mirrors
/
olm
mirror of https://git.matrix.org/git/olm.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Add support for building fuzzers using american fuzzy lop 

Builds fuzzers using http://lcamtuf.coredump.cx/afl/
release-v1.0.0
Mark Haines 2016-05-23 17:32:24 +01:00
parent aacf115468
commit f47aabd094
6 changed files with 227 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
Makefile
View File

@ -4,8 +4,11 @@ BUILD_DIR := build
RELEASE_OPTIMIZE_FLAGS ?= -g -O3
DEBUG_OPTIMIZE_FLAGS ?= -g -O0
JS_OPTIMIZE_FLAGS ?= -O3
FUZZING_OPTIMIZE_FLAGS ?= -O3
CC = gcc
EMCC = emcc
AFL_CC = afl_gcc
AFL_CXX = afl-g++
RELEASE_TARGET := $(BUILD_DIR)/libolm.so
DEBUG_TARGET := $(BUILD_DIR)/libolm_debug.so
JS_TARGET := javascript/olm.js
@ -17,6 +20,10 @@ PUBLIC_HEADERS := include/olm/olm.hh
SOURCES := $(wildcard src/*.cpp) $(wildcard src/*.c)
RELEASE_OBJECTS := $(patsubst src/%,$(BUILD_DIR)/release/%,$(patsubst %.c,%.o,$(patsubst %.cpp,%.o,$(SOURCES))))
DEBUG_OBJECTS := $(patsubst src/%,$(BUILD_DIR)/debug/%,$(patsubst %.c,%.o,$(patsubst %.cpp,%.o,$(SOURCES))))
FUZZER_OBJECTS := $(patsubst src/%,$(BUILD_DIR)/fuzzers/objects/%,$(patsubst %.c,%.o,$(patsubst %.cpp,%.o,$(SOURCES))))
FUZZER_SOURCES := $(wildcard fuzzers/fuzz_*.cpp) $(wildcard fuzzers/fuzz_*.c)
FUZZER_BINARIES := $(patsubst fuzzers/%,$(BUILD_DIR)/fuzzers/%,$(patsubst %.c,%,$(patsubst %.cpp,%,$(FUZZER_SOURCES))))
FUZZER_DEBUG_BINARIES := $(patsubst $(BUILD_DIR)/fuzzers/fuzz_%,$(BUILD_DIR)/fuzzers/debug_%,$(FUZZER_BINARIES))
TEST_SOURCES := $(wildcard tests/test_*.cpp) $(wildcard tests/test_*.c)
TEST_BINARIES := $(patsubst tests/%,$(BUILD_DIR)/tests/%,$(patsubst %.c,%,$(patsubst %.cpp,%,$(TEST_SOURCES))))
JS_OBJECTS := $(patsubst src/%,$(BUILD_DIR)/javascript/%,$(patsubst %.c,%.js.bc,$(patsubst %.cpp,%.js.bc,$(SOURCES))))
@ -37,6 +44,11 @@ EMCC.c = $(EMCC) $(CFLAGS) $(CPPFLAGS) -c
EMCC.cc = $(EMCC) $(CXXFLAGS) $(CPPFLAGS) -c
EMCC_LINK = $(EMCC) $(LDFLAGS) $(EMCCFLAGS)
AFL.c = $(AFL_CC) $(CFLAGS) $(CPPFLAGS) -c
AFL.cc = $(AFL_CXX) $(CXXFLAGS) $(CPPFLAGS) -c
AFL_LINK.c = $(AFL_CC) $(LDFLAGS) $(CFLAGS) $(CPPFLAGS)
AFL_LINK.cc = $(AFL_CXX) $(LDFLAGS) $(CXXFLAGS) $(CPPFLAGS)
# generate .d files when compiling
CPPFLAGS += -MMD
@ -53,6 +65,13 @@ $(DEBUG_TARGET): LDFLAGS += $(DEBUG_OPTIMIZE_FLAGS)
$(TEST_BINARIES): CPPFLAGS += -Itests/include
$(TEST_BINARIES): LDFLAGS += $(TEST_OPTIMIZE_FLAGS) -L$(BUILD_DIR)
$(FUZZER_OBJECTS): CFLAGS += $(FUZZER_OPTIMIZE_FLAGS)
$(FUZZER_OBJECTS): CXXFLAGS += $(FUZZER_OPTIMIZE_FLAGS)
$(FUZZER_BINARIES): CPPFLAGS += -Ifuzzers/include
$(FUZZER_BINARIES): LDFLAGS += $(FUZZER_OPTIMIZE_FLAGS) -L$(BUILD_DIR)
$(FUZZER_DEBUG_BINARIES): CPPFLAGS += -Ifuzzers/include
