fuzz/main.c

/*
 * Copyright(c) 2017-2019 Tim Ruehsen
 *
 * Permission is hereby granted, free of charge, to any person obtaining a
 * copy of this software and associated documentation files (the "Software"),
 * to deal in the Software without restriction, including without limitation
 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
 * and/or sell copies of the Software, and to permit persons to whom the
 * Software is furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 * DEALINGS IN THE SOFTWARE.
 *
 * This file is part of libtasn1.
 */

#include "../config.h"

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>
#include <fcntl.h>
#include <errno.h>
#include <sys/stat.h>

#include "fuzzer.h"

#ifdef TEST_RUN

#include <dirent.h>

static int test_single_file(const char *fname)
{
	int fd, ret;
	struct stat st;
	uint8_t *data;
	ssize_t n;

	if ((fd = open(fname, O_RDONLY)) == -1) {
		fprintf(stderr, "Failed to open %s (%d)\n", fname, errno);
		return -1;
	}

	if (fstat(fd, &st) != 0) {
		fprintf(stderr, "Failed to stat %d (%d)\n", fd, errno);
		close(fd);
		return -1;
	}

	data = malloc(st.st_size);
	if ((n = read(fd, data, st.st_size)) == st.st_size) {
		printf("testing %llu bytes from '%s'\n", (unsigned long long) st.st_size, fname);
		fflush(stdout);
		LLVMFuzzerTestOneInput(data, st.st_size);
		fflush(stderr);
		ret = 0;
	} else {
		fprintf(stderr, "Failed to read %llu bytes from %s (%d), got %zd\n", (unsigned long long) st.st_size, fname, errno, n);
		ret = -1;
	}

	free(data);
	close(fd);
	return ret;
}

static void test_all_from(const char *dirname)
{
	DIR *dirp;
	struct dirent *dp;
	char fname[1024];
	int len;

	if ((dirp = opendir(dirname))) {
		while ((dp = readdir(dirp))) {
			if (*dp->d_name == '.') continue;

			len = snprintf(fname, sizeof(fname), "%s/%s", dirname, dp->d_name);
			if (len < 0 || len >= (int) sizeof(fname)) {
				fprintf(stderr, "File name truncation: %s/%s\n", dirname, dp->d_name);
				continue;
			}

			int fd;
			if ((fd = open(fname, O_RDONLY)) == -1) {
				fprintf(stderr, "Failed to open %s (%d)\n", fname, errno);
				continue;
			}

			struct stat st;
			if (fstat(fd, &st) != 0) {
				fprintf(stderr, "Failed to stat %d (%d)\n", fd, errno);
				close(fd);
				continue;
			}

			uint8_t *data = malloc(st.st_size);
			ssize_t n;
			if ((n = read(fd, data, st.st_size)) == st.st_size) {
				printf("testing %llu bytes from '%s'\n", (unsigned long long) st.st_size, fname);
				LLVMFuzzerTestOneInput(data, st.st_size);
			} else
				fprintf(stderr, "Failed to read %llu bytes from %s (%d), got %d\n", (unsigned long long) st.st_size, fname, errno, (int) n);

			free(data);
			close(fd);
		}
		closedir(dirp);
	}
}

int main(int argc, char **argv)
{
	int len;

	/* if VALGRIND testing is enabled, we have to call ourselves with valgrind checking */
	if (argc == 1) {
		const char *valgrind = getenv("TESTS_VALGRIND");

		if (valgrind && *valgrind) {
			char cmd[1024]; /* avoid alloca / VLA / heap allocation */

			len = snprintf(cmd, sizeof(cmd), "TESTS_VALGRIND="" %s %s", valgrind, argv[0]);
			if (len < 0 || len >= (int) sizeof(cmd))
				return 1; /* failure on command truncation */

			return system(cmd) != 0;
		}
	}

	if (argc > 1)
		return test_single_file(argv[1]);

	const char *target = strrchr(argv[0], '/');
	target = target ? target + 1 : argv[0];

	char corporadir[1024]; /* avoid alloca / VLA / heap allocation */

	len = snprintf(corporadir, sizeof(corporadir), SRCDIR "/%s.in", target);
	if (len < 0 || len >= (int) sizeof(corporadir))
		return 1; /* failure on file name truncation */

	test_all_from(corporadir);

	snprintf(corporadir, sizeof(corporadir), SRCDIR "/%s.repro", target);

	test_all_from(corporadir);

	return 0;
}

#else

#ifndef __AFL_LOOP
static int __AFL_LOOP(int n)
{
	static int first = 1;

	if (first) {
		first = 0;
		return 1;
	}

	return 0;
}
#endif

int main(int argc, char **argv)
{
	int ret;
	unsigned char buf[64 * 1024];

	while (__AFL_LOOP(10000)) { // only works with afl-clang-fast
		ret = fread(buf, 1, sizeof(buf), stdin);
		if (ret < 0)
			return 0;

		LLVMFuzzerTestOneInput(buf, ret);
	}

	return 0;
}

#endif /* TEST_RUN */