Added MessagePack fuzzing

bblanchon · Jun 7, 2018 · a9a730f · a9a730f
1 parent 4ff6809
commit a9a730f
Show file tree

Hide file tree

Showing 41 changed files with 74 additions and 48 deletions.
diff --git a/fuzzing/Makefile b/fuzzing/Makefile
@@ -5,15 +5,18 @@ CXXFLAGS += -I../src
 all: \
 	$(OUT)/json_fuzzer \
 	$(OUT)/json_fuzzer_seed_corpus.zip \
-	$(OUT)/json_fuzzer.options
+	$(OUT)/json_fuzzer.options \
+	$(OUT)/msgpack_fuzzer \
+	$(OUT)/msgpack_fuzzer_seed_corpus.zip \
+	$(OUT)/msgpack_fuzzer.options
 
-$(OUT)/json_fuzzer: fuzzer.cpp $(shell find ../src -type f)
+$(OUT)/%_fuzzer: %_fuzzer.cpp $(shell find ../src -type f)
 	$(CXX) $(CXXFLAGS) $< -o$@ $(LIB_FUZZING_ENGINE)
 
-$(OUT)/json_fuzzer_seed_corpus.zip: seed_corpus/*
+$(OUT)/%_fuzzer_seed_corpus.zip: %_seed_corpus/*
 	zip -j $@ $?
 
