AFL + Libfuzzer harnesses (#455)
* Package fuzzers * Provide ability to remove main * Don't build fuzzers by default
This commit is contained in:
anthony-crystalpeak
committed by
GitHub
GitHub
parent
9e7f8978fa
commit
fcc9647983
@@ -161,6 +161,14 @@ router-ipv6:
|
|||||||
router-mstp:
|
router-mstp:
|
||||||
$(MAKE) -s -C apps $@
|
$(MAKE) -s -C apps $@
|
||||||
|
|
||||||
|
.PHONY: fuzz-libfuzzer
|
||||||
|
fuzz-libfuzzer:
|
||||||
|
$(MAKE) -s -C apps $@
|
||||||
|
|
||||||
|
.PHONY: fuzz-afl
|
||||||
|
fuzz-afl:
|
||||||
|
$(MAKE) -s -C apps $@
|
||||||
|
|
||||||
# Add "ports" to the build, if desired
|
# Add "ports" to the build, if desired
|
||||||
.PHONY: ports
|
.PHONY: ports
|
||||||
ports: atmega168 bdk-atxx4-mstp at91sam7s stm32f10x stm32f4xx
|
ports: atmega168 bdk-atxx4-mstp at91sam7s stm32f10x stm32f4xx
|
||||||
@@ -297,6 +305,8 @@ clean: ports-clean
|
|||||||
$(MAKE) -s -C apps/router-ipv6 clean
|
$(MAKE) -s -C apps/router-ipv6 clean
|
||||||
$(MAKE) -s -C apps/router-mstp clean
|
$(MAKE) -s -C apps/router-mstp clean
|
||||||
$(MAKE) -s -C apps/gateway clean
|
$(MAKE) -s -C apps/gateway clean
|
||||||
|
$(MAKE) -s -C apps/fuzz-afl clean
|
||||||
|
$(MAKE) -s -C apps/fuzz-libfuzzer clean
|
||||||
$(MAKE) -s -C ports/lwip clean
|
$(MAKE) -s -C ports/lwip clean
|
||||||
$(MAKE) -s -C test clean
|
$(MAKE) -s -C test clean
|
||||||
rm -rf ./build
|
rm -rf ./build
|
||||||
|
|||||||
@@ -196,6 +196,30 @@ ifeq (${BACNET_PORT},win32)
|
|||||||
SUBDIRS += mstpcap mstpcrc
|
SUBDIRS += mstpcap mstpcrc
|
||||||
endif
|
endif
|
||||||
|
|
||||||
|
|
||||||
|
#####
|
||||||
|
# Define target-specific fuzzing flags
|
||||||
|
#####
|
||||||
|
|
||||||
|
# AFL
|
||||||
|
fuzz-afl: CC=afl-gcc
|
||||||
|
fuzz-afl: FUZZ_FLAGS=-DFUZZING=1
|
||||||
|
fuzz-afl: LFLAGS += $(FUZZ_FLAGS)
|
||||||
|
fuzz-afl: CFLAGS += $(FUZZ_FLAGS)
|
||||||
|
fuzz-afl: export AFL_USE_ASAN=1
|
||||||
|
|
||||||
|
# LIBFUZZER
|
||||||
|
fuzz-libfuzzer: CC=clang
|
||||||
|
fuzz-libfuzzer: FUZZ_FLAGS=-DFUZZING=1 -fsanitize=fuzzer,address -g3 -Og -fno-optimize-sibling-calls -fno-omit-frame-pointer
|
||||||
|
fuzz-libfuzzer: LFLAGS += $(FUZZ_FLAGS)
|
||||||
|
fuzz-libfuzzer: CFLAGS += $(FUZZ_FLAGS)
|
||||||
|
|
||||||
|
|
||||||
|
#####
|
||||||
|
# Fuzz setup end
|
||||||
|
#####
|
||||||
|
|
||||||
|
|
||||||
.PHONY: all clean
|
.PHONY: all clean
|
||||||
TARGETS = all clean
|
TARGETS = all clean
|
||||||
|
|
||||||
@@ -354,6 +378,14 @@ router-ipv6: $(BACNET_LIB_TARGET)
|
|||||||
router-mstp: $(BACNET_LIB_TARGET)
|
router-mstp: $(BACNET_LIB_TARGET)
|
||||||
$(MAKE) -B -C $@
|
$(MAKE) -B -C $@
|
||||||
|
|
||||||
|
.PHONY: fuzz-libfuzzer
|
||||||
|
fuzz-libfuzzer: $(BACNET_LIB_TARGET)
|
||||||
|
$(MAKE) -B -C $@
|
||||||
|
|
||||||
|
.PHONY: fuzz-afl
|
||||||
|
fuzz-afl: $(BACNET_LIB_TARGET)
|
||||||
|
$(MAKE) -B -C $@
|
||||||
|
|
||||||
.PHONY: writepropm
|
.PHONY: writepropm
|
||||||
writepropm: $(BACNET_LIB_TARGET)
|
writepropm: $(BACNET_LIB_TARGET)
