Skip to content

Object parsing fuzzer#4845

Merged
carlosmn merged 3 commits intolibgit2:masterfrom
pks-t:pks/object-fuzzer
Oct 15, 2018
Merged

Object parsing fuzzer#4845
carlosmn merged 3 commits intolibgit2:masterfrom
pks-t:pks/object-fuzzer

Conversation

@pks-t
Copy link
Copy Markdown
Member

@pks-t pks-t commented Oct 11, 2018

This includes a new trivial object parsing fuzzer as well as fixes to both our standalone fuzzing driver as well as an error in the system under test.

pks-t added 3 commits October 11, 2018 12:26
The standalone driver for libgit2's fuzzing targets makes use of
functions from libgit2 itself. While this is totally fine to do, we need
to make sure to always have libgit2 initialized via `git_libgit2_init`
before we call out to any of these. While this happens in most cases as
we call `LLVMFuzzerInitialize`, which is provided by our fuzzers and
which right now always calls `git_libgit2_init`, one exception to this
rule is our error path when not enough arguments have been given. In
this case, we will call `git_vector_free_deep` without libgit2 having
been initialized. As we did not set up our allocation functions in that
case, this will lead to a segmentation fault.

Fix the issue by always initializing and shutting down libgit2 in the
standalone driver. Note that we cannot let this replace the
initialization in `LLVMFuzzerInitialize`, as it is required when using
the "real" fuzzers by LLVM without our standalone driver. It's no
problem to call the initialization and deinitialization functions
multiple times, though.
When failing to parse a raw object fromits data, we free the
partially parsed object but then fail to propagate the error to the
caller. This may lead callers to operate on objects with invalid memory,
which will sooner or later cause the program to segfault.

Fix the issue by passing up the error code returned by `parse_raw`.
Add a simple fuzzer that exercises our object parser code. The fuzzer
is quite trivial in that it simply passes the input data directly to
`git_object__from_raw` for each of the four object types.
@pks-t
Copy link
Copy Markdown
Member Author

pks-t commented Oct 11, 2018

/rebuild

@libgit2-azure-pipelines
Copy link
Copy Markdown

Okay, @pks-t, I started to rebuild this pull request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants