Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fuzz: add a new fuzzer to test serialization/deserialization code #1876

Merged
merged 1 commit into from
Jan 27, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/cifuzz.yml
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ jobs:
uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
with:
oss-fuzz-project-name: 'ndpi'
fuzz-seconds: 1500
fuzz-seconds: 1600
dry-run: false
sanitizer: ${{ matrix.sanitizer }}
- name: Check Crash (fails when a crash is detected)
Expand Down
2 changes: 2 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@
/fuzz/fuzz_alg_ses_des
/fuzz/fuzz_config
/fuzz/fuzz_community_id
/fuzz/fuzz_serialization
/fuzz/fuzz_ds_patricia
/fuzz/fuzz_ds_libcache
/fuzz/fuzz_ds_tree
Expand All @@ -70,6 +71,7 @@
/fuzz/fuzz_quic_get_crypto_data_seed_corpus.zip
/fuzz/fuzz_config_seed_corpus.zip
/fuzz/fuzz_community_id_seed_corpus.zip
/fuzz/fuzz_serialization_seed_corpus.zip
/fuzz/fuzz_alg_ses_des_seed_corpus.zip
/fuzz/fuzz_alg_bins_seed_corpus.zip
/fuzz/fuzz_alg_hll_seed_corpus.zip
Expand Down
25 changes: 23 additions & 2 deletions fuzz/Makefile.am
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
bin_PROGRAMS = fuzz_process_packet fuzz_ndpi_reader fuzz_ndpi_reader_alloc_fail fuzz_quic_get_crypto_data fuzz_config fuzz_community_id
bin_PROGRAMS = fuzz_process_packet fuzz_ndpi_reader fuzz_ndpi_reader_alloc_fail fuzz_quic_get_crypto_data fuzz_config fuzz_community_id fuzz_serialization
#Alghoritms
bin_PROGRAMS += fuzz_alg_bins fuzz_alg_hll fuzz_alg_hw_rsi_outliers_da fuzz_alg_jitter fuzz_alg_ses_des
#Data structures
Expand Down Expand Up @@ -86,6 +86,21 @@ fuzz_community_id_LINK=$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
$(LIBTOOLFLAGS) --mode=link $(CXX) @NDPI_CFLAGS@ $(AM_CXXFLAGS) $(CXXFLAGS) \
$(fuzz_community_id_LDFLAGS) @NDPI_LDFLAGS@ $(LDFLAGS) -o $@

fuzz_serialization_SOURCES = fuzz_serialization.cpp fuzz_common_code.c
fuzz_serialization_CXXFLAGS = @NDPI_CFLAGS@ $(CXXFLAGS) -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
fuzz_serialization_CFLAGS = @NDPI_CFLAGS@ $(CXXFLAGS) -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
fuzz_serialization_LDADD = ../src/lib/libndpi.a $(ADDITIONAL_LIBS)
fuzz_serialization_LDFLAGS = $(LIBS)
if HAS_FUZZLDFLAGS
fuzz_serialization_CXXFLAGS += $(LIB_FUZZING_ENGINE)
fuzz_serialization_CFLAGS += $(LIB_FUZZING_ENGINE)
fuzz_serialization_LDFLAGS += $(LIB_FUZZING_ENGINE)
endif
# force usage of CXX for linker
fuzz_serialization_LINK=$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
$(LIBTOOLFLAGS) --mode=link $(CXX) @NDPI_CFLAGS@ $(AM_CXXFLAGS) $(CXXFLAGS) \
$(fuzz_serialization_LDFLAGS) @NDPI_LDFLAGS@ $(LDFLAGS) -o $@

fuzz_alg_bins_SOURCES = fuzz_alg_bins.cpp fuzz_common_code.c
fuzz_alg_bins_CXXFLAGS = @NDPI_CFLAGS@ $(CXXFLAGS) -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
fuzz_alg_bins_CFLAGS = @NDPI_CFLAGS@ $(CXXFLAGS) -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
Expand Down Expand Up @@ -242,6 +257,11 @@ files_corpus_fuzz_config := $(wildcard corpus/fuzz_config/*)
fuzz_config_seed_corpus.zip: $(files_corpus_fuzz_config)
zip -j fuzz_config_seed_corpus.zip $(files_corpus_fuzz_config)

files_corpus_fuzz_serialization := $(wildcard corpus/fuzz_serialization/*)

fuzz_serialization_seed_corpus.zip: $(files_corpus_fuzz_serialization)
zip -j fuzz_serialization_seed_corpus.zip $(files_corpus_fuzz_serialization)

