|
 |
c2dfb7 |
From 242273e1afd456e86ebc48d7d601cb28297f8efb Mon Sep 17 00:00:00 2001
|
|
|
c2dfb7 |
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
|
|
|
c2dfb7 |
Date: Tue, 30 Oct 2018 09:02:26 +0100
|
|
|
c2dfb7 |
Subject: [PATCH] fuzz-compress: add fuzzer for compression and decompression
|
|
|
c2dfb7 |
|
|
|
c2dfb7 |
(cherry picked from commit 029427043b2e0523a21f54374f872b23cf744350)
|
|
|
c2dfb7 |
Resolves: #1843871
|
|
|
c2dfb7 |
---
|
|
|
c2dfb7 |
src/fuzz/fuzz-compress.c | 80 ++++++++++++++++++++++++++++++++++++++++
|
|
|
c2dfb7 |
src/fuzz/meson.build | 7 +++-
|
|
|
c2dfb7 |
2 files changed, 86 insertions(+), 1 deletion(-)
|
|
|
c2dfb7 |
create mode 100644 src/fuzz/fuzz-compress.c
|
|
|
c2dfb7 |
|
|
|
c2dfb7 |
diff --git a/src/fuzz/fuzz-compress.c b/src/fuzz/fuzz-compress.c
|
|
|
c2dfb7 |
new file mode 100644
|
|
|
c2dfb7 |
index 0000000000..9c5dfc92c0
|
|
|
c2dfb7 |
--- /dev/null
|
|
|
c2dfb7 |
+++ b/src/fuzz/fuzz-compress.c
|
|
|
c2dfb7 |
@@ -0,0 +1,80 @@
|
|
|
c2dfb7 |
+/* SPDX-License-Identifier: LGPL-2.1+ */
|
|
|
c2dfb7 |
+
|
|
|
c2dfb7 |
+#include <errno.h>
|
|
|
c2dfb7 |
+
|
|
|
c2dfb7 |
+#include "alloc-util.h"
|
|
|
c2dfb7 |
+#include "compress.h"
|
|
|
c2dfb7 |
+#include "fuzz.h"
|
|
|
c2dfb7 |
+
|
|
|
c2dfb7 |
+static int compress(int alg,
|
|
|
c2dfb7 |
+ const void *src, uint64_t src_size,
|
|
|
c2dfb7 |
+ void *dst, size_t dst_alloc_size, size_t *dst_size) {
|
|
|
c2dfb7 |
+
|
|
|
c2dfb7 |
+ if (alg == OBJECT_COMPRESSED_LZ4)
|
|
|
c2dfb7 |
+ return compress_blob_lz4(src, src_size, dst, dst_alloc_size, dst_size);
|
|
|
c2dfb7 |
+ if (alg == OBJECT_COMPRESSED_XZ)
|
|
|
c2dfb7 |
+ return compress_blob_xz(src, src_size, dst, dst_alloc_size, dst_size);
|
|
|
c2dfb7 |
+ return -EOPNOTSUPP;
|
|
|
c2dfb7 |
+}
|
|
|
c2dfb7 |
+
|
|
|
c2dfb7 |
+typedef struct header {
|
|
|
c2dfb7 |
+ uint32_t alg:2; /* We have only two compression algorithms so far, but we might add
|
|
|
c2dfb7 |
+ * more in the future. Let's make this a bit wider so our fuzzer
|
|
|
c2dfb7 |
+ * cases remain stable in the future. */
|
|
|
c2dfb7 |
+ uint32_t sw_len;
|
|
|
c2dfb7 |
+ uint32_t sw_alloc;
|
|
|
c2dfb7 |
+ uint32_t reserved[3]; /* Extra space to keep fuzz cases stable in case we need to
|
|
|
c2dfb7 |
+ * add stuff in the future. */
|
|
|
c2dfb7 |
+ uint8_t data[];
|
|
|
c2dfb7 |
+} header;
|
|
|
c2dfb7 |
+
|
|
|
c2dfb7 |
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
|
|
c2dfb7 |
+ _cleanup_free_ void *buf = NULL, *buf2 = NULL;
|
|
|
c2dfb7 |
+ int r;
|
|
|
c2dfb7 |
+
|
|
|
c2dfb7 |
+ if (size < offsetof(header, data) + 1)
|
|
|
c2dfb7 |
+ return 0;
|
|
|
c2dfb7 |
+
|
|
|
c2dfb7 |
+ const header *h = (struct header*) data;
|
|
|
c2dfb7 |
+ const size_t data_len = size - offsetof(header, data);
|
|
|
c2dfb7 |
+
|
|
|
c2dfb7 |
+ int alg = h->alg;
|
|
|
c2dfb7 |
+
|
|
|
c2dfb7 |
+ /* We don't want to fill the logs with messages about parse errors.
