Trophies: new bugs found with SharpFuzz + AFL++

[pawlos]

Hi! I've been using SharpFuzz + AFL++ to fuzz .NET libraries and found some bugs across different libraries. Would love to get these added to the Trophies section.

• ConfigurationManager NullReferenceException when sectionGroup name contains "/"

• MimeKit ParseUtils.TryParseDomain throws IndexOutOfRangeException fixed

• MetadataExtractor Mp3Reader throws IndexOutOfRangeException in SetBitrate and frequencyMapping

• PdfPig PdfTokenScanner.TryReadStream throws IndexOutOfRangeException

• SharpCompress Multiple decompressors crash on malformed input (9 crash sites across LZW, BZip2, Squeeze, ArcLZW)

• SharpYaml StackOverflowException via deeply nested flow sequences/mappings fixed

• SharpZipLib BZip2InputStream crashes on malformed input (4 IOOB, 1 NullRef)

• SixLabors.Fonts Format4SubTable.TryGetGlyphId throws IndexOutOfRangeException fixed

• SixLabors.Fonts CreateCffGlyphMetrics throws NullReferenceException fixed (multiple crashes)

• SixLabors.Fonts LookupType2Format1SubTable.TryUpdatePosition throws IndexOutOfRangeException

• SixLabors.ImageSharp BmpDecoderCore.ReadRgbPalette throws DivideByZeroException fixed

• SixLabors.ImageSharp JpegDecoderCore.ParseStream throws NullReferenceException fixed

• SixLabors.ImageSharp BmpDecoderCore.ReadImageHeaders throws OutOfMemoryException fixed

• SixLabors.ImageSharp PngPhysical.Parse throws IndexOutOfRangeException fixed

• SixLabors.ImageSharp ReadCompressedTextChunk and ReadInternationalTextChunk throw IndexOutOfRangeException fixed

• SixLabors.ImageSharp AssignColorPalette throws IndexOutOfRangeException fixed

[moodmosaic]

That’s great! Is it with AFL++ or AFL?

[pawlos]

It's afl++

[moodmosaic]

@pawlos, thanks! Is it related to #66? I've been using SharpFuzz successfully with AFL 2.52b. If AFL++ works out of the box that's something we could add to the docs.

[pawlos]

@moodmosaic Not sure if I know enough details (and maybe that's why I was not aware there might be some issues :D) but basically AFAIK it works quite well out of the box.

Two things I needed to do (I've asked Claude) was to use AFL_SKIP_BIN_CHECK=1 and -m none.

First is required so that AFL++ doesn't complain that the dotnet binary itself is not instrumented. The .NET DLL is. And -m none so that AFL++'s default memory limit doesn't crash the runtime.
And as far as I know everything else (fork server, coverage map, parallel fuzzing with -M/-S) works as expected. Running it with afl-fuzz++4.09c + SharpFuzz 2.2.0 on Linux.

[pawlos]

Couple more finds:

• ExcelDataReader - Reading malformed .xls files crashes with NullRef and IOOB

• Jint - Engine.Execute crashes on malformed JavaScript (StackOverflow, IOOB, InvalidCast) fixed

• jose-jwt - JWT.Decode crashes on malformed tokens (NullRef, InvalidCast)

• NCalc - Expression.Evaluate crashes with InvalidCastException on expressions containing ()

• Scriban 6.6.0 - StackOverflowException via deeply nested array initializers bypasses ExpressionDepthLimit. Process crash - GHSA-p6q4-fgr8-vx4p

• SixLabors.Fonts - LookupType2Format1SubTable.TryUpdatePosition throws IndexOutOfRangeException fixed

• SixLabors.ImageSharp.Drawing - ArcLineSegment and GetPolygonOrientation crash on malformed SVG paths

• ZXing.Net - MaxiCodeReader and RGBLuminanceSource throw IndexOutOfRangeException

[moodmosaic]

Awesome!