fuzzers: ignore size limits when compiled standalone

This way we can still call fuzzers on old samples, but oss-fuzz will not waste
its and our time finding overly large inputs.

diff --git a/meson.build b/meson.build
index 7d4233ca7fa079cf4c64b32fd0ec2a98d23d23b8..e43dcf7d509074242c2b35a2d0abc25adac51215 100644 (file)
--- a/meson.build
+++ b/meson.build
@@ -50,6 +50,11 @@ endif
 skip_deps = want_ossfuzz or get_option('skip-deps')
 fuzzer_build = want_ossfuzz or want_libfuzzer
 
+# If we're building *not* for actual fuzzing, allow input samples of any size
+# (for testing and for reproduction of issues discovered with previously-higher
+# limits).
+conf.set10('FUZZ_USE_SIZE_LIMIT', fuzzer_build)
+
 # Create a title-less summary section early, so it ends up first in the output.
 # More items are added later after they have been detected.
 summary({'build mode' : get_option('mode')})

diff --git a/src/boot/efi/fuzz-bcd.c b/src/boot/efi/fuzz-bcd.c
index 3df55a5c363485335639edd4f9f64e273a9f1630..e56183c4f010ebe4431773da3729d50d5941d6f1 100644 (file)
--- a/src/boot/efi/fuzz-bcd.c
+++ b/src/boot/efi/fuzz-bcd.c
@@ -11,7 +11,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         _cleanup_free_ void *p = NULL;
 
         /* This limit was borrowed from src/boot/efi/boot.c */
-        if (size > 100*1024)
+        if (outside_size_range(size, 0, 100*1024))
                 return 0;
 
         if (!getenv("SYSTEMD_LOG_LEVEL"))

diff --git a/src/core/fuzz-unit-file.c b/src/core/fuzz-unit-file.c
index 81cede2193d2ef3a97ccfe3b02684d4081e92019..058be6aa74d65586540a09d9f9d88b11fe1c2729 100644 (file)
--- a/src/core/fuzz-unit-file.c
+++ b/src/core/fuzz-unit-file.c
@@ -21,7 +21,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         const char *name;
         long offset;
 
-        if (size > 65536)
+        if (outside_size_range(size, 0, 65536))
                 return 0;
 
         f = data_to_file(data, size);

diff --git a/src/fuzz/fuzz-bootspec.c b/src/fuzz/fuzz-bootspec.c
index 0594a0dea55bf48da1e6b5f655555712c54159f2..c26cc94db93237362653bf3ebb17e73a5969d76a 100644 (file)
--- a/src/fuzz/fuzz-bootspec.c
+++ b/src/fuzz/fuzz-bootspec.c
@@ -84,7 +84,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         _cleanup_(boot_config_free) BootConfig config = BOOT_CONFIG_NULL;
         int r;
 
-        if (size > 65536)
+        if (outside_size_range(size, 0, 65536))
                 return 0;
 
         /* Disable most logging if not running standalone */

diff --git a/src/fuzz/fuzz-env-file.c b/src/fuzz/fuzz-env-file.c
index 431f172306abae0494b839dfaa5b77a7cb9bef2c..6217361b2e759b241909fafe9b857a6c5c1771e9 100644 (file)
--- a/src/fuzz/fuzz-env-file.c
+++ b/src/fuzz/fuzz-env-file.c
@@ -12,7 +12,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         _cleanup_fclose_ FILE *f = NULL;
         _cleanup_strv_free_ char **rl = NULL, **rlp =  NULL;
 
-        if (size > 65536)
+        if (outside_size_range(size, 0, 65536))
                 return 0;
 
         f = data_to_file(data, size);

diff --git a/src/fuzz/fuzz.h b/src/fuzz/fuzz.h
index d7cbb0bb1649f4231e552d26417ff15d8a44c81c..04c438edafae6c94f2082a85eddd2ae68710c489 100644 (file)
--- a/src/fuzz/fuzz.h
+++ b/src/fuzz/fuzz.h
@@ -4,6 +4,7 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include "env-util.h"
 #include "fileio.h"
 
