Add a fuzzer for the url parser

Corpus extracted from https://golang.org/src/net/url/url_test.go
h2o · Feb 8, 2017 · eadee12 · eadee12
1 parent 36d75bf
commit eadee12
Show file tree

Hide file tree

Showing 72 changed files with 108 additions and 0 deletions.
diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -531,6 +531,7 @@ IF (BUILD_FUZZER)
     ENDIF()
     ADD_EXECUTABLE(h2o-fuzzer-http1 fuzz/driver.cc)
     ADD_EXECUTABLE(h2o-fuzzer-http2 fuzz/driver.cc)
+    ADD_EXECUTABLE(h2o-fuzzer-url fuzz/driver_url.cc)
     SET_TARGET_PROPERTIES(h2o-fuzzer-http1 PROPERTIES COMPILE_FLAGS "-DHTTP1")
     SET_TARGET_PROPERTIES(h2o-fuzzer-http2 PROPERTIES COMPILE_FLAGS "-DHTTP2")
     SET(CMAKE_EXE_LINKER_FLAGS "${CMAKE_C_FLAGS} -fsanitize=address")
@@ -548,10 +549,12 @@ IF (BUILD_FUZZER)
         ADD_CUSTOM_TARGET(libFuzzer ${CMAKE_CURRENT_SOURCE_DIR}/misc/build_libFuzzer.sh WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR})
         ADD_DEPENDENCIES(h2o-fuzzer-http1 libFuzzer)
         ADD_DEPENDENCIES(h2o-fuzzer-http2 libFuzzer)
+        ADD_DEPENDENCIES(h2o-fuzzer-url libFuzzer)
     ENDIF (OSS_FUZZ)
 
     TARGET_LINK_LIBRARIES(h2o-fuzzer-http1 libh2o-evloop ${EXTRA_LIBS} ${LIB_FUZZER})
     TARGET_LINK_LIBRARIES(h2o-fuzzer-http2 libh2o-evloop ${EXTRA_LIBS} ${LIB_FUZZER})
+    TARGET_LINK_LIBRARIES(h2o-fuzzer-url libh2o-evloop ${EXTRA_LIBS} ${LIB_FUZZER})
 
 ENDIF (BUILD_FUZZER)
 