|
||||||
$(MAKE) -B -C $@
|
$(MAKE) -B -C $@
|
||||||
|
|||||||
@@ -0,0 +1,79 @@
|
|||||||
|
#Makefile to build BACnet Application for the GCC port
|
||||||
|
|
||||||
|
# tools - only if you need them.
|
||||||
|
# Most platforms have this already defined
|
||||||
|
# CC = gcc
|
||||||
|
|
||||||
|
# Executable file name
|
||||||
|
TARGET = fuzz-afl
|
||||||
|
|
||||||
|
TARGET_BIN = ${TARGET}$(TARGET_EXT)
|
||||||
|
|
||||||
|
# BACNET_PORT, BACNET_PORT_DIR, BACNET_PORT_SRC are defined in common Makefile
|
||||||
|
# BACNET_SRC_DIR is defined in common apps Makefile
|
||||||
|
BACNET_OBJECT_DIR = $(BACNET_SRC_DIR)/bacnet/basic/object
|
||||||
|
SRC = main.c \
|
||||||
|
$(BACNET_OBJECT_DIR)/netport.c \
|
||||||
|
$(BACNET_OBJECT_DIR)/client/device-client.c
|
||||||
|
|
||||||
|
PORT_MSTP_SRC = \
|
||||||
|
$(BACNET_PORT_DIR)/rs485.c \
|
||||||
|
$(BACNET_PORT_DIR)/dlmstp.c \
|
||||||
|
$(BACNET_SRC_DIR)/bacnet/datalink/mstp.c \
|
||||||
|
$(BACNET_SRC_DIR)/bacnet/datalink/mstptext.c \
|
||||||
|
$(BACNET_SRC_DIR)/bacnet/datalink/crc.c
|
||||||
|
|
||||||
|
PORT_BIP_SRC = \
|
||||||
|
$(BACNET_PORT_DIR)/bip-init.c \
|
||||||
|
$(BACNET_SRC_DIR)/bacnet/datalink/bvlc.c \
|
||||||
|
$(BACNET_SRC_DIR)/bacnet/basic/bbmd/h_bbmd.c
|
||||||
|
|
||||||
|
# WARNINGS, DEBUGGING, OPTIMIZATION are defined in common apps Makefile
|
||||||
|
# BACNET_DEFINES is defined in common apps Makefile
|
||||||
|
# put all the flags together
|
||||||
|
INCLUDES = -I$(BACNET_SRC_DIR) -I$(BACNET_PORT_DIR)
|
||||||
|
CFLAGS += $(WARNINGS) $(DEBUGGING) $(OPTIMIZATION) $(BACNET_DEFINES) $(INCLUDES)
|
||||||
|
LFLAGS += -Wl,$(SYSTEM_LIB)
|
||||||
|
ifneq (${BACNET_LIB},)
|
||||||
|
LFLAGS += -Wl,$(BACNET_LIB)
|
||||||
|
endif
|
||||||
|
# GCC dead code removal
|
||||||
|
CFLAGS += -ffunction-sections -fdata-sections
|
||||||
|
LFLAGS += -Wl,--gc-sections
|
||||||
|
|
||||||
|
BACNET_SRC = \
|
||||||
|
$(wildcard $(BACNET_SRC_DIR)/bacnet/*.c) \
|
||||||
|
$(wildcard $(BACNET_SRC_DIR)/bacnet/basic/*.c) \
|
||||||
|
$(wildcard $(BACNET_SRC_DIR)/bacnet/basic/binding/*.c) \
|
||||||
|
$(wildcard $(BACNET_SRC_DIR)/bacnet/basic/service/*.c) \
|
||||||
|
$(wildcard $(BACNET_SRC_DIR)/bacnet/basic/sys/*.c) \
|
||||||
|
$(BACNET_SRC_DIR)/bacnet/basic/npdu/h_routed_npdu.c \
|
||||||
|
$(BACNET_SRC_DIR)/bacnet/basic/npdu/s_router.c \
|
||||||
|
$(BACNET_SRC_DIR)/bacnet/basic/tsm/tsm.c
|
||||||
|
|
||||||
|
SRCS = ${SRC} ${BACNET_SRC} ${PORT_MSTP_SRC} ${PORT_BIP_SRC}
|
||||||
|
|
||||||
|
OBJS += ${SRCS:.c=.o}
|
||||||
|
|
||||||
|
.PHONY: all
|
||||||
|
all: Makefile ${TARGET_BIN}
|
||||||
|
|
||||||
|
${TARGET_BIN}: ${OBJS}
|
||||||
|
${CC} ${PFLAGS} ${OBJS} ${LFLAGS} -o $@
|
||||||
|
size $@
|
||||||
|
cp $@ ../../bin
|
||||||
|
|
||||||
|
.c.o:
|
||||||
|
${CC} -c ${CFLAGS} $*.c -o $@
|
||||||
|
|
||||||
|
.PHONY: depend
|
||||||
|
depend:
|
||||||
|
rm -f .depend
|
||||||
|
${CC} -MM ${CFLAGS} *.c >> .depend
|
||||||
|
|
||||||
|
.PHONY: clean
|
||||||
|
clean:
|
||||||
|
rm -f core ${TARGET_BIN} ${OBJS} $(TARGET).map
|
||||||
|
|
||||||
|
.PHONY: include
|
||||||
|
include: .depend
|
||||||
@@ -0,0 +1,24 @@
|
|||||||
|
# Getting Started
|
||||||
|
|
||||||
|
* Install [AFL](https://github.com/google/AFL), ensure afl-gcc exists on the system:
|
||||||
|
|
||||||
|
```
|
||||||
|
$ afl-gcc
|
||||||
|
afl-cc 2.57b by <lcamtuf@google.com>
|
||||||
|
```
|
||||||
|
|
||||||
