aboutsummaryrefslogtreecommitdiff
path: root/fuzz
AgeCommit message (Collapse)AuthorFilesLines
2016-09-27Refresh fuzzer corpus.David Benjamin154-0/+0
We've switched to the version extension, so refresh the corpus. Change-Id: Ic50f58bd83d62dccae26063c9ea2d4a2c799da1f Reviewed-on: https://boringssl-review.googlesource.com/11326 Reviewed-by: Adam Langley <agl@google.com>
2016-09-22Refresh TLS fuzzer corpora.David Benjamin475-0/+0
This was done by first minimizing the existing set and then merging in a fresh recording from runner. Glancing through LCOV output does not reveal anything anomolous. Fuzzer mode seems to be working as expected. Change-Id: Ife0959a5e16e3c7e2e5a2deb0c32539ff2bc740b Reviewed-on: https://boringssl-review.googlesource.com/11229 Reviewed-by: Adam Langley <agl@google.com>
2016-09-22Enable more features in the fuzzers.David Benjamin2-1/+288
Also IWYU the headers. BUG=79 Change-Id: Iafee0444c9979496166885db6ba5009cb597cb4d Reviewed-on: https://boringssl-review.googlesource.com/11225 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-09-21Start fuzzing the TLS 1.3 code.David Benjamin155-0/+2
Corpus recorded from runner and merged into existing corpus with libFuzzer's -merge flag. BUG=79 Change-Id: I986a50976ffef141b63e31de3a81fdb4ed5c1348 Reviewed-on: https://boringssl-review.googlesource.com/11130 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2016-08-11Update fuzzing corpus for ‘server’Adam Langley394-8/+0
Change-Id: I95e75708fb758265a28e775025ad748ac505770e
2016-05-26Replace base64 decoding.Adam Langley121-0/+802
This code has caused a long history of problems. This change rewrites it completely with something that is, hopefully, much simplier and robust and adds more testing. Change-Id: Ibeef51f9386afd95d5b73316e451eb3a2d7ec4e0 Reviewed-on: https://boringssl-review.googlesource.com/8033 Reviewed-by: Adam Langley <agl@google.com>
2016-04-25Add standalone PKCS#8 and SPKI fuzzers.David Benjamin26-0/+94
We already had coverage for our new EVP_PKEY parsers, but it's good to have some that cover them directly. The initial corpus was generated manually with der-ascii and should cover most of the insanity around EC key serialization. BUG=15 Change-Id: I7aaf56876680bfd5a89f5e365c5052eee03ba862 Reviewed-on: https://boringssl-review.googlesource.com/7728 Reviewed-by: Adam Langley <agl@google.com>
2016-04-25Add licenses to fuzz tests.Adam Langley5-0/+70
These source files previously didn't have the ISC license on them. Change-Id: Ic0a2047d23b28d9d7f0a85b2fedb67574bdcab25 Reviewed-on: https://boringssl-review.googlesource.com/7735 Reviewed-by: David Benjamin <davidben@google.com>
2016-04-12Remove .options files for libFuzzers and update FUZZING.md documentation.Max Moroz4-8/+0
Due to https://codereview.chromium.org/1867833002/ replacing .options files. Change-Id: I17f0d5b8b1784fdcf163791e72f6b58b29657e95 Reviewed-on: https://boringssl-review.googlesource.com/7640 Reviewed-by: David Benjamin <davidben@google.com>
2016-03-31Also re-serialize X509 objects in fuzz/cert.cc.David Benjamin1-1/+7
This is a fairly common operation on an X509. Change-Id: I1820f20b555f75c98ab7e3283b5530bc1c200e2a Reviewed-on: https://boringssl-review.googlesource.com/7611 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-03-31Remove inaccurate comments in fuzz/{client,server}.cc.David Benjamin2-2/+0
They now fuzz a lot more than just the initial flow. Change-Id: Ib0b7eb66969442e539a937d7d87f5ba031fcbef3 Reviewed-on: https://boringssl-review.googlesource.com/7610 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-03-22Update FUZZING documentation about max_len.David Benjamin4-0/+8
