diff options
author | android-build-team Robot <android-build-team-robot@google.com> | 2021-06-21 14:48:34 +0000 |
---|---|---|
committer | android-build-team Robot <android-build-team-robot@google.com> | 2021-06-21 14:48:34 +0000 |
commit | 2ee8a4e6227a1415a57eb7a30af108a2442ff4c0 (patch) | |
tree | f6e1e64a91647161c26338b6205f3f9655476a01 | |
parent | 829b4113d970aeec2fcb6acecd3631624c48acd4 (diff) | |
parent | 13cd8780df1c2f0a7dd02f0510a86b6271397af1 (diff) | |
download | libprotobuf-mutator-2ee8a4e6227a1415a57eb7a30af108a2442ff4c0.tar.gz |
Snap for 7478067 from 13cd8780df1c2f0a7dd02f0510a86b6271397af1 to mainline-extservices-releaseandroid-mainline-12.0.0_r9android-mainline-12.0.0_r87android-mainline-12.0.0_r72android-mainline-12.0.0_r44android-mainline-12.0.0_r27android-mainline-12.0.0_r117android-mainline-12.0.0_r102android12-mainline-extservices-release
Change-Id: I3bce6378465f14c0e3601bba6882bd7b5b8c9340
-rw-r--r-- | .travis.yml | 9 | ||||
-rw-r--r-- | Android.bp | 17 | ||||
-rw-r--r-- | CMakeLists.txt | 5 | ||||
-rw-r--r-- | METADATA | 6 | ||||
-rw-r--r-- | NOTICE | 202 | ||||
-rw-r--r-- | README.md | 15 | ||||
-rw-r--r-- | cmake/external/googletest.cmake | 3 | ||||
-rw-r--r-- | cmake/external/protobuf.cmake | 3 | ||||
-rw-r--r-- | examples/libfuzzer/libfuzzer_bin_example.cc | 47 | ||||
-rw-r--r-- | examples/libfuzzer/libfuzzer_example.cc | 47 | ||||
-rw-r--r-- | libprotobuf-mutator.pc.in | 3 | ||||
-rw-r--r-- | libprotobuf-mutatorConfig.cmake.in | 5 | ||||
-rw-r--r-- | port/gtest.h | 1 | ||||
-rw-r--r-- | src/CMakeLists.txt | 4 | ||||
-rw-r--r-- | src/libfuzzer/CMakeLists.txt | 4 | ||||
-rw-r--r-- | src/libfuzzer/libfuzzer_macro.cc | 42 | ||||
-rw-r--r-- | src/libfuzzer/libfuzzer_mutator.cc | 5 | ||||
-rw-r--r-- | src/libfuzzer/libfuzzer_test.cc | 79 | ||||
-rw-r--r-- | src/mutator.cc | 12 | ||||
-rw-r--r-- | src/mutator.h | 3 | ||||
-rw-r--r-- | src/mutator_test.cc | 14 | ||||
-rw-r--r-- | src/text_format.cc | 1 |
22 files changed, 251 insertions, 276 deletions
diff --git a/.travis.yml b/.travis.yml index 731b74a..92a1ebe 100644 --- a/.travis.yml +++ b/.travis.yml @@ -43,6 +43,12 @@ matrix: - env: BUILD_TYPE=Debug CC_COMPILER=gcc-${GCC_VERSION} CXX_COMPILER=g++-${GCC_VERSION} addons: *gcc + - env: + install: + before_script: + script: + - travis_retry wget --quiet -O - https://raw.githubusercontent.com/cpplint/cpplint/master/cpplint.py | python - --recursive src examples + install: - mkdir -p deps && cd deps - travis_retry wget --no-check-certificate --quiet -O - https://cmake.org/files/v3.12/cmake-3.12.3-Linux-x86_64.tar.gz | tar --strip-components=1 -xz @@ -50,7 +56,6 @@ install: - cd - before_script: - - travis_retry wget --quiet -O - https://raw.githubusercontent.com/cpplint/cpplint/master/cpplint.py | python - --recursive src examples - mkdir -p build && cd build - rm -rf * - cmake .. -GNinja -DLIB_PROTO_MUTATOR_WITH_ASAN=ON -DLIB_PROTO_MUTATOR_DOWNLOAD_PROTOBUF=ON -DCMAKE_C_COMPILER=${CC_COMPILER} -DCMAKE_CXX_COMPILER=${CXX_COMPILER} -DCMAKE_BUILD_TYPE=${BUILD_TYPE} -DCMAKE_INSTALL_PREFIX=/usr @@ -59,4 +64,4 @@ script: - export ASAN_OPTIONS=detect_leaks=0 - ninja - ninja check - - DESTDIR="/tmp/testing/" ninja install + - DESTDIR="/tmp/testing/" ninja install
