wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
openssl/fuzz
History
Richard Levitte 0483f58652 Simplify INCLUDE statements in build.info files 
Now that INCLUDE considers both the source and build trees, no need
for the rel2abs perl fragment hacks any more.

Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-07-01 18:36:08 +02:00
..
corpora Add x509 and crl corpora 2016-06-25 11:01:29 +02:00
asn1.c Run the fuzzing corpora as tests. 2016-07-01 13:45:45 +01:00
asn1parse.c Run the fuzzing corpora as tests. 2016-07-01 13:45:45 +01:00
bignum.c fix 'set but not used' warning 2016-07-01 16:05:37 +01:00
bndiv.c Run the fuzzing corpora as tests. 2016-07-01 13:45:45 +01:00
build.info Simplify INCLUDE statements in build.info files 2016-07-01 18:36:08 +02:00
build.info.fuzz Simplify INCLUDE statements in build.info files 2016-07-01 18:36:08 +02:00
cms.c Run the fuzzing corpora as tests. 2016-07-01 13:45:45 +01:00
conf.c Run the fuzzing corpora as tests. 2016-07-01 13:45:45 +01:00
crl.c Re-add x509 and crl fuzzer 2016-07-01 17:02:33 +02:00
ct.c Run the fuzzing corpora as tests. 2016-07-01 13:45:45 +01:00
driver.c include stdlib for malloc() and free() 2016-06-11 16:43:49 +02:00
fuzzer.h Run the fuzzing corpora as tests. 2016-07-01 13:45:45 +01:00
helper.py Add final(?) set of copyrights. 2016-06-01 11:27:25 -04:00
README.md Add support for fuzzing with AFL 2016-06-04 14:39:24 +02:00
server.c Run the fuzzing corpora as tests. 2016-07-01 13:45:45 +01:00
test-corpus.c Run the fuzzing corpora as tests. 2016-07-01 13:45:45 +01:00
x509.c Re-add x509 and crl fuzzer 2016-07-01 17:02:33 +02:00

README.md

I Can Haz Fuzz?

LibFuzzer

Or, how to fuzz OpenSSL with libfuzzer.

Starting from a vanilla+OpenSSH server Ubuntu install.

Use Chrome's handy recent build of clang. Older versions may also work.

$ sudo apt-get install git
$ mkdir git-work
$ git clone https://chromium.googlesource.com/chromium/src/tools/clang
$ clang/scripts/update.py

You may want to git pull and re-run the update from time to time.

Update your path:

$ PATH=~/third_party/llvm-build/Release+Asserts/bin/:$PATH

Get and build libFuzzer (there is a git mirror at https://github.com/llvm-mirror/llvm/tree/master/lib/Fuzzer if you prefer):

$ cd
$ sudo apt-get install subversion
$ mkdir svn-work
$ cd svn-work
$ svn co http://llvm.org/svn/llvm-project/llvm/trunk/lib/Fuzzer
$ cd Fuzzer
$ clang++ -c -g -O2 -std=c++11 *.cpp
$ ar r libFuzzer.a *.o
$ ranlib libFuzzer.a

Configure for fuzzing:

$ CC=clang ./config enable-fuzz-libfuzzer \
        --with-fuzzer-include=../../svn-work/Fuzzer \
        --with-fuzzer-lib=../../svn-work/Fuzzer/libFuzzer \
        enable-asan enable-ubsan no-shared
$ sudo apt-get install make
$ LDCMD=clang++ make -j
$ fuzz/helper.py <fuzzer> <arguments>

Where <fuzzer> is one of the executables in fuzz/. Most fuzzers do not need any command line arguments, but, for example, asn1 needs the name of a data type.

If you get a crash, you should find a corresponding input file in fuzz/corpora/<fuzzer>-crash/. You can reproduce the crash with

$ fuzz/<fuzzer> <crashfile>

AFL

Configure for fuzzing:

$ sudo apt-get install afl-clang
$ CC=afl-clang-fast ./config enable-fuzz-afl no-shared
$ make

Run one of the fuzzers:

$ afl-fuzz fuzz/<fuzzer> -i fuzz/corpora/<fuzzer> -o fuzz/corpora/<fuzzer>/out <fuzzer> <arguments>

Where <fuzzer> is one of the executables in fuzz/. Most fuzzers do not need any command line arguments, but, for example, asn1 needs the name of a data type.