diff --git a/fuzz/driver_url.cc b/fuzz/driver_url.cc
@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2016 Fastly, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to
+ * deal in the Software without restriction, including without limitation the
+ * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+ * sell copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ * IN THE SOFTWARE.
+ */
+
+/*
+ * This file implements a test harness for using h2o with LibFuzzer.
+ * See http://llvm.org/docs/LibFuzzer.html for more info.
+ */
+
+#include "h2o.h"
+#include "h2o/url.h"
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
+{
+    h2o_url_t url;
+    h2o_url_parse((const char *)Data, Size, &url);
+    return 0;
+}
diff --git a/fuzz/url-corpus/1 b/fuzz/url-corpus/1
@@ -0,0 +1 @@
+http://www.google.com
diff --git a/fuzz/url-corpus/10 b/fuzz/url-corpus/10
@@ -0,0 +1 @@
+http://www.google.com/a%20b?q=c+d
diff --git a/fuzz/url-corpus/11 b/fuzz/url-corpus/11
@@ -0,0 +1 @@
+http:www.google.com/?q=go+language
diff --git a/fuzz/url-corpus/12 b/fuzz/url-corpus/12
@@ -0,0 +1 @@
+http:%2f%2fwww.google.com/?q=go+language
diff --git a/fuzz/url-corpus/13 b/fuzz/url-corpus/13
@@ -0,0 +1 @@
+mailto:/webmaster@golang.org
diff --git a/fuzz/url-corpus/14 b/fuzz/url-corpus/14
@@ -0,0 +1 @@
+mailto:webmaster@golang.org
diff --git a/fuzz/url-corpus/15 b/fuzz/url-corpus/15
@@ -0,0 +1 @@
+/foo?query=http://bad
diff --git a/fuzz/url-corpus/16 b/fuzz/url-corpus/16
@@ -0,0 +1 @@
+//foo
diff --git a/fuzz/url-corpus/17 b/fuzz/url-corpus/17
@@ -0,0 +1 @@
+//user@foo/path?a=b
diff --git a/fuzz/url-corpus/18 b/fuzz/url-corpus/18
@@ -0,0 +1 @@
+///threeslashes
diff --git a/fuzz/url-corpus/19 b/fuzz/url-corpus/19
@@ -0,0 +1 @@
+http://user:password@google.com
diff --git a/fuzz/url-corpus/2 b/fuzz/url-corpus/2
@@ -0,0 +1 @@
+http://www.google.com/
diff --git a/fuzz/url-corpus/20 b/fuzz/url-corpus/20
@@ -0,0 +1 @@
+http://j@ne:password@google.com
diff --git a/fuzz/url-corpus/21 b/fuzz/url-corpus/21
@@ -0,0 +1 @@
+http://jane:p@ssword@google.com
diff --git a/fuzz/url-corpus/22 b/fuzz/url-corpus/22
@@ -0,0 +1 @@
+http://j@ne:password@google.com/p@th?q=@go
diff --git a/fuzz/url-corpus/23 b/fuzz/url-corpus/23
@@ -0,0 +1 @@
+http://www.google.com/?q=go+language#foo
diff --git a/fuzz/url-corpus/24 b/fuzz/url-corpus/24
@@ -0,0 +1 @@
+http://www.google.com/?q=go+language#foo%26bar
diff --git a/fuzz/url-corpus/25 b/fuzz/url-corpus/25
@@ -0,0 +1 @@
+file:///home/adg/rabbits
diff --git a/fuzz/url-corpus/26 b/fuzz/url-corpus/26
@@ -0,0 +1 @@
+file:///C:/FooBar/Baz.txt
diff --git a/fuzz/url-corpus/27 b/fuzz/url-corpus/27
@@ -0,0 +1 @@
+MaIlTo:webmaster@golang.org
diff --git a/fuzz/url-corpus/28 b/fuzz/url-corpus/28
@@ -0,0 +1 @@
+a/b/c
diff --git a/fuzz/url-corpus/29 b/fuzz/url-corpus/29
@@ -0,0 +1 @@
+http://%3Fam:pa%3Fsword@google.com
diff --git a/fuzz/url-corpus/3 b/fuzz/url-corpus/3
@@ -0,0 +1 @@
+http://www.google.com/file%20one%26two
diff --git a/fuzz/url-corpus/30 b/fuzz/url-corpus/30
@@ -0,0 +1 @@
+http://192.168.0.1/
diff --git a/fuzz/url-corpus/31 b/fuzz/url-corpus/31
@@ -0,0 +1 @@
+http://192.168.0.1:8080/
diff --git a/fuzz/url-corpus/32 b/fuzz/url-corpus/32
@@ -0,0 +1 @@
+http://[fe80::1]/
diff --git a/fuzz/url-corpus/33 b/fuzz/url-corpus/33
@@ -0,0 +1 @@
+http://[fe80::1]:8080/
diff --git a/fuzz/url-corpus/34 b/fuzz/url-corpus/34
@@ -0,0 +1 @@
+http://[fe80::1%25en0]/",
diff --git a/fuzz/url-corpus/35 b/fuzz/url-corpus/35
@@ -0,0 +1 @@
+//
diff --git a/fuzz/url-corpus/36 b/fuzz/url-corpus/36
@@ -0,0 +1 @@
+alphanum
diff --git a/fuzz/url-corpus/37 b/fuzz/url-corpus/37
@@ -0,0 +1 @@
+zone
diff --git a/fuzz/url-corpus/38 b/fuzz/url-corpus/38
