Skip to content

Commit

Permalink
boost: add fuzzers for beast library
Browse files Browse the repository at this point in the history
boost_beast_request_fuzzer for fuzzing HTTP requests parser
boost_beast_response_fuzzer for fuzzing HTTP responses parser
  • Loading branch information
tyler92 committed May 23, 2024
1 parent 74e3c94 commit 4ea760a
Show file tree
Hide file tree
Showing 3 changed files with 66 additions and 0 deletions.
31 changes: 31 additions & 0 deletions projects/boost/boost_beast_request_fuzzer.cc
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
// Copyright 2024 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

#include <boost/beast.hpp>
#include <boost/beast/_experimental/test/stream.hpp>

extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
{
using namespace boost::beast;

error_code ec;
flat_buffer buffer;
net::io_context ioc;
test::stream stream{ioc, {reinterpret_cast<const char*>(data), size}};

http::request<http::string_body> req;
http::read(stream, buffer, req, ec);

return 0;
}
31 changes: 31 additions & 0 deletions projects/boost/boost_beast_response_fuzzer.cc
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
// Copyright 2024 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

#include <boost/beast.hpp>
#include <boost/beast/_experimental/test/stream.hpp>

extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
{
using namespace boost::beast;

error_code ec;
flat_buffer buffer;
net::io_context ioc;
test::stream stream{ioc, {reinterpret_cast<const char*>(data), size}};

http::response<http::dynamic_body> resp;
http::read(stream, buffer, resp, ec);

return 0;
}
4 changes: 4 additions & 0 deletions projects/boost/build.sh
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,10 @@ $CXX $CXXFLAGS -I . ../boost_uuid_fuzzer.cc $LIB_FUZZING_ENGINE -o boost_uuid_fu
#boost programoptions
$CXX $CXXFLAGS -I . ../boost_programoptions_fuzzer.cc $LIB_FUZZING_ENGINE -o boost_programoptions_fuzzer stage/lib/libboost_program_options.a

#boost beast
$CXX $CXXFLAGS -I . ../boost_beast_request_fuzzer.cc $LIB_FUZZING_ENGINE -o boost_beast_request_fuzzer
$CXX $CXXFLAGS -I . ../boost_beast_response_fuzzer.cc $LIB_FUZZING_ENGINE -o boost_beast_response_fuzzer

# Copy the fuzzer executables, zip-ed corpora, option and dictionary files to $OUT
find . -name '*_fuzzer' -exec cp -v '{}' $OUT ';'
# find . -name '*_fuzzer.dict' -exec cp -v '{}' $OUT ';' # If you have dictionaries.
Expand Down

0 comments on commit 4ea760a

Please sign in to comment.