This is an archive of the discontinued Mercurial Phabricator instance.

Differential D8374

fuzz: tell manifest fuzzer about longer node hashes
ClosedPublic

Authored by durin42 on Apr 2 2020, 4:32 PM.

Details

Reviewers
Alphare
pulkit
Group Reviewers
hg-reviewers
Commits
rHG0ff59434af72: fuzz: tell manifest fuzzer about longer node hashes
rHG9bedcfb4bb0e: fuzz: tell manifest fuzzer about longer node hashes

Diff Detail

Repository
rHG Mercurial
Branch
default
Lint
No Linters Available
Unit
No Unit Test Coverage

Event Timeline

durin42 created this revision.Apr 2 2020, 4:32 PM
Alphare requested changes to this revision.Apr 14 2020, 5:02 AM
Alphare added a subscriber: Alphare.

Looks to me like this is two changes in one, with the addition of null bytes. Or am I missing something?

This revision now requires changes to proceed.Apr 14 2020, 5:02 AM
durin42 added a comment.Apr 14 2020, 11:22 AM
In D8374#125469, @Alphare wrote:

Looks to me like this is two changes in one, with the addition of null bytes. Or am I missing something?

The input format for the corpus changed because of the ConsumeBool() call that then determines the width of generated node IDs.

pulkit added a subscriber: pulkit.Jun 15 2020, 5:13 AM

I am not sure what's the status of this one. @durin42 does this needs to be reviewed? If yes, can you rebase and push?

durin42 added a comment.Jun 17 2020, 11:01 AM

This is still valid.

pulkit accepted this revision.Jun 17 2020, 2:07 PM
durin42 added a commit: rHG9bedcfb4bb0e: fuzz: tell manifest fuzzer about longer node hashes.Jun 17 2020, 2:53 PM
This revision was not accepted when it landed; it landed in state Needs Revision.
Closed by commit rHG9bedcfb4bb0e: fuzz: tell manifest fuzzer about longer node hashes (authored by durin42). · Explain Why
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

Diff 20977

contrib/fuzz/manifest.cc

#include <Python.h> #include <Python.h>
#include <assert.h> #include <assert.h>
#include <stdlib.h> #include <stdlib.h>
#include <unistd.h> #include <unistd.h>
#include "FuzzedDataProvider.h"
#include "pyutil.h" #include "pyutil.h"
#include <string> #include <string>
extern "C" { extern "C" {
static PYCODETYPE *code; static PYCODETYPE *code;
extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv) extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv)
{ {
contrib::initpy(*argv[0]); contrib::initpy(*argv[0]);
code = (PYCODETYPE *)Py_CompileString(R"py( code = (PYCODETYPE *)Py_CompileString(R"py(
try: try:
lm = parsers.lazymanifest(mdata) lm = parsers.lazymanifest(mdata)
# iterate the whole thing, which causes the code to fully parse # iterate the whole thing, which causes the code to fully parse
# every line in the manifest # every line in the manifest
for e, _, _ in lm.iterentries(): for e, _, _ in lm.iterentries():
# also exercise __getitem__ et al # also exercise __getitem__ et al
lm[e] lm[e]
e in lm e in lm
(e + 'nope') in lm (e + 'nope') in lm
lm[b'xyzzy'] = (b'\0' * 20, 'x') lm[b'xyzzy'] = (b'\0' * nlen, 'x')
# do an insert, text should change # do an insert, text should change
assert lm.text() != mdata, "insert should change text and didn't: %r %r" % (lm.text(), mdata) assert lm.text() != mdata, "insert should change text and didn't: %r %r" % (lm.text(), mdata)
cloned = lm.filtercopy(lambda x: x != 'xyzzy') cloned = lm.filtercopy(lambda x: x != 'xyzzy')
assert cloned.text() == mdata, 'cloned text should equal mdata' assert cloned.text() == mdata, 'cloned text should equal mdata'
cloned.diff(lm) cloned.diff(lm)
del lm[b'xyzzy'] del lm[b'xyzzy']
cloned.diff(lm) cloned.diff(lm)
# should be back to the same # should be back to the same
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
{ {
// Don't allow fuzzer inputs larger than 100k, since we'll just bog // Don't allow fuzzer inputs larger than 100k, since we'll just bog
// down and not accomplish much. // down and not accomplish much.
if (Size > 100000) { if (Size > 100000) {
return 0; return 0;
} }
FuzzedDataProvider provider(Data, Size);
Py_ssize_t nodelength = provider.ConsumeBool() ? 20 : 32;
PyObject *nlen = PyLong_FromSsize_t(nodelength);
PyObject *mtext = PyObject *mtext =
PyBytes_FromStringAndSize((const char *)Data, (Py_ssize_t)Size); PyBytes_FromStringAndSize((const char *)Data, (Py_ssize_t)Size);
PyObject *locals = PyDict_New(); PyObject *locals = PyDict_New();
PyDict_SetItemString(locals, "mdata", mtext); PyDict_SetItemString(locals, "mdata", mtext);
PyDict_SetItemString(locals, "nlen", nlen);
PyObject *res = PyEval_EvalCode(code, contrib::pyglobals(), locals); PyObject *res = PyEval_EvalCode(code, contrib::pyglobals(), locals);
if (!res) { if (!res) {
PyErr_Print(); PyErr_Print();
} }
Py_XDECREF(res); Py_XDECREF(res);
Py_DECREF(locals); Py_DECREF(locals);
Py_DECREF(mtext); Py_DECREF(mtext);
return 0; // Non-zero return values are reserved for future use. return 0; // Non-zero return values are reserved for future use.
} }
} }

