Fuzzer (#446)

sctplab · Mar 17, 2020 · 7b87cd4 · 7b87cd4
1 parent 3212d54
commit 7b87cd4
Show file tree

Hide file tree

Showing 116 changed files with 127 additions and 137 deletions.
diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -259,8 +259,9 @@ elseif (CMAKE_C_COMPILER_ID MATCHES "Clang" OR CMAKE_C_COMPILER_ID MATCHES "Appl
 	endif ()
 
 	if (sctp_build_fuzzer)
+		set(CMAKE_BUILD_TYPE "DEBUG")
 		add_definitions(-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
-		set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fsanitize=fuzzer-no-link")
+		set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -O1 -fsanitize=fuzzer-no-link")
 	endif ()
 endif ()
 

diff --git a/fuzzer/CORPUS_CONNECT/addip-000000 b/fuzzer/CORPUS_CONNECT/addip-000000
diff --git a/fuzzer/CORPUS_CONNECT/addip-000001 b/fuzzer/CORPUS_CONNECT/addip-000001
diff --git a/fuzzer/CORPUS_CONNECT/addip-000002 b/fuzzer/CORPUS_CONNECT/addip-000002
diff --git a/fuzzer/CORPUS_CONNECT/addip-000003 b/fuzzer/CORPUS_CONNECT/addip-000003
diff --git a/fuzzer/CORPUS_CONNECT/addip-000004 b/fuzzer/CORPUS_CONNECT/addip-000004
diff --git a/fuzzer/CORPUS_CONNECT/addip-000005 b/fuzzer/CORPUS_CONNECT/addip-000005
diff --git a/fuzzer/CORPUS_CONNECT/addip-000006 b/fuzzer/CORPUS_CONNECT/addip-000006
diff --git a/fuzzer/CORPUS_CONNECT/addip-000007 b/fuzzer/CORPUS_CONNECT/addip-000007
diff --git a/fuzzer/CORPUS_CONNECT/addip-000008 b/fuzzer/CORPUS_CONNECT/addip-000008
diff --git a/fuzzer/CORPUS_CONNECT/addip-000009 b/fuzzer/CORPUS_CONNECT/addip-000009
diff --git a/fuzzer/CORPUS_CONNECT/addip-000010 b/fuzzer/CORPUS_CONNECT/addip-000010
diff --git a/fuzzer/CORPUS_CONNECT/addip-000011 b/fuzzer/CORPUS_CONNECT/addip-000011
diff --git a/fuzzer/CORPUS_CONNECT/dummy-01 b/fuzzer/CORPUS_CONNECT/dummy-01
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000000 b/fuzzer/CORPUS_CONNECT/rtcweb-000000
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000001 b/fuzzer/CORPUS_CONNECT/rtcweb-000001
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000002 b/fuzzer/CORPUS_CONNECT/rtcweb-000002
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000003 b/fuzzer/CORPUS_CONNECT/rtcweb-000003
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000004 b/fuzzer/CORPUS_CONNECT/rtcweb-000004
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000005 b/fuzzer/CORPUS_CONNECT/rtcweb-000005
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000006 b/fuzzer/CORPUS_CONNECT/rtcweb-000006
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000007 b/fuzzer/CORPUS_CONNECT/rtcweb-000007
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000008 b/fuzzer/CORPUS_CONNECT/rtcweb-000008
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000009 b/fuzzer/CORPUS_CONNECT/rtcweb-000009
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000010 b/fuzzer/CORPUS_CONNECT/rtcweb-000010
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000011 b/fuzzer/CORPUS_CONNECT/rtcweb-000011
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000012 b/fuzzer/CORPUS_CONNECT/rtcweb-000012
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000013 b/fuzzer/CORPUS_CONNECT/rtcweb-000013
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000014 b/fuzzer/CORPUS_CONNECT/rtcweb-000014
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000015 b/fuzzer/CORPUS_CONNECT/rtcweb-000015
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000016 b/fuzzer/CORPUS_CONNECT/rtcweb-000016
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000017 b/fuzzer/CORPUS_CONNECT/rtcweb-000017
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000018 b/fuzzer/CORPUS_CONNECT/rtcweb-000018
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000019 b/fuzzer/CORPUS_CONNECT/rtcweb-000019
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000020 b/fuzzer/CORPUS_CONNECT/rtcweb-000020
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000021 b/fuzzer/CORPUS_CONNECT/rtcweb-000021
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000022 b/fuzzer/CORPUS_CONNECT/rtcweb-000022
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000023 b/fuzzer/CORPUS_CONNECT/rtcweb-000023
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000024 b/fuzzer/CORPUS_CONNECT/rtcweb-000024
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000025 b/fuzzer/CORPUS_CONNECT/rtcweb-000025
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000026 b/fuzzer/CORPUS_CONNECT/rtcweb-000026
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000027 b/fuzzer/CORPUS_CONNECT/rtcweb-000027
diff --git a/fuzzer/CORPUS_CONNECT/rtcweb-000028 b/fuzzer/CORPUS_CONNECT/rtcweb-000028
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000000 b/fuzzer/CORPUS_CONNECT/tsctp-000000
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000001 b/fuzzer/CORPUS_CONNECT/tsctp-000001
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000002 b/fuzzer/CORPUS_CONNECT/tsctp-000002
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000004 b/fuzzer/CORPUS_CONNECT/tsctp-000004
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000005 b/fuzzer/CORPUS_CONNECT/tsctp-000005
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000006 b/fuzzer/CORPUS_CONNECT/tsctp-000006
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000007 b/fuzzer/CORPUS_CONNECT/tsctp-000007
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000008 b/fuzzer/CORPUS_CONNECT/tsctp-000008
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000009 b/fuzzer/CORPUS_CONNECT/tsctp-000009
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000010 b/fuzzer/CORPUS_CONNECT/tsctp-000010
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000011 b/fuzzer/CORPUS_CONNECT/tsctp-000011
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000012 b/fuzzer/CORPUS_CONNECT/tsctp-000012
