libevent: Fuzzing Coverage Expansion #11257

viktoriia-lsg · 2023-11-22T17:20:02Z

Hi! This pull request expands fuzzing coverage of libevent by adding 3 new fuzz targets.

github-actions · 2023-11-22T17:21:07Z

viktoriia-lsg is a new contributor to projects/libevent. The PR must be approved by known contributors before it can be merged. The past contributors are: fanquake, azat, inferno-chromium, devtty1er, Google-Autofuzz

DavidKorczynski · 2023-11-27T09:13:10Z

projects/libevent/bufferevent_fuzzer.cc

+
+  int use_pair = data[0] % 2;
+  int options1 = data[1] % 16;
+  int options2 = data[2] % 16;


Could you use data_provider here to generate the ints instead?

DavidKorczynski · 2023-11-27T09:13:38Z

projects/libevent/bufferevent_fuzzer.cc

+  static struct timeval cfg_tick = { static_cast<__time_t>(*(uint32_t*)data), static_cast<__suseconds_t>(*(uint32_t*)(data+1))};
+  conn_bucket_cfg = ev_token_bucket_cfg_new(
+      *(uint32_t *)data, *(uint32_t *)(data + 1), *(uint32_t *)(data + 2),
+      *(uint32_t *)(data + 3), &cfg_tick);


In the above lines could you rely on data consumed by data_provider instead?

DavidKorczynski · 2023-11-27T09:13:55Z

projects/libevent/bufferevent_fuzzer.cc

+  bufferevent_setwatermark(bev2, EV_WRITE | EV_READ, *(size_t *)data,
+                           *(size_t *)(data + 1));
+  bufferevent_getwatermark(bev2, EV_WRITE | EV_READ, (size_t *)(data + 1),
+                           (size_t *)data);


In the above lines could you rely on data consumed by data_provider instead?

viktoriia-lsg · 2023-11-27T11:24:13Z

@DavidKorczynski I've added a data_provider for the specified cases, please take a look. The tests failed due to a valid memory leak in evbuffer_add_cb. It looks like evbuffer_cb_entry is not freed later in the libevent code.

viktoriia-lsg · 2023-11-30T09:50:27Z

Hi @DavidKorczynski. Could you please take a look?

DavidKorczynski · 2023-12-05T00:23:39Z

Hi @DavidKorczynski. Could you please take a look?

Apologies for the delay @viktoriia-lsg -- I'll review this Tuesday.

DavidKorczynski · 2023-12-06T23:34:00Z

projects/libevent/bufferevent_fuzzer.cc

+
+  /*bufferevent_filter_new*/
+  bev1 = bufferevent_filter_new(bev1, NULL, NULL, options1, NULL, NULL);
+  bev2 = bufferevent_filter_new(bev2, NULL, NULL, options2, NULL, NULL);


I don't think the leaks from the CI are valid leaks. I think they happen because you re-assign bev2 here (previously assigned on line 57) and that overwrites a pointer to some dynamic memory. Thus, a pointer is left hanging -- I think the fuzzer is missing some cleanup?

Confirm that the following seems to fix it:

diff --git a/projects/libevent/bufferevent_fuzzer.cc b/projects/libevent/bufferevent_fuzzer.cc index c3bde3138..9f5e65e7c 100644 --- a/projects/libevent/bufferevent_fuzzer.cc +++ b/projects/libevent/bufferevent_fuzzer.cc @@ -60,6 +60,14 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { bev1 = bufferevent_socket_new(base, -1, options1); bev2 = bufferevent_socket_new(base, -1, options2); } + if (bev1) { + bufferevent_free(bev1); + } + if (bev2) { + bufferevent_free(bev2); + } + bev1 = NULL; + bev2 = NULL; /*bufferevent_filter_new*/ bev1 = bufferevent_filter_new(bev1, NULL, NULL, options1, NULL, NULL);

@DavidKorczynski I really appreciate your help. Indeed, it was an issue with hanging pointers on lines 65 and 66. I fixed the fuzz target and now it works fine, as well I resolved the issue with double free.

I did not use your fix, because bufferevent_filter_new function accepts a non-NULL bufferevent object, but it helped me to realize where the problem was. In details, I've added two bufferevent objects to be assigned from bufferevent_filter_new function and set conn_bucket_cfg to NULL to fix potential double free. Please approve when you have time. Thanks!

azat

Thank you! I looked through this and left my 50 cents.

azat · 2023-12-16T22:14:58Z

projects/libevent/dns_config_fuzzer.cc

+  sprintf(hostsFilename, "/tmp/hosts.%d", getpid());
+  fp = fopen(hostsFilename, "wb");
+  if (!fp) {
+    evdns_base_free(dns, 0);


Misses unlink(resolvFilename);.

I guess it is better to rewrite it to goto

azat · 2023-12-16T22:16:54Z

projects/libevent/bufferevent_fuzzer.cc

+  if (use_pair == 0) {
+    if (bufferevent_pair_new(base, options1, pair) == -1) {
+      event_base_free(base);
+      return 0;


Why not goto cleanup?

I did it to make it simpler. If I use "goto cleanup", the code will go through 4 unnecessary if statements.

azat · 2023-12-16T22:17:38Z

projects/libevent/bufferevent_fuzzer.cc

+    bev2 = bufferevent_socket_new(base, -1, options2);
+  }
+
+  /*bufferevent_filter_new*/


Maybe it worth to make this under condition, like use_pair here?

Could you please clarify it? Do you mean to create bufferevent with bufferevent_socket_new function in another if statement? In such case, bufferevent_filter_new will throw an error, as it is waiting to receive a valid bufferevent as the first param.

UPD. I got it and added use_filter param, so not all bufferevent will be with filters.

azat · 2023-12-16T22:18:45Z

projects/libevent/bufferevent_fuzzer.cc

+  size_t int4 = data_provider.ConsumeIntegral<size_t>();
+
+  int use_pair = int1 % 2;
+  int options1 = int2 % 16;


You are using bufferevent_free here explicitly for filters, so you cannot use BEV_OPT_CLOSE_ON_FREE

azat · 2023-12-16T22:19:13Z

projects/libevent/bufferevent_fuzzer.cc

+  bufferevent_priority_set(bev3, options2);
+
+  /*set rate limits*/
+  bufferevent_set_rate_limit(bev3, NULL);


Let's also make it conditionally?

azat · 2023-12-16T22:19:40Z

projects/libevent/bufferevent_fuzzer.cc

+  bufferevent_remove_from_rate_limit_group(bev4);
+
+  /*watermarks*/
+  bufferevent_setwatermark(bev4, EV_WRITE | EV_READ, int1, int2);


And here as well, let's add some randomization, watermarks be applied or not.

azat · 2023-12-16T22:21:27Z

projects/libevent/buffer_add_file_fuzzer.cc

+  fstat(fd, &st);
+
+  struct evbuffer *buf = evbuffer_new();
+  evbuffer_add_file(buf, fd, 0, st.st_size);


Actually I don't expect any problems here, since it just will read the whole file or mmap it.
Let's add evbuffer_set_flags at least (EVBUF_FS_CLOSE_ON_FREE and friends)

viktoriia-lsg · 2023-12-18T14:53:30Z

Hi @azat! I reviewed all your notes and made some changes in the fuzzer's code. Please check this PR #11377.

Hi! This pull request extends the previous pull request #11257 and brings some improvements.

azat · 2024-01-04T11:57:55Z

@viktoriia-lsg thank you!

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257

azat · 2024-02-20T08:14:38Z

projects/libevent/buffer_add_file_fuzzer.cc

+  evbuffer_add_file(buf, fd, 0, st.st_size);
+
+  fclose(fp);
+  close(fd);


The fd can been closed by fclose already, this close should be removed.

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257 v2: adjust test

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257 v2: better check (found by CI for windows)

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257 v2: adjust test

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257 v2: adjust test v3: fix for windows (_get_osfhandle() crashes when called on closed fd)

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257 v2: adjust test v3: fix for windows (_get_osfhandle() crashes when called on closed fd) v4: fix for EVENT__DISABLE_MM_REPLACEMENT

libevent fuzzing expansion

9f4f910

cast parameters

bd1d2d3

DavidKorczynski requested changes Nov 27, 2023

View reviewed changes

take input from data_provider

4266a15

DavidKorczynski requested changes Dec 6, 2023

View reviewed changes

Update bufferevent_fuzzer.cc

affd602

DavidKorczynski approved these changes Dec 7, 2023

View reviewed changes

DavidKorczynski merged commit 6512048 into google:master Dec 7, 2023
15 checks passed

azat reviewed Dec 16, 2023

View reviewed changes

viktoriia-lsg mentioned this pull request Dec 18, 2023

libevent: Fuzzing Coverage Expansion #2 #11377

Merged

DavidKorczynski pushed a commit that referenced this pull request Dec 26, 2023

libevent: Fuzzing Coverage Expansion #2 (#11377)

859a650

Hi! This pull request extends the previous pull request #11257 and brings some improvements.

azat added a commit to azat/libevent that referenced this pull request Feb 20, 2024

Fix divide-by-zero in ev_token_bucket_get_tick_

c4fb0f7

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257

azat added a commit to azat/libevent that referenced this pull request Feb 20, 2024

Fix integer-overflow in ev_token_bucket_cfg_new

b065980

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257

azat mentioned this pull request Feb 20, 2024

Fix few issues found by oss-fuzz in bufferevent ratelimits libevent/libevent#1558

Merged

azat reviewed Feb 20, 2024

View reviewed changes

azat added a commit to azat/libevent that referenced this pull request Feb 20, 2024

Fix leak in evbuffer_add_file() on empty files

1af369a

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257

azat added a commit to azat/libevent that referenced this pull request Feb 20, 2024

Fix leak in evbuffer_add_file() on empty files

e518a12

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257

azat added a commit to azat/libevent that referenced this pull request Feb 20, 2024

Fix leak in evbuffer_add_file() on empty files

700fe97

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257

azat mentioned this pull request Feb 20, 2024

Fix leak in evbuffer_add_file() on empty files libevent/libevent#1559

Merged

azat added a commit to azat/libevent that referenced this pull request Mar 3, 2024

Fix leak in evbuffer_add_file() on empty files

1e1bd5d

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257 v2: adjust test

azat added a commit to azat/libevent that referenced this pull request Mar 3, 2024

Fix integer-overflow in ev_token_bucket_cfg_new

e4b8732

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257 v2: better check (found by CI for windows)

azat added a commit to azat/libevent that referenced this pull request Mar 3, 2024

Fix leak in evbuffer_add_file() on empty files

8840753

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257 v2: adjust test

azat added a commit to azat/libevent that referenced this pull request Mar 11, 2024

Fix leak in evbuffer_add_file() on empty files

caf57bb

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257 v2: adjust test

azat added a commit to azat/libevent that referenced this pull request Mar 11, 2024

Fix leak in evbuffer_add_file() on empty files

c307abc

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257 v2: adjust test

azat added a commit to azat/libevent that referenced this pull request Mar 11, 2024

Fix leak in evbuffer_add_file() on empty files

e87a163

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257 v2: adjust test

azat added a commit to azat/libevent that referenced this pull request Mar 11, 2024

Fix leak in evbuffer_add_file() on empty files

1d8a831

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257 v2: adjust test

azat added a commit to azat/libevent that referenced this pull request Mar 11, 2024

Fix leak in evbuffer_add_file() on empty files

438cabe

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257 v2: adjust test

azat added a commit to azat/libevent that referenced this pull request Mar 11, 2024

Fix leak in evbuffer_add_file() on empty files

70c9184

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257 v2: adjust test

azat added a commit to azat/libevent that referenced this pull request Mar 11, 2024

Fix leak in evbuffer_add_file() on empty files

fe098e9

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257 v2: adjust test

azat added a commit to azat/libevent that referenced this pull request Mar 11, 2024

Fix leak in evbuffer_add_file() on empty files

1d63fa1

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257 v2: adjust test

azat added a commit to azat/libevent that referenced this pull request Mar 11, 2024

Fix leak in evbuffer_add_file() on empty files

70c410f

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257 v2: adjust test

azat added a commit to azat/libevent that referenced this pull request Mar 11, 2024

Fix leak in evbuffer_add_file() on empty files

5415d00

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257 v2: adjust test

azat added a commit to azat/libevent that referenced this pull request Mar 11, 2024

Fix leak in evbuffer_add_file() on empty files

0d16309

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257 v2: adjust test

azat added a commit to azat/libevent that referenced this pull request Mar 11, 2024

Fix leak in evbuffer_add_file() on empty files

372b737

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257 v2: adjust test

azat added a commit to azat/libevent that referenced this pull request Mar 11, 2024

Fix leak in evbuffer_add_file() on empty files

a8720e7

Found by oss-fuzz, after coverage had been improved in google/oss-fuzz#11257 v2: adjust test

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

libevent: Fuzzing Coverage Expansion #11257

libevent: Fuzzing Coverage Expansion #11257

viktoriia-lsg commented Nov 22, 2023

github-actions bot commented Nov 22, 2023

DavidKorczynski Nov 27, 2023

DavidKorczynski Nov 27, 2023

DavidKorczynski Nov 27, 2023

viktoriia-lsg commented Nov 27, 2023

viktoriia-lsg commented Nov 30, 2023

DavidKorczynski commented Dec 5, 2023

DavidKorczynski Dec 6, 2023 •

edited

Loading

DavidKorczynski Dec 6, 2023

viktoriia-lsg Dec 7, 2023

azat left a comment

azat Dec 16, 2023

azat Dec 16, 2023

viktoriia-lsg Dec 18, 2023

azat Dec 16, 2023

viktoriia-lsg Dec 18, 2023 •

edited

Loading

azat Dec 16, 2023

azat Dec 16, 2023

azat Dec 16, 2023

azat Dec 16, 2023

viktoriia-lsg commented Dec 18, 2023

azat commented Jan 4, 2024

azat Feb 20, 2024

libevent: Fuzzing Coverage Expansion #11257

libevent: Fuzzing Coverage Expansion #11257

Conversation

viktoriia-lsg commented Nov 22, 2023

github-actions bot commented Nov 22, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

viktoriia-lsg commented Nov 27, 2023

viktoriia-lsg commented Nov 30, 2023

DavidKorczynski commented Dec 5, 2023

DavidKorczynski Dec 6, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

azat left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

viktoriia-lsg Dec 18, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

viktoriia-lsg commented Dec 18, 2023

azat commented Jan 4, 2024

Choose a reason for hiding this comment

DavidKorczynski Dec 6, 2023 •

edited

Loading

viktoriia-lsg Dec 18, 2023 •

edited

Loading