Skip to content

Commit 9cab819

Browse files
davea42davea42
committed
Source used for testing/fuzzing.
 new file: fuzz/fuzz_aranges.c new file: fuzz/fuzz_crc.c new file: fuzz/fuzz_crc_32.c new file: fuzz/fuzz_debug_addr_access.c new file: fuzz/fuzz_debug_str.c new file: fuzz/fuzz_debuglink.c new file: fuzz/fuzz_die_cu.c new file: fuzz/fuzz_die_cu_attrs.c new file: fuzz/fuzz_die_cu_attrs_loclist.c new file: fuzz/fuzz_die_cu_info1.c new file: fuzz/fuzz_die_cu_offset.c new file: fuzz/fuzz_die_cu_print.c new file: fuzz/fuzz_dnames.c new file: fuzz/fuzz_findfuncbypc.c new file: fuzz/fuzz_gdbindex.c new file: fuzz/fuzz_globals.c new file: fuzz/fuzz_gnu_index.c new file: fuzz/fuzz_init_b.c new file: fuzz/fuzz_init_binary.c new file: fuzz/fuzz_init_path.c new file: fuzz/fuzz_macro_dwarf4.c new file: fuzz/fuzz_macro_dwarf5.c new file: fuzz/fuzz_rng.c new file: fuzz/fuzz_set_frame_all.c new file: fuzz/fuzz_showsectgrp.c new file: fuzz/fuzz_simplereader_tu.c new file: fuzz/fuzz_srcfiles.c new file: fuzz/fuzz_stack_frame_access.c new file: fuzz/fuzz_str_offsets.c new file: fuzz/fuzz_tie.c new file: fuzz/fuzz_xuindex.c
1 parent 77c30fe commit 9cab819

31 files changed

+4725
-0
lines changed

‎fuzz/fuzz_aranges.c‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
/* Copyright 2021 Google LLC
2+
Licensed under the Apache License, Version 2.0 (the "License");
3+
you may not use this file except in compliance with the License.
4+
You may obtain a copy of the License at
5+
http://www.apache.org/licenses/LICENSE-2.0
6+
Unless required by applicable law or agreed to in writing, software
7+
distributed under the License is distributed on an "AS IS" BASIS,
8+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
9+
See the License for the specific language governing permissions and
10+
limitations under the License.
11+
*/
12+
#include <fcntl.h> /* open() O_RDONLY */
13+
#include <stdint.h>
14+
#include <stdio.h>
15+
#include <stdlib.h>
16+
#include <string.h>
17+
#include <sys/types.h>
18+
#include <unistd.h>
19+
20+
#define O_BINARY 0 /* So it does nothing in Linux/Unix */
21+
22+
/*
23+
* Libdwarf library callers can only use these headers.
24+
*/
25+
#include "dwarf.h"
26+
#include "libdwarf.h"
27+
28+
/*
29+
* Helper function definitions.
30+
*/
31+
static void cleanup_bad_arange(Dwarf_Debug dbg, Dwarf_Arange *arange,
32+
Dwarf_Signed i, Dwarf_Signed count);
33+
int arange_processing_example(Dwarf_Debug dbg, Dwarf_Error *error);
34+
35+
/*
36+
* Fuzzer function
37+
*/
38+
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
39+
char filename[256];
40+
sprintf(filename, "/tmp/libfuzzer.%d", getpid());
41+
42+
FILE *fp = fopen(filename, "wb");
43+
if (!fp) {
44+
return 0;
45+
}
46+
fwrite(data, size, 1, fp);
47+
fclose(fp);
48+
49+
Dwarf_Debug dbg = 0;
50+
int res = DW_DLV_ERROR;
51+
Dwarf_Error error;
52+
Dwarf_Handler errhand = 0;
53+
Dwarf_Ptr errarg = 0;
54+
55+
int fd = open(filename, O_RDONLY | O_BINARY);
56+
if (fd < 0) {
57+
exit(EXIT_FAILURE);
58+
}
59+
60+
res = dwarf_init_b(fd, DW_GROUPNUMBER_ANY, errhand, errarg, &dbg, &error);
61+
62+
if (res != DW_DLV_OK) {
63+
dwarf_dealloc_error(dbg, error);
64+
} else {
65+
printf("Processing");
66+
arange_processing_example(dbg, &error);
67+
}
68+
69+
dwarf_finish(dbg);
70+
close(fd);
71+
unlink(filename);
72+
return 0;
73+
}
74+
75+
static void cleanup_bad_arange(Dwarf_Debug dbg, Dwarf_Arange *arange,
76+
Dwarf_Signed i, Dwarf_Signed count) {
77+
Dwarf_Signed k = i;
78+
for (; k < count; ++k) {
79+
dwarf_dealloc(dbg, arange[k], DW_DLA_ARANGE);
80+
arange[k] = 0;
81+
}
82+
}
83+
84+
// Source:
85+
// https://www.prevanders.net/libdwarfdoc/group__aranges.html#ga9b628e21a71f4280f93788815796ef92
86+
int arange_processing_example(Dwarf_Debug dbg, Dwarf_Error *error) {
87+
Dwarf_Signed count = 0;
88+
Dwarf_Arange *arange = 0;
89+
int res = 0;
90+
91+
res = dwarf_get_aranges(dbg, &arange, &count, error);
92+
if (res == DW_DLV_OK) {
93+
Dwarf_Signed i = 0;
94+
95+
for (i = 0; i < count; ++i) {
96+
Dwarf_Arange ara = arange[i];
97+
Dwarf_Unsigned segment = 0;
98+
Dwarf_Unsigned segment_entry_size = 0;
99+
Dwarf_Addr start = 0;
100+
Dwarf_Unsigned length = 0;
101+
Dwarf_Off cu_die_offset = 0;
102+
103+
res = dwarf_get_arange_info_b(ara, &segment, &segment_entry_size, &start,
104+
&length, &cu_die_offset, error);
105+
if (res != DW_DLV_OK) {
106+
cleanup_bad_arange(dbg, arange, i, count);
107+
dwarf_dealloc(dbg, arange, DW_DLA_LIST);
108+
return res;
109+
}
110+
dwarf_dealloc(dbg, ara, DW_DLA_ARANGE);
111+
arange[i] = 0;
112+
}
113+
dwarf_dealloc(dbg, arange, DW_DLA_LIST);
114+
}
115+
return res;
116+
}

