summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRobert Swiecki <robert@swiecki.net>2019-05-09 16:30:42 +0200
committerRobert Swiecki <robert@swiecki.net>2019-05-09 16:30:42 +0200
commit4c29368414a3a2b9dd4897f558f4f8b700dd2b53 (patch)
tree90d49b4fc6bbf6a104993f3773224d4093401bca
parent0731ac44ff79b6022e055fad1c395797c36aecc6 (diff)
downloadhonggfuzz-4c29368414a3a2b9dd4897f558f4f8b700dd2b53.tar.gz
examples/bind: patch for 9.14.1 #2
-rw-r--r--examples/bind/bind-9.14.1.patch238
1 files changed, 83 insertions, 155 deletions
diff --git a/examples/bind/bind-9.14.1.patch b/examples/bind/bind-9.14.1.patch
index 3ab7b218..ba09db56 100644
--- a/examples/bind/bind-9.14.1.patch
+++ b/examples/bind/bind-9.14.1.patch
@@ -1,28 +1,7 @@
-diff -Nur ORIG.bind-9.14.1/bin/named/fuzz.c bind-9.14.1/bin/named/fuzz.c
---- ORIG.bind-9.14.1/bin/named/fuzz.c 2019-04-06 22:09:59.000000000 +0200
-+++ bind-9.14.1/bin/named/fuzz.c 2019-05-09 16:09:56.131889311 +0200
-@@ -738,7 +738,7 @@
- */
- void
- named_fuzz_notify(void) {
--#ifdef ENABLE_AFL
-+#if 0
- if (getenv("AFL_CMIN")) {
- named_server_flushonshutdown(named_g_server, false);
- isc_app_shutdown();
-@@ -758,7 +758,7 @@
-
- void
- named_fuzz_setup(void) {
--#ifdef ENABLE_AFL
-+#if 0
- if (getenv("__AFL_PERSISTENT") || getenv("AFL_CMIN")) {
- pthread_t thread;
- void *(fn) = NULL;
diff -Nur ORIG.bind-9.14.1/bin/named/main.c bind-9.14.1/bin/named/main.c
--- ORIG.bind-9.14.1/bin/named/main.c 2019-04-06 22:09:59.000000000 +0200
-+++ bind-9.14.1/bin/named/main.c 2019-05-09 16:09:56.131889311 +0200
-@@ -1347,13 +1347,262 @@
++++ bind-9.14.1/bin/named/main.c 2019-05-09 16:26:27.615239219 +0200
+@@ -1347,11 +1347,285 @@
}
#endif /* HAVE_LIBSCF */
@@ -50,7 +29,8 @@ diff -Nur ORIG.bind-9.14.1/bin/named/main.c bind-9.14.1/bin/named/main.c
+#include <libhfcommon/util.h>
+#include <libhfuzz/libhfuzz.h>
+
-+static void enter_namespaces(void) {
++static void enter_namespaces(void)
++{
+ if (linuxEnterNs(CLONE_NEWUSER | CLONE_NEWNET | CLONE_NEWNS | CLONE_NEWIPC) == false) {
+ exit(1);
+ }
@@ -63,12 +43,14 @@ diff -Nur ORIG.bind-9.14.1/bin/named/main.c bind-9.14.1/bin/named/main.c
+}
+
+static size_t rlen = 0;
-+static const uint8_t *rbuf = NULL;
++static const uint8_t* rbuf = NULL;
+
-+__attribute__((no_sanitize("memory"))) __attribute__((no_sanitize("address"))) static void *
-+bind_thr(void *unused __attribute__((unused))) {
++__attribute__((no_sanitize("memory")))
++__attribute__((no_sanitize("address"))) static void*
++bind_thr(void* unused __attribute__((unused)))
++{
+ while (!named_g_run_done) {
-+ usleep(10000);
++ usleep(300000);
+ }
+
+ int myfd = socket(AF_INET, SOCK_STREAM, IPPROTO_IP);
@@ -116,9 +98,13 @@ diff -Nur ORIG.bind-9.14.1/bin/named/main.c bind-9.14.1/bin/named/main.c
+ close(nfd);
+ continue;
+ }
++ if (rlen < 1) {
++ close(nfd);
++ continue;
++ }
+
