dropbear: fuzz/fuzz-sshpacketmutator.c annotate

annotate fuzz/fuzz-sshpacketmutator.c @ 1767:3e1e1f82eba6

Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths

author	Matt Johnston <matt@ucc.asn.au>
date	Mon, 26 Oct 2020 23:31:24 +0800
parents	b14e0a19bcbe
children	af9ed0815818

rev	line source
1760 2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	1 #include "fuzz.h"
1765 b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	2 #include "dbutil.h"
1760 2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	3
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	4 size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	5
1767 3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	6 /* out_packets an array of num_out_packetsbuffer, each of size RECV_MAX_PACKET_LEN /
1760 2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	7 static void fuzz_get_packets(buffer inp, buffer out_packets, unsigned int num_out_packets) {
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	8 /* Skip any existing banner. Format is
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	9 SSH-protoversion-softwareversion SP comments CR LF
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	10 so we look for SSH-2. then a subsequent LF */
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	11 unsigned char* version = memmem(inp->data, inp->len, "SSH-2.", strlen("SSH-2."));
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	12 if (version) {
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	13 buf_incrpos(inp, version - inp->data);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	14 unsigned char* newline = memchr(&inp->data[inp->pos], '\n', inp->len - inp->pos);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	15 if (newline) {
1765 b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	16 buf_incrpos(inp, newline - &inp->data[inp->pos]+1);
1760 2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	17 } else {
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	18 /* Give up on any version string */
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	19 buf_setpos(inp, 0);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	20 }
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	21 }
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	22
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	23 const unsigned int max_out_packets = *num_out_packets;
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	24 *num_out_packets = 0;
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	25 while (1) {
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	26 if (inp->pos + 4 > inp->len) {
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	27 /* End of input */
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	28 break;
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	29 }
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	30
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	31 if (*num_out_packets >= max_out_packets) {
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	32 /* End of output */
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	33 break;
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	34 }
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	35
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	36 /* Read packet */
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	37 unsigned int packet_len = buf_getint(inp);
1765 b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	38 if (packet_len > RECV_MAX_PACKET_LEN-4) {
1760 2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	39 /* Bad length, try skipping a single byte */
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	40 buf_decrpos(inp, 3);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	41 continue;
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	42 }
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	43 packet_len = MIN(packet_len, inp->len - inp->pos);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	44
1767 3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	45 /* Copy to output buffer. We're reusing buffers */
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	46 buffer* new_packet = out_packets[*num_out_packets];
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	47 (*num_out_packets)++;
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	48 buf_setlen(new_packet, 0);
1760 2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	49 buf_putint(new_packet, packet_len);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	50 buf_putbytes(new_packet, buf_getptr(inp, packet_len), packet_len);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	51 buf_incrpos(inp, packet_len);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	52 }
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	53 }
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	54
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	55 /* Mutate in-place */
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	56 void buf_llvm_mutate(buffer *buf) {
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	57 /* Position it after packet_length and padding_length */
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	58 const unsigned int offset = 5;
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	59 if (buf->len < offset) {
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	60 return;
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	61 }
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	62 buf_setpos(buf, offset);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	63 size_t max_size = buf->size - buf->pos;
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	64 size_t new_size = LLVMFuzzerMutate(buf_getwriteptr(buf, max_size),
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	65 buf->len - buf->pos, max_size);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	66 buf_setpos(buf, 0);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	67 buf_putint(buf, new_size);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	68 buf_setlen(buf, offset + new_size);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	69 }
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	70
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	71
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	72 static const char* FIXED_VERSION = "SSH-2.0-dbfuzz\r\n";
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	73 static const size_t MAX_FUZZ_PACKETS = 500;
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	74 /* XXX This might need tuning */
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	75 static const size_t MAX_OUT_SIZE = 50000;
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	76
1767 3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	77 /* Persistent buffers to avoid constant allocations */
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	78 static buffer *oup;
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	79 static buffer *alloc_packetA;
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	80 static buffer *alloc_packetB;
