sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
Code
dab793469f
samba-mirror/lib/fuzzing
History
Andrew Bartlett 8f66ce0a3d oss-fuzz: Add very verbose explaination for RPATH vs RUNPATH 
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org>
Autobuild-Date(master): Fri Oct 23 00:33:57 UTC 2020 on sn-devel-184
2020-10-23 00:33:57 +00:00
..
oss-fuzz oss-fuzz: Add very verbose explaination for RPATH vs RUNPATH 2020-10-23 00:33:57 +00:00
afl-fuzz-main.c lib/fuzzing: Allow load of fuzz inputs as files on the command line 2019-12-18 06:39:26 +00:00
decode_ndr_X_crash decode_ndr_X_crash: always find pipe in honggfuzz file 2020-01-12 19:50:37 +00:00
fuzz_cli_credentials_parse_string.c fuzz: add fuzz_cli_credentials_parse_string 2020-10-16 04:45:40 +00:00
fuzz_dcerpc_parse_binding.c fuzz_dcerpc_parse_binding: don't leak 2020-10-20 02:26:40 +00:00
fuzz_ldap_decode.c CVE-2020-10704: libcli ldap_message: Add search size limits to ldap_decode 2020-05-04 02:59:32 +00:00
fuzz_ldb_dn_explode.c fuzzing: check for NULL on ldb_init() 2020-01-17 12:59:35 +00:00
fuzz_ldb_ldif_read.c fuzzing: check for NULL on ldb_init() 2020-01-17 12:59:35 +00:00
fuzz_ldb_parse_binary_decode.c fuzz: ldb binary decode/enode 2020-01-15 19:58:41 +00:00
fuzz_ldb_parse_control.c fuzzing: check for NULL on ldb_init() 2020-01-17 12:59:35 +00:00
fuzz_ldb_parse_tree.c lib/fuzzing: Fix argument order to ldb_filter_from_tree in fuzz_ldb_parse_tree 2019-12-11 04:21:28 +00:00
fuzz_lzxpress.c Add fuzzing binary for lzxpress 2019-10-18 07:31:45 +00:00
fuzz_ndr_X.c fuzzing: ndr set global_max_recursion. 2020-02-27 01:02:32 +00:00
fuzz_nmblib_parse_packet.c fuzz: add nmblib/parse_packet target 2020-01-15 21:24:31 +00:00
fuzz_oLschema2ldif.c fuzz_oLschema2ldif: check multiple possible NULLs 2020-01-17 14:33:18 +00:00
fuzz_reg_parse.c lib/fuzzing: Tell the compiler we know we are ignoring errors in fuzz_reg_parse 2019-12-10 07:50:28 +00:00
fuzz_regfio.c Add fuzzing binary for regfio 2019-10-18 07:31:45 +00:00
fuzz_tiniparser.c lib/fuzzing: Free memory after successful load in fuzz_tiniparser 2019-11-18 21:02:52 +00:00
fuzzing.c
fuzzing.h
README.md fuzzing/README: link to wiki 2020-10-21 02:28:38 +00:00
wscript_build fuzz: add fuzz_cli_credentials_parse_string 2020-10-16 04:45:40 +00:00

README.md

Fuzzing Samba

See also https://wiki.samba.org/index.php/Fuzzing

Fuzzing supplies valid, invalid, unexpected or random data as input to a piece of code. Instrumentation, usually compiler-implemented, is used to monitor for exceptions such as crashes, assertions or memory corruption.

See Wikipedia article on fuzzing for more information.

Honggfuzz

Configure with fuzzing

Example command line to build binaries for use with honggfuzz:

buildtools/bin/waf -C --without-gettext --enable-debug --enable-developer \
	--address-sanitizer --enable-libfuzzer --abi-check-disable \
	CC=.../honggfuzz/hfuzz_cc/hfuzz-clang configure \
	LINK_CC=.../honggfuzz/hfuzz_cc/hfuzz-clang

Fuzzing tiniparser

Example for fuzzing tiniparser using honggfuzz (see --help for more options):

buildtools/bin/waf --targets=fuzz_tiniparser build && \
.../honggfuzz/honggfuzz --sanitizers --timeout 3 --max_file_size 256 \
  --rlimit_rss 100 -f .../tiniparser-corpus -- bin/fuzz_tiniparser

AFL (american fuzzy lop)

Configure with fuzzing

Example command line to build binaries for use with afl

buildtools/bin/waf -C --without-gettext --enable-debug --enable-developer \
	--enable-afl-fuzzer --abi-check-disable \
	CC=afl-gcc configure

Fuzzing tiniparser

Example for fuzzing tiniparser using afl-fuzz (see --help for more options):

buildtools/bin/waf --targets=fuzz_tiniparser build && \
afl-fuzz -m 200 -i inputdir -o outputdir -- bin/fuzz_tiniparser

oss-fuzz

Samba can be fuzzed by Google's oss-fuzz system. Assuming you have an oss-fuzz checkout from https://github.com/google/oss-fuzz with Samba's metadata in projects/samba, the following guides will help:

Testing locally

https://google.github.io/oss-fuzz/getting-started/new-project-guide/#testing-locally

Debugging oss-fuzz

See https://google.github.io/oss-fuzz/advanced-topics/debugging/

Samba-specific hints

A typical debugging workflow is:

oss-fuzz$ python infra/helper.py shell samba git fetch $REMOTE $BRANCH git checkout FETCH_HEAD lib/fuzzing/oss-fuzz/build_image.sh compile

This will pull in any new Samba deps and build Samba's fuzzers.

vim: set sw=8 sts=8 ts=8 tw=79 :