pwn.college Fuzz Dojo 实战（二）：Introduction to Fuzzing 挑战 5-7

1
/*
2
# Copyright 2022 Google LLC
3
#
4
# Licensed under the Apache License, Version 2.0 (the "License");
5
# you may not use this file except in compliance with the License.
6
# You may obtain a copy of the License at
7
#
8
#      http://www.apache.org/licenses/LICENSE-2.0
9
#
10
# Unless required by applicable law or agreed to in writing, software
11
# distributed under the License is distributed on an "AS IS" BASIS,
12
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13
# See the License for the specific language governing permissions and
14
# limitations under the License.
15
#
16
###############################################################################
17
*/
18

19
#include "bzlib.h"
20
#include <stdint.h>
21
#include <stdlib.h>
22
#include <assert.h>
23
#include <string.h>
24
#include <stddef.h>
25
#include <unistd.h>
26
#include <stdio.h>
27
#include <stdbool.h>
28

29
int
30
LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
31
{
32
    int    bzerr         = 0;
33
    int    blockSize100k = 9;
34
    int    verbosity     = 0;
35
    int    workFactor    = 30;
36
    uint   nbytes_in_lo32, nbytes_in_hi32;
37
    uint   nbytes_out_lo32, nbytes_out_hi32;
38

39
    char* filename = strdup("/tmp/generate_temporary_file.XXXXXX");
40
    const int file_descriptor = mkstemp(filename);
41
    if (file_descriptor < 0) {
42
    perror("Failed to make temporary file.");
43
    abort();
44
    }
45
    FILE* file = fdopen(file_descriptor, "wb");
46
    if (!file) {
47
    perror("Failed to open file descriptor.");
48
    close(file_descriptor);
49
    abort();
50
    }
51

52
    BZFILE* bzfile = BZ2_bzWriteOpen (&bzerr, file,
53
                           blockSize100k, verbosity, workFactor );
54

55
    BZ2_bzWrite (&bzerr, bzfile, (void*)data, size);
56

57
    BZ2_bzWriteClose64 (&bzerr, bzfile, 0,
58
                        &nbytes_in_lo32, &nbytes_in_hi32,
59
                        &nbytes_out_lo32, &nbytes_out_hi32 );
60

61
    BZ2_bzflush(file);
62
    fclose(file);
63

64
    if (unlink(filename) != 0) {
65
    perror("WARNING: Failed to delete temporary file.");
66
    }
67
    free(filename);
68
    return 0;
69
}

1
   if (open_mode==0) {
2
      if (path==NULL || strcmp(path,"")==0) {
3
        fp = (writing ? stdout : stdin);
4
        SET_BINARY_MODE(fp);
5
      } else {
6
        fp = fopen(path,mode2);
7
      }
8
   } else {
9
#ifdef BZ_STRICT_ANSI
10
      fp = NULL;
11
#else
12
      fp = fdopen(fd,mode2);
13
#endif
14
   }
15
   if (fp == NULL) return NULL;
16

17
   if (writing) {
18
      /* Guard against total chaos and anarchy -- JRS */
19
      if (blockSize100k < 1) blockSize100k = 1;
20
      if (blockSize100k > 9) blockSize100k = 9;
21
      bzfp = BZ2_bzWriteOpen(&bzerr,fp,blockSize100k,
22
                             verbosity,workFactor);
23
   } else {
24
      bzfp = BZ2_bzReadOpen(&bzerr,fp,verbosity,smallMode,
25
                            unused,nUnused);
26
   }
27
   if (bzfp == NULL) {
28
      if (fp != stdin && fp != stdout) fclose(fp);
29
      return NULL;
30
   }
31
   return bzfp;
32
}
33

34

35
/*---------------------------------------------------*/
36
/*--
37
   open file for read or write.
38
      ex) bzopen("file","w9")
39
      case path="" or NULL => use stdin or stdout.
40
--*/
41
BZFILE * BZ_API(BZ2_bzopen)
42
               ( const char *path,
43
                 const char *mode )
44
{
45
   return bzopen_or_bzdopen(path,-1,mode,/*bzopen*/0);
46
}
47