‎fuzz/fuzz_crc.c‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
/* Copyright 2021 Google LLC
2+
Licensed under the Apache License, Version 2.0 (the "License");
3+
you may not use this file except in compliance with the License.
4+
You may obtain a copy of the License at
5+
http://www.apache.org/licenses/LICENSE-2.0
6+
Unless required by applicable law or agreed to in writing, software
7+
distributed under the License is distributed on an "AS IS" BASIS,
8+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
9+
See the License for the specific language governing permissions and
10+
limitations under the License.
11+
*/
12+
#include <fcntl.h>
13+
#include <stdint.h>
14+
#include <stdio.h>
15+
#include <stdlib.h>
16+
#include <string.h>
17+
#include <sys/stat.h>
18+
#include <sys/types.h>
19+
#include <unistd.h>
20+
21+
/*
22+
* Libdwarf library callers can only use these headers.
23+
*/
24+
#include "dwarf.h"
25+
#include "libdwarf.h"
26+
27+
/*
28+
* Fuzzer function
29+
*/
30+
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
31+
char filename[256];
32+
sprintf(filename, "/tmp/libfuzzer.%d", getpid());
33+
34+
FILE *fp = fopen(filename, "wb");
35+
if (!fp) {
36+
return 0;
37+
}
38+
fwrite(data, size, 1, fp);
39+
fclose(fp);
40+
41+
int fuzz_fd = 0;
42+
Dwarf_Ptr errarg = 0;
43+
Dwarf_Handler errhand = 0;
44+
Dwarf_Error *errp = NULL;
45+
Dwarf_Debug dbg = 0;
46+
off_t size_left = 0;
47+
off_t fsize = 0;
48+
ssize_t readlen = 1000;
49+
ssize_t readval = 0;
50+
unsigned char *readbuf = 0;
51+
unsigned int tcrc = 0;
52+
unsigned int init = 0;
53+
54+
fuzz_fd = open(filename, O_RDONLY);
55+
fsize = size_left = lseek(fuzz_fd, 0L, SEEK_END);
56+
readbuf = (unsigned char *)malloc(readlen);
57+
if (fuzz_fd != -1) {
58+
while (size_left > 0) {
59+
if (size_left < readlen) {
60+
readlen = size_left;
61+
}
62+
readval = read(fuzz_fd, readbuf, readlen);
63+
size_left -= readlen;
64+
tcrc = dwarf_basic_crc32(readbuf, readlen, init);
65+
init = tcrc;
66+
}
67+
}
68+
free(readbuf);
69+
close(fuzz_fd);
70+
unlink(filename);
71+
return 0;
72+
}

