summaryrefslogtreecommitdiffstats
path: root/test/fuzz (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Merge pull request #10736 from yuwata/coredump-commentLennart Poettering2018-11-121-0/+0
|\ | | | | fuzz: fix oss-fuzz#8658
| * fuzz: add testcase of oss-fuzz#8658Yu Watanabe2018-11-121-0/+0
| |
* | Merge pull request #10731 from yuwata/fix-oss-fuzz-11344Lennart Poettering2018-11-121-0/+6
|\ \ | |/ |/| Fixes oss-fuzz#11344
| * fuzz: add testcase of oss-fuzz#11344Yu Watanabe2018-11-111-0/+6
| |
* | Merge pull request #10669 from danderson/networkd-6rdYu Watanabe2018-11-122-0/+9
|\ \ | | | | | | networkd: add 6rd support for sit netdevs
| * | Add 6rd directive to the netdev fuzzing corpus.David Anderson2018-11-102-0/+9
| | |
* | | fuzz: add testcase of oss-fuzz#10734Yu Watanabe2018-11-111-0/+0
| | |
* | | fuzz: add testcase of already fixed issue 10908Yu Watanabe2018-11-111-0/+9
| |/ |/|
* | fuzz: add testcase of oss-fuzz#11345Yu Watanabe2018-11-111-0/+2
| |
* | fuzz: add testcase for oss-fuzz#11324Yu Watanabe2018-11-101-0/+0
|/
* fuzz: add testcases of recent issuesYu Watanabe2018-11-092-0/+7
|
* fuzz: add a testcase for oss-fuzz#11285Yu Watanabe2018-11-081-0/+2
|
* fuzz: add more testcases of already fixed issue about multiple netdev kindYu Watanabe2018-11-085-0/+0
| | | | | | | This adds testcases of oss-fuzz#11286, oss-fuzz#11287, oss-fuzz#11296, oss-fuzz#11297, and oss-fuzz#11299. The issue was fixed by 62facba19ad645df7fb425ce170bdbda208b303c.
* fuzz: add testcases for oss-fuzz#11279 and #11280Yu Watanabe2018-11-072-0/+0
|
* tests: add a couple of files containing all the sections and directivesEvgeny Vereshchagin2018-11-062-0/+340
| | | | | | | | | | | | | | | This should help the fuzzers to discover code paths faster. In case anyone is interested, they were generated with the following script ``` perl -aF'/[\s,]+/' -ne ' if (my ($s, $d) = ($F[0] =~ /^([^\s\.]+)\.([^\s\.]+)$/)) { $d{$s}{$d} = 1; } END { while (my ($key, $value) = each %d) { printf "[%s]\n%s\n", $key, join("\n", keys(%$value)) }}' ``` by passing src/network/networkd-network-gperf.gperf and src/network/netdev/netdev-gperf.gperf to it.
* tests: replace AdActorSysPrio with AdActorSystemPriorityEvgeny Vereshchagin2018-11-061-1/+1
| | | | This is a follow-up to https://github.com/systemd/systemd/pull/10653.
* tests: add a reporoducer for https://github.com/systemd/systemd/issues/10639Evgeny Vereshchagin2018-11-061-0/+8
|
* tests: add some data that can be fed to fuzz-network-parserEvgeny Vereshchagin2018-11-0653-0/+384
|
* tests: add a reproducer for https://github.com/systemd/systemd/issues/10629Evgeny Vereshchagin2018-11-061-0/+10
|
* networkd: make netdev_load_one "public" and add a fuzzer for itEvgeny Vereshchagin2018-11-0628-0/+211
|
* tests: add an lldp fuzzerEvgeny Vereshchagin2018-10-293-0/+0
| | | | | | | | | I went through my antique collection of fuzzers the other day to see which ones I hadn't sent upstream yet. This one seems to be nice to have and ready to be merged. As far as I can tell, it hasn't managed to find anything useful yet, but it's better to be safe than sorry especially when it comes to networking code :-)
* Merge pull request #10378 from poettering/json-fuzz-fixZbigniew Jędrzejewski-Szmek2018-10-251-0/+9
|\ | | | | json: a comprehensive fix for oss-fuzz#10908
| * fuzz: add test from oss-fuzz#10908Lennart Poettering2018-10-181-0/+9
| | | | | | | | https://oss-fuzz.com/download?testcase_id=5639441482252288
* | fuzz: add testcase of oss-fuzz#11019Yu Watanabe2018-10-181-0/+0
|/
* core: implement per unit journal rate limitingAnita Zhang2018-10-181-0/+2
| | | | | | | | | Add LogRateLimitIntervalSec= and LogRateLimitBurst= options for services. If provided, these values get passed to the journald client context, and those values are used in the rate limiting function in the journal over the the journald.conf values. Part of #10230
* meson: rename cpp_cmd to cxx_cmdZbigniew Jędrzejewski-Szmek2018-10-101-1/+1
| | | | | cpp is a really bad alias for c++ because it's also the name of the preprocessor. Let's rename the variable.
