Skip to content

Commit e7ffaa6

Browse files
elopezelopez
committed
fuzz_{base64,altsvc}: fuzz base64 decoder/encoder and Alt-Svc parsing
1 parent dd486c1 commit e7ffaa6

File tree

4 files changed

+195
-0
lines changed

4 files changed

+195
-0
lines changed

‎.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,10 @@ m4/
2626
Makefile
2727
Makefile.in
2828
missing
29+
/curl_fuzzer_altsvc
30+
/curl_fuzzer_altsvc_seed_corpus.zip
31+
/curl_fuzzer_base64
32+
/curl_fuzzer_base64_seed_corpus.zip
2933
/curl_fuzzer_dict
3034
/curl_fuzzer_dict_seed_corpus.zip
3135
/curl_fuzzer_file

‎Makefile.am‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@ LIBS = -lpthread -lm
3636
LIB_FUZZING_ENGINE ?= libstandaloneengine.a
3737

3838
FUZZPROGS = curl_fuzzer \
39+
curl_fuzzer_altsvc \
40+
curl_fuzzer_base64 \
3941
curl_fuzzer_dict \
4042
curl_fuzzer_file \
4143
curl_fuzzer_ftp \
@@ -135,6 +137,14 @@ curl_fuzzer_fnmatch_SOURCES = fuzz_fnmatch.cc
135137
curl_fuzzer_fnmatch_CXXFLAGS = $(COMMON_FLAGS)
136138
curl_fuzzer_fnmatch_LDADD = $(COMMON_LDADD)
137139

140+
curl_fuzzer_altsvc_SOURCES = fuzz_altsvc.cc
141+
curl_fuzzer_altsvc_CXXFLAGS = $(COMMON_FLAGS)
142+
curl_fuzzer_altsvc_LDADD = $(COMMON_LDADD)
143+
144+
curl_fuzzer_base64_SOURCES = fuzz_base64.cc
145+
curl_fuzzer_base64_CXXFLAGS = $(COMMON_FLAGS)
146+
curl_fuzzer_base64_LDADD = $(COMMON_LDADD)
147+
138148
# Create the seed corpora zip files.
139149
zip:
140150
BUILD_ROOT=$(PWD) scripts/create_zip.sh

‎fuzz_altsvc.cc‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
/***************************************************************************
2+
* _ _ ____ _
3+
* Project ___| | | | _ \| |
4+
* / __| | | | |_) | |
5+
* | (__| |_| | _ <| |___
6+
* \___|\___/|_| \_\_____|
7+
*
8+
* Copyright (C) 2017, Max Dymond, <cmeister2@gmail.com>, et al.
9+
*
10+
* This software is licensed as described in the file COPYING, which
11+
* you should have received as part of this distribution. The terms
12+
* are also available at https://curl.se/docs/copyright.html.
13+
*
14+
* You may opt to use, copy, modify, merge, publish, distribute and/or sell
15+
* copies of the Software, and permit persons to whom the Software is
16+
* furnished to do so, under the terms of the COPYING file.
17+
*
18+
* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
19+
* KIND, either express or implied.
20+
*
21+
***************************************************************************/
22+
23+
extern "C"
24+
{
25+
#define HAVE_STRUCT_TIMEVAL // HACK to let it compile
26+
#include <stdlib.h>
27+
#include <signal.h>
28+
#include <string.h>
29+
#include <unistd.h>
30+
#include <inttypes.h>
31+
#include <curl/curl.h>
32+
#include <assert.h>
33+
34+
enum alpnid {
35+
ALPN_none = 0,
36+
ALPN_h1 = CURLALTSVC_H1,
37+
ALPN_h2 = CURLALTSVC_H2,
38+
ALPN_h3 = CURLALTSVC_H3
39+
};
40+
41+
struct altsvcinfo *Curl_altsvc_init(void);
42+
CURLcode Curl_altsvc_parse(struct Curl_easy *data,
43+
struct altsvcinfo *altsvc, const char *value,
44+
enum alpnid srcalpn, const char *srchost,
45+
unsigned short srcport);
46+
void Curl_altsvc_cleanup(struct altsvcinfo **altsvc);
47+
48+
}
49+
50+
#include <string>
51+
52+
/* #define DEBUG(STMT) STMT */
53+
#define DEBUG(STMT)
54+
55+
56+
/**
57+
* Fuzzing entry point. This function is passed a buffer containing a test
58+
* case. This test case should drive the CURL fnmatch function.
59+
*/
60+
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
61+
{
62+
std::string s(reinterpret_cast<const char*>(data), size);
63+
64+
struct Curl_easy *curl;
65+
CURLcode fnrc;
66+
struct altsvcinfo *asi;
67+
68+
asi = Curl_altsvc_init();
69+
curl_global_init(CURL_GLOBAL_ALL);
70+
curl = (Curl_easy*)curl_easy_init();
71+
72+
fnrc = Curl_altsvc_parse(curl, asi, s.c_str(), ALPN_h1, "example.com", 1234);
73+
(void)fnrc;
74+
75+
DEBUG(printf("Curl_altsvc_parse returned %d with %s\n", fnrc, s.c_str()));
76+
assert(fnrc == CURLE_OK);
77+
78+
curl_easy_cleanup(curl);
79+
Curl_altsvc_cleanup(&asi);
80+
curl_global_cleanup();
81+
82+
return 0;
83+
}