files_corpus_fuzz_community_id := $(wildcard corpus/fuzz_community_id/*)

fuzz_community_id_seed_corpus.zip: $(files_corpus_fuzz_community_id)
Expand Down Expand Up @@ -292,7 +312,7 @@ files_corpus_fuzz_ds_tree := $(wildcard corpus/fuzz_ds_tree/*)
fuzz_ds_tree_seed_corpus.zip: $(files_corpus_fuzz_ds_tree)
zip -j fuzz_ds_tree_seed_corpus.zip $(files_corpus_fuzz_ds_tree)

corpus: fuzz_ndpi_reader_seed_corpus.zip fuzz_ndpi_reader_alloc_fail_seed_corpus.zip fuzz_quic_get_crypto_data_seed_corpus.zip fuzz_config_seed_corpus.zip fuzz_ds_patricia_seed_corpus.zip fuzz_ds_ahocorasick_seed_corpus.zip fuzz_alg_ses_des_seed_corpus.zip fuzz_alg_hw_rsi_outliers_da_seed_corpus.zip fuzz_alg_bins_seed_corpus.zip fuzz_alg_hll_seed_corpus.zip fuzz_alg_jitter_seed_corpus.zip fuzz_ds_libcache_seed_corpus.zip fuzz_community_id_seed_corpus.zip fuzz_ds_tree_seed_corpus.zip
corpus: fuzz_ndpi_reader_seed_corpus.zip fuzz_ndpi_reader_alloc_fail_seed_corpus.zip fuzz_quic_get_crypto_data_seed_corpus.zip fuzz_config_seed_corpus.zip fuzz_ds_patricia_seed_corpus.zip fuzz_ds_ahocorasick_seed_corpus.zip fuzz_alg_ses_des_seed_corpus.zip fuzz_alg_hw_rsi_outliers_da_seed_corpus.zip fuzz_alg_bins_seed_corpus.zip fuzz_alg_hll_seed_corpus.zip fuzz_alg_jitter_seed_corpus.zip fuzz_ds_libcache_seed_corpus.zip fuzz_community_id_seed_corpus.zip fuzz_ds_tree_seed_corpus.zip fuzz_serialization_seed_corpus.zip

#Create dictionaries exactly as expected by oss-fuzz.
#This way, if we need to change/update/add something,
Expand All @@ -311,6 +331,7 @@ distdir:
-o -name '*.dict' \
-o -path './corpus/fuzz_quic_get_crypto_data/*' \
-o -path './corpus/fuzz_config/*' \
-o -path './corpus/fuzz_serialization/*' \
-o -path './corpus/fuzz_community_id/*' \
-o -path './corpus/fuzz_alg_ses_des/*' \
-o -path './corpus/fuzz_alg_bins/*' \
Expand Down
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
R�0-
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�0�{Шp(�'}��F
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�����
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�K!i�@`�1�� �GH we<��7@�|����:v�/�&m�}�9������p%����
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�0���
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
�}pp�}
�_��a���]C%�
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
0�{�uLLLLLOLLLLLLL���
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
}���D����a�Ӹt�ا�P���04
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�c�
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
��a���D��� ������=�;0izZXٙ�6��_���>�h�{|4��^iW�������a���]D� C%�
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
���
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
}�����D�u6�R�����].��z��
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�0+;;�I5j�@;x��m�
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
]C%�
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
;�e}�"�0�{�u�xn�݋c�����^�P*
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�f�+
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
0�LLLLLL���
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
��!9��dD�D��]�4�}�
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
m�
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�]C%�
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
0��
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
����]C%�
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
����
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
+�f�+
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
s�M��4V
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
0�OL�������
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
��
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
C��
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Eg�
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�o��
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�LLL���
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�r0;5��o�
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{�f���
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Y�
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
��
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
}���D����a���P���04
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�
Binary file not shown.
139 changes: 139 additions & 0 deletions fuzz/fuzz_serialization.cpp
Original file line number Diff line number Diff line change
@@ -0,0 +1,139 @@
#include "ndpi_api.h"
#include "fuzz_common_code.h"

#include <stdint.h>
#include <stdio.h>
#include <assert.h>
#include "fuzzer/FuzzedDataProvider.h"

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
FuzzedDataProvider fuzzed_data(data, size);
u_int16_t i, num_iteration;
ndpi_serializer serializer, serializer_cloned, deserializer;
ndpi_serialization_format fmt;
int rc;
std::vector<char>d;
char kbuf[32];
u_int32_t buffer_len;

