[tor-commits] [tor/master] Fuzzing: Add an initial fuzzing tool, for descriptors.

[nickm@xxxxxxxxxxxxxx]

commit b96c70d668f96550401057834bb9caafb5d0e412
Author: Nick Mathewson <nickm@xxxxxxxxxxxxxx>
Date:   Tue Dec 13 19:15:26 2016 -0500

    Fuzzing: Add an initial fuzzing tool, for descriptors.
    
    This will need some refactoring and mocking.
---
 Makefile.am                     |  1 +
 src/include.am                  |  2 +-
 src/test/fuzz/fuzz_descriptor.c | 26 +++++++++++++++++++++
 src/test/fuzz/fuzzing.h         |  7 ++++++
 src/test/fuzz/fuzzing_common.c  | 52 +++++++++++++++++++++++++++++++++++++++++
 src/test/fuzz/include.am        | 48 +++++++++++++++++++++++++++++++++++++
 6 files changed, 135 insertions(+), 1 deletion(-)

diff --git a/Makefile.am b/Makefile.am
index b6e4e53..2e853d4 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -9,6 +9,7 @@ noinst_LIBRARIES=
 EXTRA_DIST=
 noinst_HEADERS=
 bin_PROGRAMS=
+EXTRA_PROGRAMS=
 CLEANFILES=
 TESTS=
 noinst_PROGRAMS=
diff --git a/src/include.am b/src/include.am
index c468af3..d12684e 100644
--- a/src/include.am
+++ b/src/include.am
@@ -6,4 +6,4 @@ include src/test/include.am
 include src/tools/include.am
 include src/win32/include.am
 include src/config/include.am
-
+include src/test/fuzz/include.am
diff --git a/src/test/fuzz/fuzz_descriptor.c b/src/test/fuzz/fuzz_descriptor.c
new file mode 100644
index 0000000..1364bf4
--- /dev/null
+++ b/src/test/fuzz/fuzz_descriptor.c
@@ -0,0 +1,26 @@
+
+#include "or.h"
+#include "routerparse.h"
+#include "routerlist.h"
+#include "fuzzing.h"
+
+int
+fuzz_init(void)
+{
+  ed25519_init();
+  return 0;
+}
+
+int
+fuzz_main(const uint8_t *data, size_t sz)
+{
+  routerinfo_t *ri;
+  const char *str = (const char*) data;
+  ri = router_parse_entry_from_string((const char *)str,
+                                      str+sz,
+                                      0, 0, 0, NULL);
+  if (ri)
+    routerinfo_free(ri);
+  return 0;
+}
+
diff --git a/src/test/fuzz/fuzzing.h b/src/test/fuzz/fuzzing.h
new file mode 100644
index 0000000..fbd54da
--- /dev/null
+++ b/src/test/fuzz/fuzzing.h
@@ -0,0 +1,7 @@
+#ifndef FUZZING_H
+#define FUZZING_H
+
+int fuzz_init(void);
+int fuzz_main(const uint8_t *data, size_t sz);
+
+#endif /* FUZZING_H */
diff --git a/src/test/fuzz/fuzzing_common.c b/src/test/fuzz/fuzzing_common.c
new file mode 100644
index 0000000..51d519b
--- /dev/null
+++ b/src/test/fuzz/fuzzing_common.c
@@ -0,0 +1,52 @@
+#include "orconfig.h"
+#include "torint.h"
+#include "util.h"
+#include "torlog.h"
+#include "backtrace.h"
+#include "fuzzing.h"
+
+extern const char tor_git_revision[];
