Hi Michal!
If you use the persistent mode, afl-fuzz doesn't always kill the target
program on exit:
$ afl-clang-fast -Wall test-instr-persistent.c -o test-instr-persistent
afl-clang-fast 2.28b by <
lsze...@google.com>
afl-llvm-pass 2.28b by <
lsze...@google.com>
[+] Instrumented 10 locations (hardened mode, ratio 100%).
$ mkdir in out && echo moo > in/moo
$ timeout 1 afl-fuzz -i in -o out -- ./test-instr-persistent
afl-fuzz 2.28b by <
lca...@google.com>
...
[+] All set and ready to roll!
+++ Testing aborted by user +++
[+] We're done here. Have a nice day!
$ ps ax | grep '[T] .*test-instr-persistent'
1234 ? T 0:00 ./test-instr-persistent
I believe this is how it happens:
afl-llvm-rt.o.c:192: The target program stops itself with SIGSTOP.
afl-llvm-rt.o.c:156: The forkserver finishes wait()ing and sends the
status to afl-fuzz.
afl-fuzz.c:2395: run_target() reads the status...
afl-fuzz.c:2404: ... and sets child_pid to 0.
SIGTERM arrives.
afl-fuzz.c:2404: handle_stop_sig() kills the fork server, but not the
target program. Oops!
This was originally reported by Daniel Stender:
https://bugs.debian.org/833675
--
Jakub Wilk