\ No newline at end of file @@ -14,6 +14,23 @@ * limitations under the License. */ +package { + default_applicable_licenses: ["external_libprotobuf-mutator_license"], +} + +// Added automatically by a large-scale-change +// See: http://go/android-license-faq +license { + name: "external_libprotobuf-mutator_license", + visibility: [":__subpackages__"], + license_kinds: [ + "SPDX-license-identifier-Apache-2.0", + ], + license_text: [ + "LICENSE", + ], +} + cc_library { name: "libprotobuf-mutator", host_supported: true, diff --git a/CMakeLists.txt b/CMakeLists.txt index d9be154..a8fe9e6 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -150,6 +150,11 @@ if (NOT "${LIB_PROTO_MUTATOR_FUZZER_LIBRARIES}" STREQUAL "" OR add_subdirectory(examples EXCLUDE_FROM_ALL) endif() +install(EXPORT libprotobuf-mutatorTargets FILE libprotobuf-mutatorTargets.cmake + NAMESPACE libprotobuf-mutator:: DESTINATION lib/cmake/libprotobuf-mutator) +configure_file(libprotobuf-mutatorConfig.cmake.in libprotobuf-mutatorConfig.cmake @ONLY) +install(FILES "${CMAKE_CURRENT_BINARY_DIR}/libprotobuf-mutatorConfig.cmake" + DESTINATION lib/cmake/libprotobuf-mutator) configure_file("libprotobuf-mutator.pc.in" "libprotobuf-mutator.pc" @ONLY) install(FILES "${CMAKE_BINARY_DIR}/libprotobuf-mutator.pc" DESTINATION ${PKG_CONFIG_PATH}) @@ -5,11 +5,11 @@ third_party { type: GIT value: "https://github.com/google/libprotobuf-mutator" } - version: "3521f47a2828da9ace403e4ecc4aece1a84feb36" + version: "e5869dd9690c3f4dfb842fb90bd07a5a9ee32172" license_type: NOTICE last_upgrade_date { year: 2020 - month: 2 - day: 7 + month: 12 + day: 2 } } @@ -1,202 +0,0 @@ - - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS - - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright [yyyy] [name of copyright owner] - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. @@ -98,18 +98,23 @@ PostProcessorRegistration can be used to avoid such issue and guide your fuzzer code. It registers callback which will be called for each message of particular type after each mutation. ``` -DEFINE_PROTO_FUZZER(const MyMessageType& input) { - static PostProcessorRegistration reg = { - [](MyMessageType* message, unsigned int seed) { - TweakMyMessage(message, seed); - }}; +static protobuf_mutator::libfuzzer::PostProcessorRegistration<MyMessageType> reg = { + [](MyMessageType* message, unsigned int seed) { + TweakMyMessage(message, seed); + }}; +DEFINE_PROTO_FUZZER(const MyMessageType& input) { // Code which needs to be fuzzed. ConsumeMyMessageType(input); } ``` Optional: Use seed if callback uses random numbers. It may help later with debugging. +Important: Callbacks should be deterministic and avoid modifying good messages. +Callbacks are called for both: mutator generated and user provided inputs, like +corpus or bug reproducer. So if callback performs unnecessary transformation it +may corrupt the reproducer so it stops triggering the bug. + Note: You can add callback for any nested message and you can add multiple callbacks for the same message type. ``` diff --git a/cmake/external/googletest.cmake b/cmake/external/googletest.cmake index fe71115..825ff9a 100644 --- a/cmake/external/googletest.cmake +++ b/cmake/external/googletest.cmake @@ -18,7 +18,7 @@ set(GTEST_INSTALL_DIR ${CMAKE_CURRENT_BINARY_DIR}/${GTEST_TARGET}) set(GTEST_INCLUDE_DIRS ${GTEST_INSTALL_DIR}/include) include_directories(${GTEST_INCLUDE_DIRS}) -set(GTEST_LIBRARIES gtest) +set(GTEST_LIBRARIES gtest gmock) set(GTEST_MAIN_LIBRARIES