- 29 Mar, 2021 40 commits
-
-
Christian Brauner authored
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32586Signed-off-by:
Christian Brauner <christian.brauner@ubuntu.com>
-
Christian Brauner authored
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32610Signed-off-by:
-
Evgeny Vereshchagin authored
MSan doesn't instrument stpncpy (https://github.com/google/sanitizers/issues/926), which causes the fuzzer to fail with: ``` $ cat ../minimized-from-740f56329efc60eab59b8194132b712a873e88a3 lxc.console.size=123 $ ./out/fuzz-lxc-config-read ../minimized-from-740f56329efc60eab59b8194132b712a873e88a3 INFO: Seed: 3561494591 INFO: Loaded 1 modules (18795 inline 8-bit counters): 18795 [0x866b98, 0x86b503), INFO: Loaded 1 PC tables (18795 PCs): 18795 [0x86b508,0x8b4bb8), ./out/fuzz-lxc-config-read: Running 1 inputs 1 time(s) each. Running: ../minimized-from-740f56329efc60eab59b8194132b712a873e88a3 ==850885==WARNING: MemorySanitizer: use-of-uninitialized-value #0 0x6b3e7f in parse_byte_size_string /home/vagrant/lxc/src/lxc/string_utils.c:912:6 #1 0x550991 in set_config_console_size /home/vagrant/lxc/src/lxc/confile.c:2483:8 #2 0x5346e2 in parse_line /home/vagrant/lxc/src/lxc/confile.c:2962:9 #3 0x64b3cd in lxc_file_for_each_line_mmap /home/vagrant/lxc/src/lxc/parse.c:125:9 #4 0x53340c in lxc_config_read /home/vagrant/lxc/src/lxc/confile.c:3039:9 #5 0x4e7ec2 in LLVMFuzzerTestOneInput /home/vagrant/lxc/src/tests/fuzz-lxc-config-read.c:23:2 #6 0x44ad2c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x44ad2c) #7 0x42ca4d in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x42ca4d) #8 0x433af0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x433af0) #9 0x423ff6 in main (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x423ff6) #10 0x7f79bdc89081 in __libc_start_main (/lib64/libc.so.6+0x27081) #11 0x42402d in _start (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x42402d) Uninitialized value was created by an allocation of 'dup' in the stack frame of function 'parse_byte_size_string' #0 0x6b3330 in parse_byte_size_string /home/vagrant/lxc/src/lxc/string_utils.c:901 SUMMARY: MemorySanitizer: use-of-uninitialized-value /home/vagrant/lxc/src/lxc/string_utils.c:912:6 in parse_byte_size_string Exiting ``` Closes https://oss-fuzz.com/testcase-detail/5829890470445056Signed-off-by:
Evgeny Vereshchagin <evvers@ya.ru>
-
Evgeny Vereshchagin authored
Signed-off-by: -
Christian Brauner authored
This takes the overflow handling code from the kernel. Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32549Signed-off-by:
-
Evgeny Vereshchagin authored
Signed-off-by: -
Evgeny Vereshchagin authored
to make it possible to build the fuzzer with UBSan and MSan locally ``` $ SANITIZER=undefined ./src/tests/oss-fuzz.sh $ printf 'lxc.signal.stop=sigrtmax-020000000020' >oss-fuzz-32596 $ UBSAN_OPTIONS=print_stacktrace=1:print_summary=1:halt_on_error=1 ./out/fuzz-lxc-config-read oss-fuzz-32596 INFO: Seed: 595864277 INFO: Loaded 1 modules (61553 inline 8-bit counters): 61553 [0x80a1b0, 0x819221), INFO: Loaded 1 PC tables (61553 PCs): 61553 [0x819228,0x909938), ./out/fuzz-lxc-config-read: Running 1 inputs 1 time(s) each. Running: oss-fuzz-32596 confile_utils.c:1051:20: runtime error: signed integer overflow: 64 - -2147483632 cannot be represented in type 'int' #0 0x51799a in rt_sig_num /home/vagrant/lxc/src/lxc/confile_utils.c:1051:20 #1 0x517268 in sig_parse /home/vagrant/lxc/src/lxc/confile_utils.c:1069:11 #2 0x500ca4 in set_config_signal_stop /home/vagrant/lxc/src/lxc/confile.c:1738:10 #3 0x4b8c7c in parse_line /home/vagrant/lxc/src/lxc/confile.c:2962:9 #4 0x5a5eb0 in lxc_file_for_each_line_mmap /home/vagrant/lxc/src/lxc/parse.c:125:9 ``` Signed-off-by: -
Evgeny Vereshchagin authored
This was triggered by the following chain of conversions: lxc_safe_uint("020000000020") -> 2147483664 (uint) sig_num(2147483664 (uint)) -> -2147483632 (int) 64 - -2147483632 cannot be represented in type 'int' Closes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32596Signed-off-by: -
Christian Brauner authored
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32503Signed-off-by:
-
Christian Brauner authored
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32488Signed-off-by:
-
Christian Brauner authored
Reported-by:
-
Evgeny Vereshchagin authored
Signed-off-by: -
Evgeny Vereshchagin authored