* meson: we cannot call get_compiler('cpp') if we didn't "add" itZbigniew Jędrzejewski-Szmek2018-10-091-1/+1
| | | | Follow-up for f6d783ac3d145f3f3ffc2023d4ad90f76cf7fe34.
* meson: use same compilers to build fuzzersYu Watanabe2018-10-091-1/+3
|
* test: add a testcase for oss-fuzz#10746Yu Watanabe2018-10-031-0/+0
|
* bus-message: avoid wrap-around when using length read from messageZbigniew Jędrzejewski-Szmek2018-10-021-0/+0
| | | | | | | | | We would read (-1), and then add 1 to it, call message_peek_body(..., 0, ...), and when trying to make use of the data. The fuzzer test case is just for one site, but they all look similar. v2: fix two UINT8_MAX/UINT32_MAX mismatches founds by LGTM
* bus-message: return -EBADMSG not -EINVAL on invalid !gvariant messagesZbigniew Jędrzejewski-Szmek2018-10-021-0/+0
|
* fuzz-bus-message: add two test cases that pass nowZbigniew Jędrzejewski-Szmek2018-10-022-0/+0
| | | | | It seems that they got fixed by one of the patches. Let's add them just in case.
* bus-message: fix skipping of array fields in !gvariant messagesZbigniew Jędrzejewski-Szmek2018-10-021-0/+0
| | | | | | | We copied part of the string into a buffer that was off by two. If the element signature had length one, we'd copy 0 bytes and crash when looking at the "first" byte. Otherwise, we would crash because strncpy would not terminate the string.
* bus-message: fix calculation of offsets table for arraysZbigniew Jędrzejewski-Szmek2018-10-021-0/+0
| | | | | | | | This is similar to the grandparent commit 'fix calculation of offsets table', except that now the change is for array elements. Same story as before: we need to make sure that the offsets increase enough taking alignment into account. While at it, rename 'p' to 'previous' to match similar code in other places.
* bus-message: fix calculation of offsets tableZbigniew Jędrzejewski-Szmek2018-10-021-0/+0
| | | | | | | | | | | | | | | The offsets specify the ends of variable length data. We would trust the incoming data, putting the offsets specified in our message into the offsets tables after doing some superficial verification. But when actually reading the data we apply alignment, so we would take the previous offset, align it, making it bigger then current offset, and then we'd try to read data of negative length. In the attached example, the message specifies the following offsets: [1, 4] but the alignment of those items is [1, 8] so we'd calculate the second item as starting at 8 and ending at 4.
* bus-message: do not crash on message with a string of zero lengthZbigniew Jędrzejewski-Szmek2018-10-021-0/+0
| | | | | We'd calculate the "real" length of the string as 'item_size - 1', which does not work out well when item_size == 0.
* bus-message: let's always use -EBADMSG when the message is badZbigniew Jędrzejewski-Szmek2018-10-021-0/+0
| | | | | -EINVAL means the arguments were somehow wrong, so translate the code we get internally into -EBADMSG when returning.
* bus-message: avoid an infinite loop on empty structuresZbigniew Jędrzejewski-Szmek2018-10-022-0/+0
| | | | | | | | The alternative would be to treat gvariant and !gvariant messages differently. But this is a problem because we check signatures is variuos places before we have an actual message, for example in sd_bus_add_object_vtable(). It seems better to treat things consistent (i.e. follow the lowest common denominator) and disallow empty structures everywhere.
