From 7593691aadc7e1e9c5f17fd26424abe337d56302 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Fri, 31 Dec 2021 04:30:43 +0900 Subject: [PATCH] fuzzers: add input size limits, always configure limits in two ways MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Without the size limits, oss-fuzz creates huge samples that time out. Usually this is because some of our code has bad algorithmic complexity. For data like configuration samples we don't need to care about this: non-rogue configs are rarely more than a few items, and a bit of a slowdown with a few hundred items is acceptable. This wouldn't be OK for processing of untrusted data though. We need to set the limit in two ways: through .options and in the code. The first because it nicely allows libFuzzer to avoid wasting time, and the second because fuzzers like hongfuzz and afl don't support .options. While at it, let's fix an off-by-one (65535 is the largest offset for a power-of-two size, but we're checking the size here). Co-authored-by: Zbigniew Jędrzejewski-Szmek --- src/core/fuzz-unit-file.c | 4 ++++ src/fuzz/fuzz-bootspec.c | 2 +- src/fuzz/fuzz-bootspec.options | 2 +- src/fuzz/fuzz-env-file.c | 2 +- src/fuzz/fuzz-env-file.options | 2 +- src/journal-remote/fuzz-journal-remote.c | 2 +- src/libsystemd/sd-bus/fuzz-bus-match.c | 3 +++ src/libsystemd/sd-bus/fuzz-bus-match.options | 2 ++ src/network/fuzz-netdev-parser.c | 3 +++ src/network/fuzz-netdev-parser.options | 2 ++ src/network/fuzz-network-parser.c | 2 +- src/network/fuzz-network-parser.options | 2 +- src/nspawn/fuzz-nspawn-oci.c | 3 +++ src/nspawn/fuzz-nspawn-settings.c | 3 +++ src/resolve/fuzz-dns-packet.options | 2 +- src/udev/fuzz-udev-rules.c | 3 +++ src/udev/net/fuzz-link-parser.c | 2 +- src/udev/net/fuzz-link-parser.options | 2 +- src/xdg-autostart-generator/fuzz-xdg-desktop.c | 3 +++ src/xdg-autostart-generator/fuzz-xdg-desktop.options | 2 ++ 20 files changed, 38 insertions(+), 10 deletions(-) create mode 100644 src/libsystemd/sd-bus/fuzz-bus-match.options create mode 100644 src/network/fuzz-netdev-parser.options create mode 100644 src/xdg-autostart-generator/fuzz-xdg-desktop.options diff --git a/src/core/fuzz-unit-file.c b/src/core/fuzz-unit-file.c index c12e874e2df..81cede2193d 100644 --- a/src/core/fuzz-unit-file.c +++ b/src/core/fuzz-unit-file.c @@ -21,7 +21,11 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { const char *name; long offset; + if (size > 65536) + return 0; + f = data_to_file(data, size); + assert_se(f); if (read_line(f, LINE_MAX, &p) < 0) diff --git a/src/fuzz/fuzz-bootspec.c b/src/fuzz/fuzz-bootspec.c index fa9e3f06e04..0594a0dea55 100644 --- a/src/fuzz/fuzz-bootspec.c +++ b/src/fuzz/fuzz-bootspec.c @@ -84,7 +84,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { _cleanup_(boot_config_free) BootConfig config = BOOT_CONFIG_NULL; int r; - if (size > 65535) + if (size > 65536) return 0; /* Disable most logging if not running standalone */ diff --git a/src/fuzz/fuzz-bootspec.options b/src/fuzz/fuzz-bootspec.options index 0824b19fab4..678d526b1ea 100644 --- a/src/fuzz/fuzz-bootspec.options +++ b/src/fuzz/fuzz-bootspec.options @@ -1,2 +1,2 @@ [libfuzzer] -max_len = 65535 +max_len = 65536 diff --git a/src/fuzz/fuzz-env-file.c b/src/fuzz/fuzz-env-file.c