Skip to content

Commit

Permalink
fuzzing: added target, fixed harness bugs, and beautified
Browse files Browse the repository at this point in the history 
Add fuzzing targets:

1. djb hash
2. murmur hash2
3. parse
4. sha1
5. uri decode, uri encode
6. utf8 casecmp
7. websocket base64 encode
8. websocket frame

Add 'nxt_conf_json_length' check for better coverage.

'nxt_http_h1p_fuzz.c' False positive bugs in harness due to improper
use of the internal API.

Fixes: a93d878 ("fuzzing: add fuzzing targets")

Signed-off-by: Arjun <pkillarjun@protonmail.com>
  • Loading branch information
@pkillarjun
pkillarjun committed Jul 27, 2024
1 parent 61c13ad commit 25b3669
Show file tree
Hide file tree
Showing 5 changed files with 264 additions and 58 deletions.
144 changes: 143 additions & 1 deletion fuzzing/nxt_basic_fuzz.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,19 +3,31 @@
*/

#include <nxt_main.h>
#include <nxt_sha1.h>
#include <nxt_websocket.h>
#include <nxt_websocket_header.h>
#include <nxt_websocket_accept.c>


#define KMININPUTLENGTH 2
#define KMININPUTLENGTH 4
#define KMAXINPUTLENGTH 128


extern int LLVMFuzzerInitialize(int *argc, char ***argv);
extern int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);

void nxt_base64_fuzz(const u_char *data, size_t size);
void nxt_djb_hash_fuzz(const u_char *data, size_t size);
void nxt_murmur_hash2_fuzz(const u_char *data, size_t size);
void nxt_parse_fuzz(const u_char *data, size_t size);
void nxt_sha1_fuzz(const u_char *data, size_t size);
void nxt_sha1_update_fuzz(const u_char *data, size_t size);
void nxt_term_fuzz(const u_char *data, size_t size);
void nxt_time_fuzz(const u_char *data, size_t size);
void nxt_uri_fuzz(const u_char *data, size_t size);
void nxt_utf8_fuzz(const u_char *data, size_t size);
void nxt_websocket_base64_fuzz(const u_char *data, size_t size);
void nxt_websocket_frame_fuzz(const u_char *data, size_t size);


extern char **environ;
Expand All @@ -40,9 +52,17 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
}

nxt_base64_fuzz(data, size);
nxt_djb_hash_fuzz(data, size);
nxt_murmur_hash2_fuzz(data, size);
nxt_parse_fuzz(data, size);
nxt_sha1_fuzz(data, size);
nxt_sha1_update_fuzz(data, size);
nxt_term_fuzz(data, size);
nxt_time_fuzz(data, size);
nxt_uri_fuzz(data, size);
nxt_utf8_fuzz(data, size);
nxt_websocket_base64_fuzz(data, size);
nxt_websocket_frame_fuzz(data, size);

return 0;
}
Expand All @@ -66,6 +86,64 @@ nxt_base64_fuzz(const u_char *data, size_t size)
}


void
nxt_djb_hash_fuzz(const u_char *data, size_t size)
{
nxt_djb_hash(data, size);
nxt_djb_hash_lowcase(data, size);
}


void
nxt_murmur_hash2_fuzz(const u_char *data, size_t size)
{
nxt_murmur_hash2(data, size);
nxt_murmur_hash2_uint32(data);
}


void
nxt_parse_fuzz(const u_char *data, size_t size)
{
nxt_str_t input;

input.start = (u_char *)data;
input.length = size;

nxt_int_parse(data, size);
nxt_size_t_parse(data, size);
nxt_size_parse(data, size);
nxt_off_t_parse(data, size);
nxt_str_int_parse(&input);
nxt_number_parse(&data, data + size);
}


void
nxt_sha1_fuzz(const u_char *data, size_t size)
{
u_char bin_accept[20];
nxt_sha1_t ctx;

nxt_sha1_init(&ctx);
nxt_sha1_update(&ctx, data, size);
nxt_sha1_final(bin_accept, &ctx);
}


