aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMark Haines <mjark@negativecurvature.net>2016-05-25 14:32:03 +0100
committerMark Haines <mjark@negativecurvature.net>2016-05-25 14:32:03 +0100
commit024685f3db2be6c4cfb55670ecc92d8d1a0c9a8d (patch)
tree7e3c0f523052df89a447aedbc7481a40d462b9b9
parent8d31f42b1e5fd198918166edeec61f57059c6db9 (diff)
parentf47aabd094a4eafeed5a510c650d7a063a148076 (diff)
Merge branch 'markjh/fuzzingII'
-rw-r--r--Makefile52
-rw-r--r--fuzzers/fuzz_decode_message.cpp14
-rw-r--r--fuzzers/fuzz_decrypt.cpp64
-rw-r--r--fuzzers/fuzz_unpickle_account.cpp14
-rw-r--r--fuzzers/fuzz_unpickle_session.cpp14
-rw-r--r--fuzzers/include/fuzzing.hh72
6 files changed, 227 insertions, 3 deletions
diff --git a/Makefile b/Makefile
index 4d265bf..8594946 100644
--- a/Makefile
+++ b/Makefile
@@ -4,8 +4,11 @@ BUILD_DIR := build
RELEASE_OPTIMIZE_FLAGS ?= -g -O3
DEBUG_OPTIMIZE_FLAGS ?= -g -O0
JS_OPTIMIZE_FLAGS ?= -O3
+FUZZING_OPTIMIZE_FLAGS ?= -O3
CC = gcc
EMCC = emcc
+AFL_CC = afl_gcc
+AFL_CXX = afl-g++
RELEASE_TARGET := $(BUILD_DIR)/libolm.so
DEBUG_TARGET := $(BUILD_DIR)/libolm_debug.so
JS_TARGET := javascript/olm.js
@@ -17,6 +20,10 @@ PUBLIC_HEADERS := include/olm/olm.h
SOURCES := $(wildcard src/*.cpp) $(wildcard src/*.c)
RELEASE_OBJECTS := $(patsubst src/%,$(BUILD_DIR)/release/%,$(patsubst %.c,%.o,$(patsubst %.cpp,%.o,$(SOURCES))))
DEBUG_OBJECTS := $(patsubst src/%,$(BUILD_DIR)/debug/%,$(patsubst %.c,%.o,$(patsubst %.cpp,%.o,$(SOURCES))))
+FUZZER_OBJECTS := $(patsubst src/%,$(BUILD_DIR)/fuzzers/objects/%,$(patsubst %.c,%.o,$(patsubst %.cpp,%.o,$(SOURCES))))
+FUZZER_SOURCES := $(wildcard fuzzers/fuzz_*.cpp) $(wildcard fuzzers/fuzz_*.c)
+FUZZER_BINARIES := $(patsubst fuzzers/%,$(BUILD_DIR)/fuzzers/%,$(patsubst %.c,%,$(patsubst %.cpp,%,$(FUZZER_SOURCES))))
+FUZZER_DEBUG_BINARIES := $(patsubst $(BUILD_DIR)/fuzzers/fuzz_%,$(BUILD_DIR)/fuzzers/debug_%,$(FUZZER_BINARIES))
TEST_SOURCES := $(wildcard tests/test_*.cpp) $(wildcard tests/test_*.c)
TEST_BINARIES := $(patsubst tests/%,$(BUILD_DIR)/tests/%,$(patsubst %.c,%,$(patsubst %.cpp,%,$(TEST_SOURCES))))
JS_OBJECTS := $(patsubst src/%,$(BUILD_DIR)/javascript/%,$(patsubst %.c,%.js.bc,$(patsubst %.cpp,%.js.bc,$(SOURCES))))
@@ -37,6 +44,11 @@ EMCC.c = $(EMCC) $(CFLAGS) $(CPPFLAGS) -c
EMCC.cc = $(EMCC) $(CXXFLAGS) $(CPPFLAGS) -c
EMCC_LINK = $(EMCC) $(LDFLAGS) $(EMCCFLAGS)
+AFL.c = $(AFL_CC) $(CFLAGS) $(CPPFLAGS) -c
+AFL.cc = $(AFL_CXX) $(CXXFLAGS) $(CPPFLAGS) -c
+AFL_LINK.c = $(AFL_CC) $(LDFLAGS) $(CFLAGS) $(CPPFLAGS)
+AFL_LINK.cc = $(AFL_CXX) $(LDFLAGS) $(CXXFLAGS) $(CPPFLAGS)
+
# generate .d files when compiling
CPPFLAGS += -MMD
@@ -53,6 +65,13 @@ $(DEBUG_TARGET): LDFLAGS += $(DEBUG_OPTIMIZE_FLAGS)
$(TEST_BINARIES): CPPFLAGS += -Itests/include
$(TEST_BINARIES): LDFLAGS += $(DEBUG_OPTIMIZE_FLAGS) -L$(BUILD_DIR)
