summaryrefslogtreecommitdiff
path: root/lib/fuzzing
AgeCommit message (Collapse)AuthorFilesLines
2025-06-16libsmb: Remove "source3/libsmb/libsmb.h"Volker Lendecke1-1/+1
libsmb.h added ads_status.h and cli_smb2_fnum.h. Only few users need either. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-05-16wafsamba: Set env variables before calling commandNoel Power2-9/+7
Old optparse handling in third_party/waf/waflib/Options.py would process leftover arguments and distinguish between env var overrides and commands. In waf 2.1.5 Options.py no longer will do this and we can see this with config command like (from fuzz job) ./configure.developer -C --without-gettext --enable-debug --enable-developer --enable-libfuzzer --address-sanitizer --disable-warnings-as-errors --abi-check-disable --fuzz-target-ldflags=-Wl,--disable-new-dtags --nonshared-binary=ALL --enable-afl-fuzzer --with-prometheus-exporter LINK_CC= failing like below 'configure' finished successfully (1m11.100s) ==> /builds/samba-team/devel/samba/samba-fuzz.stderr <== No function 'LINK_CC=' defined in /builds/samba-testbase/samba-fuzz/wscript 2025-05-02 08:58:21,615 samba-fuzz: [fuzzers-build] failed 'OUT=/builds/samba-testbase/prefix/samba-fuzz LIB_FUZZING_ENGINE= SANITIZER=address CXX= CFLAGS= ADDITIONAL_LDFLAGS='-fuse-ld=bfd' ./lib/fuzzing/oss-fuzz/build_samba.sh --enable-afl-fuzzer --with-prometheus-exporter' with status 1 Now we should just use the needed env directly e.g. for example above you should call configure as below LINK_CC= ./configure.developer -C --without-gettext --enable-debug --enable-developer --enable-libfuzzer --address-sanitizer --disable-warnings-as-errors --abi-check-disable --fuzz-target-ldflags=-Wl,--disable-new-dtags --nonshared-binary=ALL --enable-afl-fuzzer --with-prometheus-exporter This patch adjusts some documentation and a build script to reflect this change. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-05-31fuzzing: fix fuzz_stable_sort_r_unstable comparisonDouglas Bagnall1-1/+2
Credit to OSS-Fuzz. REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69176 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Fri May 31 05:29:08 UTC 2024 on atb-devel-224
2024-05-22lib/fuzzing: add fuzz_strncasecmp_ldbDouglas Bagnall2-0/+166
As well as checking for the usual overflows, this asserts that strncasecmp_ldb is always transitive, by splitting the input into 3 pieces and comparing all pairs. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-22lib/fuzzing: fuzz_stable_sort_r_unstable tries to catch overrunDouglas Bagnall1-2/+11
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-16lib:fuzzing: Fix undefined shiftJo Sutton1-1/+1
../../lib/fuzzing/fuzz_stable_sort_r_unstable.c:47:22: runtime error: left shift of negative value -34 Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-16lib:fuzzing: Remove unused variableJo Sutton1-1/+0
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-07lib/fuzzing: add fuzz_stable_sort_r_unstableDouglas Bagnall2-0/+99
This should find out how well stable_sort copes with an unstable non-transitive comparison function. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-16lib: Give lib/util/util_file.c its own header fileVolker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Martin Schwenke <mschwenke@ddn.com>
2024-04-10lib/fuzzing/decode_ndr_X_crash: guess the pipe from filenameDouglas Bagnall1-2/+10
Usually we are dealing with a filename that tells you what the pipe is, and there is no reason for this debug helper not to be convenient BUG: https://bugzilla.samba.org/show_bug.cgi?id=15625 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-22fuzz:fuzz_ndr_X: don't skip printing on push errorDouglas Bagnall1-2/+8
push should not have changed the struct, so it is valid to try to print it also. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-22fuzz:_conditional_ace_blob discards a constDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-22fuzz:fuzz_conditional_ace_blob lets long generated SDDL failDouglas Bagnall1-1/+12
This can legitimately fail, due to e.g. integers being interpreted as local attributes due to their position (the original data is complete nonsense, bravely decompiled by sddl_from_conditional_ace). In the example found the original begins like 00000000 61 72 74 78 02 00 00 00 00 00 00 00 00 03 01 02 |artx............| 00000010 f7 ff ff ff ff ff ff ff 03 01 a1 02 00 3b 00 00 |.............;..| 00000020 00 00 00 00 03 01 a1 02 00 3b 00 00 00 00 00 00 |.........;......| 00000030 03 01 02 a5 ff ff ff ff ff ff ff 03 01 a1 02 78 |...............x| 00000040 00 00 00 00 00 00 00 03 01 85 02 00 3b 00 00 00 |............;...| 00000050 00 00 00 03 01 a1 02 00 3b 00 00 00 00 00 00 03 |........;.......| 00000060 01 02 a5 00 00 00 00 00 00 00 03 01 81 02 00 00 |................| 00000070 00 00 00 00 00 00 03 01 81 02 00 3b 00 00 00 00 |...........;....| while the SDDL cycled version looks like 00000000 61 72 74 78 f8 04 00 00 00 30 00 30 00 f8 2e 00 |artx.....0.0....| 00000010 00 00 30 00 31 00 37 00 37 00 37 00 37 00 37 00 |..0.1.7.7.7.7.7.| 00000020 37 00 37 00 37 00 37 00 37 00 37 00 37 00 37 00 |7.7.7.7.7.7.7.7.| 00000030 37 00 37 00 37 00 37 00 37 00 37 00 36 00 37 00 |7.7.7.7.7.7.6.7.| 00000040 a1 f8 0c 00 00 00 30 00 33 00 35 00 34 00 30 00 |......0.3.5.4.0.