diff --git a/hfuzz_cc/hfuzz-cc.c b/hfuzz_cc/hfuzz-cc.c index 060ba5cb..5a8ed31d 100644 --- a/hfuzz_cc/hfuzz-cc.c +++ b/hfuzz_cc/hfuzz-cc.c @@ -563,6 +563,17 @@ static int ldMode(int argc, char** argv) { args[j++] = "-Wl,--wrap=sqlite3_stricmp"; args[j++] = "-Wl,--wrap=sqlite3_strnicmp"; args[j++] = "-Wl,--wrap=sqlite3StrICmp"; + /* FFmpeg */ + args[j++] = "-Wl,--wrap=av_strcasecmp"; + args[j++] = "-Wl,--wrap=av_strncasecmp"; + /* MbedTLS */ + args[j++] = "-Wl,--wrap=mbedtls_ct_memcmp"; + /* PostgreSQL */ + args[j++] = "-Wl,--wrap=pg_strcasecmp"; + args[j++] = "-Wl,--wrap=pg_strncasecmp"; + /* BSD/openssh */ + args[j++] = "-Wl,--wrap=timingsafe_bcmp"; + args[j++] = "-Wl,--wrap=timingsafe_memcmp"; #endif /* _HF_ARCH_DARWIN */ /* Pull modules defining the following symbols (if they exist) */ diff --git a/libhfuzz/instrument.c b/libhfuzz/instrument.c index f4892416..5da68faf 100644 --- a/libhfuzz/instrument.c +++ b/libhfuzz/instrument.c @@ -296,7 +296,7 @@ void instrumentResetLocalCovFeedback(void) { /* Used to limit certain expensive actions, like adding values to dictionaries */ static inline bool instrumentLimitEvery(uint64_t step) { static uint64_t counter = 0; - uint64_t val = __atomic_add_fetch(&counter, 1, __ATOMIC_RELAXED); + uint64_t val = __atomic_add_fetch(&counter, 1, __ATOMIC_RELAXED); if (((step + 1) & step) == 0) { return ((val & step) == 0); } @@ -441,7 +441,7 @@ void __sanitizer_cov_trace_cmp2(uint16_t Arg1, uint16_t Arg2) { hfuzz_trace_cmp2_internal((uintptr_t)__builtin_return_address(0), Arg1, Arg2); } -#if 0 /* Unused for now */ +#if 0 /* Unused for now */ /* * Check if only 1 byte in a multi-byte value is non-zero. * Skip adding such values to dynamic dict (e.g. 0x00000005, 0xAA000000). @@ -459,7 +459,7 @@ __attribute__((always_inline)) static inline bool instrumentOnlyOneByteSet( #endif void __sanitizer_cov_trace_cmp4(uint32_t Arg1, uint32_t Arg2) { -#if 0 /* Pollutes the dynamic dictionary */ +#if 0 /* Pollutes the dynamic dictionary */ /* Add 4byte values to the const_dictionary if they exist within the binary */ if (globalCmpFeedback && instrumentLimitEvery(16383)) { if (!instrumentOnlyOneByteSet(Arg1, sizeof(Arg1))) { @@ -483,7 +483,7 @@ void __sanitizer_cov_trace_cmp4(uint32_t Arg1, uint32_t Arg2) { } void __sanitizer_cov_trace_cmp8(uint64_t Arg1, uint64_t Arg2) { -#if 0 /* Pollutes the dynamic dictionary */ +#if 0 /* Pollutes the dynamic dictionary */ /* Add 8byte values to the const_dictionary if they exist within the binary */ if (globalCmpFeedback && instrumentLimitEvery(16383)) { if (!instrumentOnlyOneByteSet(Arg1, sizeof(Arg1))) { diff --git a/libhfuzz/memorycmp.c b/libhfuzz/memorycmp.c index 855e6954..9174a50c 100644 --- a/libhfuzz/memorycmp.c +++ b/libhfuzz/memorycmp.c @@ -651,7 +651,7 @@ HF_WEAK_WRAP(char*, g_strstr_len, const char* haystack, ssize_t haystack_len, co (uintptr_t)__builtin_return_address(0)); } -static inline int hf_glib_ascii_tolower(int c) { +static inline int hf_ascii_tolower(int c) { if (c >= 'A' && c <= 'Z') { return c - 'A' + 'a'; } @@ -662,14 +662,14 @@ HF_WEAK_WRAP(int, g_ascii_strcasecmp, const char* s1, const char* s2) { if (!s1 || !s2) { return 0; } - return HF_strcasecmp(s1, s2, hf_glib_ascii_tolower, (uintptr_t)__builtin_return_address(0)); + return HF_strcasecmp(s1, s2, hf_ascii_tolower, (uintptr_t)__builtin_return_address(0)); } HF_WEAK_WRAP(int, g_ascii_strncasecmp, const char* s1, const char* s2, size_t n) { if (!s1 || !s2) { return 0; } - return HF_strncasecmp(s1, s2, n, hf_glib_ascii_tolower, instrumentConstAvail(), + return HF_strncasecmp(s1, s2, n, hf_ascii_tolower, instrumentConstAvail(), (uintptr_t)__builtin_return_address(0)); } @@ -762,3 +762,45 @@ HF_WEAK_WRAP(int, sqlite3_strnicmp, const char* s1, const char* s2, size_t len) int _ZNSt11char_traitsIcE7compareEPKcS2_m(const char* s1, const char* s2, size_t count) { return HF_memcmp(s1, s2, count, instrumentConstAvail(), (uintptr_t)__builtin_return_address(0)); } + +/* + * FFmpeg wrappers + */ +HF_WEAK_WRAP(int, av_strcasecmp, const char* s1, const char* s2) { + return HF_strcasecmp(s1, s2, hf_ascii_tolower, (uintptr_t)__builtin_return_address(0)); +} + +HF_WEAK_WRAP(int, av_strncasecmp, const char* s1, const char* s2, size_t n) { + return HF_strncasecmp(s1, s2, n, hf_ascii_tolower, instrumentConstAvail(), + (uintptr_t)__builtin_return_address(0)); +} + +/* + * MbedTLS wrappers + */ +HF_WEAK_WRAP(int, mbedtls_ct_memcmp, const void* m1, const void* m2, size_t n) { + return HF_memcmp(m1, m2, n, instrumentConstAvail(), (uintptr_t)__builtin_return_address(0)); +} + +/* + * PostgreSQL wrappers + */ +HF_WEAK_WRAP(int, pg_strcasecmp, const char* s1, const char* s2) { + return HF_strcasecmp(s1, s2, hf_ascii_tolower, (uintptr_t)__builtin_return_address(0)); +} + +HF_WEAK_WRAP(int, pg_strncasecmp, const char* s1, const char* s2, size_t n) { + return HF_strncasecmp(s1, s2, n, hf_ascii_tolower, instrumentConstAvail(), + (uintptr_t)__builtin_return_address(0)); +} + +/* + * BSD/openssh wrappers + */ +HF_WEAK_WRAP(int, timingsafe_bcmp, const void* b1, const void* b2, size_t n) { + return HF_memcmp(b1, b2, n, instrumentConstAvail(), (uintptr_t)__builtin_return_address(0)); +} + +HF_WEAK_WRAP(int, timingsafe_memcmp, const void* b1, const void* b2, size_t n) { + return HF_memcmp(b1, b2, n, instrumentConstAvail(), (uintptr_t)__builtin_return_address(0)); +}