+$(FUZZER_OBJECTS): CFLAGS += $(FUZZER_OPTIMIZE_FLAGS)
+$(FUZZER_OBJECTS): CXXFLAGS += $(FUZZER_OPTIMIZE_FLAGS)
+$(FUZZER_BINARIES): CPPFLAGS += -Ifuzzers/include
+$(FUZZER_BINARIES): LDFLAGS += $(FUZZER_OPTIMIZE_FLAGS) -L$(BUILD_DIR)
+$(FUZZER_DEBUG_BINARIES): CPPFLAGS += -Ifuzzers/include
+$(FUZZER_DEBUG_BINARIES): LDFLAGS += $(DEBUG_OPTIMIZE_FLAGS)
+
$(JS_OBJECTS): CFLAGS += $(JS_OPTIMIZE_FLAGS)
$(JS_OBJECTS): CXXFLAGS += $(JS_OPTIMIZE_FLAGS)
$(JS_TARGET): LDFLAGS += $(JS_OPTIMIZE_FLAGS)
@@ -65,9 +84,11 @@ lib: $(RELEASE_TARGET)
# Make sure that the build directory exists.
# We can't check the build directory into git because it is empty.
makedirs:
- mkdir -p $(BUILD_DIR)/release $(BUILD_DIR)/debug $(BUILD_DIR)/javascript $(BUILD_DIR)/tests
+ mkdir -p $(BUILD_DIR)/release $(BUILD_DIR)/debug $(BUILD_DIR)/javascript\
+ $(BUILD_DIR)/tests $(BUILD_DIR)/fuzzers/objects
.PHONY: makedirs
+
$(RELEASE_TARGET): $(RELEASE_OBJECTS)
$(CXX) $(LDFLAGS) --shared -fPIC \
-Wl,--version-script,version_script.ver \
@@ -81,7 +102,6 @@ $(DEBUG_TARGET): $(DEBUG_OBJECTS)
-Wl,--version-script,version_script.ver \
$(OUTPUT_OPTION) $(DEBUG_OBJECTS)
-
js: $(JS_TARGET)
.PHONY: js
@@ -96,8 +116,11 @@ clean:;
$(DEBUG_OBJECTS) $(DEBUG_OBJECTS:.o=.d) \
$(TEST_BINARIES) $(TEST_BINARIES:=.d) \
$(JS_OBJECTS) $(JS_OBJECTS:.bc=.d) $(JS_TARGET) \
- $(JS_EXPORTED_FUNCTIONS) \
+ $(JS_EXPORTED_FUNCTIONS)\
$(RELEASE_TARGET) $(DEBUG_TARGET)\
+ $(FUZZER_OBJECTS) $(FUZZER_OBJECTS:.o=.d)\
+ $(FUZZER_BINARIES) $(FUZZER_BINARIES:=.d)\
+ $(FUZZER_DEBUG_BINARIES) $(FUZZER_DEBUG_BINARIES:=.d)\
build_tests: $(TEST_BINARIES)
@@ -107,6 +130,9 @@ test: build_tests
$$i || exit $$?; \
done
+fuzzers: $(FUZZER_BINARIES) $(FUZZER_DEBUG_BINARIES)
+.PHONY: fuzzers
+
$(JS_EXPORTED_FUNCTIONS): $(PUBLIC_HEADERS)
perl -MJSON -ne '/(olm_[^( ]*)\(/ && push @f, "_$$1"; END { print encode_json \@f }' $^ > $@.tmp
mv $@.tmp $@
@@ -139,6 +165,23 @@ $(BUILD_DIR)/tests/%: tests/%.c $(DEBUG_OBJECTS)
$(BUILD_DIR)/tests/%: tests/%.cpp $(DEBUG_OBJECTS)
$(LINK.cc) $< $(DEBUG_OBJECTS) $(LOADLIBES) $(LDLIBS) -o $@
+$(BUILD_DIR)/fuzzers/objects/%.o: src/%.c | makedirs
+ $(AFL.c) $(OUTPUT_OPTION) $<
+
+$(BUILD_DIR)/fuzzers/objects/%.o: src/%.cpp | makedirs
+ $(AFL.cc) $(OUTPUT_OPTION) $<
+
+$(BUILD_DIR)/fuzzers/fuzz_%: fuzzers/fuzz_%.c $(FUZZER_OBJECTS)
+ $(AFL_LINK.c) $< $(FUZZER_OBJECTS) $(LOADLIBES) $(LDLIBS) -o $@
+
+$(BUILD_DIR)/fuzzers/fuzz_%: fuzzers/fuzz_%.cpp $(FUZZER_OBJECTS)
+ $(AFL_LINK.cc) $< $(FUZZER_OBJECTS) $(LOADLIBES) $(LDLIBS) -o $@
+
+$(BUILD_DIR)/fuzzers/debug_%: fuzzers/fuzz_%.c $(DEBUG_OBJECTS)
+ $(LINK.c) $< $(DEBUG_OBJECTS) $(LOADLIBES) $(LDLIBS) -o $@
+
+$(BUILD_DIR)/fuzzers/debug_%: fuzzers/fuzz_%.cpp $(DEBUG_OBJECTS)
+ $(LINK.cc) $< $(DEBUG_OBJECTS) $(LOADLIBES) $(LDLIBS) -o $@
### dependencies
@@ -146,3 +189,6 @@ $(BUILD_DIR)/tests/%: tests/%.cpp $(DEBUG_OBJECTS)