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000013 b/fuzzer/CORPUS_CONNECT/tsctp-000013
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000014 b/fuzzer/CORPUS_CONNECT/tsctp-000014
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000015 b/fuzzer/CORPUS_CONNECT/tsctp-000015
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000016 b/fuzzer/CORPUS_CONNECT/tsctp-000016
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000017 b/fuzzer/CORPUS_CONNECT/tsctp-000017
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000020 b/fuzzer/CORPUS_CONNECT/tsctp-000020
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000021 b/fuzzer/CORPUS_CONNECT/tsctp-000021
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000022 b/fuzzer/CORPUS_CONNECT/tsctp-000022
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000024 b/fuzzer/CORPUS_CONNECT/tsctp-000024
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000025 b/fuzzer/CORPUS_CONNECT/tsctp-000025
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000026 b/fuzzer/CORPUS_CONNECT/tsctp-000026
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000027 b/fuzzer/CORPUS_CONNECT/tsctp-000027
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000028 b/fuzzer/CORPUS_CONNECT/tsctp-000028
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000029 b/fuzzer/CORPUS_CONNECT/tsctp-000029
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000030 b/fuzzer/CORPUS_CONNECT/tsctp-000030
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000031 b/fuzzer/CORPUS_CONNECT/tsctp-000031
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000032 b/fuzzer/CORPUS_CONNECT/tsctp-000032
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000033 b/fuzzer/CORPUS_CONNECT/tsctp-000033
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000034 b/fuzzer/CORPUS_CONNECT/tsctp-000034
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000035 b/fuzzer/CORPUS_CONNECT/tsctp-000035
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000036 b/fuzzer/CORPUS_CONNECT/tsctp-000036
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000037 b/fuzzer/CORPUS_CONNECT/tsctp-000037
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000038 b/fuzzer/CORPUS_CONNECT/tsctp-000038
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000039 b/fuzzer/CORPUS_CONNECT/tsctp-000039
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000040 b/fuzzer/CORPUS_CONNECT/tsctp-000040
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000041 b/fuzzer/CORPUS_CONNECT/tsctp-000041
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000042 b/fuzzer/CORPUS_CONNECT/tsctp-000042
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000043 b/fuzzer/CORPUS_CONNECT/tsctp-000043
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000044 b/fuzzer/CORPUS_CONNECT/tsctp-000044
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000045 b/fuzzer/CORPUS_CONNECT/tsctp-000045
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000046 b/fuzzer/CORPUS_CONNECT/tsctp-000046
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000047 b/fuzzer/CORPUS_CONNECT/tsctp-000047
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000048 b/fuzzer/CORPUS_CONNECT/tsctp-000048
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000049 b/fuzzer/CORPUS_CONNECT/tsctp-000049
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000050 b/fuzzer/CORPUS_CONNECT/tsctp-000050
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000051 b/fuzzer/CORPUS_CONNECT/tsctp-000051
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000052 b/fuzzer/CORPUS_CONNECT/tsctp-000052
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000053 b/fuzzer/CORPUS_CONNECT/tsctp-000053
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000054 b/fuzzer/CORPUS_CONNECT/tsctp-000054
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000055 b/fuzzer/CORPUS_CONNECT/tsctp-000055
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000056 b/fuzzer/CORPUS_CONNECT/tsctp-000056
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000057 b/fuzzer/CORPUS_CONNECT/tsctp-000057
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000058 b/fuzzer/CORPUS_CONNECT/tsctp-000058
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-i-data-000000 b/fuzzer/CORPUS_CONNECT/tsctp-i-data-000000
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-i-data-000001 b/fuzzer/CORPUS_CONNECT/tsctp-i-data-000001
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-i-data-000002 b/fuzzer/CORPUS_CONNECT/tsctp-i-data-000002
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000023 → fuzzer/CORPUS_CONNECT/tsctp-i-data-000003 b/fuzzer/CORPUS_CONNECT/tsctp-000023 → fuzzer/CORPUS_CONNECT/tsctp-i-data-000003
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-i-data-000004 b/fuzzer/CORPUS_CONNECT/tsctp-i-data-000004
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-i-data-000005 b/fuzzer/CORPUS_CONNECT/tsctp-i-data-000005
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-i-data-000006 b/fuzzer/CORPUS_CONNECT/tsctp-i-data-000006
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-i-data-000007 b/fuzzer/CORPUS_CONNECT/tsctp-i-data-000007
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-i-data-000008 b/fuzzer/CORPUS_CONNECT/tsctp-i-data-000008
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000018 → fuzzer/CORPUS_CONNECT/tsctp-i-data-000009 b/fuzzer/CORPUS_CONNECT/tsctp-000018 → fuzzer/CORPUS_CONNECT/tsctp-i-data-000009
diff --git a/fuzzer/CORPUS_CONNECT/tsctp-000019 → fuzzer/CORPUS_CONNECT/tsctp-i-data-000010 b/fuzzer/CORPUS_CONNECT/tsctp-000019 → fuzzer/CORPUS_CONNECT/tsctp-i-data-000010
diff --git a/fuzzer/build-fuzzer.sh b/fuzzer/build-fuzzer.sh
@@ -41,7 +41,7 @@ pwd
 find . -iwholename '*cmake*' -not -name CMakeLists.txt -delete
 
