3party/libzmq
0
0
Fork 0
mirror of https://github.com/zeromq/libzmq.git synced 2024-12-26 23:01:04 +08:00
Code Issues Projects Releases Wiki Activity

Problem: fuzzer regression tests do very little

Browse Source 
Solution: run them with the seed corpora
This commit is contained in:
Luca Boccassi 2020-05-04 01:54:34 +01:00 committed by Luca Boccassi
parent c8e62cb2e0
commit 6b259224ee
6 changed files with 136 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
tests/test_bind_curve_fuzzer.cpp
View File

@ -50,6 +50,22 @@ extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
my_endpoint);
fd_t client = connect_socket (my_endpoint);
// If there is not enough data for a full greeting, just send what we can
// Otherwise send greeting first, as expected by the protocol
uint8_t buf[64];
if (size >= 64) {
send (client, (void *) data, 64, MSG_NOSIGNAL);
data += 64;
size -= 64;
}
recv (client, buf, 64, 0);
if (size >= 202) {
send (client, (void *) data, 202, MSG_NOSIGNAL);
data += 202;
size -= 202;
}
recv (client, buf, 64, MSG_DONTWAIT);
msleep (250);
for (ssize_t sent = 0; size > 0 && (sent != -1 || errno == EINTR);
size -= sent > 0 ? sent : 0, data += sent > 0 ? sent : 0)
sent = send (client, (const char *) data, size, MSG_NOSIGNAL);
@ -66,8 +82,16 @@ extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
#ifndef ZMQ_USE_FUZZING_ENGINE
void test_bind_curve_fuzzer ()
{
TEST_ASSERT_SUCCESS_ERRNO (LLVMFuzzerTestOneInput (
zmtp_greeting_curve, sizeof (zmtp_greeting_curve)));
uint8_t *data;
size_t len;
if (fuzzer_corpus_encode ("tests/fuzzer_corpora/test_bind_curve_fuzzer.txt",
&data, &len)
!= 0)
exit (77);
TEST_ASSERT_SUCCESS_ERRNO (LLVMFuzzerTestOneInput (data, len));
free (data);
}
int main (int argc, char **argv)

22
tests/test_bind_null_fuzzer.cpp
View File

@ -44,6 +44,16 @@ extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
bind_loopback_ipv4 (server, my_endpoint, sizeof (my_endpoint));
fd_t client = connect_socket (my_endpoint);
// If there is not enough data for a full greeting, just send what we can
// Otherwise send greeting first, as expected by the protocol
uint8_t buf[64];
if (size >= 64) {
send (client, (void *) data, 64, MSG_NOSIGNAL);
data += 64;
size -= 64;
}
recv (client, buf, 64, 0);
msleep (250);
for (ssize_t sent = 0; size > 0 && (sent != -1 || errno == EINTR);
size -= sent > 0 ? sent : 0, data += sent > 0 ? sent : 0)
sent = send (client, (const char *) data, size, MSG_NOSIGNAL);
@ -60,8 +70,16 @@ extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
#ifndef ZMQ_USE_FUZZING_ENGINE
void test_bind_null_fuzzer ()
{
TEST_ASSERT_SUCCESS_ERRNO (
LLVMFuzzerTestOneInput (zmtp_greeting_null, sizeof (zmtp_greeting_null)));
uint8_t *data;
size_t len;
if (fuzzer_corpus_encode ("tests/fuzzer_corpora/test_bind_null_fuzzer.txt",
&data, &len)
!= 0)
exit (77);
TEST_ASSERT_SUCCESS_ERRNO (LLVMFuzzerTestOneInput (data, len));
free (data);
}
int main (int argc, char **argv)

29
tests/test_connect_curve_fuzzer.cpp
View File

@ -51,11 +51,28 @@ extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
fd_t server_accept =
TEST_ASSERT_SUCCESS_RAW_ERRNO (accept (server, NULL, NULL));
// If there is not enough data for a full greeting, just send what we can
// Otherwise send greeting first, as expected by the protocol
uint8_t buf[64];
if (size >= 64) {
send (server_accept, (void *) data, 64, MSG_NOSIGNAL);
data += 64;
size -= 64;
}
recv (server_accept, buf, 64, 0);
msleep (250);
for (ssize_t sent = 0; size > 0 && (sent != -1 || errno == EINTR);
size -= sent > 0 ? sent : 0, data += sent > 0 ? sent : 0)
sent = send (server_accept, (const char *) data, size, MSG_NOSIGNAL);
recv (server_accept, buf, 64, MSG_DONTWAIT);
msleep (250);
zmq_msg_t msg;
zmq_msg_init (&msg);
while (-1 != zmq_msg_recv (&msg, client, ZMQ_DONTWAIT))
zmq_msg_close (&msg);
close (server_accept);
close (server);
@ -69,8 +86,16 @@ extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
#ifndef ZMQ_USE_FUZZING_ENGINE
void test_connect_curve_fuzzer ()
{
TEST_ASSERT_SUCCESS_ERRNO (LLVMFuzzerTestOneInput (
zmtp_greeting_curve, sizeof (zmtp_greeting_curve)));
uint8_t *data;
size_t len;
if (fuzzer_corpus_encode (
"tests/fuzzer_corpora/test_connect_curve_fuzzer.txt", &data, &len)
!= 0)
exit (77);
TEST_ASSERT_SUCCESS_ERRNO (LLVMFuzzerTestOneInput (data, len));
free (data);
}
int main (int argc, char **argv)

