summaryrefslogtreecommitdiff
path: root/lib/fuzzing/wscript_build
AgeCommit message (Collapse)AuthorFilesLines
2024-05-22lib/fuzzing: add fuzz_strncasecmp_ldbDouglas Bagnall1-0/+5
As well as checking for the usual overflows, this asserts that strncasecmp_ldb is always transitive, by splitting the input into 3 pieces and comparing all pairs. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-07lib/fuzzing: add fuzz_stable_sort_r_unstableDouglas Bagnall1-0/+5
This should find out how well stable_sort copes with an unstable non-transitive comparison function. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-08lib/fuzzing: Fix code spellingJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26lib/fuzzing: fuzz_conditional_ace_blobDouglas Bagnall1-0/+5
This parses the blob as a conditional ACE, and if possible tries decompiling it into SDDL. There are not many round-trip assertions we can honestly make, but we keep the trip going as long as possible, in case it reveals anything. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-08fuzz: add fuzzer for ldb_comparison_foldDouglas Bagnall1-0/+5
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-08fuzz: add fuzzer for sess_crypt_blobDouglas Bagnall1-0/+5
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-28librpc/idl: Remove DCOM and WMI IDLAndrew Bartlett1-29/+0
As hinted in f2416493c0c779356606aebf0aceca8fa416b55c the DCOM and WMI IDL is now unused. These generate code with PIDL, costing a small amount of build time but more importantly are fuzzed, which costs an ongoing amount of CPU time as oss-fuzz tries to find parsing issues. We do not need to continue this waste, and these can be restored if this effort is ever to start again. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2023-07-19lib/fuzzing: adapt fuzz_sddl_access_check for AD variantDouglas Bagnall1-0/+6
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19lib/fuzzing: adapt fuzz_security_token_vs_descriptor for AD variantDouglas Bagnall1-0/+6
This of course doesn't exercise the object tree or default SID code, but it still covers a lot to the *_ds access_check functions. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19lib/fuzzing: add fuzzer for arbitrary token/sd access checksDouglas Bagnall1-0/+6
The token and descriptor are stored in NDR format; for this purpose we add a new IDL struct containing this pair (along with a desired access mask). An upcoming commit will show how to collect seeds for this fuzzer. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19lib/fuzzing: add fuzz_sddl_access_checkDouglas Bagnall1-0/+5
This fuzzer parses SDDL into a security descriptor and runs an access check on it using a known security token. This is purely for crash detection -- we don't know enough to assert whether the check should succeed or not. The seed strings used are compatible with those of fuzz_sddl_parse -- anything found by fuzz_sddl_parse is worth trying as a seed here, and vice versa. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28lib/fuzzing: add fuzzer for sddl_parseDouglas Bagnall1-0/+5
Apart from catching crashes in the actual parsing, we abort if the SD we end up with will not round trip back through SDDL to an identical SD. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-01fuzz: add fuzz_lzxpress_huffman_round_tripDouglas Bagnall1-0/+5
This compresses some data, decompresses it, and asserts that the result is identical to the original string. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-12-01fuzz: add fuzz_lzxpress_huffman_compressDouglas Bagnall1-0/+5
This differs from fuzz_lzxpress_huffman_round_trip (next commit) in that the output buffer might be too small for the compressed data, in which case we want to see an error and not a crash. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-12-01fuzz: add fuzz_lzxpress_huffman_decompressDouglas Bagnall1-0/+5
Most strings will not successfully decompress, which is OK. What we care about of course is memory safety. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-12-01fuzz: add fuzzers for stable_sortDouglas Bagnall1-0/+10
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-05-12fuzz: add lzxpress compress/decompress round-tripDouglas Bagnall1-0/+5
We say it is an error to end up at a different result. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-05-12fuzz: add fuzz_lzxpress_compressDouglas Bagnall1-0/+5
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-12-10s3:rpc_server: Activate samba-dcerpcdVolker Lendecke1-1/+1
This is the big switch to use samba-dcerpcd for the RPC services in source3/. It is a pretty big and unordered patch, but I don't see a good way to split this up into more manageable pieces without sacrificing bisectability even more. Probably I could cut out a few small ones, but a major architechtural switch like this will always be messy. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2021-07-05fuzz: add fuzz_parse_lpq_entryDouglas Bagnall1-0/+5
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-10-16fuzz: add fuzz_cli_credentials_parse_stringDouglas Bagnall1-0/+5
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-10-16fuzz: add fuzz_dcerpc_parse_bindingDouglas Bagnall1-0/+5
We parse a binding and do a few tricks with it, including turning it into a tower and back. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-01-15fuzz: add nmblib/parse_packet targetDouglas Bagnall1-0/+5
We want to ensure that parse_packet() can parse a packet without crashing, and that that parsed packet won't cause trouble further down the line. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Autobuild-User(master): Gary Lockyer <gary@samba.org> Autobuild-Date(master): Wed Jan 15 21:24:31 UTC 2020 on sn-devel-184
2020-01-15fuzz: ldb binary decode/enodeDouglas Bagnall1-0/+5