gtest_main) set(GTEST_BOTH_LIBRARIES ${GTEST_LIBRARIES} ${GTEST_MAIN_LIBRARIES}) @@ -50,5 +50,6 @@ ExternalProject_Add(${GTEST_TARGET} -DCMAKE_CXX_COMPILER:FILEPATH=${CMAKE_CXX_COMPILER} CMAKE_ARGS ${CMAKE_ARGS} -DCMAKE_INSTALL_PREFIX=${GTEST_INSTALL_DIR} + -DCMAKE_INSTALL_LIBDIR=lib BUILD_BYPRODUCTS ${GTEST_BUILD_BYPRODUCTS} ) diff --git a/cmake/external/protobuf.cmake b/cmake/external/protobuf.cmake index 50277b6..0b64519 100644 --- a/cmake/external/protobuf.cmake +++ b/cmake/external/protobuf.cmake @@ -63,11 +63,12 @@ include (ExternalProject) ExternalProject_Add(${PROTOBUF_TARGET} PREFIX ${PROTOBUF_TARGET} GIT_REPOSITORY https://github.com/google/protobuf.git - GIT_TAG 1363bf9c051af36c555c23d734a204246c215697 + GIT_TAG 214c77e1b76e63e512bd675d1c300c80438642b6 UPDATE_COMMAND "" CONFIGURE_COMMAND ${CMAKE_COMMAND} ${PROTOBUF_INSTALL_DIR}/src/${PROTOBUF_TARGET}/cmake -G${CMAKE_GENERATOR} -DCMAKE_INSTALL_PREFIX=${PROTOBUF_INSTALL_DIR} + -DCMAKE_INSTALL_LIBDIR=lib -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE} -DCMAKE_POSITION_INDEPENDENT_CODE=ON -DCMAKE_C_COMPILER:FILEPATH=${CMAKE_C_COMPILER} diff --git a/examples/libfuzzer/libfuzzer_bin_example.cc b/examples/libfuzzer/libfuzzer_bin_example.cc index 560bcb3..963b522 100644 --- a/examples/libfuzzer/libfuzzer_bin_example.cc +++ b/examples/libfuzzer/libfuzzer_bin_example.cc @@ -13,6 +13,7 @@ // limitations under the License. #include <cmath> +#include <iostream> #include "examples/libfuzzer/libfuzzer_example.pb.h" #include "port/protobuf.h" @@ -20,32 +21,30 @@ protobuf_mutator::protobuf::LogSilencer log_silincer; -DEFINE_BINARY_PROTO_FUZZER(const libfuzzer_example::Msg& message) { - static PostProcessorRegistration reg = { - [](libfuzzer_example::Msg* message, unsigned int seed) { - if (seed % 2) { - message->set_optional_uint64( - std::hash<std::string>{}(message->optional_string())); - } - - if (message->has_any()) { - auto* any = message->mutable_any(); - - // Guide mutator to usefull 'Any' types. - static const char* const expected_types[] = { - "type.googleapis.com/google.protobuf.DescriptorProto", - "type.googleapis.com/google.protobuf.FileDescriptorProto", - }; - - if (!std::count(std::begin(expected_types), std::end(expected_types), - any->type_url())) { - const size_t num = - (std::end(expected_types) - std::begin(expected_types)); - any->set_type_url(expected_types[seed % num]); - } +protobuf_mutator::libfuzzer::PostProcessorRegistration<libfuzzer_example::Msg> + reg = {[](libfuzzer_example::Msg* message, unsigned int seed) { + message->set_optional_uint64( + std::hash<std::string>{}(message->optional_string())); + + if (message->has_any()) { + auto* any = message->mutable_any(); + + // Guide mutator to usefull 'Any' types. + static const char* const expected_types[] = { + "type.googleapis.com/google.protobuf.DescriptorProto", + "type.googleapis.com/google.protobuf.FileDescriptorProto", + }; + + if (!std::count(std::begin(expected_types), std::end(expected_types), + any->type_url())) { + const size_t num = + (std::end(expected_types) - std::begin(expected_types)); + any->set_type_url(expected_types[seed % num]); } - }}; + } + }}; +DEFINE_BINARY_PROTO_FUZZER(const libfuzzer_example::Msg& message) { protobuf_mutator::protobuf::FileDescriptorProto file; // Emulate a bug. diff --git a/examples/libfuzzer/libfuzzer_example.cc