summaryrefslogtreecommitdiff
path: root/src/fuzz
AgeCommit message (Collapse)AuthorFilesLines
2019-06-02udev: modernize udev-rules.cYu Watanabe1-1/+1
This does the following: - rename enum udev_builtin_cmd -> UdevBuiltinCmd - rename struct udev_builtin -> UdevBuiltin - move type definitions to udev-rules.h - move prototypes of functions defined in udev-rules.c to udev-rules.h - drop to use strbuf - propagate critical errors in applying rules, - drop limitation for number of tokens per line.
2019-05-09fuzzer: add varlink fuzzerLennart Poettering2-0/+135
2019-05-07tests: hook up fuzz targets to FuzzBuzzEvgeny Vereshchagin2-0/+8
2019-04-30meson: make source files including nspawn-settings.h depend on libseccompFranck Bui1-2/+2
Since nspawn-settings.h includes seccomp.h, any file that includes nspawn-settings.h should depend on libseccomp so the correct header path where seccomp.h lives is added to the header search paths. It's especially important for distros such as openSUSE where seccomp.h is not shipped in /usr/include but /usr/include/libseccomp. This patch is similar to 8238423095ca54c48d9408a5da13e0325b31e6f6.
2019-04-12Add fmemopen_unlocked() and use unlocked ops in fuzzers and some other testsZbigniew Jędrzejewski-Szmek7-19/+16
This might make things marginially faster. I didn't benchmark though.
2019-03-27headers: remove unneeded includes from util.hZbigniew Jędrzejewski-Szmek2-0/+5
This means we need to include many more headers in various files that simply included util.h before, but it seems cleaner to do it this way.
2019-03-22fuzz-nspawn-oci: add fuzzer for the oci bundle loaderZbigniew Jędrzejewski-Szmek2-0/+33
2019-03-16fuzz-calendarspec: actually run the second part of the fuzzerZbigniew Jędrzejewski-Szmek1-1/+1
https://github.com/systemd/systemd/pull/11975#issuecomment-473467475
2019-03-15Merge pull request #11975 from keszybz/fuzzer-fixes-nLennart Poettering2-1/+3
Fixes for a few fuzzer issues
2019-03-13util: split out memcmp()/memset() related calls into memory-util.[ch]Lennart Poettering1-0/+1
Just some source rearranging.
2019-03-12fuzz: limit the maximum size of test inputs for a few parsersZbigniew Jędrzejewski-Szmek2-1/+3
We have a few cases or reported issues which are about a timeout to parse the input in 25 s. In all cases, the input is a few hundred kb. We don't really care if the config parsers are super efficent, so let's set a limit on the input size to avoid triggering such issues. The parsers often contain quadratic algorithms. This is OK, because the numbers of elements are almost always very small in real use. Rewriting the code to use more complicated data structures to speed this up would not only complicate the code, but also pessimize behaviour for the overwhelmingly common case of small samples. Note that in all those cases, the input data is trusted. We care about memory correctness, and not not so much about efficiency. The size checks are done twice: using options for libfuzzer, and using an internal check for afl. Those should be changed together. I didn't use a define, because there is no easy mechanism to share the define between the two files.
2019-03-12fuzz: add a fuzzer for time utilsFrantisek Sumsal2-0/+32
2019-03-12fuzz: add a fuzzer for calendarspecFrantisek Sumsal2-0/+28
2019-03-11fuzz: add nspawn-settings fuzzerFrantisek Sumsal2-0/+33
2019-03-11fuzz: add hostname-util fuzzerFrantisek Sumsal2-0/+32
2019-03-11fuzz: add env-file fuzzerFrantisek Sumsal2-0/+35
2019-03-11fuzz: add bus-label fuzzerFrantisek Sumsal2-0/+22
2019-03-04fuzz-dhcp6-client: avoid assertion failure on samples which dont fit in pipeYu Watanabe2-0/+5
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11584.
2019-02-28fuzz: do not assume the existence of /sys/class/net/loYu Watanabe1-1/+2
Hopefully fixes oss-fuzz#13440.
2019-02-26Merge pull request #11824 from keszybz/fuzzer-fixesLennart Poettering6-1/+13
Fuzzer fixes
2019-02-26Merge pull request #11823 from keszybz/more-fuzz-coverageLennart Poettering1-0/+1
More fuzz coverage
2019-02-26fuzz-ndisc-rs: avoid assertion failure on samples which dont fit in pipeZbigniew Jędrzejewski-Szmek2-0/+5
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11605.
2019-02-26fuzz-lldp: avoid assertion failure on samples which dont fit in pipeZbigniew Jędrzejewski-Szmek2-0/+5
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11603.
2019-02-26fuzz-journal-stream: avoid assertion failure on samples which don't fit in pipeZbigniew Jędrzejewski-Szmek2-1/+3
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11587. We had a sample which was large enough that write(2) failed to push all the data into the pipe, and an assert failed. The code could be changed to use a loop, but then we'd need to interleave writes and sd_event_run (to process the journal). I don't think the complexity is worth it — fuzzing works best if the sample is not too huge anyway. So let's just reject samples above 64k, and tell oss-fuzz about this limit.
2019-02-26fuzz: add fuzzer for udev databaseYu Watanabe2-0/+29
2019-02-25fuzz-unit-file: also run manager_dump()Zbigniew Jędrzejewski-Szmek1-0/+1
This should increase coverage a bit.
