From e5f274bee1c5652ebdadf7bc2c06a4437a8389f0 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Sun, 10 Mar 2019 20:53:57 +0100 Subject: [PATCH 1/6] fuzz: add bus-label fuzzer --- src/fuzz/fuzz-bus-label.c | 18 ++++++++++++++++++ src/fuzz/meson.build | 4 ++++ 2 files changed, 22 insertions(+) create mode 100644 src/fuzz/fuzz-bus-label.c diff --git a/src/fuzz/fuzz-bus-label.c b/src/fuzz/fuzz-bus-label.c new file mode 100644 index 00000000000..46a3d23dc4a --- /dev/null +++ b/src/fuzz/fuzz-bus-label.c @@ -0,0 +1,18 @@ +/* SPDX-License-Identifier: LGPL-2.1+ */ + +#include + +#include "alloc-util.h" +#include "bus-label.h" +#include "fuzz.h" + +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + _cleanup_free_ char *unescaped = NULL, *escaped = NULL; + + unescaped = bus_label_unescape_n((const char*)data, size); + assert_se(unescaped != NULL); + escaped = bus_label_escape(unescaped); + assert_se(escaped != NULL); + + return 0; +} diff --git a/src/fuzz/meson.build b/src/fuzz/meson.build index 5138a2c4165..ba893cff94d 100644 --- a/src/fuzz/meson.build +++ b/src/fuzz/meson.build @@ -112,4 +112,8 @@ fuzzers += [ [['src/fuzz/fuzz-compress.c'], [libshared], []], + + [['src/fuzz/fuzz-bus-label.c'], + [libshared], + []], ] From 18d51b45097f510676ce0ae90ff8becdd3564f3c Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Mon, 11 Mar 2019 12:42:26 +0100 Subject: [PATCH 2/6] fuzz: add env-file fuzzer --- src/fuzz/fuzz-env-file.c | 31 +++++++++++++++++++++++++ src/fuzz/meson.build | 4 ++++ test/fuzz/fuzz-env-file/simple-env-file | 5 ++++ 3 files changed, 40 insertions(+) create mode 100644 src/fuzz/fuzz-env-file.c create mode 100644 test/fuzz/fuzz-env-file/simple-env-file diff --git a/src/fuzz/fuzz-env-file.c b/src/fuzz/fuzz-env-file.c new file mode 100644 index 00000000000..51df1aab557 --- /dev/null +++ b/src/fuzz/fuzz-env-file.c @@ -0,0 +1,31 @@ +/* SPDX-License-Identifier: LGPL-2.1+ */ + +#include + +#include "alloc-util.h" +#include "env-file.h" +#include "fd-util.h" +#include "fuzz.h" +#include "strv.h" + +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + _cleanup_fclose_ FILE *f = NULL; + _cleanup_strv_free_ char **rl = NULL, **rlp = NULL; + + if (size == 0) + return 0; + + f = fmemopen((char*) data, size, "re"); + assert_se(f); + + /* We don't want to fill the logs with messages about parse errors. + * Disable most logging if not running standalone */ + if (!getenv("SYSTEMD_LOG_LEVEL")) + log_set_max_level(LOG_CRIT); + + (void) load_env_file(f, NULL, &rl); + assert_se(fseek(f, 0, SEEK_SET) == 0); + (void) load_env_file_pairs(f, NULL, &rlp); + + return 0; +} diff --git a/src/fuzz/meson.build b/src/fuzz/meson.build index ba893cff94d..d09006f640f 100644 --- a/src/fuzz/meson.build +++ b/src/fuzz/meson.build @@ -116,4 +116,8 @@ fuzzers += [ [['src/fuzz/fuzz-bus-label.c'], [libshared], []], + + [['src/fuzz/fuzz-env-file.c'], + [libshared], + []], ] diff --git a/test/fuzz/fuzz-env-file/simple-env-file b/test/fuzz/fuzz-env-file/simple-env-file new file mode 100644 index 00000000000..2cad6f7a211 --- /dev/null +++ b/test/fuzz/fuzz-env-file/simple-env-file @@ -0,0 +1,5 @@ +VARIABLE="value" +OPTION="--option=1234" +NUMBER=1 +EMPTY="" +PATH=/var/lib/xxx From 04ddab1462f53430b3977362428dea20b8ee3122 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Mon, 11 Mar 2019 12:43:00 +0100 Subject: [PATCH 3/6] fuzz: add hostname-util fuzzer --- src/fuzz/fuzz-hostname-util.c | 28 ++++++++++++++++++++++++++++ src/fuzz/meson.build | 4 ++++ 2 files changed, 32 insertions(+) create mode 100644 src/fuzz/fuzz-hostname-util.c diff --git a/src/fuzz/fuzz-hostname-util.c b/src/fuzz/fuzz-hostname-util.c new file mode 100644 index 00000000000..deaf8112ba2 --- /dev/null +++ b/src/fuzz/fuzz-hostname-util.c @@ -0,0 +1,28 @@ +/* SPDX-License-Identifier: LGPL-2.1+ */ + +#include + +#include "alloc-util.h" +#include "fd-util.h" +#include "fuzz.h" +#include "hostname-util.h" + +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + _cleanup_fclose_ FILE *f = NULL; + _cleanup_free_ char *ret = NULL; + + if (size == 0) + return 0; + + f = fmemopen((char*) data, size, "re"); + assert_se(f); + + /* We don't want to fill the logs with messages about parse errors. + * Disable most logging if not running standalone */ + if (!getenv("SYSTEMD_LOG_LEVEL")) + log_set_max_level(LOG_CRIT); + + (void) read_etc_hostname_stream(f, &ret); + + return 0; +} diff --git a/src/fuzz/meson.build b/src/fuzz/meson.build index d09006f640f..e851d4e7640 100644 --- a/src/fuzz/meson.build +++ b/src/fuzz/meson.build @@ -120,4 +120,8 @@ fuzzers += [ [['src/fuzz/fuzz-env-file.c'], [libshared], []], + + [['src/fuzz/fuzz-hostname-util.c'], + [libshared], + []], ] From b5b499b32c164149d20ee50a73f3098ed0a3aea4 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Mon, 11 Mar 2019 12:43:20 +0100 Subject: [PATCH 4/6] fuzz: add nspawn-settings fuzzer --- src/fuzz/fuzz-nspawn-settings.c | 28 ++++++++++++++++ src/fuzz/meson.build | 5 +++ test/fuzz/fuzz-nspawn-settings/basic-config | 36 +++++++++++++++++++++ 3 files changed, 69 insertions(+) create mode 100644 src/fuzz/fuzz-nspawn-settings.c create mode 100644 test/fuzz/fuzz-nspawn-settings/basic-config diff --git a/src/fuzz/fuzz-nspawn-settings.c b/src/fuzz/fuzz-nspawn-settings.c new file mode 100644 index 00000000000..6c81eb773a7 --- /dev/null +++ b/src/fuzz/fuzz-nspawn-settings.c @@ -0,0 +1,28 @@ +/* SPDX-License-Identifier: LGPL-2.1+ */ + +#include + +#include "alloc-util.h" +#include "fd-util.h" +#include "fuzz.h" +#include "nspawn-settings.h" + +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + _cleanup_fclose_ FILE *f = NULL; + _cleanup_(settings_freep) Settings *s = NULL; + + if (size == 0) + return 0; + + f = fmemopen((char*) data, size, "re"); + assert_se(f); + + /* We don't want to fill the logs with messages about parse errors. + * Disable most logging if not running standalone */ + if (!getenv("SYSTEMD_LOG_LEVEL")) + log_set_max_level(LOG_CRIT); + + (void) settings_load(f, "/dev/null", &s); + + return 0; +} diff --git a/src/fuzz/meson.build b/src/fuzz/meson.build index e851d4e7640..4a242f8a6ce 100644 --- a/src/fuzz/meson.build +++ b/src/fuzz/meson.build @@ -124,4 +124,9 @@ fuzzers += [ [['src/fuzz/fuzz-hostname-util.c'], [libshared], []], + + [['src/fuzz/fuzz-nspawn-settings.c'], + [libshared, + libnspawn_core], + []], ] diff --git a/test/fuzz/fuzz-nspawn-settings/basic-config b/test/fuzz/fuzz-nspawn-settings/basic-config new file mode 100644 index 00000000000..be0d4e7c7bf --- /dev/null +++ b/test/fuzz/fuzz-nspawn-settings/basic-config @@ -0,0 +1,36 @@ +[Exec] +Boot=off +ProcessTwo=off +Parameters=/sbin/init -x=1 +Environment=THIS=that +User=user +WorkingDirectory=/cwd +PivotRoot=/newroot +Capability=CAP_NET +DropCapability=CAP_ADMIN +KillSignal=SIGTERM +Personality=shy +MachineID=edbfea3309ba41ea83e2318c58a8d498 +PrivateUser=1:2 +NotifyReady=no +SystemCallFilters=write + +[Files] +ReadOnly=no +Volatile=no +Bind=/bindthis +BindReadOnly=/bindthisro +TemporaryFileSystem=/thisismytmpfs:rw +Overlay=/thisisanoverlay:/thisisanoverlaytoo +PrivateUsersChown=no + +[Network] +Private=off +VirtualEthernet=yes +VirtualEthernetExtra=veth1:veth2 +Interface=eth1 enp0s1 +MacVLAN=eno1 eno2 +IPVLAN=eno3 enp2s124 +Bridge=bridge123 bridge125 +Zone=myzone +Port=1234 156 -1 From ea1cdaf262bc89733dcbf60c8dbcd341839e9bbe Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Mon, 11 Mar 2019 12:56:10 +0100 Subject: [PATCH 5/6] fuzz: add a memleak reproducer for fuzz-nspawn-settings --- .../leak-4ff0e2498f596a77ea68d185c61e9e9ff9bb657f | Bin 0 -> 133 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 test/fuzz/fuzz-nspawn-settings/leak-4ff0e2498f596a77ea68d185c61e9e9ff9bb657f diff --git a/test/fuzz/fuzz-nspawn-settings/leak-4ff0e2498f596a77ea68d185c61e9e9ff9bb657f b/test/fuzz/fuzz-nspawn-settings/leak-4ff0e2498f596a77ea68d185c61e9e9ff9bb657f new file mode 100644 index 0000000000000000000000000000000000000000..7be2d2c9da3b551d29207ecb280af51bd3585c8b GIT binary patch literal 133 zcmWlRF$%*l5CmOclb_fxP~$+_n2@9~E{^z&4-_rv4h#R@Qn#}VGY@?~EHnZhux&JD z{KV{C(C{{K=D$2Nx?~F_s|(RwS!|(~@cK;g3<>l_WUqJIqoy@Lal*kl^65aW Q>%lG`tF`-%lA2C*0S4JFU;qFB literal 0 HcmV?d00001 From 0e636bf51aaaf319695f9d0dc91a29b03c8bd69b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Mon, 11 Mar 2019 14:27:29 +0100 Subject: [PATCH 6/6] nspawn: fix memleak uncovered by fuzzer Also use TAKE_PTR as appropriate. --- src/nspawn/nspawn-mount.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/src/nspawn/nspawn-mount.c b/src/nspawn/nspawn-mount.c index eb0a26ef35b..13f50b2d37b 100644 --- a/src/nspawn/nspawn-mount.c +++ b/src/nspawn/nspawn-mount.c @@ -206,7 +206,7 @@ int bind_mount_parse(CustomMount **l, size_t *n, const char *s, bool read_only) } if (isempty(source)) - source = NULL; + source = mfree(source); else if (!source_path_is_valid(source)) return -EINVAL; @@ -219,12 +219,10 @@ int bind_mount_parse(CustomMount **l, size_t *n, const char *s, bool read_only) if (!m) return -ENOMEM; - m->source = source; - m->destination = destination; + m->source = TAKE_PTR(source); + m->destination = TAKE_PTR(destination); m->read_only = read_only; - m->options = opts; - - source = destination = opts = NULL; + m->options = TAKE_PTR(opts); return 0; }