-+ /* It's a response, so set QR bit to 1 */
-+ uint8_t qr = rbuf[0] | 0x80;
++ /* It's a response, so set QR bit to 1 */
++ uint8_t qr = rbuf[0] | 0x80;
+
+ uint16_t t_l = htons(rlen + 2);
+ const struct iovec iov[] = {
@@ -135,7 +121,7 @@ diff -Nur ORIG.bind-9.14.1/bin/named/main.c bind-9.14.1/bin/named/main.c
+ .iov_len = 1,
+ },
+ {
-+ .iov_base = (void *)&rbuf[1],
++ .iov_base = (void*)&rbuf[1],
+ .iov_len = rlen - 1,
+ },
+ };
@@ -150,23 +136,25 @@ diff -Nur ORIG.bind-9.14.1/bin/named/main.c bind-9.14.1/bin/named/main.c
+ return NULL;
+}
+
-+static void rndloop(int sock) {
++static void rndloop(int sock)
++{
+ const struct sockaddr_in bsaddr = {
+ .sin_family = AF_INET,
+ .sin_port = htons(0),
+ .sin_addr.s_addr = htonl((((uint32_t)util_rnd64()) & 0x00FFFFFF) | 0x7F000000),
+ };
-+ if (bind(sock, (const struct sockaddr *)&bsaddr, sizeof(bsaddr)) == -1) {
++ if (bind(sock, (const struct sockaddr*)&bsaddr, sizeof(bsaddr)) == -1) {
+ perror("bind");
+ }
+}
+
-+__attribute__((no_sanitize("memory"))) __attribute__((no_sanitize("address"))) static void *
-+connect_thr(void *unused __attribute__((unused))) {
++__attribute__((no_sanitize("memory")))
++__attribute__((no_sanitize("address"))) static void*
++connect_thr(void* unused __attribute__((unused)))
++{
+ while (!named_g_run_done) {
-+ usleep(10000);
++ usleep(300000);
+ }
-+ usleep(100000);
+
+ for (;;) {
+ int myfd = socket(AF_INET, SOCK_STREAM, IPPROTO_IP);
@@ -191,28 +179,42 @@ diff -Nur ORIG.bind-9.14.1/bin/named/main.c bind-9.14.1/bin/named/main.c
+ continue;
+ }
+
-+ const uint8_t *buf;
++ const uint8_t* buf;
+ size_t len;
-+ HF_ITER(&buf, &len);
-+
-+ rlen = 0;
-+ rbuf = NULL;
-+
-+ if (len < 32) {
-+ close(myfd);
-+ continue;
-+ }
+
-+ uint32_t tmplen = *((const uint32_t *)buf);
++ if (named_g_fuzz_type == isc_fuzz_client) {
++ HF_ITER(&buf, &len);
+
-+ buf = &buf[sizeof(uint32_t)];
-+ len -= sizeof(uint32_t);
++ rlen = 0;
++ rbuf = NULL;
+
-+ tmplen %= len;
++ if (len < 32) {
++ close(myfd);
++ continue;
++ }
+
-+ rbuf = &buf[tmplen];
-+ rlen = len - tmplen;
-+ len = tmplen;
++ uint32_t tmplen = *((const uint32_t*)buf);
++
++ buf = &buf[sizeof(uint32_t)];
++ len -= sizeof(uint32_t);
++
++ tmplen %= len;
++
++ rbuf = &buf[tmplen];
++ rlen = len - tmplen;
++ len = tmplen;
++ } else {
++ static const uint8_t qbuf[] = {
++ 0x88, 0x0c, 0x01, 0x20, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00,
++ 0x00, 0x01, 0x0a, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61, 0x61,
++ 0x61, 0x61, 0x61, 0x07, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c,
++ 0x65, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x29, 0x10,
++ 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00
++ };
++ buf = qbuf;
++ len = sizeof(qbuf);
++ HF_ITER(&rbuf, &rlen);
++ }
+
+ uint16_t t_l = htons(len);
+ const struct iovec iov[] = {
