@matheusbsbs / matheus-bagliano / commits / 966253db75

fuzz: port fuzz-credential-from-url-gently from OSS-Fuzz

Git's fuzz tests are run continuously as part of OSS-Fuzz [1]. Several additional fuzz tests have been contributed directly to OSS-Fuzz; however, these tests are vulnerable to bitrot because they are not built during Git's CI runs, and thus breaking changes are much less likely to be noticed by Git contributors. Port one of these tests back to the Git project: fuzz-credential-from-url-gently This test was originally written by Eric Sesterhenn as part of a security audit of Git [2]. It was then contributed to the OSS-Fuzz repo in commit c58ac4492 (Git fuzzing: uncomment the existing and add new targets. (#11486), 2024-02-21) by Jaroslav Lobačevski. I (Josh Steadmon) have verified with both Eric and Jaroslav that they're OK with moving this test to the Git project. [1] https://github.com/google/oss-fuzz [2] https://ostif.org/wp-content/uploads/2023/01/X41-OSTIF-Gitlab-Git-Security-Audit-20230117-public.pdf Co-authored-by: Jaroslav Lobačevski <jarlob@gmail.com> Co-authored-by: Josh Steadmon <steadmon@google.com> Signed-off-by: Josh Steadmon <steadmon@google.com> Signed-off-by: Taylor Blau <me@ttaylorr.com>

Eric Sesterhenn committed Oct 14, 2024 at 14:04 UTC 966253db757948d4e0738c5c1fac5b694f0d042d
4 files changed +44 -1
Makefile
+1
@@ -2422,6 +2422,7 @@ endif
2422 FUZZ_OBJS += oss-fuzz/dummy-cmd-main.o
2423 FUZZ_OBJS += oss-fuzz/fuzz-commit-graph.o
2424 FUZZ_OBJS += oss-fuzz/fuzz-config.o
2425 +FUZZ_OBJS += oss-fuzz/fuzz-credential-from-url-gently.o
2426 FUZZ_OBJS += oss-fuzz/fuzz-date.o
2427 FUZZ_OBJS += oss-fuzz/fuzz-pack-headers.o
2428 FUZZ_OBJS += oss-fuzz/fuzz-pack-idx.o
ci/run-build-and-minimal-fuzzers.sh
+10 -1
@@ -13,7 +13,16 @@ group "Build fuzzers" make \
13 LIB_FUZZING_ENGINE="-fsanitize=fuzzer,address" \
14 fuzz-all
15
16 -for fuzzer in commit-graph config date pack-headers pack-idx ; do
16 +fuzzers="
17 +commit-graph
18 +config
19 +credential-from-url-gently
20 +date
21 +pack-headers
22 +pack-idx
23 +"
24 +
25 +for fuzzer in $fuzzers; do
26 begin_group "fuzz-$fuzzer"
27 ./oss-fuzz/fuzz-$fuzzer -verbosity=0 -runs=1 || exit 1
28 end_group "fuzz-$fuzzer"
oss-fuzz/.gitignore
+1
@@ -1,5 +1,6 @@
1 fuzz-commit-graph
2 fuzz-config
3 +fuzz-credential-from-url-gently
4 fuzz-date
5 fuzz-pack-headers
6 fuzz-pack-idx
oss-fuzz/fuzz-credential-from-url-gently.c new
+32
@@ -0,0 +1,32 @@
1 +#include "git-compat-util.h"
2 +#include <stddef.h>
3 +#include <stdlib.h>
4 +#include <stdint.h>
5 +#include <string.h>
6 +#include <stdio.h>
7 +#include "credential.h"
8 +
9 +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
10 +
11 +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
12 +{
13 + struct credential c;
14 + char *buf;
15 +
16 + buf = malloc(size + 1);
17 + if (!buf)
18 + return 0;
19 +
20 + memcpy(buf, data, size);
21 + buf[size] = 0;
22 +
23 + // start fuzzing
24 + credential_init(&c);
25 + credential_from_url_gently(&c, buf, 1);
26 +
27 + // cleanup
28 + credential_clear(&c);
29 + free(buf);
30 +
31 + return 0;
32 +}