* sd-bus: unify three code-paths which free struct bus_containerZbigniew Jędrzejewski-Szmek2018-10-021-0/+0
| | | | | | | | | | | | | | | | | | | | | | | | We didn't free one of the fields in two of the places. $ valgrind --show-leak-kinds=all --leak-check=full \ build/fuzz-bus-message \ test/fuzz/fuzz-bus-message/leak-c09c0e2256d43bc5e2d02748c8d8760e7bc25d20 ... ==14457== HEAP SUMMARY: ==14457== in use at exit: 3 bytes in 1 blocks ==14457== total heap usage: 509 allocs, 508 frees, 51,016 bytes allocated ==14457== ==14457== 3 bytes in 1 blocks are definitely lost in loss record 1 of 1 ==14457== at 0x4C2EBAB: malloc (vg_replace_malloc.c:299) ==14457== by 0x53AFE79: strndup (in /usr/lib64/libc-2.27.so) ==14457== by 0x4F52EB8: free_and_strndup (string-util.c:1039) ==14457== by 0x4F8E1AB: sd_bus_message_peek_type (bus-message.c:4193) ==14457== by 0x4F76CB5: bus_message_dump (bus-dump.c:144) ==14457== by 0x108F12: LLVMFuzzerTestOneInput (fuzz-bus-message.c:24) ==14457== by 0x1090F7: main (fuzz-main.c:34) ==14457== ==14457== LEAK SUMMARY: ==14457== definitely lost: 3 bytes in 1 blocks
* Introduce free_and_strndup and use it in bus-message.cZbigniew Jędrzejewski-Szmek2018-10-021-0/+0
| | | | | | | | | | | | | | v2: fix error in free_and_strndup() When the orignal and copied message were the same, but shorter than specified length l, memory read past the end of the buffer would be performed. A test case is included: a string that had an embedded NUL ("q\0") is used to replace "q". v3: Fix one more bug in free_and_strndup and add tests. v4: Some style fixed based on review, one more use of free_and_replace, and make the tests more comprehensive.
* fuzz-bus-message: add fuzzer for message parsingZbigniew Jędrzejewski-Szmek2018-10-021-0/+0
| | | | | As with other fuzzers, SYSTEMD_FUZZ_OUTPUT=1 and SYSTEMD_LOG_LEVEL=debug can be used for debugging.
* meson: treat all fuzz cases as unit testsZbigniew Jędrzejewski-Szmek2018-10-021-30/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 318/365 fuzz-bus-message:crash-26bba7182dedc8848939931d9fcefcb7922f2e56:address OK 0.03 s 319/365 fuzz-bus-message:crash-29ed3c202e0ffade3cad42c8bbeb6cc68a21eb8e:address OK 0.03 s 320/365 fuzz-bus-message:crash-b88ad9ecf4aacf4a0caca5b5543953265367f084:address OK 0.03 s 321/365 fuzz-bus-message:crash-c1b37b4729b42c0c05b23cba4eed5d8102498a1e:address OK 0.03 s 322/365 fuzz-bus-message:crash-d8f3941c74219b4c03532c9b244d5ea539c61af5:address OK 0.03 s 323/365 fuzz-bus-message:crash-e1b811da5ca494e494b77c6bd8e1c2f2989425c5:address OK 0.03 s 324/365 fuzz-bus-message:leak-c09c0e2256d43bc5e2d02748c8d8760e7bc25d20:address OK 0.04 s 325/365 fuzz-bus-message:message1:address OK 0.03 s 326/365 fuzz-bus-message:timeout-08ee8f6446a4064db064e8e0b3d220147f7d0b5b:address OK 0.03 s 327/365 fuzz-dhcp-server:discover-existing:address OK 0.04 s 328/365 fuzz-dhcp-server:discover-new:address OK 0.03 s 329/365 fuzz-dhcp-server:release:address OK 0.04 s 330/365 fuzz-dhcp-server:request-existing:address OK 0.03 s 331/365 fuzz-dhcp-server:request-new:address OK 0.03 s 332/365 fuzz-dhcp-server:request-reboot:address OK 0.03 s 333/365 fuzz-dhcp-server:request-renew:address OK 0.03 s 334/365 fuzz-dns-packet:issue-7888:address OK 0.03 s 335/365 fuzz-dns-packet:oss-fuzz-5465:address OK 0.03 s 336/365 fuzz-journal-remote:crash-5a8f03d4c3a46fcded39527084f437e8e4b54b76:address OK 0.06 s 337/365 fuzz-journal-remote:crash-96dee870ea66d03e89ac321eee28ea63a9b9aa45:address OK 0.04 s 338/365 fuzz-journal-remote:invalid-ts.txt:address OK 0.04 s 339/365 fuzz-journal-remote:oss-fuzz-8659:address OK 0.06 s 340/365 fuzz-journal-remote:oss-fuzz-8686:address OK 0.04 s 341/365 fuzz-journal-remote:sample.txt:address OK 0.07 s 342/365 fuzz-unit-file:directives.service:address OK 0.03 s 343/365 fuzz-unit-file:empty.scope:address OK 0.04 s 344/365 