"There is no constraint in the seeds" ...

[vanhauser-thc]

# /prg/tmp/Angora/angora_fuzzer -i in -o out-angora -t ./unrar.taint -- ./unrar.fast -inul p @@

 INFO  angora::fuzz_main > CommandOpt { mode: LLVM, id: 0, main: ("./unrar.fast", ["-inul", "p", "@@"]), track: ("./unrar.taint", ["-inul", "p", "@@"]), tmp_dir: "out-angora/tmp", out_file: "out-angora/tmp/cur_input", forksrv_socket_path: "out-angora/tmp/forksrv_socket", track_path: "out-angora/tmp/track", is_stdin: false, search_method: Gd, mem_limit: 200, time_limit: 1, is_raw: true, uses_asan: false, ld_library: "$LD_LIBRARY_PATH:/usr/lib/llvm-7/lib", enable_afl: true, enable_exploitation: true }
 INFO  angora::fuzz_main > DepotDir { inputs_dir: "out-angora/queue", hangs_dir: "out-angora/hangs", crashes_dir: "out-angora/crashes", seeds_dir: "in" }
 INFO  angora::depot::sync > sync       1 file from seeds.
 INFO  angora::bind_cpu    > Found 8 cores.
 INFO  angora::bind_cpu    > Free Cpus: [0, 1, 2, 3, 4, 5, 6, 7]

   ANGORA    (\_/)
   FUZZER    (x'.')
 -- OVERVIEW -- 
[...]
-- STATE -- 
           |    NORMAL:       0d -       0p,   NORMAL_END:       0d -       0p,   ONE_BYTE:       0d -       0p
           |       DET:       0d -       0p,    TIMEOUT:       0d -       0p,     UNSOLVABLE:       0d -       0p


 WARN  angora::fuzz_main   > There is none constraint in the seeds, please ensure the inputs are vaild in the seed directory, or the program is ran correctly, or the read functions have been marked as source.
 INFO  angora::depot::dump > dump constraints and chart..

the in/ directory contains one test.rar file that works fine, also when used with unrar.taint (with lots of ASAN output) and unrar.fast

the command line works fine with afl-fuzz too (afl-fuzz -i in -o out -- ./unrar.afl -inul p @@)

what could be the issue here?

[spinpx]

Hi @vanhauser-thc.

There are two reasons that may cause this issue.

• the seed is more than 15k, we limited the seeds to 15k since we use byte level taint tracking. If the seed is too huge, it will bring much overhead.

• It did not mark the source for taint analysis. Angora adds taint for some read functions, but I can't ensure it will add taints for all read functions.

• The taint is lost while taint propagation.

---

I will dubug it if I have time, but sorry I am busy in some works these days.