fuzz: port fuzz-url-decode-mem from OSS-Fuzz

Git's fuzz tests are run continuously as part of OSS-Fuzz [1]. Several
additional fuzz tests have been contributed directly to OSS-Fuzz;
however, these tests are vulnerable to bitrot because they are not built
during Git's CI runs, and thus breaking changes are much less likely to
be noticed by Git contributors.

Port one of these tests back to the Git project:
fuzz-url-decode-mem

This test was originally written by Eric Sesterhenn as part of a
security audit of Git [2]. It was then contributed to the OSS-Fuzz repo
in commit c58ac4492 (Git fuzzing: uncomment the existing and add new
targets. (#11486), 2024-02-21) by Jaroslav Lobačevski. I (Josh Steadmon)
have verified with both Eric and Jaroslav that they're OK with moving
this test to the Git project.

[1] https://github.com/google/oss-fuzz
[2] https://ostif.org/wp-content/uploads/2023/01/X41-OSTIF-Gitlab-Git-Security-Audit-20230117-public.pdf

Co-authored-by: Jaroslav Lobačevski <jarlob@gmail.com>
Co-authored-by: Josh Steadmon <steadmon@google.com>
Signed-off-by: Josh Steadmon <steadmon@google.com>
Signed-off-by: Taylor Blau <me@ttaylorr.com>

diff --git a/Makefile b/Makefile
index cfbbd70fdc7dc0ed3cbdfd5bdbca492f418f13d5..5d630eedaae8015cd925b9a34096f05891b2f70c 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -2427,6 +2427,7 @@ FUZZ_OBJS += oss-fuzz/fuzz-date.o
 FUZZ_OBJS += oss-fuzz/fuzz-pack-headers.o
 FUZZ_OBJS += oss-fuzz/fuzz-pack-idx.o
 FUZZ_OBJS += oss-fuzz/fuzz-parse-attr-line.o
+FUZZ_OBJS += oss-fuzz/fuzz-url-decode-mem.o
 .PHONY: fuzz-objs
 fuzz-objs: $(FUZZ_OBJS)
 

diff --git a/ci/run-build-and-minimal-fuzzers.sh b/ci/run-build-and-minimal-fuzzers.sh
index 13c85320d6b22ebcf2626f34ca2af311b9512705..e7b97952e7d485d587025fda383a470c32de54c3 100755 (executable)
--- a/ci/run-build-and-minimal-fuzzers.sh
+++ b/ci/run-build-and-minimal-fuzzers.sh
@@ -21,6 +21,7 @@ date
 pack-headers
 pack-idx
 parse-attr-line
+url-decode-mem
 "
 
 for fuzzer in $fuzzers; do

diff --git a/oss-fuzz/.gitignore b/oss-fuzz/.gitignore
index ec185f061c78a135447803ddb3f09afda9ec9e3e..f2d74de457259decd4d279dc1069c5615efa26ec 100644 (file)
--- a/oss-fuzz/.gitignore
+++ b/oss-fuzz/.gitignore
@@ -5,3 +5,4 @@ fuzz-date
 fuzz-pack-headers
 fuzz-pack-idx
 fuzz-parse-attr-line
+fuzz-url-decode-mem

diff --git a/oss-fuzz/fuzz-url-decode-mem.c b/oss-fuzz/fuzz-url-decode-mem.c
new file mode 100644 (file)
index 0000000..2342aa9
--- /dev/null
+++ b/oss-fuzz/fuzz-url-decode-mem.c
@@ -0,0 +1,43 @@
+#include "git-compat-util.h"
+#include <stddef.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <stdio.h>
+#include "url.h"
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+       char *buf;
+       char *r;
+       const char *pbuf;
+
+       buf = malloc(size + 1);
+       if (!buf)
+               return 0;
+
+       memcpy(buf, data, size);
+       buf[size] = 0;
+
+       // start fuzzing
+       r = url_decode(buf);
+       free(r);
+
+       r = url_percent_decode(buf);
+       free(r);
+
+       pbuf = (const char*) buf;
+       r = url_decode_parameter_name(&pbuf);
+       free(r);
+
+       pbuf = (const char*) buf;
+       r = url_decode_parameter_value(&pbuf);
+       free(r);
+
+       // cleanup
+       free(buf);
+
+       return 0;
+}