fuzz-unit-file:machine.slice:address OK 0.03 s 345/365 fuzz-unit-file:oss-fuzz-6884:address OK 0.05 s 346/365 fuzz-unit-file:oss-fuzz-6885:address OK 0.03 s 347/365 fuzz-unit-file:oss-fuzz-6886:address OK 0.04 s 348/365 fuzz-unit-file:oss-fuzz-6892:address OK 0.03 s 349/365 fuzz-unit-file:oss-fuzz-6897:address OK 0.05 s 350/365 fuzz-unit-file:oss-fuzz-6897-evverx:address OK 0.04 s 351/365 fuzz-unit-file:oss-fuzz-6908:address OK 0.05 s 352/365 fuzz-unit-file:oss-fuzz-6917:address OK 0.06 s 353/365 fuzz-unit-file:oss-fuzz-6977:address OK 0.08 s 354/365 fuzz-unit-file:oss-fuzz-6977-unminimized:address OK 0.10 s 355/365 fuzz-unit-file:oss-fuzz-7004:address OK 0.03 s 356/365 fuzz-unit-file:oss-fuzz-8064:address OK 0.03 s 357/365 fuzz-unit-file:oss-fuzz-8827:address OK 0.50 s 358/365 fuzz-unit-file:proc-sys-fs-binfmt_misc.automount:address OK 0.03 s 359/365 fuzz-unit-file:syslog.socket:address OK 0.03 s 360/365 fuzz-unit-file:systemd-ask-password-console.path:address OK 0.03 s 361/365 fuzz-unit-file:systemd-machined.service:address OK 0.03 s 362/365 fuzz-unit-file:systemd-resolved.service:address OK 0.03 s 363/365 fuzz-unit-file:systemd-tmpfiles-clean.timer:address OK 0.03 s 364/365 fuzz-unit-file:timers.target:address OK 0.03 s 365/365 fuzz-unit-file:var-lib-machines.mount:address OK 0.04 s This gives us slightly nicer coverage in the normal test run. When in a git repo, git ls-files is used to get a list of files known to git. This mirrors what update-man-rules does for man files. Only looking at files known to git makes it easier to not forget to commit the test file to git, and also makes bisecting easier if some files are left in repo. When outside of a git repo, we expect to be unpacked from a tarball, so just using all files reported by ls is OK.
* fuzz: unify the "fuzz-regressions" directory with the main corpusZbigniew Jędrzejewski-Szmek2018-10-0229-0/+111
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There isn't really much need to keep them separate. Anything which is a good corpus entry can be used as a smoke test, and anything which which is a regression test can just as well be inserted into the corpus. The only functional difference from this patch (apart from different paths in output) is that the regression tests are now zipped together with the rest of the corpus. $ meson configure build -Dslow-tests=true && ninja -C build test ... 307/325 fuzz-dns-packet:issue-7888:address OK 0.06 s 308/325 fuzz-dns-packet:oss-fuzz-5465:address OK 0.04 s 309/325 fuzz-journal-remote:crash-5a8f03d4c3a46fcded39527084f437e8e4b54b76:address OK 0.07 s 310/325 fuzz-journal-remote:crash-96dee870ea66d03e89ac321eee28ea63a9b9aa45:address OK 0.05 s 311/325 fuzz-journal-remote:oss-fuzz-8659:address OK 0.05 s 312/325 fuzz-journal-remote:oss-fuzz-8686:address OK 0.07 s 313/325 fuzz-unit-file:oss-fuzz-6884:address OK 0.06 s 314/325 fuzz-unit-file:oss-fuzz-6885:address OK 0.05 s 315/325 fuzz-unit-file:oss-fuzz-6886:address OK 0.05 s 316/325 fuzz-unit-file:oss-fuzz-6892:address OK 0.05 s 317/325 fuzz-unit-file:oss-fuzz-6897:address OK 0.05 s 318/325 fuzz-unit-file:oss-fuzz-6897-evverx:address OK 0.06 s 319/325 fuzz-unit-file:oss-fuzz-6908:address OK 0.07 s 320/325 fuzz-unit-file:oss-fuzz-6917:address OK 0.07 s 321/325 fuzz-unit-file:oss-fuzz-6977:address OK 0.13 s 322/325 fuzz-unit-file:oss-fuzz-6977-unminimized:address OK 0.12 s 323/325 fuzz-unit-file:oss-fuzz-7004:address OK 0.05 s 324/325 fuzz-unit-file:oss-fuzz-8064:address OK 0.05 s 325/325 fuzz-unit-file:oss-fuzz-8827:address OK 0.52 s
* fuzz: rename "fuzz-corpus" directory to just "fuzz"Zbigniew Jędrzejewski-Szmek2018-10-0222-0/+1437
Also, all corpus subdirectories are named exactly the same as the fuzzer they are for. This makes the paths a bit longer, but easier.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-02 02:07:24 +0100