void
nxt_sha1_update_fuzz(const u_char *data, size_t size)
{
u_char bin_accept[20];
nxt_sha1_t ctx;

nxt_sha1_init(&ctx);
nxt_sha1_update(&ctx, data, size);
nxt_sha1_update(&ctx, data, size);
nxt_sha1_final(bin_accept, &ctx);
}


void
nxt_term_fuzz(const u_char *data, size_t size)
{
Expand All @@ -81,11 +159,75 @@ nxt_time_fuzz(const u_char *data, size_t size)
}


void
nxt_uri_fuzz(const u_char *data, size_t size)
{
u_char *dst;

dst = nxt_zalloc(size * 3);
if (dst == NULL) {
return;
}

nxt_decode_uri(dst, (u_char *)data, size);
nxt_decode_uri_plus(dst, (u_char *)data, size);

nxt_encode_uri(NULL, (u_char *)data, size);
nxt_encode_uri(dst, (u_char *)data, size);

nxt_free(dst);
}


void
nxt_utf8_fuzz(const u_char *data, size_t size)
{
const u_char *in;

in = data;
nxt_utf8_decode(&in, data + size);

nxt_utf8_casecmp((u_char *)"ABC АБВ ΑΒΓ",
data,
nxt_length("ABC АБВ ΑΒΓ"),
size);
}


void
nxt_websocket_base64_fuzz(const u_char *data, size_t size)
{
u_char *out;

out = nxt_zalloc(size * 2);
if (out == NULL) {
return;
}

nxt_websocket_base64_encode(out, data, size);

nxt_free(out);
}


void
nxt_websocket_frame_fuzz(const u_char *data, size_t size)
{
char *input;

/*
* Resolve overwrites-const-input by using a copy of the data.
*/
input = nxt_malloc(size);
if (input == NULL) {
return;
}

nxt_memcpy(input, data, size);

nxt_websocket_frame_init(input, 0);
nxt_websocket_frame_header_size(input);
nxt_websocket_frame_payload_len(input);

nxt_free(input);
}
36 changes: 23 additions & 13 deletions fuzzing/nxt_http_controller_fuzz.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ int
LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
nxt_mp_t *mp;
nxt_int_t rc;
nxt_buf_mem_t buf;
nxt_controller_request_t *r_controller;
nxt_http_request_parse_t rp;
Expand All @@ -51,27 +52,22 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
return 0;
}

mp = nxt_mp_create(1024, 128, 256, 32);
if (mp == NULL) {
return 0;
}

nxt_memzero(&rp, sizeof(nxt_http_request_parse_t));
if (nxt_http_parse_request_init(&rp, mp) != NXT_OK) {
goto failed;
}

buf.start = (u_char *)data;
buf.end = (u_char *)data + size;
buf.pos = buf.start;
buf.free = buf.end;

if (nxt_http_parse_request(&rp, &buf) != NXT_DONE) {
goto failed;

/*
* Create memory pool.
* Initialize 'nxt_controller_request_t'
*/
mp = nxt_mp_create(1024, 128, 256, 32);
if (mp == NULL) {
return 0;
}

r_controller = nxt_mp_zget(mp, sizeof(nxt_controller_request_t));

if (r_controller == NULL) {
goto failed;
}
Expand All @@ -84,6 +80,20 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
nxt_main_log.level = NXT_LOG_ALERT;
r_controller->conn->log = nxt_main_log;

/*
* Process request and fields.
*/
nxt_memzero(&rp, sizeof(nxt_http_request_parse_t));

if (nxt_http_parse_request_init(&rp, mp) != NXT_OK) {
goto failed;
}

rc = nxt_http_parse_request(&rp, &buf);
if (rc != NXT_DONE) {
goto failed;
}

nxt_http_fields_process(rp.fields, &nxt_controller_fields_hash,
r_controller);

