This is an archive of the discontinued Mercurial Phabricator instance.

Differential D7033

fuzz: new fuzzer for fncache-related functions
ClosedPublic

Authored by durin42 on Oct 9 2019, 12:18 PM.

Details

Reviewers
indygreg
Group Reviewers
hg-reviewers
Commits
rHGb37dd26935ee: fuzz: new fuzzer for fncache-related functions
rHGca2ca7fbad44: fuzz: new fuzzer for fncache-related functions
Summary

Not all of these are strictly fncache-related, but they all have th
same signature and similar-enough behavior that we may as well fuzz
them together. No obvious bugs for once, but these felt like they were
just complicated enough to cover.

Diff Detail

Repository
rHG Mercurial
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Revision Contents
Changeset List

PathPackages
Mcontrib/fuzz/Makefile (10 lines)
AMcontrib/fuzz/fncache.cc (78 lines)

Diff 17034

contrib/fuzz/Makefile

dirs_fuzzer: dirs.cc manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o dirs_fuzzer: dirs.cc manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o
$(CXX) $(CXXFLAGS) `$$OUT/sanpy/bin/python-config --cflags` \ $(CXX) $(CXXFLAGS) `$$OUT/sanpy/bin/python-config --cflags` \
-Wno-register -Wno-macro-redefined \ -Wno-register -Wno-macro-redefined \
-I../../mercurial dirs.cc \ -I../../mercurial dirs.cc \
manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o \ manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o \
-lFuzzingEngine `$$OUT/sanpy/bin/python-config --ldflags` \ -lFuzzingEngine `$$OUT/sanpy/bin/python-config --ldflags` \
-o $$OUT/dirs_fuzzer -o $$OUT/dirs_fuzzer
fncache_fuzzer: fncache.cc manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o
$(CXX) $(CXXFLAGS) `$$OUT/sanpy/bin/python-config --cflags` \
-Wno-register -Wno-macro-redefined \
-I../../mercurial fncache.cc \
manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o \
-lFuzzingEngine `$$OUT/sanpy/bin/python-config --ldflags` \
-o $$OUT/fncache_fuzzer
manifest_corpus.zip: manifest_corpus.zip:
python manifest_corpus.py $$OUT/manifest_fuzzer_seed_corpus.zip python manifest_corpus.py $$OUT/manifest_fuzzer_seed_corpus.zip
manifest_fuzzer: manifest.cc manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o manifest_fuzzer: manifest.cc manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o
$(CXX) $(CXXFLAGS) `$$OUT/sanpy/bin/python-config --cflags` \ $(CXX) $(CXXFLAGS) `$$OUT/sanpy/bin/python-config --cflags` \
-Wno-register -Wno-macro-redefined \ -Wno-register -Wno-macro-redefined \
-I../../mercurial manifest.cc \ -I../../mercurial manifest.cc \
manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o \ manifest.o charencode.o parsers.o dirs.o pathencode.o revlog.o pyutil.o \
python fm1readmarkers_corpus.py $$OUT/fm1readmarkers_fuzzer_seed_corpus.zip python fm1readmarkers_corpus.py $$OUT/fm1readmarkers_fuzzer_seed_corpus.zip
clean: clean:
$(RM) *.o *_fuzzer \ $(RM) *.o *_fuzzer \
bdiff \ bdiff \
mpatch \ mpatch \
xdiff xdiff
oss-fuzz: bdiff_fuzzer mpatch_fuzzer mpatch_corpus.zip xdiff_fuzzer dirs_fuzzer manifest_fuzzer manifest_corpus.zip revlog_fuzzer revlog_corpus.zip dirstate_fuzzer dirstate_corpus.zip fm1readmarkers_fuzzer fm1readmarkers_corpus.zip oss-fuzz: bdiff_fuzzer mpatch_fuzzer mpatch_corpus.zip xdiff_fuzzer dirs_fuzzer fncache_fuzzer manifest_fuzzer manifest_corpus.zip revlog_fuzzer revlog_corpus.zip dirstate_fuzzer dirstate_corpus.zip fm1readmarkers_fuzzer fm1readmarkers_corpus.zip
.PHONY: all clean oss-fuzz .PHONY: all clean oss-fuzz

contrib/fuzz/fncache.cc

  • This file was added.
#include <Python.h>
#include <assert.h>
#include <stdlib.h>
#include <unistd.h>
#include "pyutil.h"
#include <iostream>
#include <string>
extern "C" {
static PyCodeObject *code;
extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv)
{
contrib::initpy(*argv[0]);
code = (PyCodeObject *)Py_CompileString(R"py(
from parsers import (
isasciistr,
asciilower,
asciiupper,
encodedir,
pathencode,
lowerencode,
)
try:
for fn in (
isasciistr,
asciilower,
asciiupper,
encodedir,
pathencode,
lowerencode,
):
try:
fn(data)
except UnicodeDecodeError:
pass # some functions emit this exception
except AttributeError:
# pathencode needs hashlib, which fails to import because the time
# module fails to import. We should try and fix that some day, but
# for now we at least get coverage on non-hashencoded codepaths.
if fn != pathencode:
raise
# uncomment this for debugging exceptions
# except Exception as e:
# raise Exception('%r: %r' % (fn, e))
except Exception as e:
pass
# uncomment this print if you're editing this Python code
# to debug failures.
# print(e)
)py",
"fuzzer", Py_file_input);
if (!code) {
std::cerr << "failed to compile Python code!" << std::endl;
}
return 0;
}
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
{
PyObject *mtext =
PyBytes_FromStringAndSize((const char *)Data, (Py_ssize_t)Size);
PyObject *locals = PyDict_New();
PyDict_SetItemString(locals, "data", mtext);
PyObject *res = PyEval_EvalCode(code, contrib::pyglobals(), locals);
if (!res) {
PyErr_Print();
}
Py_XDECREF(res);
Py_DECREF(locals);
Py_DECREF(mtext);
return 0; // Non-zero return values are reserved for future use.
}
}