| 00000050 30 00 a1 f8 0c 00 00 00 30 00 33 00 35 00 34 00 |0.......0.3.5.4.| 00000060 30 00 30 00 f8 2e 00 00 00 30 00 31 00 37 00 37 |0.0......0.1.7.7| 00000070 00 37 00 37 00 37 00 37 00 37 00 37 00 37 00 37 |.7.7.7.7.7.7.7.7| and this new interpretation ends up being more than 10000 bytes long, so the conversion fails. The SDDL ends up looking like this: (((((((((((00) || (01777777777777777777767)) || (035400)) || \ (((((((((((((((((((((((((((((((((((035400) || (01777777777777777777645)) \ >= 0170) || (035400)) || (((((((((((((((((((((((((((((((035400 != 0245) [...] where all the octal digits on the left hand side of operators are UTF-16 strings. REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65322 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-22fuzzing: fuzz_ndr_X ndr_print does printingDouglas Bagnall1-7/+13
By printing into a buffer, we might notice some errors. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-22fuzz: allow max size conditional ACE round-trip failureDouglas Bagnall1-0/+11
The encoder, being cautious not to overstep the arbitrary 10000 byte boundary, might not encode an exactly 10000 byte condition. This is an off-by-one, but in the safe direction. Credit to OSS-Fuzz. REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65118 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri Dec 22 00:51:13 UTC 2023 on atb-devel-224
2023-12-08lib/fuzzing: Fix code spellingJoseph Sutton2-2/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-09libcli/security: Optionally disallow device‐specific attributes and ↵Joseph Sutton2-0/+3
operators where they are not applicable Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-01librpc:ndr: Introduce ‘ndr_flags_type’ typeJoseph Sutton1-1/+1
Instead of ‘int’ or ‘uint32_t’, neither of which convey much meaning, consistently use a newly added type to hold NDR_ flags. Update the NDR 4.0.0 ABI. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-11-01librpc:ndr: Introduce ‘libndr_flags’ typeJoseph Sutton1-1/+1
The LIBNDR_FLAG_ namespace is getting dangerously full, with only a single flag value (1 << 9) remaining for use. After that flag is put into use, we won’t be able to add any new flags without increasing the flag width to 64‐bit. Up to now we’ve used a haphazard mix of int, unsigned, and uint32_t to store these flags. Introduce a new type, ‘libndr_flags’, to be used consistently to hold LIBNDR flags. If in the future we find we need to move to 64‐bit flags, this type gives us an opportunity to do that. Bump the NDR version to 4.0.0 — an major version increment, for we’re changing the function ABI and adding the new symbol ndr_print_libndr_flags. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-10-25lib/fuzzing: Fix code spellingJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26fuzzing: fuzz_sddl_parse forgives bad utf-8Douglas Bagnall1-0/+23
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26lib/fuzzing: fuzz_sddl_parse: allow non-round-trip with long stringsDouglas Bagnall1-0/+22
There is a borderline case where a conditional ACE unicode string becomes longer than the SDDL parser wants to handle when control characters are given canonical escaping. This can make the round trip fail, but it isn't really a problem. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26lib/fuzzing: adjust access-check seed patchDouglas Bagnall1-12/+15
Now that access_check.c includes headers for conditional ACEs, the patch should take that into account. Also, we check for a talloc failure. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26lib/fuzzing: fuzz_conditional_ace_blobDouglas Bagnall2-0/+149
This parses the blob as a conditional ACE, and if possible tries decompiling it into SDDL. There are not many round-trip assertions we can honestly make, but we keep the trip going as long as possible, in case it reveals anything. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26lib/fuzzing: adapt fuzz_sddl_access_check for claimsDouglas Bagnall1-10/+72
The token has more stuff in it. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26lib/fuzzing: fuzz SDDL conditional ACEsDouglas Bagnall1-0/+119
Here we're not compiling the whole SD, just the single conditional ACE. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-08fuzz: add fuzzer for ldb_comparison_foldDouglas Bagnall2-0/+63
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-08fuzz: add fuzzer for sess_crypt_blobDouglas Bagnall2-0/+60
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-08lib/fuzzing:fuzz_sddl_access_check fix nul-term checkDouglas Bagnall1-1/+1
We were wanting to ensure the string contains a zero byte, but instead were checking for a non-zero byte. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-08lib/fuzzing: LLVMFuzzerTestOneInput() takes const uint8_t*Douglas Bagnall27-27/+27
We have been using `uint8_t *`, which works fine as far as linking goes, but leads fuzz target developers to sometimes forget why they can't just modify the passed in string instead of copying it for modification (e.g. to NUL-terminate). REF: https://llvm.org/docs/LibFuzzer.html#fuzz-target Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-03lib:fuzzing: Fix code spellingAndreas Schneider1-2/+2
