libhfuzz/memory+hfuzz-cc: new wrappers for openssh/mbedtls

hfuzz_cc/hfuzz-cc.c

@@ -563,6 +563,17 @@ static int ldMode(int argc, char** argv) {
     args[j++] = "-Wl,--wrap=sqlite3_stricmp";
     args[j++] = "-Wl,--wrap=sqlite3_strnicmp";
     args[j++] = "-Wl,--wrap=sqlite3StrICmp";
+    /* FFmpeg */
+    args[j++] = "-Wl,--wrap=av_strcasecmp";
+    args[j++] = "-Wl,--wrap=av_strncasecmp";
+    /* MbedTLS */
+    args[j++] = "-Wl,--wrap=mbedtls_ct_memcmp";
+    /* PostgreSQL */
+    args[j++] = "-Wl,--wrap=pg_strcasecmp";
+    args[j++] = "-Wl,--wrap=pg_strncasecmp";
+    /* BSD/openssh */
+    args[j++] = "-Wl,--wrap=timingsafe_bcmp";
+    args[j++] = "-Wl,--wrap=timingsafe_memcmp";
 #endif /* _HF_ARCH_DARWIN */
 
     /* Pull modules defining the following symbols (if they exist) */

libhfuzz/instrument.c

@@ -296,7 +296,7 @@ void instrumentResetLocalCovFeedback(void) {
 /* Used to limit certain expensive actions, like adding values to dictionaries */
 static inline bool instrumentLimitEvery(uint64_t step) {
     static uint64_t counter = 0;
-    uint64_t val = __atomic_add_fetch(&counter, 1, __ATOMIC_RELAXED);
+    uint64_t        val     = __atomic_add_fetch(&counter, 1, __ATOMIC_RELAXED);
     if (((step + 1) & step) == 0) {
         return ((val & step) == 0);
     }
@@ -441,7 +441,7 @@ void __sanitizer_cov_trace_cmp2(uint16_t Arg1, uint16_t Arg2) {
     hfuzz_trace_cmp2_internal((uintptr_t)__builtin_return_address(0), Arg1, Arg2);
 }
 
-#if 0  /* Unused for now */
+#if 0 /* Unused for now */
 /*
  * Check if only 1 byte in a multi-byte value is non-zero.
  * Skip adding such values to dynamic dict (e.g. 0x00000005, 0xAA000000).
@@ -459,7 +459,7 @@ __attribute__((always_inline)) static inline bool instrumentOnlyOneByteSet(
 #endif
 
 void __sanitizer_cov_trace_cmp4(uint32_t Arg1, uint32_t Arg2) {
-#if 0  /* Pollutes the dynamic dictionary */
+#if 0 /* Pollutes the dynamic dictionary */
     /* Add 4byte values to the const_dictionary if they exist within the binary */
     if (globalCmpFeedback && instrumentLimitEvery(16383)) {
         if (!instrumentOnlyOneByteSet(Arg1, sizeof(Arg1))) {
@@ -483,7 +483,7 @@ void __sanitizer_cov_trace_cmp4(uint32_t Arg1, uint32_t Arg2) {
 }
 
 void __sanitizer_cov_trace_cmp8(uint64_t Arg1, uint64_t Arg2) {
-#if 0  /* Pollutes the dynamic dictionary */
+#if 0 /* Pollutes the dynamic dictionary */
     /* Add 8byte values to the const_dictionary if they exist within the binary */
     if (globalCmpFeedback && instrumentLimitEvery(16383)) {
         if (!instrumentOnlyOneByteSet(Arg1, sizeof(Arg1))) {

libhfuzz/memorycmp.c

@@ -651,7 +651,7 @@ HF_WEAK_WRAP(char*, g_strstr_len, const char* haystack, ssize_t haystack_len, co
         (uintptr_t)__builtin_return_address(0));
 }
 
-static inline int hf_glib_ascii_tolower(int c) {
+static inline int hf_ascii_tolower(int c) {
     if (c >= 'A' && c <= 'Z') {
         return c - 'A' + 'a';
     }
@@ -662,14 +662,14 @@ HF_WEAK_WRAP(int, g_ascii_strcasecmp, const char* s1, const char* s2) {
     if (!s1 || !s2) {
         return 0;
     }
-    return HF_strcasecmp(s1, s2, hf_glib_ascii_tolower, (uintptr_t)__builtin_return_address(0));
+    return HF_strcasecmp(s1, s2, hf_ascii_tolower, (uintptr_t)__builtin_return_address(0));
 }
 
 HF_WEAK_WRAP(int, g_ascii_strncasecmp, const char* s1, const char* s2, size_t n) {
     if (!s1 || !s2) {
         return 0;
     }
-    return HF_strncasecmp(s1, s2, n, hf_glib_ascii_tolower, instrumentConstAvail(),
+    return HF_strncasecmp(s1, s2, n, hf_ascii_tolower, instrumentConstAvail(),
         (uintptr_t)__builtin_return_address(0));
 }
 
@@ -762,3 +762,45 @@ HF_WEAK_WRAP(int, sqlite3_strnicmp, const char* s1, const char* s2, size_t len)
 int _ZNSt11char_traitsIcE7compareEPKcS2_m(const char* s1, const char* s2, size_t count) {
     return HF_memcmp(s1, s2, count, instrumentConstAvail(), (uintptr_t)__builtin_return_address(0));
 }
+
+/*
+ * FFmpeg wrappers
+ */
+HF_WEAK_WRAP(int, av_strcasecmp, const char* s1, const char* s2) {
+    return HF_strcasecmp(s1, s2, hf_ascii_tolower, (uintptr_t)__builtin_return_address(0));
+}
+
+HF_WEAK_WRAP(int, av_strncasecmp, const char* s1, const char* s2, size_t n) {
+    return HF_strncasecmp(s1, s2, n, hf_ascii_tolower, instrumentConstAvail(),
+        (uintptr_t)__builtin_return_address(0));
+}
+
+/*
+ * MbedTLS wrappers
+ */
+HF_WEAK_WRAP(int, mbedtls_ct_memcmp, const void* m1, const void* m2, size_t n) {
+    return HF_memcmp(m1, m2, n, instrumentConstAvail(), (uintptr_t)__builtin_return_address(0));
+}
+
+/*
+ * PostgreSQL wrappers
+ */
+HF_WEAK_WRAP(int, pg_strcasecmp, const char* s1, const char* s2) {
+    return HF_strcasecmp(s1, s2, hf_ascii_tolower, (uintptr_t)__builtin_return_address(0));
+}
+
+HF_WEAK_WRAP(int, pg_strncasecmp, const char* s1, const char* s2, size_t n) {
+    return HF_strncasecmp(s1, s2, n, hf_ascii_tolower, instrumentConstAvail(),
+        (uintptr_t)__builtin_return_address(0));
+}
+
+/*
+ * BSD/openssh wrappers
+ */
+HF_WEAK_WRAP(int, timingsafe_bcmp, const void* b1, const void* b2, size_t n) {
+    return HF_memcmp(b1, b2, n, instrumentConstAvail(), (uintptr_t)__builtin_return_address(0));
+}
+
+HF_WEAK_WRAP(int, timingsafe_memcmp, const void* b1, const void* b2, size_t n) {
+    return HF_memcmp(b1, b2, n, instrumentConstAvail(), (uintptr_t)__builtin_return_address(0));
+}