Fuzzing a Vulnerable JSON Parser: A Complete Guide to Finding Memory Corruption Bugs

Introduction

Fuzzing has become one of the most effective techniques for discovering security vulnerabilities in software. In this hands-on tutorial, we'll build a deliberately vulnerable JSON parser and use AFL++ (American Fuzzy Lop) to automatically discover five different types of memory corruption vulnerabilities.

This guide demonstrates:

How to design effective fuzzing test cases (seeds)
Understanding AFL++ fuzzing workflow
Analyzing crashes with AddressSanitizer (ASAN)
Real-world vulnerability patterns in parsers

The Vulnerable JSON Parser

Our target is a simple JSON parser (json_parser.c) that supports three data types:

Strings: "name": "value"
Numbers: "port": 8080
Arrays: "array": [1, 2, 3]

Complete Source Code

c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>

#define MAX_KEY_LEN 64
#define MAX_VALUE_LEN 256
#define MAX_ARRAY_SIZE 1024

// JSON key-value pair structure
typedef struct {
    char *key;
    char *value;
    int type;  // 0=string, 1=number, 2=array
} json_pair_t;

// Global array buffer
int *global_array = NULL;
size_t global_array_size = 0;

// Vulnerability 1: Stack buffer overflow
void process_key(char *key) {
    char local_key[MAX_KEY_LEN];
    strcpy(local_key, key);  // Dangerous! No bounds check
    printf("Processing key: %s\n", local_key);
}

// Vulnerability 2: Format string vulnerability
void log_value(char *value) {
    fprintf(stderr, "Value: ");
    fprintf(stderr, value);  // Dangerous! User input as format string
    fprintf(stderr, "\n");
}

// Vulnerability 3: Integer overflow
size_t calculate_array_size(unsigned int count, unsigned int item_size) {
    // Dangerous! Possible integer overflow
    size_t total = count * item_size;
    return total;
}

// Vulnerability 4: Heap buffer overflow
void process_array(int *data, size_t data_count) {
    if (!global_array) {
        fprintf(stderr, "Error: Array buffer not initialized\n");
        return;
    }

    // Dangerous! No check if data_count exceeds global_array_size
    memcpy(global_array, data, data_count * sizeof(int));

    printf("Processed %zu array elements\n", data_count);
}

// Cleanup function
void cleanup_array() {
    if (global_array) {
        free(global_array);
        global_array = NULL;
    }
}

// Vulnerability 5: Use-After-Free
void print_array_info() {
    // Dangerous! May access freed memory
    if (global_array_size > 0) {
        printf("Array size: %zu\n", global_array_size);
        if (global_array) {
            printf("First element: %d\n", global_array[0]);  // UAF!
        }
    }
}

// Simple JSON parser
char* skip_whitespace(char *json) {
    while (*json && isspace(*json)) json++;
    return json;
}

char* parse_string(char *json, char **result) {
    json = skip_whitespace(json);

    if (*json != '"') {
        return NULL;
    }

    json++; // skip opening "
    char *start = json;

    while (*json && *json != '"') json++;

    if (*json != '"') {
        return NULL;
    }

    size_t len = json - start;
    *result = malloc(len + 1);
    strncpy(*result, start, len);
    (*result)[len] = '\0';

    json++; // skip closing "
    return json;
}

char* parse_number(char *json, int *result) {
    json = skip_whitespace(json);

    *result = atoi(json);

    while (*json && (isdigit(*json) || *json == '-')) json++;

    return json;
}

char* parse_array(char *json, int **array, size_t *count) {
    json = skip_whitespace(json);

    if (*json != '[') {
        return NULL;
    }

    json++; // skip [

    // Parse array length
    unsigned int capacity = 10;
    *array = malloc(capacity * sizeof(int));
    *count = 0;

    json = skip_whitespace(json);

    while (*json && *json != ']') {
        int num;
        json = parse_number(json, &num);

        if (*count >= capacity) {
            capacity *= 2;
            *array = realloc(*array, capacity * sizeof(int));
        }

