Skip to content

add additional complexity to the fuzzer #874

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 14, 2023
Merged

add additional complexity to the fuzzer #874

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/fuzz.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,12 +35,12 @@ jobs:
- name: Build
run: cmake --build build -j4

- name: Test
- name: Test_app
run: |
cd build
make QUICK_CLI11_APP_FUZZ

- name: Test2
- name: Test_file
run: |
cd build
make QUICK_CLI11_FILE_FUZZ
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,7 @@ jobs:

boost-build:
name: Boost build
runs-on: ubuntu-20.04
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v3
with:
Expand Down
11 changes: 7 additions & 4 deletions fuzz/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,22 +19,25 @@ if(CMAKE_CXX_STANDARD GREATER 16)
set(CLI11_FUZZ_ARTIFACT_PATH ${PROJECT_BINARY_DIR}/fuzz)
endif()

if(NOT CLI11_FUZZ_TIME)
set(CLI11_FUZZ_TIME 360)
if(NOT CLI11_FUZZ_TIME_APP)
set(CLI11_FUZZ_TIME_APP 600)
endif()
if(NOT CLI11_FUZZ_TIME_FILE)
set(CLI11_FUZZ_TIME_FILE 240)
endif()
add_custom_target(
QUICK_CLI11_APP_FUZZ
COMMAND ${CMAKE_COMMAND} -E make_directory corp
COMMAND
cli11_app_fuzzer corp -max_total_time=${CLI11_FUZZ_TIME} -max_len=2048
cli11_app_fuzzer corp -max_total_time=${CLI11_FUZZ_TIME_APP} -max_len=2148
-dict=${CMAKE_CURRENT_SOURCE_DIR}/fuzz_dictionary1.txt
-exact_artifact_path=${CLI11_FUZZ_ARTIFACT_PATH}/cli11_app_fail_artifact.txt)

add_custom_target(
QUICK_CLI11_FILE_FUZZ
COMMAND ${CMAKE_COMMAND} -E make_directory corp
COMMAND
cli11_file_fuzzer corp -max_total_time=${CLI11_FUZZ_TIME} -max_len=2048
cli11_file_fuzzer corp -max_total_time=${CLI11_FUZZ_TIME_FILE} -max_len=2048
-dict=${CMAKE_CURRENT_SOURCE_DIR}/fuzz_dictionary2.txt
-exact_artifact_path=${CLI11_FUZZ_ARTIFACT_PATH}/cli11_file_fail_artifact.txt)

Expand Down
23 changes: 21 additions & 2 deletions fuzz/cli11_app_fuzz.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,29 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
return 0;
}
std::string parseString(reinterpret_cast<const char *>(Data), Size);

std::string optionString;
std::string flagString;
if(parseString.size() > 25) {
optionString = parseString.substr(0, 25);
parseString.erase(0, 25);
}
if(parseString.size() > 25) {
flagString = parseString.substr(0, 25);
parseString.erase(0, 25);
}
CLI::FuzzApp fuzzdata;

auto app = fuzzdata.generateApp();
try {
if(!optionString.empty()) {
app->add_option(optionString, fuzzdata.buffer);
}
if(!flagString.empty()) {
app->add_flag(flagString, fuzzdata.intbuffer);
}
} catch(const CLI::ConstructionError &e) {
return 0; // Non-zero return values are reserved for future use.
}

try {
app->parse(parseString);
} catch(const CLI::ParseError &e) {
Expand Down
2 changes: 1 addition & 1 deletion fuzz/cli11_file_fuzz.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
try {
app->parse_from_stream(out);
} catch(const CLI::ParseError &e) {
(app)->exit(e);
// (app)->exit(e);
// this just indicates we caught an error known by CLI
}

Expand Down
52 changes: 47 additions & 5 deletions fuzz/fuzzApp.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,9 +44,10 @@ std::shared_ptr<CLI::App> FuzzApp::generateApp() {
auto fApp = std::make_shared<CLI::App>("fuzzing App", "fuzzer");
fApp->set_config("--config");
fApp->add_flag("-a,--flag");
fApp->add_flag("-b,--flag2", flag1);
fApp->add_flag("-b,--flag2,!--nflag2", flag1);
fApp->add_flag("-c{34},--flag3{1}", flagCnt)->disable_flag_override();
fApp->add_flag("-e,--flagA", flagAtomic);
fApp->add_flag("--atd", doubleAtomic);

fApp->add_option("-d,--opt1", val8);
fApp->add_option("--opt2", val16);
Expand All @@ -64,20 +65,61 @@ std::shared_ptr<CLI::App> FuzzApp::generateApp() {
fApp->add_option("--dopt1", v1);
fApp->add_option("--dopt2", v2);

fApp->add_option("--vopt1", vv1);
fApp->add_option("--vopt2", vvs);
fApp->add_option("--vopt3", vstr);
fApp->add_option("--vopt4", vecvecd);
auto *vgroup = fApp->add_option_group("vectors");

vgroup->add_option("--vopt1", vv1);
vgroup->add_option("--vopt2", vvs);
vgroup->add_option("--vopt3", vstr);
vgroup->add_option("--vopt4", vecvecd);

fApp->add_option("--oopt1", od1);
fApp->add_option("--oopt2", ods);

fApp->add_option("--tup1", p1);
fApp->add_option("--tup2", t1);
fApp->add_option("--tup4", tcomplex);
vgroup->add_option("--vtup", vectup);

fApp->add_option("--dwrap", dwrap);
fApp->add_option("--iwrap", iwrap);
fApp->add_option("--swrap", swrap);
// file checks
fApp->add_option("--dexists")->check(ExistingDirectory);
fApp->add_option("--fexists")->check(ExistingFile);
fApp->add_option("--fnexists")->check(NonexistentPath);

