diff --git a/MANIFEST b/MANIFEST index b1e7d33c1..bb4d8b738 100644 --- a/MANIFEST +++ b/MANIFEST @@ -108,6 +108,8 @@ lib/eventlog/logwrap.c lib/eventlog/regress/logwrap/check_wrap.c lib/eventlog/regress/logwrap/check_wrap.in lib/eventlog/regress/logwrap/check_wrap.out.ok +lib/fuzzstub/Makefile.in +lib/fuzzstub/fuzzstub.c lib/iolog/Makefile.in lib/iolog/host_port.c lib/iolog/hostcheck.c diff --git a/Makefile.in b/Makefile.in index 9d9d754d7..2569e4df4 100644 --- a/Makefile.in +++ b/Makefile.in @@ -56,7 +56,7 @@ shlib_mode = @SHLIB_MODE@ # Version of python detected by configure (major.minor) python_version = @PYTHON_VERSION@ -SUBDIRS = lib/util @ZLIB_SRC@ lib/eventlog lib/iolog @LOGSRV_SRC@ \ +SUBDIRS = lib/util @ZLIB_SRC@ lib/eventlog lib/fuzzstub lib/iolog @LOGSRV_SRC@ \ @LOGSRVD_SRC@ plugins/audit_json plugins/group_file \ plugins/sample_approval plugins/sudoers plugins/system_group \ @PYTHON_PLUGIN_SRC@ src include doc examples @@ -210,7 +210,8 @@ siglist.c signame.c: depend: siglist.c signame.c $(scriptdir)/mkdep.pl \ --srcdir=$(abs_top_srcdir) --builddir=$(abs_top_builddir) \ - lib/util/Makefile.in lib/zlib/Makefile.in lib/eventlog/Makefile.in \ + lib/util/Makefile.in lib/zlib/Makefile.in \ + lib/fuzzstub/Makefile.in lib/eventlog/Makefile.in \ lib/iolog/Makefile.in lib/logsrv/Makefile.in logsrvd/Makefile.in \ plugins/group_file/Makefile.in plugins/sample/Makefile.in \ plugins/sudoers/Makefile.in plugins/system_group/Makefile.in \ @@ -219,6 +220,7 @@ depend: siglist.c signame.c $(top_builddir)/config.status --file $(top_builddir)/lib/util/Makefile \ --file $(top_builddir)/lib/zlib/Makefile \ --file $(top_builddir)/lib/eventlog/Makefile \ + --file $(top_builddir)/lib/fuzzstub/Makefile \ --file $(top_builddir)/lib/iolog/Makefile \ --file $(top_builddir)/lib/logsrv/Makefile \ --file $(top_builddir)/logsrvd/Makefile \ diff --git a/configure b/configure index 7820bfc67..e5dba8d0a 100755 --- a/configure +++ b/configure @@ -28765,6 +28765,9 @@ else $as_nop : fi +else + # Not using compiler fuzzing support, link with stub library. + FUZZ_ENGINE='$(top_builddir)/lib/fuzzstub/libsudo_fuzzstub.la' fi if test -n "$GCC"; then @@ -29489,7 +29492,7 @@ elif test X"$TMPFILES_D" != X""; then fi -ac_config_files="$ac_config_files Makefile doc/Makefile examples/Makefile examples/sudo.conf include/Makefile lib/eventlog/Makefile lib/iolog/Makefile lib/logsrv/Makefile lib/util/Makefile lib/util/util.exp logsrvd/Makefile src/sudo_usage.h src/Makefile plugins/audit_json/Makefile plugins/sample/Makefile plugins/group_file/Makefile plugins/sample_approval/Makefile plugins/system_group/Makefile plugins/sudoers/Makefile plugins/sudoers/sudoers" +ac_config_files="$ac_config_files Makefile doc/Makefile examples/Makefile examples/sudo.conf include/Makefile lib/eventlog/Makefile lib/fuzzstub/Makefile lib/iolog/Makefile lib/logsrv/Makefile lib/util/Makefile lib/util/util.exp logsrvd/Makefile src/sudo_usage.h src/Makefile plugins/audit_json/Makefile plugins/sample/Makefile plugins/group_file/Makefile plugins/sample_approval/Makefile plugins/system_group/Makefile plugins/sudoers/Makefile plugins/sudoers/sudoers" cat >confcache <<\_ACEOF @@ -30486,6 +30489,7 @@ do "examples/sudo.conf") CONFIG_FILES="$CONFIG_FILES examples/sudo.conf" ;; "include/Makefile") CONFIG_FILES="$CONFIG_FILES include/Makefile" ;; "lib/eventlog/Makefile") CONFIG_FILES="$CONFIG_FILES lib/eventlog/Makefile" ;; + "lib/fuzzstub/Makefile") CONFIG_FILES="$CONFIG_FILES