|
* Build via `make fuzz-afl` from repository root
|
||||||
|
* Clone a decent [corpus](https://github.com/CrystalPeakSecurity/bacnet-corpus/tree/main)
|
||||||
|
* Start AFL and feed it the input/output directories along with target executable
|
||||||
|
|
||||||
|
```
|
||||||
|
afl-fuzz -i </path/to/corpus/> -o </path/to/output_dir/> -m none ./apps/fuzz-afl/fuzz-afl
|
||||||
|
```
|
||||||
|
|
||||||
|
Caveats:
|
||||||
|
|
||||||
|
* This builds the target with ASAN (Address Sanitizer). This makes AFL require the `-m none` to not interpret ASAN's behavior as a crash
|
||||||
|
* AFL uses a fork/exec model to launch the target. This is nice because each testcase is from a clean state. But this also brings in a lot of overhead. If you need something faster, check out ../fuzz-libfuzzer/
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@@ -0,0 +1,126 @@
|
|||||||
|
/**
|
||||||
|
* @file
|
||||||
|
* @author Steve Karg, Anthony Delorenzo
|
||||||
|
* @date 2020
|
||||||
|
* @brief
|
||||||
|
*
|
||||||
|
* @section LICENSE
|
||||||
|
*
|
||||||
|
* Copyright (C) 2020 Steve Karg <skarg@users.sourceforge.net>
|
||||||
|
*
|
||||||
|
* Permission is hereby granted, free of charge, to any person obtaining
|
||||||
|
* a copy of this software and associated documentation files (the
|
||||||
|
* "Software"), to deal in the Software without restriction, including
|
||||||
|
* without limitation the rights to use, copy, modify, merge, publish,
|
||||||
|
* distribute, sublicense, and/or sell copies of the Software, and to
|
||||||
|
* permit persons to whom the Software is furnished to do so, subject to
|
||||||
|
* the following conditions:
|
||||||
|
*
|
||||||
|
* The above copyright notice and this permission notice shall be included
|
||||||
|
* in all copies or substantial portions of the Software.
|
||||||
|
*
|
||||||
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||||
|
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||||
|
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
||||||
|
* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
|
||||||
|
* CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
|
||||||
|
* TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
|
||||||
|
* SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
#include <stddef.h>
|
||||||
|
#include <stdint.h>
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <signal.h>
|
||||||
|
#include <time.h>
|
||||||
|
#include <assert.h>
|
||||||
|
|
||||||
|
#include "bacnet/bacdef.h"
|
||||||
|
#include "bacnet/config.h"
|
||||||
|
#include "bacnet/bactext.h"
|
||||||
|
#include "bacnet/bacerror.h"
|
||||||
|
#include "bacnet/iam.h"
|
||||||
|
#include "bacnet/arf.h"
|
||||||
|
#include "bacnet/npdu.h"
|
||||||
|
#include "bacnet/apdu.h"
|
||||||
|
#include "bacnet/version.h"
|
||||||
|
/* some demo modules we use */
|
||||||
|
#include "bacnet/basic/sys/debug.h"
|
||||||
|
#include "bacnet/basic/tsm/tsm.h"
|
||||||
|
#include "bacnet/basic/binding/address.h"
|
||||||
|
#include "bacnet/basic/services.h"
|
||||||
|
/* port agnostic file */
|
||||||
|
#include "bacport.h"
|
||||||
|
/* our datalink layers */
|
||||||
|
#include "bacnet/datalink/dlmstp.h"
|
||||||
|
#include "bacnet/datalink/bip.h"
|
||||||
|
#include "bacnet/datalink/bvlc.h"
|
||||||
|
#include "bacnet/basic/bbmd/h_bbmd.h"
|
||||||
|
|
||||||
|
// Pull in all of this...
