diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index 4154b2721179..426aad99b456 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -5064,6 +5064,12 @@ githubId = 3269878; name = "Miguel Madrid Mencía"; }; + mindavi = { + email = "rol3517@gmail.com"; + github = "Mindavi"; + githubId = 9799623; + name = "Rick van Schijndel"; + }; minijackson = { email = "minijackson@riseup.net"; github = "minijackson"; diff --git a/pkgs/tools/security/aflplusplus/default.nix b/pkgs/tools/security/aflplusplus/default.nix index a52ea88950c0..f99be6d75758 100644 --- a/pkgs/tools/security/aflplusplus/default.nix +++ b/pkgs/tools/security/aflplusplus/default.nix @@ -1,6 +1,6 @@ -{ stdenv, fetchFromGitHub, callPackage, makeWrapper -, clang, llvm, gcc, which, libcgroup, python, perl, gmp -, wine ? null +{ stdenv, stdenvNoCC, fetchFromGitHub, callPackage, makeWrapper +, clang_9, llvm_9, gcc, which, libcgroup, python, perl, gmp +, file, cmocka, wine ? null, fetchpatch }: # wine fuzzing is only known to work for win32 binaries, and using a mixture of @@ -15,24 +15,52 @@ let else throw "aflplusplus: no support for ${stdenv.targetPlatform.system}!"; libdislocator = callPackage ./libdislocator.nix { inherit aflplusplus; }; libtokencap = callPackage ./libtokencap.nix { inherit aflplusplus; }; - aflplusplus = stdenv.mkDerivation rec { + aflplusplus = stdenvNoCC.mkDerivation rec { pname = "aflplusplus"; - version = "2.59c"; + version = "2.64c"; src = fetchFromGitHub { - owner = "vanhauser-thc"; + owner = "AFLplusplus"; repo = "AFLplusplus"; rev = version; - sha256 = "1ik33ifk4n96762iv1h4kl4jf9yvsq2hgs097wkiy589siw44g5r"; + sha256 = "0n618pk6nlmkcbv1qm05fny4mnhcprrw0ppmra1phvk1y22iildj"; }; enableParallelBuilding = true; + # build of unsigaction32 broken in 2.64c: + # https://github.com/AFLplusplus/AFLplusplus/commit/079fdbf9bc5be1adba19e4bd08be965bd4dd79dc#commitcomment-38428357 + # The applied patch fixes it. + patches = [ + (fetchpatch { + url = "https://github.com/AFLplusplus/AFLplusplus/commit/5b9928f1a9d4b017ea04365ca8b522fde71236eb.patch"; + sha256 = "1m4w9w4jaxb2mjkwvr6r4qa2j5cdzzpchjphpwd95861h0zvb6hh"; + }) + ]; + # Note: libcgroup isn't needed for building, just for the afl-cgroup # script. - nativeBuildInputs = [ makeWrapper which ]; - buildInputs = [ llvm python gmp ] + nativeBuildInputs = [ makeWrapper which clang_9 gcc ]; + buildInputs = [ llvm_9 python gmp ] ++ stdenv.lib.optional (wine != null) python.pkgs.wrapPython; + + postPatch = '' + # Replace the CLANG_BIN variables with the correct path + substituteInPlace llvm_mode/afl-clang-fast.c \ + --replace "CLANGPP_BIN" '"${clang_9}/bin/clang++"' \ + --replace "CLANG_BIN" '"${clang_9}/bin/clang"' \ + --replace 'getenv("AFL_PATH")' "(getenv(\"AFL_PATH\") ? getenv(\"AFL_PATH\") : \"$out/lib/afl\")" + + # Replace "gcc" and friends with full paths in afl-gcc + # Prevents afl-gcc picking up any (possibly incorrect) gcc from the path + substituteInPlace src/afl-gcc.c \ + --replace '"gcc"' '"${gcc}/bin/gcc"' \ + --replace '"g++"' '"${gcc}/bin/g++"' \ + --replace '"gcj"' '"gcj-UNSUPPORTED"' \ + --replace '"clang"' '"clang-UNSUPPORTED"' \ + --replace '"clang++"' '"clang++-UNSUPPORTED"' + ''; + makeFlags = [ "PREFIX=$(out)" ]; buildPhase = '' common="$makeFlags -j$NIX_BUILD_CORES" @@ -45,6 +73,9 @@ let ''; postInstall = '' + # remove afl-clang(++) which are just symlinks to afl-clang-fast + rm $out/bin/afl-clang $out/bin/afl-clang++ + # the makefile neglects to install unsigaction cp qemu_mode/unsigaction/unsigaction*.so $out/lib/afl/ @@ -61,36 +92,15 @@ let cp ${libtokencap}/bin/get-libtokencap-so $out/bin/ # Install the cgroups wrapper for asan-based fuzzing. - cp experimental/asan_cgroups/limit_memory.sh $out/bin/afl-cgroup + cp examples/asan_cgroups/limit_memory.sh $out/bin/afl-cgroup chmod +x $out/bin/afl-cgroup substituteInPlace $out/bin/afl-cgroup \ --replace "cgcreate" "${libcgroup}/bin/cgcreate" \ --replace "cgexec" "${libcgroup}/bin/cgexec" \ --replace "cgdelete" "${libcgroup}/bin/cgdelete" - # Patch shebangs before wrapping patchShebangs $out/bin - # Wrap afl-clang-fast(++) with a *different* AFL_PATH, because it - # has totally different semantics in that case(?) - and also set a - # proper AFL_CC and AFL_CXX so we don't pick up the wrong one out - # of $PATH. - # first though we need to replace the afl-clang-fast++ symlink with - # a real copy to prevent wrapProgram skipping the symlink and confusing - # nix's cc wrapper - rm $out/bin/afl-clang-fast++ - cp $out/bin/afl-clang-fast $out/bin/afl-clang-fast++ - for x in $out/bin/afl-clang-fast $out/bin/afl-clang-fast++; do - wrapProgram $x \ - --set-default AFL_PATH "$out/lib/afl" \ - --run 'export AFL_CC=''${AFL_CC:-${clang}/bin/clang} AFL_CXX=''${AFL_CXX:-${clang}/bin/clang++}' - done - # do similar for afl-gcc and afl-gcc-fast - for x in $out/bin/afl-gcc $out/bin/afl-gcc-fast; do - wrapProgram $x \ - --set-default AFL_PATH "$out/lib/afl" \ - --run 'export AFL_CC=''${AFL_CC:-${gcc}/bin/gcc} AFL_CXX=''${AFL_CXX:-${gcc}/bin/g++}' - done '' + stdenv.lib.optionalString (wine != null) '' substitute afl-wine-trace $out/bin/afl-wine-trace \ --replace "qemu_mode/unsigaction" "$out/lib/afl" @@ -105,17 +115,15 @@ let wrapPythonProgramsIn $out/bin ${python.pkgs.pefile} ''; - installCheckInputs = [ perl ]; + installCheckInputs = [ perl file cmocka ]; doInstallCheck = true; installCheckPhase = '' # replace references to tools in build directory with references to installed locations substituteInPlace test/test.sh \ - --replace '`which gcc`' "" \ --replace '../libcompcov.so' '`$out/bin/get-afl-qemu-libcompcov-so`' \ --replace '../libdislocator.so' '`$out/bin/get-libdislocator-so`' \ --replace '../libtokencap.so' '`$out/bin/get-libtokencap-so`' - perl -pi -e 's|(?<=\s)gcc(?=\s)|${gcc}/bin/gcc|g' test/test.sh - perl -pi -e 's|(\.\./)(\S+?)(? all.patch '';