thodg/libgit2/fuzzers/standalone_driver.c

• Show log

  Commit

• Hash : 6956a954
  Author :
  Date : 2018-10-11T12:26:44
  

  fuzzers: initialize libgit2 in standalone driver The standalone driver for libgit2's fuzzing targets makes use of functions from libgit2 itself. While this is totally fine to do, we need to make sure to always have libgit2 initialized via `git_libgit2_init` before we call out to any of these. While this happens in most cases as we call `LLVMFuzzerInitialize`, which is provided by our fuzzers and which right now always calls `git_libgit2_init`, one exception to this rule is our error path when not enough arguments have been given. In this case, we will call `git_vector_free_deep` without libgit2 having been initialized. As we did not set up our allocation functions in that case, this will lead to a segmentation fault. Fix the issue by always initializing and shutting down libgit2 in the standalone driver. Note that we cannot let this replace the initialization in `LLVMFuzzerInitialize`, as it is required when using the "real" fuzzers by LLVM without our standalone driver. It's no problem to call the initialization and deinitialization functions multiple times, though.

Download

• fuzzers/standalone_driver.c

• /*
   * Copyright (C) the libgit2 contributors. All rights reserved.
   *
   * This file is part of libgit2, distributed under the GNU GPL v2 with
   * a Linking Exception. For full terms see the included COPYING file.
   */
  
  #include <assert.h>
  #include <dirent.h>
  #include <stdio.h>
  #include <stdlib.h>
  #include <sys/types.h>
  
  #include "git2.h"
  #include "fileops.h"
  #include "path.h"
  
  extern int LLVMFuzzerTestOneInput(const unsigned char *data, size_t size);
  extern int LLVMFuzzerInitialize(int *argc, char ***argv);
  
  static int run_one_file(const char *filename)
  {
  	git_buf buf = GIT_BUF_INIT;
  	int error = 0;
  
  	if (git_futils_readbuffer(&buf, filename) < 0) {
  		fprintf(stderr, "Failed to read %s: %m\n", filename);
  		error = -1;
  		goto exit;
  	}
  
  	LLVMFuzzerTestOneInput((const unsigned char *)buf.ptr, buf.size);
  exit:
  	git_buf_dispose(&buf);
  	return error;
  }
  
  int main(int argc, char **argv)
  {
  	git_vector corpus_files = GIT_VECTOR_INIT;
  	char *filename = NULL;
  	unsigned i = 0;
  	int error = 0;
  
  	if (git_libgit2_init() < 0) {
  		fprintf(stderr, "Failed to initialize libgit2\n");
  		abort();
  	}
  
  	if (argc != 2) {
  		fprintf(stderr, "Usage: %s <corpus directory>\n", argv[0]);
  		error = -1;
  		goto exit;
  	}
  
  	fprintf(stderr, "Running %s against %s\n", argv[0], argv[1]);
  	LLVMFuzzerInitialize(&argc, &argv);
  
  	if (git_path_dirload(&corpus_files, argv[1], 0, 0x0) < 0) {
  		fprintf(stderr, "Failed to scan corpus directory: %m\n");
  		error = -1;
  		goto exit;
  	}
  	git_vector_foreach(&corpus_files, i, filename) {
  		fprintf(stderr, "\tRunning %s...\n", filename);
  		if (run_one_file(filename) < 0) {
  			error = -1;
  			goto exit;
  		}
  	}
  	fprintf(stderr, "Done %d runs\n", i);
  
  exit:
  	git_vector_free_deep(&corpus_files);
  	git_libgit2_shutdown();
  	return error;
  }
  

Download