Battelle / afl-unicorn

afl-unicorn lets you fuzz any piece of binary that can be emulated by Unicorn Engine.

Home Page:https://medium.com/@njvoss299/afl-unicorn-fuzzing-arbitrary-binary-code-563ca28936bf

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Add use-after-free and double-free detection to UnicornSimpleHeap

njv299 opened this issue · comments

Detecting these two other bugs would be pretty simple:

  • Double free: Store all free'd addresses. If the same one occurs twice (without a call to malloc() allocating a buffer at that address first), report a double free
  • Use after free: Keep track of free'd heap buffer regions. If any memory access falls within one of those regions report a UAF