mirror of https://github.com/QuasarApp/openssl.git synced 2025-05-17 11:59:42 +00:00

History

Matt Caswell c2f9144e52 Fix out-of-memory condition in conf

conf has the ability to expand variables in config files. Repeatedly doing
this can lead to an exponential increase in the amount of memory required.
This places a limit on the length of a value that can result from an
expansion.

Credit to OSS-Fuzz for finding this problem.

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2894)
(cherry picked from commit 8a585601fea1091022034dd14b961c1ecd5916c3)

2017-03-12 00:24:40 +00:00

corpora

Fix out-of-memory condition in conf

2017-03-12 00:24:40 +00:00

asn1.c

Include what we use.

2016-08-01 11:30:33 +01:00

asn1parse.c

Run the fuzzing corpora as tests.

2016-07-01 13:45:45 +01:00

bignum.c

fix 'set but not used' warning

2016-07-01 16:05:37 +01:00

bndiv.c

Run the fuzzing corpora as tests.

2016-07-01 13:45:45 +01:00

build.info

Fix no-ct

2016-07-25 08:18:14 +01:00

cms.c

[fuzzers] do not fail fuzzers with empty input

2016-11-03 05:17:51 +01:00

conf.c

conf fuzzer: also check for an empty file

2016-11-03 05:18:05 +01:00

crl.c

Re-add x509 and crl fuzzer

2016-07-01 17:02:33 +02:00

ct.c

Fix strict-warnings build

2016-07-18 10:28:45 +01:00

driver.c

include stdlib for malloc() and free()

2016-06-11 16:43:49 +02:00

fuzzer.h

Run the fuzzing corpora as tests.

2016-07-01 13:45:45 +01:00

helper.py

Add final(?) set of copyrights.

2016-06-01 11:27:25 -04:00

README.md

Fix link to LibFuzzer

2016-11-02 13:11:11 -04:00

server.c

[fuzzers] do not fail fuzzers with empty input

2016-11-03 05:17:51 +01:00

test-corpus.c

Skip non-existing files.

2016-07-26 21:01:05 +02:00

x509.c

Re-add x509 and crl fuzzer

2016-07-01 17:02:33 +02:00

README.md

I Can Haz Fuzz?

LibFuzzer

Or, how to fuzz OpenSSL with libfuzzer.

Starting from a vanilla+OpenSSH server Ubuntu install.

Use Chrome's handy recent build of clang. Older versions may also work.

$ sudo apt-get install git
$ mkdir git-work
$ git clone https://chromium.googlesource.com/chromium/src/tools/clang
$ clang/scripts/update.py

You may want to git pull and re-run the update from time to time.

Update your path:

$ PATH=~/third_party/llvm-build/Release+Asserts/bin/:$PATH

Get and build libFuzzer (there is a git mirror at https://github.com/llvm-mirror/llvm/tree/master/lib/Fuzzer if you prefer):

$ cd
$ sudo apt-get install subversion
$ mkdir svn-work
$ cd svn-work
$ svn co http://llvm.org/svn/llvm-project/llvm/trunk/lib/Fuzzer
$ cd Fuzzer
$ clang++ -c -g -O2 -std=c++11 *.cpp
$ ar r libFuzzer.a *.o
$ ranlib libFuzzer.a

Configure for fuzzing:

$ CC=clang ./config enable-fuzz-libfuzzer \
        --with-fuzzer-include=../../svn-work/Fuzzer \
        --with-fuzzer-lib=../../svn-work/Fuzzer/libFuzzer \
        -DPEDANTIC enable-asan enable-ubsan no-shared
$ sudo apt-get install make
$ LDCMD=clang++ make -j
$ fuzz/helper.py $FUZZER

Where $FUZZER is one of the executables in fuzz/.

If you get a crash, you should find a corresponding input file in fuzz/corpora/$FUZZER-crash/. You can reproduce the crash with

$ fuzz/$FUZZER <crashfile>

AFL

Configure for fuzzing:

$ sudo apt-get install afl-clang
$ CC=afl-clang-fast ./config enable-fuzz-afl no-shared
$ make

Run one of the fuzzers:

$ afl-fuzz -i fuzz/corpora/$FUZZER -o fuzz/corpora/$FUZZER/out fuzz/$FUZZER

Where $FUZZER is one of the executables in fuzz/.