lib/fuzzstub/Makefile" ;; "lib/iolog/Makefile") CONFIG_FILES="$CONFIG_FILES lib/iolog/Makefile" ;; "lib/logsrv/Makefile") CONFIG_FILES="$CONFIG_FILES lib/logsrv/Makefile" ;; "lib/util/Makefile") CONFIG_FILES="$CONFIG_FILES lib/util/Makefile" ;; diff --git a/configure.ac b/configure.ac index e589b26db..9ac9782ad 100644 --- a/configure.ac +++ b/configure.ac @@ -4604,6 +4604,9 @@ if test "$enable_fuzzer" = "yes"; then AX_APPEND_FLAG([-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION], [CFLAGS]) AC_DEFINE(NO_LEAKS) ]) +else + # Not using compiler fuzzing support, link with stub library. + FUZZ_ENGINE='$(top_builddir)/lib/fuzzstub/libsudo_fuzzstub.la' fi dnl @@ -4914,7 +4917,7 @@ elif test X"$TMPFILES_D" != X""; then AC_CONFIG_FILES([etc/init.d/sudo.conf]) fi -AC_CONFIG_FILES([Makefile doc/Makefile examples/Makefile examples/sudo.conf include/Makefile lib/eventlog/Makefile lib/iolog/Makefile lib/logsrv/Makefile lib/util/Makefile lib/util/util.exp logsrvd/Makefile src/sudo_usage.h src/Makefile plugins/audit_json/Makefile plugins/sample/Makefile plugins/group_file/Makefile plugins/sample_approval/Makefile plugins/system_group/Makefile plugins/sudoers/Makefile plugins/sudoers/sudoers]) +AC_CONFIG_FILES([Makefile doc/Makefile examples/Makefile examples/sudo.conf include/Makefile lib/eventlog/Makefile lib/fuzzstub/Makefile lib/iolog/Makefile lib/logsrv/Makefile lib/util/Makefile lib/util/util.exp logsrvd/Makefile src/sudo_usage.h src/Makefile plugins/audit_json/Makefile plugins/sample/Makefile plugins/group_file/Makefile plugins/sample_approval/Makefile plugins/system_group/Makefile plugins/sudoers/Makefile plugins/sudoers/sudoers]) AC_OUTPUT diff --git a/lib/fuzzstub/Makefile.in b/lib/fuzzstub/Makefile.in new file mode 100644 index 000000000..57f051aba --- /dev/null +++ b/lib/fuzzstub/Makefile.in @@ -0,0 +1,166 @@ +# +# SPDX-License-Identifier: ISC +# +# Copyright (c) 2021 Todd C. Miller +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. +# +# @configure_input@ +# + +#### Start of system configuration section. #### + +srcdir = @srcdir@ +abs_srcdir = @abs_srcdir@ +top_srcdir = @top_srcdir@ +abs_top_srcdir = @abs_top_srcdir@ +top_builddir = @top_builddir@ +abs_top_builddir = @abs_top_builddir@ +devdir = @devdir@ +scriptdir = $(top_srcdir)/scripts +incdir = $(top_srcdir)/include + +# Compiler & tools to use +CC = @CC@ +LIBTOOL = @LIBTOOL@ + +# C preprocessor flags +CPPFLAGS = -I$(incdir) -I$(top_builddir) -I$(srcdir) -I$(top_srcdir) @CPPFLAGS@ + +# Usually -O and/or -g +CFLAGS = @CFLAGS@ + +# Flags to pass to the link stage +LDFLAGS = @LDFLAGS@ + +# Flags to pass to libtool +LTFLAGS = @LT_STATIC@ + +# Libraries +LT_LIBS = +LIBS = $(LT_LIBS) + +# Address sanitizer flags +ASAN_CFLAGS = @ASAN_CFLAGS@ +ASAN_LDFLAGS = @ASAN_LDFLAGS@ + +# PIE flags +PIE_CFLAGS = @PIE_CFLAGS@ +PIE_LDFLAGS = @PIE_LDFLAGS@ + +# Stack smashing protection flags +SSP_CFLAGS = @SSP_CFLAGS@ +SSP_LDFLAGS = @SSP_LDFLAGS@ + +# cppcheck options, usually set in the top-level Makefile +CPPCHECK_OPTS = -q --enable=warning,performance,portability --suppress=constStatement --suppress=compareBoolExpressionWithInt --error-exitcode=1 --inline-suppr -Dva_copy=va_copy -U__cplusplus -UQUAD_MAX -UQUAD_MIN -UUQUAD_MAX -U_POSIX_HOST_NAME_MAX -U_POSIX_PATH_MAX -U__NBBY -DNSIG=64 + +# splint options, usually set in the top-level Makefile +SPLINT_OPTS = -D__restrict= -checks + +# PVS-studio options +PVS_CFG = $(top_srcdir)/PVS-Studio.cfg +PVS_IGNORE = 'V707,V011,V002,V536' +PVS_LOG_OPTS = -a 'GA:1,2' -e -t errorfile -d $(PVS_IGNORE) + +# Set to non-empty for development mode +DEVEL = @DEVEL@ + +#### End of system configuration section. #### + +SHELL = @SHELL@ + +LIBFUZZSTUB_OBJS = fuzzstub.lo + +IOBJS = $(LIBFUZZSTUB_OBJS:.lo=.i) + +POBJS = $(IOBJS:.i=.plog) + +all: libsudo_fuzzstub.la + +pvs-log-files: $(POBJS) + +pvs-studio: $(POBJS) + plog-converter $(PVS_LOG_OPTS) $(POBJS) + +depend: + $(scriptdir)/mkdep.pl --srcdir=$(abs_top_srcdir) \ + --builddir=$(abs_top_builddir) lib/fuzzstub/Makefile.in + cd $(top_builddir) && ./config.status --file lib/fuzzstub/Makefile + +Makefile: $(srcdir)/Makefile.in + cd $(top_builddir) && ./config.status --file lib/fuzzstub/Makefile + +.SUFFIXES: .c .h .i .lo .plog + +.c.lo: + $(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c -o $@ $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $< + +.c.i: + $(CC) -E -o $@ $(CPPFLAGS) $< + +.i.plog: + ifile=$<; rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $${ifile%i}c --i-file $< --output-file $@ + +libsudo_fuzzstub.la: $(LIBFUZZSTUB_OBJS) + $(LIBTOOL) $(LTFLAGS) --mode=link $(CC) -o $@ $(LIBFUZZSTUB_OBJS) $(LT_LIBS) + +pre-install: + +install: + +install-binaries: + +install-includes: + +install-doc: + +install-plugin: + +uninstall: + +splint: + splint $(SPLINT_OPTS) -I$(incdir) -I$(top_builddir) -I$(top_srcdir) $(srcdir)/*.c + +cppcheck: + cppcheck $(CPPCHECK_OPTS) -I$(incdir) -I$(top_builddir) -I$(top_srcdir) $(srcdir)/*.c + +pvs-log-files: $(POBJS) + +check: + +clean: + -$(LIBTOOL) $(LTFLAGS) --mode=clean rm -f *.lo *.o *.la + -rm -f *.i *.plog stamp-* core *.core core.* + +mostlyclean: clean + +distclean: clean + -rm -rf Makefile .libs + +clobber: distclean + +realclean: distclean + rm -f TAGS tags + +cleandir: realclean + +# Autogenerated dependencies, do not modify +fuzzstub.lo: $(srcdir)/fuzzstub.c $(incdir)/sudo_compat.h \ + $(top_builddir)/config.h + $(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c -o $@ $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/fuzzstub.c +fuzzstub.i: $(srcdir)/fuzzstub.c $(incdir)/sudo_compat.h \ + $(top_builddir)/config.h + $(CC) -E -o $@ $(CPPFLAGS) $< +fuzzstub.plog: fuzzstub.i + rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/fuzzstub.c --i-file $< --output-file $@ diff --git a/lib/fuzzstub/fuzzstub.c b/lib/fuzzstub/fuzzstub.c new file mode 100644 index 000000000..9fb802738 --- /dev/null +++ b/lib/fuzzstub/fuzzstub.c @@ -0,0 +1,106 @@ +/* + * SPDX-License-Identifier: ISC + * + * Copyright (c) 2021 Todd C. Miller + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +/* + * This is an open source non-commercial project. Dear PVS-Studio, please check it. + * PVS-Studio Static Code Analyzer for C, C++ and C#: http://www.viva64.com + */ + +#include + +#include + +#include +#include +#include +#include +#include +#include +#include +#if defined(HAVE_STDINT_H) +# include +#elif defined(HAVE_INTTYPES_H) +# include +#endif + +#include "sudo_compat.h" + +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size); + +/* + * Simple driver for fuzzers built for LLVM libfuzzer. + * This stub library allows fuzz targets to be built and run without + * libfuzzer. No actual fuzzing will occur but the provided inputs + * will be tested. + */ +int +main(int argc, char *argv[]) +{ + size_t bufsize = 0; + ssize_t nread; + struct stat sb; + uint8_t *buf = NULL; + int fd, i, errors = 0; + + /* Test provided