Skip to content

Commit 15ef294

Browse files
cedelavergne-ledgercedelavergne-ledger
committed
AI added fuzzing
1 parent 19ecad5 commit 15ef294

File tree

6 files changed

+510
-12
lines changed

6 files changed

+510
-12
lines changed

‎fuzzing/CMakeLists.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,7 @@ if(NOT ${CMAKE_SOURCE_DIR} STREQUAL ${CMAKE_CURRENT_SOURCE_DIR})
118118
secure_sdk
119119
INTERFACE macros
120120
alloc
121+
c_list
121122
cxng
122123
io
123124
nbgl

‎fuzzing/README.md‎

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
## Manual usage based on Ledger container
44

55
### About Fuzzing Framework
6+
67
The code is divided into the following folders:
78

89
```bash
@@ -49,23 +50,22 @@ export BOLOS_SDK=/app
4950

5051
cd fuzzing # You must run it from the fuzzing folder
5152

52-
./local_run.sh --build=1 --fuzzer=build/fuzz_bip32 --j=4 --run-fuzzer=1 --compute-coverage=1 --BOLOS_SDK=${BOLOS_SDK}
53+
./local_run.sh --BOLOS_SDK=${BOLOS_SDK} --j=4 --build=1 --fuzzer=build/fuzz_bip32 --run-fuzzer=1 --compute-coverage=1
5354
```
5455

5556
### About local_run.sh
5657

57-
| Parameter | Type | Description |
58-
| :--------------------- | :------------------ | :------------------------------------------------------------------- |
59-
| `--BOLOS_SDK` | `PATH TO BOLOS SDK` | **Required**. Path to the BOLOS SDK |
60-
| `--build` | `bool` | **Optional**. Whether to build the project (default: 0) |
61-
| `--fuzzer` | `PATH` | **Required**. Path to the fuzzer binary |
62-
| `--compute-coverage` | `bool` | **Optional**. Whether to compute coverage after fuzzing (default: 0) |
63-
| `--run-fuzzer` | `bool` | **Optional**. Whether to run or not the fuzzer (default: 0) |
64-
| `--run-crash` | `FILENAME` | **Optional**. Run the fuzzer on a specific crash input file (default: 0) |
65-
| `--sanitizer` | `address or memory` | **Optional**. Compile fuzzer with sanitizer (default: address) |
58+
| Parameter | Type | Description |
59+
| :--------------------- | :------------------ | :------------------------------------------------------------------- ---------|
60+
| `--BOLOS_SDK` | `PATH TO BOLOS SDK` | **Required**. Path to the BOLOS SDK |
61+
| `--build` | `bool` | **Optional**. Whether to build the project (default: 0) |
62+
| `--fuzzer` | `PATH` | **Required**. Path to the fuzzer binary |
63+
| `--compute-coverage` | `bool` | **Optional**. Whether to compute coverage after fuzzing (default: 0) |
64+
| `--run-fuzzer` | `bool` | **Optional**. Whether to run or not the fuzzer (default: 0) |
65+
| `--run-crash` | `FILENAME` | **Optional**. Run the fuzzer on a specific crash input file (default: 0) |
66+
| `--sanitizer` | `address or memory` | **Optional**. Compile fuzzer with sanitizer (default: address) |
6667
| `--j` | `int` | **Optional**. Number of parallel jobs/CPUs for build and fuzzing (default: 1) |
67-
| `--help` | | **Optional**. Display help message |
68-
68+
| `--help` | | **Optional**. Display help message |
6969

7070
### Writing your Harness
7171

@@ -138,6 +138,7 @@ cmake -S . -B build -DCMAKE_C_COMPILER=clang -DSANITIZER=address -G Ninja -DTARG
138138
./build/fuzz_apdu_parser
139139
./build/fuzz_base58
140140
./build/fuzz_bip32
141+
./build/fuzz_c_list
141142
./build/fuzz_qrcodegen
142143
./build/fuzz_alloc
143144
./build/fuzz_alloc_utils

