Apply american fuzzy lop as a part of Travis CI?

Question

I would like to run american fuzzy lop as a part of Travis CI run. How can I do that?

Gangue

Here is the quickstart guide in case it helps answering the question: lcamtuf.coredump.cx/afl/QuickStartGuide.txt - with AFL_EXIT_WHEN_DONE=1 exported, afl runs can be automated. – Gangue

What about Travis CI time limits? AFL execution can take a lot of time... – Zoospore

There's no way around that, which is why you need a different model: either add a timeout using timeout command or push the AFL output directory to your repo and see if any changes happened. You can also replace cycles_wo_finds > 20 from 20 to a smaller number here: github.com/d33tah/afl-fuzz-releases/blob/… – Gangue

Answer 1

Here are my attempts - I managed to run AFL this way:

https://github.com/d33tah/travis-test-c-app

.travis.yml

language: c
install: wget "http://lcamtuf.coredump.cx/afl/releases/afl-1.88b.tgz" -O- | tar zxf - ; pushd . ; cd afl-*; make PREFIX=/tmp/afl install; echo core | sudo tee /proc/sys/kernel/core_pattern; popd

Makefile

CC=/tmp/afl/bin/afl-gcc
all: app
test: app
    ./perform_fuzzing

perform_fuzzing

#!/bin/bash
AFL_EXIT_WHEN_DONE=1 /tmp/afl/bin/afl-fuzz -i i -o o ./app >/dev/null
cat o/fuzzer_stats

configure

#!/bin/sh
true

app.c

int main() {
    if (getchar() == '1')
        abort();
    return 0;
}

Note:

As user cubuspl42 pointed out in his comment to this question, Travis CI has time limitations though. This means that you might want to push the output directory to Git and run AFL in resume mode instead. You might also want to wrap the command with timeout program and/or replace cycles_wo_finds > 20 with a smaller number in this line (and possibly some others in the future).

Gangue