 # Build with ASAN / MSAN
-cmake -Dsctp_build_fuzzer=1 -Dsctp_build_programs=0 -Dsctp_invariants=1 -Dsctp_sanitizer_address=1 -DCMAKE_LINKER="$CC" -DCMAKE_C_COMPILER="$CC" -DCMAKE_BUILD_TYPE=Debug .
-#cmake -Dsctp_build_fuzzer=1 -Dsctp_build_programs=0 -Dsctp_invariants=1 -Dsctp_sanitizer_memory=1 -DCMAKE_LINKER="$CC" -DCMAKE_C_COMPILER="$CC" -DCMAKE_BUILD_TYPE=RelWithDebInfo .
+cmake -Dsctp_build_fuzzer=1 -Dsctp_build_programs=0 -Dsctp_invariants=1 -Dsctp_sanitizer_address=1 -DCMAKE_LINKER="$CC" -DCMAKE_C_COMPILER="$CC" .
+#cmake -Dsctp_build_fuzzer=1 -Dsctp_build_programs=0 -Dsctp_invariants=1 -Dsctp_sanitizer_memory=1 -DCMAKE_LINKER="$CC" -DCMAKE_C_COMPILER="$CC" .
 
 make -j"$NPROC"
diff --git a/fuzzer/check-input.sh b/fuzzer/check-input.sh
@@ -18,7 +18,7 @@ echo "########## Beginning Fuzzer Chain"
 echo ""
 
 set +e
-./fuzzer_connect_multi_verbose -timeout=30 $1 > $1.log 2>&1
+./fuzzer_connect_multi_verbose -timeout=10 $1 > $1.log 2>&1
 FUZZER_RETVAL=$?
 set -e
 

diff --git a/fuzzer/crashtest.py b/fuzzer/crashtest.py
@@ -5,7 +5,6 @@
 import re
 
 reportdir = "reports/"
-fuzzer = "./fuzzer_connect_multi"
 
 class bcolors:
 	HEADER = '\033[95m'

diff --git a/fuzzer/fuzzer_connect.c b/fuzzer/fuzzer_connect.c
diff --git a/fuzzer/fuzzer_connect_multi.sh b/fuzzer/fuzzer_connect_multi.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-export ASAN_OPTIONS=abort_on_error=1:disable_core=0:unmap_shadow_on_exit=1:disable_coredump=0:detect_leaks=1
+#export ASAN_OPTIONS=abort_on_error=1:disable_core=0:unmap_shadow_on_exit=1:disable_coredump=0:detect_leaks=1
 ulimit -c unlimited
 mkdir -p CORPUS_CONNECT
 
@@ -19,4 +19,4 @@ fi
 echo "$NPROC"
 
 
-./fuzzer_connect_multi -jobs=64 -timeout=10 -max_len=32000 CORPUS_CONNECT
+./fuzzer_connect_multi -jobs=64 -timeout=10 -max_len=32000 -use_value_profile=1 CORPUS_CONNECT
diff --git a/programs/programs_helper.c b/programs/programs_helper.c
@@ -52,10 +52,24 @@ void
 debug_printf_stack(const char *format, ...)
 {
 	va_list ap;
+	char charbuf[1024];
+	static struct timeval time_main;
+	struct timeval time_now;
+	struct timeval time_delta;
+
+	if (time_main.tv_sec == 0  && time_main.tv_usec == 0) {
+		gettimeofday(&time_main, NULL);
+	}
+
+	gettimeofday(&time_now, NULL);
+	timersub(&time_now, &time_main, &time_delta);
 
 	va_start(ap, format);
-	vprintf(format, ap);
+	//vfprintf(stderr, format, ap);
+	vsnprintf(charbuf, 1024, format, ap);
 	va_end(ap);
+
+	fprintf(stderr, "[S][%u.%03u] %s", (unsigned int) time_delta.tv_sec, (unsigned int) time_delta.tv_usec / 1000, charbuf);
 }
 
 static void

diff --git a/usrsctplib/CMakeLists.txt b/usrsctplib/CMakeLists.txt
@@ -43,6 +43,8 @@ set(includedir 				${prefix}/include/usrsctp)
 set(CMAKE_REQUIRED_INCLUDES ${CMAKE_CURRENT_SOURCE_DIR})
 set(CMAKE_MACOSX_RPATH 		1)
 
+include(CheckCCompilerFlag)
+
 add_definitions(-D__Userspace__)
 add_definitions(-D__Userspace_os_${CMAKE_SYSTEM_NAME})
 add_definitions(-DSCTP_SIMPLE_ALLOCATOR)
@@ -53,11 +55,16 @@ add_definitions(-DSCTP_PROCESS_LEVEL_LOCKS)
 # OS DEPENDENT
 #################################################
 
-check_c_compiler_flag(-Wno-address-of-packed-member has_wno_address_of_packet_member)
-if (has_wno_address_of_packet_member)
+check_c_compiler_flag(-Wno-address-of-packed-member has_wno_address_of_packed_member)
+if (has_wno_address_of_packed_member)
 	set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-address-of-packed-member")
 endif ()
 
+check_c_compiler_flag(-Wno-deprecated-declarations has_wno_deprecated_declarations)
+if (has_wno_deprecated_declarations)
+	set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-deprecated-declarations")
+endif ()
+
 if (CMAKE_SYSTEM_NAME MATCHES "Linux")
 	add_definitions(-D_GNU_SOURCE)
 endif ()
@@ -69,7 +76,6 @@ endif ()
 if (CMAKE_SYSTEM_NAME MATCHES "Darwin")
 	add_definitions(-U__APPLE__)
 	add_definitions(-D__APPLE_USE_RFC_2292)
-	set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-deprecated-declarations")
 endif ()
 
 if (CMAKE_SYSTEM_NAME MATCHES "DragonFly")
-Original file line number
+Diff line change
@@ Expand Up / @@ -18,7 +18,7 @@ echo "########## Beginning Fuzzer Chain" @@
     echo ""
     set +e
-    ./fuzzer_connect_multi_verbose -timeout=30 $1 > $1.log 2>&1
+    ./fuzzer_connect_multi_verbose -timeout=10 $1 > $1.log 2>&1
     FUZZER_RETVAL=$?
     set -e
@@ Expand Down @@