Research Article

CAFA: A Checksum-Aware Fuzzing Assistant Tool for Coverage Improvement

Table 6

Checksum points.

Input SpecificationApplicationChecksum algorithm by H1 and H2 by H3Checksum point (assembly)Checksum point (source)

PNGImageMagickCRC32571at offset 0x7972 in libpng12.so.0.46.0
jz short loc_799D
at pngrutil.c:167
if(png_crc_error(png_ptr))
Adler32391at offset 0x922e in libz.so.1.2.3.4
je loc_A6B4
at inflate.c:1170
if ((REVERSE(hold)) != state->check)
optipngCRC3261at offset 0x7972 in libpng12.so.0.46.0
jz short loc_799D
at pngrutil.c:167
if(png_crc_error(png_ptr))
Adler32421at offset 0x922e in libz.so.1.2.3.4
je loc_A6B4
at inflate.c:1170
if ((REVERSE(hold)) != state->check)
pngcheckCRC3251at offset 0x11df6 in pngcheck
jz short loc_8059E50
at pngcheck.c:4594
if (filecrc != CRCCOMPL(crc))
Adler32421at offset 0x922e in libz.so.1.2.3.4
je loc_A6B4
at inflate.c:1170
if ((REVERSE(hold)) != state->check)

GZIPgzipCRC32281at offset 0x978e in gzip
jz short loc_80517B8
at unzip.c:185
if (orig_crc != updcrc(outbuf, 0))

ZIPunzipCRC3281at offset 0x70d6 in unzip
jz loc_804F1B6
at extract.c:1978
if (G.crc32val != G.lrec.crc32)

TARtarTar checksum122at offset 0x16eae in tar
jz short loc_805EEB8
at list.c:352
if (unsigned_sum != recorded_sum && signed_sum != recorded_sum)

RARrarCRC3261at offset 0xe728 in rar
jz loc_8055EB0
---

UDPtcpdumpUDP Checksum101at offset 0x73115 in tcpdump
jz loc_80BB99F
at print-udp.c:562
if (sum != 0)

TCPtcpdumpTCP Checksum81at offset 0x6e68b in tcpdump
jz loc_80B7B0C
at print-tcp.c:390
if (sum != 0)

IPtcpdumpIP Checksum101at offset 0x31615 in tcpdump
jz loc_807932D
at print-ip.c:634
if (sum != 0)

IGMPtcpdumpIGMP Checksum81at offset 0x30146 in tcpdump
jz loc_80780C3
at print-igmp.c:335
if (in_cksum(vec, 1))