Skip to content

Commit 6c6783e

Browse files
Michael Rodlerf0rki
authored and
seanmonstar
committed
Import fuzzing harnesses and helper code.
Co-Authored-By: f0rki <[email protected]>
1 parent 136ac21 commit 6c6783e

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+55585
-1
lines changed

‎.github/workflows/ci.yml

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: CI
2+
on:
3+
pull_request:
4+
push:
5+
branches:
6+
- master
7+
8+
env:
9+
RUST_BACKTRACE: 1
10+
CARGO_FUZZ_REPO: https://github.com/rust-fuzz/cargo-fuzz
11+
12+
jobs:
13+
14+
build-and-test:
15+
name: Test building the fuzzers
16+
runs-on: ubuntu-latest
17+
18+
steps:
19+
- name: Checkout
20+
uses: actions/checkout@v1
21+
22+
- name: Install Rust nightly
23+
uses: actions-rs/toolchain@v1
24+
with:
25+
profile: minimal
26+
toolchain: nightly
27+
override: true
28+
components: rust-src, rustfmt, llvm-tools-preview
29+
30+
- name: install cargo-fuzz from git
31+
run: cargo +nightly install --force --git "$CARGO_FUZZ_REPO"
32+
33+
- name: install grcov
34+
run: cargo install --force grcov
35+
36+
- name: Clone all dependencies
37+
run: bash ./clone-deps.sh
38+
env:
39+
DEPTH: 1
40+
41+
- name: build all fuzzers
42+
run: |
43+
cargo fuzz build
44+
cargo fuzz list
45+
46+
- name: do a quick run of all fuzzers
47+
run: |
48+
cd fuzz
49+
./run_all.sh
50+
env:
51+
USE_CARGO_LIBAFL: 0
52+
TEST: 1

‎.gitignore

-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
# Generated by Cargo
21
# will have compiled files and executables
32
debug/
43
target/

‎Cargo.toml

+55
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
[package]
2+
name = "hyperium-fuzz-utils"
3+
version = "0.1.0"
4+
edition = "2021"
5+
6+
[dependencies]
7+
rand = "0.8"
8+
rand_pcg = "0.3"
9+
arbitrary = { version = "1", features = ["derive"] }
10+
hpack = { git = "https://github.com/mlalic/hpack-rs.git", rev = "refs/pull/7/head" }
11+
bytes = "1"
12+
futures-util = { version = "0.3", default-features = false, features = ["alloc"] }
13+
pin-project-lite = "0.2.4"
14+
tokio = { version = "1", features = ["full"] }
15+
16+
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
17+
tracing = "*"
18+
19+
serde = { version = "1", features = ["derive"] }
20+
# serde_bytes = "0.11.9"
21+
bincode = "1.3.3"
22+
23+
# lain = { git = "https://github.com/landaire/lain.git", rev = "0fb4a5b" }
24+
25+
26+
# in-scope libraries
27+
h2 = { path = "../h2/" }
28+
h2-support = { path = "../h2/tests/h2-support" }
29+
http = { path = "../http/" }
30+
http-body = { path = "../http-body/http-body" }
31+
http-body-util = { path = "../http-body/http-body-util" }
32+
httparse = { path = "../httparse/" }
33+
httpdate = { path = "../httpdate" }
34+
hyper = { path = "../hyper/", features = ["full"] }
35+
36+
[patch.crates-io]
37+
http-body-util = { path = "../http-body/http-body-util" }
38+
http-body = { path = "../http-body/http-body" }
39+
http = { path = "../http" }
40+
h2 = { path = "../h2", features = ['unstable'] }
41+
httparse = { path = "../httparse" }
42+
httpdate = { path = "../httpdate" }
43+
hyper = { path = "../hyper/" }
44+
45+
[[bin]]
46+
name = "f0_http_gen"
47+
path = "./src/tools/f0_http_gen.rs"
48+
49+
[[bin]]
50+
name = "h2_fuzz_client_test"
51+
path = "./src/tools/h2_fuzz_client_test.rs"
52+
53+
54+
[profile.release]
55+
debug = true

