Add more standalone fuzzing harnesses #64

elopez · 2022-10-27T15:25:03Z

This PR adds some new standalone harnesses that fuzz:

Alt-Svc parsing
Base64 encoding/decoding
DoH decoding
Date parsing
(un)escaping

Some of the harness code includes (from CURLDIR) or copies bits from internal headers; there might be a nicer way to do that.

cmeister2 · 2022-10-27T16:07:15Z

Immediate comment - I'm mildly terrified about adding another 2000 files to this repo, but I don't know if that's FUD or not.

elopez · 2022-10-27T17:45:32Z

For each harness there's a few "seed" cases with human-readable names, plus some more inputs obtained through fuzzing, with hash-like filenames. We can probably remove the latter and let oss-fuzz rediscover them, if you don't want all the files committed in the repository.

cmeister2 · 2022-11-02T13:52:32Z

For each harness there's a few "seed" cases with human-readable names, plus some more inputs obtained through fuzzing, with hash-like filenames. We can probably remove the latter and let oss-fuzz rediscover them, if you don't want all the files committed in the repository.

I realise I didn't respond here - yes, please, if you could do that that would be great.

That list is used by oss-fuzz, and probably somewhere else. Add the new altsvc, base64 and doh fuzzers to it.

This patch adds `-I` flag to compilation flags for standalone harnesses in Makefile.am. Variable CURLDIR is used to determine include path. This patch sets CURLDIR envvar in ossfuzz.sh, but name is taken from mainline.sh. That makes dependencies work with oss-fuzz. It should also make it work with mainline.sh

This fixes coverage collection for standalone harnesses.

Real target is function parsedate from parsedate.c The harness was written by Peter Goodman.

Basic test inputs for parse-date.

It does check if orginal string and unescaped data are same. Functions fuzzed: - curl_easy_escape - curl_easy_unescape

Simple inputs for escape fuzzer

Co-authored-by: Kelly Kaoudis <[email protected]>

This makes it easier to debug crashes.

cmeister2 · 2022-11-02T16:24:05Z

fuzz_altsvc.cc

+
+extern "C"
+{
+  #define HAVE_STRUCT_TIMEVAL // HACK to let it compile


Should this hack still be in here?

cmeister2 · 2022-11-02T16:24:23Z

fuzz_altsvc.cc

+
+/**
+ * Fuzzing entry point. This function is passed a buffer containing a test
+ * case.  This test case should drive the CURL fnmatch function.


Not driving the fnmatch function.

cmeister2 · 2022-11-02T16:30:39Z

fuzz_altsvc.cc

+ */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+  std::string s(reinterpret_cast<const char*>(data), size);


Mildly worried that we could have a std::string buffer (which isn't null terminated) containing a buffer with a null in it, and what that would do for the fuzzing. Probably fine though.

(One of the things I've been wanting to get into the codebase is the FuzzedDataProvider which might help here, but equally might just do the same thing under the covers)

cmeister2 · 2022-11-02T16:31:18Z

fuzz_base64.cc

+
+/**
+ * Fuzzing entry point. This function is passed a buffer containing a test
+ * case.  This test case should drive the CURL fnmatch function.


s/fnmatch/base64/

cmeister2 · 2022-11-02T16:36:42Z

fuzz_doh.cc

+  #include <inttypes.h>
+  #include <curl/curl.h>
+  #include <assert.h>
+  #define WARN_UNUSED_RESULT /* hack */


Does this hack still need to be in?

cmeister2 · 2022-11-02T16:38:08Z

fuzz_parsedate.cc

+  #include <lib/parsedate.h>
+}
+
+// fuzz_target.cc


cmeister2 · 2022-11-02T16:38:31Z

fuzz_escape.cc

@@ -0,0 +1,35 @@
+extern "C"


These have lost the copyright header.

cmeister2 · 2022-11-02T16:38:41Z

fuzz_parsedate.cc

@@ -0,0 +1,18 @@
+extern "C"


Ditto copyright

cmeister2 · 2022-11-02T16:41:22Z

fuzz_parsedate.cc

+
+extern "C" int LLVMFuzzerTestOneInput(char *data, size_t size) {
+  time_t output = 0;
+  char date[100];


