me(char* filename){
test_func_t test_func;
/* Harness function #0 */
void c0_a0 = 0x4424b0;
LOAD_FUNC(dlllib, test);
__int64 test_ret = test_func(&c0_a0);
dbg_printf("test, ret = %d\n", test_ret);
}
It is apparent from the signature that the test method accepts a void pointer, which should point to a valid/allocated/initialized buffer (bag of bytes). During invocation, the harness tries to set c0_a0 to the integer 0x4424b0, which the compiler refuses to compile. I can cast (hand-fix) it as follows: void* c0_a0 = (void*) 0x4424b0;, which shuts up the compiler. However, in that case, we end up passing an uninitialized pointer, which, I believe, not what we would like to do. Any insights would be appreciated.