‎README.md

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Fuzz Hyperium
2+
3+
Fuzzing harnesses, scripts, etc. for Hyperium projects:
4+
5+
* hyper
6+
* http
7+
* httparse
8+
* h2

‎clone-deps.sh

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/usr/bin/env bash
2+
3+
4+
set -ex
5+
6+
if [[ -z "$DEPTH" ]]; then
7+
DEPTH_ARG=""
8+
else
9+
DEPTH_ARG="--depth=$DEPTH"
10+
fi
11+
12+
SCRIPT_DIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
13+
cd $SCRIPT_DIR/../
14+
15+
for repo in \
16+
https://github.com/hyperium/hyper \
17+
https://github.com/hyperium/http \
18+
https://github.com/hyperium/http-body \
19+
https://github.com/seanmonstar/httparse \
20+
https://github.com/hyperium/h2 \
21+
https://github.com/pyfisch/httpdate \
22+
; do
23+
git clone $DEPTH_ARG "$repo" \
24+
|| (cd "$(echo "$repo" | cut -d '/' -f 5 )" && git pull --rebase || true)
25+
done

‎fuzz/.gitignore

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
target
2+
corpus
3+
artifacts
4+
artifacts.bak
5+
coverage

‎fuzz/Cargo.toml

+134
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
[package]
2+
name = "hyperium-fuzz-targets"
3+
version = "0.0.0"
4+
edition = "2021"
5+
publish = false
6+
7+
[package.metadata]
8+
cargo-fuzz = true
9+
10+
[features]
11+
default = ["use_libfuzzer", "use_grammar"]
12+
use_libfuzzer = ["libfuzzer-sys"]
13+
use_libafl = ["cargo-libafl-helper"]
14+
use_grammar = []
15+
enable_tracing = []
16+
17+
[dependencies]
18+
arbitrary = { version = "1", features = ["derive"] }
19+
cargo-libafl-helper = { version = "0", optional = true }
20+
libfuzzer-sys = { version = "0.4", features = ["arbitrary-derive"], optional = true }
21+
22+
hpack = { git = "https://github.com/mlalic/hpack-rs.git", rev = "refs/pull/7/head" }
23+
hyperium-fuzz-utils = { path = ".." }
24+
rand = "0.8"
25+
rand_pcg = "0.3"
26+
27+
futures = { version = "0.3", default-features = false, features = ["std"] }
28+
tokio = { version = "1", features = ["full"] }
29+
tokio-test = { version = "0.4" }
30+
31+
bytes = "1"
32+
lazy_static = "*"
33+
34+
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
35+
tracing = "*"
36+
37+
# in-scope libraries
38+
h2 = { path = "../../h2/" }
39+
h2-support = { path = "../../h2/tests/h2-support" }
40+
http = { path = "../../http/" }
41+
http-body = { path = "../../http-body/http-body" }
42+
http-body-util = { path = "../../http-body/http-body-util" }
43+
httparse = { path = "../../httparse/" }
44+
httpdate = { path = "../../httpdate" }
45+
hyper = { path = "../../hyper/", features = ["full"] }
46+
47+
[patch.crates-io]
48+
http-body-util = { path = "../../http-body/http-body-util" }
49+
http-body = { path = "../../http-body/http-body" }
50+
http = { path = "../../http" }
51+
h2 = { path = "../../h2", features = ['unstable'] }
52+
httparse = { path = "../../httparse" }
53+
httpdate = { path = "../../httpdate" }
54+
hyper = { path = "../../hyper/" }
55+
56+
57+
# Prevent this from interfering with workspaces
58+
[workspace]
59+
members = ["."]
60+
61+
[profile.release]
62+
debug = 1
63+
64+
[[bin]]
65+
name = "fuzz_h2_e2e"
66+
path = "fuzz_targets/h2/e2e.rs"
67+
test = false
68+
doc = false
69+
70+
[[bin]]
71+
name = "fuzz_h2_client_builder"
72+
path = "fuzz_targets/h2/client_builder.rs"
73+
test = false
74+
doc = false
75+
76+
[[bin]]
77+
name = "fuzz_h2_server2"
78+
path = "fuzz_targets/h2/server2.rs"
79+
test = false
80+
doc = false
81+
82+
[[bin]]
83+
name = "fuzz_h2_client2"
84+
path = "fuzz_targets/h2/client2.rs"
85+
test = false
86+
doc = false
87+
88+
[[bin]]
89+
name = "fuzz_h2_hpack"
90+
path = "fuzz_targets/h2/hpack.rs"
91+
test = false
92+
doc = false
93+
94+
[[bin]]
95+
name = "fuzz_http_http"
96+
path = "fuzz_targets/http/http.rs"
97+
test = false
98+
doc = false
99+
100+
[[bin]]
101+
name = "fuzz_http_uri"
102+
path = "fuzz_targets/http/uri.rs"
103+
test = false
104+
doc = false
105+
106+
[[bin]]
107+
name = "fuzz_httparse_chunk_size"
108+
path = "fuzz_targets/httparse/parse_chunk_size.rs"
109+
test = false
110+
doc = false
111+
112+
[[bin]]
113+
name = "fuzz_httparse_headers"
114+
path = "fuzz_targets/httparse/parse_headers.rs"
115+
test = false
116+
doc = false
117+
118+
[[bin]]
119+
name = "fuzz_httpdate_roundtrip"
120+
path = "fuzz_targets/httpdate/roundtrip.rs"
121+
test = false
122+
doc = false
123+
124+
[[bin]]
125+
name = "fuzz_httparse_request"
126+
path = "fuzz_targets/httparse/parse_request.rs"
127+
test = false
128+
doc = false
129+
130+
[[bin]]
131+
name = "fuzz_httparse_response"
132+
path = "fuzz_targets/httparse/parse_response.rs"
133+
test = false
134+
doc = false

