This is an archive of the discontinued Mercurial Phabricator instance.

Differential D5154

fuzz: move many initialization steps into LLVMFuzzerInitialize
ClosedPublic

Authored by durin42 on Oct 18 2018, 4:36 PM.

Details

Reviewers
None
Group Reviewers
hg-reviewers
Commits
rHGc3ab0a89331d: fuzz: move many initialization steps into LLVMFuzzerInitialize
Summary

Doing this means that things we intentionally leak (eg type objects)
no longer confuse AddressSanitizer, so now we can run the fuzzer MUCH
longer.

Diff Detail

Repository
rHG Mercurial
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

durin42 created this revision.Oct 18 2018, 4:36 PM
Closed by commit rHGc3ab0a89331d: fuzz: move many initialization steps into LLVMFuzzerInitialize (authored by durin42). · Explain WhyOct 19 2018, 9:29 AM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathPackages
Mcontrib/fuzz/manifest.cc (32 lines)

Diff 12262

contrib/fuzz/manifest.cc

#include <Python.h> #include <Python.h>
#include <assert.h> #include <assert.h>
#include <stdlib.h> #include <stdlib.h>
#include <unistd.h> #include <unistd.h>
#include <string> #include <string>
extern "C" { extern "C" {
/* TODO: use Python 3 for this fuzzing? */ /* TODO: use Python 3 for this fuzzing? */
PyMODINIT_FUNC initparsers(void); PyMODINIT_FUNC initparsers(void);
static char cpypath[8192] = "\0"; static char cpypath[8192] = "\0";
static PyCodeObject *code;
static PyObject *mainmod;
static PyObject *globals;
extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv) extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv)
{ {
const std::string subdir = "/sanpy/lib/python2.7"; const std::string subdir = "/sanpy/lib/python2.7";
/* HACK ALERT: we need a full Python installation built without /* HACK ALERT: we need a full Python installation built without
pymalloc and with ASAN, so we dump one in pymalloc and with ASAN, so we dump one in
$OUT/sanpy/lib/python2.7. This helps us wire that up. */ $OUT/sanpy/lib/python2.7. This helps us wire that up. */
std::string selfpath(*argv[0]); std::string selfpath(*argv[0]);
std::string pypath; std::string pypath;
auto pos = selfpath.rfind("/"); auto pos = selfpath.rfind("/");
if (pos == std::string::npos) { if (pos == std::string::npos) {
char wd[8192]; char wd[8192];
getcwd(wd, 8192); getcwd(wd, 8192);
pypath = std::string(wd) + subdir; pypath = std::string(wd) + subdir;
} else { } else {
pypath = selfpath.substr(0, pos) + subdir; pypath = selfpath.substr(0, pos) + subdir;
} }
strncpy(cpypath, pypath.c_str(), pypath.size()); strncpy(cpypath, pypath.c_str(), pypath.size());
setenv("PYTHONPATH", cpypath, 1); setenv("PYTHONPATH", cpypath, 1);
setenv("PYTHONNOUSERSITE", "1", 1); setenv("PYTHONNOUSERSITE", "1", 1);
/* prevent Python from looking up users in the fuzz environment */ /* prevent Python from looking up users in the fuzz environment */
setenv("PYTHONUSERBASE", cpypath, 1); setenv("PYTHONUSERBASE", cpypath, 1);
Py_SetPythonHome(cpypath); Py_SetPythonHome(cpypath);
Py_InitializeEx(0); Py_InitializeEx(0);
return 0;
}
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
{
initparsers(); initparsers();
PyObject *mtext = code = (PyCodeObject *)Py_CompileString(R"py(
PyBytes_FromStringAndSize((const char *)Data, (Py_ssize_t)Size);
PyObject *mainmod = PyImport_AddModule("__main__");
PyObject *globals = PyModule_GetDict(mainmod);
PyObject *locals = PyDict_New();
PyDict_SetItemString(locals, "mdata", mtext);
PyCodeObject *code =
(PyCodeObject *)Py_CompileString(R"py(
from parsers import lazymanifest from parsers import lazymanifest
try: try:
lm = lazymanifest(mdata) lm = lazymanifest(mdata)
# iterate the whole thing, which causes the code to fully parse # iterate the whole thing, which causes the code to fully parse
# every line in the manifest # every line in the manifest
list(lm.iterentries()) list(lm.iterentries())
lm[b'xyzzy'] = (b'\0' * 20, 'x') lm[b'xyzzy'] = (b'\0' * 20, 'x')
# do an insert, text should change # do an insert, text should change
assert lm.text() != mdata, "insert should change text and didn't: %r %r" % (lm.text(), mdata) assert lm.text() != mdata, "insert should change text and didn't: %r %r" % (lm.text(), mdata)
del lm[b'xyzzy'] del lm[b'xyzzy']
# should be back to the same # should be back to the same
assert lm.text() == mdata, "delete should have restored text but didn't: %r %r" % (lm.text(), mdata) assert lm.text() == mdata, "delete should have restored text but didn't: %r %r" % (lm.text(), mdata)
except Exception as e: except Exception as e:
pass pass
# uncomment this print if you're editing this Python code # uncomment this print if you're editing this Python code
# to debug failures. # to debug failures.
# print e # print e
)py", )py",
"fuzzer", Py_file_input); "fuzzer", Py_file_input);
mainmod = PyImport_AddModule("__main__");
globals = PyModule_GetDict(mainmod);
return 0;
}
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
{
PyObject *mtext =
PyBytes_FromStringAndSize((const char *)Data, (Py_ssize_t)Size);
PyObject *locals = PyDict_New();
PyDict_SetItemString(locals, "mdata", mtext);
PyObject *res = PyEval_EvalCode(code, globals, locals); PyObject *res = PyEval_EvalCode(code, globals, locals);
if (!res) { if (!res) {
PyErr_Print(); PyErr_Print();
} }
Py_XDECREF(res); Py_XDECREF(res);
Py_DECREF(code);
Py_DECREF(locals); Py_DECREF(locals);
Py_DECREF(mtext); Py_DECREF(mtext);
return 0; // Non-zero return values are reserved for future use. return 0; // Non-zero return values are reserved for future use.
} }
} }