|
||||||
|
#include "../router-mstp/main.c"
|
||||||
|
|
||||||
|
static void Init_Service_Handlers()
|
||||||
|
{
|
||||||
|
|
||||||
|
apdu_set_unconfirmed_handler(SERVICE_UNCONFIRMED_WHO_IS, handler_who_is_unicast);
|
||||||
|
apdu_set_unconfirmed_handler(SERVICE_UNCONFIRMED_WHO_HAS, handler_who_has);
|
||||||
|
apdu_set_unrecognized_service_handler_handler(handler_unrecognized_service);
|
||||||
|
apdu_set_confirmed_handler(SERVICE_CONFIRMED_READ_PROPERTY, handler_read_property);
|
||||||
|
apdu_set_confirmed_handler(SERVICE_CONFIRMED_READ_PROP_MULTIPLE, handler_read_property_multiple);
|
||||||
|
apdu_set_confirmed_handler(SERVICE_CONFIRMED_WRITE_PROPERTY, handler_write_property);
|
||||||
|
apdu_set_confirmed_handler(SERVICE_CONFIRMED_READ_RANGE, handler_read_range);
|
||||||
|
apdu_set_confirmed_handler(SERVICE_CONFIRMED_REINITIALIZE_DEVICE, handler_reinitialize_device);
|
||||||
|
apdu_set_unconfirmed_handler(SERVICE_UNCONFIRMED_UTC_TIME_SYNCHRONIZATION, handler_timesync_utc);
|
||||||
|
apdu_set_unconfirmed_handler(SERVICE_UNCONFIRMED_TIME_SYNCHRONIZATION, handler_timesync);
|
||||||
|
apdu_set_confirmed_handler(SERVICE_CONFIRMED_SUBSCRIBE_COV, handler_cov_subscribe);
|
||||||
|
apdu_set_unconfirmed_handler(SERVICE_UNCONFIRMED_COV_NOTIFICATION, handler_ucov_notification);
|
||||||
|
apdu_set_confirmed_handler(SERVICE_CONFIRMED_DEVICE_COMMUNICATION_CONTROL, handler_device_communication_control);
|
||||||
|
apdu_set_unconfirmed_handler(SERVICE_UNCONFIRMED_WHO_IS, handler_who_is);
|
||||||
|
apdu_set_unrecognized_service_handler_handler(handler_unrecognized_service);
|
||||||
|
apdu_set_confirmed_handler(SERVICE_CONFIRMED_READ_PROPERTY, handler_read_property);
|
||||||
|
apdu_set_unconfirmed_handler(SERVICE_UNCONFIRMED_I_AM, handler_i_am_add);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
* FIXME: This is a hack to get things linking correctly
|
||||||
|
*/
|
||||||
|
extern int cov_subscribe(void) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
extern int Device_Value_List_Supported(void) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
extern int Encode_RR_payload(void) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
extern int Device_Objects_RR_Info(void) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
extern int Device_Write_Property(void) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
extern int Device_Reinitialize(void) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
int main(int argc, char *argv[])
|
||||||
|
{
|
||||||
|
BACNET_ADDRESS src = { 0 };
|
||||||
|
uint16_t pdu_len = 0;
|
||||||
|
|
||||||
|
Init_Service_Handlers();
|
||||||
|
|
||||||
|
pdu_len = read(0, &BIP_Rx_Buffer[0], sizeof(BIP_Rx_Buffer));
|
||||||
|
|
||||||
|
/* process fuzz input*/
|
||||||
|
if (pdu_len) {
|
||||||
|
my_routing_npdu_handler(BIP_Net, &src, &BIP_Rx_Buffer[0], pdu_len);
