lib/fuzzer: Allow building a fuzz binary for just one interface

This helps direct the fuzzer at a particular function that we are concerned about.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

diff --git a/lib/fuzzing/fuzz_ndr_X.c b/lib/fuzzing/fuzz_ndr_X.c
index 8c9e572173935c08089bfcfa651024146dfad704..cdc9de50a8c05b25e4c963c66db68bbd421ebd1f 100644 (file)
--- a/lib/fuzzing/fuzz_ndr_X.c
+++ b/lib/fuzzing/fuzz_ndr_X.c
@@ -162,6 +162,20 @@ int LLVMFuzzerTestOneInput(uint8_t *data, size_t size) {
        const struct ndr_interface_call *f = NULL;
        NTSTATUS status;
 
+/*
+ * This allows us to build binaries to fuzz just one target function
+ *
+ * In this mode the input becomes the 'stub data', there is no prefix.
+ *
+ * There is no NDR64 support in this mode at this time.
+ */
+#if defined(FUZZ_TYPE) && defined(FUZZ_FUNCTION)
+#undef HEADER_SIZE
+#define HEADER_SIZE 0
+       fuzz_packet_flags = 0;
+       type = FUZZ_TYPE;
+       function = FUZZ_FUNCTION;
+#else
        if (size < HEADER_SIZE) {
                /*
                 * the first few bytes decide what is being fuzzed --
@@ -178,6 +192,7 @@ int LLVMFuzzerTestOneInput(uint8_t *data, size_t size) {
        function = SVAL(data, 2);
 
        type = fuzz_packet_flags & 3;
+#endif
 
        switch (type) {
        case TYPE_STRUCT:

diff --git a/lib/fuzzing/wscript_build b/lib/fuzzing/wscript_build
index cf94e8f89a7a4c95d4fa19bbf60af0b6b5203b37..b187f088445cda65bbb345a05695272ed52edb30 100644 (file)
--- a/lib/fuzzing/wscript_build
+++ b/lib/fuzzing/wscript_build
@@ -43,14 +43,25 @@ bld.SAMBA_BINARY('fuzz_ldb_parse_tree',
                  deps='fuzzing ldb',
                  fuzzer=True)
 
-def SAMBA_NDR_FUZZ(bld, interface, auto_deps=False):
+# The fuzz_type and fuzz_function parameters make the built
+# fuzzer take the same input as ndrdump and so the same that
+# could be sent to the client or server as the stub data.
+
+def SAMBA_NDR_FUZZ(bld, interface, auto_deps=False,
+                   fuzz_type=None, fuzz_function=None):
     name = "fuzz_ndr_%s" % (interface.lower())
     fuzz_dir = os.path.join(bld.env.srcdir, 'lib/fuzzing')
     fuzz_reldir = os.path.relpath(fuzz_dir, bld.path.abspath())
     fuzz_src = os.path.join(fuzz_reldir, 'fuzz_ndr_X.c')
-    fuzz_named_src = os.path.join(fuzz_reldir,
-                                  'fuzz_ndr_%s.c' % interface.lower())
 
+    cflags = "-D FUZZ_PIPE_TABLE=ndr_table_%s" % interface
+    if fuzz_type and fuzz_function:
+        name += "_%s_%d" % (fuzz_type, fuzz_function)
+        cflags += " -D FUZZ_TYPE=%s -DFUZZ_FUNCTION=%d" % (fuzz_type,
+                                                           fuzz_function)
+
+    fuzz_named_src = os.path.join(fuzz_reldir,
+                                  '%s.c' % (name))
     # Work around an issue that WAF is invoked from up to 3 different
     # directories so doesn't create a unique name for the multiple .o
     # files like it would if called from just one place.
@@ -65,7 +76,7 @@ def SAMBA_NDR_FUZZ(bld, interface, auto_deps=False):
         deps = "ndr-table NDR_DCERPC"
 
     bld.SAMBA_BINARY(name, source=fuzz_named_src,
-                     cflags = "-D FUZZ_PIPE_TABLE=ndr_table_%s" % interface,
+                     cflags = cflags,
                      deps = deps,
                      fuzzer=True)
 
@@ -124,3 +135,10 @@ bld.SAMBA_NDR_FUZZ('IDispatch')
 bld.SAMBA_NDR_FUZZ('IMarshal')
 bld.SAMBA_NDR_FUZZ('ICoffeeMachine')
 bld.SAMBA_NDR_FUZZ('IStream')
+
+# Specific struct or function on the interface
+
+bld.SAMBA_NDR_FUZZ('spoolss',
+                   auto_deps=True,
+                   fuzz_type="TYPE_IN",
+                   fuzz_function=65)