contrib/fuzz/manifest_corpus.py

from __future__ import absolute_import, print_function from __future__ import absolute_import, print_function
import argparse import argparse
import zipfile import zipfile
ap = argparse.ArgumentParser() ap = argparse.ArgumentParser()
ap.add_argument("out", metavar="some.zip", type=str, nargs=1) ap.add_argument("out", metavar="some.zip", type=str, nargs=1)
args = ap.parse_args() args = ap.parse_args()
with zipfile.ZipFile(args.out[0], "w", zipfile.ZIP_STORED) as zf: with zipfile.ZipFile(args.out[0], "w", zipfile.ZIP_STORED) as zf:
zf.writestr( zf.writestr(
"manifest_zero", "manifest_zero",
'''PKG-INFO\09b3ed8f2b81095a13064402e930565f083346e9a '''\0PKG-INFO\09b3ed8f2b81095a13064402e930565f083346e9a
README\080b6e76643dcb44d4bc729e932fc464b3e36dbe3 README\080b6e76643dcb44d4bc729e932fc464b3e36dbe3
hg\0b6444347c629cc058d478023905cfb83b7f5bb9d hg\0b6444347c629cc058d478023905cfb83b7f5bb9d
mercurial/__init__.py\0b80de5d138758541c5f05265ad144ab9fa86d1db mercurial/__init__.py\0b80de5d138758541c5f05265ad144ab9fa86d1db
mercurial/byterange.py\017f5a9fbd99622f31a392c33ac1e903925dc80ed mercurial/byterange.py\017f5a9fbd99622f31a392c33ac1e903925dc80ed
mercurial/fancyopts.py\0b6f52e23e356748c5039313d8b639cda16bf67ba mercurial/fancyopts.py\0b6f52e23e356748c5039313d8b639cda16bf67ba
mercurial/hg.py\023cc12f225f1b42f32dc0d897a4f95a38ddc8f4a mercurial/hg.py\023cc12f225f1b42f32dc0d897a4f95a38ddc8f4a
mercurial/mdiff.py\0a05f65c44bfbeec6a42336cd2ff0b30217899ca3 mercurial/mdiff.py\0a05f65c44bfbeec6a42336cd2ff0b30217899ca3
mercurial/revlog.py\0217bc3fde6d82c0210cf56aeae11d05a03f35b2b mercurial/revlog.py\0217bc3fde6d82c0210cf56aeae11d05a03f35b2b
mercurial/transaction.py\09d180df101dc14ce3dd582fd998b36c98b3e39aa mercurial/transaction.py\09d180df101dc14ce3dd582fd998b36c98b3e39aa
notes.txt\0703afcec5edb749cf5cec67831f554d6da13f2fb notes.txt\0703afcec5edb749cf5cec67831f554d6da13f2fb
setup.py\0ccf3f6daf0f13101ca73631f7a1769e328b472c9 setup.py\0ccf3f6daf0f13101ca73631f7a1769e328b472c9
tkmerge\03c922edb43a9c143682f7bc7b00f98b3c756ebe7 tkmerge\03c922edb43a9c143682f7bc7b00f98b3c756ebe7
''', ''',
) )
zf.writestr("badmanifest_shorthashes", "narf\0aa\nnarf2\0aaa\n") zf.writestr("badmanifest_shorthashes", "\0narf\0aa\nnarf2\0aaa\n")
zf.writestr( zf.writestr(
"badmanifest_nonull", "badmanifest_nonull",
"narf\0cccccccccccccccccccccccccccccccccccccccc\n" "\0narf\0cccccccccccccccccccccccccccccccccccccccc\n"
"narf2aaaaaaaaaaaaaaaaaaaa\n", "narf2aaaaaaaaaaaaaaaaaaaa\n",
) )
zf.writestr(
"manifest_long_nodes",
"\1a\0ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\n",
)