|
||||||
|
}
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
}
|
||||||
@@ -0,0 +1,81 @@
|
|||||||
|
#Makefile to build BACnet Application for the GCC port
|
||||||
|
|
||||||
|
# tools - only if you need them.
|
||||||
|
# Most platforms have this already defined
|
||||||
|
# CC = gcc
|
||||||
|
|
||||||
|
# Executable file name
|
||||||
|
TARGET = fuzz-libfuzzer
|
||||||
|
|
||||||
|
TARGET_BIN = ${TARGET}$(TARGET_EXT)
|
||||||
|
|
||||||
|
# BACNET_PORT, BACNET_PORT_DIR, BACNET_PORT_SRC are defined in common Makefile
|
||||||
|
# BACNET_SRC_DIR is defined in common apps Makefile
|
||||||
|
BACNET_OBJECT_DIR = $(BACNET_SRC_DIR)/bacnet/basic/object
|
||||||
|
SRC = main.c \
|
||||||
|
$(BACNET_OBJECT_DIR)/netport.c \
|
||||||
|
$(BACNET_OBJECT_DIR)/bacfile.c \
|
||||||
|
$(BACNET_OBJECT_DIR)/gateway/gw_device.c \
|
||||||
|
$(BACNET_OBJECT_DIR)/client/device-client.c
|
||||||
|
|
||||||
|
PORT_MSTP_SRC = \
|
||||||
|
$(BACNET_PORT_DIR)/rs485.c \
|
||||||
|
$(BACNET_PORT_DIR)/dlmstp.c \
|
||||||
|
$(BACNET_SRC_DIR)/bacnet/datalink/mstp.c \
|
||||||
|
$(BACNET_SRC_DIR)/bacnet/datalink/mstptext.c \
|
||||||
|
$(BACNET_SRC_DIR)/bacnet/datalink/crc.c
|
||||||
|
|
||||||
|
PORT_BIP_SRC = \
|
||||||
|
$(BACNET_PORT_DIR)/bip-init.c \
|
||||||
|
$(BACNET_SRC_DIR)/bacnet/datalink/bvlc.c \
|
||||||
|
$(BACNET_SRC_DIR)/bacnet/basic/bbmd/h_bbmd.c
|
||||||
|
|
||||||
|
# WARNINGS, DEBUGGING, OPTIMIZATION are defined in common apps Makefile
|
||||||
|
# BACNET_DEFINES is defined in common apps Makefile
|
||||||
|
# put all the flags together
|
||||||
|
INCLUDES = -I$(BACNET_SRC_DIR) -I$(BACNET_PORT_DIR)
|
||||||
|
CFLAGS += $(WARNINGS) $(DEBUGGING) $(OPTIMIZATION) $(BACNET_DEFINES) $(INCLUDES)
|
||||||
|
LFLAGS += -Wl,$(SYSTEM_LIB)
|
||||||
|
ifneq (${BACNET_LIB},)
|
||||||
|
LFLAGS += -Wl,$(BACNET_LIB)
|
||||||
|
endif
|
||||||
|
# GCC dead code removal
|
||||||
|
CFLAGS += -ffunction-sections -fdata-sections
|
||||||
|
LFLAGS += -Wl,--gc-sections
|
||||||
|
|
||||||
|
BACNET_SRC = \
|
||||||
|
$(wildcard $(BACNET_SRC_DIR)/bacnet/*.c) \
|
||||||
|
$(wildcard $(BACNET_SRC_DIR)/bacnet/basic/*.c) \
|
||||||
|
$(wildcard $(BACNET_SRC_DIR)/bacnet/basic/binding/*.c) \
|
||||||
|
$(wildcard $(BACNET_SRC_DIR)/bacnet/basic/service/*.c) \
|
||||||
|
$(wildcard $(BACNET_SRC_DIR)/bacnet/basic/sys/*.c) \
|
||||||
|
$(BACNET_SRC_DIR)/bacnet/basic/npdu/h_routed_npdu.c \
|
||||||
|
$(BACNET_SRC_DIR)/bacnet/basic/npdu/s_router.c \
|
||||||
|
$(BACNET_SRC_DIR)/bacnet/basic/tsm/tsm.c
|
||||||
|
|
||||||
|
SRCS = ${SRC} ${BACNET_SRC} ${PORT_MSTP_SRC} ${PORT_BIP_SRC}
|
||||||
|
|
||||||
|
OBJS += ${SRCS:.c=.o}
|
||||||
|
|
||||||
|
.PHONY: all
|
||||||
|
all: Makefile ${TARGET_BIN}
|
||||||
|
|
||||||
|
${TARGET_BIN}: ${OBJS}
|
||||||
|
${CC} ${PFLAGS} ${OBJS} ${LFLAGS} -o $@
|
||||||
|
size $@
|
||||||
|
cp $@ ../../bin
|
||||||
|
|
||||||
|
.c.o:
|
||||||
|
${CC} -c ${CFLAGS} $*.c -o $@
|
||||||
|
|
||||||
|
.PHONY: depend
|
||||||
|
depend:
|
||||||
|
rm -f .depend
|
||||||
|
${CC} -MM ${CFLAGS} *.c >> .depend
|
||||||
|
|
||||||
|
.PHONY: clean
|
||||||
|
clean:
|
||||||
|
rm -f core ${TARGET_BIN} ${OBJS} $(TARGET).map
|
||||||
|
|
||||||
|
.PHONY: include
|
||||||
|
include: .depend
|
||||||
@@ -0,0 +1,51 @@
|
|||||||
|
# Getting Started
|
||||||
|
|
||||||
|
* Ensure Clang & [compiler-rt](https://compiler-rt.llvm.org/) are installed on the system. On Arch Linux, this is package `compiler-rt`
|
||||||
|
* Build via `make fuzz-libfuzzer` from repository root
|
||||||
|
* Clone a decent [corpus](https://github.com/CrystalPeakSecurity/bacnet-corpus/tree/main)
|
||||||
|
* Start and feed it the corpus directory
|
||||||
|
|
||||||
|
```
|
||||||
|
$ ./apps/fuzz-libfuzzer/fuzz-libfuzzer ../bacnet-corpus/corpus/
|
||||||
|
INFO: Running with entropic power schedule (0xFF, 100).