2018-12-17udev: use typedef for struct udev_rulesZbigniew Jędrzejewski-Szmek1-1/+1
2018-12-14udev: make udev_rules_new() return a proper error codeZbigniew Jędrzejewski-Szmek1-2/+2
2018-12-06util: drop missing.h from socket-util.hYu Watanabe1-1/+2
2018-12-04util: drop missing.h from util.hYu Watanabe1-0/+1
2018-12-02util-lib: split out all temporary file related calls into tmpfiles-util.cLennart Poettering2-3/+3
This splits out a bunch of functions from fileio.c that have to do with temporary files. Simply to make the header files a bit shorter, and to group things more nicely. No code changes, just some rearranging of source files.
2018-11-28Merge pull request #10952 from evverx/keep-fuzz-udev-rules-goingYu Watanabe1-16/+28
tests: make fuzz-udev-rules work also in the environment created by run_minijail
2018-11-28tests: suppress "unwanted log lines" in several fuzzersEvgeny Vereshchagin1-0/+3
According to https://oss-fuzz.com/fuzzer-stats/by-fuzzer/fuzzer/libFuzzer/job/libfuzzer_asan_systemd, fuzz-network-parser, fuzz-netdev-parser and fuzz-journal-remote produce a lot of unwanted log lines. Let's set the maximum log level to LOG_CRIT as we do in the other fuzzers.
2018-11-28tests: make fuzz-udev-rules work also in the environment created by run_minijailEvgeny Vereshchagin1-14/+18
This should close https://oss-fuzz.com/testcase?key=5642013043589120. See also https://github.com/google/oss-fuzz/issues/1983.
2018-11-27tests: keep going even if setup_mount_namespace has failedEvgeny Vereshchagin1-6/+14
This should address https://github.com/google/oss-fuzz/issues/1983.
2018-11-26tests: add a fuzzer for the udev rules parser (#10929)Evgeny Vereshchagin3-1/+105
2018-11-23tests: add a fuzzer for server_process_native_fileEvgeny Vereshchagin2-0/+53
2018-11-22tests: add a fuzzer for catalog_import_fileEvgeny Vereshchagin2-0/+31
2018-11-20tests: add a fuzzer for journald streamsEvgeny Vereshchagin3-3/+48
2018-11-17tests: introduce dummy_server_init and use it in all journald fuzzersEvgeny Vereshchagin5-40/+32
2018-11-16tests: add a fuzzer for process_audit_stringEvgeny Vereshchagin2-0/+32
2018-11-16tests: run fuzzers four times in a row (#10794)Evgeny Vereshchagin1-1/+7
This should help to catch issues that are easily detectable by bad_build_check like the one being fixed in https://github.com/systemd/systemd/pull/10793, which would totally break the build tomorrow if I hadn't run `helper.py check_build` manually.
2018-11-16test: initialize syslog_fd in fuzz-journald-kmsg tooEvgeny Vereshchagin1-0/+1
This is a follow-up to 8857fb9beb9dcb that prevents the fuzzer from crashing with ``` ==220==ERROR: AddressSanitizer: ABRT on unknown address 0x0000000000dc (pc 0x7ff4953c8428 bp 0x7ffcf66ec290 sp 0x7ffcf66ec128 T0) SCARINESS: 10 (signal) #0 0x7ff4953c8427 in gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x35427) #1 0x7ff4953ca029 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x37029) #2 0x7ff49666503a in log_assert_failed_realm /work/build/../../src/systemd/src/basic/log.c:805:9 #3 0x7ff496614ecf in safe_close /work/build/../../src/systemd/src/basic/fd-util.c:66:17 #4 0x548806 in server_done /work/build/../../src/systemd/src/journal/journald-server.c:2064:9 #5 0x5349fa in LLVMFuzzerTestOneInput /work/build/../../src/systemd/src/fuzz/fuzz-journald-kmsg.c:26:9 #6 0x592755 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15 #7 0x590627 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) /src/libfuzzer/FuzzerLoop.cpp:480:3 #8 0x594432 in fuzzer::Fuzzer::MutateAndTestOne() /src/libfuzzer/FuzzerLoop.cpp:708:19 #9 0x5973c6 in fuzzer::Fuzzer::Loop(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, fuzzer::fuzzer_allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&) /src/libfuzzer/FuzzerLoop.cpp:839:5 #10 0x574541 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:764:6 #11 0x5675fc in main /src/libfuzzer/FuzzerMain.cpp:20:10 #12 0x7ff4953b382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #13 0x420f58 in _start (/out/fuzz-journald-kmsg+0x420f58) ```
2018-11-16tests: add a fuzzer for dev_kmsg_recordEvgeny Vereshchagin2-0/+34
2018-11-12fuzz: explicitly set initial value of global variablesYu Watanabe2-2/+2
2018-11-12fuzz: set SOCK_CLOEXEC and SOCK_NONBLOCKYu Watanabe3-3/+3
2018-11-12fuzz: use SOCK_STREAM instead of SOCK_DGRAMYu Watanabe2-2/+2
Fixes oss-fuzz#10734.
2018-10-30Merge pull request #10563 from keszybz/lz4-quickfix-quickfixLennart Poettering2-0/+84
journal: adapt for new improved LZ4_decompress_safe_partial()
2018-10-30fuzz-compress: add fuzzer for compression and decompressionZbigniew Jędrzejewski-Szmek2-0/+84
2018-10-29tests: add an lldp fuzzerEvgeny Vereshchagin2-0/+45
I went through my antique collection of fuzzers the other day to see which ones I hadn't sent upstream yet. This one seems to be nice to have and ready to be merged. As far as I can tell, it hasn't managed to find anything useful yet, but it's better to be safe than sorry especially when it comes to networking code :-)
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-14 18:52:58 +0000