|
|
|
c2dfb7 |
+ * Disable most logging if not running standalone */
|
|
|
c2dfb7 |
+ if (!getenv("SYSTEMD_LOG_LEVEL"))
|
|
|
c2dfb7 |
+ log_set_max_level(LOG_CRIT);
|
|
|
c2dfb7 |
+
|
|
|
c2dfb7 |
+ log_info("Using compression %s, data size=%zu",
|
|
|
c2dfb7 |
+ object_compressed_to_string(alg) ?: "(none)",
|
|
|
c2dfb7 |
+ data_len);
|
|
|
c2dfb7 |
+
|
|
|
c2dfb7 |
+ buf = malloc(MAX(size, 128u)); /* Make the buffer a bit larger for very small data */
|
|
|
c2dfb7 |
+ if (!buf) {
|
|
|
c2dfb7 |
+ log_oom();
|
|
|
c2dfb7 |
+ return 0;
|
|
|
c2dfb7 |
+ }
|
|
|
c2dfb7 |
+
|
|
|
c2dfb7 |
+ size_t csize;
|
|
|
c2dfb7 |
+ r = compress(alg, h->data, data_len, buf, size, &csize);
|
|
|
c2dfb7 |
+ if (r < 0) {
|
|
|
c2dfb7 |
+ log_error_errno(r, "Compression failed: %m");
|
|
|
c2dfb7 |
+ return 0;
|
|
|
c2dfb7 |
+ }
|
|
|
c2dfb7 |
+
|
|
|
c2dfb7 |
+ log_debug("Compressed %zu bytes to → %zu bytes", data_len, csize);
|
|
|
c2dfb7 |
+
|
|
|
c2dfb7 |
+ size_t sw_alloc = MAX(h->sw_alloc, 1u);
|
|
|
c2dfb7 |
+ buf2 = malloc(sw_alloc);
|
|
|
c2dfb7 |
+ if (!buf) {
|
|
|
c2dfb7 |
+ log_oom();
|
|
|
c2dfb7 |
+ return 0;
|
|
|
c2dfb7 |
+ }
|
|
|
c2dfb7 |
+
|
|
|
c2dfb7 |
+ size_t sw_len = MIN(data_len - 1, h->sw_len);
|
|
|
c2dfb7 |
+
|
|
|
c2dfb7 |
+ r = decompress_startswith(alg, buf, csize, &buf2, &sw_alloc, h->data, sw_len, h->data[sw_len]);
|
|
|
c2dfb7 |
+ assert_se(r > 0);
|
|
|
c2dfb7 |
+
|
|
|
c2dfb7 |
+ return 0;
|
|
|
c2dfb7 |
+}
|
|
|
c2dfb7 |
diff --git a/src/fuzz/meson.build b/src/fuzz/meson.build
|
|
|
c2dfb7 |
index 5315d2771c..b8d5979d3c 100644
|
|
|
c2dfb7 |
--- a/src/fuzz/meson.build
|
|
|
c2dfb7 |
+++ b/src/fuzz/meson.build
|
|
|
c2dfb7 |
@@ -73,8 +73,13 @@ fuzzers += [
|
|
|
c2dfb7 |
[libsystemd_journal_remote,
|
|
|
c2dfb7 |
libshared],
|
|
|
c2dfb7 |
[]],
|
|
|
c2dfb7 |
+
|
|
|
c2dfb7 |
[['src/fuzz/fuzz-fido-id-desc.c',
|
|
|
c2dfb7 |
'src/udev/fido_id/fido_id_desc.c'],
|
|
|
c2dfb7 |
[],
|
|
|
c2dfb7 |
- []]
|
|
|
c2dfb7 |
+ []],
|
|
|
c2dfb7 |
+
|
|
|
c2dfb7 |
+ [['src/fuzz/fuzz-compress.c'],
|
|
|
c2dfb7 |
+ [libshared],
|
|
|
c2dfb7 |
+ []],
|
|
|
c2dfb7 |
]
|