Fuzzing bozohttpd: by adding a mock function for bozo_read to feed fu…

…zzing input
plusun · Aug 3, 2018 · 312c8ee · krytarowski · Aug 3, 2018 · plusun
1 parent 192d684
commit 312c8ee
Show file tree

Hide file tree

Showing 3 changed files with 76 additions and 0 deletions.
diff --git a/tests/fuzz/bozohttpd/bozohttpd/Makefile b/tests/fuzz/bozohttpd/bozohttpd/Makefile
@@ -0,0 +1,17 @@
+#       $NetBSD: Makefile,v 1.15 2007/05/28 12:06:25 tls Exp $
+#       @(#)Makefile    8.2 (Berkeley) 4/2/94
+
+.include <bsd.own.mk>
+
+PROG=   fuzz_bozohttpd
+SRCS=   fuzz_bozohttpd.c mock-ssl-bozo.c
+.PATH:  ${NETBSDSRCDIR}/libexec/httpd
+SRCS+=	bozohttpd.c daemon-bozo.c dir-index-bozo.c content-bozo.c tilde-luzah-bozo.c cgi-bozo.c lua-bozo.c
+
+CFLAGS= -fsanitize=fuzzer-no-link,address,undefined -Wall -Werror -I${NETBSDSRCDIR}/libexec/httpd #-Dbozowarn=mock_bozowarn
+LDFLAGS= -fsanitize=fuzzer,address,undefined -Wall -Werror -lssl -llua
+
+fuzz: fuzz_bozohttpd
+	export UBSAN_OPTIONS=halt_on_error=1 && ./fuzz_bozohttpd -only_ascii=1 ./input > /dev/null
+
+.include <bsd.prog.mk>
diff --git a/tests/fuzz/bozohttpd/bozohttpd/fuzz_bozohttpd.c b/tests/fuzz/bozohttpd/bozohttpd/fuzz_bozohttpd.c
@@ -0,0 +1,25 @@
+#include <stdint.h>
+#include <stddef.h>
+#include <string.h>
+#include "bozohttpd.h"
+
+extern void init_bozo_read_buffer(const uint8_t *data, size_t size);
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    init_bozo_read_buffer(data, size);
+    bozohttpd_t httpd;
+    bozoprefs_t prefs;
+    memset(&httpd, 0x0, sizeof(httpd));
+    memset(&prefs, 0x0, sizeof(prefs));
+    bozo_set_defaults(&httpd, &prefs);
+    bozo_setup(&httpd, &prefs, "localhost", "./slashdir");
+    do {
+        bozo_httpreq_t *request;
+        if ((request = bozo_read_request(&httpd)) != NULL) {
+            bozo_process_request(request);
+            bozo_clean_request(request);
+        }
+    } while (httpd.background);
+
+    return 0;
+}
diff --git a/tests/fuzz/bozohttpd/bozohttpd/mock-ssl-bozo.c b/tests/fuzz/bozohttpd/bozohttpd/mock-ssl-bozo.c
@@ -0,0 +1,34 @@
+#include "bozohttpd.h"
+#include <string.h>
+
+struct {
+    const uint8_t *data;
+    size_t size;
+} buffer;
+
+void init_bozo_read_buffer(const uint8_t *data, size_t size) {
+    buffer.data = data;
+    buffer.size = size;
+}
+
+void bozo_ssl_init(bozohttpd_t *httpd) {}
+int bozo_ssl_accept(bozohttpd_t *httpd) { return 0; }
+void bozo_ssl_destroy(bozohttpd_t *httpd) {}
+int bozo_printf(bozohttpd_t *httpd, const char *fmt, ...) { return 0; }
+int bozo_flush(bozohttpd_t *httpd, FILE *fp) { return 0; }
+ssize_t bozo_write(bozohttpd_t *httpd, int fd, const void *buf, size_t len) { return len; }
+ssize_t bozo_read(bozohttpd_t *httpd, int fd, void *buf, size_t len) {
+    if (len > buffer.size) {
+        len = buffer.size;
+    }
+    if (len == 0) {
+        return len;
+    }
+
+    memcpy(buf, buffer.data, len);
+    buffer.data += len;
+    buffer.size -= len;
+    return len;
+}
+
+void mock_bozowarn(bozohttpd_t *httpd, const char *fmt, ...) {}