libubox/tests/fuzz, branch master

tests: add fuzzer seed file for crash in blob_len

2020-05-26T07:48:07Z

Following regression was introduced in commit 5e75160f4878 ("blobmsg: fix attrs iteration in the blobmsg_check_array_len()"): Thread 1 "test-fuzz" received signal SIGSEGV, Segmentation fault. in blob_len (attr=0x6020000100d4) at libubox/blob.h:102 102 return (be32_to_cpu(attr->id_len) & BLOB_ATTR_LEN_MASK) - sizeof(struct blob_attr); blob_len (attr=0x6020000100d4) at /libubox/blob.h:102 blob_raw_len (attr=0x6020000100d4) at /libubox/blob.h:111 blob_pad_len (attr=0x6020000100d4) at /libubox/blob.h:120 blobmsg_check_array_len (attr=0x6020000000d0, type=0, blob_len=10) at /libubox/blobmsg.c:145 fuzz_blobmsg_parse (data=0x6020000000d0 "\001\004", size=10) at /libubox/tests/fuzz/test-fuzz.c:57 Signed-off-by: Petr Štetiar

blobmsg: blobmsg_parse and blobmsg_parse_array oob read fixes

2020-01-20T15:54:10Z

Fix out of bounds read in blobmsg_parse and blobmsg_check_name. The out of bounds read happens because blob_attr and blobmsg_hdr have flexible array members, whose size is 0 in the corresponding sizeofs. For example the __blob_for_each_attr macro checks whether rem >= sizeof(struct blob_attr). However, what LibFuzzer discovered was, if the input data was only 4 bytes, the data would be casted to blob_attr, and later on blob_data(attr) would be called even though attr->data was empty. The same issue could appear with data larger than 4 bytes, where data wasn't empty, but contained only the start of the blobmsg_hdr struct, and blobmsg_hdr name was empty. The bugs were discovered by fuzzing blobmsg_parse and blobmsg_array_parse with LibFuzzer. CC: Luka Perkov Reviewed-by: Jo-Philipp Wich Signed-off-by: Juraj Vijtiuk [refactored some checks, added fuzz inputs, adjusted unit test results] Signed-off-by: Petr Štetiar

tests: prefer dynamically allocated buffers

2020-01-20T15:54:10Z

Help detecting Valgrind OOB reads and other issues. Conditional jump or move depends on uninitialised value(s) at 0x5452886: blobmsg_parse (blobmsg.c:203) by 0x400A8E: test_blobmsg (tests/test-blobmsg-parse.c:66) by 0x400A8E: main (tests/test-blobmsg-parse.c:82) Conditional jump or move depends on uninitialised value(s) at 0x545247F: blobmsg_check_name (blobmsg.c:39) by 0x545247F: blobmsg_check_attr_len (blobmsg.c:79) by 0x5452710: blobmsg_parse_array (blobmsg.c:159) by 0x400AB8: test_blobmsg (tests/test-blobmsg-parse.c:69) by 0x400AB8: main (tests/test-blobmsg-parse.c:82) Conditional jump or move depends on uninitialised value(s) at 0x54524A0: blobmsg_check_name (blobmsg.c:42) by 0x54524A0: blobmsg_check_attr_len (blobmsg.c:79) by 0x5452710: blobmsg_parse_array (blobmsg.c:159) by 0x400AB8: test_blobmsg (tests/test-blobmsg-parse.c:69) by 0x400AB8: main (tests/test-blobmsg-parse.c:82) Ref: http://lists.infradead.org/pipermail/openwrt-devel/2020-January/021204.html Signed-off-by: Petr Štetiar

tests: fuzz: fuzz _len variants of checking methods

2019-12-25T09:31:58Z

In order to increase test coverage. Signed-off-by: Petr Štetiar

test: fuzz: add blobmsg_check_attr crashes

2019-12-25T09:31:58Z

==31775==ERROR: AddressSanitizer: SEGV on unknown address 0x604000a7c715 ==31775==The signal is caused by a READ memory access. #0 blobmsg_check_attr blobmsg.c:48:6 #1 blobmsg_parse_array blobmsg.c:118:8 #2 fuzz_blobmsg_parse test-blobmsg-parse-fuzzer.c:35:2 Signed-off-by: Petr Štetiar

blob: fix OOB access in blob_check_type

2019-12-25T09:31:58Z

Found by fuzzer: ERROR: AddressSanitizer: SEGV on unknown address 0x602100000455 The signal is caused by a READ memory access. #0 in blob_check_type blob.c:214:43 #1 in blob_parse_attr blob.c:234:9 #2 in blob_parse_untrusted blob.c:272:12 #3 in fuzz_blob_parse tests/fuzzer/test-blob-parse-fuzzer.c:34:2 #4 in LLVMFuzzerTestOneInput tests/fuzzer/test-blob-parse-fuzzer.c:39:2 Caused by following line: if (type == BLOB_ATTR_STRING && data[len - 1] != 0) where len was pointing outside of the data buffer. Signed-off-by: Petr Štetiar

tests: use blob_parse_untrusted variant

2019-12-25T09:31:58Z

In order to be able to use invalid input for testing as well. Signed-off-by: Petr Štetiar

test: fuzz: add blob_parse crashes

2019-12-25T09:31:58Z

==5872==ERROR: AddressSanitizer: SEGV on unknown address 0x6020004100b4 ==5872==The signal is caused by a READ memory access. #0 blob_data blob.h #1 blob_parse blob.c:228:2 Signed-off-by: Petr Štetiar

tests: add libFuzzer based tests

2019-12-25T09:31:58Z

LibFuzzer is in-process, coverage-guided, evolutionary fuzzing engine. LibFuzzer is linked with the library under test, and feeds fuzzed inputs to the library via a specific fuzzing entrypoint (aka "target function"); the fuzzer then tracks which areas of the code are reached, and generates mutations on the corpus of input data in order to maximize the code coverage. Lets use libFuzzer to fuzz blob and blobmsg parsing for the start. Ref: https://llvm.org/docs/LibFuzzer.html Signed-off-by: Petr Štetiar