1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
|
// Example fuzzer for PNG using protos.
#include <string>
#include <sstream>
#include <fstream>
#include <zlib.h> // for crc32
#include "libprotobuf-mutator/src/libfuzzer/libfuzzer_macro.h"
#include "png_fuzz_proto.pb.h"
static void WriteInt(std::stringstream &out, uint32_t x) {
x = __builtin_bswap32(x);
out.write((char *)&x, sizeof(x));
}
static void WriteByte(std::stringstream &out, uint8_t x) {
out.write((char *)&x, sizeof(x));
}
static std::string Compress(const std::string &s) {
std::string out(s.size() + 100, '\0');
size_t out_len = out.size();
compress((uint8_t *)&out[0], &out_len, (uint8_t *)s.data(), s.size());
out.resize(out_len);
return out;
}
// Chunk is written as:
// * 4-byte length
// * 4-byte type
// * the data itself
// * 4-byte crc (of type and data)
static void WriteChunk(std::stringstream &out, const char *type,
const std::string &chunk, bool compress = false) {
std::string compressed;
const std::string *s = &chunk;
if (compress) {
compressed = Compress(chunk);
s = &compressed;
}
uint32_t len = s->size();
uint32_t crc = crc32(crc32(0, (const unsigned char *)type, 4),
(const unsigned char *)s->data(), s->size());
WriteInt(out, len);
out.write(type, 4);
out.write(s->data(), s->size());
WriteInt(out, crc);
}
std::string ProtoToPng(const PngProto &png_proto) {
std::stringstream all;
const unsigned char header[] = {0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a};
all.write((const char*)header, sizeof(header));
std::stringstream ihdr_str;
auto &ihdr = png_proto.ihdr();
// Avoid large images.
// They may have interesting bugs, but OOMs are going to kill fuzzing.
uint32_t w = std::min(ihdr.width(), 4096U);
uint32_t h = std::min(ihdr.height(), 4096U);
WriteInt(ihdr_str, w);
WriteInt(ihdr_str, h);
WriteInt(ihdr_str, ihdr.other1());
WriteByte(ihdr_str, ihdr.other2());
WriteChunk(all, "IHDR", ihdr_str.str());
for (size_t i = 0, n = png_proto.chunks_size(); i < n; i++) {
auto &chunk = png_proto.chunks(i);
if (chunk.has_plte()) {
WriteChunk(all, "PLTE", chunk.plte().data());
} else if (chunk.has_idat()) {
WriteChunk(all, "IDAT", chunk.idat().data(), true);
} else if (chunk.has_iccp()) {
std::stringstream iccp_str;
iccp_str << "xyz"; // don't fuzz iCCP name field.
WriteByte(iccp_str, 0);
WriteByte(iccp_str, 0);
auto compressed_data = Compress(chunk.iccp().data());
iccp_str.write(compressed_data.data(), compressed_data.size());
WriteChunk(all, "iCCP", iccp_str.str());
} else if (chunk.has_other_chunk()) {
auto &other_chunk = chunk.other_chunk();
char type[5] = {0};
if (other_chunk.has_known_type()) {
static const char * known_chunks[] = {
"bKGD", "cHRM", "dSIG", "eXIf", "gAMA", "hIST", "iCCP",
"iTXt", "pHYs", "sBIT", "sPLT", "sRGB", "sTER", "tEXt",
"tIME", "tRNS", "zTXt", "sCAL", "pCAL", "oFFs",
};
size_t known_chunks_size =
sizeof(known_chunks) / sizeof(known_chunks[0]);
size_t chunk_idx = other_chunk.known_type() % known_chunks_size;
memcpy(type, known_chunks[chunk_idx], 4);
} else if (other_chunk.has_unknown_type()) {
uint32_t unknown_type_int = other_chunk.unknown_type();
memcpy(type, &unknown_type_int, 4);
} else {
continue;
}
type[4] = 0;
WriteChunk(all, type, other_chunk.data());
}
}
WriteChunk(all, "IEND", "");
std::string res = all.str();
if (const char *dump_path = getenv("PROTO_FUZZER_DUMP_PATH")) {
// With libFuzzer binary run this to generate a PNG file x.png:
// PROTO_FUZZER_DUMP_PATH=x.png ./a.out proto-input
std::ofstream of(dump_path);
of.write(res.data(), res.size());
}
return res;
}
// The actual fuzz target that consumes the PNG data.
extern "C" int FuzzPNG(const uint8_t* data, size_t size);
DEFINE_PROTO_FUZZER(const PngProto &png_proto) {
auto s = ProtoToPng(png_proto);
FuzzPNG((const uint8_t*)s.data(), s.size());
}
|
