Problem: fuzzer regression tests do very little

Solution: run them with the seed corpora

tests/test_bind_curve_fuzzer.cpp

@@ -50,6 +50,22 @@ extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
                                    my_endpoint);
     fd_t client = connect_socket (my_endpoint);
 
+    //  If there is not enough data for a full greeting, just send what we can
+    //  Otherwise send greeting first, as expected by the protocol
+    uint8_t buf[64];
+    if (size >= 64) {
+        send (client, (void *) data, 64, MSG_NOSIGNAL);
+        data += 64;
+        size -= 64;
+    }
+    recv (client, buf, 64, 0);
+    if (size >= 202) {
+        send (client, (void *) data, 202, MSG_NOSIGNAL);
+        data += 202;
+        size -= 202;
+    }
+    recv (client, buf, 64, MSG_DONTWAIT);
+    msleep (250);
     for (ssize_t sent = 0; size > 0 && (sent != -1 || errno == EINTR);
          size -= sent > 0 ? sent : 0, data += sent > 0 ? sent : 0)
         sent = send (client, (const char *) data, size, MSG_NOSIGNAL);
@@ -66,8 +82,16 @@ extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
 #ifndef ZMQ_USE_FUZZING_ENGINE
 void test_bind_curve_fuzzer ()
 {
-    TEST_ASSERT_SUCCESS_ERRNO (LLVMFuzzerTestOneInput (
+    uint8_t *data;
-      zmtp_greeting_curve, sizeof (zmtp_greeting_curve)));
+    size_t len;
+    if (fuzzer_corpus_encode ("tests/fuzzer_corpora/test_bind_curve_fuzzer.txt",
+                              &data, &len)
+        != 0)
+        exit (77);
+
+    TEST_ASSERT_SUCCESS_ERRNO (LLVMFuzzerTestOneInput (data, len));
+
+    free (data);
 }
 
 int main (int argc, char **argv)

tests/test_bind_null_fuzzer.cpp

@@ -44,6 +44,16 @@ extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
     bind_loopback_ipv4 (server, my_endpoint, sizeof (my_endpoint));
     fd_t client = connect_socket (my_endpoint);
 
+    //  If there is not enough data for a full greeting, just send what we can
+    //  Otherwise send greeting first, as expected by the protocol
+    uint8_t buf[64];
+    if (size >= 64) {
+        send (client, (void *) data, 64, MSG_NOSIGNAL);
+        data += 64;
+        size -= 64;
+    }
+    recv (client, buf, 64, 0);
+    msleep (250);
     for (ssize_t sent = 0; size > 0 && (sent != -1 || errno == EINTR);
          size -= sent > 0 ? sent : 0, data += sent > 0 ? sent : 0)
         sent = send (client, (const char *) data, size, MSG_NOSIGNAL);
@@ -60,8 +70,16 @@ extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
 #ifndef ZMQ_USE_FUZZING_ENGINE
 void test_bind_null_fuzzer ()
 {
-    TEST_ASSERT_SUCCESS_ERRNO (
+    uint8_t *data;
-      LLVMFuzzerTestOneInput (zmtp_greeting_null, sizeof (zmtp_greeting_null)));
+    size_t len;
+    if (fuzzer_corpus_encode ("tests/fuzzer_corpora/test_bind_null_fuzzer.txt",
+                              &data, &len)
+        != 0)
+        exit (77);
+
+    TEST_ASSERT_SUCCESS_ERRNO (LLVMFuzzerTestOneInput (data, len));
+
+    free (data);
 }
 
 int main (int argc, char **argv)

tests/test_connect_curve_fuzzer.cpp

@@ -51,11 +51,28 @@ extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
 
     fd_t server_accept =
       TEST_ASSERT_SUCCESS_RAW_ERRNO (accept (server, NULL, NULL));
+
+    //  If there is not enough data for a full greeting, just send what we can
+    //  Otherwise send greeting first, as expected by the protocol
+    uint8_t buf[64];
+    if (size >= 64) {
+        send (server_accept, (void *) data, 64, MSG_NOSIGNAL);
+        data += 64;
+        size -= 64;
+    }
+    recv (server_accept, buf, 64, 0);
+    msleep (250);
     for (ssize_t sent = 0; size > 0 && (sent != -1 || errno == EINTR);
          size -= sent > 0 ? sent : 0, data += sent > 0 ? sent : 0)
         sent = send (server_accept, (const char *) data, size, MSG_NOSIGNAL);
+    recv (server_accept, buf, 64, MSG_DONTWAIT);
     msleep (250);
 
+    zmq_msg_t msg;
+    zmq_msg_init (&msg);
+    while (-1 != zmq_msg_recv (&msg, client, ZMQ_DONTWAIT))
+        zmq_msg_close (&msg);
+
     close (server_accept);
     close (server);
 