 /* The entry point into the fuzzer */
@@ -15,3 +16,14 @@ static inline FILE* data_to_file(const uint8_t *data, size_t size) {
         else
                 return fmemopen_unlocked((char*) data, size, "re");
 }
+
+/* Check if we are within the specified size range.
+ * The upper limit is ignored if FUZZ_USE_SIZE_LIMIT is unset.
+ */
+static inline bool outside_size_range(size_t size, size_t lower, size_t upper) {
+        if (size < lower)
+                return true;
+        if (size > upper)
+                return FUZZ_USE_SIZE_LIMIT;
+        return false;
+}

diff --git a/src/journal-remote/fuzz-journal-remote.c b/src/journal-remote/fuzz-journal-remote.c
index dd7884ee9af3cd81403b4bba2c812c044ab4ccc5..db10c2b01271070758ae69bb1f796c784094394f 100644 (file)
--- a/src/journal-remote/fuzz-journal-remote.c
+++ b/src/journal-remote/fuzz-journal-remote.c
@@ -24,7 +24,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         _cleanup_(journal_remote_server_destroy) RemoteServer s = {};
         int r;
 
-        if (size <= 2 || size > 65536)
+        if (outside_size_range(size, 3, 65536))
                 return 0;
 
         if (!getenv("SYSTEMD_LOG_LEVEL"))

diff --git a/src/journal/fuzz-journald-stream.c b/src/journal/fuzz-journald-stream.c
index 8a979df3ced408094695d86838772e48e6a4013f..67e990ab7cb8b7e793dd110504e40a79dc149d98 100644 (file)
--- a/src/journal/fuzz-journald-stream.c
+++ b/src/journal/fuzz-journald-stream.c
@@ -16,7 +16,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         StdoutStream *stream;
         int v;
 
-        if (size == 0 || size > 65536)
+        if (outside_size_range(size, 1, 65536))
                 return 0;
 
         if (!getenv("SYSTEMD_LOG_LEVEL"))

diff --git a/src/libsystemd-network/fuzz-dhcp6-client.c b/src/libsystemd-network/fuzz-dhcp6-client.c
index 32e35510e53521d0b395ff632026d7b882f67741..3b53c5c6a80d98320ed9c12dca69879b75c5f4cd 100644 (file)
--- a/src/libsystemd-network/fuzz-dhcp6-client.c
+++ b/src/libsystemd-network/fuzz-dhcp6-client.c
@@ -73,7 +73,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         struct in6_addr hint = { { { 0x3f, 0xfe, 0x05, 0x01, 0xff, 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 } } };
         static const char *v1_data = "hogehoge", *v2_data = "foobar";
 
-        if (size > 65536)
+        if (outside_size_range(size, 0, 65536))
                 return 0;
 
         assert_se(sd_event_new(&e) >= 0);

diff --git a/src/libsystemd-network/fuzz-lldp-rx.c b/src/libsystemd-network/fuzz-lldp-rx.c
index 6ee623fa1176797de16a6cf5f6c92e60eeae30df..6419075a4a5bfc1106f7da51cffd588e345d3c4a 100644 (file)
--- a/src/libsystemd-network/fuzz-lldp-rx.c
+++ b/src/libsystemd-network/fuzz-lldp-rx.c
@@ -23,7 +23,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         _cleanup_(sd_event_unrefp) sd_event *e = NULL;
         _cleanup_(sd_lldp_rx_unrefp) sd_lldp_rx *lldp_rx = NULL;
 
-        if (size > 2048)
+        if (outside_size_range(size, 0, 2048))
                 return 0;
 
         assert_se(sd_event_new(&e) == 0);

diff --git a/src/libsystemd-network/fuzz-ndisc-rs.c b/src/libsystemd-network/fuzz-ndisc-rs.c
index 20350d449cf398d39b5eb683c8eb2087ce61f41b..b294611fab6fce583d36e5432a5a2afefe333ed7 100644 (file)
--- a/src/libsystemd-network/fuzz-ndisc-rs.c
+++ b/src/libsystemd-network/fuzz-ndisc-rs.c
@@ -43,7 +43,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         _cleanup_(sd_event_unrefp) sd_event *e = NULL;
         _cleanup_(sd_ndisc_unrefp) sd_ndisc *nd = NULL;
 
