summaryrefslogtreecommitdiff
path: root/lib/fuzzing
Commit message (Collapse)AuthorAgeFilesLines
* lib/fuzzing: add fuzzer for sddl_parseDouglas Bagnall2023-04-282-0/+70
| | | | | | | | | Apart from catching crashes in the actual parsing, we abort if the SD we end up with will not round trip back through SDDL to an identical SD. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* lib:fuzzing: Fix code spellingAndreas Schneider2023-04-033-5/+5
| | | | | | | Best reviewed with: `git show --word-diff`. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* fuzz: fix lzxpress plain round-trip fuzzerDouglas Bagnall2022-12-191-1/+4
| | | | | | | | | | | The 'compressed' string can be about 9/8 the size of the decompressed string, but we didn't allow enough memory in the fuzz target for that. Then when it failed, we didn't check. Credit to OSSFuzz. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
* fuzz: add fuzz_lzxpress_huffman_round_tripDouglas Bagnall2022-12-012-0/+73
| | | | | | | | This compresses some data, decompresses it, and asserts that the result is identical to the original string. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* fuzz: add fuzz_lzxpress_huffman_compressDouglas Bagnall2022-12-012-0/+63
| | | | | | | | | This differs from fuzz_lzxpress_huffman_round_trip (next commit) in that the output buffer might be too small for the compressed data, in which case we want to see an error and not a crash. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* fuzz: add fuzz_lzxpress_huffman_decompressDouglas Bagnall2022-12-012-0/+53
| | | | | | | | Most strings will not successfully decompress, which is OK. What we care about of course is memory safety. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* fuzz: add fuzzers for stable_sortDouglas Bagnall2022-12-013-0/+167
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* lib:fuzzing: Fix shellcheck errors in build_samba.shAndreas Schneider2022-08-171-2/+2
| | | | | | | lib/fuzzing/oss-fuzz/build_samba.sh:24:27: error: Double quote array expansions to avoid re-splitting elements. [SC2068] Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
* fuzz: add lzxpress compress/decompress round-tripDouglas Bagnall2022-05-122-0/+58
| | | | | | | We say it is an error to end up at a different result. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* fuzz: add fuzz_lzxpress_compressDouglas Bagnall2022-05-122-0/+40
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* lib/fuzzing/README.md: don't use waf directlyStefan Metzmacher2022-03-291-6/+6
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* lib:fuzzing: Reformat shell scriptsAndreas Schneider2022-02-243-67/+65
| | | | | | shfmt -f lib/fuzzing/ | xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s3:rpc_server: Activate samba-dcerpcdVolker Lendecke2021-12-101-1/+1
| | | | | | | | | | | | | | This is the big switch to use samba-dcerpcd for the RPC services in source3/. It is a pretty big and unordered patch, but I don't see a good way to split this up into more manageable pieces without sacrificing bisectability even more. Probably I could cut out a few small ones, but a major architechtural switch like this will always be messy. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* lib:fuzzing: Fix quoting of --fuzz-target-ldflagsAndreas Schneider2021-10-041-1/+1
| | | | | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Uri Simchoni <uri@samba.org> Autobuild-User(master): Uri Simchoni <uri@samba.org> Autobuild-Date(master): Mon Oct 4 11:36:06 UTC 2021 on sn-devel-184
* fuzzing/oss-fuzz: strip RUNPATH from dependenciesUri Simchoni2021-09-091-0/+14
| | | | | | | | | Strip all RUNPATH headers from all dependency shared objects that we copy to the fuzzing target, as those libraries aren't placed in their original place. Signed-off-by: Uri Simchoni <uri@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* fuzzing/oss-fuzz: fix samba build script for Ubuntu 20.04Uri Simchoni2021-09-091-1/+4
| | | | | | | | Add a linker flag to generate fuzzer binaries with an RPATH header instead of RUNPATH. Signed-off-by: Uri Simchoni <uri@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* fuzzing/oss-fuzz: fix RPATH comments for post-Ubuntu-16.04 eraUri Simchoni2021-09-092-11/+6
| | | | | | | | | Remove what appears to be a copy+paste error in one place, and explain that RPATH/RUNPATH is set by the linker, not by chrpath utility. Signed-off-by: Uri Simchoni <uri@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* fuzzing/oss-fuzz: fix image build recipe for Ubuntu 20.04Uri Simchoni2021-09-091-1/+1
| | | | | | | | | | | Update the build_image.sh script to install Ubuntu 20.04 packages instead of Ubuntu 16.04 on the oss-fuzz container - this will allow the oss-fuzz container to be based on Ubuntu 20.04. REF: https://github.com/google/oss-fuzz/issues/6301#issuecomment-911705365 Signed-off-by: Uri Simchoni <uri@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* fuzz: add fuzz_parse_lpq_entryDouglas Bagnall2021-07-052-0/+70
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* fuzz: fix multiple comment headersDouglas Bagnall2021-07-056-6/+6
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* oss-fuzz: Update build script to be compatible with rpm distrosSamuel Cabrero2021-04-061-1/+5
