diff --git a/Makefile b/Makefile index 6e9e29b..a6207fa 100644 --- a/Makefile +++ b/Makefile @@ -30,6 +30,58 @@ TEST_ENV="UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1" all: +.PHONY: harness harness-afl harness-laf harness-cmplog harness-sand fuzz fuzz-stop + +harness: harness-afl harness-laf harness-cmplog harness-sand + +harness-afl: harness.c picohttpparser.c + afl-clang-lto -fsanitize=fuzzer -I. harness.c picohttpparser.c -o harness.afl + +harness-laf: harness.c picohttpparser.c + AFL_LLVM_LAF_ALL=1 afl-clang-lto -fsanitize=fuzzer -I. harness.c picohttpparser.c -o harness.laf + +harness-cmplog: harness.c picohttpparser.c + AFL_LLVM_CMPLOG=1 afl-clang-lto -fsanitize=fuzzer -I. harness.c picohttpparser.c -o harness.cmplog + +harness-sand: harness.c picohttpparser.c + AFL_USE_ASAN=1 AFL_USE_UBSAN=1 AFL_LLVM_ONLY_FSRV=1 afl-clang-lto -fsanitize=fuzzer -I. harness.c picohttpparser.c -o harness.asanubsan + AFL_USE_MSAN=1 AFL_LLVM_ONLY_FSRV=1 afl-clang-lto -fsanitize=fuzzer -I. harness.c picohttpparser.c -o harness.msan + AFL_USE_CFISAN=1 AFL_LLVM_ONLY_FSRV=1 afl-clang-lto -fsanitize=fuzzer -I. harness.c picohttpparser.c -o harness.cfisan + AFL_USE_TSAN=1 AFL_LLVM_ONLY_FSRV=1 afl-clang-lto -fsanitize=fuzzer -I. harness.c picohttpparser.c -o harness.tsan + +fuzz: harness + screen -dmS afl-main bash -c 'export AFL_FINAL_SYNC=1; afl-fuzz -M main -i in -o out ./harness.afl' + screen -dmS afl-sand-01 bash -c 'afl-fuzz -S sand-01 -i in -o out -w ./harness.asanubsan -w ./harness.msan -w ./harness.cfisan -w ./harness.tsan ./harness.afl' + screen -dmS afl-cmplog-01 bash -c 'afl-fuzz -S cmplog-01 -i in -o out -c ./harness.cmplog ./harness.afl' + screen -dmS afl-cmplog-02 bash -c 'afl-fuzz -S cmplog-02 -i in -o out -c ./harness.cmplog ./harness.afl' + screen -dmS afl-laf-01 bash -c 'afl-fuzz -S laf-01 -i in -o out ./harness.laf' + screen -dmS afl-laf-02 bash -c 'afl-fuzz -S laf-02 -i in -o out ./harness.laf' + screen -dmS afl-laf-03 bash -c 'afl-fuzz -S laf-03 -i in -o out ./harness.laf' + screen -dmS afl-mopt-01 bash -c 'afl-fuzz -S mopt-01 -i in -o out -L 0 ./harness.afl' + screen -dmS afl-old-queue-cycling-01 bash -c 'afl-fuzz -S old-queue-cycling-01 -i in -o out -Z ./harness.afl' + screen -dmS afl-disable-trim-01 bash -c 'export AFL_DISABLE_TRIM=1; afl-fuzz -S disable-trim-01 -i in -o out ./harness.afl' + screen -dmS afl-explore-01 bash -c 'afl-fuzz -S explore-01 -i in -o out -p explore ./harness.afl' + screen -dmS afl-exploit-01 bash -c 'afl-fuzz -S exploit-01 -i in -o out -p exploit ./harness.afl' + screen -dmS afl-ascii-01 bash -c 'afl-fuzz -S ascii-01 -i in -o out -a ascii ./harness.afl' + screen -dmS afl-binary-01 bash -c 'afl-fuzz -S binary-01 -i in -o out -a binary ./harness.afl' + +fuzz-stop: + screen -S afl-main -X quit + screen -S afl-sand-01 -X quit + screen -S afl-cmplog-01 -X quit + screen -S afl-cmplog-02 -X quit + screen -S afl-laf-01 -X quit + screen -S afl-laf-02 -X quit + screen -S afl-laf-03 -X quit + screen -S afl-mopt-01 -X quit + screen -S afl-old-queue-cycling-01 -X quit + screen -S afl-disable-trim-01 -X quit + screen -S afl-explore-01 -X quit + screen -S afl-exploit-01 -X quit + screen -S afl-ascii-01 -X quit + screen -S afl-binary-01 -X quit + + test: test-bin env $(TEST_ENV) $(PROVE) -v ./test-bin diff --git a/harness.c b/harness.c new file mode 100644 index 0000000..d111287 --- /dev/null +++ b/harness.c @@ -0,0 +1,15 @@ +#include +#include +#include "picohttpparser.h" + +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + const char *method, *path; + int minor_version; + struct phr_header headers[100]; + size_t method_len, path_len, num_headers = 100; + + phr_parse_request((const char *)data, size, &method, &method_len, &path, &path_len, + &minor_version, headers, &num_headers, 0); + + return 0; +} \ No newline at end of file