QuickFuzz

An experimental grammar fuzzer in Haskell using QuickCheck

View project on GitHub

QuickFuzz is a grammar fuzzer powered by QuickCheck, Template Haskell and specific libraries from Hackage to generate many complex file-formats like Jpeg, Png, Svg, Xml, Zip, Tar and more!. QuickFuzz is open-source (GPL3) and it can use other bug detection tools like zzuf, radamsa, honggfuzz and valgrind.

News

  • Our intern, Franco Costantini improved a lot the generation of random source code enforcing variable coherence. This feature is enabled in Javascript, Lua, Python and Bash, but it can easily extended for other languages.
  • QuickFuzz is now included in Gentoo!
  • An academic article on QuickFuzz will be presented at the Haskell Symposium 2016 (preprint)!

Bugs lost and found

Quick introduction to QuickFuzz

To generate corrupted gifs to test giffix using QuickFuzz and zzuf:

$ QuickFuzz Gif "/usr/bin/giffix @@" -a zzuf -t 25 -s 10
*** Error in `/usr/bin/giffix': double free or corruption (out): 0x0000000000b44f80 ***
zzuf[s=-1193471787,r=0.004:1e-06]: signal 6 (SIGABRT)
*** Error in `/usr/bin/giffix': free(): invalid pointer: 0x0000000002565f80 ***
zzuf[s=1436598283,r=0.004:1e-06]: signal 6 (SIGABRT)
zzuf[s=88548751,r=0.004:1e-06]: signal 11 (SIGSEGV)
+++ OK, passed 25 tests.

It looks like we re-discovered several files to trigger CVE-2015-7555 in a few seconds! QuickFuzz can also print the structure of the generated file that triggered a crash in Haskell syntax. For instance:

GifFile {
         gifHeader = GifHeader {gifVersion = GIF87a, gifScreenDescriptor = LogicalScreenDescriptor {screenWidth = 1, screenHeight = 0, backgroundIndex = 1, hasGlobalMap = True, colorResolution = 0, isColorTableSorted = True, colorTableSize = 1}, gifGlobalMap = }, 
         gifImages = [(Just GraphicControlExtension {gceDisposalMethod = DisposalRestorePrevious, gceUserInputFlag = True, gceTransparentFlag = True, gceDelay = 1, gceTransparentColorIndex = 0},GifImage {imgDescriptor = ImageDescriptor {gDescPixelsFromLeft = 1, gDescPixelsFromTop = 1, gDescImageWidth = 0, gDescImageHeight = 1, gDescHasLocalMap = False, gDescIsInterlaced = False, gDescIsImgDescriptorSorted = False, gDescLocalColorTableSize = 0}, imgLocalPalette = Just , imgLzwRootSize = 0, imgData = ""})], 
         gifLoopingBehaviour = LoopingForever
        }

List of file types to generate

Downloads

Pre-compiled and compressed (bzexe) binaries are available here:

Otherwise QuickFuzz can be easily compiled using stack.

Authors

The QuickFuzz team

Students

  • Franco Costantini
  • Lucas Salvatore

Former Members

Acknowledgements

  • ayberkt and NineFx for the bug reports and pull requests.
  • Sergei Trofimovich for adding QuickFuzz to the official Gentoo repository and porting it to GHC8!
  • Special thanks go to all the developers of the Hackage packages that make it possible for QuickFuzz to generate several complex file-formats.