This is an archive of the discontinued Mercurial Phabricator instance.

Differential D7106

fuzz: restrict dirs fuzzer to only 40k of input
Needs RevisionPublic

Authored by durin42 on Oct 15 2019, 9:58 AM.

Details

Reviewers
baymax
Group Reviewers
hg-reviewers
Summary

Experimentally one very long path of this size shouldn't blow the RAM
budget in the fuzzer environment, and it's not really exciting to
discover that building the dirs dict for one stupidly long path uses a
ton of RAM.

Diff Detail

Repository
rHG Mercurial
Lint
Lint Skipped
Unit
Unit Tests Skipped

Event Timeline

durin42 created this revision.Oct 15 2019, 9:58 AM
indygreg added a subscriber: indygreg.Oct 15 2019, 9:55 PM

If we blow stupid amounts of memory in the dirs internals, perhaps we should be enforcing a length limit in the implementation instead of burying our head in the sand by not triggering it via fuzzing.

If we need to teach the fuzzer to only send small input so we don't trigger exceptions, fine. But if this is an OOM vector, I'd like to fix it. What do you think?

durin42 added a comment.Oct 16 2019, 12:16 AM

The concern is basically that the fuzzer will figure out something dumb, like 'a/' * 40000 + 'b' which consumes around a gig of memory. I don't think this is a serious OOM vector, since any such manifest would also be inordinately large?

Maybe I'm being an optimist.

baymax requested changes to this revision.Jan 24 2020, 12:31 PM

There seems to have been no activities on this Diff for the past 3 Months.

By policy, we are automatically moving it out of the need-review state.

Please, move it back to need-review without hesitation if this diff should still be discussed.

:baymax:need-review-idle:

This revision now requires changes to proceed.Jan 24 2020, 12:31 PM

Revision Contents
Changeset List

PathPackages
Mcontrib/fuzz/dirs.cc (7 lines)

Diff 17174

contrib/fuzz/dirs.cc

# print e # print e
)py", )py",
"fuzzer", Py_file_input); "fuzzer", Py_file_input);
return 0; return 0;
} }
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
{ {
// Don't allow fuzzer inputs larger than 100k, since we'll just bog // Don't allow fuzzer inputs larger than 40k: the fuzzer will
// down and not accomplish much. // discover that if it passes us one extremely long path we'll
if (Size > 100000) { // use a ton of RAM, which is a surprise to nobody.
if (Size > 40000) {
return 0; return 0;
} }
PyObject *mtext = PyObject *mtext =
PyBytes_FromStringAndSize((const char *)Data, (Py_ssize_t)Size); PyBytes_FromStringAndSize((const char *)Data, (Py_ssize_t)Size);
PyObject *locals = PyDict_New(); PyObject *locals = PyDict_New();
PyDict_SetItemString(locals, "mdata", mtext); PyDict_SetItemString(locals, "mdata", mtext);
PyObject *res = PyEval_EvalCode(code, contrib::pyglobals(), locals); PyObject *res = PyEval_EvalCode(code, contrib::pyglobals(), locals);
if (!res) { if (!res) {
PyErr_Print(); PyErr_Print();
} }
Py_XDECREF(res); Py_XDECREF(res);
Py_DECREF(locals); Py_DECREF(locals);
Py_DECREF(mtext); Py_DECREF(mtext);
return 0; // Non-zero return values are reserved for future use. return 0; // Non-zero return values are reserved for future use.
} }
} }