@@ -0,0 +1 @@
+identifier
diff --git a/fuzz/url-corpus/39 b/fuzz/url-corpus/39
@@ -0,0 +1 @@
+http://[fe80::1%25en0]:8080/",
diff --git a/fuzz/url-corpus/4 b/fuzz/url-corpus/4
@@ -0,0 +1 @@
+ftp://webmaster@www.google.com/
diff --git a/fuzz/url-corpus/40 b/fuzz/url-corpus/40
@@ -0,0 +1 @@
+//
diff --git a/fuzz/url-corpus/41 b/fuzz/url-corpus/41
@@ -0,0 +1 @@
+alphanum
diff --git a/fuzz/url-corpus/42 b/fuzz/url-corpus/42
@@ -0,0 +1 @@
+zone
diff --git a/fuzz/url-corpus/43 b/fuzz/url-corpus/43
@@ -0,0 +1 @@
+identifier
diff --git a/fuzz/url-corpus/44 b/fuzz/url-corpus/44
@@ -0,0 +1 @@
+http://[fe80::1%25%65%6e%301-._~]/",
diff --git a/fuzz/url-corpus/45 b/fuzz/url-corpus/45
@@ -0,0 +1 @@
+//
diff --git a/fuzz/url-corpus/46 b/fuzz/url-corpus/46
@@ -0,0 +1 @@
+percent-encoded+unreserved
diff --git a/fuzz/url-corpus/47 b/fuzz/url-corpus/47
@@ -0,0 +1 @@
+zone
diff --git a/fuzz/url-corpus/48 b/fuzz/url-corpus/48
@@ -0,0 +1 @@
+identifier
diff --git a/fuzz/url-corpus/49 b/fuzz/url-corpus/49
@@ -0,0 +1 @@
+http://[fe80::1%25%65%6e%301-._~]:8080/",
diff --git a/fuzz/url-corpus/5 b/fuzz/url-corpus/5
@@ -0,0 +1 @@
+ftp://john%20doe@www.google.com/
diff --git a/fuzz/url-corpus/50 b/fuzz/url-corpus/50
@@ -0,0 +1 @@
+//
diff --git a/fuzz/url-corpus/51 b/fuzz/url-corpus/51
@@ -0,0 +1 @@
+percent-encoded+unreserved
diff --git a/fuzz/url-corpus/52 b/fuzz/url-corpus/52
@@ -0,0 +1 @@
+zone
diff --git a/fuzz/url-corpus/53 b/fuzz/url-corpus/53
@@ -0,0 +1 @@
+identifier
diff --git a/fuzz/url-corpus/54 b/fuzz/url-corpus/54
@@ -0,0 +1 @@
+http://rest.rsc.io/foo%2fbar/baz%2Fquux?alt=media
diff --git a/fuzz/url-corpus/55 b/fuzz/url-corpus/55
@@ -0,0 +1 @@
+mysql://a,b,c/bar
diff --git a/fuzz/url-corpus/56 b/fuzz/url-corpus/56
@@ -0,0 +1 @@
+scheme://!$&'()*+,;=hello!:port/path
diff --git a/fuzz/url-corpus/57 b/fuzz/url-corpus/57
@@ -0,0 +1 @@
+http://host/!$&'()*+,;=:@[hello]
diff --git a/fuzz/url-corpus/58 b/fuzz/url-corpus/58
@@ -0,0 +1 @@
+http://example.com/oid/[order_id]
diff --git a/fuzz/url-corpus/59 b/fuzz/url-corpus/59
@@ -0,0 +1 @@
+http://192.168.0.2:8080/foo
diff --git a/fuzz/url-corpus/6 b/fuzz/url-corpus/6
@@ -0,0 +1 @@
+http://www.google.com/?
diff --git a/fuzz/url-corpus/60 b/fuzz/url-corpus/60
@@ -0,0 +1 @@
+http://192.168.0.2:/foo
diff --git a/fuzz/url-corpus/61 b/fuzz/url-corpus/61
@@ -0,0 +1 @@
+http://2b01:e34:ef40:7730:8e70:5aff:fefe:edac:8080/foo
diff --git a/fuzz/url-corpus/62 b/fuzz/url-corpus/62
@@ -0,0 +1 @@
+http://2b01:e34:ef40:7730:8e70:5aff:fefe:edac:/foo
diff --git a/fuzz/url-corpus/63 b/fuzz/url-corpus/63
@@ -0,0 +1 @@
+http://[2b01:e34:ef40:7730:8e70:5aff:fefe:edac]:8080/foo
diff --git a/fuzz/url-corpus/64 b/fuzz/url-corpus/64
@@ -0,0 +1 @@
+http://[2b01:e34:ef40:7730:8e70:5aff:fefe:edac]:/foo
diff --git a/fuzz/url-corpus/65 b/fuzz/url-corpus/65
@@ -0,0 +1 @@
+http://hello.世界.com/foo
diff --git a/fuzz/url-corpus/66 b/fuzz/url-corpus/66
@@ -0,0 +1 @@
+http://hello.%e4%b8%96%e7%95%8c.com/foo
diff --git a/fuzz/url-corpus/67 b/fuzz/url-corpus/67
@@ -0,0 +1 @@
+http://hello.%E4%B8%96%E7%95%8C.com/foo
diff --git a/fuzz/url-corpus/68 b/fuzz/url-corpus/68
@@ -0,0 +1 @@
+http://example.com//foo
diff --git a/fuzz/url-corpus/69 b/fuzz/url-corpus/69
@@ -0,0 +1 @@
+myscheme://authority<\"hi\">/foo
diff --git a/fuzz/url-corpus/7 b/fuzz/url-corpus/7
@@ -0,0 +1 @@
+http://www.google.com/?foo=bar?
diff --git a/fuzz/url-corpus/70 b/fuzz/url-corpus/70
@@ -0,0 +1 @@
+tcp://[2020::2020:20:2020:2020%25Windows%20Loves%20Spaces]:2020
diff --git a/fuzz/url-corpus/8 b/fuzz/url-corpus/8
@@ -0,0 +1 @@
+http://www.google.com/?q=go+language
diff --git a/fuzz/url-corpus/9 b/fuzz/url-corpus/9
@@ -0,0 +1 @@
+http://www.google.com/?q=go%20language