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-07-28librpc/idl: Remove DCOM and WMI IDLAndrew Bartlett1-29/+0
As hinted in f2416493c0c779356606aebf0aceca8fa416b55c the DCOM and WMI IDL is now unused. These generate code with PIDL, costing a small amount of build time but more importantly are fuzzed, which costs an ongoing amount of CPU time as oss-fuzz tries to find parsing issues. We do not need to continue this waste, and these can be restored if this effort is ever to start again. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2023-07-19lib/fuzzing: patch for collecting fuzz_security_token_vs_descriptor seedsDouglas Bagnall1-0/+253
If this patch is applied, and an environment variable is set, all access_check calls will be recorded as seeds for fuzz_security_token_vs_descriptor. See the patch for details. You probably will never want to apply this patch, but it is here just in case. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19lib/fuzzing: adapt fuzz_sddl_access_check for AD variantDouglas Bagnall2-0/+25
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19lib/fuzzing: adapt fuzz_security_token_vs_descriptor for AD variantDouglas Bagnall2-0/+24
This of course doesn't exercise the object tree or default SID code, but it still covers a lot to the *_ds access_check functions. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19lib/fuzzing: add fuzzer for arbitrary token/sd access checksDouglas Bagnall2-0/+66
The token and descriptor are stored in NDR format; for this purpose we add a new IDL struct containing this pair (along with a desired access mask). An upcoming commit will show how to collect seeds for this fuzzer. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19lib/fuzzing: add fuzz_sddl_access_checkDouglas Bagnall2-0/+130
This fuzzer parses SDDL into a security descriptor and runs an access check on it using a known security token. This is purely for crash detection -- we don't know enough to assert whether the check should succeed or not. The seed strings used are compatible with those of fuzz_sddl_parse -- anything found by fuzz_sddl_parse is worth trying as a seed here, and vice versa. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-28lib/fuzzing: add fuzzer for sddl_parseDouglas Bagnall2-0/+70
Apart from catching crashes in the actual parsing, we abort if the SD we end up with will not round trip back through SDDL to an identical SD. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-03lib:fuzzing: Fix code spellingAndreas Schneider3-5/+5
Best reviewed with: `git show --word-diff`. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-19fuzz: fix lzxpress plain round-trip fuzzerDouglas Bagnall1-1/+4
The 'compressed' string can be about 9/8 the size of the decompressed string, but we didn't allow enough memory in the fuzz target for that. Then when it failed, we didn't check. Credit to OSSFuzz. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-12-01fuzz: add fuzz_lzxpress_huffman_round_tripDouglas Bagnall2-0/+73
This compresses some data, decompresses it, and asserts that the result is identical to the original string. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-12-01fuzz: add fuzz_lzxpress_huffman_compressDouglas Bagnall2-0/+63
This differs from fuzz_lzxpress_huffman_round_trip (next commit) in that the output buffer might be too small for the compressed data, in which case we want to see an error and not a crash. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-12-01fuzz: add fuzz_lzxpress_huffman_decompressDouglas Bagnall2-0/+53
Most strings will not successfully decompress, which is OK. What we care about of course is memory safety. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-12-01fuzz: add fuzzers for stable_sortDouglas Bagnall3-0/+167
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-08-17lib:fuzzing: Fix shellcheck errors in build_samba.shAndreas Schneider1-2/+2
lib/fuzzing/oss-fuzz/build_samba.sh:24:27: error: Double quote array expansions to avoid re-splitting elements. [SC2068] Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Pavel Filipenský <pfilipensky@samba.org>
2022-05-12fuzz: add lzxpress compress/decompress round-tripDouglas Bagnall2-0/+58
We say it is an error to end up at a different result. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-05-12fuzz: add fuzz_lzxpress_compressDouglas Bagnall2-0/+40
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-29lib/fuzzing/README.md: don't use waf directlyStefan Metzmacher1-6/+6
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-02-24lib:fuzzing: Reformat shell scriptsAndreas Schneider3-67/+65
shfmt -f lib/fuzzing/ | xargs shfmt -w -p -i 0 -fn Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-12-10s3:rpc_server: Activate samba-dcerpcdVolker Lendecke1-1/+1
This is the big switch to use samba-dcerpcd for the RPC services in source3/. It is a pretty big and unordered patch, but I don't see a good way to split this up into more manageable pieces without sacrificing bisectability even more. Probably I could cut out a few small ones, but a major architechtural switch like this will always be messy. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Samuel Cabrero <scabrero@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 18:34:49 +0000