From 67d2e1ee4c09ea28a2dae72750a1714f3b8294ef Mon Sep 17 00:00:00 2001 From: Martijn van Beurden Date: Thu, 23 Feb 2023 08:46:44 +0100 Subject: [PATCH] Add fuzzer for metaflac command-line tool --- oss-fuzz/Makefile.am | 28 ++++- oss-fuzz/tool_metaflac.c | 102 ++++++++++++++++++ src/metaflac/main.c | 4 + src/metaflac/operations_shorthand_cuesheet.c | 2 + .../operations_shorthand_vorbiscomment.c | 2 + src/metaflac/usage.c | 1 + src/metaflac/utils.h | 5 + 7 files changed, 143 insertions(+), 1 deletion(-) create mode 100644 oss-fuzz/tool_metaflac.c diff --git a/oss-fuzz/Makefile.am b/oss-fuzz/Makefile.am index 4494a437..ef06486d 100644 --- a/oss-fuzz/Makefile.am +++ b/oss-fuzz/Makefile.am @@ -35,7 +35,7 @@ EXTRA_DIST = \ noinst_PROGRAMS = if USE_OSSFUZZERS -noinst_PROGRAMS += fuzzer_encoder fuzzer_encoder_v2 fuzzer_decoder fuzzer_seek fuzzer_metadata fuzzer_reencoder fuzzer_tool_flac +noinst_PROGRAMS += fuzzer_encoder fuzzer_encoder_v2 fuzzer_decoder fuzzer_seek fuzzer_metadata fuzzer_reencoder fuzzer_tool_flac fuzzer_tool_metaflac endif fuzzer_encoder_SOURCES = encoder.cc @@ -54,6 +54,16 @@ fuzzer_tool_flac_LDADD = \ $(top_builddir)/src/libFLAC/libFLAC.la \ @LTLIBICONV@ \ -lm +fuzzer_tool_metaflac_SOURCES = ${metaflac_SOURCES} empty.cc tool_metaflac.c # empty.cc is to force use of C++ linker, which is mandated by oss-fuzz +fuzzer_tool_metaflac_LDADD = \ + $(top_builddir)/src/share/utf8/libutf8.la \ + $(top_builddir)/src/share/grabbag/libgrabbag.la \ + $(top_builddir)/src/share/getopt/libgetopt.la \ + $(top_builddir)/src/share/replaygain_analysis/libreplaygain_analysis.la \ + $(top_builddir)/src/share/replaygain_synthesis/libreplaygain_synthesis.la \ + $(top_builddir)/src/libFLAC/libFLAC.la \ + @LTLIBICONV@ \ + -lm flac_libs = \ $(top_builddir)/src/libFLAC/libFLAC-static.la \ @@ -76,3 +86,19 @@ flac_SOURCES = \ ${top_builddir}/src/flac/local_string_utils.h \ ${top_builddir}/src/flac/utils.h \ ${top_builddir}/src/flac/vorbiscomment.h + +metaflac_SOURCES = \ + ${top_builddir}/src/metaflac/operations.c \ + ${top_builddir}/src/metaflac/operations_shorthand_cuesheet.c \ + ${top_builddir}/src/metaflac/operations_shorthand_picture.c \ + ${top_builddir}/src/metaflac/operations_shorthand_seektable.c \ + ${top_builddir}/src/metaflac/operations_shorthand_streaminfo.c \ + ${top_builddir}/src/metaflac/operations_shorthand_vorbiscomment.c \ + ${top_builddir}/src/metaflac/options.c \ + ${top_builddir}/src/metaflac/usage.c \ + ${top_builddir}/src/metaflac/utils.c \ + ${top_builddir}/src/metaflac/operations.h \ + ${top_builddir}/src/metaflac/operations_shorthand.h \ + ${top_builddir}/src/metaflac/options.h \ + ${top_builddir}/src/metaflac/usage.h \ + ${top_builddir}/src/metaflac/utils.h diff --git a/oss-fuzz/tool_metaflac.c b/oss-fuzz/tool_metaflac.c new file mode 100644 index 00000000..a2941b3a --- /dev/null +++ b/oss-fuzz/tool_metaflac.c @@ -0,0 +1,102 @@ +/* fuzzer_tool_flac + * Copyright (C) 2023 Xiph.Org Foundation + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * - Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * - Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * - Neither the name of the Xiph.org Foundation nor the names of its + * contributors may be used to endorse or promote products derived from + * this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#include +#include +#include /* for memcpy */ +#define FUZZ_TOOL_METAFLAC +#define fprintf(...) +#define printf(...) +#include "../src/metaflac/main.c" +#include "common.h" + +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size); + +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + