Provide an interface for fuzzing sequence producer plugins

This commit is contained in:
Elliot Gorokhovsky
2023-03-28 12:02:57 -07:00
parent 9420bce8a4
commit a810e1eeb7
21 changed files with 297 additions and 14 deletions
+16
View File
@@ -0,0 +1,16 @@
# Copyright (c) Yann Collet, Meta Platforms, Inc.
# All rights reserved.
#
# This source code is licensed under both the BSD-style license (found in the
# LICENSE file in the root directory of this source tree) and the GPLv2 (found
# in the COPYING file in the root directory of this source tree).
# You may select, at your option, one of the above-listed licenses.
CC = clang
CFLAGS = -g -fno-omit-frame-pointer -fsanitize=undefined,address,fuzzer -I../ -I../../../lib/
.PHONY: default
default: example_seq_prod.o
example_seq_prod.o: example_seq_prod.c
$(CC) -c $(CFLAGS) $^ -o $@
@@ -0,0 +1,12 @@
# Fuzzing a Custom Sequence Producer Plugin
This directory contains example code for using a custom sequence producer in the zstd fuzzers.
You can build and run the code in this directory using these commands:
```
$ make corpora
$ make -C seq_prod_fuzz_example/
$ python3 ./fuzz.py build all --enable-fuzzer --enable-asan --enable-ubsan --cc clang --cxx clang++ --custom-seq-prod=seq_prod_fuzz_example/example_seq_prod.o
$ python3 ./fuzz.py libfuzzer simple_round_trip
```
See `../fuzz_third_party_seq_prod.h` and `../README.md` for more information on zstd fuzzing.
@@ -0,0 +1,52 @@
/*
* Copyright (c) Yann Collet, Meta Platforms, Inc.
* All rights reserved.
*
* This source code is licensed under both the BSD-style license (found in the
* LICENSE file in the root directory of this source tree) and the GPLv2 (found
* in the COPYING file in the root directory of this source tree).
* You may select, at your option, one of the above-listed licenses.
*/
#include "fuzz_third_party_seq_prod.h"
#include <assert.h>
#include <stdlib.h>
#include <string.h>
_Thread_local size_t threadLocalState;
size_t FUZZ_seqProdSetup(void) {
threadLocalState = 0;
return 0;
}
size_t FUZZ_seqProdTearDown(void) {
return 0;
}
void* FUZZ_createSeqProdState(void) {
return calloc(1, sizeof(size_t));
}
size_t FUZZ_freeSeqProdState(void* state) {
free(state);
return 0;
}
size_t FUZZ_thirdPartySeqProd(
void* sequenceProducerState,
ZSTD_Sequence* outSeqs, size_t outSeqsCapacity,
const void* src, size_t srcSize,
const void* dict, size_t dictSize,
int compressionLevel,
size_t windowSize
) {
/* Try to catch unsafe use of the shared state */
size_t* const sharedStatePtr = (size_t*)sequenceProducerState;
assert(*sharedStatePtr == threadLocalState);
(*sharedStatePtr)++; threadLocalState++;
/* Check that fallback is enabled when FUZZ_THIRD_PARTY_SEQ_PROD is defined */
return ZSTD_SEQUENCE_PRODUCER_ERROR;
}