tests: add a fuzzer for dev_kmsg_record #10788
Conversation
src/fuzz/fuzz-journald-kmsg.c
Outdated
| buffer = memdup(data, size); | ||
| assert_se(buffer); | ||
| s.syslog_fd = s.native_fd = s.stdout_fd = s.dev_kmsg_fd = s.audit_fd = s.hostname_fd = s.notify_fd = -1; | ||
| s.storage = STORAGE_NONE; |
There was a problem hiding this comment.
It is not a matter but I prefer to use structured initializer.
There was a problem hiding this comment.
@yuwata thank you for the review!
This was originally borrowed verbatim from server_init, where there're a lot of assignments like that, which, of course, shouldn't be an excuse for blind copy-pasting :-) I've just changed that. Could you take a look?
By the way, I seem to have lost track of all the labels we have :-) What is "good-to-merge/with-minor-suggestions"? Does it mean that, generally, suggestions can be ignored? Or is it just a little bit softer way to say that the code isn't exactly ideal? :-)
There was a problem hiding this comment.
Heh, it's the first time I see this one too.
There was a problem hiding this comment.
Heh, it's the first time I see this one too.
I saw that once in my PR, but I forgot which one.
Does it mean that, generally, suggestions can be ignored?
Yeah, I used the tag for that meaning :-) Sorry for the confusion.
There was a problem hiding this comment.
The fuzzer has started to crash with
==220==ERROR: AddressSanitizer: ABRT on unknown address 0x0000000000dc (pc 0x7ff4953c8428 bp 0x7ffcf66ec290 sp 0x7ffcf66ec128 T0)
SCARINESS: 10 (signal)
#0 0x7ff4953c8427 in gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x35427)
#1 0x7ff4953ca029 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x37029)
#2 0x7ff49666503a in log_assert_failed_realm /work/build/../../src/systemd/src/basic/log.c:805:9
#3 0x7ff496614ecf in safe_close /work/build/../../src/systemd/src/basic/fd-util.c:66:17
#4 0x548806 in server_done /work/build/../../src/systemd/src/journal/journald-server.c:2064:9
#5 0x5349fa in LLVMFuzzerTestOneInput /work/build/../../src/systemd/src/fuzz/fuzz-journald-kmsg.c:26:9
#6 0x592755 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
#7 0x590627 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) /src/libfuzzer/FuzzerLoop.cpp:480:3
#8 0x594432 in fuzzer::Fuzzer::MutateAndTestOne() /src/libfuzzer/FuzzerLoop.cpp:708:19
#9 0x5973c6 in fuzzer::Fuzzer::Loop(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, fuzzer::fuzzer_allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&) /src/libfuzzer/FuzzerLoop.cpp:839:5
#10 0x574541 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:764:6
#11 0x5675fc in main /src/libfuzzer/FuzzerMain.cpp:20:10
#12 0x7ff4953b382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#13 0x420f58 in _start (/out/fuzz-journald-kmsg+0x420f58)Apparently, I forgot to initialize syslog_fd. I'll fix it shortly.
Yeah, I used the tag for that meaning :-) Sorry for the confusion.
No problem. I wasn't confused at all.
There was a problem hiding this comment.
The fuzzer has started to crash
I've just opened #10794 so that TravisCI and semaphoreci will be able to catch slip-ups like that in the future.
The function takes a pointer to a random block of memory and the length of that block. It shouldn't crash every time it sees a zero byte at the beginning there. This should help the dev-kmsg fuzzer to keep going.
| }; | ||
| assert_se(sd_event_default(&s.event) >= 0); | ||
| buffer = memdup(data, size); | ||
| assert_se(buffer); |
There was a problem hiding this comment.
As far as I know, Coverity doesn't like assignments mixed with assertions. d9fb7af was supposed to fix this but apparently cases like that haven't been covered yet.
| @@ -106,7 +106,6 @@ int cunescape_one(const char *p, size_t length, char32_t *ret, bool *eight_bit) | |||
| int r = 1; | |||
|
|
|||
| assert(p); | |||
| assert(*p); | |||
There was a problem hiding this comment.
I love the understatedness in the last sentence in the patch description.
| #include "journald-kmsg.h" | ||
|
|
||
| int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { | ||
| Server s = {}; |
There was a problem hiding this comment.
no need to initialize this here if you initialize it further down anyway
There was a problem hiding this comment.
@poettering I addressed that in #10817.
evverx
added
the
fuzzing
No description provided.