Skip to content

Conversation

@xhanulik
Copy link
Member

@xhanulik xhanulik commented Oct 6, 2021

This PR adds simple fuzzer with basic corpus for parsing configuration file using function scconf_parse_string().
When no --enable-fuzzing option, fuzzers are built with fuzzer.c as simple programs which take file as source for buffer, that is then passed to LLVMFuzzerTestOneInput(). stdout in fuzzers will be closed, when fuzzing is enabled.

Fixes #2402

Checklist
  • New files have a LGPL 2.1 license statement

@Jakuje
Copy link
Member

Jakuje commented Oct 20, 2021

@frankmorgner what do you think?

…bled

For testing purposes, fuzzers take files as input which feed
LLVMFuzzerTestOneInput function.
In case that called function print out some data
buf_addch() store values on bp->bufcur and bp->bufcur + 1
but check size of the buffer only for bp->bufcur.
Issue found by calling scconf_string_parse()
with "name =\n\n\nvalue,value;" as an input string.

scconf_parse_token() interprets more newline characters as item
with type SCCONF_ITEM_TYPE_COMMENT. After that when parsing
TOKEN_TYPE_STRING, if parser->state is STATE_VALUE,
scconf_list_add() adds list into that item.
During freeing scconf_context structure, above described
item is freed as SCCONF_ITEM_TYPE_COMMENT and created list
causes memory leak.
To fix this, scconf_parse_token() checks type of item before
adding into list.

When parsing is done, scconf_parse_reset_state() frees values
in parser->name and parser->key.
@frankmorgner
Copy link
Member

looks good, thank you

@Jakuje Jakuje merged commit 9f4eae6 into OpenSC:master Nov 3, 2021
@xhanulik xhanulik deleted the config_fuzz branch January 19, 2022 20:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Idea: Fuzzer for configuration file

3 participants