Changeset 1563 for zzufTweet

Timestamp:

Jan 5, 2007, 11:28:07 AM (14 years ago)

Author:

Sam Hocevar

Message:

• Allow octal escape values for -P and -R.
• Updated manpage accordingly and added a few minor things in it.

Location:

zzuf/trunk

Files:

• doc/zzuf.1 (modified) (7 diffs)
• src/libzzuf.c (modified) (1 diff)

zzuf/trunk/doc/zzuf.1

@@ -89 +89 @@
 .RS
 .TP
-\fB\\0\fR
-null byte
-.TP
 \fB\\n\fR
 new line
@@ -100 +97 @@
 \fB\\t\fR
 tabulation
+.TP
+\fB\\\fR\fINNN\fR
+the byte whose octal value is \fINNN\fR
 .TP
 \fB\\x\fR\fINN\fR
@@ -109 +109 @@
 .IP
 You can use \(oq\fB-\fR\(cq to specify ranges. For instance, to protect all
-bytes from \(oq\fB\\x01\fR\(cq to \(oq \(cq, use
-\(oq\fB\-P\ \(aq\\x01-\ \(aq\fR\(cq.
-
-The statistical outcome of this option should not be overlooked. Because
-\fBzzuf\fR cannot know the nature of the input data beforehands and must
-fuzz it even if only one byte of data was received, protecting characters
-may change the meaning of the \fB\-r\fR flag depending on the data being
-fuzzed. For instance, asking to fuzz 1% of input bits (\fB\-r\ 0.01\fR)
-and to protect lowercase characters (\fB\-P\ a-z\fR) will result in
-an actual average fuzzing ratio of 0.9% with truly random data, 0.3% with
-random ASCII data and 0.2% with a standard English text.
+bytes from '\\001' to '/', use \(oq\fB\-P\ \(aq\\001-/\(aq\fR\(cq.
+
+The statistical outcome of this option should not be overlooked: if characters
+are protected, the effect of the \(oq\fB\-r\fR\(cq flag will vary depending
+on the data being fuzzed. For instance, asking to fuzz 1% of input bits
+(\fB\-r\ 0.01\fR) and to protect lowercase characters (\fB\-P\ a-z\fR) will
+result in an actual average fuzzing ratio of 0.9% with truly random data,
+0.3% with random ASCII data and 0.2% with standard English text.
 
 See also the \fB\-R\fR flag.
@@ -189 +186 @@
 and prevent non-ASCII characters from appearing in the output:
 .PP
-\fB    zzuf -P \(aq\\n\(aq -R \(aq\\0-\\x1f\\x7f-\\xff\(aq cat /etc/motd\fR
+\fB    zzuf -P \(aq\\n\(aq -R \(aq\\x00-\\x1f\\x7f-\\xff\(aq cat /etc/motd\fR
 .PP
 Fuzz the input of the \fBconvert\fR program, using file \fBfoo.jpeg\fR as the
@@ -198 +195 @@
 \fB    zzuf -E \(aq\\.xml$\(aq convert -- foo.jpeg -format tga /dev/null\fR
 .PP
-Fuzz the input of \fBvlc\fR, using file \fBmovie.avi\fR as the original input
+Fuzz the input of \fBVLC\fR, using file \fBmovie.avi\fR as the original input
 and restricting fuzzing to filenames that appear on the command line
 (\fB\-c\fR), then generate \fBfuzzy-movie.avi\fR which is a file that
-can be read by \fBvlc\fR to reproduce the same behaviour without using
+can be read by \fBVLC\fR to reproduce the same behaviour without using
 \fBzzuf\fR:
 .PP
@@ -208 +205 @@
 \fB    vlc fuzzy-movie.avi\fR
 .PP
-Fuzz 2% of \fBmplayer\fR's input bits (\fB\-r\ 0.02\fR) with seeds 0 to 9999
+Fuzz 2% of \fBMPlayer\fR's input bits (\fB\-r\ 0.02\fR) with seeds 0 to 9999
 (\fB\-s\ 0:10000\fR), disabling its standard output messages (\fB\-q\fR),
 launching up to three simultaneous child processes (\fB\-F\ 3\fR), killing
-\fBmplayer\fR if it takes more than one minute to read the file (\fB\-T\ 60\fR)
+\fBMPlayer\fR if it takes more than one minute to read the file (\fB\-T\ 60\fR)
 and disabling its \fBSIGSEGV\fR signal handler (\fB\-S\fR):
 .PP
@@ -238 +235 @@
 .PP
 Though best efforts are made, identical behaviour for different versions of
-\fBzzuf\fR is not guaranteed. Only the reproducibility for subsequent calls
-with the same \fBzzuf\fR version on different operating systems and with
-different target programs is guaranteed.
+\fBzzuf\fR is not guaranteed. The reproducibility for subsequent calls on
+different operating systems and with different target programs is only
+guaranteed when the same version of \fBzzuf\fR is used.
+.SH HISTORY
+.PP
+\fBZzuf\fR started its life in 2002 as the \fBstreamfucker\fR tool, a small
+multimedia stream corrupter used to find bugs in the \fBVLC\fR media player.
+\fBZzuf\fR is a complete rewrite of that tool.
 .SH AUTHOR
 .PP

zzuf/trunk/src/libzzuf.c

@@ -157 +157 @@
             else if(*tmp == 't')
                 new = '\t';
-            else if(*tmp == '0')
-                new = '\0';
+            else if(tmp[0] >= '0' && tmp[0] <= '7' && tmp[1] >= '0'
+                     && tmp[1] <= '7' && tmp[2] >= '0' && tmp[2] <= '7')
+            {
+                new = tmp[2] - '0';
+                new |= (int)(tmp[1] - '0') << 3;
+                new |= (int)(tmp[0] - '0') << 6;
+                tmp += 2;
+            }
             else if((*tmp == 'x' || *tmp == 'X')
                      && tmp[1] && strchr(hex, tmp[1])