It was found by ClusterFuzz in https://oss-fuzz.com/testcase-detail/4747480244813824 but hasn't been reported on Monorail (https://bugs.chromium.org/p/oss-fuzz/) yet ``` $ cat minimized-from-1a18983c13ce64e8a3bd0f699a97d25beb21481e lxc.net.0.hwaddr=0 lxc.net.0.hwaddr=4 ./out/fuzz-lxc-config-read minimized-from-1a18983c13ce64e8a3bd0f699a97d25beb21481e INFO: Seed: 1473396311 INFO: Loaded 1 modules (18821 inline 8-bit counters): 18821 [0x885fa0, 0x88a925), INFO: Loaded 1 PC tables (18821 PCs): 18821 [0x88a928,0x8d4178), ./out/fuzz-lxc-config-read: Running 1 inputs 1 time(s) each. Running: minimized-from-1a18983c13ce64e8a3bd0f699a97d25beb21481e ================================================================= ==226185==ERROR: LeakSanitizer: detected memory leaks Direct leak of 2 byte(s) in 1 object(s) allocated from: #0 0x4d25d7 in strdup (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x4d25d7) #1 0x58e48f in set_config_net_hwaddr /home/vagrant/lxc/src/lxc/confile.c:654:14 #2 0x59af3b in set_config_net_nic /home/vagrant/lxc/src/lxc/confile.c:5276:9 #3 0x571c29 in parse_line /home/vagrant/lxc/src/lxc/confile.c:2958:9 #4 0x61b0b2 in lxc_file_for_each_line_mmap /home/vagrant/lxc/src/lxc/parse.c:125:9 #5 0x5710ed in lxc_config_read /home/vagrant/lxc/src/lxc/confile.c:3035:9 #6 0x542cd6 in LLVMFuzzerTestOneInput /home/vagrant/lxc/src/tests/fuzz-lxc-config-read.c:23:2 #7 0x449e8c in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x449e8c) #8 0x42bbad in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x42bbad) #9 0x432c50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x432c50) #10 0x423136 in main (/home/vagrant/lxc/out/fuzz-lxc-config-read+0x423136) #11 0x7f2cbb992081 in __libc_start_main (/lib64/libc.so.6+0x27081) SUMMARY: AddressSanitizer: 2 byte(s) leaked in 1 allocation(s). ``` Signed-off-by:
-
Christian Brauner authored
Move all input sanity checks up and add two missing checks for the correct network type when using veth-vlan and vlan network types. Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32513Signed-off-by:
-
Christian Brauner authored
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32558Signed-off-by:
-
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32484Signed-off-by:
-
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32482Signed-off-by:
-
Christian Brauner authored
Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32532Signed-off-by:
-
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
We need to allow relative log paths. Signed-off-by: -
Christian Brauner authored
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32475Signed-off-by:
-
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32532Signed-off-by:
-
Christian Brauner authored
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32521Signed-off-by:
-
Christian Brauner authored
Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32473Signed-off-by:
-
Christian Brauner authored
We never call these helper without an initialized config afaict but since we're now exposing these two functions to oss-fuzz directly in a way we never do to users so let's be stricter about it. Inspired-by: #3733 Signed-off-by: -
Christian Brauner authored
Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32491Signed-off-by:
-
Christian Brauner authored
Fixes: #3730 Fixes: https://github.com/google/oss-fuzz/issues/5509Suggested-by:
-
Christian Brauner authored
Fixes: #3730 Fixes: https://github.com/google/oss-fuzz/issues/5509Signed-off-by:
-
Evgeny Vereshchagin authored
It should help to cover more code faster Signed-off-by: -
Evgeny Vereshchagin authored
Signed-off-by: -
Evgeny Vereshchagin authored
It's mostly a cosmetic change that should prevent the fuzzer from cluttering the "$OUT" directory (which OSS-Fuzz uses to build docker images): ``` Step #44: Already have image: gcr.io/oss-fuzz/lxc Step #44: adding: fuzz-lxc-config-read (deflated 67%) Step #44: adding: fuzz-lxc-config-read-WBWKxN (deflated 32%) Step #44: adding: fuzz-lxc-config-read_seed_corpus.zip (stored 0%) Step #44: adding: honggfuzz (deflated 66%) Step #44: adding: llvm-symbolizer (deflated 65%) ``` Signed-off-by: -
Sam Boyles authored
Reviewed-by:
Blair Steven <blair.steven@alliedtelesis.co.nz> Signed-off-by:
Sam Boyles <sam.boyles@alliedtelesis.co.nz>
-
Evgeny Vereshchagin authored
With this patch applied the fuzz target can be built (with ASan) and run with ``` ./src/tests/oss-fuzz.sh ./out/fuzz-lxc-config-read doc/examples/ ``` https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32475 can be reproduced by running ``` $ echo "lxc.console.buffer.size=d" >oss-fuzz-32475 $ ./out/fuzz-lxc-config-read ./oss-fuzz-32475 INFO: Seed: 1044753468 INFO: Loaded 1 modules (18770 inline 8-bit counters): 18770 [0x883cc0, 0x888612), INFO: Loaded 1 PC tables (18770 PCs): 18770 [0x888618,0x8d1b38), ./out/fuzz-lxc-config-read: Running 1 inputs 1 time(s) each. Running: oss-fuzz-32475 ================================================================= ==2052097==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffcca063e7f at pc 0x000000659e0d bp 0x7ffcca063e30 sp 0x7ffcca063e28 READ of size 1 at 0x7ffcca063e7f thread T0 ... ``` I'll point OSS-Fuzz to the build script once this patch is merged. Signed-off-by:
-
Christian Brauner authored
Signed-off-by: -
Christian Brauner authored
Signed-off-by:
-
