Skip to content

Commit 642aca0

Browse files
committed
Add fuzzing functionality
Closes ##370.
1 parent b0870e9 commit 642aca0

16 files changed

+607
-56
lines changed

.gitattributes

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,8 @@
2929
*.docx binary
3030
*.pptx binary
3131
*.bin binary
32+
*.exe binary
33+
test/Verifiable.FuzzTests/libfuzzer-dotnet-ubuntu binary
3234
*.gz filter=lfs diff=lfs merge=lfs -text
3335
*.jffs2 filter=lfs diff=lfs merge=lfs -text
3436
*.zip filter=lfs diff=lfs merge=lfs -text
@@ -47,3 +49,6 @@
4749
*.wav filter=lfs diff=lfs merge=lfs -text
4850
*.myo filter=lfs diff=lfs merge=lfs -text
4951
*.vsmdi filter=lfs diff=lfs merge=lfs -text
52+
*.vsmdi filter=lfs diff=lfs merge=lfs -text
53+
54+

Directory.Packages.props

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,7 @@
2222
<PackageVersion Include="System.Collections.Immutable" Version="8.0.0" />
2323
<PackageVersion Include="System.Net.Http.Json" Version="8.0.0" />
2424
<PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="8.0.0" />
25-
<PackageVersion Include="System.Text.Json" Version="8.0.4" />
26-
<PackageVersion Include="WinSharpFuzz" Version="1.0.0" />
25+
<PackageVersion Include="System.Text.Json" Version="8.0.4" />
2726
<PackageVersion Include="xunit" Version="2.9.0" />
2827
<PackageVersion Include="xunit.analyzers" Version="1.15.0" />
2928
<PackageVersion Include="xunit.extensibility.execution" Version="2.9.0" />

Verifiable.sln

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,8 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = ".vscode", ".vscode", "{BE64
7070
.vscode\tasks.json = .vscode\tasks.json
7171
EndProjectSection
7272
EndProject
73+
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Verifiable.FuzzTests", "test\Verifiable.FuzzTests\Verifiable.FuzzTests.csproj", "{A50E91E9-51A8-490D-B92B-97C547B98539}"
74+
EndProject
7375
Global
7476
GlobalSection(SolutionConfigurationPlatforms) = preSolution
7577
Debug|Any CPU = Debug|Any CPU
@@ -120,6 +122,10 @@ Global
120122
{FF947DEC-29E7-4700-94A4-0E84B2917BF5}.Debug|Any CPU.Build.0 = Debug|Any CPU
121123
{FF947DEC-29E7-4700-94A4-0E84B2917BF5}.Release|Any CPU.ActiveCfg = Release|Any CPU
122124
{FF947DEC-29E7-4700-94A4-0E84B2917BF5}.Release|Any CPU.Build.0 = Release|Any CPU
125+
{A50E91E9-51A8-490D-B92B-97C547B98539}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
126+
{A50E91E9-51A8-490D-B92B-97C547B98539}.Debug|Any CPU.Build.0 = Debug|Any CPU
127+
{A50E91E9-51A8-490D-B92B-97C547B98539}.Release|Any CPU.ActiveCfg = Release|Any CPU
128+
{A50E91E9-51A8-490D-B92B-97C547B98539}.Release|Any CPU.Build.0 = Release|Any CPU
123129
EndGlobalSection
124130
GlobalSection(SolutionProperties) = preSolution
125131
HideSolutionNode = FALSE
@@ -140,6 +146,7 @@ Global
140146
{1B79A5A8-0754-4F72-AD32-E791F9A8ED23} = {737B175F-5A06-480C-B93F-42B31EF4EFA7}
141147
{CD06BE0E-287F-4A01-B500-CD92465F1E2D} = {35CAB8A9-7332-4D46-BBD3-83A37A747F5E}
142148
{BE64721C-A756-4078-B683-34AC9B639E28} = {35CAB8A9-7332-4D46-BBD3-83A37A747F5E}
149+
{A50E91E9-51A8-490D-B92B-97C547B98539} = {942BE00F-D1A2-405C-80F3-D854D373E1FF}
143150
EndGlobalSection
144151
GlobalSection(ExtensibilityGlobals) = postSolution
145152
SolutionGuid = {B3AC63DE-C110-4924-B7DB-FFAC4704246F}
Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
using SharpFuzz;
2+
using System;
3+
using System.Diagnostics;
4+
using System.Text;
5+
using System.Text.Json;
6+
using static System.Runtime.InteropServices.JavaScript.JSType;
7+
8+
9+
namespace Verifiable.FuzzTests
10+
{
11+
public class Program
12+
{
13+
public static void Main(string[] args)
14+
{
15+
Fuzzer.LibFuzzer.Run(json =>
16+
{
17+
try
18+
{
19+
Console.WriteLine("Start");
20+
Debug.WriteLine("Start");
21+
string jsonString = Encoding.UTF8.GetString(json);
22+
if(jsonString is null)
23+
{
24+
Console.WriteLine("Fuzzer provided a null input.");
25+
return;
26+
}
27+
28+
_ = JsonSerializer.Deserialize<object>(jsonString);
29+
}
30+
catch(JsonException)
31+
{
32+
}
33+
catch(Exception ex)
34+
{
35+
Console.WriteLine($"Unexpected exception occurred: {ex.Message}");
36+
}
37+
});
38+
}
39+
}
40+
}
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<Project Sdk="Microsoft.NET.Sdk">
2+
3+
<PropertyGroup>
4+
<OutputType>Exe</OutputType>
5+
<TargetFramework>net9.0</TargetFramework>
6+
<Nullable>disable</Nullable>
7+
</PropertyGroup>
8+
9+
<ItemGroup>
10+
<PackageReference Include="SharpFuzz" />
11+
</ItemGroup>
12+
13+
</Project>
Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
"0"
2+
"7"
3+
","
4+
":"
5+
"2.1e24"
6+
7+
"true"
8+
"false"
9+
"null"
10+
11+
"\"\""
12+
"\"\":"
13+
14+
"{}"
15+
",{}"
16+
":{}"
17+
"{\"\":0}"
18+
"{{}}"
19+
20+
"[]"
21+
",[]"
22+
":[]"
23+
"[0]"
24+
"[[]]"
25+
26+
"''"
27+
"\\"
28+
"\\b"
29+
"\\f"
30+
"\\n"
31+
"\\r"
32+
"\\t"
33+
"\\u0000"
34+
"\\x00"
35+
"\\0"
36+
"\\uD800\\uDC00"
37+
"\\uDBFF\\uDFFF"
38+
39+
"\"\":0"
40+
"//"
41+
"/**/"
42+
43+
44+
# Things like geojson, json-ld, ...
45+
"$ref"
46+
"type"
47+
"coordinates"
48+
"@context"
49+
"@id"
50+
"@type"
51+
52+
# Strings with truncated special values
53+
"{\"foo\":fa"
54+
"{\"foo\":t"
55+
"{\"foo\":nul"
56+
57+
"{"
58+
"}"
59+
"\"qty\": 1, \"qty\": -1"
60+
"\"qty\": 1, \"qty\\ud800\": -1"
61+
"\"qty\": 1, \"qt\\y\": -1"
62+
"/*"
63+
"*/"
64+
"\""
65+
"1.7976931348623157e+308"
66+
"5e-324"
67+
"9007199254740991"
68+
"-9007199254740991"
69+
70+
"}="
71+
72+
",,"
73+
"{\"\":"
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
./libfuzzer-dotnet-windows.exe --target_path=bin/release/net9.0/Verifiable.FuzzTests.exe ./crash-<something> -timeout=10 -minimize_crash=1
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
.\fuzz.ps1 -libFuzzer ".\libfuzzer-dotnet-windows.exe" -project ".\Verifiable.FuzzTests.csproj" -corpus .\testcases\test-1.json -dict .\dictionaries\json.dict -timeout 10

