subversion-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From phi...@apache.org
Subject svn commit: r1798156 - in /subversion/trunk: build.conf subversion/tests/afl/ subversion/tests/afl/README subversion/tests/afl/afl-x509-testcase/ subversion/tests/afl/afl-x509-testcase/test1 subversion/tests/afl/afl-x509.c
Date Fri, 09 Jun 2017 00:29:39 GMT
Author: philip
Date: Fri Jun  9 00:29:38 2017
New Revision: 1798156

URL: http://svn.apache.org/viewvc?rev=1798156&view=rev
Log:
Add an American Fuzzy Lop fuzzer test for the x509 parser.  This is
not part of the main regression tests and needs to be run manually,
see README for details.  One SEGV found so far (to be fixed in an
upcoming commit).

* build.conf (afl-x509): New.

* subversion/tests/afl: New.

* subversion/tests/afl/README: New.

* subversion/tests/afl/afl-x509-testcase: New.

* subversion/tests/afl/afl-x509-testcase/test1: New.

* subversion/tests/afl/afl-x509.c: New.

Added:
    subversion/trunk/subversion/tests/afl/   (with props)
    subversion/trunk/subversion/tests/afl/README   (with props)
    subversion/trunk/subversion/tests/afl/afl-x509-testcase/
    subversion/trunk/subversion/tests/afl/afl-x509-testcase/test1   (with props)
    subversion/trunk/subversion/tests/afl/afl-x509.c   (with props)
Modified:
    subversion/trunk/build.conf

Modified: subversion/trunk/build.conf
URL: http://svn.apache.org/viewvc/subversion/trunk/build.conf?rev=1798156&r1=1798155&r2=1798156&view=diff
==============================================================================
--- subversion/trunk/build.conf (original)
+++ subversion/trunk/build.conf Fri Jun  9 00:29:38 2017
@@ -1714,3 +1714,11 @@ type = exe
 path = tools/client-side/svnconflict
 install = tools
 libs = libsvn_client libsvn_wc libsvn_ra libsvn_subr apriconv apr
+
+[afl-x509]
+description = AFL fuzzer for x509 parser
+type = exe
+path = subversion/tests/afl
+sources = afl-x509.c
+install = test
+libs = libsvn_subr apr

Propchange: subversion/trunk/subversion/tests/afl/
------------------------------------------------------------------------------
--- svn:ignore (added)
+++ svn:ignore Fri Jun  9 00:29:38 2017
@@ -0,0 +1,3 @@
+*.lo
+.libs
+afl-x509

Added: subversion/trunk/subversion/tests/afl/README
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/tests/afl/README?rev=1798156&view=auto
==============================================================================
--- subversion/trunk/subversion/tests/afl/README (added)
+++ subversion/trunk/subversion/tests/afl/README Fri Jun  9 00:29:38 2017
@@ -0,0 +1,31 @@
+American Fuzzy Lop (AFL) is available from all good distros, or from
+the upstream site: http://lcamtuf.coredump.cx/afl/
+
+Configure to build the instumented binary:
+
+  CC=afl-gcc ../src/configure --disable-shared --enable-static
+
+Build the binary:
+
+   make clean
+   make afl-x509
+
+Run the fuzzer (you may need root to change the CPU governor):
+
+   mkdir afl-findings
+   afl-fuzz -i ../src/subversion/tests/afl/afl-x509-testcase \
+            -o afl-findings -M fuzzer01 \
+            subversion/tests/afl/afl-x509
+   afl-fuzz -i ../src/subversion/tests/afl/afl-x509-testcase \
+            -o afl-findings -S fuzzer02 \
+            subversion/tests/afl/afl-x509
+   afl-fuzz -i ../src/subversion/tests/afl/afl-x509-testcase \
+            -o afl-findings -S fuzzer03 \
+            subversion/tests/afl/afl-x509
+
+Wait, burning CPU...
+
+Testcases that cause SEGVs are easier to debug using a separate build
+without AFL instrumentation:
+
+   gdb --args subversion/tests/afl/afl-x509 afl-findings/fuzzer01/crashes/some-test-case

Propchange: subversion/trunk/subversion/tests/afl/README
------------------------------------------------------------------------------
    svn:eol-style = native

Added: subversion/trunk/subversion/tests/afl/afl-x509-testcase/test1
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/tests/afl/afl-x509-testcase/test1?rev=1798156&view=auto
==============================================================================
Binary file - no diff available.

Propchange: subversion/trunk/subversion/tests/afl/afl-x509-testcase/test1
------------------------------------------------------------------------------
    svn:mime-type = application/octet-stream

Added: subversion/trunk/subversion/tests/afl/afl-x509.c
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/tests/afl/afl-x509.c?rev=1798156&view=auto
==============================================================================
--- subversion/trunk/subversion/tests/afl/afl-x509.c (added)
+++ subversion/trunk/subversion/tests/afl/afl-x509.c Fri Jun  9 00:29:38 2017
@@ -0,0 +1,75 @@
+/*
+ * afl-x509.c an American Fuzz Lop test
+ *
+ * ====================================================================
+ *    Licensed to the Apache Software Foundation (ASF) under one
+ *    or more contributor license agreements.  See the NOTICE file
+ *    distributed with this work for additional information
+ *    regarding copyright ownership.  The ASF licenses this file
+ *    to you under the Apache License, Version 2.0 (the
+ *    "License"); you may not use this file except in compliance
+ *    with the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *    Unless required by applicable law or agreed to in writing,
+ *    software distributed under the License is distributed on an
+ *    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *    KIND, either express or implied.  See the License for the
+ *    specific language governing permissions and limitations
+ *    under the License.
+ * ====================================================================
+ *
+ */
+
+/*  The input data can either be a file on disk or provided via stdin:
+
+       afl-x509 some-file
+       afl-x509 < some-file
+
+    In practice the file simply contains random binary data. The data
+    are interpreted as a (base64 decoded) x509 cert and a parse is
+    attempted. */
+
+#include "svn_x509.h"
+#include "svn_cmdline.h"
+#include "svn_pools.h"
+#include "svn_io.h"
+
+#include <stdlib.h>
+
+static svn_error_t *
+parse(const char *filename, apr_pool_t *pool)
+{
+  svn_stringbuf_t *buf;
+  svn_x509_certinfo_t *certinfo;
+
+  SVN_ERR(svn_stringbuf_from_file2(&buf, filename, pool));
+  SVN_ERR(svn_x509_parse_cert(&certinfo, buf->data, buf->len, pool, pool));
+
+  return SVN_NO_ERROR;
+}
+
+int main(int argc, char **argv)
+{
+  apr_pool_t *pool;
+  int exit_code = EXIT_SUCCESS;
+  svn_error_t *err;
+  const char *filename;
+
+  if (argc == 2)
+    filename = argv[1];
+  else
+    filename = "-";
+
+  if (svn_cmdline_init("afl-x509", stderr) != EXIT_SUCCESS)
+    return EXIT_FAILURE;
+  pool = apr_allocator_owner_get(svn_pool_create_allocator(FALSE));
+
+  err = parse(filename, pool);
+  if (err)
+    exit_code = EXIT_FAILURE;
+  svn_error_clear(err);
+  svn_pool_destroy(pool);
+  return exit_code;
+}

Propchange: subversion/trunk/subversion/tests/afl/afl-x509.c
------------------------------------------------------------------------------
    svn:eol-style = native



Mime
View raw message