48

49
/*---------------------------------------------------*/
50
BZFILE * BZ_API(BZ2_bzdopen)
51
               ( int fd,
52
                 const char *mode )
53
{
54
   return bzopen_or_bzdopen(NULL,fd,mode,/*bzdopen*/1);
55
}
56

57

58
/*---------------------------------------------------*/
59
int BZ_API(BZ2_bzread) (BZFILE* b, void* buf, int len )
60
{
61
   int bzerr, nread;
62
   if (((bzFile*)b)->lastErr == BZ_STREAM_END) return 0;
63
   nread = BZ2_bzRead(&bzerr,b,buf,len);
64
   if (bzerr == BZ_OK || bzerr == BZ_STREAM_END) {
65
      return nread;
66
   } else {
67
      return -1;
68
   }
69
}
70

71

72
/*---------------------------------------------------*/
73
int BZ_API(BZ2_bzwrite) (BZFILE* b, void* buf, int len )
74
{
75
   int bzerr;
76

77
   BZ2_bzWrite(&bzerr,b,buf,len);
78
   if(bzerr == BZ_OK){
79
      return len;
80
   }else{
81
      return -1;
82
   }
83
}
84

85

86
/*---------------------------------------------------*/
87
int BZ_API(BZ2_bzflush) (BZFILE *b)
88
{
89
   /* do nothing now... */
90
   return 0;
91
}
92

93

94
/*---------------------------------------------------*/
95
void BZ_API(BZ2_bzclose) (BZFILE* b)
96
{
97
   int bzerr;
98
   FILE *fp;
99

100
   if (b==NULL) {return;}
101
   fp = ((bzFile *)b)->handle;
102
   if(((bzFile*)b)->writing){
103
      BZ2_bzWriteClose(&bzerr,b,0,NULL,NULL);
104
      if(bzerr != BZ_OK){
105
         BZ2_bzWriteClose(NULL,b,1,NULL,NULL);
106
      }
107
   }else{
108
      BZ2_bzReadClose(&bzerr,b);
109
   }
110
   if(fp!=stdin && fp!=stdout){
111
      fclose(fp);
112
   }
113
}
114

115

116
/*---------------------------------------------------*/

1
###
2
### Create New Fuzz Driver - avahi
3
###
4

5
Every included OSS-Fuzz project has an extra fuzz driver named newdriver or
6
something similar. This is a duplicate of one of the other fuzz drivers
7
designed to allow you to experiment with new fuzz driver code without
8
reducing the total code coverage of the project through modifications of an
9
existing driver.
10

11
Your task is to increase the total code coverage of the entire project by
12
adding a new fuzz driver to cover code that is not currently addressed.
13
Look at the function 'avahi_dns_packet_new_reply' within avahi-core/dns.c.
14

15
You will need to modify fuzz-newfuzzer.c, remove
16
avahi_dns_packet_consume_record and add the new function while figuring out
17
what parameters to send. Searching the source code of avahi for calls to
18
this function might help.
19

20
Useful
21
links:
22
https://storage.googleapis.com/oss-fuzz-introspector/avahi/inspector-report/20230821/fuzz_report.html
23

24
https://storage.googleapis.com/oss-fuzz-coverage/avahi/reports/20230821/linux/src/avahi/avahi-core/report.html
25

26
https://github.com/lathiat/avahi
27

28
/challenge/loc will provide you the flag when the total project sees an
29
increase in code coverage.

