From 4ec9e3d286b6d3e982cb0fc3564dee0bf8d87ede Mon Sep 17 00:00:00 2001 From: Patrick Griffis Date: Tue, 27 Aug 2024 12:18:58 -0500 Subject: [PATCH] fuzzing: Cover soup_header_parse_param_list CVE: CVE-2024-52531 Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407/diffs?commit_id=4ec9e3d286b6d3e982cb0fc3564dee0bf8d87ede] Signed-off-by: Changqing Li --- fuzzing/fuzz.h | 9 +++++++-- fuzzing/fuzz_header_parsing.c | 19 +++++++++++++++++++ fuzzing/fuzz_header_parsing.dict | 8 ++++++++ fuzzing/meson.build | 2 ++ 4 files changed, 36 insertions(+), 2 deletions(-) create mode 100644 fuzzing/fuzz_header_parsing.c create mode 100644 fuzzing/fuzz_header_parsing.dict diff --git a/fuzzing/fuzz.h b/fuzzing/fuzz.h index 0d380285..f3bd28ee 100644 --- a/fuzzing/fuzz.h +++ b/fuzzing/fuzz.h @@ -1,13 +1,14 @@ #include "libsoup/soup.h" int LLVMFuzzerTestOneInput (const unsigned char *data, size_t size); +static int set_logger = 0; #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION static GLogWriterOutput empty_logging_func (GLogLevelFlags log_level, const GLogField *fields, gsize n_fields, gpointer user_data) { - return G_LOG_WRITER_HANDLED; + return G_LOG_WRITER_HANDLED; } #endif @@ -16,6 +17,10 @@ static void fuzz_set_logging_func (void) { #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION - g_log_set_writer_func (empty_logging_func, NULL, NULL); + if (!set_logger) + { + set_logger = 1; + g_log_set_writer_func (empty_logging_func, NULL, NULL); + } #endif } diff --git a/fuzzing/fuzz_header_parsing.c b/fuzzing/fuzz_header_parsing.c new file mode 100644 index 00000000..a8e5c1f9 --- /dev/null +++ b/fuzzing/fuzz_header_parsing.c @@ -0,0 +1,19 @@ +#include "fuzz.h" + +int +LLVMFuzzerTestOneInput (const unsigned char *data, size_t size) +{ + GHashTable *elements; + + // We only accept NUL terminated strings + if (!size || data[size - 1] != '\0') + return 0; + + fuzz_set_logging_func (); + + elements = soup_header_parse_param_list((char*)data); + + g_hash_table_unref(elements); + + return 0; +} \ No newline at end of file diff --git a/fuzzing/fuzz_header_parsing.dict b/fuzzing/fuzz_header_parsing.dict new file mode 100644 index 00000000..1562ca3a --- /dev/null +++ b/fuzzing/fuzz_header_parsing.dict @@ -0,0 +1,8 @@ +"*=UTF-8''" +"*=iso-8859-1''" +"'" +"''" +"=" +"*=" +""" +";" \ No newline at end of file diff --git a/fuzzing/meson.build b/fuzzing/meson.build index b14cbb50..5dd0f417 100644 --- a/fuzzing/meson.build +++ b/fuzzing/meson.build @@ -5,6 +5,7 @@ fuzz_targets = [ 'fuzz_cookie_parse', 'fuzz_content_sniffer', 'fuzz_date_time', + 'fuzz_header_parsing', ] fuzzing_args = '-fsanitize=fuzzer,address,undefined' @@ -34,6 +35,7 @@ if have_fuzzing and (fuzzing_feature.enabled() or fuzzing_feature.auto()) '-runs=200000', '-artifact_prefix=meson-logs/' + target + '-', '-print_final_stats=1', + '-max_len=4096', ] + extra_args, env: [ 'ASAN_OPTIONS=fast_unwind_on_malloc=0', -- 2.25.1