-        if (size > 2048)
+        if (outside_size_range(size, 0, 2048))
                 return 0;
 
         assert_se(sd_event_new(&e) >= 0);

diff --git a/src/libsystemd/sd-bus/fuzz-bus-match.c b/src/libsystemd/sd-bus/fuzz-bus-match.c
index 39ab62196a45800df09b7823689fdb43eca47a5c..f74394bcde3abdcaeb008443956a92de8f3cae27 100644 (file)
--- a/src/libsystemd/sd-bus/fuzz-bus-match.c
+++ b/src/libsystemd/sd-bus/fuzz-bus-match.c
@@ -15,7 +15,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         _cleanup_(sd_bus_unrefp) sd_bus *bus = NULL;
         int r;
 
-        if (size > 65536)
+        if (outside_size_range(size, 0, 65536))
                 return 0;
 
         /* We don't want to fill the logs with messages about parse errors.

diff --git a/src/network/fuzz-netdev-parser.c b/src/network/fuzz-netdev-parser.c
index d8cbd2891c242a5d9b2fc8fa7777173ab8ea4d99..77e87e9c433699fa7a052b6088650f81a5e06eb3 100644 (file)
--- a/src/network/fuzz-netdev-parser.c
+++ b/src/network/fuzz-netdev-parser.c
@@ -11,7 +11,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         _cleanup_fclose_ FILE *f = NULL;
         _cleanup_(unlink_tempfilep) char netdev_config[] = "/tmp/fuzz-networkd.XXXXXX";
 
-        if (size > 65536)
+        if (outside_size_range(size, 0, 65536))
                 return 0;
 
         if (!getenv("SYSTEMD_LOG_LEVEL"))

diff --git a/src/network/fuzz-network-parser.c b/src/network/fuzz-network-parser.c
index 630c86a98cef886c6737820e7774ba0791e461fc..0c9d6d2110d1deb9772c42779727ef4caf6fdad3 100644 (file)
--- a/src/network/fuzz-network-parser.c
+++ b/src/network/fuzz-network-parser.c
@@ -11,7 +11,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         _cleanup_fclose_ FILE *f = NULL;
         _cleanup_(unlink_tempfilep) char network_config[] = "/tmp/fuzz-networkd.XXXXXX";
 
-        if (size > 65536)
+        if (outside_size_range(size, 0, 65536))
                 return 0;
 
         if (!getenv("SYSTEMD_LOG_LEVEL"))

diff --git a/src/nspawn/fuzz-nspawn-oci.c b/src/nspawn/fuzz-nspawn-oci.c
index 7110a66187ee0d261d13e402f8d2170f8db5171e..5d0383479b200a8f89fccedc4af90a51b0630249 100644 (file)
--- a/src/nspawn/fuzz-nspawn-oci.c
+++ b/src/nspawn/fuzz-nspawn-oci.c
@@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         _cleanup_fclose_ FILE *f = NULL;
         _cleanup_(settings_freep) Settings *s = NULL;
 
-        if (size > 65536)
+        if (outside_size_range(size, 0, 65536))
                 return 0;
 
         f = data_to_file(data, size);

diff --git a/src/nspawn/fuzz-nspawn-settings.c b/src/nspawn/fuzz-nspawn-settings.c
index 76838146591b025287a2a0aca297439fabcdc624..40ee78438d2f15494a187031df9454ef0cf53fdc 100644 (file)
--- a/src/nspawn/fuzz-nspawn-settings.c
+++ b/src/nspawn/fuzz-nspawn-settings.c
@@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         _cleanup_fclose_ FILE *f = NULL;
         _cleanup_(settings_freep) Settings *s = NULL;
 
