question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Heartbleed example does not work out of the box.

See original GitHub issue

I was going over the documentation on this page: https://google.github.io/clusterfuzz/setting-up-fuzzing/heartbleed-example/

To do that I first followed the pre-requisites section here: https://google.github.io/clusterfuzz/setting-up-fuzzing/libfuzzer-and-afl/#compiler

That recommends installing clang 6.0 or greater. I installed it via apt and got clang version 6.0.0-1ubuntu2 as output by clang -v

The example handshake-fuzzer.cc does not compile out of the box with that version of clang as I believe it only supports the filesystem extension as experimental feature.

When I try to run the build step from the documentation:

/usr/bin/clang++ -g handshake-fuzzer.cc -fsanitize=address,fuzzer openssl-1.0.1f/libssl.a openssl-1.0.1f/libcrypto.a -std=c++17 -Iopenssl-1.0.1f/include/ -lstdc++fs -ldl -lstdc++ -o handshake-fuzzer

I get this error:

handshake-fuzzer.cc:25:10: fatal error: 'filesystem' file not found
#include <filesystem>
         ^~~~~~~~~~~~
1 error generated.

This can be fixed by changing the include to experimental/filesystem and then changing the using statement below to also include experimental at the right spot - but I imagine that will break the build on later versions of clang (I haven’t tested).

A proper fix likely involves using an API that’s available in clang 6 (though it may be more verbose).

Issue Analytics

  • State:closed
  • Created 5 years ago
  • Comments:5

github_iconTop GitHub Comments

1reaction
oliverchangcommented, Feb 14, 2019

Maybe we can just use some ifdef here? @jonathanmetzman

0reactions
jonathanmetzmancommented, Feb 14, 2019

Thanks! Just to be clear this wont work with clang5, I was just pointing out that the filesystem part of the example with clang5 (but I need to use -std=c++1z), so I assumed it work in clang6.

Read more comments on GitHub >

github_iconTop Results From Across the Web

HeartBleed Bug Explained - 10 Most Frequently Asked ...
It is a critical bug in the OpenSSL's implementation of the TLS/DTLS heartbeat extension that allows attackers to read portions of the affected...
Read more >
Heartbleed Bug - Definition, Explanation and Prevention
The Heartbleed Bug allows attackers to steal the private key of a server certificate. Learn how it works, what impact it has and...
Read more >
How to Prevent the next Heartbleed - David A. Wheeler
This paper focuses on tools and techniques that would prevent the next Heartbleed-like vulnerability.
Read more >
Building a Vulnerable Box – Heartbleed | War Room - RSM US
Most of the media attention focused on the idea of exploiting the vulnerability to acquire a server's private key. While that is certainly...
Read more >
How to cybersecurity: Heartbleed deep dive - Synopsys
Heartbleed is a serious vulnerability discovered in the openssl open source software component in April 2014. This article is a deep dive on ......
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found