1
/***
2
  This file is part of avahi.
3

4
  avahi is free software; you can redistribute it and/or modify it
5
  under the terms of the GNU Lesser General Public License as
6
  published by the Free Software Foundation; either version 2.1 of the
7
  License, or (at your option) any later version.
8

9
  avahi is distributed in the hope that it will be useful, but WITHOUT
10
  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
11
  or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General
12
  Public License for more details.
13

14
  You should have received a copy of the GNU Lesser General Public
15
  License along with avahi; if not, write to the Free Software
16
  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
17
  USA.
18
***/
19

20
#include <stdint.h>
21
#include <string.h>
22

23
#include "avahi-common/malloc.h"
24
#include "avahi-core/dns.h"
25
#include "avahi-core/log.h"
26

27
void log_function(AvahiLogLevel level, const char *txt) {}
28

29
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
30
    avahi_set_log_function(log_function);
31
    AvahiDnsPacket* packet = avahi_dns_packet_new(size + AVAHI_DNS_PACKET_EXTRA_SIZE);
32
    memcpy(AVAHI_DNS_PACKET_DATA(packet), data, size);
33
    packet->size = size;
34
    AvahiRecord* rec = avahi_dns_packet_consume_record(packet, NULL);
35
    if (rec) {
36
        avahi_record_is_valid(rec);
37
        char *s = avahi_record_to_string(rec);
38
        avahi_free(s);
39
        avahi_record_unref(rec);
40
    }
41
    avahi_dns_packet_free(packet);
42

43
    return 0;
44
}

1
data / size
2
   │
3
   ▼
4
avahi_dns_packet_new()
5
   │
6
   ▼
7
把 fuzz input 写进 AvahiDnsPacket
8
   │
9
   ▼
10
avahi_dns_packet_consume_record()
11
   │
12
   ▼
13
得到 AvahiRecord
14
   │
15
   ├── avahi_record_is_valid()
16
   ├── avahi_record_to_string()
17
   └── avahi_record_unref()

1
/***
2
  This file is part of avahi.
3

4
  avahi is free software; you can redistribute it and/or modify it
5
  under the terms of the GNU Lesser General Public License as
6
  published by the Free Software Foundation; either version 2.1 of the
7
  License, or (at your option) any later version.
8

9
  avahi is distributed in the hope that it will be useful, but WITHOUT
10
  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
11
  or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General
12
  Public License for more details.
13

14
  You should have received a copy of the GNU Lesser General Public
15
  License along with avahi; if not, write to the Free Software
16
  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
17
  USA.
18
***/
19

20
#include <stdint.h>
21
#include <string.h>
22

23
#include "avahi-common/malloc.h"
24
#include "avahi-core/dns.h"
25
#include "avahi-core/log.h"
26

27
void log_function(AvahiLogLevel level, const char *txt) {}
28

29
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
30
    avahi_set_log_function(log_function);
31

32
    AvahiDnsPacket* packet =
33
        avahi_dns_packet_new(size + AVAHI_DNS_PACKET_EXTRA_SIZE);
34

35
    memcpy(AVAHI_DNS_PACKET_DATA(packet), data, size);
36
    packet->size = size;
37

38
    AvahiDnsPacket* reply =
39
        avahi_dns_packet_new_reply(
40
            packet,
41
            size + AVAHI_DNS_PACKET_EXTRA_SIZE,
42
            0,
43
            1
44
        );
45

46
    if (reply)
47
        avahi_dns_packet_free(reply);
48

49
    avahi_dns_packet_free(packet);
50

51
    return 0;
52
}

1
-    AvahiRecord* rec = avahi_dns_packet_consume_record(packet, NULL);
2
-    if (rec) {
3
-        avahi_record_is_valid(rec);
4
-        char *s = avahi_record_to_string(rec);
5
-        avahi_free(s);
6
-        avahi_record_unref(rec);
7
-    }
8
+    AvahiDnsPacket* reply =
9
+        avahi_dns_packet_new_reply(
10
+            packet,
11
+            size + AVAHI_DNS_PACKET_EXTRA_SIZE,
12
+            0,
13
+            1
14
+        );
15
+
16
+    if (reply)
17
+        avahi_dns_packet_free(reply);

1
    p->data = NULL;
2

3
    memset(AVAHI_DNS_PACKET_DATA(p), 0, p->size);
4
    return p;
5
}
6

7
AvahiDnsPacket* avahi_dns_packet_new_query(unsigned mtu) {
8
    AvahiDnsPacket *p;
9

10
    if (!(p = avahi_dns_packet_new(mtu)))
11
        return NULL;
12

13
    avahi_dns_packet_set_field(p, AVAHI_DNS_FIELD_FLAGS, AVAHI_DNS_FLAGS(0, 0, 0, 0, 0, 0, 0, 0, 0, 0));
14
    return p;
15
}
16