@@ -221,7 +223,7 @@ diff -Nur ORIG.bind-9.14.1/bin/named/main.c bind-9.14.1/bin/named/main.c
+ .iov_len = sizeof(t_l),
+ },
+ {
-+ .iov_base = (void *)buf,
++ .iov_base = (void*)buf,
+ .iov_len = len,
+ },
+ };
@@ -248,7 +250,8 @@ diff -Nur ORIG.bind-9.14.1/bin/named/main.c bind-9.14.1/bin/named/main.c
+ }
+}
+
-+static void launch_thr(void) {
++static void launch_thr(void)
++{
+ pthread_attr_t attr;
+ pthread_attr_init(&attr);
+ pthread_attr_setstacksize(&attr, 1024 * 1024 * 4);
@@ -274,7 +277,8 @@ diff -Nur ORIG.bind-9.14.1/bin/named/main.c bind-9.14.1/bin/named/main.c
-int
-main(int argc, char *argv[]) {
- isc_result_t result;
-+int main(int argc, char *argv[]) {
++int main(int argc, char* argv[])
++{
+ if (!getenv("NO_FUZZ")) {
+ named_g_fuzz_addr = "127.0.0.1:53";
+ named_g_fuzz_type = isc_fuzz_client;
@@ -284,34 +288,11 @@ diff -Nur ORIG.bind-9.14.1/bin/named/main.c bind-9.14.1/bin/named/main.c
+
+ isc_result_t result;
#ifdef HAVE_LIBSCF
-- char *instance = NULL;
-+ char *instance = NULL;
+ char *instance = NULL;
#endif
-
- #ifdef HAVE_GPERFTOOLS_PROFILER
-@@ -1399,17 +1648,17 @@
-
- parse_command_line(argc, argv);
-
--#ifdef ENABLE_AFL
-+#if 0
- if (named_g_fuzz_type != isc_fuzz_none) {
- named_fuzz_setup();
- }
-+#endif
-
- if (named_g_fuzz_type == isc_fuzz_resolver) {
- dns_resolver_setfuzzing();
- } else if (named_g_fuzz_type == isc_fuzz_http) {
- isc_httpd_setfinishhook(named_fuzz_notify);
- }
--#endif
- /*
- * Warn about common configuration error.
- */
diff -Nur ORIG.bind-9.14.1/compile.sh bind-9.14.1/compile.sh
--- ORIG.bind-9.14.1/compile.sh 1970-01-01 01:00:00.000000000 +0100
-+++ bind-9.14.1/compile.sh 2019-05-09 16:10:05.455881725 +0200
++++ bind-9.14.1/compile.sh 2019-05-09 16:27:15.139211816 +0200
@@ -0,0 +1,20 @@
+#!/bin/sh
+
@@ -333,46 +314,9 @@ diff -Nur ORIG.bind-9.14.1/compile.sh bind-9.14.1/compile.sh
+
+make clean
+make -j$(nproc)
-diff -Nur ORIG.bind-9.14.1/configure bind-9.14.1/configure
---- ORIG.bind-9.14.1/configure 2019-04-06 22:09:59.000000000 +0200
-+++ bind-9.14.1/configure 2019-05-09 16:09:56.135889307 +0200
-@@ -11948,33 +11948,6 @@
- ;;
- esac
-
--if test "$enable_fuzzing" = "afl"; then :
-- { $as_echo "$as_me:${as_lineno-$LINENO}: checking \"for AFL enabled compiler\"" >&5
--$as_echo_n "checking \"for AFL enabled compiler\"... " >&6; }
-- cat confdefs.h - <<_ACEOF >conftest.$ac_ext
--/* end confdefs.h. */
--
--int
--main ()
--{
--#ifndef __AFL_COMPILER
-- #error AFL compiler required
-- #endif
--
-- ;
-- return 0;
--}
--_ACEOF
--if ac_fn_c_try_compile "$LINENO"; then :
-- { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
--$as_echo "yes" >&6; }
--else
-- as_fn_error $? "set CC=afl-<gcc|clang> when --enable-fuzzing=afl is used" "$LINENO" 5
--fi
--rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
--
--fi
--
- #
- # Make very sure that these are the first files processed by
- # config.status, since we use the processed output as the input for
diff -Nur ORIG.bind-9.14.1/lib/dns/request.c bind-9.14.1/lib/dns/request.c
--- ORIG.bind-9.14.1/lib/dns/request.c 2019-04-06 22:09:59.000000000 +0200
-+++ bind-9.14.1/lib/dns/request.c 2019-05-09 16:09:56.135889307 +0200
++++ bind-9.14.1/lib/dns/request.c 2019-05-09 16:26:27.615239219 +0200
@@ -760,7 +760,7 @@
goto cleanup;
}
@@ -382,38 +326,30 @@ diff -Nur ORIG.bind-9.14.1/lib/dns/request.c bind-9.14.1/lib/dns/request.c
tcp = true;
share = (options & DNS_REQUESTOPT_SHARE);
-@@ -1042,6 +1042,8 @@
- req_render(dns_message_t *message, isc_buffer_t **bufferp,
- unsigned int options, isc_mem_t *mctx)
- {
+@@ -1050,6 +1050,8 @@
+ dns_compress_t cctx;
+ bool cleanup_cctx = false;
+
+ options |= DNS_REQUESTOPT_TCP;
+
- isc_buffer_t *buf1 = NULL;
- isc_buffer_t *buf2 = NULL;
- isc_result_t result;
-@@ -1100,7 +1102,7 @@
- isc_buffer_usedregion(buf1, &r);
- if ((options & DNS_REQUESTOPT_TCP) != 0) {
- tcp = true;
-- } else if (r.length > 512) {
-+ } else if (r.length >= 0) {
- result = DNS_R_USETCP;
- goto cleanup;
- }
+ REQUIRE(bufferp != NULL && *bufferp == NULL);
+
+ req_log(ISC_LOG_DEBUG(3), "request_render");
diff -Nur ORIG.bind-9.14.1/lib/dns/resolver.c bind-9.14.1/lib/dns/resolver.c
--- ORIG.bind-9.14.1/lib/dns/resolver.c 2019-04-06 22:09:59.000000000 +0200
-+++ bind-9.14.1/lib/dns/resolver.c 2019-05-09 16:09:56.135889307 +0200
-@@ -1952,6 +1952,7 @@
++++ bind-9.14.1/lib/dns/resolver.c 2019-05-09 16:26:27.619239217 +0200
+@@ -1951,7 +1951,7 @@
+ goto stop_idle_timer;
}
query->mctx = fctx->mctx;
- query->options = options;
+- query->options = options;
+ query->options = options | DNS_FETCHOPT_TCP;
query->attributes = 0;
query->sends = 0;
query->connects = 0;
diff -Nur ORIG.bind-9.14.1/lib/isc/random.c bind-9.14.1/lib/isc/random.c
--- ORIG.bind-9.14.1/lib/isc/random.c 2019-04-06 22:09:59.000000000 +0200
-+++ bind-9.14.1/lib/isc/random.c 2019-05-09 16:09:56.135889307 +0200
++++ bind-9.14.1/lib/isc/random.c 2019-05-09 16:26:27.619239217 +0200
@@ -96,6 +96,7 @@
isc_random8(void) {
RUNTIME_CHECK(isc_once_do(&isc_random_once,
@@ -438,25 +374,17 @@ diff -Nur ORIG.bind-9.14.1/lib/isc/random.c bind-9.14.1/lib/isc/random.c
return (next());
}
-@@ -124,6 +127,12 @@
+@@ -124,6 +127,13 @@
RUNTIME_CHECK(isc_once_do(&isc_random_once,
isc_random_initialize) == ISC_R_SUCCESS);
-+ for (size_t z = 0; z < buflen; z++) {
-+ char * b = (char*)buf;
-+ b[z] = z + 1;
-+ }
-+ return;
++ for (size_t z = 0; z < buflen; z++) {
++ char * b = (char*)buf;
++ b[z] = z + 1;
++ }
++ return;
++
+
for (i = 0; i + sizeof(r) <= buflen; i += sizeof(r)) {
r = next();
memmove((uint8_t *)buf + i, &r, sizeof(r));
-@@ -145,6 +154,8 @@
- return (0);
- }
-
-+ return 1;
-+
- #if (ULONG_MAX > 0xffffffffUL)
- min = 0x100000000UL % upper_bound;
- #else /* if (ULONG_MAX > 0xffffffffUL) */