$(FUZZER_DEBUG_BINARIES): LDFLAGS += $(DEBUG_OPTIMIZE_FLAGS)
$(JS_OBJECTS): CFLAGS += $(JS_OPTIMIZE_FLAGS)
$(JS_OBJECTS): CXXFLAGS += $(JS_OPTIMIZE_FLAGS)
$(JS_TARGET): LDFLAGS += $(JS_OPTIMIZE_FLAGS)
@ -65,9 +84,11 @@ lib: $(RELEASE_TARGET)
# Make sure that the build directory exists.
# We can't check the build directory into git because it is empty.
makedirs:
mkdir -p $(BUILD_DIR)/release $(BUILD_DIR)/debug $(BUILD_DIR)/javascript $(BUILD_DIR)/tests
mkdir -p $(BUILD_DIR)/release $(BUILD_DIR)/debug $(BUILD_DIR)/javascript\
$(BUILD_DIR)/tests $(BUILD_DIR)/fuzzers/objects
.PHONY: makedirs
$(RELEASE_TARGET): $(RELEASE_OBJECTS)
$(CXX) $(LDFLAGS) --shared -fPIC \
-Wl,--version-script,version_script.ver \
@ -81,7 +102,6 @@ $(DEBUG_TARGET): $(DEBUG_OBJECTS)
-Wl,--version-script,version_script.ver \
$(OUTPUT_OPTION) $(DEBUG_OBJECTS)
js: $(JS_TARGET)
.PHONY: js
@ -96,8 +116,11 @@ clean:;
$(DEBUG_OBJECTS) $(DEBUG_OBJECTS:.o=.d) \
$(TEST_BINARIES) $(TEST_BINARIES:=.d) \
$(JS_OBJECTS) $(JS_OBJECTS:.bc=.d) $(JS_TARGET) \
$(JS_EXPORTED_FUNCTIONS) \
$(JS_EXPORTED_FUNCTIONS)\
$(RELEASE_TARGET) $(DEBUG_TARGET)\
$(FUZZER_OBJECTS) $(FUZZER_OBJECTS:.o=.d)\
$(FUZZER_BINARIES) $(FUZZER_BINARIES:=.d)\
$(FUZZER_DEBUG_BINARIES) $(FUZZER_DEBUG_BINARIES:=.d)\
build_tests: $(TEST_BINARIES)
@ -107,6 +130,9 @@ test: build_tests
$$i || exit $$?; \
done
fuzzers: $(FUZZER_BINARIES) $(FUZZER_DEBUG_BINARIES)
.PHONY: fuzzers
$(JS_EXPORTED_FUNCTIONS): $(PUBLIC_HEADERS)
perl -MJSON -ne '/(olm_[^( ]*)\(/ && push @f, "_$$1"; END { print encode_json \@f }' $^ > $@.tmp
mv $@.tmp $@
@ -139,6 +165,23 @@ $(BUILD_DIR)/tests/%: tests/%.c $(DEBUG_OBJECTS)
$(BUILD_DIR)/tests/%: tests/%.cpp $(DEBUG_OBJECTS)
$(LINK.cc) $< $(DEBUG_OBJECTS) $(LOADLIBES) $(LDLIBS) -o $@
$(BUILD_DIR)/fuzzers/objects/%.o: src/%.c | makedirs
$(AFL.c) $(OUTPUT_OPTION) $<
$(BUILD_DIR)/fuzzers/objects/%.o: src/%.cpp | makedirs
$(AFL.cc) $(OUTPUT_OPTION) $<
$(BUILD_DIR)/fuzzers/fuzz_%: fuzzers/fuzz_%.c $(FUZZER_OBJECTS)
$(AFL_LINK.c) $< $(FUZZER_OBJECTS) $(LOADLIBES) $(LDLIBS) -o $@
$(BUILD_DIR)/fuzzers/fuzz_%: fuzzers/fuzz_%.cpp $(FUZZER_OBJECTS)
$(AFL_LINK.cc) $< $(FUZZER_OBJECTS) $(LOADLIBES) $(LDLIBS) -o $@
$(BUILD_DIR)/fuzzers/debug_%: fuzzers/fuzz_%.c $(DEBUG_OBJECTS)
$(LINK.c) $< $(DEBUG_OBJECTS) $(LOADLIBES) $(LDLIBS) -o $@
$(BUILD_DIR)/fuzzers/debug_%: fuzzers/fuzz_%.cpp $(DEBUG_OBJECTS)
$(LINK.cc) $< $(DEBUG_OBJECTS) $(LOADLIBES) $(LDLIBS) -o $@
### dependencies
@ -146,3 +189,6 @@ $(BUILD_DIR)/tests/%: tests/%.cpp $(DEBUG_OBJECTS)
-include $(DEBUG_OBJECTS:.o=.d)
-include $(JS_OBJECTS:.bc=.d)
-include $(TEST_BINARIES:=.d)
-include $(FUZZER_OBJECTS:.o=.d)
-include $(FUZZER_BINARIES:=.d)
-include $(FUZZER_DEBUG_BINARIES:=.d)