‎fuzz/fuzz_crc_32.c‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
/* Copyright 2021 Google LLC
2+
Licensed under the Apache License, Version 2.0 (the "License");
3+
you may not use this file except in compliance with the License.
4+
You may obtain a copy of the License at
5+
http://www.apache.org/licenses/LICENSE-2.0
6+
Unless required by applicable law or agreed to in writing, software
7+
distributed under the License is distributed on an "AS IS" BASIS,
8+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
9+
See the License for the specific language governing permissions and
10+
limitations under the License.
11+
*/
12+
#include <fcntl.h>
13+
#include <stdint.h>
14+
#include <stdio.h>
15+
#include <stdlib.h>
16+
#include <string.h>
17+
#include <sys/stat.h>
18+
#include <sys/types.h>
19+
#include <unistd.h>
20+
21+
/*
22+
* Libdwarf library callers can only use these headers.
23+
*/
24+
#include "dwarf.h"
25+
#include "libdwarf.h"
26+
27+
/*
28+
* Fuzzer function targeting dwarf_crc32
29+
*/
30+
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
31+
char filename[256];
32+
sprintf(filename, "/tmp/libfuzzer.%d", getpid());
33+
34+
FILE *fp = fopen(filename, "wb");
35+
if (!fp) {
36+
return 0;
37+
}
38+
fwrite(data, size, 1, fp);
39+
fclose(fp);
40+
41+
int fuzz_fd = 0;
42+
Dwarf_Ptr errarg = 0;
43+
Dwarf_Handler errhand = 0;
44+
Dwarf_Error error;
45+
Dwarf_Debug dbg = 0;
46+
off_t size_left = 0;
47+
off_t fsize = 0;
48+
unsigned char *crcbuf = 0;
49+
int res = 0;
50+
51+
fuzz_fd = open(filename, O_RDONLY);
52+
fsize = size_left = lseek(fuzz_fd, 0L, SEEK_END);
53+
if (fuzz_fd != -1) {
54+
dwarf_init_b(fuzz_fd, DW_GROUPNUMBER_ANY, errhand, errarg, &dbg, &error);
55+
res = dwarf_crc32(dbg, crcbuf, &error);
56+
dwarf_finish(dbg);
57+
}
58+
close(fuzz_fd);
59+
unlink(filename);
60+
return 0;
61+
}

‎fuzz/fuzz_debug_addr_access.c‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
/* Copyright 2021 Google LLC
2+
Licensed under the Apache License, Version 2.0 (the "License");
3+
you may not use this file except in compliance with the License.
4+
You may obtain a copy of the License at
5+
http://www.apache.org/licenses/LICENSE-2.0
6+
Unless required by applicable law or agreed to in writing, software
7+
distributed under the License is distributed on an "AS IS" BASIS,
8+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
9+
See the License for the specific language governing permissions and
10+
limitations under the License.
11+
*/
12+
#include <fcntl.h>
13+
#include <stdint.h>
14+
#include <stdio.h>
15+
#include <stdlib.h>
16+
#include <string.h>
17+
#include <sys/stat.h>
18+
#include <sys/types.h>
19+
#include <unistd.h>
20+
21+
/*
22+
* Libdwarf library callers can only use these headers.
23+
*/
24+
#include "dwarf.h"
25+
#include "libdwarf.h"
26+
27+
/*
28+
* Fuzzer function
29+
*/
30+
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
31+
char filename[256];
32+
sprintf(filename, "/tmp/libfuzzer.%d", getpid());
33+
34+
FILE *fp = fopen(filename, "wb");
35+
if (!fp) {
36+
return 0;
37+
}
38+
fwrite(data, size, 1, fp);
39+
fclose(fp);
40+
41+
int fuzz_fd = 0;
42+
Dwarf_Ptr errarg = 0;
43+
Dwarf_Handler errhand = 0;
44+
Dwarf_Error *errp = 0;
45+
Dwarf_Debug dbg = 0;
46+
47+
fuzz_fd = open(filename, O_RDONLY);
48+
if (fuzz_fd != -1) {
49+
int res =
50+
dwarf_init_b(fuzz_fd, DW_GROUPNUMBER_ANY, errhand, errarg, &dbg, errp);
51+
52+
if (res != DW_DLV_OK) {
53+
dwarf_finish(dbg);
54+
close(fuzz_fd);
55+
unlink(filename);
56+
return 0;
57+
}
58+
Dwarf_Debug_Addr_Table debug_address_table;
59+
Dwarf_Unsigned dw_section_offset = 0;
60+
Dwarf_Unsigned dw_debug_address_table_length = 0;
61+
Dwarf_Half dw_version;
62+
Dwarf_Small dw_address_size;
63+
Dwarf_Unsigned dw_dw_at_addr_base;
64+
Dwarf_Unsigned dw_entry_count;
65+
Dwarf_Unsigned dw_next_table_offset;
66+
res = dwarf_debug_addr_table(dbg, dw_section_offset, &debug_address_table,
67+
&dw_debug_address_table_length, &dw_version,
68+
&dw_address_size, &dw_dw_at_addr_base,
69+
&dw_entry_count, &dw_next_table_offset, errp);
70+
71+
if (res != DW_DLV_OK) {
72+
if (res == DW_DLV_ERROR) {
73+
dwarf_dealloc_error(dbg, *errp);
74+
}
75+
dwarf_finish(dbg);
76+
close(fuzz_fd);
77+
unlink(filename);
78+
return 0;
79+
}
80+
for (Dwarf_Unsigned curindex = 0; curindex < dw_entry_count; ++curindex) {
81+
Dwarf_Unsigned addr = 0;
82+
res =
83+
dwarf_debug_addr_by_index(debug_address_table, curindex, &addr, errp);
84+
85+
if (res != DW_DLV_OK) {
86+
break;
87+
}
88+
}
89+
dwarf_dealloc_error(dbg, *errp);
90+
dwarf_dealloc_debug_addr_table(debug_address_table);
91+
dwarf_finish(dbg);
92+
close(fuzz_fd);
93+
}
94+
95+
unlink(filename);
96+
return 0;
97+
}

0 commit comments

Comments
 (0)