17
AvahiDnsPacket* avahi_dns_packet_new_response(unsigned mtu, int aa) {
18
    AvahiDnsPacket *p;
19

20
    if (!(p = avahi_dns_packet_new(mtu)))
21
        return NULL;
22

23
    avahi_dns_packet_set_field(p, AVAHI_DNS_FIELD_FLAGS, AVAHI_DNS_FLAGS(1, 0, aa, 0, 0, 0, 0, 0, 0, 0));
24
    return p;
25
}
26

27
AvahiDnsPacket* avahi_dns_packet_new_reply(AvahiDnsPacket* p, unsigned mtu, int copy_queries, int aa) {
28
    AvahiDnsPacket *r;
29
    assert(p);
30

31
    if (!(r = avahi_dns_packet_new_response(mtu, aa)))
32
        return NULL;
33

34
    if (copy_queries) {
35
        unsigned saved_rindex;
36
        uint32_t n;
37

38
        saved_rindex = p->rindex;
39
        p->rindex = AVAHI_DNS_PACKET_HEADER_SIZE;
40

41
        for (n = avahi_dns_packet_get_field(p, AVAHI_DNS_FIELD_QDCOUNT); n > 0; n--) {
42
            AvahiKey *k;
43
            int unicast_response;
44

45
            if ((k = avahi_dns_packet_consume_key(p, &unicast_response))) {
46
                avahi_dns_packet_append_key(r, k, unicast_response);
47
                avahi_key_unref(k);
48
            }
49
        }
50

51
        p->rindex = saved_rindex;
52

53
        avahi_dns_packet_set_field(r, AVAHI_DNS_FIELD_QDCOUNT, avahi_dns_packet_get_field(p, AVAHI_DNS_FIELD_QDCOUNT));
54
    }
55

56
    avahi_dns_packet_set_field(r, AVAHI_DNS_FIELD_ID, avahi_dns_packet_get_field(p, AVAHI_DNS_FIELD_ID));
57

58
    avahi_dns_packet_set_field(r, AVAHI_DNS_FIELD_FLAGS,
59
                               (avahi_dns_packet_get_field(r, AVAHI_DNS_FIELD_FLAGS) & ~AVAHI_DNS_FLAG_OPCODE) |
60
                               (avahi_dns_packet_get_field(p, AVAHI_DNS_FIELD_FLAGS) & AVAHI_DNS_FLAG_OPCODE));
61

62
    return r;
63
}
64

65

66
void avahi_dns_packet_free(AvahiDnsPacket *p) {
67
    assert(p);
68

69
    if (p->name_table)
70
        avahi_hashmap_free(p->name_table);

1
avahi_dns_packet_new_reply(packet, mtu, copy_queries, aa)
2
                    │
3
                    ├── 创建 response
4
                    │
5
                    ├── copy_queries == 1 ?
6
                    │        │
7
                    │        ├── 读取 QDCOUNT
8
                    │        │
9
                    │        ├── consume_key()
10
                    │        │
11
                    │        ├── append_key()
12
                    │        │
13
                    │        └── 设置 QDCOUNT
14
                    │
15
                    ├── 设置 ID
16
                    │
17
                    └── 复制 OPCODE

1
avahi_dns_packet_new_reply()
2
        │
3
        ├── 创建 response
4
        │
5
        ├── copy_queries == 1
6
        │       │
7
        │       ├── 获取 QDCOUNT
8
        │       │
9
        │       ├── consume_key()
10
        │       │
11
        │       ├── append_key()
12
        │       │
13
        │       ├── key_unref()
14
        │       │
15
        │       └── 设置 QDCOUNT
16
        │
17
        ├── 设置 ID
18
        │
19
        └── 复制 OPCODE