Skip to content

Commit 40d9736

Browse files
skypherskypher
committed
[libarchive] Expand fuzzing from 1 to 25 targets
Update build configuration to use all 25 fuzz targets now available in upstream libarchive (merged in libarchive/libarchive#2820). Changes: - Update build.sh to compile all 25 fuzzers from contrib/oss-fuzz/ - Copy dictionaries and options files for guided fuzzing - Generate seed corpora from libarchive's test files - Remove local libarchive_fuzzer.cc (now in upstream repo) New fuzzers include: - 13 format-specific: tar, zip, 7zip, rar, rar5, xar, cab, lha, iso9660, cpio, warc, mtree, ar - 4 security-critical: encryption, write_disk, read_disk, entry (ACL) - 7 API coverage: write, linkify, match, string, seek, roundtrip, filter Expected coverage improvement: 74% → 85-95%
1 parent b18ea9a commit 40d9736

File tree

3 files changed

+125
-103
lines changed

3 files changed

+125
-103
lines changed

‎projects/libarchive/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,5 +38,5 @@ RUN mkdir /deps && \
3838
make install && \
3939
cp .libs/libxml2.a /deps/
4040

41-
COPY build.sh libarchive_fuzzer.cc $SRC/
41+
COPY build.sh $SRC/
4242
WORKDIR $SRC

‎projects/libarchive/build.sh‎

Lines changed: 124 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -32,26 +32,134 @@ cd build2
3232
cmake -DDONT_FAIL_ON_CRC_ERROR=ON -DENABLE_WERROR=OFF ../
3333
make -j$(nproc)
3434

35-
# build seed
36-
cp $SRC/libarchive/contrib/oss-fuzz/corpus.zip\
37-
$OUT/libarchive_fuzzer_seed_corpus.zip
35+
FUZZ_DIR=$SRC/libarchive/contrib/oss-fuzz
36+
TEST_DIR=$SRC/libarchive/libarchive/test
3837

39-
# build fuzzer(s)
40-
$CXX $CXXFLAGS -I../libarchive \
41-
$SRC/libarchive_fuzzer.cc -o $OUT/libarchive_fuzzer \
42-
$LIB_FUZZING_ENGINE ./libarchive/libarchive.a \
43-
-Wl,-Bstatic -llzo2 -Wl,-Bdynamic -lcrypto -lacl -llzma -llz4 -lbz2 -lz ${DEPS}/libxml2.a
38+
# Common link flags
39+
LINK_FLAGS="./libarchive/libarchive.a -Wl,-Bstatic -llzo2 -Wl,-Bdynamic -lcrypto -lacl -llzma -llz4 -lbz2 -lz ${DEPS}/libxml2.a"
4440