Expand Down
48 changes: 38 additions & 10 deletions fuzzing/nxt_http_h1p_fuzz.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ int
LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
nxt_mp_t *mp;
nxt_int_t rc;
nxt_buf_mem_t buf;
nxt_http_request_t *r_h1p;
nxt_http_request_parse_t rp;
Expand All @@ -50,32 +51,59 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
return 0;
}

buf.start = (u_char *)data;
buf.end = (u_char *)data + size;
buf.pos = buf.start;
buf.free = buf.end;


/*
* Create memory pool.
* Initialize 'nxt_http_request_t'
*/
mp = nxt_mp_create(1024, 128, 256, 32);
if (mp == NULL) {
return 0;
}

nxt_memzero(&rp, sizeof(nxt_http_request_parse_t));
if (nxt_http_parse_request_init(&rp, mp) != NXT_OK) {
r_h1p = nxt_mp_zget(mp, sizeof(nxt_http_request_t));
if (r_h1p == NULL) {
goto failed;
}

buf.start = (u_char *)data;
buf.end = (u_char *)data + size;
buf.pos = buf.start;
buf.free = buf.end;

if (nxt_http_parse_request(&rp, &buf) != NXT_DONE) {
r_h1p->proto.h1 = nxt_mp_zget(mp, sizeof(nxt_h1proto_t));
if (r_h1p->proto.h1 == NULL) {
goto failed;
}

r_h1p = nxt_mp_zget(mp, sizeof(nxt_http_request_t));
r_h1p->conf = nxt_mp_zget(mp, sizeof(nxt_socket_conf_joint_t));
if (r_h1p->conf == NULL) {
goto failed;
}

if (r_h1p == NULL) {
r_h1p->conf->socket_conf = nxt_mp_zget(mp, sizeof(nxt_socket_conf_t));
if (r_h1p->conf->socket_conf == NULL) {
goto failed;
}

r_h1p->mem_pool = mp;
r_h1p->conf->socket_conf->max_body_size = 8 * 1024 * 1024;


/*
* Process request and fields.
* Parse http cookies and arguments.
*/
nxt_memzero(&rp, sizeof(nxt_http_request_parse_t));

if (nxt_http_parse_request_init(&rp, mp) != NXT_OK) {
goto failed;
}

rc = nxt_http_parse_request(&rp, &buf);
if (rc != NXT_DONE) {
goto failed;
}

nxt_http_fields_process(rp.fields, &nxt_h1p_fields_hash, r_h1p);

Expand Down
31 changes: 21 additions & 10 deletions fuzzing/nxt_http_h1p_peer_fuzz.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ int
LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
nxt_mp_t *mp;
nxt_int_t rc;
nxt_buf_mem_t buf;
nxt_http_request_t *r_h1p_peer;
nxt_http_request_parse_t rp;
Expand All @@ -51,28 +52,38 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
return 0;
}

buf.start = (u_char *)data;
buf.end = (u_char *)data + size;
buf.pos = buf.start;
buf.free = buf.end;


/*
* Create memory pool.
* Initialize 'nxt_http_request_t'
*/
mp = nxt_mp_create(1024, 128, 256, 32);
if (mp == NULL) {
return 0;
}

nxt_memzero(&rp, sizeof(nxt_http_request_parse_t));
if (nxt_http_parse_request_init(&rp, mp) != NXT_OK) {
r_h1p_peer = nxt_mp_zget(mp, sizeof(nxt_http_request_t));
if (r_h1p_peer == NULL) {
goto failed;
}

buf.start = (u_char *)data;
buf.end = (u_char *)data + size;
buf.pos = buf.start;
buf.free = buf.end;

if (nxt_http_parse_request(&rp, &buf) != NXT_DONE) {
/*
* Process request and fields.
*/
nxt_memzero(&rp, sizeof(nxt_http_request_parse_t));

if (nxt_http_parse_request_init(&rp, mp) != NXT_OK) {
goto failed;
}

r_h1p_peer = nxt_mp_zget(mp, sizeof(nxt_http_request_t));

if (r_h1p_peer == NULL) {
rc = nxt_http_parse_request(&rp, &buf);
if (rc != NXT_DONE) {
goto failed;
}

Expand Down
Loading

0 comments on commit 25b3669

Please sign in to comment.