How to fuzz a libpng

[巴赫哥德尔]

Hello, my friends.

I'm trying to fuzz a former version（libpng-1.6.32） of libpng with afl.

First I compiled the library with: 

CC=/path/to/afl-gcc ./configure --disable-shared && make -j4 

When this is done,I try:

/path/to/afl-gcc ./readpng.c -lm -lz ../../.libs/libpng16.a -o readpng 

And I get this error:

[+] Instrumented 31 locations (64-bit, non-hardened mode, ratio 100%).

../../.libs/libpng16.a(png.o): In function `png_build_16bit_table':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:4023: undefined reference to `pow'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:4023: undefined reference to `floor'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:4023: undefined reference to `pow'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:4023: undefined reference to `floor'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:4023: undefined reference to `pow'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:4023: undefined reference to `floor'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:4023: undefined reference to `pow'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:4023: undefined reference to `floor'

../../.libs/libpng16.a(png.o): In function `png_muldiv':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3372: undefined reference to `floor'

../../.libs/libpng16.a(png.o): In function `png_gamma_8bit_correct':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3899: undefined reference to `pow'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3899: undefined reference to `floor'

../../.libs/libpng16.a(png.o): In function `png_reset_crc':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:130: undefined reference to `crc32'

../../.libs/libpng16.a(png.o): In function `png_calculate_crc':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:173: undefined reference to `crc32'

../../.libs/libpng16.a(png.o): In function `png_muldiv':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3372: undefined reference to `floor'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3372: undefined reference to `floor'

../../.libs/libpng16.a(png.o): In function `png_compare_ICC_profile_with_sRGB':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:2381: undefined reference to `crc32'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:2382: undefined reference to `crc32'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:2368: undefined reference to `adler32'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:2369: undefined reference to `adler32'

../../.libs/libpng16.a(png.o): In function `png_muldiv':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3372: undefined reference to `floor'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3372: undefined reference to `floor'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3372: undefined reference to `floor'

../../.libs/libpng16.a(png.o): In function `png_ascii_from_fp':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3024: undefined reference to `floor'

../../.libs/libpng16.a(png.o): In function `png_fixed':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3324: undefined reference to `floor'

../../.libs/libpng16.a(png.o):/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3372: more undefined references to `floor' follow

../../.libs/libpng16.a(png.o): In function `png_gamma_8bit_correct':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3899: undefined reference to `pow'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3899: undefined reference to `floor'

../../.libs/libpng16.a(png.o): In function `png_gamma_16bit_correct':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3928: undefined reference to `pow'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3928: undefined reference to `floor'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3928: undefined reference to `pow'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3928: undefined reference to `floor'

../../.libs/libpng16.a(png.o): In function `png_gamma_8bit_correct':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3899: undefined reference to `pow'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3899: undefined reference to `floor'

../../.libs/libpng16.a(png.o): In function `png_reciprocal2':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3557: undefined reference to `floor'

../../.libs/libpng16.a(png.o): In function `png_product2':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3532: undefined reference to `floor'

../../.libs/libpng16.a(png.o): In function `png_gamma_16bit_correct':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3928: undefined reference to `pow'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3928: undefined reference to `floor'

../../.libs/libpng16.a(png.o): In function `png_reciprocal2':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3557: undefined reference to `floor'

../../.libs/libpng16.a(png.o): In function `png_reciprocal':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3497: undefined reference to `floor'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3497: undefined reference to `floor'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3497: undefined reference to `floor'

../../.libs/libpng16.a(png.o):/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:3497: more undefined references to `floor' follow

../../.libs/libpng16.a(png.o): In function `png_reset_zstream':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/png.c:986: undefined reference to `inflateReset'

../../.libs/libpng16.a(pngread.o): In function `png_read_destroy':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/pngread.c:979: undefined reference to `inflateEnd'

../../.libs/libpng16.a(pngrtran.o): In function `convert_gamma_value':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/pngrtran.c:264: undefined reference to `floor'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/pngrtran.c:264: undefined reference to `floor'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/pngrtran.c:264: undefined reference to `floor'

../../.libs/libpng16.a(pngrutil.o): In function `png_inflate_claim':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/pngrutil.c:406: undefined reference to `inflateReset2'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/pngrutil.c:415: undefined reference to `inflateInit2_'

../../.libs/libpng16.a(pngrutil.o): In function `png_zlib_inflate':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/pngrutil.c:466: undefined reference to `inflate'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/pngrutil.c:466: undefined reference to `inflate'

../../.libs/libpng16.a(pngrutil.o): In function `png_inflate_claim':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/pngrutil.c:415: undefined reference to `inflateInit2_'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/pngrutil.c:406: undefined reference to `inflateReset2'

../../.libs/libpng16.a(pngrutil.o): In function `png_decompress_chunk':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/pngrutil.c:661: undefined reference to `inflateReset'

../../.libs/libpng16.a(pngrutil.o): In function `png_zlib_inflate':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/pngrutil.c:466: undefined reference to `inflate'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/pngrutil.c:466: undefined reference to `inflate'

../../.libs/libpng16.a(pngwrite.o): In function `png_write_destroy':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/pngwrite.c:945: undefined reference to `deflateEnd'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/pngwrite.c:945: undefined reference to `deflateEnd'

../../.libs/libpng16.a(pngwutil.o): In function `png_deflate_claim':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/pngwutil.c:418: undefined reference to `deflateInit2_'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/pngwutil.c:396: undefined reference to `deflateEnd'

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/pngwutil.c:414: undefined reference to `deflateReset'

../../.libs/libpng16.a(pngwutil.o): In function `png_text_compress':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/pngwutil.c:581: undefined reference to `deflate'

../../.libs/libpng16.a(pngwutil.o): In function `png_compress_IDAT':

/home/wcx/Development/Research/fuzzingApp/libpng-1.6.32/pngwutil.c:982: undefined reference to `deflate'

collect2: error: ld returned 1 exit status

Can anyone help me,Thanks a lot!

[Jakub Wilk]

* 巴赫哥德尔 <w3698...@gmail.com>, 2018-03-05, 20:41:

>/path/to/afl-gcc ./readpng.c -lm -lz ../../.libs/libpng16.a -o readpng

The order of libraries is wrong. Try this:

/path/to/afl-gcc ./readpng.c ../../.libs/libpng16.a -lm -lz -o readpng

--
Jakub Wilk