|
||||||
|
INFO: Seed: 4165043991
|
||||||
|
INFO: Loaded 1 modules (9101 inline 8-bit counters): 9101 [0x55a0d5487090, 0x55a0d548941d),
|
||||||
|
INFO: Loaded 1 PC tables (9101 PCs): 9101 [0x55a0d5489420,0x55a0d54accf0),
|
||||||
|
INFO: 5790 files found in ../bacnet-corpus/corpus/
|
||||||
|
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
|
||||||
|
INFO: seed corpus: files: 5790 min: 1b max: 483b total: 305068b rss: 40Mb
|
||||||
|
NPDU: Decoding failed; Discarded!
|
||||||
|
...
|
||||||
|
NPDU: DNET=65280. Discarded!
|
||||||
|
#5867 REDUCE cov: 208 ft: 249 corp: 66/1273b lim: 115 exec/s: 2933 rss: 106Mb L: 12/109 MS: 1 EraseBytes-
|
||||||
|
Received Reserved for Use by ASHRAE
|
||||||
|
WP: Failed to send PDU (Success)!
|
||||||
|
NEW_FUNC[1/3]: 0x55a0d533f98a in abort_encode_apdu /mnt/net/lab_share/Bacnet/bacnet-stack-fixes/src/bacnet/abort.c:149
|
||||||
|
NEW_FUNC[2/3]: 0x55a0d538f29a in wp_decode_service_request /mnt/net/lab_share/Bacnet/bacnet-stack-fixes/src/bacnet/wp.c:113
|
||||||
|
#5940 NEW cov: 216 ft: 257 corp: 68/1282b lim: 115 exec/s: 2970 rss: 106Mb L: 6/109 MS: 2 EraseBytes-ChangeBit-
|
||||||
|
Received Reserved for Use by ASHRAE
|
||||||
|
...
|
||||||
|
=================================================================
|
||||||
|
==2204295==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200003b656 at pc 0x55a0d5350276 bp 0x7fff17646790 sp 0x7fff17646788
|
||||||
|
READ of size 1 at 0x60200003b656 thread T0
|
||||||
|
#0 0x55a0d5350275 in decode_tag_number_and_value /mnt/net/lab_share/Bacnet/bacnet-stack-fixes/src/bacnet/bacdcode.c:496:13
|
||||||
|
#1 0x55a0d5360b44 in bacerror_decode_error_class_and_code /mnt/net/lab_share/Bacnet/bacnet-stack-fixes/src/bacnet/bacerror.c:78:16
|
||||||
|
#2 0x55a0d539851e in apdu_handler /mnt/net/lab_share/Bacnet/bacnet-stack-fixes/src/bacnet/basic/service/h_apdu.c:684:27
|
||||||
|
#3 0x55a0d5331fff in my_routing_npdu_handler /mnt/net/lab_share/Bacnet/bacnet-stack-fixes/apps/fuzz-libfuzzer/./../router-mstp/main.c:977:25
|
||||||
|
#4 0x55a0d5331fff in LLVMFuzzerTestOneInput /mnt/net/lab_share/Bacnet/bacnet-stack-fixes/apps/fuzz-libfuzzer/main.c:144:9
|
||||||
|
#5 0x55a0d5216878 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/mnt/net/lab_share/Bacnet/bacnet-stack-fixes/apps/fuzz-libfuzzer/fuzz-libfuzzer+0xc2878) (BuildId: 6c764deec893b5d17197c0a0183d5b491e36f6c9)
|
||||||
|
#6 0x55a0d5217550 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool, bool*) (/mnt/net/lab_share/Bacnet/bacnet-stack-fixes/apps/fuzz-libfuzzer/fuzz-libfuzzer+0xc3550) (BuildId: 6c764deec893b5d17197c0a0183d5b491e36f6c9)
|
||||||
|
#7 0x55a0d52185e1 in fuzzer::Fuzzer::MutateAndTestOne() (/mnt/net/lab_share/Bacnet/bacnet-stack-fixes/apps/fuzz-libfuzzer/fuzz-libfuzzer+0xc45e1) (BuildId: 6c764deec893b5d17197c0a0183d5b491e36f6c9)
|
||||||
|
#8 0x55a0d5219407 in fuzzer::Fuzzer::Loop(std::vector<fuzzer::SizedFile, std::allocator<fuzzer::SizedFile>>&) (/mnt/net/lab_share/Bacnet/bacnet-stack-fixes/apps/fuzz-libfuzzer/fuzz-libfuzzer+0xc5407) (BuildId: 6c764deec893b5d17197c0a0183d5b491e36f6c9)
|
||||||
|
#9 0x55a0d51f98d5 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/mnt/net/lab_share/Bacnet/bacnet-stack-fixes/apps/fuzz-libfuzzer/fuzz-libfuzzer+0xa58d5) (BuildId: 6c764deec893b5d17197c0a0183d5b491e36f6c9)
|
||||||
|
#10 0x55a0d51e3717 in main (/mnt/net/lab_share/Bacnet/bacnet-stack-fixes/apps/fuzz-libfuzzer/fuzz-libfuzzer+0x8f717) (BuildId: 6c764deec893b5d17197c0a0183d5b491e36f6c9)
|
||||||
|
#11 0x7fc3c263984f (/usr/lib/libc.so.6+0x2384f) (BuildId: 2f005a79cd1a8e385972f5a102f16adba414d75e)
|
||||||
|
#12 0x7fc3c2639909 in __libc_start_main (/usr/lib/libc.so.6+0x23909) (BuildId: 2f005a79cd1a8e385972f5a102f16adba414d75e)
|
||||||
|
#13 0x55a0d51e3754 in _start (/mnt/net/lab_share/Bacnet/bacnet-stack-fixes/apps/fuzz-libfuzzer/fuzz-libfuzzer+0x8f754) (BuildId: 6c764deec893b5d17197c0a0183d5b491e36f6c9)
|
||||||
|
...