        (*array)[(*count)++] = num;

        json = skip_whitespace(json);
        if (*json == ',') {
            json++;
            json = skip_whitespace(json);
        }
    }

    if (*json != ']') {
        free(*array);
        return NULL;
    }

    json++; // skip ]
    return json;
}

int parse_json_pair(char *json) {
    char *key = NULL;
    char *value = NULL;
    int num_value;
    int *array_data = NULL;
    size_t array_count = 0;

    json = skip_whitespace(json);

    if (*json != '{') {
        fprintf(stderr, "Error: Expected '{'\n");
        return -1;
    }

    json++; // skip {

    while (1) {
        json = skip_whitespace(json);

        if (*json == '}') {
            break;
        }

        // Parse key
        json = parse_string(json, &key);
        if (!json) {
            fprintf(stderr, "Error: Failed to parse key\n");
            return -1;
        }

        // Trigger stack overflow
        process_key(key);

        json = skip_whitespace(json);

        if (*json != ':') {
            fprintf(stderr, "Error: Expected ':'\n");
            free(key);
            return -1;
        }

        json++; // skip :
        json = skip_whitespace(json);

        // Parse value based on type
        if (*json == '"') {
            // String value
            json = parse_string(json, &value);
            if (!json) {
                free(key);
                return -1;
            }

            // Trigger format string vulnerability
            log_value(value);

            free(value);
        }
        else if (*json == '[') {
            // Array value
            json = parse_array(json, &array_data, &array_count);
            if (!json) {
                free(key);
                return -1;
            }

            // Trigger integer overflow and heap overflow
            global_array_size = calculate_array_size(array_count, sizeof(int));

            if (global_array_size > 0) {
                global_array = malloc(global_array_size);
                if (global_array) {
                    process_array(array_data, array_count);
                }
            }

            free(array_data);
        }
        else if (isdigit(*json) || *json == '-') {
            // Number value
            json = parse_number(json, &num_value);
            printf("Number: %d\n", num_value);
        }

        free(key);

        json = skip_whitespace(json);
        if (*json == ',') {
            json++;
        }
    }

    return 0;
}

int main(int argc, char *argv[]) {
    if (argc != 2) {
        printf("Usage: %s <json_file>\n", argv[0]);
        return 1;
    }

    FILE *fp = fopen(argv[1], "r");
    if (!fp) {
        fprintf(stderr, "Cannot open file: %s\n", argv[1]);
        return 1;
    }

    // Read entire file
    fseek(fp, 0, SEEK_END);
    long file_size = ftell(fp);
    fseek(fp, 0, SEEK_SET);

    char *json_content = malloc(file_size + 1);
    fread(json_content, 1, file_size, fp);
    json_content[file_size] = '\0';
    fclose(fp);

    printf("Parsing JSON...\n");

    // Parse JSON
    int result = parse_json_pair(json_content);

    free(json_content);

    if (result == 0) {
        printf("JSON parsed successfully\n");

        // Cleanup resources
        cleanup_array();

        // Trigger UAF
        print_array_info();
    }

    return result;
}

Intentional Vulnerabilities

We've embedded five classic memory safety vulnerabilities:

1. Stack Buffer Overflow (Critical)

c
void process_key(char *key) {
    char local_key[MAX_KEY_LEN];  // 64 bytes
    strcpy(local_key, key);       // No bounds check!
    printf("Processing key: %s\n", local_key);
}

Trigger: JSON key exceeding 64 bytes
Impact: Stack corruption, potential RIP/RBP overwrite

2. Format String Vulnerability (High)

c
void log_value(char *value) {
    fprintf(stderr, "Value: ");
    fprintf(stderr, value);  // Dangerous!
    fprintf(stderr, "\n");
}

Trigger: JSON value containing format specifiers (%s, %p, %n)
Impact: Information disclosure, arbitrary memory write

3. Integer Overflow (Medium)

c
size_t calculate_array_size(unsigned int count, unsigned int item_size) {
    size_t total = count * item_size;  // Can overflow!
    return total;
}

Trigger: Extremely large array element count
Impact: Small buffer allocation followed by large copy → heap overflow

4. Heap Buffer Overflow (Critical)

c
void process_array(int *data, size_t data_count) {
    if (!global_array) return;

    // No bounds check against global_array_size!
    memcpy(global_array, data, data_count * sizeof(int));
}

Trigger: Array data exceeds allocated buffer
Exploitation chain: Integer overflow → small buffer → large data → heap overflow

5. Use-After-Free (Medium)

c
// In main():
cleanup_array();        // Frees global_array
print_array_info();     // Accesses freed memory!

void print_array_info() {
    if (global_array_size > 0) {
        if (global_array) {
            printf("First element: %d\n", global_array[0]);  // UAF!
        }
    }
}

Trigger: Normal JSON parsing with arrays
Impact: Access to freed memory, potential information leak