/* To allow memory allocation failures */
fuzz_set_alloc_callbacks_and_seed(size);

fmt = static_cast<ndpi_serialization_format>(fuzzed_data.ConsumeIntegralInRange(1, 3));

if (fuzzed_data.ConsumeBool())
rc = ndpi_init_serializer(&serializer, fmt);
else
rc = ndpi_init_serializer_ll(&serializer, fmt, fuzzed_data.ConsumeIntegralInRange(0, 64));

if (rc != 0)
return 0;

if (fmt == ndpi_serialization_format_csv)
ndpi_serializer_set_csv_separator(&serializer, ',');

num_iteration = fuzzed_data.ConsumeIntegralInRange(0, 16);
for (i = 0; i < num_iteration; i++) {
memset(kbuf, '\0', sizeof(kbuf)); /* It is also used as binary key */
snprintf(kbuf, sizeof(kbuf), "Key %d", i);

ndpi_serialize_uint32_uint32(&serializer, i, fuzzed_data.ConsumeIntegral<u_int32_t>());
ndpi_serialize_uint32_int32(&serializer, i, fuzzed_data.ConsumeIntegral<int32_t>());
ndpi_serialize_uint32_uint64(&serializer, i, fuzzed_data.ConsumeIntegral<u_int64_t>());
ndpi_serialize_uint32_int64(&serializer, i, fuzzed_data.ConsumeIntegral<int64_t>());
ndpi_serialize_uint32_float(&serializer, i, fuzzed_data.ConsumeFloatingPoint<float>(), "%f");
if (fmt != ndpi_serialization_format_tlv)
ndpi_serialize_uint32_double(&serializer, i, fuzzed_data.ConsumeFloatingPoint<double>(), "%lf");
d = fuzzed_data.ConsumeBytes<char>(16);
ndpi_serialize_uint32_binary(&serializer, i, d.data(), d.size());
ndpi_serialize_uint32_string(&serializer, i, fuzzed_data.ConsumeBytesAsString(8).c_str());
ndpi_serialize_uint32_boolean(&serializer, i, fuzzed_data.ConsumeIntegral<int8_t>());

ndpi_serialize_string_uint32(&serializer, kbuf, fuzzed_data.ConsumeIntegral<u_int32_t>());
ndpi_serialize_string_int32(&serializer, kbuf, fuzzed_data.ConsumeIntegral<int32_t>());
ndpi_serialize_string_uint64(&serializer, kbuf, fuzzed_data.ConsumeIntegral<u_int64_t>());
ndpi_serialize_string_int64(&serializer, kbuf, fuzzed_data.ConsumeIntegral<int64_t>());
ndpi_serialize_string_float(&serializer, kbuf, fuzzed_data.ConsumeFloatingPoint<float>(), "%f");
if (fmt != ndpi_serialization_format_tlv)
ndpi_serialize_string_double(&serializer, kbuf, fuzzed_data.ConsumeFloatingPoint<double>(), "%lf");
ndpi_serialize_string_string(&serializer, kbuf, fuzzed_data.ConsumeBytesAsString(8).c_str());
ndpi_serialize_string_boolean(&serializer, kbuf, fuzzed_data.ConsumeIntegral<int8_t>());

ndpi_serialize_binary_uint32(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeIntegral<u_int32_t>());
ndpi_serialize_binary_int32(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeIntegral<int32_t>());
ndpi_serialize_binary_uint64(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeIntegral<u_int64_t>());
ndpi_serialize_binary_int64(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeIntegral<int64_t>());
ndpi_serialize_binary_float(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeFloatingPoint<float>(), "%f");
if (fmt != ndpi_serialization_format_tlv)
ndpi_serialize_binary_double(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeFloatingPoint<double>(), "%lf");
ndpi_serialize_binary_boolean(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeIntegral<int8_t>());
d = fuzzed_data.ConsumeBytes<char>(16);
ndpi_serialize_binary_binary(&serializer, kbuf, sizeof(kbuf), d.data(), d.size());

if ((i & 0x3) == 0x3)
ndpi_serialize_end_of_record(&serializer);
}

ndpi_serializer_create_snapshot(&serializer);

if (fuzzed_data.ConsumeBool()) {
ndpi_serialize_start_of_block(&serializer, "Block");
memset(kbuf, '\0', sizeof(kbuf)); /* It is also used as binary key */
snprintf(kbuf, sizeof(kbuf), "K-Ignored");
ndpi_serialize_uint32_uint32(&serializer, i, fuzzed_data.ConsumeIntegral<u_int32_t>());
ndpi_serialize_string_string(&serializer, kbuf, fuzzed_data.ConsumeBytesAsString(8).c_str());
ndpi_serialize_string_float(&serializer, kbuf, fuzzed_data.ConsumeFloatingPoint<float>(), "%f");
ndpi_serialize_binary_boolean(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeIntegral<int8_t>());
ndpi_serialize_end_of_block(&serializer);
}

