CVE-2019-6455.sh

#!/bin/bash
PUT="CVE-2019-6455"
runmode=$1
timeout=$2
targets=$3

# Checkout source code
wget ftp://ftp.gnu.org/gnu/recutils/recutils-1.8.tar.gz;
tar xvzf recutils-1.8.tar.gz; mv recutils-1.8 $PUT; rm recutils-1.8.tar.gz
cd $PUT; export SUBJECT=$PWD;

# Compile source code
rm -rf obj; mkdir obj; cd obj
CFLAGS="-g -m32" CXXFLAGS="-g -m32" ../configure --disable-shared --prefix=`pwd`
make clean; make
cd $SUBJECT; rm -rf obj-asan; mkdir obj-asan; cd obj-asan
CFLAGS="-g -m32 -fsanitize=address" CXXFLAGS="-g -m32 -fsanitize=address" ../configure --disable-shared --prefix=`pwd`
make clean; make

# Prepare working directories
cd $SUBJECT; rm -rf obj-$runmode; mkdir obj-$runmode; export FUZZ_DIR=$SUBJECT/obj-$runmode; cd $FUZZ_DIR
mkdir in; cp $UAFBENCH_PATH/seeds/$PUT/* in

# Fuzzing
if [ $runmode = "aflqemu" ]; then
	cp $SUBJECT/obj/utils/rec2csv .
	timeout -sHUP ${timeout}m $SCRIPTS/run_afl.py -f $FUZZ_DIR/rec2csv -Q -i $FUZZ_DIR/in -o run -r "$FUZZ_DIR/rec2csv @@" -to $timeout
elif [ $runmode = "aflgo" ]; then
	SECONDS=0
	export AFL_PATH=$HOME/aflgo; export AFLGO=$AFL_PATH
	mkdir temp; export TMP_DIR=$FUZZ_DIR/temp
	export CC=$AFLGO/afl-clang-fast; export CXX=$AFLGO/afl-clang-fast++
	export LDFLAGS=-lpthread
	export ADDITIONAL="-targets=$TMP_DIR/BBtargets.txt -outdir=$TMP_DIR -flto -fuse-ld=gold -Wl,-plugin-opt=save-temps"
	echo $'rec2csv.c:342\nrecutl.c:332\nrecutl.c:246\nrec-parser.c:549\nrec-parser.c:1131\nrec-comment.c:43\nrec-parser.c:612\nrec-rset.c:263\nrec-mset.c:152\ngl_list.h:760\ngl_array_list.c:436\nrec-mset.c:814\nrec-mset.c:905\nrec-rset.c:1031\nrec-comment.c:49' > $TMP_DIR/BBtargets.txt
	CFLAGS="$ADDITIONAL" CXXFLAGS="$ADDITIONAL" ../configure --disable-shared --prefix=`pwd`
	make clean; make
	cat $TMP_DIR/BBnames.txt | rev | cut -d: -f2- | rev | sort | uniq > $TMP_DIR/BBnames2.txt && mv $TMP_DIR/BBnames2.txt $TMP_DIR/BBnames.txt
	cat $TMP_DIR/BBcalls.txt | sort | uniq > $TMP_DIR/BBcalls2.txt && mv $TMP_DIR/BBcalls2.txt $TMP_DIR/BBcalls.txt
	cd $FUZZ_DIR/utils; $AFLGO/scripts/genDistance.sh $SUBJECT $TMP_DIR rec2csv
	cd $FUZZ_DIR; CFLAGS="-distance=$TMP_DIR/distance.cfg.txt" CXXFLAGS="-distance=$TMP_DIR/distance.cfg.txt" ../configure --disable-shared --prefix=`pwd`
	make clean; make
	pp_aflgo_time=$SECONDS; echo "pp_aflgo_time: $pp_aflgo_time (s)."
	timeout -sHUP "${timeout}m" $AFLGO/afl-fuzz -m none -z exp -c 45m -i in -o out $FUZZ_DIR/utils/rec2csv @@
elif [ $1 = "aflgob" ] || [ $1 = "heb" ] || [ $1 = "uafuzz" ]; then
	cp $SUBJECT/obj/utils/rec2csv $PUT; cp $targets .
	$UAFUZZ_PATH/scripts/preprocess.py -f $PUT -v $targets -o $FUZZ_DIR
	$UAFUZZ_PATH/scripts/run_uafuzz.py -f $FUZZ_DIR/$PUT -M fuzz -i $FUZZ_DIR/in -o run -r "$FUZZ_DIR/$PUT @@" -I $runmode -T "$FUZZ_DIR/$PUT.tgt" -to $timeout
fi