Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Try4 fuzz decode receive #305

Open
wants to merge 12 commits into
base: master
Choose a base branch
from
17 changes: 17 additions & 0 deletions CMakeLists.txt
Original file line number Diff line number Diff line change
Expand Up @@ -128,3 +128,20 @@ IF (BUILD_FUZZER)
ENDIF(OSS_FUZZ)
ENDIF()

IF (BUILD_FUZZER_DECODE_RECEIVE)
MESSAGE(STATUS "===== Making the decode receive fuzzer")
SET(FUZZER_EXE "quicly-fuzzer-decode_receive")
SET(FUZZER_CC "fuzz/decode_receive.cc")

IF(NOT CMAKE_CXX_COMPILER_ID STREQUAL "Clang")
MESSAGE(FATAL_ERROR "The fuzzer needs clang as a compiler")
ENDIF()
ADD_EXECUTABLE(${FUZZER_EXE} ${PICOTLS_OPENSSL_FILES} ${FUZZER_CC})
SET(CMAKE_EXE_LINKER_FLAGS "${CMAKE_C_FLAGS}")
SET(LIB_FUZZER "${CMAKE_CURRENT_BINARY_DIR}/libFuzzer.a")
SET(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fno-omit-frame-pointer -fsanitize=address -fsanitize-address-use-after-scope -fsanitize=fuzzer-no-link")
SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -g -fno-omit-frame-pointer -fsanitize=address -fsanitize-address-use-after-scope -fsanitize=fuzzer-no-link")
ADD_CUSTOM_TARGET(libFuzzer ${CMAKE_CURRENT_SOURCE_DIR}/misc/build_libFuzzer.sh WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR})
ADD_DEPENDENCIES(${FUZZER_EXE} quicly libFuzzer)
TARGET_LINK_LIBRARIES(${FUZZER_EXE} quicly ${OPENSSL_LIBRARIES} ${CMAKE_DL_LIBS} ${LIB_FUZZER})
ENDIF()
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
+
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
e r
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@

Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
`�
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
-
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
/
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
]
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
��
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
,
#
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@

Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
,
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@

Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�`�
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
]=�
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
]=
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
@
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
��
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
r
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
��
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
0
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@

Original file line number Diff line number Diff line change
@@ -0,0 +1 @@

Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
�`
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@

Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
/-
Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
��
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@

Binary file not shown.
Binary file not shown.
Binary file not shown.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Binary file not shown.
91 changes: 91 additions & 0 deletions fuzz/decode_receive.cc
Original file line number Diff line number Diff line change
@@ -0,0 +1,91 @@
#include <picotls.h>
#include <stdio.h>
#include <netdb.h>
#include "quicly.h"
#include "quicly/defaults.h"
#include "quicly/frame.h"
#include "../deps/picotls/include/picotls/openssl.h"

void __sanitizer_cov_trace_pc(void)
{
}

int save_session_ticket_cb(ptls_save_ticket_t *_self, ptls_t *tls, ptls_iovec_t src)
{
return 0;
}

static int on_client_hello_cb(ptls_on_client_hello_t *_self, ptls_t *tls, ptls_on_client_hello_parameters_t *params)
{
return 0;
}

static ptls_key_exchange_algorithm_t *key_exchanges[128];
static ptls_cipher_suite_t *cipher_suites[128];

static ptls_save_ticket_t save_session_ticket = {save_session_ticket_cb};
static ptls_on_client_hello_t on_client_hello = {on_client_hello_cb};

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
{

ptls_context_t tlsctx = {.random_bytes = ptls_openssl_random_bytes,
.get_time = &ptls_get_time,
.key_exchanges = key_exchanges,
.cipher_suites = ptls_openssl_cipher_suites,
.require_dhe_on_psk = 1 ,
.save_ticket = &save_session_ticket,
.on_client_hello = &on_client_hello};


int ret;
quicly_context_t ctx;
ctx = quicly_spec_context;
ctx.tls = &tlsctx;

quicly_decoded_packet_t p;

struct sockaddr sa;
socklen_t salen;

quicly_conn_t *conn = NULL;
quicly_cid_plaintext_t next_cid;
const char* host = "127.0.0.1";
const char* port = "4422";
ptls_iovec_t *resumption_token = (ptls_iovec_t *)malloc(sizeof(ptls_iovec_t));
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not think we need a pointer (with allocate memory), as the only use of the value in relation to other functions is passing the value of the pointer in quicly_connect. This can be ptls_iovec_t resumption_token = ptls_iovec_init(NULL, 0).

ptls_handshake_properties_t hs_properties = (ptls_handshake_properties_t){{{{NULL}}}};
quicly_transport_parameters_t resumed_transport_params;

struct addrinfo hint, *res;

memset(&hint, 0, sizeof(hint));
hint.ai_family = AF_INET;
hint.ai_socktype = SOCK_DGRAM;
hint.ai_protocol = IPPROTO_UDP;
hint.ai_flags = AI_ADDRCONFIG | AI_NUMERICSERV | AI_PASSIVE;
getaddrinfo(host, port, &hint, &res);

memcpy(&sa, res->ai_addr, res->ai_addrlen);

resumption_token->len = 0;

hs_properties.additional_extensions = NULL;
hs_properties.collect_extension = NULL;
hs_properties.collected_extensions = NULL;

ret = quicly_connect(&conn, &ctx, host, &sa, NULL, &next_cid, *resumption_token, &hs_properties, &resumed_transport_params);

ret = quicly_decode_packet(&ctx, &p, Data, Size);

if (ret != Size)
goto Exit;

quicly_receive(conn, NULL, &sa, &p);

Exit:
freeaddrinfo(res);
free(resumption_token);
quicly_free(conn);

return 0;
}