From 0f0a1dad7d69802a7e6c7fc9aba350f0e87c1952 Mon Sep 17 00:00:00 2001 From: Evgeny Vereshchagin Date: Wed, 26 Sep 2018 15:04:26 +0000 Subject: [PATCH 1/4] tests: add a fuzzer for sd-ndisc --- src/fuzz/fuzz-ndisc-rs.c | 57 ++++++++++++++++++++++++++++++++++++++++ src/fuzz/meson.build | 10 +++++++ 2 files changed, 67 insertions(+) create mode 100644 src/fuzz/fuzz-ndisc-rs.c diff --git a/src/fuzz/fuzz-ndisc-rs.c b/src/fuzz/fuzz-ndisc-rs.c new file mode 100644 index 0000000000..7f2d8f8649 --- /dev/null +++ b/src/fuzz/fuzz-ndisc-rs.c @@ -0,0 +1,57 @@ +/* SPDX-License-Identifier: LGPL-2.1+ */ + +#include +#include + +#include "alloc-util.h" +#include "icmp6-util.h" +#include "fuzz.h" +#include "sd-ndisc.h" +#include "socket-util.h" +#include "ndisc-internal.h" + +static int test_fd[2]; + +int icmp6_bind_router_solicitation(int index) { + assert_se(socketpair(AF_UNIX, SOCK_DGRAM, 0, test_fd) >= 0); + return test_fd[0]; +} + +int icmp6_bind_router_advertisement(int index) { + return -ENOSYS; +} + +int icmp6_receive(int fd, void *iov_base, size_t iov_len, + struct in6_addr *dst, triple_timestamp *timestamp) { + assert_se(read(fd, iov_base, iov_len) == (ssize_t) iov_len); + + if (timestamp) + triple_timestamp_get(timestamp); + + return 0; +} + +int icmp6_send_router_solicitation(int s, const struct ether_addr *ether_addr) { + return 0; +} + +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + struct ether_addr mac_addr = { + .ether_addr_octet = {'A', 'B', 'C', '1', '2', '3'} + }; + _cleanup_(sd_event_unrefp) sd_event *e = NULL; + _cleanup_(sd_ndisc_unrefp) sd_ndisc *nd = NULL; + + assert_se(sd_event_new(&e) >= 0); + assert_se(sd_ndisc_new(&nd) >= 0); + assert_se(sd_ndisc_attach_event(nd, e, 0) >= 0); + assert_se(sd_ndisc_set_ifindex(nd, 42) >= 0); + assert_se(sd_ndisc_set_mac(nd, &mac_addr) >= 0); + assert_se(sd_ndisc_start(nd) >= 0); + assert_se(write(test_fd[1], data, size) == (ssize_t) size); + (void) sd_event_run(e, (uint64_t) -1); + assert_se(sd_ndisc_stop(nd) >= 0); + close(test_fd[1]); + + return 0; +} diff --git a/src/fuzz/meson.build b/src/fuzz/meson.build index 40c623345d..f66d8883c4 100644 --- a/src/fuzz/meson.build +++ b/src/fuzz/meson.build @@ -14,6 +14,16 @@ fuzzers += [ libshared], []], + [['src/fuzz/fuzz-ndisc-rs.c', + 'src/libsystemd-network/dhcp-identifier.h', + 'src/libsystemd-network/dhcp-identifier.c', + 'src/libsystemd-network/icmp6-util.h', + 'src/systemd/sd-dhcp6-client.h', + 'src/systemd/sd-ndisc.h'], + [libshared, + libsystemd_network], + []], + [['src/fuzz/fuzz-unit-file.c'], [libcore, libshared], From f3241c61f12dbd8f0ed37419ae272e291d09461d Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Fri, 28 Sep 2018 19:28:05 +0900 Subject: [PATCH 2/4] ndisc: fix two infinite loops --- src/libsystemd-network/ndisc-router.