-include $(DEBUG_OBJECTS:.o=.d)
-include $(JS_OBJECTS:.bc=.d)
-include $(TEST_BINARIES:=.d)
+-include $(FUZZER_OBJECTS:.o=.d)
+-include $(FUZZER_BINARIES:=.d)
+-include $(FUZZER_DEBUG_BINARIES:=.d)
diff --git a/fuzzers/fuzz_decode_message.cpp b/fuzzers/fuzz_decode_message.cpp
new file mode 100644
index 0000000..2ef734c
--- /dev/null
+++ b/fuzzers/fuzz_decode_message.cpp
@@ -0,0 +1,14 @@
+#include "olm/message.hh"
+#include "fuzzing.hh"
+
+int main(int argc, const char *argv[]) {
+ int message_fd = STDIN_FILENO;
+ uint8_t * message_buffer;
+ ssize_t message_length = check_errno(
+ "Error reading message file", read_file(message_fd, &message_buffer)
+ );
+ olm::MessageReader * reader = new olm::MessageReader;
+ decode_message(*reader, message_buffer, message_length, 8);
+ free(message_buffer);
+ delete reader;
+}
diff --git a/fuzzers/fuzz_decrypt.cpp b/fuzzers/fuzz_decrypt.cpp
new file mode 100644
index 0000000..6116934
--- /dev/null
+++ b/fuzzers/fuzz_decrypt.cpp
@@ -0,0 +1,64 @@
+#include "olm/olm.hh"
+
+#include "fuzzing.hh"
+
+int main(int argc, const char *argv[]) {
+ size_t ignored;
+ if (argc <= 3) {
+ const char * message = "Usage: decrypt: <session_key> <session_file>"
+ " <message_type>\n";
+ ignored = write(STDERR_FILENO, message, strlen(message));
+ exit(3);
+ }
+
+ const char * key = argv[1];
+ size_t key_length = strlen(key);
+
+
+ int session_fd = check_errno(
+ "Error opening session file", open(argv[2], O_RDONLY)
+ );
+
+ int message_type = atoi(argv[3]);
+
+ uint8_t *session_buffer;
+ ssize_t session_length = check_errno(
+ "Error reading session file", read_file(session_fd, &session_buffer)
+ );
+
+ int message_fd = STDIN_FILENO;
+ uint8_t * message_buffer;
+ ssize_t message_length = check_errno(
+ "Error reading message file", read_file(message_fd, &message_buffer)
+ );
+
+ uint8_t * tmp_buffer = (uint8_t *) malloc(message_length);
+ memcpy(tmp_buffer, message_buffer, message_length);
+
+ uint8_t session_memory[olm_session_size()];
+ OlmSession * session = olm_session(session_memory);
+ check_session(session, "Error unpickling session", olm_unpickle_session(
+ session, key, key_length, session_buffer, session_length
+ ));
+
+ size_t max_length = check_session(
+ session,
+ "Error getting plaintext length",
+ olm_decrypt_max_plaintext_length(
+ session, message_type, tmp_buffer, message_length
+ )
+ );
+
+ uint8_t plaintext[max_length];
+
+ size_t length = check_session(
+ session, "Error decrypting message", olm_decrypt(
+ session, message_type,
+ message_buffer, message_length,
+ plaintext, max_length
+ )
+ );
+
+ ignored = write(STDOUT_FILENO, plaintext, length);
+ ignored = write(STDOUT_FILENO, "\n", 1);
+}
diff --git a/fuzzers/fuzz_unpickle_account.cpp b/fuzzers/fuzz_unpickle_account.cpp
new file mode 100644
index 0000000..12c6d9b
--- /dev/null