|
||||||
|
```
|
||||||
|
|
||||||
|
Caveat:
|
||||||
|
|
||||||
|
* Libfuzzer does not reinitialize the target on each testcase. This means that it will be much quicker than ../fuzz-afl/, BUT it will also be a little less stable. It also will not continue to fuzz after a crash is found (since the libfuzzer runtime shares a process with the target that just crashed). There may be some command line options to adopt a fork model.
|
||||||
|
|
||||||
@@ -0,0 +1,149 @@
|
|||||||
|
/**
|
||||||
|
* @file
|
||||||
|
* @author Steve Karg, Anthony Delorenzo
|
||||||
|
* @date 2020
|
||||||
|
* @brief
|
||||||
|
*
|
||||||
|
* @section LICENSE
|
||||||
|
*
|
||||||
|
* Copyright (C) 2020 Steve Karg <skarg@users.sourceforge.net>
|
||||||
|
*
|
||||||
|
* Permission is hereby granted, free of charge, to any person obtaining
|
||||||
|
* a copy of this software and associated documentation files (the
|
||||||
|
* "Software"), to deal in the Software without restriction, including
|
||||||
|
* without limitation the rights to use, copy, modify, merge, publish,
|
||||||
|
* distribute, sublicense, and/or sell copies of the Software, and to
|
||||||
|
* permit persons to whom the Software is furnished to do so, subject to
|
||||||
|
* the following conditions:
|
||||||
|
*
|
||||||
|
* The above copyright notice and this permission notice shall be included
|
||||||
|
* in all copies or substantial portions of the Software.
|
||||||
|
*
|
||||||
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||||
|
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||||
|
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
||||||
|
* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
|
||||||
|
* CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
|
||||||
|
* TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
|
||||||
|
* SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
#include <stddef.h>
|
||||||
|
#include <stdint.h>
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <signal.h>
|
||||||
|
#include <time.h>
|
||||||
|
#include <assert.h>
|
||||||
|
|
||||||
|
|
||||||
|
#include "bacnet/bacdef.h"
|
||||||
|
#include "bacnet/config.h"
|
||||||
|
#include "bacnet/bactext.h"
|
||||||
|
#include "bacnet/bacerror.h"
|
||||||
|
#include "bacnet/iam.h"
|
||||||
|
#include "bacnet/list_element.h"
|
||||||
|
#include "bacnet/arf.h"
|
||||||
|
#include "bacnet/npdu.h"
|
||||||
|
#include "bacnet/apdu.h"
|
||||||
|
#include "bacnet/version.h"
|
||||||
|
/* some demo modules we use */
|
||||||
|
#include "bacnet/basic/sys/debug.h"
|
||||||
|
#include "bacnet/basic/tsm/tsm.h"
|
||||||
|
#include "bacnet/basic/binding/address.h"
|
||||||
|
#include "bacnet/basic/services.h"
|
||||||
|
/* port agnostic file */
|
||||||
|
#include "bacport.h"
|
||||||
|
/* our datalink layers */
|
||||||
|
#include "bacnet/datalink/dlmstp.h"
|
||||||
|
#include "bacnet/datalink/bip.h"
|
||||||
|
#include "bacnet/datalink/bvlc.h"
|
||||||
|
#include "bacnet/basic/bbmd/h_bbmd.h"
|
||||||
|
|
||||||
|
// Pull in all of this...
