Add fuzzing setup for Message::decode

Co-authored-by: kpcyrd <[email protected]>
Signed-off-by: Wiktor Kwapisiewicz <[email protected]>

Cargo.toml

@@ -15,6 +15,9 @@ keywords = ["ssh", "agent", "authentication", "openssh", "async"]
 categories = ["authentication", "cryptography", "encoding", "network-programming", "parsing"]
 exclude = [".github"]
 
+[workspace]
+members = [".", "fuzz"]
+
 [dependencies]
 byteorder = "1.4.3"
 async-trait = { version = "0.1.77", optional = true }

fuzz/.gitignore

@@ -0,0 +1,4 @@
+target
+corpus
+artifacts
+coverage

fuzz/Cargo.toml

@@ -0,0 +1,22 @@
+[package]
+name = "ssh-agent-lib-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2021"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+ssh-encoding = "0.2.0"
+
+[dependencies.ssh-agent-lib]
+path = ".."
+
+[[bin]]
+name = "message_decode"
+path = "fuzz_targets/message_decode.rs"
+test = false
+doc = false
+bench = false

fuzz/README.md

@@ -0,0 +1,28 @@
+# Fuzzing
+
+This directory contains fuzzing targets for ssh-agent-lib.
+
+## Setup
+
+Install [`cargo-fuzz`](https://crates.io/crates/cargo-fuzz):
+
+```sh
+cargo install --locked cargo-fuzz
+```
+
+## Running
+
+Select a target from the list printed by `cargo fuzz list` e.g. `message_decode`:
+
+```sh
+cargo +nightly fuzz run message_decode
+```
+
+Options that can be added to the `fuzz run` command:
+
+- `--jobs N` - increase parallelism,
+- `--sanitizer none` - disable sanitizer since ssh-agent-lib does not use any `unsafe` blocks,
+
+Note that due to a limitation of cargo-fuzz nightly version of the toolchain is required.
+
+For more details see [Fuzzing with cargo-fuzz](https://rust-fuzz.github.io/book/cargo-fuzz.html) or the [more detailed explanation of fuzzing output](https://github.com/rust-fuzz/cargo-fuzz/issues/72#issuecomment-284448618) in a `cargo-fuzz` comment.

fuzz/fuzz_targets/message_decode.rs

@@ -0,0 +1,9 @@
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+use ssh_agent_lib::proto::message::Message;
+use ssh_encoding::Decode;
+
+fuzz_target!(|data: &[u8]| {
+    let _ = Message::decode(&mut &data[..]);
+});