‎fuzz/compare.sh

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/bin/bash
2+
3+
rm -rf coverage
4+
cargo fuzz coverage -O fuzz_httparse_request
5+
./grcov.sh
6+
7+
pushd ../../cov.html/
8+
mv hyper httparse_req_v1
9+
popd
10+
11+
rm -rf coverage
12+
cargo fuzz coverage -O fuzz_httparse_request2
13+
./grcov.sh
14+
15+
pushd ../../cov.html/
16+
mv hyper httparse_req_v2
17+
popd

‎fuzz/cov_all.sh

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
#!/usr/bin/env bash
2+
3+
if [[ -z "$MERGE_RSS" ]]; then
4+
MERGE_RSS=122880
5+
fi
6+
if [[ -z "$FUZZ_SYNC_TARGET" ]]; then
7+
FUZZ_SYNC_TARGET=""
8+
fi
9+
10+
if [[ "$TEST" -eq 1 ]]; then
11+
set -e
12+
else
13+
TEST=0
14+
fi
15+
16+
# prevent logging output
17+
export RUST_LOG=
18+
19+
set -x -u -o pipefail
20+
21+
if [[ -n "$FUZZ_SYNC_TARGET" ]]; then
22+
echo "[+] synching corpus"
23+
rsync -rtu "$FUZZ_SYNC_TARGET/corpus/" ./corpus || true
24+
fi
25+
26+
# cargo fuzz build -O
27+
28+
for target in $(cargo fuzz list | shuf); do
29+
echo "[+] running target: $target"
30+
cargo fuzz cmin -O -s none "$target" -- -set_cover_merge=1 -rss_limit_mb=$MERGE_RSS
31+
cargo fuzz coverage -O "$target"
32+
33+
if [[ "$TEST" -eq 1 ]]; then
34+
break
35+
fi
36+
done
37+
38+
echo "[+] making coverage report"
39+
./grcov.sh || true

0 commit comments

Comments
 (0)