-$(OUT)/json_fuzzer.options:
+$(OUT)/%_fuzzer.options:
 	@echo "[libfuzzer]" > $@
 	@echo "max_len = 256" >> $@
 	@echo "timeout = 10" >> $@
diff --git a/fuzzing/fuzzer.cpp b/fuzzing/fuzzer.cpp
diff --git a/fuzzing/my_corpus/.gitignore → fuzzing/json_corpus/.gitignore b/fuzzing/my_corpus/.gitignore → fuzzing/json_corpus/.gitignore
diff --git a/fuzzing/json_fuzzer.cpp b/fuzzing/json_fuzzer.cpp
@@ -0,0 +1,11 @@
+#include <ArduinoJson.h>
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  DynamicJsonDocument doc;
+  DeserializationError error = deserializeJson(doc, data, size);
+  if (!error) {
+    std::string json;
+    serializeJson(doc, json);
+  }
+  return 0;
+}
diff --git a/fuzzing/seed_corpus/Comments.json → fuzzing/json_seed_corpus/Comments.json b/fuzzing/seed_corpus/Comments.json → fuzzing/json_seed_corpus/Comments.json
diff --git a/fuzzing/seed_corpus/EmptyArray.json → fuzzing/json_seed_corpus/EmptyArray.json b/fuzzing/seed_corpus/EmptyArray.json → fuzzing/json_seed_corpus/EmptyArray.json
diff --git a/fuzzing/seed_corpus/EmptyObject.json → fuzzing/json_seed_corpus/EmptyObject.json b/fuzzing/seed_corpus/EmptyObject.json → fuzzing/json_seed_corpus/EmptyObject.json
diff --git a/fuzzing/seed_corpus/ExcessiveNesting.json → ...ng/json_seed_corpus/ExcessiveNesting.json b/fuzzing/seed_corpus/ExcessiveNesting.json → ...ng/json_seed_corpus/ExcessiveNesting.json
diff --git a/fuzzing/seed_corpus/Numbers.json → fuzzing/json_seed_corpus/Numbers.json b/fuzzing/seed_corpus/Numbers.json → fuzzing/json_seed_corpus/Numbers.json
diff --git a/fuzzing/seed_corpus/OpenWeatherMap.json → fuzzing/json_seed_corpus/OpenWeatherMap.json b/fuzzing/seed_corpus/OpenWeatherMap.json → fuzzing/json_seed_corpus/OpenWeatherMap.json
diff --git a/fuzzing/seed_corpus/Strings.json → fuzzing/json_seed_corpus/Strings.json b/fuzzing/seed_corpus/Strings.json → fuzzing/json_seed_corpus/Strings.json
diff --git a/fuzzing/seed_corpus/WeatherUnderground.json → .../json_seed_corpus/WeatherUnderground.json b/fuzzing/seed_corpus/WeatherUnderground.json → .../json_seed_corpus/WeatherUnderground.json
diff --git a/fuzzing/msgpack_corpus/.gitignore b/fuzzing/msgpack_corpus/.gitignore
@@ -0,0 +1,2 @@
+*
+!.gitignore
diff --git a/fuzzing/msgpack_fuzzer.cpp b/fuzzing/msgpack_fuzzer.cpp
@@ -0,0 +1,11 @@
+#include <ArduinoJson.h>
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  DynamicJsonDocument doc;
+  DeserializationError error = deserializeMsgPack(doc, data, size);
+  if (!error) {
+    std::string json;
+    serializeMsgPack(doc, json);
+  }
+  return 0;
+}
diff --git a/fuzzing/msgpack_seed_corpus/array16 b/fuzzing/msgpack_seed_corpus/array16
diff --git a/fuzzing/msgpack_seed_corpus/array32 b/fuzzing/msgpack_seed_corpus/array32
diff --git a/fuzzing/msgpack_seed_corpus/false b/fuzzing/msgpack_seed_corpus/false
@@ -0,0 +1 @@
+�
diff --git a/fuzzing/msgpack_seed_corpus/fixarray b/fuzzing/msgpack_seed_corpus/fixarray
@@ -0,0 +1 @@
+��hello�world
diff --git a/fuzzing/msgpack_seed_corpus/fixint_negative b/fuzzing/msgpack_seed_corpus/fixint_negative
@@ -0,0 +1 @@
+�
diff --git a/fuzzing/msgpack_seed_corpus/fixint_positive b/fuzzing/msgpack_seed_corpus/fixint_positive
@@ -0,0 +1 @@
+
diff --git a/fuzzing/msgpack_seed_corpus/fixmap b/fuzzing/msgpack_seed_corpus/fixmap
@@ -0,0 +1 @@
+��one�two
diff --git a/fuzzing/msgpack_seed_corpus/fixstr b/fuzzing/msgpack_seed_corpus/fixstr
@@ -0,0 +1 @@
+�hello world
diff --git a/fuzzing/msgpack_seed_corpus/float32 b/fuzzing/msgpack_seed_corpus/float32
@@ -0,0 +1 @@
+�@H��
diff --git a/fuzzing/msgpack_seed_corpus/float64 b/fuzzing/msgpack_seed_corpus/float64
@@ -0,0 +1 @@
+�@	!���o
diff --git a/fuzzing/msgpack_seed_corpus/int16 b/fuzzing/msgpack_seed_corpus/int16
@@ -0,0 +1 @@
+���
diff --git a/fuzzing/msgpack_seed_corpus/int32 b/fuzzing/msgpack_seed_corpus/int32
@@ -0,0 +1 @@
+Ҷi�.
diff --git a/fuzzing/msgpack_seed_corpus/int64 b/fuzzing/msgpack_seed_corpus/int64
@@ -0,0 +1 @@
+�4Vx����
diff --git a/fuzzing/msgpack_seed_corpus/int8 b/fuzzing/msgpack_seed_corpus/int8
@@ -0,0 +1 @@
+��
diff --git a/fuzzing/msgpack_seed_corpus/map16 b/fuzzing/msgpack_seed_corpus/map16
diff --git a/fuzzing/msgpack_seed_corpus/map32 b/fuzzing/msgpack_seed_corpus/map32
diff --git a/fuzzing/msgpack_seed_corpus/nil b/fuzzing/msgpack_seed_corpus/nil
@@ -0,0 +1 @@
+�
diff --git a/fuzzing/msgpack_seed_corpus/str16 b/fuzzing/msgpack_seed_corpus/str16
diff --git a/fuzzing/msgpack_seed_corpus/str32 b/fuzzing/msgpack_seed_corpus/str32
diff --git a/fuzzing/msgpack_seed_corpus/str8 b/fuzzing/msgpack_seed_corpus/str8
@@ -0,0 +1 @@
+�hello
diff --git a/fuzzing/msgpack_seed_corpus/true b/fuzzing/msgpack_seed_corpus/true
@@ -0,0 +1 @@
+�
diff --git a/fuzzing/msgpack_seed_corpus/uint16 b/fuzzing/msgpack_seed_corpus/uint16
@@ -0,0 +1 @@
+�09
diff --git a/fuzzing/msgpack_seed_corpus/uint32 b/fuzzing/msgpack_seed_corpus/uint32
@@ -0,0 +1 @@
+�4Vx
diff --git a/fuzzing/msgpack_seed_corpus/uint64 b/fuzzing/msgpack_seed_corpus/uint64
@@ -0,0 +1 @@
+�4Vx����
diff --git a/fuzzing/msgpack_seed_corpus/uint8 b/fuzzing/msgpack_seed_corpus/uint8
@@ -0,0 +1 @@
+��
diff --git a/scripts/oss-fuzz/Vagrantfile b/scripts/oss-fuzz/Vagrantfile
@@ -2,11 +2,16 @@
 Vagrant.configure(2) do |config|
   config.vm.box = "ubuntu/xenial64"
 