| | | | | | | | | | | | | | The /etc/default/locale file does not exists in the rpm family distros so the do_build.sh script failed with: ./lib/fuzzing/oss-fuzz/do_build.sh: line 31: /etc/default/locale: No such file or directory Signed-off-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: David Mulder <dmulder@samba.org> Autobuild-User(master): Samuel Cabrero <scabrero@samba.org> Autobuild-Date(master): Tue Apr 6 15:54:54 UTC 2021 on sn-devel-184
* fuzz:afl main: run the initialisation functionDouglas Bagnall2021-03-161-1/+9
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
* fuzz: add a LLVMFuzzerInitialize() to all fuzzersDouglas Bagnall2021-03-168-0/+48
| | | | | | | | | | | | To compile the AFL binaries, we need every fuzzer to have a consistent set of functions. Some fuzzers require the initialize function, so all the rest must have an empty one. AFL binaires are handy for testing the fuzz results in a less magical environment than libfuzzer/honggfuzz give you. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
* fuzz:afl main: add a diagnostic messageDouglas Bagnall2021-03-161-0/+2
| | | | | | | | LLVMFuzzerTestOneInput() NEVER returns non-zero, but if it does, we might as well know what made it do so Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
* fuzz/afl main: don't treat fuzzer as fuzzeeDouglas Bagnall2021-03-161-2/+2
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
* oss-fuzz: Add very verbose explaination for RPATH vs RUNPATHAndrew Bartlett2020-10-231-3/+140
| | | | | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Fri Oct 23 00:33:57 UTC 2020 on sn-devel-184
* oss-fuzz: Always run the check, even on the oss-fuzz platformAndrew Bartlett2020-10-222-118/+143
| | | | | | | | | | | | | | | | It is much harder to determine why we get messages like Step #6: Error occured while running fuzz_reg_parse: Step #6: /workspace/out/coverage/fuzz_reg_parse: error while loading shared libraries: libavahi-common.so.3: cannot open shared object file: No such file or directory instead this detects the failure to use RPATH (which is strictly required instead of the modern RUNPATH) otherwise. We do this by creating a new build_samba.sh after renaming build_samba.sh to do_build.sh because this is what oss-fuzz runs, meaning we don't need to coordinate a MR there as well. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* oss-fuzz: update comment to reference RPATH for the static-ish binariesAndrew Bartlett2020-10-221-1/+1
| | | | | | | | We strictly require RPATH, so fix the comment to avoid mentioning the modern RUNPATH which is almost but not entirely similar. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* oss-fuzz: standardise on RPATH for the static-ish binariesAndrew Bartlett2020-10-222-14/+20
| | | | | | | | | | | | | | | This includes a revert of commit e60df214998afc145ca482cab184691b3ddc3bb2. We strictly require RPATH, not the modern RUNPATH for the behaviour we need in oss-fuzz, which is that not just the first line of dependencies but the full set of libraries used by the program are looked for in the '$ORIGIN/lib' directory. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Thu Oct 22 14:10:04 UTC 2020 on sn-devel-184
* fuzzing: Improve robustness and documentation of the ldd-base library copyAndrew Bartlett2020-10-221-3/+16
| | | | | | | | | | | This tries to make progress towards understanding why we sometime see errors like Step #6: Error occured while running fuzz_reg_parse: Step #6: /workspace/out/coverage/fuzz_reg_parse: error while loading shared libraries: libavahi-common.so.3: cannot open shared object file: No such file or directory in the previously failing coverage builds. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* fuzzing: Fix the oss-fuzz coverage buildAndrew Bartlett2020-10-211-1/+8
| | | | | | | | | | | | | | | | | | | It was long thought that the issue here was that no seed corpus was provided, but actually the issue is that to obtain coverage output just as we already know for gcc gcov, you must provide fuzzing flags to both the compile and link phase. Thankfully clang as a linker does not mind the strange non-linker options from $COVERAGE_FLAGS. REF: https://stackoverflow.com/questions/56112019/clang-does-not-generate-profraw-file-when-linking-manually REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19495#c48 Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Oct 21 23:07:37 UTC 2020 on sn-devel-184
* fuzz/oss-fuzz/build_samba: fetch fuzz seedsDouglas Bagnall2020-10-212-0/+27
| | | | | | | | | | | | | | | | | | | | | | | | | There is a git repository at https://gitlab.com/samba-team/samba-fuzz-seeds that contains the seeds. When the master branch of that repository is updated, a CI job runs that creates a zip file of all the seeds as an artifact. That zip file is downloaded and unpacked by oss_fuzz/build_samba. The contents of that zip are further zips that contain the seeds for each fuzzing binary; these are placed next to the binaries in the manner that oss-fuzz expects. That is, beside 'fuzz_foo', we put 'fuzz_foo_seed_corpus.zip' which contains a pile of fuzz_foo seeds. There may be times when a new fuzz target does not have a seed corpus, and times when a removed fuzz target leaves behind a seed corpus. This is OK, so we don't insist on an exact match between the target names and the zip names, only that there is some overlap. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Oct 21 03:47:35 UTC 2020 on sn-devel-184
