fuzz: port fuzz-credential-from-url-gently from OSS-Fuzz

Git's fuzz tests are run continuously as part of OSS-Fuzz [1]. Several
additional fuzz tests have been contributed directly to OSS-Fuzz;
however, these tests are vulnerable to bitrot because they are not built
during Git's CI runs, and thus breaking changes are much less likely to
be noticed by Git contributors.

Port one of these tests back to the Git project:
fuzz-credential-from-url-gently

This test was originally written by Eric Sesterhenn as part of a
security audit of Git [2]. It was then contributed to the OSS-Fuzz repo
in commit c58ac4492 (Git fuzzing: uncomment the existing and add new
targets. (#11486), 2024-02-21) by Jaroslav Lobačevski. I (Josh Steadmon)
have verified with both Eric and Jaroslav that they're OK with moving
this test to the Git project.

[1] https://github.com/google/oss-fuzz
[2] https://ostif.org/wp-content/uploads/2023/01/X41-OSTIF-Gitlab-Git-Security-Audit-20230117-public.pdf

Co-authored-by: Jaroslav Lobačevski <jarlob@gmail.com>
Co-authored-by: Josh Steadmon <steadmon@google.com>
Signed-off-by: Josh Steadmon <steadmon@google.com>
Signed-off-by: Taylor Blau <me@ttaylorr.com>

diff --git a/Makefile b/Makefile
index feeed6f9321a5069424c3adb21f92ad4abec82e8..22f7585f74e5bda7923e6f4e497e3758db600acd 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -2422,6 +2422,7 @@ endif
 FUZZ_OBJS += oss-fuzz/dummy-cmd-main.o
 FUZZ_OBJS += oss-fuzz/fuzz-commit-graph.o
 FUZZ_OBJS += oss-fuzz/fuzz-config.o
+FUZZ_OBJS += oss-fuzz/fuzz-credential-from-url-gently.o
 FUZZ_OBJS += oss-fuzz/fuzz-date.o
 FUZZ_OBJS += oss-fuzz/fuzz-pack-headers.o
 FUZZ_OBJS += oss-fuzz/fuzz-pack-idx.o

diff --git a/ci/run-build-and-minimal-fuzzers.sh b/ci/run-build-and-minimal-fuzzers.sh
index af8065f34992f86831b50b7af4d671c1d9f8805b..631796ab8bf8ab4dd89990f44adeffd18c025704 100755 (executable)
--- a/ci/run-build-and-minimal-fuzzers.sh
+++ b/ci/run-build-and-minimal-fuzzers.sh
@@ -13,7 +13,16 @@ group "Build fuzzers" make \
        LIB_FUZZING_ENGINE="-fsanitize=fuzzer,address" \
        fuzz-all
 
-for fuzzer in commit-graph config date pack-headers pack-idx ; do
+fuzzers="
+commit-graph
+config
+credential-from-url-gently
+date
+pack-headers
+pack-idx
+"
+
+for fuzzer in $fuzzers; do
        begin_group "fuzz-$fuzzer"
        ./oss-fuzz/fuzz-$fuzzer -verbosity=0 -runs=1 || exit 1
        end_group "fuzz-$fuzzer"

diff --git a/oss-fuzz/.gitignore b/oss-fuzz/.gitignore
index a877c11f42b2d25550457b55c2c021985adacd1f..2cfc845b202d668328c4776b7d47533f86f6b3b9 100644 (file)
--- a/oss-fuzz/.gitignore
+++ b/oss-fuzz/.gitignore
@@ -1,5 +1,6 @@
 fuzz-commit-graph
 fuzz-config
+fuzz-credential-from-url-gently
 fuzz-date
 fuzz-pack-headers
 fuzz-pack-idx

diff --git a/oss-fuzz/fuzz-credential-from-url-gently.c b/oss-fuzz/fuzz-credential-from-url-gently.c
new file mode 100644 (file)
index 0000000..c872f9a
--- /dev/null
+++ b/oss-fuzz/fuzz-credential-from-url-gently.c
@@ -0,0 +1,32 @@
+#include "git-compat-util.h"
+#include <stddef.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <stdio.h>
+#include "credential.h"
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+       struct credential c;
+       char *buf;
+
+       buf = malloc(size + 1);
+       if (!buf)
+               return 0;
+
+       memcpy(buf, data, size);
+       buf[size] = 0;
+
+       // start fuzzing
+       credential_init(&c);
+       credential_from_url_gently(&c, buf, 1);
+
+       // cleanup
+       credential_clear(&c);
+       free(buf);
+
+       return 0;
+}