-        if (size > 65536)
+        if (outside_size_range(size, 0, 65536))
                 return 0;
 
         f = data_to_file(data, size);

diff --git a/src/resolve/fuzz-dns-packet.c b/src/resolve/fuzz-dns-packet.c
index b9a0aa1216a63bd945bc0f9eaeaf25001499935b..de5ee204341838b4d4bbc11d5fee4688f21704be 100644 (file)
--- a/src/resolve/fuzz-dns-packet.c
+++ b/src/resolve/fuzz-dns-packet.c
@@ -7,7 +7,7 @@
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
 
-        if (size > DNS_PACKET_SIZE_MAX)
+        if (outside_size_range(size, 0, DNS_PACKET_SIZE_MAX))
                 return 0;
 
         assert_se(dns_packet_new(&p, DNS_PROTOCOL_DNS, 0, DNS_PACKET_SIZE_MAX) >= 0);

diff --git a/src/udev/fido_id/fuzz-fido-id-desc.c b/src/udev/fido_id/fuzz-fido-id-desc.c
index 44d66df1a04f452f9508df9f53ee3c4018798479..dd2ae5b3acb404d1be486550d8ffc24c2fcc50ee 100644 (file)
--- a/src/udev/fido_id/fuzz-fido-id-desc.c
+++ b/src/udev/fido_id/fuzz-fido-id-desc.c
@@ -15,8 +15,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         if (!getenv("SYSTEMD_LOG_LEVEL"))
                 log_set_max_level(LOG_CRIT);
 
-        if (size > HID_MAX_DESCRIPTOR_SIZE)
+        if (outside_size_range(size, 0, HID_MAX_DESCRIPTOR_SIZE))
                 return 0;
+
         (void) is_fido_security_token_desc(data, size);
 
         return 0;

diff --git a/src/udev/fuzz-udev-rules.c b/src/udev/fuzz-udev-rules.c
index 0208f8c2d8101db175ae58ec6b4e3c72b1c1aa66..255d5df7570ed248fb8a32646d809afd41a401e0 100644 (file)
--- a/src/udev/fuzz-udev-rules.c
+++ b/src/udev/fuzz-udev-rules.c
@@ -15,7 +15,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         _cleanup_(unlink_tempfilep) char filename[] = "/tmp/fuzz-udev-rules.XXXXXX";
         int r;
 
-        if (size > 65536)
+        if (outside_size_range(size, 0, 65536))
                 return 0;
 
         if (!getenv("SYSTEMD_LOG_LEVEL"))

diff --git a/src/udev/net/fuzz-link-parser.c b/src/udev/net/fuzz-link-parser.c
index 5727897305d6bd7813140d68fad070ffb8e0b325..c809791bc105fdf60e3f11d3fbf8f594ad063d27 100644 (file)
--- a/src/udev/net/fuzz-link-parser.c
+++ b/src/udev/net/fuzz-link-parser.c
@@ -11,7 +11,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         _cleanup_(unlink_tempfilep) char filename[] = "/tmp/fuzz-link-config.XXXXXX";
         _cleanup_fclose_ FILE *f = NULL;
 
-        if (size > 65536)
+        if (outside_size_range(size, 0, 65536))
                 return 0;
 
         if (!getenv("SYSTEMD_LOG_LEVEL"))

diff --git a/src/xdg-autostart-generator/fuzz-xdg-desktop.c b/src/xdg-autostart-generator/fuzz-xdg-desktop.c
index 0ae27fc39d9f5636f450f81715c59a543a19ef09..084c9073070e7e608b9f5bbb3f464adad1e52c83 100644 (file)
--- a/src/xdg-autostart-generator/fuzz-xdg-desktop.c
+++ b/src/xdg-autostart-generator/fuzz-xdg-desktop.c
@@ -17,7 +17,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         _cleanup_(xdg_autostart_service_freep) XdgAutostartService *service = NULL;
         _cleanup_(rm_rf_physical_and_freep) char *tmpdir = NULL;
 
-        if (size > 65536)
+        if (outside_size_range(size, 0, 65536))
                 return 0;
 
         /* We don't want to fill the logs with messages about parse errors.