-  config.vm.synced_folder "E:\\Git\\Arduino\\libraries\\ArduinoJson", "/host/ArduinoJson"
+  config.vm.synced_folder "../..", "/host/ArduinoJson"
   config.vm.synced_folder "E:\\Git\\oss-fuzz", "/host/oss-fuzz"
 
   config.vm.network "forwarded_port", guest: 8001, host: 8001
 
+  config.vm.provider "virtualbox" do |v|
+    v.memory = 2048
+    v.cpus = 2
+  end
+
   config.vm.provision "shell", privileged: false, inline: <<-SHELL
     set -x
 
@@ -18,10 +23,6 @@ Vagrant.configure(2) do |config|
     git clone https://github.com/google/fuzzer-test-suite.git FTS
     ./FTS/tutorial/install-deps.sh  # Get deps
     ./FTS/tutorial/install-clang.sh # Get fresh clang binaries
-    # Get libFuzzer sources and build it
-    svn co http://llvm.org/svn/llvm-project/llvm/trunk/lib/Fuzzer
-    Fuzzer/build.sh
-    sudo mv libFuzzer.a /usr/local/lib/
 
     echo "export PROJECT_NAME='arduinojson'" >> $HOME/.profile
     echo "export CC='clang'" >> $HOME/.profile

diff --git a/scripts/travis/fuzz.sh b/scripts/travis/fuzz.sh
@@ -1,20 +1,26 @@
 #!/bin/bash -eux
 
 ROOT_DIR=$(dirname $0)/../../
-INCLUDE_DIR=$ROOT_DIR/src/
-FUZZING_DIR=$ROOT_DIR/fuzzing/
-JSON_CORPUS_DIR=$FUZZING_DIR/my_corpus
-JSON_SEED_CORPUS_DIR=$FUZZING_DIR/seed_corpus
-
-CXX="clang++-$CLANG"
+INCLUDE_DIR=${ROOT_DIR}/src/
+FUZZING_DIR=${ROOT_DIR}/fuzzing/
 CXXFLAGS="-g -fprofile-instr-generate -fcoverage-mapping -fsanitize=address,fuzzer"
 
-$CXX $CXXFLAGS -o json_fuzzer -I$INCLUDE_DIR $FUZZING_DIR/fuzzer.cpp
+fuzz() {
+	NAME="$1"
+	FUZZER="${NAME}_fuzzer"
+	FUZZER_CPP="${FUZZING_DIR}/${NAME}_fuzzer.cpp"
+	CORPUS_DIR="${FUZZING_DIR}/${NAME}_corpus"
+	SEED_CORPUS_DIR="${FUZZING_DIR}/${NAME}_seed_corpus"
+
+	clang++-${CLANG} ${CXXFLAGS} -o ${FUZZER} -I$INCLUDE_DIR ${FUZZER_CPP}
 
-export ASAN_OPTIONS="detect_leaks=0"
-export LLVM_PROFILE_FILE="json_fuzzer.profraw"
-./json_fuzzer "$JSON_CORPUS_DIR" "$JSON_SEED_CORPUS_DIR" -max_total_time=60
+	export ASAN_OPTIONS="detect_leaks=0"
+	export LLVM_PROFILE_FILE="${FUZZER}.profraw"
+	./${FUZZER} "$CORPUS_DIR" "$SEED_CORPUS_DIR" -max_total_time=30
 
-llvm-profdata-$CLANG merge -sparse json_fuzzer.profraw -o json_fuzzer.profdata
+	llvm-profdata-${CLANG} merge -sparse ${LLVM_PROFILE_FILE} -o ${FUZZER}.profdata
+	llvm-cov-${CLANG} report ./${FUZZER} -instr-profile=${FUZZER}.profdata
+}
 
-llvm-cov-$CLANG report ./json_fuzzer -instr-profile=json_fuzzer.profdata
+fuzz json
+fuzz msgpack