RPCSX/llvm
1
0
Fork 0
mirror of https://github.com/RPCSX/llvm.git synced 2025-01-27 15:22:29 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

[libfuzzer] test for c-ares CVE-2016-5180

Browse Source 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282839 91177308-0d34-0410-b5e6-96231b3b80d8
This commit is contained in:
Kostya Serebryany 2016-09-30 05:15:45 +00:00
parent 91f3caeaf5
commit adcfb5ac04
3 changed files with 50 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
lib/Fuzzer/fuzzer-test-suite/c-ares-CVE-2016-5180/build.sh Executable file
View File

@ -0,0 +1,22 @@
#!/bin/bash
[ -e $(basename $0) ] && echo "PLEASE USE THIS SCRIPT FROM ANOTHER DIR" && exit 1
SCRIPT_DIR=$(dirname $0)
EXECUTABLE_NAME_BASE=$(basename $SCRIPT_DIR)
LIBFUZZER_SRC=$(dirname $(dirname $SCRIPT_DIR))
FUZZ_CXXFLAGS="-O2 -g -fsanitize=address -fsanitize-coverage=trace-pc-guard,trace-cmp,trace-gep,trace-div"
get() {
[ ! -e SRC ] && git clone https://github.com/c-ares/c-ares.git SRC && (cd SRC && git reset --hard 51fbb479f7948fca2ace3ff34a15ff27e796afdd)
}
build_lib() {
rm -rf BUILD
cp -rf SRC BUILD
(cd BUILD && ./buildconf && ./configure CC="clang $FUZZ_CXXFLAGS" && make -j)
}
get
build_lib
$LIBFUZZER_SRC/build.sh
clang++ -g $SCRIPT_DIR/target.cc -I BUILD BUILD/.libs/libcares.a libFuzzer.a $FUZZ_CXXFLAGS -o $EXECUTABLE_NAME_BASE

21
lib/Fuzzer/fuzzer-test-suite/c-ares-CVE-2016-5180/target.cc Normal file
View File

@ -0,0 +1,21 @@
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <arpa/nameser.h>
#include <iostream>
#include <ares.h>
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
unsigned char* buf;
int buflen;
char* inp = (char*)malloc(size+1);
inp[size]=0;
memcpy(inp, data, size);
ares_create_query((const char*)inp, ns_c_in, ns_t_a, 0x1234, 0, &buf, &buflen, 0);
free(buf);
free(inp);
return 0;
}

7
lib/Fuzzer/fuzzer-test-suite/c-ares-CVE-2016-5180/test.sh Executable file
View File

@ -0,0 +1,7 @@
#!/bin/bash
set -x
SCRIPT_DIR=$(dirname $0)
EXECUTABLE_NAME_BASE=$(basename $SCRIPT_DIR)
CORPUS=CORPUS-$EXECUTABLE_NAME_BASE
[ -e $EXECUTABLE_NAME_BASE ] && ./$EXECUTABLE_NAME_BASE -max_total_time=10 2>&1 | tee log
grep -Pzo "(?s)ERROR: AddressSanitizer: heap-buffer-overflow.*WRITE of size 1.*ares_create_query.*is located 0 bytes to the right of" log