33
tests/test_connect_null_fuzzer.cpp
View File

@ -42,16 +42,33 @@ extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
char my_endpoint[MAX_SOCKET_STRING];
fd_t server = bind_socket_resolve_port ("127.0.0.1", "0", my_endpoint);
void *client = test_context_socket (ZMQ_PUB);
void *client = test_context_socket (ZMQ_SUB);
TEST_ASSERT_SUCCESS_ERRNO (zmq_setsockopt (client, ZMQ_SUBSCRIBE, "", 0));
TEST_ASSERT_SUCCESS_ERRNO (zmq_connect (client, my_endpoint));
fd_t server_accept =
TEST_ASSERT_SUCCESS_RAW_ERRNO (accept (server, NULL, NULL));
// If there is not enough data for a full greeting, just send what we can
// Otherwise send greeting first, as expected by the protocol
uint8_t buf[64];
if (size >= 64) {
send (server_accept, (void *) data, 64, MSG_NOSIGNAL);
data += 64;
size -= 64;
}
recv (server_accept, buf, 64, 0);
msleep (250);
for (ssize_t sent = 0; size > 0 && (sent != -1 || errno == EINTR);
size -= sent > 0 ? sent : 0, data += sent > 0 ? sent : 0)
sent = send (server_accept, (const char *) data, size, MSG_NOSIGNAL);
msleep (250);
zmq_msg_t msg;
zmq_msg_init (&msg);
while (-1 != zmq_msg_recv (&msg, client, ZMQ_DONTWAIT))
zmq_msg_close (&msg);
close (server_accept);
close (server);
@ -64,13 +81,21 @@ extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
#ifndef ZMQ_USE_FUZZING_ENGINE
void test_connect_null_fuzzer ()
{
TEST_ASSERT_SUCCESS_ERRNO (
LLVMFuzzerTestOneInput (zmtp_greeting_null, sizeof (zmtp_greeting_null)));
uint8_t *data;
size_t len;
if (fuzzer_corpus_encode (
"tests/fuzzer_corpora/test_connect_null_fuzzer.txt", &data, &len)
!= 0)
exit (77);
TEST_ASSERT_SUCCESS_ERRNO (LLVMFuzzerTestOneInput (data, len));
free (data);
}
int main (int argc, char **argv)
{
setup_test_environment ();
setup_test_environment (0);
UNITY_BEGIN ();
RUN_TEST (test_connect_null_fuzzer);

31
tests/testutil.cpp
View File

@ -522,3 +522,34 @@ bool strneq (const char *lhs_, const char *rhs_)
{
return strcmp (lhs_, rhs_) != 0;
}
int fuzzer_corpus_encode (const char *filename, uint8_t **data, size_t *len)
{
TEST_ASSERT_NOT_NULL (filename);
TEST_ASSERT_NOT_NULL (data);
TEST_ASSERT_NOT_NULL (len);
FILE *f = fopen (filename, "r");
if (!f)
return -1;
fseek (f, 0, SEEK_END);
size_t text_len = ftell (f);
fseek (f, 0, SEEK_SET);
char *buf = (char *) malloc (text_len);
TEST_ASSERT_NOT_NULL (buf);
size_t read = fread (buf, 1, text_len, f);
fclose (f);
TEST_ASSERT_EQUAL_INT (read, text_len);
// Convert to binary format, corpus is stored in ascii (hex)
*len = text_len / 2;
*data = (unsigned char *) malloc (*len);
TEST_ASSERT_NOT_NULL (*data);
const char *pos = buf;
for (size_t count = 0; count < *len; ++count, pos += 2) {
char tmp[3] = {pos[0], pos[1], 0};
(*data)[count] = (uint8_t) strtol (tmp, NULL, 16);
}
free (buf);
return 0;
}

3
tests/testutil.hpp
View File

@ -44,6 +44,7 @@
#else
#include <arpa/inet.h>
#include <unistd.h>
#include <stdlib.h>
#endif
// This defines the settle time used in tests; raise this if we
@ -227,4 +228,6 @@ fd_t bind_socket_resolve_port (const char *address_,
const int af_ = AF_INET,
const int protocol_ = IPPROTO_TCP);
int fuzzer_corpus_encode (const char *filename, uint8_t **data, size_t *len);
#endif