Nice work! Could you post more about the basic mechanics of the testing setup itself with AFL + zonefiles? I’ve been meaning to get into AFL but haven’t quite gotten to it on my list yet. I’d love to try similar stuff on gdnsd’s zonefile parser, and eventually even use AFL to fuzz query packet parsing as well.
Sure, gdnsd can easily be fuzzed without any modifications.
Build it with AFL:
Create some directories:
mkdir input output zones
Put a zone file in the ‘input’ directory, (I used a trimmed down version of all.rr.org, removing RR which gdnsd doesn’t support) and launch the fuzzer:
afl-fuzz -i input -o output -f zones/all.rr.org ./src/gdnsd -c . checkconf
While doing so, I found and reported two stack-based buffer overflows.