auto *sub = fApp->add_subcommand("sub1");

sub->add_option("--sopt2", val16)->check(Range(1, 10));
sub->add_option("--sopt3", val32)->check(PositiveNumber);
sub->add_option("--sopt4", val64)->check(NonNegativeNumber);

sub->add_option("--sopt5", uval8)->transform(Bound(6, 20));
sub->add_option("--sopt6", uval16);
sub->add_option("--sopt7", uval32);
sub->add_option("--sopt8", uval64);

sub->add_option("--saopt1", atomicval64);
sub->add_option("--saopt2", atomicuval64);

sub->add_option("--sdopt1", v1);
sub->add_option("--sdopt2", v2);

sub->add_option("--svopt1", vv1);
sub->add_option("--svopt2", vvs);
sub->add_option("--svopt3", vstr);
sub->add_option("--svopt4", vecvecd);

sub->add_option("--soopt1", od1);
sub->add_option("--soopt2", ods);

sub->add_option("--stup1", p1);
sub->add_option("--stup2", t1);
sub->add_option("--stup4", tcomplex);
sub->add_option("--svtup", vectup);

sub->add_option("--sdwrap", dwrap);
sub->add_option("--siwrap", iwrap);

return fApp;
}
Expand Down
15 changes: 15 additions & 0 deletions fuzz/fuzzApp.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,16 @@ class doubleWrapper {
double val{0.0};
};

class stringWrapper {
public:
stringWrapper() = default;
explicit stringWrapper(std::string_view v) : val(v){};
CLI11_NODISCARD std::string value() const { return val; }

private:
std::string val{};
};

class FuzzApp {
public:
FuzzApp() = default;
Expand Down Expand Up @@ -80,6 +90,7 @@ class FuzzApp {
std::vector<int>,
std::optional<std::string>>
tcomplex2{};
std::vector<std::tuple<std::string, double, char, std::vector<std::string>>> vectup{};
std::string_view vstrv = "";

bool flag1{false};
Expand All @@ -88,5 +99,9 @@ class FuzzApp {

intWrapper64 iwrap{0};
doubleWrapper dwrap{0.0};
stringWrapper swrap{};
std::string buffer{};
int intbuffer{0};
std::atomic<double> doubleAtomic{0.0};
};
} // namespace CLI
124 changes: 124 additions & 0 deletions fuzz/fuzz_dictionary1.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
"-c"
"-d"
"-e"
" "
"--flag1"
"--flag"
"--flag2"
Expand Down Expand Up @@ -32,3 +33,126 @@
"--tup4"
"--dwrap"
"--iwrap"
"--vtup"
"--atd"
"sub1"
"--sflag1"
"--sflag"
"--sflag2"
"--sflagA"
"--sopt1"
"--sopt2"
"--sopt3"
"--sopt4"
"--sopt5"
"--sopt6"
"--sopt7"
"--sopt8"
"--sopt9"
"--saopt1"
"--saopt2"
"--sdopt1"
"--sdopt2"
"--svopt1"
"--svopt2"
"--svopt3"
"--svopt4"
"--soopt1"
"--soopt2"
"--stup1"
"--stup2"
"--stup4"
"--sdwrap"
"--siwrap"
"--svtup"
"--satd"
"nflag2"
"stup1"
"svtup"
"sdwrap"
"siwrap"
"++"
"="
"vtup"
"soopt2"
"--"
"svopt4"
"opt8"
"config"
"dwrap"
"soptneg"
"flag1"
"flag"
"flag2"
"flag3"
"enable"
"help"
"flagA"
"opt1"
"opt2"
"opt3"
"opt4"
"opt5"
"opt6"
"opt7"
"opt8"
"opt9"
"aopt1"
"aopt2"
"dopt1"
"dopt2"
"vopt1"
"vopt2"
"vopt3"
"vopt4"
"oopt1"
"oopt2"
"tup1"
"tup2"
"tup4"
"dwrap"
"iwrap"
"swrap"
"vtup"
"atd"
"sflag1"
"sflag"
"sflag2"
"sflagA"
"sopt1"
"sopt2"
"sopt3"
"sopt4"
"sopt5"
"sopt6"
"sopt7"
"sopt8"
"sopt9"
"saopt1"
"saopt2"
"sdopt1"
"sdopt2"
"svopt1"
"svopt2"
"svopt3"
"svopt4"
"soopt1"
"soopt2"
"stup1"
"stup2"
"stup4"
"sdwrap"
"siwrap"
"svtup"
"satd"
"%%"
"dexists"
"fexists"
"fnexists"
",-"
",--"
"{false}"
"{4}"
"!"
"{"
"}"
47 changes: 47 additions & 0 deletions fuzz/fuzz_dictionary2.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,3 +35,50 @@
"tup4"
"dwrap"
"iwrap"
"vtup"
"atd"
"sub1"
"soopt1"
"soopt2"
"stup1"
"stup2"
"stup4"
"stup2"
"stup4"
"sdwrap"
"siwrap"
"svtup"
"satd"
"sflag1"
"sflag"
"sflag2"
"sflagA"
"sopt1"
"sopt2"
"sopt3"
"sopt4"
"sopt5"
"sopt6"
"sopt7"
"sopt8"
"sopt9"
"saopt1"
"saopt2"
"sdopt1"
"sdopt2"
"svopt1"
"svopt2"
"svopt3"
"svopt4"
"config"
"nflag2"
"--"
"fuzzer"
"t-"
"++"
"su"
"%%"
"swrap"
"dexists"
"fexists"
"fnexists"
Loading