14
fuzzers/fuzz_decode_message.cpp Normal file
View File

@ -0,0 +1,14 @@
#include "olm/message.hh"
#include "fuzzing.hh"
int main(int argc, const char *argv[]) {
int message_fd = STDIN_FILENO;
uint8_t * message_buffer;
ssize_t message_length = check_errno(
"Error reading message file", read_file(message_fd, &message_buffer)
);
olm::MessageReader * reader = new olm::MessageReader;
decode_message(*reader, message_buffer, message_length, 8);
free(message_buffer);
delete reader;
}

64
fuzzers/fuzz_decrypt.cpp Normal file
View File

@ -0,0 +1,64 @@
#include "olm/olm.hh"
#include "fuzzing.hh"
int main(int argc, const char *argv[]) {
size_t ignored;
if (argc <= 3) {
const char * message = "Usage: decrypt: <session_key> <session_file>"
" <message_type>\n";
ignored = write(STDERR_FILENO, message, strlen(message));
exit(3);
}
const char * key = argv[1];
size_t key_length = strlen(key);
int session_fd = check_errno(
"Error opening session file", open(argv[2], O_RDONLY)
);
int message_type = atoi(argv[3]);
uint8_t *session_buffer;
ssize_t session_length = check_errno(
"Error reading session file", read_file(session_fd, &session_buffer)
);
int message_fd = STDIN_FILENO;
uint8_t * message_buffer;
ssize_t message_length = check_errno(
"Error reading message file", read_file(message_fd, &message_buffer)
);
uint8_t * tmp_buffer = (uint8_t *) malloc(message_length);
memcpy(tmp_buffer, message_buffer, message_length);
uint8_t session_memory[olm_session_size()];
OlmSession * session = olm_session(session_memory);
check_session(session, "Error unpickling session", olm_unpickle_session(
session, key, key_length, session_buffer, session_length
));
size_t max_length = check_session(
session,
"Error getting plaintext length",
olm_decrypt_max_plaintext_length(
session, message_type, tmp_buffer, message_length
)
);
uint8_t plaintext[max_length];
size_t length = check_session(
session, "Error decrypting message", olm_decrypt(
session, message_type,
message_buffer, message_length,
plaintext, max_length
)
);
ignored = write(STDOUT_FILENO, plaintext, length);
ignored = write(STDOUT_FILENO, "\n", 1);
}

14
fuzzers/fuzz_unpickle_account.cpp Normal file
View File

@ -0,0 +1,14 @@
#include "olm/account.hh"
#include "fuzzing.hh"
int main(int argc, const char *argv[]) {
int pickle_fd = STDIN_FILENO;
uint8_t * pickle_buffer;
ssize_t pickle_length = check_errno(
"Error reading pickle file", read_file(pickle_fd, &pickle_buffer)
);
olm::Account * account = new olm::Account;
unpickle(pickle_buffer, pickle_buffer + pickle_length, *account);
free(pickle_buffer);
delete account;
}

14
fuzzers/fuzz_unpickle_session.cpp Normal file
View File

@ -0,0 +1,14 @@
#include "olm/session.hh"
#include "fuzzing.hh"
int main(int argc, const char *argv[]) {
int pickle_fd = STDIN_FILENO;
uint8_t * pickle_buffer;
ssize_t pickle_length = check_errno(
"Error reading pickle file", read_file(pickle_fd, &pickle_buffer)
);
olm::Session * session = new olm::Session;
unpickle(pickle_buffer, pickle_buffer + pickle_length, *session);
free(pickle_buffer);
delete session;
}

72
fuzzers/include/fuzzing.hh Normal file
View File

@ -0,0 +1,72 @@
#include "olm/olm.hh"
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <stddef.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
ssize_t read_file(
int fd,
uint8_t **buffer
) {
size_t buffer_size = 4096;
uint8_t * current_buffer = (uint8_t *) malloc(buffer_size);
if (current_buffer == NULL) return -1;
size_t buffer_pos = 0;
while (1) {
ssize_t count = read(
fd, current_buffer + buffer_pos, buffer_size - buffer_pos
);
if (count < 0) break;
if (count == 0) {
uint8_t * return_buffer = (uint8_t *) realloc(current_buffer, buffer_pos);
if (return_buffer == NULL) break;
*buffer = return_buffer;
return buffer_pos;
}
buffer_pos += count;
if (buffer_pos == buffer_size) {
buffer_size *= 2;
uint8_t * new_buffer = (uint8_t *) realloc(current_buffer, buffer_size);
if (new_buffer == NULL) break;
current_buffer = new_buffer;
}
}
free(current_buffer);
return -1;
}
template<typename T>
T check_errno(
const char * message,
T value
) {
if (value == T(-1)) {
perror(message);
exit(1);
}
return value;
}
size_t check_session(
OlmSession * session,
const char * message,
size_t value
) {
if (value == olm_error()) {
const char * olm_message = olm_session_last_error(session);
ssize_t ignored;
ignored = write(STDERR_FILENO, message, strlen(message));
ignored = write(STDERR_FILENO, ": ", 2);
ignored = write(STDERR_FILENO, olm_message, strlen(olm_message));
ignored = write(STDERR_FILENO, "\n", 1);
exit(2);
return ignored;
}
return value;
}