|
||||||
|
#include "../router-mstp/main.c"
|
||||||
|
|
||||||
|
static void Init_Service_Handlers(void) {
|
||||||
|
|
||||||
|
apdu_set_unconfirmed_handler(SERVICE_UNCONFIRMED_WHO_IS, handler_who_is_unicast);
|
||||||
|
apdu_set_unconfirmed_handler(SERVICE_UNCONFIRMED_WHO_HAS, handler_who_has);
|
||||||
|
apdu_set_unrecognized_service_handler_handler(handler_unrecognized_service);
|
||||||
|
apdu_set_confirmed_handler(SERVICE_CONFIRMED_READ_PROPERTY, handler_read_property);
|
||||||
|
apdu_set_confirmed_handler(SERVICE_CONFIRMED_READ_PROP_MULTIPLE, handler_read_property_multiple);
|
||||||
|
apdu_set_confirmed_handler(SERVICE_CONFIRMED_WRITE_PROPERTY, handler_write_property);
|
||||||
|
apdu_set_confirmed_handler(SERVICE_CONFIRMED_READ_RANGE, handler_read_range);
|
||||||
|
apdu_set_confirmed_handler(SERVICE_CONFIRMED_REINITIALIZE_DEVICE, handler_reinitialize_device);
|
||||||
|
apdu_set_unconfirmed_handler(SERVICE_UNCONFIRMED_UTC_TIME_SYNCHRONIZATION, handler_timesync_utc);
|
||||||
|
apdu_set_unconfirmed_handler(SERVICE_UNCONFIRMED_TIME_SYNCHRONIZATION, handler_timesync);
|
||||||
|
apdu_set_confirmed_handler(SERVICE_CONFIRMED_SUBSCRIBE_COV, handler_cov_subscribe);
|
||||||
|
apdu_set_unconfirmed_handler(SERVICE_UNCONFIRMED_COV_NOTIFICATION, handler_ucov_notification);
|
||||||
|
apdu_set_confirmed_handler(SERVICE_CONFIRMED_DEVICE_COMMUNICATION_CONTROL, handler_device_communication_control);
|
||||||
|
apdu_set_unconfirmed_handler(SERVICE_UNCONFIRMED_WHO_IS, handler_who_is);
|
||||||
|
apdu_set_unrecognized_service_handler_handler(handler_unrecognized_service);
|
||||||
|
apdu_set_confirmed_handler(SERVICE_CONFIRMED_READ_PROPERTY, handler_read_property);
|
||||||
|
apdu_set_unconfirmed_handler(SERVICE_UNCONFIRMED_I_AM, handler_i_am_add);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
/*
|
||||||
|
* FIXME: This is a hack to get things linking correctly
|
||||||
|
*/
|
||||||
|
extern int cov_subscribe(void) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
extern int Device_Value_List_Supported(void) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
extern int Encode_RR_payload(void) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
extern int Device_Objects_RR_Info(void) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
extern int Device_Write_Property(void) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
extern int Device_Reinitialize(void) {
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
extern bool Device_COV(BACNET_OBJECT_TYPE object_type, uint32_t object_instance) {
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
extern void Device_COV_Clear(BACNET_OBJECT_TYPE object_type, uint32_t object_instance) {
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
extern bool Device_Encode_Value_List(BACNET_OBJECT_TYPE object_type,
|
||||||
|
uint32_t object_instance,
|
||||||
|
BACNET_PROPERTY_VALUE *value_list) {
|
||||||
|
|
||||||
|
return false;
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
extern int Device_Add_List_Element(BACNET_LIST_ELEMENT_DATA * list_element) {
|
||||||
|
return BACNET_STATUS_ERROR;
|
||||||
|
}
|
||||||
|
|
||||||
|
extern int Device_Remove_List_Element(BACNET_LIST_ELEMENT_DATA * list_element) {
|
||||||
|
return BACNET_STATUS_ERROR;
|
||||||
|
}
|
||||||
|
|
||||||
|
extern bool Device_Write_Property_Local(BACNET_WRITE_PROPERTY_DATA *wp_data) {
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
int LLVMFuzzerTestOneInput(uint8_t *data, size_t size) {
|
||||||
|
BACNET_ADDRESS src = { 0 };
|
||||||
|
|
||||||
|
Init_Service_Handlers();
|
||||||
|
|
||||||
|
/* process fuzz input*/
|
||||||
|
if (size>0 && size<=0xffff) {
|
||||||
|
my_routing_npdu_handler(BIP_Net, &src, data, (uint16_t)size);
|
||||||
|
}
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
}
|
||||||
@@ -1136,6 +1136,9 @@ static void control_c_hooks(void)
|
|||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
|
|
||||||
|
#ifndef FUZZING
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Main function of simple router demo.
|
* Main function of simple router demo.
|
||||||
*
|
*
|
||||||
@@ -1199,3 +1202,6 @@ int main(int argc, char *argv[])
|
|||||||
|
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
#endif // FUZZING
|
||||||
|
|||||||
Reference in New Issue
Block a user