Compilation

Compile multiple versions for different purposes:

bash
# 1. AFL++ instrumented version (for fuzzing)
afl-clang-fast -o json_parser_fuzz json_parser.c

# 2. AddressSanitizer version (for vulnerability detection)
afl-clang-fast -fsanitize=address -fsanitize=undefined -g -O1 \
    -o json_parser_asan json_parser.c

# 3. Debug version (for exploitation)
gcc -g -fno-stack-protector -z execstack -no-pie \
    -o json_parser_debug json_parser.c

# 4. Normal version (for comparison)
gcc -o json_parser_normal json_parser.c

Testing the Basic Seed

basic seed: seed.json

json
{
  "name": "test",
  "port": 8080,
  "array": [1, 2, 3]
}

bash
root@softsec2:/opt/json_fuzzing_exercise# ./json_parser_normal seed.json
Parsing JSON...
Processing key: name
Value: test
Processing key: port
Number: 8080
Processing key: array
Processed 3 array elements
JSON parsed successfully
Array size: 12

Seed Design Strategy

Effective fuzzing starts with well-designed seed files. Our strategy focuses on:

Coverage of all 3 data types (string/number/array)
Boundary value testing (extra-long keys/values, huge arrays)
Malformed formats (missing quotes, unmatched brackets)
Attack payloads (format strings, overflow data)

We'll create 10 seed variants based on the basic seed:

Seed 2: Long Key (Stack Overflow)

bash
cat > seeds/02_long_key.json << 'EOF'
{"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa": "value"}
EOF

Purpose: Trigger strcpy overflow in process_key()

Seed 3: Format String

bash
cat > seeds/03_format_string.json << 'EOF'
{"name": "%s%s%s%n"}
EOF

Purpose: Trigger format string vulnerability in log_value()

Seed 4: Large Array

bash
# Generate array with 1000 elements
echo -n '{"array": [' > seeds/04_large_array.json
for i in {1..1000}; do
    echo -n "$i"
    [ $i -lt 1000 ] && echo -n ","
done >> seeds/04_large_array.json
echo ']}' >> seeds/04_large_array.json

Purpose: Trigger integer overflow and heap overflow

Seed 5: Missing Quote

bash
cat > seeds/05_invalid_quote.json << 'EOF'
{"name: "test"}
EOF

Purpose: Test error handling

Seed 6: Unmatched Bracket

bash
cat > seeds/06_unmatched_bracket.json << 'EOF'
{"name": "test"
EOF

Purpose: Test parser robustness

Seed 7: Nested Structure

bash
cat > seeds/07_nested.json << 'EOF'
{"obj": {"key": "value"}}
EOF

Note: Current parser doesn't support nesting, will trigger error handling

Seed 8: Empty JSON

bash
echo '{}' > seeds/08_empty.json

Purpose: Boundary condition testing

Seed 9: Negative Number

bash
cat > seeds/09_negative.json << 'EOF'
{"port": -1}
EOF

Seed 10: Long Value

bash
printf '{"msg": "%0500d"}' 1 > seeds/10_long_value.json

AFL++ Fuzzing

Start the fuzzer:

bash
# Launch AFL++
afl-fuzz -i seeds -o output \
    -M fuzzer01 \
    -- ./json_parser_fuzz @@

Parameters explained:

-i seeds: Input seed directory
-o output: Output directory
-M fuzzer01: Main fuzzer instance
@@: AFL++ replaces this with test case path

With well-designed seeds, results appear within minutes:

AFL Fuzzing Results

bash

root@softsec2:/opt/json_fuzzing_exercise/output/fuzzer01/crashes# ls
id:000000,sig:11,src:000002,time:3113,execs:9537,op:havoc,rep:8
id:000001,sig:11,src:000002,time:3815,execs:15601,op:havoc,rep:16
id:000002,sig:11,src:000002+000008,time:6913,execs:33715,op:splice,rep:4
id:000003,sig:11,src:000006,time:52490,execs:37465,op:havoc,rep:8
id:000004,sig:11,src:000006,time:103749,execs:40472,op:havoc,rep:16
README.txt

Real Crash Analysis

Initial Testing with Normal Binary

bash
root@softsec2:/opt/json_fuzzing_exercise/output/fuzzer01/crashes# ../../../json_parser_normal "id:000000,sig:11,src:000002,time:3113,execs:9537,op:havoc,rep:8"
Parsing JSON...
Processing key: pa
Value: 0x561fbb39a8b0    # ⚠️ Memory address leaked!
Processing key: b
Value: bb39a8b0          # ⚠️ Address fragment leaked!
Processing key: c
Value:
JSON parsed successfully