+++ b/fuzzers/fuzz_unpickle_account.cpp
@@ -0,0 +1,14 @@
+#include "olm/account.hh"
+#include "fuzzing.hh"
+
+int main(int argc, const char *argv[]) {
+ int pickle_fd = STDIN_FILENO;
+ uint8_t * pickle_buffer;
+ ssize_t pickle_length = check_errno(
+ "Error reading pickle file", read_file(pickle_fd, &pickle_buffer)
+ );
+ olm::Account * account = new olm::Account;
+ unpickle(pickle_buffer, pickle_buffer + pickle_length, *account);
+ free(pickle_buffer);
+ delete account;
+}
diff --git a/fuzzers/fuzz_unpickle_session.cpp b/fuzzers/fuzz_unpickle_session.cpp
new file mode 100644
index 0000000..6edbc96
--- /dev/null
+++ b/fuzzers/fuzz_unpickle_session.cpp
@@ -0,0 +1,14 @@
+#include "olm/session.hh"
+#include "fuzzing.hh"
+
+int main(int argc, const char *argv[]) {
+ int pickle_fd = STDIN_FILENO;
+ uint8_t * pickle_buffer;
+ ssize_t pickle_length = check_errno(
+ "Error reading pickle file", read_file(pickle_fd, &pickle_buffer)
+ );
+ olm::Session * session = new olm::Session;
+ unpickle(pickle_buffer, pickle_buffer + pickle_length, *session);
+ free(pickle_buffer);
+ delete session;
+}
diff --git a/fuzzers/include/fuzzing.hh b/fuzzers/include/fuzzing.hh
new file mode 100644
index 0000000..e4f5eb9
--- /dev/null
+++ b/fuzzers/include/fuzzing.hh
@@ -0,0 +1,72 @@
+#include "olm/olm.hh"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <stddef.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+
+ssize_t read_file(
+ int fd,
+ uint8_t **buffer
+) {
+ size_t buffer_size = 4096;
+ uint8_t * current_buffer = (uint8_t *) malloc(buffer_size);
+ if (current_buffer == NULL) return -1;
+ size_t buffer_pos = 0;
+ while (1) {
+ ssize_t count = read(
+ fd, current_buffer + buffer_pos, buffer_size - buffer_pos
+ );
+ if (count < 0) break;
+ if (count == 0) {
+ uint8_t * return_buffer = (uint8_t *) realloc(current_buffer, buffer_pos);
+ if (return_buffer == NULL) break;
+ *buffer = return_buffer;
+ return buffer_pos;
+ }
+ buffer_pos += count;
+ if (buffer_pos == buffer_size) {
+ buffer_size *= 2;
+ uint8_t * new_buffer = (uint8_t *) realloc(current_buffer, buffer_size);
+ if (new_buffer == NULL) break;
+ current_buffer = new_buffer;
+ }
+ }
+ free(current_buffer);
+ return -1;
+}
+
+template<typename T>
+T check_errno(
+ const char * message,
+ T value
+) {
+ if (value == T(-1)) {
+ perror(message);
+ exit(1);
+ }
+ return value;
+}
+
+size_t check_session(
+ OlmSession * session,
+ const char * message,
+ size_t value
+) {
+ if (value == olm_error()) {
+ const char * olm_message = olm_session_last_error(session);
+ ssize_t ignored;
+ ignored = write(STDERR_FILENO, message, strlen(message));
+ ignored = write(STDERR_FILENO, ": ", 2);
+ ignored = write(STDERR_FILENO, olm_message, strlen(olm_message));
+ ignored = write(STDERR_FILENO, "\n", 1);
+ exit(2);
+ return ignored;
+ }
+ return value;
+}