eurecom-s3 / symcc

Running the following command I get the following errors (with increased verbosity)

root@39b2dcd3cc08:/cb-multios# /root/.cargo/bin/symcc_fuzzing_helper -v -o /cb-multios/build_afl/challenges/Barcoder/out/ -a Barcoder-S -n symcc -- /cb-multios/build_symcc/challenges/Barcoder/Barcoder
[2023-04-14T01:56:33Z DEBUG symcc_fuzzing_helper] SymCC configuration: SymCC { use_standard_input: true, bitmap: "/cb-multios/build_afl/challenges/Barcoder/out/symcc/bitmap", input_file: "/cb-multios/build_afl/challenges/Barcoder/out/symcc/.cur_input", command: ["/cb-multios/build_symcc/challenges/Barcoder/Barcoder"] }
[2023-04-14T01:56:33Z DEBUG symcc_fuzzing_helper] AFL configuration: AflConfig { show_map: "afl-showmap", target_command: ["--", "/cb-multios/build_afl/challenges/Barcoder/Barcoder"], use_standard_input: true, use_qemu_mode: false, queue: "/cb-multios/build_afl/challenges/Barcoder/out/Barcoder-S/queue" }
[2023-04-14T01:56:33Z INFO  symcc_fuzzing_helper] Running on input /cb-multios/build_afl/challenges/Barcoder/out/Barcoder-S/queue/id:000005,src:000000,time:56,execs:62,op:havoc,rep:4,+cov
[2023-04-14T01:56:33Z DEBUG symcc_fuzzing_helper::symcc] Running SymCC as follows: "timeout" "-k" "5" "90" "/cb-multios/build_symcc/challenges/Barcoder/Barcoder"
[2023-04-14T01:56:35Z DEBUG symcc_fuzzing_helper::symcc] SymCC returned code 0
[2023-04-14T01:56:35Z INFO  symcc_fuzzing_helper] Generated 0 test cases (0 new)
[2023-04-14T01:56:35Z INFO  symcc_fuzzing_helper] Running on input /cb-multios/build_afl/challenges/Barcoder/out/Barcoder-S/queue/id:000075,src:000067,time:40522,execs:36944,op:havoc,rep:16,+cov
[2023-04-14T01:56:35Z DEBUG symcc_fuzzing_helper::symcc] Running SymCC as follows: "timeout" "-k" "5" "90" "/cb-multios/build_symcc/challenges/Barcoder/Barcoder"
[2023-04-14T01:56:37Z DEBUG symcc_fuzzing_helper::symcc] SymCC returned code 0
[2023-04-14T01:56:37Z DEBUG symcc_fuzzing_helper] Processing test case /tmp/.tmpS2FzjJ/output/000021-optimistic
[2023-04-14T01:56:37Z DEBUG symcc_fuzzing_helper::symcc] Running afl-showmap as follows: "afl-showmap" "-t" "5000" "-m" "none" "-b" "-o" "/tmp/.tmpS2FzjJ/testcase_bitmap" "--" "/cb-multios/build_afl/challenges/Barcoder/Barcoder"
[2023-04-14T01:56:37Z DEBUG symcc_fuzzing_helper::symcc] afl-showmap returned exit status: 0
Error: Failed to check whether test case /tmp/.tmpS2FzjJ/output/000021-optimistic is interesting

Caused by:
    0: Failed to read the AFL bitmap that afl-showmap should have generated at /tmp/.tmpS2FzjJ/testcase_bitmap
    1: The file to load the coverage map from has the wrong size (896)

Seems to originate from here:

symcc/util/symcc_fuzzing_helper/src/symcc.rs

Line 65 in c4eacea

"The file to load the coverage map from has the wrong size ({})",

and it looks like it's looking for an output of size 65536 (though I am not familiar with Rust).

Manually running afl-showmap from the example output returns the following:

root@39b2dcd3cc08:/cb-multios# afl-showmap -t 5000 -m none -b -o /tmp/testcase_bitmap -- /cb-multios/build_afl/challenges/Barcoder/Barcoder
afl-showmap++4.00c by Michal Zalewski
[*] Executing '/cb-multios/build_afl/challenges/Barcoder/Barcoder'...
-- Program output begins --
-- Program output ends --

+++ Program timed off +++
[+] Hash of coverage map: a25d811ee0af7a15
[+] Captured 10 tuples (map size 876, highest value 0, total values 0) in '/tmp/testcase_bitmap'.

I've compiled using AFL_USE_ASAN=1 using afl-clang-fast /afl-clang-fast++ to compile, though I also tried afl-clang/afl-clang++ as mentioned in the Fuzzing.txt page. Additionally, from the afl-showmap help page, I tried setting AFL_MAP_SIZE to any number, but it doesn't seem to change the resulting map size.

Any thoughts or things that I might be overlooking?

UPDATE

I probably should have looked at Pull Requests :) Obviously I'm using AFL++ which doesn't have explicit support.
Pull request #90 resolves this issue.

afl-showmap generating incorrectly sized map