K2
commented
6 years ago I took a quick stab at this and started up 48 instances in a parallel afl fuzz.
I'm using the afl-fuzz mode only right now, the perf can be improved a bit, lots of options with M/ASAN and HARDEN are possible. Some of the newer features work best with llvm-svn and I've updated a few things there, some errors in my libcxx I can look again later.
I chose the portability test case since there are 2 pre-existing test bin's and I would think the serialization path here is one of our higher priority items, made use of the bitmapwithruns.bin/bitmapwithoutruns.bin files even though they are a bit large (would be better for much smaller versions) I didn't want to originate too much churn since we have tests for these already.
I took out the cmocka as it seemed to be conflicting due to it's signal handlers and added a few tweaks to accept a command line argument, as AFL works typically with file I/O.
There's a few output's I'll triage them and see which ones are real, I might need to tweak some of the memory ulimit's since that can cause false-positives here.
/*
* afl_format_portability_unit.c
*
*/
#include <assert.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <roaring/roaring.h>
#include "config.h"
char filename[1024];
long filesize(FILE* fp) {
fseek(fp, 0L, SEEK_END);
return ftell(fp);
}
char* readfile(FILE* fp) {
long bytes = filesize(fp);
char* buf = malloc(bytes);
if(buf == NULL) return NULL;
rewind(fp);
int cnt = fread(buf, 1, bytes, fp);
if(bytes != cnt){
free(buf);
return NULL;
}
return buf;
}
int compare(char* x, char* y, size_t size) {
for (size_t i = 0; i < size; ++i) {
if (x[i] != y[i]) {
return i + 1;
}
}
return 0;
}
int test_deserialize(FILE* fp) {
char* input_buffer = readfile(fp);
if(input_buffer == NULL) return -1;
roaring_bitmap_t* bitmap =
roaring_bitmap_portable_deserialize(input_buffer);
if(bitmap == NULL) {
free(input_buffer);
return -2;
}
size_t expected_size = roaring_bitmap_portable_size_in_bytes(bitmap);
char* output_buffer = malloc(expected_size);
size_t actual_size =
roaring_bitmap_portable_serialize(bitmap, output_buffer);
// maybe we should crash here to catch these
if(actual_size != expected_size) {
free(input_buffer);
free(output_buffer);
return -3;
}
int compare_result = compare(input_buffer, output_buffer, actual_size);
free(output_buffer);
free(input_buffer);
fclose(fp);
roaring_bitmap_free(bitmap);
return compare_result;
}
int main(int argc, char **argv) {
if(argc < 2)
return 1;
snprintf(filename, sizeof(filename)-1, "%s", argv[argc-1]);
FILE* fp = fopen(filename, "rb");
if(fp == NULL)
return 2;
return test_deserialize(fp);
}I've got a couple of these boxes I can suspend some of my XMR mining on ;) for a bit, the execution speed would improve with smaller test cases, however it's still around 1500 or so that's over 4Million tests per minute.
lemire
http://lcamtuf.coredump.cx/afl/