input files. */ + for (i = 1; i < argc; i++) { + fd = open(argv[i], O_RDONLY); + if (fd == -1 || fstat(fd, &sb) != 0) { + fprintf(stderr, "open %s: %s\n", argv[i], strerror(errno)); + if (fd != -1) + close(fd); + errors++; + continue; + } + if (sb.st_size > SSIZE_MAX) { + errno = E2BIG; + fprintf(stderr, "%s: %s\n", argv[i], strerror(errno)); + close(fd); + errors++; + continue; + } + if (bufsize < (size_t)sb.st_size) { + void *tmp = realloc(buf, sb.st_size); + if (tmp == NULL) { + fprintf(stderr, "realloc: %s\n", strerror(errno)); + close(fd); + errors++; + continue; + } + buf = tmp; + bufsize = sb.st_size; + } + nread = read(fd, buf, sb.st_size); + if (nread != sb.st_size) { + if (nread == -1) + fprintf(stderr, "read %s: %s\n", argv[i], strerror(errno)); + else + fprintf(stderr, "read %s: short read\n", argv[i]); + close(fd); + errors++; + continue; + } + close(fd); + + /* NOTE: doesn't support LLVMFuzzerInitialize() (but we don't use it) */ + LLVMFuzzerTestOneInput(buf, nread); + } + free(buf); + + return errors; +} diff --git a/lib/iolog/regress/fuzz/fuzz_iolog_json.c b/lib/iolog/regress/fuzz/fuzz_iolog_json.c index a7c397e0c..345046b53 100644 --- a/lib/iolog/regress/fuzz/fuzz_iolog_json.c +++ b/lib/iolog/regress/fuzz/fuzz_iolog_json.c @@ -84,12 +84,3 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) return 0; } - -#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -int -main(int argc, char *argv[]) -{ - /* Nothing for now. */ - return LLVMFuzzerTestOneInput(NULL, 0); -} -#endif diff --git a/lib/iolog/regress/fuzz/fuzz_iolog_legacy.c b/lib/iolog/regress/fuzz/fuzz_iolog_legacy.c index c15f84375..712b57a3c 100644 --- a/lib/iolog/regress/fuzz/fuzz_iolog_legacy.c +++ b/lib/iolog/regress/fuzz/fuzz_iolog_legacy.c @@ -82,12 +82,3 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) return 0; } - -#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -int -main(int argc, char *argv[]) -{ - /* Nothing for now. */ - return LLVMFuzzerTestOneInput(NULL, 0); -} -#endif diff --git a/lib/iolog/regress/fuzz/fuzz_iolog_timing.c b/lib/iolog/regress/fuzz/fuzz_iolog_timing.c index e83726456..57f10df98 100644 --- a/lib/iolog/regress/fuzz/fuzz_iolog_timing.c +++ b/lib/iolog/regress/fuzz/fuzz_iolog_timing.c @@ -95,12 +95,3 @@ cleanup: return 0; } - -#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -int -main(int argc, char *argv[]) -{ - /* Nothing for now. */ - return LLVMFuzzerTestOneInput(NULL, 0); -} -#endif diff --git a/plugins/sudoers/regress/fuzz/fuzz_sudoers.c b/plugins/sudoers/regress/fuzz/fuzz_sudoers.c index edea66462..99f27cc69 100644 --- a/plugins/sudoers/regress/fuzz/fuzz_sudoers.c +++ b/plugins/sudoers/regress/fuzz/fuzz_sudoers.c @@ -97,12 +97,3 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) return 0; } - -#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -int -main(int argc, char *argv[]) -{ - /* Nothing for now. */ - return LLVMFuzzerTestOneInput(NULL, 0); -} -#endif diff --git a/plugins/sudoers/regress/fuzz/fuzz_sudoers_ldif.c b/plugins/sudoers/regress/fuzz/fuzz_sudoers_ldif.c index e1814b1ef..5408df946 100644 --- a/plugins/sudoers/regress/fuzz/fuzz_sudoers_ldif.c +++ b/plugins/sudoers/regress/fuzz/fuzz_sudoers_ldif.c @@ -88,12 +88,3 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) return 0; } - -#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -int -main(int argc, char *argv[]) -{ - /* Nothing for now. */ - return LLVMFuzzerTestOneInput(NULL, 0); -} -#endif