Armaan Sandhu
43cd946f98
fuzz-compress only ever feeds the decompressors their own output: it compresses the fuzzer input and then decompresses the result, so the stream the decoders see is well formed by construction. The blobs they get in reality come out of journal files, systemd-journal-remote streams, coredumps and downloaded images, i.e. from wherever the data was written, which is not necessarily somewhere we trust. So hand them the fuzzer input directly instead, across all four entrypoints: decompress_blob(), decompress_startswith(), decompress_stream(), and the decompressor_detect()/decompressor_push() pair that systemd-importd feeds from the network. The latter is pushed in chunks, so that the decoders see the same fragmentation a real download produces. The decompressed size is capped, as an unbounded decode of a hostile blob measures the allocator rather than the decoder. The corpus carries the two truncated stream headers that used to send decompress_startswith() allocating until OOM, fixed in the previous commit.
System and Service Manager
Details
Most documentation is available on systemd's website.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS, and also repositories with packages built from the latest stable release