mirror of
https://github.com/troglobit/finit.git
synced 2026-10-01 05:22:48 +07:00
Joachim Wiberg
c28acf21a1
__msg_parse() turns bytes off a socket into pointers, before anything has vouched for the peer, and it is the only place in libink that does. It had no test of its own beyond whatever the other tests happened to send it, all of it well-formed. The target checks the parser's contract, not merely that it survived. A header field must point into the header field array, and terminate inside it, and the parse must never claim more bytes than it was handed. Crash-only would pass a parser that walked into the body and returned fields from there, since those bytes were handed over too. The expected bounds are derived from the raw header rather than from the parser, so the two have to agree independently. Every input is copied into an allocation sized to it first. Reading past the end of a roomy buffer stays inside the allocation and the sanitizer never sees it; against an exact one the same read is a fault, which is where the sharpest findings come from. Under libFuzzer it is an ordinary fuzz target and named files replay, which is how a find gets reproduced. With no arguments it runs a fixed sweep -- every truncation, every single-byte corruption, every value of the length that decides where the header ends, and seeded garbage -- so the suite covers the same contract on every build, without clang or a corpus in the tree. It takes 40 ms. CI fuzzes it properly on every pull request, keeps the crashers, and carries the corpus between runs so it reaches deeper over time than any single run can. Note that clang links the fuzzer runtime against the newest GCC tree it finds, so the libstdc++ headers have to match that one and not the default compiler, which is worth saying since installing the obvious package leaves you exactly where you started. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
21 lines
556 B
Bash
Executable File
21 lines
556 B
Bash
Executable File
#!/bin/sh
|
|
# libink: __msg_parse() against truncation, corruption, and garbage.
|
|
#
|
|
# Runs the fuzz target's fixed sweep, which is the same contract check
|
|
# libFuzzer drives, so the suite covers it on every build without
|
|
# needing clang. Anything it finds aborts, and the sanitizers CI
|
|
# builds with turn a stray read into a failure here rather than a
|
|
# puzzle on a target.
|
|
|
|
set -eu
|
|
|
|
TEST_DIR=$(dirname "$0")
|
|
DRIVER="$TEST_DIR/src/fuzz-msg-parse"
|
|
|
|
[ -x "$DRIVER" ] || {
|
|
echo "fuzz-msg-parse not built, D-Bus support is off"
|
|
exit 77
|
|
}
|
|
|
|
exec "$DRIVER"
|