index 3b3e6256089..431f172306a 100644 --- a/src/fuzz/fuzz-env-file.c +++ b/src/fuzz/fuzz-env-file.c @@ -12,7 +12,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { _cleanup_fclose_ FILE *f = NULL; _cleanup_strv_free_ char **rl = NULL, **rlp = NULL; - if (size > 65535) + if (size > 65536) return 0; f = data_to_file(data, size); diff --git a/src/fuzz/fuzz-env-file.options b/src/fuzz/fuzz-env-file.options index 0824b19fab4..678d526b1ea 100644 --- a/src/fuzz/fuzz-env-file.options +++ b/src/fuzz/fuzz-env-file.options @@ -1,2 +1,2 @@ [libfuzzer] -max_len = 65535 +max_len = 65536 diff --git a/src/journal-remote/fuzz-journal-remote.c b/src/journal-remote/fuzz-journal-remote.c index a8e56e21b2a..dd7884ee9af 100644 --- a/src/journal-remote/fuzz-journal-remote.c +++ b/src/journal-remote/fuzz-journal-remote.c @@ -24,7 +24,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { _cleanup_(journal_remote_server_destroy) RemoteServer s = {}; int r; - if (size <= 2) + if (size <= 2 || size > 65536) return 0; if (!getenv("SYSTEMD_LOG_LEVEL")) diff --git a/src/libsystemd/sd-bus/fuzz-bus-match.c b/src/libsystemd/sd-bus/fuzz-bus-match.c index 0585338e283..39ab62196a4 100644 --- a/src/libsystemd/sd-bus/fuzz-bus-match.c +++ b/src/libsystemd/sd-bus/fuzz-bus-match.c @@ -15,6 +15,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { _cleanup_(sd_bus_unrefp) sd_bus *bus = NULL; int r; + if (size > 65536) + return 0; + /* We don't want to fill the logs with messages about parse errors. * Disable most logging if not running standalone */ if (!getenv("SYSTEMD_LOG_LEVEL")) diff --git a/src/libsystemd/sd-bus/fuzz-bus-match.options b/src/libsystemd/sd-bus/fuzz-bus-match.options new file mode 100644 index 00000000000..678d526b1ea --- /dev/null +++ b/src/libsystemd/sd-bus/fuzz-bus-match.options @@ -0,0 +1,2 @@ +[libfuzzer] +max_len = 65536 diff --git a/src/network/fuzz-netdev-parser.c b/src/network/fuzz-netdev-parser.c index bb4b487ab21..d8cbd2891c2 100644 --- a/src/network/fuzz-netdev-parser.c +++ b/src/network/fuzz-netdev-parser.c @@ -11,6 +11,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { _cleanup_fclose_ FILE *f = NULL; _cleanup_(unlink_tempfilep) char netdev_config[] = "/tmp/fuzz-networkd.XXXXXX"; + if (size > 65536) + return 0; + if (!getenv("SYSTEMD_LOG_LEVEL")) log_set_max_level(LOG_CRIT); diff --git a/src/network/fuzz-netdev-parser.options b/src/network/fuzz-netdev-parser.options new file mode 100644 index 00000000000..678d526b1ea --- /dev/null +++ b/src/network/fuzz-netdev-parser.options @@ -0,0 +1,2 @@ +[libfuzzer] +max_len = 65536 diff --git a/src/network/fuzz-network-parser.c b/src/network/fuzz-network-parser.c index 9290aa58d6e..630c86a98ce 100644 --- a/src/network/fuzz-network-parser.c +++ b/src/network/fuzz-network-parser.c @@ -11,7 +11,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { _cleanup_fclose_ FILE *f = NULL; _cleanup_(unlink_tempfilep) char network_config[] = "/tmp/fuzz-networkd.XXXXXX"; - if (size > 65535) + if (size > 65536) return 0; if (!getenv("SYSTEMD_LOG_LEVEL")) diff --git a/src/network/fuzz-network-parser.options b/src/network/fuzz-network-parser.options index 0824b19fab4..678d526b1ea 100644 --- a/src/network/fuzz-network-parser.options +++ b/src/network/fuzz-network-parser.options @@ -1,2 +1,2 @@ [libfuzzer] -max_len = 65535 +max_len = 65536 diff --git a/src/nspawn/fuzz-nspawn-oci.c b/src/nspawn/fuzz-nspawn-oci.c index 91f2a81dfc3..7110a66187e 100644 --- a/src/nspawn/fuzz-nspawn-oci.c +++ b/src/nspawn/fuzz-nspawn-oci.c @@ -9,6 +9,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { _cleanup_fclose_ FILE *f = NULL; _cleanup_(settings_freep) Settings *s = NULL; + if (size > 65536) + return 0; + f = data_to_file(data, size); assert_se(f); diff --git a/src/nspawn/fuzz-nspawn-settings.c b/src/nspawn/fuzz-nspawn-settings.c index 6b91e1506eb..76838146591 100644 --- a/src/nspawn/fuzz-nspawn-settings.c +++ b/src/nspawn/fuzz-nspawn-settings.c @@ -9,6 +9,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { _cleanup_fclose_ FILE *f = NULL; _cleanup_(settings_freep) Settings *s = NULL; + if (size > 65536) + return 0; + f = data_to_file(data, size); assert_se(f); diff --git a/src/resolve/fuzz-dns-packet.options b/src/resolve/fuzz-dns-packet.options index 0824b19fab4..678d526b1ea 100644 --- a/src/resolve/fuzz-dns-packet.options +++ b/src/resolve/fuzz-dns-packet.options @@ -1,2 +1,2 @@ [libfuzzer] -max_len = 65535 +max_len = 65536 diff --git a/src/udev/fuzz-udev-rules.c b/src/udev/fuzz-udev-rules.c index 17f5ea121bb..0208f8c2d81 100644 --- a/src/udev/fuzz-udev-rules.c +++ b/src/udev/fuzz-udev-rules.c @@ -15,6 +15,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { _cleanup_(unlink_tempfilep) char filename[] = "/tmp/fuzz-udev-rules.XXXXXX"; int r; + if (size > 65536) + return 0; + if (!getenv("SYSTEMD_LOG_LEVEL")) log_set_max_level(LOG_CRIT); diff --git a/src/udev/net/fuzz-link-parser.c b/src/udev/net/fuzz-link-parser.c index b871a4e23ca..5727897305d 100644 --- a/src/udev/net/fuzz-link-parser.c +++ b/src/udev/net/fuzz-link-parser.c @@ -11,7 +11,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { _cleanup_(unlink_tempfilep) char filename[] = "/tmp/fuzz-link-config.XXXXXX"; _cleanup_fclose_ FILE *f = NULL; - if (size > 65535) + if (size > 65536) return 0; if (!getenv("SYSTEMD_LOG_LEVEL")) diff --git a/src/udev/net/fuzz-link-parser.options b/src/udev/net/fuzz-link-parser.options index 0824b19fab4..678d526b1ea 100644 --- a/src/udev/net/fuzz-link-parser.options +++ b/src/udev/net/fuzz-link-parser.options @@ -1,2 +1,2 @@ [libfuzzer] -max_len = 65535 +max_len = 65536 diff --git a/src/xdg-autostart-generator/fuzz-xdg-desktop.c b/src/xdg-autostart-generator/fuzz-xdg-desktop.c index 52ba7ff0a47..0ae27fc39d9 100644 --- a/src/xdg-autostart-generator/fuzz-xdg-desktop.c +++ b/src/xdg-autostart-generator/fuzz-xdg-desktop.c @@ -17,6 +17,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { _cleanup_(xdg_autostart_service_freep) XdgAutostartService *service = NULL; _cleanup_(rm_rf_physical_and_freep) char *tmpdir = NULL; + if (size > 65536) + return 0; + /* We don't want to fill the logs with messages about parse errors. * Disable most logging if not running standalone */ if (!getenv("SYSTEMD_LOG_LEVEL")) diff --git a/src/xdg-autostart-generator/fuzz-xdg-desktop.options b/src/xdg-autostart-generator/fuzz-xdg-desktop.options new file mode 100644 index 00000000000..678d526b1ea --- /dev/null +++ b/src/xdg-autostart-generator/fuzz-xdg-desktop.options @@ -0,0 +1,2 @@ +[libfuzzer] +max_len = 65536