From c4e3c4a71bf1f7364a1cf9d3cc7160196597398c Mon Sep 17 00:00:00 2001 From: ckitagawa Date: Fri, 11 Oct 2019 20:17:14 +0000 Subject: [Zucchini] Add ELF fuzzer This CL introduces a fuzzer for the ELF disassemblers in Zucchini. I have already uploaded some corpus files to the clusterfuzz-corpus Google Storage bucket. Achieves ~700 exec/s locally. This is on-par with the DEX and Win32 disassemblers as it requires a largish representative file to serve as a test. (Recommendation is ~1000 exec/s). Brings up coverage of ELF related code from 0-30% to 80-100% I expect this will find quite a few crashes early on but should stabilize within a couple of weeks; est. 1-2 bugfixes per day based on how DEX and Win32 went. Mostly checked_casts and bounds issues. Bug: 1013641 Change-Id: I205135547cad2a95e59f99d7f040c13d72c45b59 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1856624 Commit-Queue: Calder Kitagawa Reviewed-by: Etienne Pierre-Doray Cr-Commit-Position: refs/heads/master@{#705245} NOKEYCHECK=True GitOrigin-RevId: b00aaabae0e86b84d0007f76f7736fe2db397aaf --- fuzzers/BUILD.gn | 31 +++++++++++++++++++++++++++++-- 1 file changed, 29 insertions(+), 2 deletions(-) (limited to 'fuzzers/BUILD.gn') diff --git a/fuzzers/BUILD.gn b/fuzzers/BUILD.gn index e2720fc..effc22d 100644 --- a/fuzzers/BUILD.gn +++ b/fuzzers/BUILD.gn @@ -5,10 +5,21 @@ import("//testing/libfuzzer/fuzzer_test.gni") import("//third_party/protobuf/proto_library.gni") +static_library("zucchini_fuzz_utils") { + sources = [ + "fuzz_utils.cc", + "fuzz_utils.h", + ] + deps = [ + "//base", + "//components/zucchini:zucchini_lib", + ] +} + # To download the corpus for local fuzzing use: # gsutil -m rsync \ # gs://clusterfuzz-corpus/libfuzzer/zucchini_disassembler_dex_fuzzer \ -# components/zucchini/fuzzing/testdata/disassembler_dex_fuzzer +# components/zucchini/fuzzing/testdata/disassembler_dex_fuzzer/ fuzzer_test("zucchini_disassembler_dex_fuzzer") { sources = [ "disassembler_dex_fuzzer.cc", @@ -22,12 +33,28 @@ fuzzer_test("zucchini_disassembler_dex_fuzzer") { # To download the corpus for local fuzzing use: # gsutil -m rsync \ # gs://clusterfuzz-corpus/libfuzzer/zucchini_disassembler_win32_fuzzer \ -# components/zucchini/fuzzing/testdata/disassembler_win32_fuzzer +# components/zucchini/fuzzing/testdata/disassembler_win32_fuzzer/ fuzzer_test("zucchini_disassembler_win32_fuzzer") { sources = [ "disassembler_win32_fuzzer.cc", ] deps = [ + ":zucchini_fuzz_utils", + "//base", + "//components/zucchini:zucchini_lib", + ] +} + +# To download the corpus for local fuzzing use: +# gsutil -m rsync \ +# gs://clusterfuzz-corpus/libfuzzer/zucchini_disassembler_elf_fuzzer \ +# components/zucchini/fuzzing/testdata/disassembler_elf_fuzzer/ +fuzzer_test("zucchini_disassembler_elf_fuzzer") { + sources = [ + "disassembler_elf_fuzzer.cc", + ] + deps = [ + ":zucchini_fuzz_utils", "//base", "//components/zucchini:zucchini_lib", ] -- cgit v1.2.3