size_t size_left = size; + size_t arglen; + char * argv[64]; + char exename[] = "metaflac"; + char filename[] = "/tmp/fuzzXXXXXX"; + int numarg = 0, maxarg; + int file_to_fuzz; + int tmp_stderr, tmp_stdout; + fpos_t pos_stderr, pos_stdout; + + share__opterr = 0; + share__optind = 0; + + + if(size < 2) + return 0; + + maxarg = data[0] & 16; + size_left--; + + argv[0] = exename; + numarg++; + + /* Check whether input is zero delimited */ + while((arglen = strnlen((char *)data+(size-size_left),size_left)) < size_left && numarg < maxarg) { + argv[numarg++] = (char *)data+(size-size_left); + size_left -= arglen + 1; + } + + file_to_fuzz = mkstemp(filename); + + if (file_to_fuzz < 0) + abort(); + write(file_to_fuzz,data+(size-size_left),size_left); + close(file_to_fuzz); + + argv[numarg++] = filename; + + /* redirect stderr and stdout */ + fflush(stdout); + fgetpos(stdout,&pos_stdout); + tmp_stdout = dup(fileno(stdout)); + freopen("/dev/null","w",stdout); + + main_to_fuzz(numarg,argv); + + /* restore stderr and stdout */ + fflush(stdout); + dup2(tmp_stdout, fileno(stdout)); + close(tmp_stdout); + clearerr(stdout); + fsetpos(stdout,&pos_stdout); + + unlink(filename); + + return 0; +} + diff --git a/src/metaflac/main.c b/src/metaflac/main.c index cd488e7c..210c3b0d 100644 --- a/src/metaflac/main.c +++ b/src/metaflac/main.c @@ -28,7 +28,11 @@ #include #include "share/compat.h" +#ifndef FUZZ_TOOL_METAFLAC int main(int argc, char *argv[]) +#else +static int main_to_fuzz(int argc, char *argv[]) +#endif { CommandLineOptions options; int ret = 0; diff --git a/src/metaflac/operations_shorthand_cuesheet.c b/src/metaflac/operations_shorthand_cuesheet.c index 72154efb..2e500502 100644 --- a/src/metaflac/operations_shorthand_cuesheet.c +++ b/src/metaflac/operations_shorthand_cuesheet.c @@ -122,9 +122,11 @@ FLAC__bool import_cs_from(const char *filename, FLAC__StreamMetadata **cuesheet, flac_fprintf(stderr, "%s: ERROR: empty import file name\n", filename); return false; } +#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION if(0 == strcmp(cs_filename, "-")) f = stdin; else +#endif f = flac_fopen(cs_filename, "r"); if(0 == f) { diff --git a/src/metaflac/operations_shorthand_vorbiscomment.c b/src/metaflac/operations_shorthand_vorbiscomment.c index bf135d4b..c690fddf 100644 --- a/src/metaflac/operations_shorthand_vorbiscomment.c +++ b/src/metaflac/operations_shorthand_vorbiscomment.c @@ -347,9 +347,11 @@ FLAC__bool import_vc_from(const char *filename, FLAC__StreamMetadata *block, con flac_fprintf(stderr, "%s: ERROR: empty import file name\n", filename); return false; } +#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION if(0 == strcmp(vc_filename->value, "-")) f = stdin; else +#endif f = flac_fopen(vc_filename->value, "r"); if(0 == f) { diff --git a/src/metaflac/usage.c b/src/metaflac/usage.c index 62c2f1a8..d352d0b8 100644 --- a/src/metaflac/usage.c +++ b/src/metaflac/usage.c @@ -21,6 +21,7 @@ # include #endif +#include "utils.h" #include "usage.h" #include "FLAC/format.h" #include diff --git a/src/metaflac/utils.h b/src/metaflac/utils.h index 41c395be..cd2dfe4e 100644 --- a/src/metaflac/utils.h +++ b/src/metaflac/utils.h @@ -23,6 +23,11 @@ #include "FLAC/metadata.h" #include /* for FILE */ +#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION +#undef stderr +#define stderr stdout +#endif + void die(const char *message); #ifdef FLAC__VALGRIND_TESTING size_t local_fwrite(const void *ptr, size_t size, size_t nmemb, FILE *stream);