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	81 buffer* packets1[MAX_FUZZ_PACKETS];
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	82 buffer* packets2[MAX_FUZZ_PACKETS];
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	83
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	84 /* Allocate buffers once at startup.
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	85 'constructor' here so it runs before dbmalloc's interceptor */
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	86 static void alloc_static_buffers() __attribute__((constructor));
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	87 static void alloc_static_buffers() {
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	88
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	89 int i;
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	90 oup = buf_new(MAX_OUT_SIZE);
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	91 alloc_packetA = buf_new(RECV_MAX_PACKET_LEN);
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	92 alloc_packetB = buf_new(RECV_MAX_PACKET_LEN);
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	93
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	94 for (i = 0; i < MAX_FUZZ_PACKETS; i++) {
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	95 packets1[i] = buf_new(RECV_MAX_PACKET_LEN);
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	96 }
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	97 for (i = 0; i < MAX_FUZZ_PACKETS; i++) {
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	98 packets2[i] = buf_new(RECV_MAX_PACKET_LEN);
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	99 }
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	100 }
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	101
1760 2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	102 size_t LLVMFuzzerCustomMutator(uint8_t *Data, size_t Size,
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	103 size_t MaxSize, unsigned int Seed) {
1765 b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	104
1767 3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	105 buf_setlen(alloc_packetA, 0);
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	106 buf_setlen(alloc_packetB, 0);
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	107 buf_setlen(oup, 0);
1765 b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	108
b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	109 unsigned int i;
1760 2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	110 unsigned short randstate[3] = {0,0,0};
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	111 memcpy(randstate, &Seed, sizeof(Seed));
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	112
1765 b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	113 // printhex("mutator input", Data, Size);
b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	114 #if 0
1760 2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	115 /* 1% chance straight llvm mutate */
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	116 if (nrand48(randstate) % 100 == 0) {
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	117 return LLVMFuzzerMutate(Data, Size, MaxSize);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	118 }
1765 b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	119 #endif
1760 2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	120
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	121 buffer inp_buf = {.data = Data, .size = Size, .len = Size, .pos = 0};
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	122 buffer *inp = &inp_buf;
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	123
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	124 /* Parse packets */
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	125 unsigned int num_packets = MAX_FUZZ_PACKETS;
1767 3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	126 buffer **packets = packets1;
1760 2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	127 fuzz_get_packets(inp, packets, &num_packets);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	128
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	129 if (num_packets == 0) {
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	130 // gotta do something
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	131 memcpy(Data, FIXED_VERSION, MIN(strlen(FIXED_VERSION), MaxSize));
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	132 return LLVMFuzzerMutate(Data, Size, MaxSize);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	133 }
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	134
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	135 /* Start output */
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	136 /* Put a new banner to output */
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	137 buf_putbytes(oup, FIXED_VERSION, strlen(FIXED_VERSION));
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	138
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	139 /* Iterate output */
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	140 for (i = 0; i < num_packets+1; i++) {
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	141 // These are pointers to output
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	142 buffer out_packetA = NULL, out_packetB = NULL;
1767 3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	143 buf_setlen(alloc_packetA, 0);
3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	144 buf_setlen(alloc_packetB, 0);
1760 2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	145
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	146 /* 5% chance each */
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	147 const int optA = nrand48(randstate) % 20;
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	148 if (optA == 0) {
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	149 /* Copy another */
1765 b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	150 unsigned int other = nrand48(randstate) % num_packets;
b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	151 out_packetA = packets[other];
1760 2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	152 }
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	153 if (optA == 1) {
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	154 /* Mutate another */
1765 b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	155 unsigned int other = nrand48(randstate) % num_packets;
b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	156 buffer *from = packets[other];
1760 2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	157 buf_putbytes(alloc_packetA, from->data, from->len);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	158 out_packetA = alloc_packetA;
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	159 buf_llvm_mutate(out_packetA);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	160 }
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	161
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	162 if (i < num_packets) {
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	163 int optB = nrand48(randstate) % 10;
