Commit 0036993b99967f9d159d42966dd4260909fad779
2018-08-24T09:29:32
Merge pull request #4752 from nelhage/fuzz-config Add a fuzzer for config files
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98
diff --git a/fuzzers/config_file_fuzzer.c b/fuzzers/config_file_fuzzer.c
new file mode 100644
index 0000000..30a47bf
--- /dev/null
+++ b/fuzzers/config_file_fuzzer.c
@@ -0,0 +1,75 @@
+/*
+ * libgit2 config file parser fuzz target.
+ *
+ * Copyright (C) the libgit2 contributors. All rights reserved.
+ *
+ * This file is part of libgit2, distributed under the GNU GPL v2 with
+ * a Linking Exception. For full terms see the included COPYING file.
+ */
+
+#include <git2.h>
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <limits.h>
+#include <errno.h>
+
+#define UNUSED(x) (void)(x)
+
+int foreach_cb(const git_config_entry *entry, void *payload)
+{
+ UNUSED(entry);
+ UNUSED(payload);
+
+ return 0;
+}
+
+static char path[] = "/tmp/git.XXXXXX";
+static int fd = -1;
+
+int LLVMFuzzerInitialize(int *argc, char ***argv)
+{
+ UNUSED(argc);
+ UNUSED(argv);
+
+ if (git_libgit2_init() < 0)
+ abort();
+ fd = mkstemp(path);
+ if (fd < 0) {
+ abort();
+ }
+
+ return 0;
+}
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+ git_config *cfg = NULL;
+ int err = 0;
+ size_t total = 0;
+
+ if (ftruncate(fd, 0) !=0 ) {
+ abort();
+ }
+ if (lseek(fd, 0, SEEK_SET) != 0) {
+ abort();
+ }
+
+ while (total < size) {
+ ssize_t written = write(fd, data, size);
+ if (written < 0 && errno != EINTR)
+ abort();
+ if (written < 0)
+ continue;
+ total += written;
+ }
+
+ err = git_config_open_ondisk(&cfg, path);
+ if (err == 0) {
+ git_config_foreach(cfg, foreach_cb, NULL);
+ git_config_free(cfg);
+ }
+
+ return 0;
+}
diff --git a/fuzzers/corpora/config_file/git2.dat b/fuzzers/corpora/config_file/git2.dat
new file mode 100644
index 0000000..e556154
--- /dev/null
+++ b/fuzzers/corpora/config_file/git2.dat
@@ -0,0 +1,11 @@
+[core]
+ repositoryformatversion = 0
+ filemode = true
+ bare = false
+ logallrefupdates = true
+[remote "origin"]
+ url = git@github.com:libgit2/libgit2
+ fetch = +refs/heads/*:refs/remotes/origin/*
+[branch "master"]
+ remote = origin
+ merge = refs/heads/master