45-
# add the uuencoded test files
41+
# Build all fuzzers
42+
FUZZERS=(
43+
"libarchive_fuzzer"
44+
"libarchive_tar_fuzzer"
45+
"libarchive_zip_fuzzer"
46+
"libarchive_7zip_fuzzer"
47+
"libarchive_rar_fuzzer"
48+
"libarchive_rar5_fuzzer"
49+
"libarchive_xar_fuzzer"
50+
"libarchive_cab_fuzzer"
51+
"libarchive_lha_fuzzer"
52+
"libarchive_iso9660_fuzzer"
53+
"libarchive_cpio_fuzzer"
54+
"libarchive_warc_fuzzer"
55+
"libarchive_mtree_fuzzer"
56+
"libarchive_ar_fuzzer"
57+
"libarchive_filter_fuzzer"
58+
"libarchive_entry_fuzzer"
59+
"libarchive_write_fuzzer"
60+
"libarchive_linkify_fuzzer"
61+
"libarchive_match_fuzzer"
62+
"libarchive_encryption_fuzzer"
63+
"libarchive_read_disk_fuzzer"
64+
"libarchive_write_disk_fuzzer"
65+
"libarchive_seek_fuzzer"
66+
"libarchive_string_fuzzer"
67+
"libarchive_roundtrip_fuzzer"
68+
)
69+
70+
for fuzzer in "${FUZZERS[@]}"; do
71+
if [ -f "$FUZZ_DIR/${fuzzer}.cc" ]; then
72+
echo "Building $fuzzer..."
73+
$CXX $CXXFLAGS -I../libarchive \
74+
"$FUZZ_DIR/${fuzzer}.cc" -o "$OUT/$fuzzer" \
75+
$LIB_FUZZING_ENGINE $LINK_FLAGS
76+
fi
77+
done
78+
79+
# Copy dictionaries and options
80+
cp "$FUZZ_DIR"/*.dict "$OUT/" 2>/dev/null || true
81+
cp "$FUZZ_DIR"/*.options "$OUT/" 2>/dev/null || true
82+
83+
# Build seed corpora
84+
echo "Building seed corpora..."
85+
86+
# Main fuzzer corpus (existing)
87+
cp "$FUZZ_DIR/corpus.zip" "$OUT/libarchive_fuzzer_seed_corpus.zip"
88+
89+
# Function to create corpus from test files
90+
create_corpus() {
91+
local name=$1
92+
local pattern=$2
93+
local dir="/tmp/${name}_corpus"
94+
95+
mkdir -p "$dir"
96+
for f in $TEST_DIR/$pattern; do
97+
if [ -f "$f" ]; then
98+
base=$(basename "$f" .uu)
99+
uudecode -o "$dir/$base" "$f" 2>/dev/null || true
100+
fi
101+
done
102+
103+
if [ "$(ls -A $dir 2>/dev/null)" ]; then
104+
zip -j "$OUT/${name}_seed_corpus.zip" "$dir"/* 2>/dev/null || true
105+
echo "Created corpus for $name with $(ls $dir | wc -l) files"
106+
fi
107+
rm -rf "$dir"
108+
}
109+
110+
# Create format-specific corpora
111+
create_corpus "libarchive_tar_fuzzer" "test_compat_*tar*.uu"
112+
create_corpus "libarchive_zip_fuzzer" "test_*zip*.uu"
113+
create_corpus "libarchive_7zip_fuzzer" "test_read_format_7zip*.uu"
114+
create_corpus "libarchive_rar_fuzzer" "test_read_format_rar_*.uu"
115+
create_corpus "libarchive_rar5_fuzzer" "test_read_format_rar5*.uu"
116+
create_corpus "libarchive_xar_fuzzer" "test_read_format_xar*.uu"
117+
create_corpus "libarchive_cab_fuzzer" "test_read_format_cab*.uu"
118+
create_corpus "libarchive_lha_fuzzer" "test_read_format_lha*.uu"
119+
create_corpus "libarchive_iso9660_fuzzer" "test_read_format_iso*.uu"
120+
create_corpus "libarchive_cpio_fuzzer" "test_compat_cpio*.uu"
121+
create_corpus "libarchive_warc_fuzzer" "test_read_format_warc*.uu"
122+
create_corpus "libarchive_mtree_fuzzer" "test_read_format_mtree*.uu"
123+
create_corpus "libarchive_ar_fuzzer" "test_read_format_ar*.uu"
124+
125+
# Filter corpus - use compressed test files
126+
mkdir -p /tmp/filter_corpus
127+
for f in $TEST_DIR/*.gz.uu $TEST_DIR/*.bz2.uu $TEST_DIR/*.xz.uu $TEST_DIR/*.lz4.uu $TEST_DIR/*.zst.uu $TEST_DIR/*.Z.uu; do
128+
if [ -f "$f" ]; then
129+
base=$(basename "$f" .uu)
130+
uudecode -o "/tmp/filter_corpus/$base" "$f" 2>/dev/null || true
131+
fi
132+
done
133+
if [ "$(ls -A /tmp/filter_corpus 2>/dev/null)" ]; then
134+
zip -j "$OUT/libarchive_filter_fuzzer_seed_corpus.zip" /tmp/filter_corpus/* 2>/dev/null || true
135+
fi
136+
rm -rf /tmp/filter_corpus
137+
138+
# Encryption corpus - encrypted archives
139+
mkdir -p /tmp/encryption_corpus
140+
for f in $TEST_DIR/*encrypt*.uu $TEST_DIR/*password*.uu; do
141+
if [ -f "$f" ]; then
142+
base=$(basename "$f" .uu)
143+
uudecode -o "/tmp/encryption_corpus/$base" "$f" 2>/dev/null || true
144+
fi
145+
done
146+
if [ "$(ls -A /tmp/encryption_corpus 2>/dev/null)" ]; then
147+
zip -j "$OUT/libarchive_encryption_fuzzer_seed_corpus.zip" /tmp/encryption_corpus/* 2>/dev/null || true
148+
fi
149+
rm -rf /tmp/encryption_corpus
150+
151+
# add the uuencoded test files to main corpus
46152
cd $SRC
47-
mkdir ./uudecoded
48-
find $SRC/libarchive/ -type f -name "test_extract.*.uu" -print0 | xargs -0 -I % cp -f % ./uudecoded/
153+
mkdir -p ./uudecoded
154+
find $SRC/libarchive/ -type f -name "test_extract.*.uu" -print0 | xargs -0 -I % cp -f % ./uudecoded/ 2>/dev/null || true
49155
cd ./uudecoded
50-
find ./ -name "*.uu" -exec uudecode {} \;
156+
find ./ -name "*.uu" -exec uudecode {} \; 2>/dev/null || true
51157
cd ../
52-
rm -f ./uudecoded/*.uu
53-
zip -jr $OUT/libarchive_fuzzer_seed_corpus.zip ./uudecoded/*
158+
rm -f ./uudecoded/*.uu 2>/dev/null || true
159+
zip -jr $OUT/libarchive_fuzzer_seed_corpus.zip ./uudecoded/* 2>/dev/null || true
54160

55-
# add weird archives
161+
# add weird archives from corkami
56162
git clone --depth=1 https://github.com/corkami/pocs
57-
find ./pocs/ -type f -print0 | xargs -0 -I % zip -jr $OUT/libarchive_fuzzer_seed_corpus.zip %
163+
find ./pocs/ -type f -print0 | xargs -0 -I % zip -jr $OUT/libarchive_fuzzer_seed_corpus.zip % 2>/dev/null || true
164+
165+
echo "Build complete! Built ${#FUZZERS[@]} fuzzers."

‎projects/libarchive/libarchive_fuzzer.cc‎

Lines changed: 0 additions & 86 deletions
This file was deleted.

0 commit comments

Comments
 (0)