‎fuzzing/docs/fuzz_c_list.md‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
# Fuzzing lib_c_list
2+
3+
## Overview
4+
5+
This fuzzer tests the generic linked list library (`lib_c_list`) for memory safety issues, edge cases, and potential crashes. It exercises all list operations including insertion, removal, sorting, and traversal.
6+
7+
## Operations Tested
8+
9+
The fuzzer uses the lower 4 bits of each input byte to select operations:
10+
11+
| Op Code | Operation | Description |
12+
|---------|-------------------|------------------------------------------------|
13+
| 0x00 | `push_front` | Add node at the beginning |
14+
| 0x01 | `push_back` | Add node at the end |
15+
| 0x02 | `pop_front` | Remove first node |
16+
| 0x03 | `pop_back` | Remove last node |
17+
| 0x04 | `insert_after` | Insert node after reference node |
18+
| 0x05 | `insert_before` | Insert node before reference node |
19+
| 0x06 | `remove` | Remove specific node |
20+
| 0x07 | `clear` | Remove all nodes |
21+
| 0x08 | `sort` | Sort list by node ID |
22+
| 0x09 | `size` | Get list size |
23+
| 0x0A | `traverse` | Traverse and verify integrity (cycle detection)|
24+
25+
## Features
26+
27+
### Safety Checks
28+
29+
- **Cycle detection**: Prevents infinite loops in traversal
30+
- **Node tracking**: All allocated nodes are tracked for cleanup
31+
- **Memory leak prevention**: Automatic cleanup at end of fuzzing iteration
32+
- **Integrity verification**: Validates list structure during traversal
33+
34+
### Test Data
35+
36+
Each node contains:
37+
38+
- Unique ID (auto-incremented)
39+
- 16 bytes of fuzzer-provided data
40+
- Standard list node structure
41+
42+
### Limits
43+
44+
- `MAX_NODES`: 1000 (prevents excessive memory usage)
45+
- `MAX_TRACKERS`: 100 (limits number of tracked nodes)
46+
- Maximum input length: 256 bytes (configurable)
47+
48+
## Building
49+
50+
From the SDK root:
51+
52+
```bash
53+
cd fuzzing
54+
mkdir -p build && cd build
55+
cmake -S .. -B . -DCMAKE_C_COMPILER=clang -DSANITIZER=address -DBOLOS_SDK=/path/to/sdk
56+
cmake --build . --target fuzz_c_list
57+
```
58+
59+
## Running
60+
61+
### Basic run
62+
63+
```bash
64+
./fuzz_c_list
65+
```
66+
67+
### With specific options
68+
69+
```bash
70+
# Run for 10000 iterations
71+
./fuzz_c_list -runs=10000
72+
73+
# Limit input size to 128 bytes
74+
./fuzz_c_list -max_len=128
75+
76+
# Use corpus directory
77+
./fuzz_c_list corpus/
78+
79+
# Timeout per input (in seconds)
80+
./fuzz_c_list -timeout=10
81+
```
82+
83+
### Using the helper script
84+
85+
```bash
86+
cd /path/to/sdk/fuzzing
87+
./local_run.sh --build=1 --fuzzer=build/fuzz_c_list --j=4 --run-fuzzer=1 --BOLOS_SDK=/path/to/sdk
88+
```
89+
90+
## Corpus
91+
92+
Initial corpus files can be placed in:
93+
94+
```bash
95+
fuzzing/harness/fuzz_c_list/
96+
```
97+
98+
Example corpus files:
99+
100+
- Simple operations: `\x00\x00...` (push_front operations)
101+
- Mixed operations: `\x00...\x01...\x02` (push_front, push_back, pop_front)
102+
- Complex sequences: Various operation combinations
103+
104+
## Debugging
105+
106+
Enable debug output by uncommenting `#define DEBUG_CRASH` in `fuzzer_c_list.c`:
107+
108+
```c
109+
#define DEBUG_CRASH
110+
```
111+
112+
This will print:
113+
114+
- Node creation/deletion
115+
- Operation execution
116+
- List size changes
117+
- Cleanup operations
118+
119+
## Crash Analysis
120+
121+
If a crash is found:
122+
123+
1. The fuzzer will save the crashing input to `crash-*` or `leak-*` files
124+
2. Reproduce the crash:
125+
126+
```bash
127+
./fuzz_c_list crash-HASH
128+
```
129+
130+
3. Debug with AddressSanitizer output
131+
4. Fix the issue in `lib_c_list/c_list.c`
132+
5. Verify fix by re-running fuzzer
133+
134+
## Expected Behavior
135+
136+
The fuzzer should:
137+
138+
- ✅ Handle all operations safely
139+
- ✅ Prevent memory leaks (all nodes cleaned up)
140+
- ✅ Detect invalid operations (return false)
141+
- ✅ Handle edge cases (empty list, single node, etc.)
142+
- ✅ Maintain list integrity (no cycles, no corruption)
143+
144+
## Known Issues
145+
146+
None currently. If you find a crash, please report it!
147+
148+
## Coverage
149+
150+
To generate coverage report:
151+
152+
```bash
153+
./local_run.sh --build=1 --fuzzer=build/fuzz_c_list --compute-coverage=1 --BOLOS_SDK=/path/to/sdk
154+
```
155+
156+
Coverage files will be in `fuzzing/out/coverage/`.

‎fuzzing/extra/lib_c_list.cmake‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
include_guard()
2+
3+
# Include required libraries
4+
include(${BOLOS_SDK}/fuzzing/libs/lib_c_list.cmake)
5+
include(${BOLOS_SDK}/fuzzing/mock/mock.cmake)
6+
7+
# Define the executable and its properties here
8+
add_executable(fuzz_c_list ${BOLOS_SDK}/fuzzing/harness/fuzzer_c_list.c)
9+
target_compile_options(fuzz_c_list PUBLIC ${COMPILATION_FLAGS})
10+
target_link_options(fuzz_c_list PUBLIC ${LINK_FLAGS})
11+
12+
# Link with required libraries
13+
target_link_libraries(fuzz_c_list PUBLIC c_list mock)

0 commit comments

Comments
 (0)