b/examples/libfuzzer/libfuzzer_example.cc index 6eab362..aa65125 100644 --- a/examples/libfuzzer/libfuzzer_example.cc +++ b/examples/libfuzzer/libfuzzer_example.cc @@ -13,6 +13,7 @@ // limitations under the License. #include <cmath> +#include <iostream> #include "examples/libfuzzer/libfuzzer_example.pb.h" #include "port/protobuf.h" @@ -20,32 +21,30 @@ protobuf_mutator::protobuf::LogSilencer log_silincer; -DEFINE_PROTO_FUZZER(const libfuzzer_example::Msg& message) { - static PostProcessorRegistration reg = { - [](libfuzzer_example::Msg* message, unsigned int seed) { - if (seed % 2) { - message->set_optional_uint64( - std::hash<std::string>{}(message->optional_string())); - } - - if (message->has_any()) { - auto* any = message->mutable_any(); - - // Guide mutator to usefull 'Any' types. - static const char* const expected_types[] = { - "type.googleapis.com/google.protobuf.DescriptorProto", - "type.googleapis.com/google.protobuf.FileDescriptorProto", - }; - - if (!std::count(std::begin(expected_types), std::end(expected_types), - any->type_url())) { - const size_t num = - (std::end(expected_types) - std::begin(expected_types)); - any->set_type_url(expected_types[seed % num]); - } +protobuf_mutator::libfuzzer::PostProcessorRegistration<libfuzzer_example::Msg> + reg = {[](libfuzzer_example::Msg* message, unsigned int seed) { + message->set_optional_uint64( + std::hash<std::string>{}(message->optional_string())); + + if (message->has_any()) { + auto* any = message->mutable_any(); + + // Guide mutator to usefull 'Any' types. + static const char* const expected_types[] = { + "type.googleapis.com/google.protobuf.DescriptorProto", + "type.googleapis.com/google.protobuf.FileDescriptorProto", + }; + + if (!std::count(std::begin(expected_types), std::end(expected_types), + any->type_url())) { + const size_t num = + (std::end(expected_types) - std::begin(expected_types)); + any->set_type_url(expected_types[seed % num]); } - }}; + } + }}; +DEFINE_PROTO_FUZZER(const libfuzzer_example::Msg& message) { protobuf_mutator::protobuf::FileDescriptorProto file; // Emulate a bug. diff --git a/libprotobuf-mutator.pc.in b/libprotobuf-mutator.pc.in index ac5224e..551dc72 100644 --- a/libprotobuf-mutator.pc.in +++ b/libprotobuf-mutator.pc.in @@ -1,8 +1,9 @@ prefix=@CMAKE_INSTALL_PREFIX@ +libdir=${prefix}/lib includedir=${prefix}/include/libprotobuf-mutator Name: libprotobuf-mutator Description: randomly mutate protobuffers for fuzzing Version: 0 Cflags: -I${includedir} -I${includedir}/src -Libs: -lprotobuf-mutator-libfuzzer -lprotobuf-mutator +Libs: -L${libdir} -lprotobuf-mutator-libfuzzer -lprotobuf-mutator diff --git a/libprotobuf-mutatorConfig.cmake.in b/libprotobuf-mutatorConfig.cmake.in new file mode 100644 index 0000000..f62a501 --- /dev/null +++ b/libprotobuf-mutatorConfig.cmake.in @@ -0,0 +1,5 @@ +include(CMakeFindDependencyMacro) + +find_dependency(Protobuf REQUIRED) + +include("${CMAKE_CURRENT_LIST_DIR}/libprotobuf-mutatorTargets.cmake") diff --git a/port/gtest.h b/port/gtest.h index 485aa98..60d50b8 100644 --- a/port/gtest.h +++ b/port/gtest.h @@ -15,6 +15,7 @@ #ifndef PORT_GTEST_H_ #define PORT_GTEST_H_ +#include "gmock/gmock.h" #include "gtest/gtest.h" #endif // PORT_GTEST_H_ diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index 19f4406..d0af1b6 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -60,5 +60,7 @@ if (LIB_PROTO_MUTATOR_TESTING) endif() install(TARGETS protobuf-mutator + EXPORT libprotobuf-mutatorTargets ARCHIVE DESTINATION ${LIB_DIR} - LIBRARY DESTINATION ${LIB_DIR}) + LIBRARY DESTINATION ${LIB_DIR} + INCLUDES DESTINATION include/libprotobuf-mutator include/libprotobuf-mutator/src) diff --git a/src/libfuzzer/CMakeLists.txt b/src/libfuzzer/CMakeLists.txt index 8fc78e6..85e9f4d 100644 --- a/src/libfuzzer/CMakeLists.txt +++ b/src/libfuzzer/CMakeLists.txt @@ -23,8 +23,10 @@ set_target_properties(protobuf-mutator-libfuzzer PROPERTIES SOVERSION 0) install(TARGETS protobuf-mutator-libfuzzer + EXPORT libprotobuf-mutatorTargets ARCHIVE DESTINATION ${LIB_DIR} - LIBRARY DESTINATION ${LIB_DIR}) + LIBRARY DESTINATION ${LIB_DIR} + INCLUDES DESTINATION include/libprotobuf-mutator include/libprotobuf-mutator/src) if (LIB_PROTO_MUTATOR_TESTING) add_executable(libfuzzer_test diff --git a/src/libfuzzer/libfuzzer_macro.cc b/src/libfuzzer/libfuzzer_macro.cc index b2a5302..4e506cb 100644 --- a/src/libfuzzer/libfuzzer_macro.cc +++ b/src/libfuzzer/libfuzzer_macro.cc @@ -15,6 +15,8 @@ #include "src/libfuzzer/libfuzzer_macro.h" #include <algorithm> +#include <memory> +#include <vector> #include "src/binary_format.h" #include "src/libfuzzer/libfuzzer_mutator.h" @@ -91,6 +93,35 @@ class BinaryOutputWriter : public OutputWriter { } }; +class LastMutationCache { + public: + void Store(const uint8_t* data, size_t size, protobuf::Message* message) { + if (!message_) message_.reset(message->New()); + message->GetReflection()->Swap(message, message_.get()); + data_.assign(data, data + size); + } + + bool LoadIfSame(const uint8_t* data, size_t size, + protobuf::Message* message) { + if (!message_ || size != data_.size() || + !std::equal(data_.begin(), data_.end(), data)) + return false; + + message->GetReflection()->Swap(message, message_.get()); + message_.reset(); + return true; + } + + private: + std::vector<uint8_t> data_; + std::unique_ptr<protobuf::Message> message_; +}; + +LastMutationCache* GetCache() { + static LastMutationCache cache; + return &cache; +} + Mutator* GetMutator() { static Mutator mutator; return &mutator; @@ -111,6 +142,7 @@ size_t MutateMessage(unsigned int seed, const InputReader& input, GetMutator()->Mutate(message, max_size); if (size_t new_size = output->Write(*message)) { assert(new_size <= output->size()); + GetCache()->Store(output->data(), new_size, message); return new_size; } return 0; @@ -127,6 +159,7 @@ size_t CrossOverMessages(unsigned int seed, const InputReader& input1, GetMutator()->CrossOver(*message2, message1, max_size); if (size_t new_size = output->Write(*message1)) { assert(new_size <= output->size()); + GetCache()->Store(output->data(), new_size, message1); return new_size; } return 0; @@ -189,8 +222,13 @@ size_t CustomProtoCrossOver(bool binary, const uint8_t* data1, size_t size1, bool LoadProtoInput(bool binary, const uint8_t* data, size_t size, protobuf::Message* input) { - return binary ? ParseBinaryMessage(data, size, input) - : ParseTextMessage(data, size, input); + if (GetCache()->LoadIfSame(data, size, input)) return true; + auto result = binary ? ParseBinaryMessage(data, size, input) + : ParseTextMessage(data, size, input); + if (!result) return false; + GetMutator()->Seed(size); + GetMutator()->Fix(input); + return true; } void RegisterPostProcessor( diff --git