rhboot / shim

UEFI shim loader
Other
816 stars 284 forks source link

Add libFuzzer support for csv.c and sbat.c #584

Closed vathpela closed 1 year ago

vathpela commented 1 year ago

shim takes several forms of input from several sources that are not necessarily trustworthy. As such, we need to take measures to validate that we don't have unacceptable results from bad inputs. One such measure is "fuzzing" the inputs which parse untrusted data by running them with randomized or partially randomized input.

This change adds such testing using clang's "libFuzzer" to our CSV parser and the parser for .sbat sections.

vathpela commented 1 year ago

Did you mean to have the generic "clean" and "all" in fuzz.mk?

Yeah - those wind up appending the build dependency, so e.g. clean will automatically rebuild fuzz-clean.

Otherwise this looks ok, I do get noise from -print-multiarch on a system that doesn't support it, although I did confirm it's just noise.

I don't think I'm going to fix "clang made this argument print a warning instead of silent when there's nothing to do" in this one, especially since you don't need to run that to ship it at all.

dennis-tseng99 commented 1 year ago

@vathpela Because .ascii directive expects zero or more string literals separated by commas (http://web.mit.edu/gnu/doc/html/as_7.html), rather than by space, could you change sbat_var.S file to something like fig-1 ? So that the compiling error(fig-2) can be avoided with clang when make fuzz. Thanks so much.

[fig-1] image

[fig-2] image