sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-02 09:47:23 +03:00
Code

lib/fuzzing: Split up automatically build fuzzers into TYPE_{IN,OUT,STRUCT}

Browse Source 
The advise is that a fuzz target should be as small as possible
so we split this up.  Splitting up by function would build too
many fuzzers, but this should help a little.

See for example:
https://github.com/google/fuzzing/blob/master/docs/good-fuzz-target.md#large-apis

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@samba.org>
This commit is contained in:
Andrew Bartlett 2019-12-11 13:03:43 +13:00
parent 6e5aefc2d3
commit e6fc8e79ae
3 changed files with 32 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
buildtools/wafsamba/samba_pidl.py
View File

@ -123,7 +123,19 @@ def SAMBA_PIDL_LIST(bld, name, source,
# the fuzzers rely
if generate_tables and generate_fuzzers:
interface = p[0:-4] # strip off the .idl suffix
bld.SAMBA_NDR_FUZZ(interface, auto_deps=True)
bld.SAMBA_NDR_FUZZ(interface,
auto_deps=True,
fuzz_type="TYPE_STRUCT")
# Only generate the TYPE_STRUCT fuzzer if this isn't
# really DCE/RPC
if '--client' in options:
bld.SAMBA_NDR_FUZZ(interface,
auto_deps=True,
fuzz_type="TYPE_IN")
bld.SAMBA_NDR_FUZZ(interface,
auto_deps=True,
fuzz_type="TYPE_OUT")
Build.BuildContext.SAMBA_PIDL_LIST = SAMBA_PIDL_LIST

14
lib/fuzzing/fuzz_ndr_X.c
View File

@ -192,6 +192,20 @@ int LLVMFuzzerTestOneInput(uint8_t *data, size_t size) {
function = SVAL(data, 2);
type = fuzz_packet_flags & 3;
#ifdef FUZZ_TYPE
/*
* Fuzz targets should have as small an interface as possible.
* This allows us to create 3 binaries for most pipes,
* TYPE_IN, TYPE_OUT and TYPE_STRUCT
*
* We keep the header format, and just exit early if it does
* not match.
*/
if (type != FUZZ_TYPE) {
return 0;
}
#endif
#endif
switch (type) {

8
lib/fuzzing/wscript_build
View File

@ -59,10 +59,12 @@ def SAMBA_NDR_FUZZ(bld, interface, auto_deps=False,
fuzz_src = os.path.join(fuzz_reldir, 'fuzz_ndr_X.c')
cflags = "-D FUZZ_PIPE_TABLE=ndr_table_%s" % interface
if fuzz_type:
name += "_%s" % (fuzz_type)
cflags += " -D FUZZ_TYPE=%s " % (fuzz_type)
if fuzz_type and fuzz_function:
name += "_%s_%d" % (fuzz_type, fuzz_function)
cflags += " -D FUZZ_TYPE=%s -DFUZZ_FUNCTION=%d" % (fuzz_type,
fuzz_function)
name += "_%d" % (fuzz_function)
cflags += " -D FUZZ_FUNCTION=%d" % (fuzz_function)
fuzz_named_src = os.path.join(fuzz_reldir,
'%s.c' % (name))