a/src/libfuzzer/libfuzzer_mutator.cc b/src/libfuzzer/libfuzzer_mutator.cc index c8bca64..34d144c 100644 --- a/src/libfuzzer/libfuzzer_mutator.cc +++ b/src/libfuzzer/libfuzzer_mutator.cc @@ -89,9 +89,8 @@ std::string Mutator::MutateString(const std::string& value, // any 8 bit types. if (!std::uniform_int_distribution<uint16_t>(0, 20)(*random())) return {}; std::string result = value; - result.resize(value.size() + - std::max<int>(-value.size(), size_increase_hint)); - if (result.empty()) result.push_back(0); + int new_size = value.size() + size_increase_hint; + result.resize(std::max(1, new_size)); result.resize(LLVMFuzzerMutate(reinterpret_cast<uint8_t*>(&result[0]), value.size(), result.size())); return result; diff --git a/src/libfuzzer/libfuzzer_test.cc b/src/libfuzzer/libfuzzer_test.cc index 180a02c..f19eb12 100644 --- a/src/libfuzzer/libfuzzer_test.cc +++ b/src/libfuzzer/libfuzzer_test.cc @@ -13,16 +13,85 @@ // limitations under the License. #include "port/gtest.h" +#include "port/protobuf.h" #include "src/libfuzzer/libfuzzer_macro.h" #include "src/mutator_test_proto2.pb.h" -static bool reached = false; +using protobuf_mutator::protobuf::util::MessageDifferencer; +using ::testing::_; +using ::testing::AllOf; +using ::testing::DoAll; +using ::testing::Ref; +using ::testing::SaveArg; +using ::testing::SaveArgPointee; +using ::testing::StrictMock; -DEFINE_PROTO_FUZZER(const protobuf_mutator::Msg::EmptyMessage& message) { - reached = true; +static class MockFuzzer* mock_fuzzer; + +class MockFuzzer { + public: + MockFuzzer() { mock_fuzzer = this; } + ~MockFuzzer() { mock_fuzzer = nullptr; } + MOCK_METHOD(void, PostProcess, + (protobuf_mutator::Msg * message, unsigned int seed)); + MOCK_METHOD(void, TestOneInput, (const protobuf_mutator::Msg& message)); +}; + +protobuf_mutator::libfuzzer::PostProcessorRegistration<protobuf_mutator::Msg> + reg = {[](protobuf_mutator::Msg* message, unsigned int seed) { + mock_fuzzer->PostProcess(message, seed); + }}; + +DEFINE_TEXT_PROTO_FUZZER(const protobuf_mutator::Msg& message) { + mock_fuzzer->TestOneInput(message); } -TEST(LibFuzzerTest, Basic) { +MATCHER_P(IsMessageEq, msg, "") { + return MessageDifferencer::Equals(arg, msg.get()); +} +MATCHER(IsInitialized, "") { return arg.IsInitialized(); } + +TEST(LibFuzzerTest, LLVMFuzzerTestOneInput) { + unsigned int seed = 0; + testing::StrictMock<MockFuzzer> mock; + protobuf_mutator::Msg msg; + EXPECT_CALL(mock, PostProcess(_, _)) + .WillOnce(DoAll(SaveArgPointee<0>(&msg), SaveArg<1>(&seed))); + EXPECT_CALL( + mock, TestOneInput(AllOf(IsMessageEq(std::cref(msg)), IsInitialized()))); + LLVMFuzzerTestOneInput((const uint8_t*)"", 0); + + EXPECT_CALL(mock, PostProcess(_, seed)).WillOnce(SaveArgPointee<0>(&msg)); + EXPECT_CALL( + mock, TestOneInput(AllOf(IsMessageEq(std::cref(msg)), IsInitialized()))); LLVMFuzzerTestOneInput((const uint8_t*)"", 0); - EXPECT_TRUE(reached); +} + +TEST(LibFuzzerTest, LLVMFuzzerCustomMutator) { + testing::StrictMock<MockFuzzer> mock; + protobuf_mutator::Msg msg; + EXPECT_CALL(mock, PostProcess(_, _)).WillOnce(SaveArgPointee<0>(&msg)); + EXPECT_CALL( + mock, TestOneInput(AllOf(IsMessageEq(std::cref(msg)), IsInitialized()))); + + uint8_t buff[1024] = {}; + size_t size = LLVMFuzzerCustomMutator(buff, 0, sizeof(buff), 5); + ASSERT_GT(size, 