test/Verifiable.FuzzTests/fuzz.ps1

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
param (
2+
[Parameter(Mandatory = $true)]
3+
[string]$libFuzzer,
4+
[Parameter(Mandatory = $true)]
5+
[string]$project,
6+
[Parameter(Mandatory = $true)]
7+
[string]$corpus,
8+
[string]$dict = $null,
9+
[int]$timeout = 10,
10+
[int]$fork = 0,
11+
[int]$ignore_crashes = 0,
12+
[string]$command = "sharpfuzz"
13+
)
14+
15+
Set-StrictMode -Version Latest
16+
17+
$outputDir = "bin"
18+
19+
if (Test-Path $outputDir) {
20+
Remove-Item -Recurse -Force $outputDir
21+
}
22+
23+
dotnet publish $project -c release -o $outputDir
24+
25+
$projectName = (Get-Item $project).BaseName
26+
$projectDll = "$projectName.dll"
27+
$project = Join-Path $outputDir $projectDll
28+
29+
$exclusions = @(
30+
"dnlib.dll",
31+
"SharpFuzz.dll",
32+
"SharpFuzz.Common.dll"
33+
)
34+
35+
Write-Output "Exclusions: $($exclusions -join ', ')"
36+
37+
$allDlls = Get-ChildItem $outputDir -Filter *.dll
38+
Write-Output "All DLLs: $($allDlls.Name -join ', ')"
39+
40+
$fuzzingTargets = $allDlls `
41+
| Where-Object { $_.Name -notin $exclusions } `
42+
| Where-Object { $_.Name -notlike "System.*.dll" }
43+
44+
Write-Output "Fuzzing Targets: $($fuzzingTargets.Name -join ', ')"
45+
46+
if (($fuzzingTargets | Measure-Object).Count -eq 0) {
47+
Write-Error "No fuzzing targets found"
48+
exit 1
49+
}
50+
51+
foreach ($fuzzingTarget in $fuzzingTargets) {
52+
Write-Output "Instrumenting $fuzzingTarget"
53+
& $command $fuzzingTarget.FullName
54+
55+
if ($LastExitCode -ne 0) {
56+
Write-Error "An error occurred while instrumenting $fuzzingTarget"
57+
exit 1
58+
}
59+
}
60+
61+
# Construct the final command string
62+
$finalCommand = "$libFuzzer --target_path=dotnet --target_arg=$project"
63+
64+
if ($dict) {
65+
$finalCommand += " -dict=$dict"
66+
}
67+
68+
# Print the final command
69+
Write-Output "Final Command: $finalCommand"
70+
71+
# Execute the final command
72+
Invoke-Expression $finalCommand
809 KB
Binary file not shown.

0 commit comments

Comments
 (0)