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/libsystemd-network/ndisc-router.c b/src/libsystemd-network/ndisc-router.c index c6e75ab312..b982dcc07d 100644 --- a/src/libsystemd-network/ndisc-router.c +++ b/src/libsystemd-network/ndisc-router.c @@ -168,7 +168,7 @@ int ndisc_router_parse(sd_ndisc_router *rt) { if (has_mtu) { log_ndisc("MTU option specified twice, ignoring."); - continue; + break; } if (length != 8) { @@ -209,7 +209,7 @@ int ndisc_router_parse(sd_ndisc_router *rt) { if (has_flag_extension) { log_ndisc("Flags extension option specified twice, ignoring."); - continue; + break; } if (length < 1*8) { From df30e78e02f653c9e6ee6677b7ccaea21d3dcd7d Mon Sep 17 00:00:00 2001 From: Evgeny Vereshchagin Date: Wed, 26 Sep 2018 15:10:21 +0000 Subject: [PATCH 3/4] tests: add a reproducer for an infinite loop in ndisc_handle_datagram =0 ndisc_router_parse (rt=0x60d000000110) at ../src/libsystemd-network/ndisc-router.c:126 =1 0x000055555558dc67 in ndisc_handle_datagram (nd=0x608000000020, rt=0x60d000000110) at ../src/libsystemd-network/sd-ndisc.c:170 =2 0x000055555558e65d in ndisc_recv (s=0x611000000040, fd=4, revents=1, userdata=0x608000000020) at ../src/libsystemd-network/sd-ndisc.c:233 =3 0x00007ffff63913a8 in source_dispatch (s=0x611000000040) at ../src/libsystemd/sd-event/sd-event.c:3042 =4 0x00007ffff6395eab in sd_event_dispatch (e=0x617000000080) at ../src/libsystemd/sd-event/sd-event.c:3455 =5 0x00007ffff6396b12 in sd_event_run (e=0x617000000080, timeout=18446744073709551615) at ../src/libsystemd/sd-event/sd-event.c:3512 =6 0x0000555555583f5c in LLVMFuzzerTestOneInput (data=0x6060000000e0 "\206", size=53) at ../src/fuzz/fuzz-ndisc-rs.c:422 =7 0x0000555555586356 in main (argc=2, argv=0x7fffffffe3d8) at ../src/fuzz/fuzz-main.c:33 --- ...imeout-2815b773c712fa33bea62f541dfa3017c64ea2f1 | Bin 0 -> 53 bytes test/fuzz-regressions/meson.build | 1 + 2 files changed, 1 insertion(+) create mode 100644 test/fuzz-regressions/fuzz-ndisc-rs/timeout-2815b773c712fa33bea62f541dfa3017c64ea2f1 diff --git a/test/fuzz-regressions/fuzz-ndisc-rs/timeout-2815b773c712fa33bea62f541dfa3017c64ea2f1 b/test/fuzz-regressions/fuzz-ndisc-rs/timeout-2815b773c712fa33bea62f541dfa3017c64ea2f1 new file mode 100644 index 0000000000000000000000000000000000000000..410cf38c1ec2156680e80160825b883fb4f12aa9 GIT binary patch literal 53 ucmZo;U|{$U0h55t23AHOm-#;v2(&S9GpRCgaeXR_WB`f-fhq$7NEHAcu@3A2 literal 0 HcmV?d00001 diff --git a/test/fuzz-regressions/meson.build b/test/fuzz-regressions/meson.build index 80b062d7c6..6af6d01c5d 100644 --- a/test/fuzz-regressions/meson.build +++ b/test/fuzz-regressions/meson.build @@ -22,6 +22,7 @@ fuzz_regression_tests = ''' fuzz-journald-syslog/github-9820 fuzz-journald-syslog/github-9827 fuzz-journald-syslog/github-9829 + fuzz-ndisc-rs/timeout-2815b773c712fa33bea62f541dfa3017c64ea2f1 fuzz-unit-file/oss-fuzz-6884 fuzz-unit-file/oss-fuzz-6885 fuzz-unit-file/oss-fuzz-6886 From bbb393877b2cfcbe2f205c902ca7d9f7ce91f1a1 Mon Sep 17 00:00:00 2001 From: Evgeny Vereshchagin Date: Wed, 26 Sep 2018 18:09:09 +0000 Subject: [PATCH 4/4] tests: add a reproducer for another infinite loop in ndisc_handle_datagram --- ...imeout-61fff7fd1e5dcc07e1b656baab29065ce634ad5b | Bin 0 -> 71 bytes test/fuzz-regressions/meson.build | 1 + 2 files changed, 1 insertion(+) create mode 100644 test/fuzz-regressions/fuzz-ndisc-rs/timeout-61fff7fd1e5dcc07e1b656baab29065ce634ad5b diff --git a/test/fuzz-regressions/fuzz-ndisc-rs/timeout-61fff7fd1e5dcc07e1b656baab29065ce634ad5b b/test/fuzz-regressions/fuzz-ndisc-rs/timeout-61fff7fd1e5dcc07e1b656baab29065ce634ad5b new file mode 100644 index 0000000000000000000000000000000000000000..04e871fbcbddfe0642bd6855228bf8da163ad6e3 GIT binary patch literal 71 ucmZo;U}$4tu#$oUW@d)Jzy1TkUp6M@U)f7q