0U); + LLVMFuzzerTestOneInput(buff, size); +} + +TEST(LibFuzzerTest, LLVMFuzzerCustomCrossOver) { + testing::StrictMock<MockFuzzer> mock; + protobuf_mutator::Msg msg; + EXPECT_CALL(mock, PostProcess(_, _)).WillOnce(SaveArgPointee<0>(&msg)); + EXPECT_CALL( + mock, TestOneInput(AllOf(IsMessageEq(std::cref(msg)), IsInitialized()))); + + uint8_t buff1[1024] = {}; + uint8_t buff2[1024] = {}; + uint8_t buff3[1024] = {}; + size_t size = + LLVMFuzzerCustomCrossOver(buff1, 0, buff2, 0, buff3, sizeof(buff3), 6); + ASSERT_GT(size, 0U); + LLVMFuzzerTestOneInput(buff3, size); } diff --git a/src/mutator.cc b/src/mutator.cc index 45acd48..fb5542b 100644 --- a/src/mutator.cc +++ b/src/mutator.cc @@ -16,6 +16,7 @@ #include <algorithm> #include <bitset> +#include <iostream> #include <map> #include <memory> #include <random> @@ -55,7 +56,7 @@ enum class Mutation : uint8_t { Last = Clone, }; -using MutationBitset = std::bitset<static_cast<size_t>(Mutation::Last)>; +using MutationBitset = std::bitset<static_cast<size_t>(Mutation::Last) + 1>; using Messages = std::vector<Message*>; using ConstMessages = std::vector<const Message*>; @@ -624,6 +625,15 @@ struct CreateField : public FieldFunction<CreateField> { void Mutator::Seed(uint32_t value) { random_.seed(value); } +void Mutator::Fix(Message* message) { + UnpackedAny any; + UnpackAny(*message, &any); + + PostProcessing(keep_initialized_, post_processors_, any, &random_) + .Run(message, kMaxInitializeDepth); + assert(IsInitialized(*message)); +} + void Mutator::Mutate(Message* message, size_t max_size_hint) { UnpackedAny any; UnpackAny(*message, &any); diff --git a/src/mutator.h b/src/mutator.h index 57c7c47..afb6940 100644 --- a/src/mutator.h +++ b/src/mutator.h @@ -60,6 +60,9 @@ class Mutator { void CrossOver(const protobuf::Message& message1, protobuf::Message* message2, size_t max_size_hint); + // Makes message initialized and calls post processors to make it valid. + void Fix(protobuf::Message* message); + // Callback to postprocess mutations. // Implementation should use seed to initialize random number generators. using PostProcess = diff --git a/src/mutator_test.cc b/src/mutator_test.cc index fe93181..312b2d9 100644 --- a/src/mutator_test.cc +++ b/src/mutator_test.cc @@ -293,6 +293,14 @@ const char kOptionalInDeepAnyFields[] = R"( } )"; +const char kUnknownFieldInput[] = R"( + optional_bool: true + unknown_field: "test unknown field" +)"; + +const char kUnknownFieldExpected[] = R"(optional_bool: true +)"; + class TestMutator : public Mutator { public: explicit TestMutator(bool keep_initialized, @@ -668,6 +676,12 @@ TYPED_TEST(MutatorTypedTest, Serialization) { } } +TYPED_TEST(MutatorTypedTest, UnknownFieldTextFormat) { + typename TestFixture::Message parsed; + EXPECT_TRUE(ParseTextMessage(kUnknownFieldInput, &parsed)); + EXPECT_EQ(SaveMessageAsText(parsed), kUnknownFieldExpected); +} + TYPED_TEST(MutatorTypedTest, DeepRecursion) { typename TestFixture::Message message; typename TestFixture::Message* last = &message; diff --git a/src/text_format.cc b/src/text_format.cc index 94e6a79..4479229 100644 --- a/src/text_format.cc +++ b/src/text_format.cc @@ -30,6 +30,7 @@ bool ParseTextMessage(const std::string& data, protobuf::Message* output) { TextFormat::Parser parser; parser.SetRecursionLimit(100); parser.AllowPartialMessage(true); + parser.AllowUnknownField(true); if (!parser.ParseFromString(data, output)) { output->Clear(); return false; |