| indygreg |
| hg-reviewers |
This found a six-year-old bug immediately, and then I put it through a
few CPU-days of time before sending it.
| Automatic diff as part of commit; lint not applicable. |
| Automatic diff as part of commit; unit tests not applicable. |
| Path | Packages | |||
|---|---|---|---|---|
| M | contrib/fuzz/Makefile (16 lines) | |||
| A | M | contrib/fuzz/dirs.cc (56 lines) |
| -I../../mercurial \ | -I../../mercurial \ | ||||
| -c -o pathencode.o ../../mercurial/cext/pathencode.c | -c -o pathencode.o ../../mercurial/cext/pathencode.c | ||||
| revlog.o: ../../mercurial/cext/revlog.c | revlog.o: ../../mercurial/cext/revlog.c | ||||
| $(CC) $(CFLAGS) `$$OUT/sanpy/bin/python-config --cflags` \ | $(CC) $(CFLAGS) `$$OUT/sanpy/bin/python-config --cflags` \ | ||||
| -I../../mercurial \ | -I../../mercurial \ | ||||
| -c -o revlog.o ../../mercurial/cext/revlog.c | -c -o revlog.o ../../mercurial/cext/revlog.c | ||||
| manifest_fuzzer: manifest.cc manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o | dirs_fuzzer: dirs.cc manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o | ||||
| $(CXX) $(CXXFLAGS) `$$OUT/sanpy/bin/python-config --cflags` \ | $(CXX) $(CXXFLAGS) `$$OUT/sanpy/bin/python-config --cflags` \ | ||||
| -Wno-register -Wno-macro-redefined \ | -Wno-register -Wno-macro-redefined \ | ||||
| -I../../mercurial manifest.cc \ | -I../../mercurial dirs.cc \ | ||||
| manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o \ | manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o \ | ||||
| -lFuzzingEngine `$$OUT/sanpy/bin/python-config --ldflags` \ | -lFuzzingEngine `$$OUT/sanpy/bin/python-config --ldflags` \ | ||||
| -o $$OUT/manifest_fuzzer | -o $$OUT/dirs_fuzzer | ||||
| manifest_corpus.zip: | manifest_corpus.zip: | ||||
| python manifest_corpus.py $$OUT/manifest_fuzzer_seed_corpus.zip | python manifest_corpus.py $$OUT/manifest_fuzzer_seed_corpus.zip | ||||
| manifest_fuzzer: manifest.cc manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o | |||||
| $(CXX) $(CXXFLAGS) `$$OUT/sanpy/bin/python-config --cflags` \ | |||||
| -Wno-register -Wno-macro-redefined \ | |||||
| -I../../mercurial manifest.cc \ | |||||
| manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o \ | |||||
| -lFuzzingEngine `$$OUT/sanpy/bin/python-config --ldflags` \ | |||||
| -o $$OUT/manifest_fuzzer | |||||
| revlog_fuzzer: revlog.cc manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o | revlog_fuzzer: revlog.cc manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o | ||||
| $(CXX) $(CXXFLAGS) `$$OUT/sanpy/bin/python-config --cflags` \ | $(CXX) $(CXXFLAGS) `$$OUT/sanpy/bin/python-config --cflags` \ | ||||
| -Wno-register -Wno-macro-redefined \ | -Wno-register -Wno-macro-redefined \ | ||||
| -I../../mercurial revlog.cc \ | -I../../mercurial revlog.cc \ | ||||
| manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o \ | manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o \ | ||||
| -lFuzzingEngine `$$OUT/sanpy/bin/python-config --ldflags` \ | -lFuzzingEngine `$$OUT/sanpy/bin/python-config --ldflags` \ | ||||
| -o $$OUT/revlog_fuzzer | -o $$OUT/revlog_fuzzer | ||||
| python fm1readmarkers_corpus.py $$OUT/fm1readmarkers_fuzzer_seed_corpus.zip | python fm1readmarkers_corpus.py $$OUT/fm1readmarkers_fuzzer_seed_corpus.zip | ||||
| clean: | clean: | ||||
| $(RM) *.o *_fuzzer \ | $(RM) *.o *_fuzzer \ | ||||
| bdiff \ | bdiff \ | ||||
| mpatch \ | mpatch \ | ||||
| xdiff | xdiff | ||||
| oss-fuzz: bdiff_fuzzer mpatch_fuzzer mpatch_corpus.zip xdiff_fuzzer manifest_fuzzer manifest_corpus.zip revlog_fuzzer revlog_corpus.zip dirstate_fuzzer dirstate_corpus.zip fm1readmarkers_fuzzer fm1readmarkers_corpus.zip | oss-fuzz: bdiff_fuzzer mpatch_fuzzer mpatch_corpus.zip xdiff_fuzzer dirs_fuzzer manifest_fuzzer manifest_corpus.zip revlog_fuzzer revlog_corpus.zip dirstate_fuzzer dirstate_corpus.zip fm1readmarkers_fuzzer fm1readmarkers_corpus.zip | ||||
| .PHONY: all clean oss-fuzz | .PHONY: all clean oss-fuzz | ||||
| #include <Python.h> | |||||
| #include <assert.h> | |||||
| #include <stdlib.h> | |||||
| #include <unistd.h> | |||||
| #include "pyutil.h" | |||||
| #include <string> | |||||
| extern "C" { | |||||
| static PyCodeObject *code; | |||||
| extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv) | |||||
| { | |||||
| contrib::initpy(*argv[0]); | |||||
| code = (PyCodeObject *)Py_CompileString(R"py( | |||||
| from parsers import dirs | |||||
| try: | |||||
| files = mdata.split('\n') | |||||
| d = dirs(files) | |||||
| list(d) | |||||
| 'a' in d | |||||
| if files: | |||||
| files[0] in d | |||||
| except Exception as e: | |||||
| pass | |||||
| # uncomment this print if you're editing this Python code | |||||
| # to debug failures. | |||||
| # print e | |||||
| )py", | |||||
| "fuzzer", Py_file_input); | |||||
| return 0; | |||||
| } | |||||
| int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) | |||||
| { | |||||
| // Don't allow fuzzer inputs larger than 100k, since we'll just bog | |||||
| // down and not accomplish much. | |||||
| if (Size > 100000) { | |||||
| return 0; | |||||
| } | |||||
| PyObject *mtext = | |||||
| PyBytes_FromStringAndSize((const char *)Data, (Py_ssize_t)Size); | |||||
| PyObject *locals = PyDict_New(); | |||||
| PyDict_SetItemString(locals, "mdata", mtext); | |||||
| PyObject *res = PyEval_EvalCode(code, contrib::pyglobals(), locals); | |||||
| if (!res) { | |||||
| PyErr_Print(); | |||||
| } | |||||
| Py_XDECREF(res); | |||||
| Py_DECREF(locals); | |||||
| Py_DECREF(mtext); | |||||
| return 0; // Non-zero return values are reserved for future use. | |||||
| } | |||||
| } | |||||