A few magic numbers here; might be best to define a constant MAX_DATE_LEN to be 100, then use that?

char date[MAX_DATE_LEN + 1]; size_t len = size > MAX_DATE_LEN ? MAX_DATE_LEN : size; memcpy(date, data, len); date[len] = 0;

cmeister2 · 2022-11-02T16:42:18Z

mainline.sh

@@ -31,8 +31,8 @@ shift $((OPTIND-1))
 export CC=clang
 export CXX=clang++
 FUZZ_FLAG="-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION"
-export CFLAGS="-fsanitize=address"
-export CXXFLAGS="-fsanitize=address -stdlib=libstdc++ $FUZZ_FLAG"
+export CFLAGS="-fsanitize=address,fuzzer-no-link"


Can you explain this, I'm unsure what it does.

As far as I recall, fuzzer-no-link adds the instrumentation for fuzzing (like -fsanitize=fuzzer would), but without linking libfuzzer in (so you can link it afterwards). When I first tried without this flag, the local mainline.sh builds were not running appropriately, but it might have been a matter of my environment and/or clang version. I can try again and see if it's really needed.

elopez added 3 commits October 16, 2022 14:39

fuzz_{base64,altsvc}: fuzz base64 decoder/encoder and Alt-Svc parsing

e7ffaa6

fuzz_doh: fuzz DNS-over-HTTPS response decoding

ce8927d

corpora: add altsvc, base64, and doh input seeds

36dfe96

cmeister2 self-assigned this Oct 27, 2022

Advenam Tacet and others added 4 commits November 2, 2022 12:10

fuzz_targets: update list of fuzzers

617266b

That list is used by oss-fuzz, and probably somewhere else. Add the new altsvc, base64 and doh fuzzers to it.

codecoverage: also export CURLDIR during code coverage collection

623a6a9

This fixes coverage collection for standalone harnesses.

fuzz_parsedate: fuzz date parsing with Curl_getdate_capped

2ccbc11

Real target is function parsedate from parsedate.c The harness was written by Peter Goodman.

elopez force-pushed the elopez/new-curl-fuzzers branch from f43b34a to 2987f5c Compare November 2, 2022 15:15

Advenam Tacet and others added 5 commits November 2, 2022 12:33

fuzz_parsedate: add initial inputs

92ea8c7

Basic test inputs for parse-date.

fuzz_escape: fuzzing (un)escape functions

3181980

It does check if orginal string and unescaped data are same. Functions fuzzed: - curl_easy_escape - curl_easy_unescape

fuzz_escape: add escape inputs

ef8e707

Simple inputs for escape fuzzer

gitignore: add new fuzzer artifacts to the list

dd7905a

Co-authored-by: Kelly Kaoudis <[email protected]>

mainline.sh: enable fuzzing instrumentation with build

e746887

This makes it easier to debug crashes.

elopez force-pushed the elopez/new-curl-fuzzers branch from 2987f5c to e746887 Compare November 2, 2022 15:33

cmeister2 reviewed Nov 2, 2022

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add more standalone fuzzing harnesses #64

Add more standalone fuzzing harnesses #64

elopez commented Oct 27, 2022

cmeister2 commented Oct 27, 2022

elopez commented Oct 27, 2022

cmeister2 commented Nov 2, 2022

cmeister2 Nov 2, 2022

cmeister2 Nov 2, 2022

cmeister2 Nov 2, 2022

cmeister2 Nov 2, 2022

cmeister2 Nov 2, 2022

cmeister2 Nov 2, 2022

cmeister2 Nov 2, 2022

cmeister2 Nov 2, 2022

cmeister2 Nov 2, 2022

cmeister2 Nov 2, 2022

elopez Nov 2, 2022

Add more standalone fuzzing harnesses #64

Are you sure you want to change the base?

Add more standalone fuzzing harnesses #64

Conversation

elopez commented Oct 27, 2022

cmeister2 commented Oct 27, 2022

elopez commented Oct 27, 2022

cmeister2 commented Nov 2, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment