diff options
author | Dylan Reid <dgreid@chromium.org> | 2019-03-13 14:24:18 -0700 |
---|---|---|
committer | chrome-bot <chrome-bot@chromium.org> | 2019-03-25 21:51:14 -0700 |
commit | 39028af02f0b4ba39574b89c9eea60f2da6ae1fc (patch) | |
tree | c333ea0b09c804d8855faa9ace9c7d2462e9f454 | |
parent | fcd4e847f3dbdd4e8979f60ce7275210b5a20376 (diff) | |
download | crosvm-39028af02f0b4ba39574b89c9eea60f2da6ae1fc.tar crosvm-39028af02f0b4ba39574b89c9eea60f2da6ae1fc.tar.gz crosvm-39028af02f0b4ba39574b89c9eea60f2da6ae1fc.tar.bz2 crosvm-39028af02f0b4ba39574b89c9eea60f2da6ae1fc.tar.lz crosvm-39028af02f0b4ba39574b89c9eea60f2da6ae1fc.tar.xz crosvm-39028af02f0b4ba39574b89c9eea60f2da6ae1fc.tar.zst crosvm-39028af02f0b4ba39574b89c9eea60f2da6ae1fc.zip |
fuzz: Add qcow fuzzing
Fuzz using the data as a qcow image with an offset and value to write to the image. Change-Id: Iff8f2971ba716c93d978e33338ad62b5d487c115 Signed-off-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/871132 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
-rw-r--r-- | fuzz/Cargo.toml | 6 | ||||
-rw-r--r-- | fuzz/qcow_fuzzer.rs | 57 |
2 files changed, 63 insertions, 0 deletions
diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml index 3b09eb6..3dd3d41 100644 --- a/fuzz/Cargo.toml +++ b/fuzz/Cargo.toml @@ -4,8 +4,10 @@ version = "0.0.1" authors = ["The Chromium OS Authors"] [dependencies] +devices = { path = "../devices" } libc = "*" kernel_loader = { path = "../kernel_loader" } +qcow = { path = "../qcow" } sys_util = { path = "../sys_util" } # Prevent this from interfering with workspaces @@ -13,5 +15,9 @@ sys_util = { path = "../sys_util" } members = ["."] [[bin]] +name = "crosvm_qcow_fuzzer" +path = "qcow_fuzzer.rs" + +[[bin]] name = "crosvm_zimage_fuzzer" path = "zimage_fuzzer.rs" diff --git a/fuzz/qcow_fuzzer.rs b/fuzz/qcow_fuzzer.rs new file mode 100644 index 0000000..0f7ff2a --- /dev/null +++ b/fuzz/qcow_fuzzer.rs @@ -0,0 +1,57 @@ +// Copyright 2019 The Chromium OS Authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +#![no_main] +extern crate libc; +extern crate qcow; +extern crate sys_util; + +use qcow::QcowFile; +use sys_util::SharedMemory; + +use std::fs::File; +use std::io::{Cursor, Read, Seek, SeekFrom, Write}; +use std::mem::size_of; +use std::panic; +use std::process; +use std::slice; + +// Take the first 64 bits of data as an address and the next 64 bits as data to +// store there. The rest of the data is used as a qcow image. +#[export_name = "LLVMFuzzerTestOneInput"] +pub fn test_one_input(data: *const u8, size: usize) -> i32 { + // We cannot unwind past ffi boundaries. + panic::catch_unwind(|| { + // Safe because the libfuzzer runtime will guarantee that `data` is at least + // `size` bytes long and that it will be valid for the lifetime of this + // function. + let bytes = unsafe { slice::from_raw_parts(data, size) }; + if bytes.len() < 16 { + // Need an address and data, each are 8 bytes. + return; + } + let mut disk_image = Cursor::new(bytes); + let addr = read_u64(&mut disk_image); + let value = read_u64(&mut disk_image); + let shm = SharedMemory::new(None).unwrap(); + let mut disk_file: File = shm.into(); + disk_file.write_all(&bytes[16..]).unwrap(); + disk_file.seek(SeekFrom::Start(0)).unwrap(); + if let Ok(mut qcow) = QcowFile::from(disk_file) { + if qcow.seek(SeekFrom::Start(addr)).is_ok() { + let _ = qcow.write_all(&value.to_le_bytes()); + } + } + }) + .err() + .map(|_| process::abort()); + + 0 +} + +fn read_u64<T: Read>(readable: &mut T) -> u64 { + let mut buf = [0u8; size_of::<u64>()]; + readable.read_exact(&mut buf[..]).unwrap(); + u64::from_le_bytes(buf) +} |