ASAN Analysis

bash
root@softsec2:/opt/json_fuzzing_exercise/output/fuzzer01/crashes# ../../../json_parser_asan "id:000000,sig:11,src:000002,time:3113,execs:9537,op:havoc,rep:8"
Parsing JSON...
Processing key: pa
Value: 0xffffffff
Processing key: b
Value: ffffffff
Processing key: c
Value: AddressSanitizer:DEADLYSIGNAL
=================================================================
==1749957==ERROR: AddressSanitizer: SEGV on unknown address 0x00009fff7fff (pc 0x0000004344a2 bp 0x7ffe31b6b460 sp 0x7ffe31b6abd8 T0)
==1749957==The signal is caused by a READ memory access.
    #0 0x4344a2 in __asan::QuickCheckForUnpoisonedRegion(unsigned long, unsigned long) asan_interceptors.cpp.o
    #1 0x43fc2e in printf_common(void*, char const*, __va_list_tag*) asan_interceptors.cpp.o
    #2 0x4414b9 in fprintf (/opt/json_fuzzing_exercise/json_parser_asan+0x4414b9)
    #3 0x4cf1bf in log_value /opt/json_fuzzing_exercise/json_parser.c:31:5
    #4 0x4d0f38 in parse_json_pair /opt/json_fuzzing_exercise/json_parser.c:212:13
    #5 0x4d1ab4 in main /opt/json_fuzzing_exercise/json_parser.c:278:18
    #6 0x7fcec770bd8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #7 0x7fcec770be3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #8 0x420394 in _start (/opt/json_fuzzing_exercise/json_parser_asan+0x420394)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV asan_interceptors.cpp.o in __asan::QuickCheckForUnpoisonedRegion(unsigned long, unsigned long)
==1749957==ABORTING

Examining Crash Content

bash
root@softsec2:/opt/json_fuzzing_exercise/output/fuzzer01/crashes# hexdump -C "id:000000,sig:11,src:000002,time:3113,execs:9537,op:havoc,rep:8"
00000000  7b 22 70 61 22 3a 20 22  25 70 22 2c 20 22 62 22  |{"pa": "%p", "b"|
00000010  3a 20 22 25 78 22 2c 20  22 63 22 3a 20 22 25 6e  |: "%x", "c": "%n|
00000020  22 7d 6f 3e 74 22 35 20  73 08                    |"}o>t"5 s.|
0000002a

AFL++ generated payload:

json
{"pa": "%p", "b": "%x", "c": "%n"}o>t"5 s.

Format specifiers found:

%p - Pointer leak
%x - Hexadecimal value leak
%n - Memory write format specifier (dangerous!)

Vulnerability Assessment

Trigger location: log_value() function (json_parser.c:31)
Vulnerability type: Format string injection (%n attempts memory write, invalid address causes crash)

Security impact:

Information disclosure - %p/%x leak memory addresses → ASLR bypass
Arbitrary memory write - %n can write to memory → Control program flow
Exploitation chain - Address leak + crafted %n → RCE (Remote Code Execution)

Results

Within just a few minutes, we discovered 8 crashes:

AFL Progress

12mins after

afl3

20mins after
afl4

Key Takeaways

Seed design is critical - Well-crafted seeds accelerate vulnerability discovery
ASAN is essential - Reveals detailed crash information for analysis
Format strings are dangerous - User input must never be used directly as format strings

Fixes

Fix Format String Vulnerability

Before:

c
void log_value(char *value) {
    fprintf(stderr, value);  // Dangerous!
}

After:

c
void log_value(char *value) {
    fprintf(stderr, "%s", value);  // Safe!
}

Remember: Use these techniques responsibly and only on systems you're authorized to test.

References

AFLplusplus. (n.d.). AFL++ (American Fuzzy Lop plus plus). GitHub. https://github.com/AFLplusplus/AFLplusplus
OWASP Foundation. (n.d.-a). Format string attack. https://owasp.org/www-community/attacks/Format_string_attack
OWASP Foundation. (n.d.-b). Secure coding practices quick reference guide. https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/
Software Engineering Institute. (n.d.). SEI CERT C coding standard. Carnegie Mellon University. https://wiki.sei.cmu.edu/confluence/display/c/SEI+CERT+C+Coding+Standard