+const char tor_git_revision[] = "";
+
+#define MAX_FUZZ_SIZE (128*1024)
+
+#ifdef LLVM_FUZZ
+int
+LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+  static int initialized = 0;
+  if (!initialized) {
+    if (fuzz_init() < 0)
+      abort();
+  }
+
+  return fuzz_main(Data, Size);
+}
+
+#else /* Not LLVM_FUZZ, so AFL. */
+
+int
+main(int argc, char **argv)
+{
+  size_t size;
+  char *input = read_file_to_str_until_eof(0, MAX_FUZZ_SIZE, &size);
+
+  tor_threads_init();
+  init_logging(1);
+
+  if (argc > 1 && !strcmp(argv[1], "--info")) {
+    log_severity_list_t sev;
+    set_log_severity_config(LOG_INFO, LOG_ERR, &sev);
+    add_stream_log(&sev, "stdout", 1);
+    configure_backtrace_handler(NULL);
+  }
+
+  tor_assert(input);
+  if (fuzz_init() < 0)
+    abort();
+  fuzz_main((const uint8_t*)input, size);
+  tor_free(input);
+  return 0;
+}
+
+#endif
+
diff --git a/src/test/fuzz/include.am b/src/test/fuzz/include.am
new file mode 100644
index 0000000..323798f
--- /dev/null
+++ b/src/test/fuzz/include.am
@@ -0,0 +1,48 @@
+
+FUZZING_CPPFLAGS = \
+	$(src_test_AM_CPPFLAGS) $(TEST_CPPFLAGS)
+FUZZING_CFLAGS = \
+	$(AM_CFLAGS) $(TEST_CFLAGS)
+FUZZING_LDFLAG = \
+	@TOR_LDFLAGS_zlib@ @TOR_LDFLAGS_openssl@ @TOR_LDFLAGS_libevent@
+FUZZING_LIBS = \
+	src/or/libtor-testing.a \
+	src/common/libor-crypto-testing.a \
+	$(LIBKECCAK_TINY) \
+	$(LIBDONNA) \
+	src/common/libor-testing.a \
+	src/common/libor-ctime-testing.a \
+	src/common/libor-event-testing.a \
+	src/trunnel/libor-trunnel-testing.a \
+	@TOR_ZLIB_LIBS@ @TOR_LIB_MATH@ \
+	@TOR_LIBEVENT_LIBS@ \
+	@TOR_OPENSSL_LIBS@ @TOR_LIB_WS32@ @TOR_LIB_GDI@ @CURVE25519_LIBS@ \
+	@TOR_SYSTEMD_LIBS@
+
+
+noinst_HEADERS += \
+	src/test/fuzz/fuzzing_boilerplate.h
+
+src_test_fuzz_fuzz_descriptor_SOURCES = \
+	src/test/fuzz/fuzzing_common.c \
+	src/test/fuzz/fuzz_descriptor.c
+src_test_fuzz_fuzz_descriptor_CPPFLAGS = $(FUZZING_CPPFLAGS)
+src_test_fuzz_fuzz_descriptor_CFLAGS = $(FUZZING_CFLAGS)
+src_test_fuzz_fuzz_descriptor_LDFLAGS = $(FUZZING_LDFLAG)
+src_test_fuzz_fuzz_descriptor_LDADD = $(FUZZING_LIBS)
+
+src_test_fuzz_fuzz_http_SOURCES = \
+	src/test/fuzz/fuzzing_common.c \
+	src/test/fuzz/fuzz_http.c
+src_test_fuzz_fuzz_http_CPPFLAGS = $(FUZZING_CPPFLAGS)
+src_test_fuzz_fuzz_http_CFLAGS = $(FUZZING_CFLAGS)
+src_test_fuzz_fuzz_http_LDFLAGS = $(FUZZING_LDFLAG)
+src_test_fuzz_fuzz_http_LDADD = $(FUZZING_LIBS)
+
+FUZZERS = \
+	src/test/fuzz/fuzz-descriptor \
+	src/test/fuzz/fuzz-http
+
+# The fuzzers aren't built by default right now. That should change.
+EXTRA_PROGRAMS += $(FUZZERS)
+fuzzers: $(FUZZERS)



_______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits