Skip to content

Commit

Permalink
Merge branch 'nginx:master' into master
Browse files Browse the repository at this point in the history
  • Loading branch information
@phpclub
phpclub authored Aug 6, 2024
2 parents e84e094 + 3667c3e commit 6d50d9f
Show file tree
Hide file tree
Showing 9 changed files with 253 additions and 68 deletions.
147 changes: 146 additions & 1 deletion fuzzing/nxt_basic_fuzz.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,19 +3,33 @@
*/

#include <nxt_main.h>
#include <nxt_sha1.h>
#include <nxt_websocket.h>
#include <nxt_websocket_header.h>

/* DO NOT TRY THIS AT HOME! */
#include <nxt_websocket_accept.c>

#define KMININPUTLENGTH 2

#define KMININPUTLENGTH 4
#define KMAXINPUTLENGTH 128


extern int LLVMFuzzerInitialize(int *argc, char ***argv);
extern int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);

void nxt_base64_fuzz(const u_char *data, size_t size);
void nxt_djb_hash_fuzz(const u_char *data, size_t size);
void nxt_murmur_hash2_fuzz(const u_char *data, size_t size);
void nxt_parse_fuzz(const u_char *data, size_t size);
void nxt_sha1_fuzz(const u_char *data, size_t size);
void nxt_sha1_update_fuzz(const u_char *data, size_t size);
void nxt_term_fuzz(const u_char *data, size_t size);
void nxt_time_fuzz(const u_char *data, size_t size);
void nxt_uri_fuzz(const u_char *data, size_t size);
void nxt_utf8_fuzz(const u_char *data, size_t size);
void nxt_websocket_base64_fuzz(const u_char *data, size_t size);
void nxt_websocket_frame_fuzz(const u_char *data, size_t size);


extern char **environ;
Expand All @@ -40,9 +54,17 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
}

nxt_base64_fuzz(data, size);
nxt_djb_hash_fuzz(data, size);
nxt_murmur_hash2_fuzz(data, size);
nxt_parse_fuzz(data, size);
nxt_sha1_fuzz(data, size);
nxt_sha1_update_fuzz(data, size);
nxt_term_fuzz(data, size);
nxt_time_fuzz(data, size);
nxt_uri_fuzz(data, size);
nxt_utf8_fuzz(data, size);
nxt_websocket_base64_fuzz(data, size);
nxt_websocket_frame_fuzz(data, size);

return 0;
}
Expand All @@ -66,6 +88,64 @@ nxt_base64_fuzz(const u_char *data, size_t size)
}


void
nxt_djb_hash_fuzz(const u_char *data, size_t size)
{
nxt_djb_hash(data, size);
nxt_djb_hash_lowcase(data, size);
}


void
nxt_murmur_hash2_fuzz(const u_char *data, size_t size)
{
nxt_murmur_hash2(data, size);
nxt_murmur_hash2_uint32(data);
}


void
nxt_parse_fuzz(const u_char *data, size_t size)
{
nxt_str_t input;

input.start = (u_char *)data;
input.length = size;

nxt_int_parse(data, size);
nxt_size_t_parse(data, size);
nxt_size_parse(data, size);
nxt_off_t_parse(data, size);
nxt_str_int_parse(&input);
nxt_number_parse(&data, data + size);
}


void
nxt_sha1_fuzz(const u_char *data, size_t size)
{
u_char bin_accept[20];
nxt_sha1_t ctx;

nxt_sha1_init(&ctx);
nxt_sha1_update(&ctx, data, size);
nxt_sha1_final(bin_accept, &ctx);
}


void
nxt_sha1_update_fuzz(const u_char *data, size_t size)
{
u_char bin_accept[20];
nxt_sha1_t ctx;

nxt_sha1_init(&ctx);
nxt_sha1_update(&ctx, data, size);
nxt_sha1_update(&ctx, data, size);
nxt_sha1_final(bin_accept, &ctx);
}


void
nxt_term_fuzz(const u_char *data, size_t size)
{
Expand All @@ -81,11 +161,76 @@ nxt_time_fuzz(const u_char *data, size_t size)
}


void
nxt_uri_fuzz(const u_char *data, size_t size)
{
u_char *dst;

dst = nxt_zalloc(size * 3);
if (dst == NULL) {
return;
}

nxt_decode_uri(dst, (u_char *)data, size);
nxt_decode_uri_plus(dst, (u_char *)data, size);

nxt_memzero(dst, size * 3);
nxt_encode_uri(NULL, (u_char *)data, size);
nxt_encode_uri(dst, (u_char *)data, size);

nxt_free(dst);
}


void
nxt_utf8_fuzz(const u_char *data, size_t size)
{
const u_char *in;

in = data;
nxt_utf8_decode(&in, data + size);

nxt_utf8_casecmp((const u_char *)"ABC АБВ ΑΒΓ",
data,
nxt_length("ABC АБВ ΑΒΓ"),
size);
}


void
nxt_websocket_base64_fuzz(const u_char *data, size_t size)
{
u_char *out;

out = nxt_zalloc(size * 2);
if (out == NULL) {
return;
}

nxt_websocket_base64_encode(out, data, size);

nxt_free(out);
}


void
nxt_websocket_frame_fuzz(const u_char *data, size_t size)
{
u_char *input;

/*
* Resolve overwrites-const-input by using a copy of the data.
*/
input = nxt_malloc(size);
if (input == NULL) {
return;
}

nxt_memcpy(input, data, size);

nxt_websocket_frame_init(input, 0);
nxt_websocket_frame_header_size(input);
nxt_websocket_frame_payload_len(input);

nxt_free(input);
}
31 changes: 17 additions & 14 deletions fuzzing/nxt_http_controller_fuzz.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -43,8 +43,9 @@ int
LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
nxt_mp_t *mp;
nxt_int_t rc;
nxt_buf_mem_t buf;
nxt_controller_request_t *r_controller;
nxt_controller_request_t *req;
nxt_http_request_parse_t rp;

if (size < KMININPUTLENGTH || size > KMAXINPUTLENGTH) {
Expand All @@ -56,8 +57,13 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
return 0;
}

nxt_memzero(&rp, sizeof(nxt_http_request_parse_t));
if (nxt_http_parse_request_init(&rp, mp) != NXT_OK) {
req = nxt_mp_zget(mp, sizeof(nxt_controller_request_t));
if (req == NULL) {
goto failed;
}

req->conn = nxt_mp_zget(mp, sizeof(nxt_conn_t));
if (req->conn == NULL) {
goto failed;
}

Expand All @@ -66,26 +72,23 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
buf.pos = buf.start;
buf.free = buf.end;

if (nxt_http_parse_request(&rp, &buf) != NXT_DONE) {
goto failed;
}
nxt_main_log.level = NXT_LOG_ALERT;
req->conn->log = nxt_main_log;

r_controller = nxt_mp_zget(mp, sizeof(nxt_controller_request_t));
nxt_memzero(&rp, sizeof(nxt_http_request_parse_t));

if (r_controller == NULL) {
rc = nxt_http_parse_request_init(&rp, mp);
if (rc != NXT_OK) {
goto failed;
}

r_controller->conn = nxt_mp_zget(mp, sizeof(nxt_conn_t));
if (r_controller->conn == NULL) {
rc = nxt_http_parse_request(&rp, &buf);
if (rc != NXT_DONE) {
goto failed;
}

nxt_main_log.level = NXT_LOG_ALERT;
r_controller->conn->log = nxt_main_log;

nxt_http_fields_process(rp.fields, &nxt_controller_fields_hash,
r_controller);
req);

failed:

Expand Down
39 changes: 29 additions & 10 deletions fuzzing/nxt_http_h1p_fuzz.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,8 +42,9 @@ int
LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
nxt_mp_t *mp;
nxt_int_t rc;
nxt_buf_mem_t buf;
nxt_http_request_t *r_h1p;
nxt_http_request_t *req;
nxt_http_request_parse_t rp;

if (size < KMININPUTLENGTH || size > KMAXINPUTLENGTH) {
Expand All @@ -55,8 +56,23 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
return 0;
}

nxt_memzero(&rp, sizeof(nxt_http_request_parse_t));
if (nxt_http_parse_request_init(&rp, mp) != NXT_OK) {
req = nxt_mp_zget(mp, sizeof(nxt_http_request_t));
if (req == NULL) {
goto failed;
}

req->proto.h1 = nxt_mp_zget(mp, sizeof(nxt_h1proto_t));
if (req->proto.h1 == NULL) {
goto failed;
}

req->conf = nxt_mp_zget(mp, sizeof(nxt_socket_conf_joint_t));
if (req->conf == NULL) {
goto failed;
}

req->conf->socket_conf = nxt_mp_zget(mp, sizeof(nxt_socket_conf_t));
if (req->conf->socket_conf == NULL) {
goto failed;
}

Expand All @@ -65,19 +81,22 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
buf.pos = buf.start;
buf.free = buf.end;

if (nxt_http_parse_request(&rp, &buf) != NXT_DONE) {
goto failed;
}
req->mem_pool = mp;
req->conf->socket_conf->max_body_size = 8 * 1024 * 1024;

r_h1p = nxt_mp_zget(mp, sizeof(nxt_http_request_t));
nxt_memzero(&rp, sizeof(nxt_http_request_parse_t));

if (r_h1p == NULL) {
rc = nxt_http_parse_request_init(&rp, mp);
if (rc != NXT_OK) {
goto failed;
}

r_h1p->mem_pool = mp;
rc = nxt_http_parse_request(&rp, &buf);
if (rc != NXT_DONE) {
goto failed;
}

nxt_http_fields_process(rp.fields, &nxt_h1p_fields_hash, r_h1p);
nxt_http_fields_process(rp.fields, &nxt_h1p_fields_hash, req);

failed:

Expand Down
19 changes: 11 additions & 8 deletions fuzzing/nxt_http_h1p_peer_fuzz.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -43,8 +43,9 @@ int
LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
nxt_mp_t *mp;
nxt_int_t rc;
nxt_buf_mem_t buf;
nxt_http_request_t *r_h1p_peer;
nxt_http_request_t *req;
nxt_http_request_parse_t rp;

if (size < KMININPUTLENGTH || size > KMAXINPUTLENGTH) {
Expand All @@ -56,8 +57,8 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
return 0;
}

nxt_memzero(&rp, sizeof(nxt_http_request_parse_t));
if (nxt_http_parse_request_init(&rp, mp) != NXT_OK) {
req = nxt_mp_zget(mp, sizeof(nxt_http_request_t));
if (req == NULL) {
goto failed;
}

Expand All @@ -66,17 +67,19 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
buf.pos = buf.start;
buf.free = buf.end;

if (nxt_http_parse_request(&rp, &buf) != NXT_DONE) {
nxt_memzero(&rp, sizeof(nxt_http_request_parse_t));

rc = nxt_http_parse_request_init(&rp, mp);
if (rc != NXT_OK) {
goto failed;
}

r_h1p_peer = nxt_mp_zget(mp, sizeof(nxt_http_request_t));

if (r_h1p_peer == NULL) {
rc = nxt_http_parse_request(&rp, &buf);
if (rc != NXT_DONE) {
goto failed;
}

nxt_http_fields_process(rp.fields, &nxt_h1p_peer_fields_hash, r_h1p_peer);
nxt_http_fields_process(rp.fields, &nxt_h1p_peer_fields_hash, req);

failed:

Expand Down
Loading

0 comments on commit 6d50d9f

Please sign in to comment.