diff --git a/projects/boost/boost_beast_request_fuzzer.cc b/projects/boost/boost_beast_request_fuzzer.cc new file mode 100644 index 000000000000..36b4bd9c50fb --- /dev/null +++ b/projects/boost/boost_beast_request_fuzzer.cc @@ -0,0 +1,32 @@ +// Copyright 2024 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#include +#include + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + using namespace boost::beast; + + error_code ec; + flat_buffer buffer; + net::io_context ioc; + test::stream stream{ioc, {reinterpret_cast(data), size}}; + stream.close_remote(); + + http::request_parser parser; + http::read(stream, buffer, parser, ec); + + return 0; +} diff --git a/projects/boost/boost_beast_response_fuzzer.cc b/projects/boost/boost_beast_response_fuzzer.cc new file mode 100644 index 000000000000..d1abf438f867 --- /dev/null +++ b/projects/boost/boost_beast_response_fuzzer.cc @@ -0,0 +1,40 @@ +// Copyright 2024 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#include +#include + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + using namespace boost::beast; + + error_code ec; + multi_buffer buffer; + net::io_context ioc; + test::stream stream{ioc, {reinterpret_cast(data), size}}; + stream.close_remote(); + + http::chunk_extensions ce; + http::response_parser parser; + + auto chunk_header_cb + = [&ce](std::uint64_t size, string_view extensions, error_code& ev) { + ce.parse(extensions, ev); + }; + + parser.on_chunk_header(chunk_header_cb); + http::read(stream, buffer, parser, ec); + + return 0; +} diff --git a/projects/boost/build.sh b/projects/boost/build.sh index e4057bc9b5bf..1b891ee69e6b 100755 --- a/projects/boost/build.sh +++ b/projects/boost/build.sh @@ -51,6 +51,10 @@ $CXX $CXXFLAGS -I . ../boost_uuid_fuzzer.cc $LIB_FUZZING_ENGINE -o boost_uuid_fu #boost programoptions $CXX $CXXFLAGS -I . ../boost_programoptions_fuzzer.cc $LIB_FUZZING_ENGINE -o boost_programoptions_fuzzer stage/lib/libboost_program_options.a +#boost beast +$CXX $CXXFLAGS -I . ../boost_beast_request_fuzzer.cc $LIB_FUZZING_ENGINE -o boost_beast_request_fuzzer +$CXX $CXXFLAGS -I . ../boost_beast_response_fuzzer.cc $LIB_FUZZING_ENGINE -o boost_beast_response_fuzzer + # Copy the fuzzer executables, zip-ed corpora, option and dictionary files to $OUT find . -name '*_fuzzer' -exec cp -v '{}' $OUT ';' # find . -name '*_fuzzer.dict' -exec cp -v '{}' $OUT ';' # If you have dictionaries.