if (fuzzed_data.ConsumeBool()) {
ndpi_serialize_start_of_block_uint32(&serializer, 0);
memset(kbuf, '\0', sizeof(kbuf)); /* It is also used as binary key */
snprintf(kbuf, sizeof(kbuf), "K32-Ignored");
ndpi_serialize_uint32_uint32(&serializer, i, fuzzed_data.ConsumeIntegral<u_int32_t>());
ndpi_serialize_string_string(&serializer, kbuf, fuzzed_data.ConsumeBytesAsString(8).c_str());
ndpi_serialize_string_float(&serializer, kbuf, fuzzed_data.ConsumeFloatingPoint<float>(), "%f");
ndpi_serialize_binary_boolean(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeIntegral<int8_t>());
ndpi_serialize_end_of_block(&serializer);
}

if (fuzzed_data.ConsumeBool())
ndpi_serializer_rollback_snapshot(&serializer);

if (fmt == ndpi_serialization_format_json) {

ndpi_serialize_start_of_list(&serializer, "List");

num_iteration = fuzzed_data.ConsumeIntegralInRange(0, 8);
for (i = 0; i < num_iteration; i++) {
memset(kbuf, '\0', sizeof(kbuf)); /* It is also used as binary key */
snprintf(kbuf, sizeof(kbuf), "Ignored");
ndpi_serialize_uint32_uint32(&serializer, i, fuzzed_data.ConsumeIntegral<u_int32_t>());
ndpi_serialize_string_string(&serializer, kbuf, fuzzed_data.ConsumeBytesAsString(8).c_str());
ndpi_serialize_string_float(&serializer, kbuf, fuzzed_data.ConsumeFloatingPoint<float>(), "%f");
ndpi_serialize_binary_boolean(&serializer, kbuf, sizeof(kbuf), fuzzed_data.ConsumeIntegral<int8_t>());
}

ndpi_serialize_end_of_list(&serializer);
ndpi_serialize_string_string(&serializer, "Last", "Ok");
} else if (fmt == ndpi_serialization_format_csv) {
ndpi_serializer_get_header(&serializer, &buffer_len);
ndpi_serializer_get_buffer(&serializer, &buffer_len);
} else {
/* Conversion from tlv to json */
rc = ndpi_init_deserializer(&deserializer, &serializer);
if (rc == 0) {
rc = ndpi_init_serializer_ll(&serializer_cloned, ndpi_serialization_format_json, fuzzed_data.ConsumeIntegralInRange(0, 2048));
if (rc == 0) {
ndpi_deserialize_clone_all(&deserializer, &serializer_cloned);
ndpi_serializer_get_buffer(&serializer_cloned, &buffer_len);
ndpi_term_serializer(&serializer_cloned);
}
}
}

ndpi_term_serializer(&serializer);

return 0;
}
20 changes: 20 additions & 0 deletions src/include/ndpi_api.h
Original file line number Diff line number Diff line change
Expand Up @@ -1248,6 +1248,16 @@ extern "C" {
*/
int ndpi_serialize_uint32_float(ndpi_serializer *serializer, u_int32_t key, float value, const char *format /* e.f. "%.2f" */);

/**
* Serialize a 32-bit unsigned int key and a double value
* @param serializer The serializer handle
* @param key The field name or ID
* @param value The field value
* @param format The float value format
* @return 0 on success, a negative number otherwise
*/
int ndpi_serialize_uint32_double(ndpi_serializer *serializer, u_int32_t key, double value, const char *format /* e.f. "%.2f" */);

/**
* Serialize a 32-bit unsigned int key and a double value
* @param serializer The serializer handle
Expand Down Expand Up @@ -1276,6 +1286,16 @@ extern "C" {
*/
int ndpi_serialize_uint32_boolean(ndpi_serializer *serializer, u_int32_t key, u_int8_t value);

/**
* Serialize a 32-bit unsigned int and an unterminated string value
* @param serializer The serializer handle
* @param key The field name or ID
* @param value The field value
* @param vlen The value length
* @return 0 on success, a negative number otherwise
*/
int ndpi_serialize_uint32_binary(ndpi_serializer *serializer, u_int32_t key, const char *_value, u_int16_t vlen);

/**
* Serialize an unterminated string key and a 32-bit signed int value
* @param serializer The serializer handle
Expand Down
Loading