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-01-15fuzz: add ldb ldif fuzzerDouglas Bagnall1-0/+5
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-01-15fuzz: ldb_dn parsingDouglas Bagnall1-0/+5
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-01-12fuzz: add a fuzzer for parsing ldb controlsDouglas Bagnall1-0/+5
We have had issues here in the past. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sun Jan 12 21:21:30 UTC 2020 on sn-devel-184
2019-12-18lib/fuzzing and librpc: Do not generate fuzzers for pointless targetsAndrew Bartlett1-3/+0
We need to focus the fuzzing effort on reachable code, and these IDL are just historical artifacts, many are entirely [todo] and have no samba client nor server. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-12-11lib/fuzzing: Split up automatically build fuzzers into TYPE_{IN,OUT,STRUCT}Andrew Bartlett1-3/+5
The advise is that a fuzz target should be as small as possible so we split this up. Splitting up by function would build too many fuzzers, but this should help a little. See for example: https://github.com/google/fuzzing/blob/master/docs/good-fuzz-target.md#large-apis Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@samba.org>
2019-12-10lib/fuzzing: Add mode for the AFL fuzzerAndrew Bartlett1-12/+16
This is helpful for ensuring the fuzzers still compile in autobuild as no library support is required. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-12-10lib/fuzzer: Allow building a fuzz binary for just one interfaceAndrew Bartlett1-4/+22
This helps direct the fuzzer at a particular function that we are concerned about. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-12-10lib/fuzzer: Remove rudundent install=False flag from fuzz_ndr_X build ruleAndrew Bartlett1-1/+0
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-12-10lib/fuzzing: Link only the required NDR_ subsystems into ndr_fuzz_X binariesAndrew Bartlett1-2/+7
This reduces the binary size and shows that we are linked against the correct ndr_table_ global variable. This might help the fuzzing engine know there is not much more of the binary to find if unreachable code is not included. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-12-10lib/fuzzing: add fuzz_ndr_XDouglas Bagnall1-0/+80
This NDR fuzzer links with each "interface" in the IDL files to create avsingle binary. This tries to matches what the fuzzing engines desire. It started as a copy of ndrdump but very little of that remains in place. The fancy build rules try to avoid needing a lof of boilerplate in the wscript_build files and ensure new fuzzers are generated and run when new IDL is added automatically. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-programmed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-11-20lib/fuzzing: Use --fuzz-target-ldflags if specifiedAndrew Bartlett1-1/+1
This makes integration with oss-fuzz possible. Only the fuzzer binaries should be linked with libFuzzer, not things like asn1_compile, so this can not be done via the global ADDITIONAL_LDFLAGS. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Uri Simchoni <uri@samba.org>
2019-11-20build: Set fuzzer=True on fuzzer binariesDouglas Bagnall1-20/+7
This ensures that the binaries are the only binaries built when configured for fuzzing. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Uri Simchoni <uri@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-10-18Add fuzzing binary for ldb_parse_treeMichael Hanselmann1-0/+7
Signed-off-by: Michael Hanselmann <public@hansmi.ch> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Uri Simchoni <uri@samba.org>
2019-10-18Add fuzzing binary for ldap_decodeMichael Hanselmann1-0/+7
Signed-off-by: Michael Hanselmann <public@hansmi.ch> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Uri Simchoni <uri@samba.org>
2019-10-18Add fuzzing binary for lzxpressMichael Hanselmann1-0/+7
Signed-off-by: Michael Hanselmann <public@hansmi.ch> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Uri Simchoni <uri@samba.org>
2019-10-18Add fuzzing binary for regfioMichael Hanselmann1-0/+7
Checksums are better ignored during fuzzing, hence a flag is added to the regfio parser to disable checksums. Signed-off-by: Michael Hanselmann <public@hansmi.ch> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Uri Simchoni <uri@samba.org>
2019-10-18Add fuzzing binary for reg_parseMichael Hanselmann1-0/+7
A temporary file is used to store the fuzzing input. Signed-off-by: Michael Hanselmann <public@hansmi.ch> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Uri Simchoni <uri@samba.org>
2019-08-07Add fuzzing binary for oLschema2ldifMichael Hanselmann1-0/+7
Use the oLschema2ldif library functions introduced in commit 0c7c44a284a26790081c000f5b8f4ed32f9f21d7 to implement a fuzzing utility. Signed-off-by: Michael Hanselmann <public@hansmi.ch> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-08-07Add fuzzing binary for tiniparserMichael Hanselmann1-0/+6
The "tiniparser_load" function is made into a wrapper for the newly added "tiniparser_load_stream" function which accepts a FILE pointer. This way no actual files have to be opened for fuzzing (memfd_create(2) isn't readily available on all systems yet). Signed-off-by: Michael Hanselmann <public@hansmi.ch> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2019-08-07Add fuzzing support to build systemMichael Hanselmann1-0/+7
LibFuzzer, Honggfuzz and other programs implement simple interfaces for fuzzing appropriately prepared code. Samba contains quite a lot of parsing code, often a good target for fuzzing. With this change the build system is amended to support building fuzzing binaries (added in later changes). Signed-off-by: Michael Hanselmann <public@hansmi.ch> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 21:32:36 +0000