‎fuzz_base64.cc‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
/***************************************************************************
2+
* _ _ ____ _
3+
* Project ___| | | | _ \| |
4+
* / __| | | | |_) | |
5+
* | (__| |_| | _ <| |___
6+
* \___|\___/|_| \_\_____|
7+
*
8+
* Copyright (C) 2017, Max Dymond, <cmeister2@gmail.com>, et al.
9+
*
10+
* This software is licensed as described in the file COPYING, which
11+
* you should have received as part of this distribution. The terms
12+
* are also available at https://curl.se/docs/copyright.html.
13+
*
14+
* You may opt to use, copy, modify, merge, publish, distribute and/or sell
15+
* copies of the Software, and permit persons to whom the Software is
16+
* furnished to do so, under the terms of the COPYING file.
17+
*
18+
* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
19+
* KIND, either express or implied.
20+
*
21+
***************************************************************************/
22+
23+
extern "C"
24+
{
25+
#include <stdlib.h>
26+
#include <signal.h>
27+
#include <string.h>
28+
#include <unistd.h>
29+
#include <inttypes.h>
30+
#include <curl/curl.h>
31+
#include "curl/lib/curl_base64.h"
32+
#include "curl/lib/curl_printf.h"
33+
#include "curl/lib/curl_memory.h"
34+
#include "curl/lib/memdebug.h"
35+
#include <assert.h>
36+
}
37+
38+
#include <string>
39+
40+
/* #define DEBUG(STMT) STMT */
41+
#define DEBUG(STMT)
42+
43+
44+
void curl_dbg_free(void *ptr)
45+
{
46+
if(ptr) {
47+
void *mem = (void *)((char *)ptr - 8);
48+
49+
/* free for real */
50+
(Curl_cfree)(mem);
51+
}
52+
}
53+
54+
55+
/**
56+
* Fuzzing entry point. This function is passed a buffer containing a test
57+
* case. This test case should drive the CURL fnmatch function.
58+
*/
59+
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
60+
{
61+
std::string s(reinterpret_cast<const char*>(data), size);
62+
CURLcode fnrc;
63+
unsigned char *outptr = NULL, *outptr2 = NULL;
64+
char *recodeptr = NULL;
65+
size_t inlen = strlen(s.c_str()), outlen, outlen2, recodelen;
66+
67+
fnrc = Curl_base64_decode(s.c_str(), &outptr, &outlen);
68+
69+
(void)fnrc;
70+
DEBUG(printf("Curl_base64_decode returned %d with %s\n", fnrc, s.c_str()));
71+
72+
if (fnrc != CURLE_OK)
73+
goto EXIT_LABEL;
74+
75+
fnrc = Curl_base64_encode((const char *)outptr, outlen, &recodeptr, &recodelen);
76+
77+
if (fnrc != CURLE_OK)
78+
goto EXIT_LABEL;
79+
80+
(void)fnrc;
81+
DEBUG(printf("Curl_base64_encode returned %d with %s\n", fnrc, s.c_str()));
82+
83+
fnrc = Curl_base64_decode(recodeptr, &outptr2, &outlen2);
84+
85+
DEBUG(printf("Sizes og:%lu decode:%lu recode:%lu decode2:%lu, Strings '%s' '%s'\n", inlen, outlen, recodelen, outlen2, s.c_str(), recodeptr));
86+
87+
assert(fnrc == CURLE_OK);
88+
assert(outlen == outlen2);
89+
assert(!memcmp(outptr, outptr2, outlen));
90+
91+
EXIT_LABEL:
92+
93+
curl_dbg_free(outptr);
94+
curl_dbg_free(outptr2);
95+
curl_dbg_free(recodeptr);
96+
97+
return 0;
98+
}

0 commit comments

Comments
 (0)