@@ -69,8 +86,16 @@ extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
 #ifndef ZMQ_USE_FUZZING_ENGINE
 void test_connect_curve_fuzzer ()
 {
-    TEST_ASSERT_SUCCESS_ERRNO (LLVMFuzzerTestOneInput (
+    uint8_t *data;
-      zmtp_greeting_curve, sizeof (zmtp_greeting_curve)));
+    size_t len;
+    if (fuzzer_corpus_encode (
+          "tests/fuzzer_corpora/test_connect_curve_fuzzer.txt", &data, &len)
+        != 0)
+        exit (77);
+
+    TEST_ASSERT_SUCCESS_ERRNO (LLVMFuzzerTestOneInput (data, len));
+
+    free (data);
 }
 
 int main (int argc, char **argv)

tests/test_connect_null_fuzzer.cpp

@@ -42,16 +42,33 @@ extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
     char my_endpoint[MAX_SOCKET_STRING];
     fd_t server = bind_socket_resolve_port ("127.0.0.1", "0", my_endpoint);
 
-    void *client = test_context_socket (ZMQ_PUB);
+    void *client = test_context_socket (ZMQ_SUB);
+    TEST_ASSERT_SUCCESS_ERRNO (zmq_setsockopt (client, ZMQ_SUBSCRIBE, "", 0));
     TEST_ASSERT_SUCCESS_ERRNO (zmq_connect (client, my_endpoint));
 
     fd_t server_accept =
       TEST_ASSERT_SUCCESS_RAW_ERRNO (accept (server, NULL, NULL));
+
+    //  If there is not enough data for a full greeting, just send what we can
+    //  Otherwise send greeting first, as expected by the protocol
+    uint8_t buf[64];
+    if (size >= 64) {
+        send (server_accept, (void *) data, 64, MSG_NOSIGNAL);
+        data += 64;
+        size -= 64;
+    }
+    recv (server_accept, buf, 64, 0);
+    msleep (250);
     for (ssize_t sent = 0; size > 0 && (sent != -1 || errno == EINTR);
          size -= sent > 0 ? sent : 0, data += sent > 0 ? sent : 0)
         sent = send (server_accept, (const char *) data, size, MSG_NOSIGNAL);
     msleep (250);
 
+    zmq_msg_t msg;
+    zmq_msg_init (&msg);
+    while (-1 != zmq_msg_recv (&msg, client, ZMQ_DONTWAIT))
+        zmq_msg_close (&msg);
+
     close (server_accept);
     close (server);
 
@@ -64,13 +81,21 @@ extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
 #ifndef ZMQ_USE_FUZZING_ENGINE
 void test_connect_null_fuzzer ()
 {
-    TEST_ASSERT_SUCCESS_ERRNO (
+    uint8_t *data;
-      LLVMFuzzerTestOneInput (zmtp_greeting_null, sizeof (zmtp_greeting_null)));
+    size_t len;
+    if (fuzzer_corpus_encode (
+          "tests/fuzzer_corpora/test_connect_null_fuzzer.txt", &data, &len)
+        != 0)
+        exit (77);
+
+    TEST_ASSERT_SUCCESS_ERRNO (LLVMFuzzerTestOneInput (data, len));
+
+    free (data);
 }
 
 int main (int argc, char **argv)
 {
-    setup_test_environment ();
+    setup_test_environment (0);
 
     UNITY_BEGIN ();
     RUN_TEST (test_connect_null_fuzzer);

tests/testutil.cpp

@@ -522,3 +522,34 @@ bool strneq (const char *lhs_, const char *rhs_)
 {
     return strcmp (lhs_, rhs_) != 0;
 }
+
+int fuzzer_corpus_encode (const char *filename, uint8_t **data, size_t *len)
+{
+    TEST_ASSERT_NOT_NULL (filename);
+    TEST_ASSERT_NOT_NULL (data);
+    TEST_ASSERT_NOT_NULL (len);
+    FILE *f = fopen (filename, "r");
+    if (!f)
+        return -1;
+    fseek (f, 0, SEEK_END);
+    size_t text_len = ftell (f);
+    fseek (f, 0, SEEK_SET);
+    char *buf = (char *) malloc (text_len);
+    TEST_ASSERT_NOT_NULL (buf);
+    size_t read = fread (buf, 1, text_len, f);
+    fclose (f);
+    TEST_ASSERT_EQUAL_INT (read, text_len);
+
+    //  Convert to binary format, corpus is stored in ascii (hex)
+    *len = text_len / 2;
+    *data = (unsigned char *) malloc (*len);
+    TEST_ASSERT_NOT_NULL (*data);
+    const char *pos = buf;
+    for (size_t count = 0; count < *len; ++count, pos += 2) {
+        char tmp[3] = {pos[0], pos[1], 0};
+        (*data)[count] = (uint8_t) strtol (tmp, NULL, 16);
+    }
+    free (buf);
+
+    return 0;
+}

tests/testutil.hpp

@@ -44,6 +44,7 @@
 #else
 #include <arpa/inet.h>
 #include <unistd.h>
+#include <stdlib.h>
 #endif
 
 //  This defines the settle time used in tests; raise this if we
@@ -227,4 +228,6 @@ fd_t bind_socket_resolve_port (const char *address_,
                                const int af_ = AF_INET,
                                const int protocol_ = IPPROTO_TCP);
 
+int fuzzer_corpus_encode (const char *filename, uint8_t **data, size_t *len);
+
 #endif