From: Andrew Bartlett <abartlet@samba.org>
Date: Sat, 30 Nov 2019 07:23:18 +0000 (+1300)
Subject: lib/fuzzer: Allow building a fuzz binary for just one interface
X-Git-Tag: ldb-2.1.0~321
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a9a8bcf731659f0898f70759e78a9909f018ae48;p=thirdparty%2Fsamba.git

lib/fuzzer: Allow building a fuzz binary for just one interface

This helps direct the fuzzer at a particular function that we are concerned about.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
---

diff --git a/lib/fuzzing/fuzz_ndr_X.c b/lib/fuzzing/fuzz_ndr_X.c
index 8c9e5721739..cdc9de50a8c 100644
--- a/lib/fuzzing/fuzz_ndr_X.c
+++ b/lib/fuzzing/fuzz_ndr_X.c
@@ -162,6 +162,20 @@ int LLVMFuzzerTestOneInput(uint8_t *data, size_t size) {
 	const struct ndr_interface_call *f = NULL;
 	NTSTATUS status;
 
+/*
+ * This allows us to build binaries to fuzz just one target function
+ *
+ * In this mode the input becomes the 'stub data', there is no prefix.
+ *
+ * There is no NDR64 support in this mode at this time.
+ */
+#if defined(FUZZ_TYPE) && defined(FUZZ_FUNCTION)
+#undef HEADER_SIZE
+#define HEADER_SIZE 0
+	fuzz_packet_flags = 0;
+	type = FUZZ_TYPE;
+	function = FUZZ_FUNCTION;
+#else
 	if (size < HEADER_SIZE) {
 		/*
 		 * the first few bytes decide what is being fuzzed --
@@ -178,6 +192,7 @@ int LLVMFuzzerTestOneInput(uint8_t *data, size_t size) {
 	function = SVAL(data, 2);
 
 	type = fuzz_packet_flags & 3;
+#endif
 
 	switch (type) {
 	case TYPE_STRUCT:
diff --git a/lib/fuzzing/wscript_build b/lib/fuzzing/wscript_build
index cf94e8f89a7..b187f088445 100644
--- a/lib/fuzzing/wscript_build
+++ b/lib/fuzzing/wscript_build
@@ -43,14 +43,25 @@ bld.SAMBA_BINARY('fuzz_ldb_parse_tree',
                  deps='fuzzing ldb',
                  fuzzer=True)
 
-def SAMBA_NDR_FUZZ(bld, interface, auto_deps=False):
+# The fuzz_type and fuzz_function parameters make the built
+# fuzzer take the same input as ndrdump and so the same that
+# could be sent to the client or server as the stub data.
+
+def SAMBA_NDR_FUZZ(bld, interface, auto_deps=False,
+                   fuzz_type=None, fuzz_function=None):
     name = "fuzz_ndr_%s" % (interface.lower())
     fuzz_dir = os.path.join(bld.env.srcdir, 'lib/fuzzing')
     fuzz_reldir = os.path.relpath(fuzz_dir, bld.path.abspath())
     fuzz_src = os.path.join(fuzz_reldir, 'fuzz_ndr_X.c')
-    fuzz_named_src = os.path.join(fuzz_reldir,
-                                  'fuzz_ndr_%s.c' % interface.lower())
 
+    cflags = "-D FUZZ_PIPE_TABLE=ndr_table_%s" % interface
+    if fuzz_type and fuzz_function:
+        name += "_%s_%d" % (fuzz_type, fuzz_function)
+        cflags += " -D FUZZ_TYPE=%s -DFUZZ_FUNCTION=%d" % (fuzz_type,
+                                                           fuzz_function)
+
+    fuzz_named_src = os.path.join(fuzz_reldir,
+                                  '%s.c' % (name))
     # Work around an issue that WAF is invoked from up to 3 different
     # directories so doesn't create a unique name for the multiple .o
     # files like it would if called from just one place.
@@ -65,7 +76,7 @@ def SAMBA_NDR_FUZZ(bld, interface, auto_deps=False):
         deps = "ndr-table NDR_DCERPC"
 
     bld.SAMBA_BINARY(name, source=fuzz_named_src,
-                     cflags = "-D FUZZ_PIPE_TABLE=ndr_table_%s" % interface,
+                     cflags = cflags,
                      deps = deps,
                      fuzzer=True)
 
@@ -124,3 +135,10 @@ bld.SAMBA_NDR_FUZZ('IDispatch')
 bld.SAMBA_NDR_FUZZ('IMarshal')
 bld.SAMBA_NDR_FUZZ('ICoffeeMachine')
 bld.SAMBA_NDR_FUZZ('IStream')
+
+# Specific struct or function on the interface
+
+bld.SAMBA_NDR_FUZZ('spoolss',
+                   auto_deps=True,
+                   fuzz_type="TYPE_IN",
+                   fuzz_function=65)