* fuzz/oss-fuzz/build-samba: note the calling siteDouglas Bagnall2020-10-211-1/+6
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* fuzzing/README: link to wikiDouglas Bagnall2020-10-211-1/+3
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* fuzz_dcerpc_parse_binding: don't leakDouglas Bagnall2020-10-201-1/+3
| | | | | | | | | | | Also, by not tallocing at all in the too-long case, we can short circuit quicker. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue Oct 20 02:26:40 UTC 2020 on sn-devel-184
* fuzz: add fuzz_cli_credentials_parse_stringDouglas Bagnall2020-10-162-0/+62
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* fuzz: add fuzz_dcerpc_parse_bindingDouglas Bagnall2020-10-162-0/+73
| | | | | | | | We parse a binding and do a few tricks with it, including turning it into a tower and back. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* oss-fuzz: standardise on RUNPATH for the static-ish binariesAndrew Bartlett2020-09-111-0/+11
| | | | | | | | | | | | | | | | | We use ld.bfd for the coverage builds, rather than the faster ld.gold. We run the oss-fuzz autobuild target on Ubuntu 16.04 to more closely mirror the environment provided by the Google oss-fuzz build container. On Ubuntu 16.04, when linking with ld.bfd built binaries get a RPATH, but builds in Ubuntu 18.04 and those using ld.gold get a RUNPATH. Just convert them all to RUNPATH to make the check_build.sh test (run by the oss-fuzz autobuild target) easier. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* oss-fuzz: Ensure a UTF8 locale is set for the samba buildAndrew Bartlett2020-08-261-0/+6
| | | | | | | | | | | | | | | | This ensures that LANG=en_US.UTF8 is set, which Samba's build system needs to operate in UTF8 mode. The change to use flex to generate code meant that this difference between GitLab CI and oss-fuzz was exposed. REF: https://github.com/google/oss-fuzz/pull/4366 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Aug 26 03:20:46 UTC 2020 on sn-devel-184
* oss-fuzz: Try harder to ensure we always fail fastAndrew Bartlett2020-08-261-1/+8
| | | | | | | | | | During a previous attempt to fix the LANG= issue I changed the script invocation to be via a shell, so the set -x et al ensures these are always in place and we fail fast rather than failures only being detected by lack of output. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* oss-fuzz: use uninstrumented dynamic pythonDouglas Bagnall2020-08-031-0/+6
| | | | | | | | | | | | We can't link to the instrumented statically built Python, so instead we use the system Python in the docker image. REF: https://github.com/google/oss-fuzz/issues/4223 REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22618 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14451 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2020-10704: libcli ldap_message: Add search size limits to ldap_decodeGary Lockyer2020-05-041-1/+8
| | | | | | | | | | | | | | | | Add search request size limits to ldap_decode calls. The ldap server uses the smb.conf variable "ldap max search request size" which defaults to 250Kb. For cldap the limit is hard coded as 4096. Credit to OSS-Fuzz REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2020-10704: lib util asn1: Add ASN.1 max tree depthGary Lockyer2020-05-041-1/+5
| | | | | | | | | | | | | Add maximum parse tree depth to the call to asn1_init, which will be used to limit the depth of the ASN.1 parse tree. Credit to OSS-Fuzz REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* fuzzing: ndr set global_max_recursion.Gary Lockyer2020-02-271-0/+1
| | | | | | | | | | | | | Set global_max_recursion to 128, to ensure the fuzzer does not trip the ASAN maximum stack depth which seems to be about 256? Credit to OSS-Fuzz REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19820 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14254 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* fuzz_oLschema2ldif: check multiple possible NULLsDouglas Bagnall2020-01-171-0/+11
| | | | | | | | | | | Address sanitizer will object to a theoretically possible NULL dereference so we can't ignore these checks in set-up. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Fri Jan 17 14:33:18 UTC 2020 on sn-devel-184
* fuzzing: check for NULL on ldb_init()Douglas Bagnall2020-01-173-2/+11
| | | | | | | We simply return 0 because failure here is not a problem with the code we are actually trying to fuzz. Without this asan is unhappy. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* fuzz: add nmblib/parse_packet targetDouglas Bagnall2020-01-152-0/+61
| | | | | | | | | | | | We want to ensure that parse_packet() can parse a packet without crashing, and that that parsed packet won't cause trouble further down the line. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Autobuild-User(master): Gary Lockyer <gary@samba.org> Autobuild-Date(master): Wed Jan 15 21:24:31 UTC 2020 on sn-devel-184
* fuzz: ldb binary decode/enodeDouglas Bagnall2020-01-152-0/+54
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* fuzz: add ldb ldif fuzzerDouglas Bagnall2020-01-152-0/+52
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* fuzz: ldb_dn parsingDouglas Bagnall2020-01-152-0/+49
| | | | | Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
View Lorry Controller Status