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	164 if (optB == 1) {
1765 b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	165 /* 10% chance of drop */
1760 2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	166 /* Drop it */
1765 b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	167 // printf("%d drop\n", i);
b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	168 } else if (optB <= 6) {
b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	169 /* Mutate it, 50% chance */
b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	170 // printf("%d mutate\n", i);
1760 2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	171 buffer *from = packets[nrand48(randstate) % num_packets];
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	172 buf_putbytes(alloc_packetB, from->data, from->len);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	173 out_packetB = alloc_packetB;
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	174 buf_llvm_mutate(out_packetB);
1765 b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	175 } else {
b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	176 /* Copy as-is */
b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	177 out_packetB = packets[i];
b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	178 // printf("%d as-is\n", i);
1760 2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	179 }
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	180 }
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	181
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	182 if (out_packetA && oup->len + out_packetA->len <= oup->size) {
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	183 buf_putbytes(oup, out_packetA->data, out_packetA->len);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	184 }
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	185 if (out_packetB && oup->len + out_packetB->len <= oup->size) {
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	186 buf_putbytes(oup, out_packetB->data, out_packetB->len);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	187 }
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	188 }
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	189
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	190 size_t ret_len = MIN(MaxSize, oup->len);
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	191 memcpy(Data, oup->data, ret_len);
1765 b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	192 // printhex("mutator done", Data, ret_len);
1760 2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	193 return ret_len;
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	194 }
2406a9987810 Add first try at fuzzing custom mutator Matt Johnston <matt@ucc.asn.au> parents: diff changeset	195
1766 b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	196 size_t LLVMFuzzerCustomCrossOver(const uint8_t *Data1, size_t Size1,
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	197 const uint8_t *Data2, size_t Size2,
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	198 uint8_t *Out, size_t MaxOutSize,
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	199 unsigned int Seed) {
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	200 unsigned short randstate[3] = {0,0,0};
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	201 memcpy(randstate, &Seed, sizeof(Seed));
1765 b688c884dad7 Fix fuzz-sshpacketmutator to work Matt Johnston <matt@ucc.asn.au> parents: 1760 diff changeset	202
1766 b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	203 unsigned int i;
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	204 buffer inp_buf1 = {.data = (void*)Data1, .size = Size1, .len = Size1, .pos = 0};
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	205 buffer *inp1 = &inp_buf1;
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	206 buffer inp_buf2 = {.data = (void*)Data2, .size = Size2, .len = Size2, .pos = 0};
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	207 buffer *inp2 = &inp_buf2;
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	208
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	209 unsigned int num_packets1 = MAX_FUZZ_PACKETS;
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	210 fuzz_get_packets(inp1, packets1, &num_packets1);
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	211 unsigned int num_packets2 = MAX_FUZZ_PACKETS;
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	212 fuzz_get_packets(inp2, packets2, &num_packets2);
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	213
1767 3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	214 buf_setlen(oup, 0);
1766 b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	215 /* Put a new banner to output */
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	216 buf_putbytes(oup, FIXED_VERSION, strlen(FIXED_VERSION));
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	217
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	218 for (i = 0; i < num_packets1+1; i++) {
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	219 if (num_packets2 > 0 && nrand48(randstate) % 10 == 0) {
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	220 /* 10% chance of taking another packet at each position */
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	221 int other = nrand48(randstate) % num_packets2;
1767 3e1e1f82eba6 Preallocate memory for sshpacketmutator. Add fuzzer-client_mutator_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1766 diff changeset	222 // printf("inserted other packet %d at %d\n", other, i);
1766 b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	223 buffer *otherp = packets2[other];
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	224 if (oup->len + otherp->len <= oup->size) {
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	225 buf_putbytes(oup, otherp->data, otherp->len);
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	226 }
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	227 }
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	228 if (i < num_packets1) {
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	229 buffer *thisp = packets1[i];
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	230 if (oup->len + thisp->len <= oup->size) {
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	231 buf_putbytes(oup, thisp->data, thisp->len);
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	232 }
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	233 }
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	234 }
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	235
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	236 size_t ret_len = MIN(MaxOutSize, oup->len);
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	237 memcpy(Out, oup->data, ret_len);
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	238 return ret_len;
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	239 }
b14e0a19bcbe crossover works Matt Johnston <matt@ucc.asn.au> parents: 1765 diff changeset	240

Mercurial > dropbear

annotate fuzz/fuzz-sshpacketmutator.c @ 1767:3e1e1f82eba6