etc~ scripts and random things |
| git clone https://github.com/djnnvx/etc.git |
| log | files | refs | archive |
harness.h (2002B)
1 /* 2 * harness.h - shared AFL++/libFuzzer entry boilerplate for the libnfs harnesses. 3 * 4 * Each fuzz_*.c defines: static int fuzz_one(const uint8_t *data, size_t size); 5 * 6 * Build modes (set by setup.sh): 7 * afl-clang-fast -> persistent loop, reads from AFL shared memory 8 * clang -DNFS_FUZZ_STANDALONE -> reads files from argv, for crash replay/triage 9 * <libFuzzer> -> LLVMFuzzerTestOneInput 10 */ 11 #pragma once 12 13 #include <stddef.h> 14 #include <stdint.h> 15 #include <stdio.h> 16 #include <stdlib.h> 17 #include <string.h> 18 19 #include "nfsc/libnfs-zdr.h" 20 21 /* Initialise a ZDR memory stream in DECODE mode over the fuzz buffer. 22 * ZDR is libnfs's reimplementation of XDR. zdrmem_create takes a non-const 23 * char *, but in DECODE mode it only reads from the buffer. We cast away 24 * const-ness; the alternative is allocating + copying every iteration which 25 * murders persistent-mode throughput. */ 26 static inline void nfs_zdrmem_decode(ZDR *zdr, const uint8_t *data, size_t size) 27 { 28 memset(zdr, 0, sizeof(*zdr)); 29 zdrmem_create(zdr, (char *)(uintptr_t)data, 30 size > 0xffffffff ? 0xffffffff : (uint32_t)size, 31 ZDR_DECODE); 32 } 33 34 static int fuzz_one(const uint8_t *data, size_t size); 35 36 #ifdef __AFL_FUZZ_TESTCASE_LEN 37 __AFL_FUZZ_INIT(); 38 int main(void) 39 { 40 __AFL_INIT(); 41 unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF; 42 while (__AFL_LOOP(10000)) 43 fuzz_one(buf, (size_t)__AFL_FUZZ_TESTCASE_LEN); 44 return 0; 45 } 46 #else 47 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) 48 { 49 return fuzz_one(data, size); 50 } 51 #ifdef NFS_FUZZ_STANDALONE 52 int main(int argc, char **argv) 53 { 54 static unsigned char buf[1 << 20]; 55 int i; 56 for (i = 1; i < argc; i++) { 57 FILE *f = fopen(argv[i], "rb"); 58 size_t n; 59 if (!f) 60 continue; 61 n = fread(buf, 1, sizeof buf, f); 62 fclose(f); 63 fprintf(stderr, "[*] %s (%zu bytes)\n", argv[i], n); 64 fuzz_one(buf, n); 65 } 66 return 0; 67 } 68 #endif 69 #endif