Maintain the max_len values in foo.options files which ClusterFuzz can process. Also recompute the recommended client and server lengths as they've since gotten much more extensive. Change-Id: Ie87a80d8a4a0c41e215f0537c8ccf82b38c4de09 Reviewed-on: https://boringssl-review.googlesource.com/7509 Reviewed-by: Mike Aizatsky <aizatsky@chromium.org> Reviewed-by: David Benjamin <davidben@google.com>
2016-03-21Tweak FUZZING.md and minimise_corpuses.sh.David Benjamin1-2/+1
Change-Id: If312ce3783bcc39ebd2047470251334aa0897d3d Reviewed-on: https://boringssl-review.googlesource.com/7508 Reviewed-by: David Benjamin <davidben@google.com>
2016-03-04Regenerate server_corpus and client_corpus.David Benjamin414-0/+0
Now that client.cc and server.cc run through application data, regenerate the corpus. Change-Id: I8278ebfe47fd2ba74f67db6f9b545aabf9fd1f84 Reviewed-on: https://boringssl-review.googlesource.com/7301 Reviewed-by: Adam Langley <agl@google.com>
2016-03-04Enable renegotiation in the client fuzzer and read app data.David Benjamin2-2/+19
As long as the HTTP/1.1 client auth hack forces use to support renego, having it on seems much more useful than having it off for fuzzing purposes. Also read app data to exercise that code and, on the client, trigger renegotiations as needed. Change-Id: I1941ded6ec9bd764abd199d1518420a1075ed1b2 Reviewed-on: https://boringssl-review.googlesource.com/7291 Reviewed-by: Adam Langley <agl@google.com>
2016-03-04Add an option to pick a different build directory in minimise_corpuses.sh.David Benjamin1-5/+13
Also pass set -e instead of chaining things with &&. (One line was missing the &&.) Change-Id: Ia04e7f40f46688c9664101efefef1d1ea069de71 Reviewed-on: https://boringssl-review.googlesource.com/7300 Reviewed-by: Adam Langley <agl@google.com>
2016-03-03Update fuzzing corpuses.Adam Langley1732-26/+23
This results from running the fuzzers for a little while with both the 8bit-counters change and after taking the transcripts from the runner tests as seeds for the `client` and `server` fuzzers. Change-Id: I545a89d8dccd7ef69dd97546ed61610eea4a27a3 Reviewed-on: https://boringssl-review.googlesource.com/7276 Reviewed-by: David Benjamin <davidben@google.com>
2016-03-03Add a deterministic PRNG for fuzzing.David Benjamin2-0/+6
If running the stack through a fuzzer, we would like execution to be completely deterministic. This is gated on a BORINGSSL_UNSAFE_FUZZER_MODE #ifdef. For now, this just uses the zero ChaCha20 key and a global counter. As needed, we can extend this to a thread-local counter and a separate ChaCha20 stream and counter per input length. Change-Id: Ic6c9d8a25e70d68e5dc6804e2c234faf48e51395 Reviewed-on: https://boringssl-review.googlesource.com/7286 Reviewed-by: Adam Langley <agl@google.com>
2016-02-18Have fuzz/cert.cc also call X509_get_pubkey.David Benjamin1-1/+6
crypto/x509 parses the SPKI on-demand, so we weren't actually exercising the SPKI code. Change-Id: I2e16045bd35dbe04d4b8d8b45939c8885e09a550 Reviewed-on: https://boringssl-review.googlesource.com/7161 Reviewed-by: Adam Langley <agl@google.com>
2015-12-22Update the fuzz tests for the server.Adam Langley176-0/+5
These seeds are the result of spending more CPU time fuzzing the server. Change-Id: Iacf889ae6e214056033f4a5f9f3b89e4710c22a5
2015-11-10Add four, basic fuzz tests.Adam Langley601-0/+381
This change adds fuzzing tests for: ∙ Certificate parsing ∙ Private key parsing ∙ ClientHello parsing ∙ Server first flow (ServerHello, Certificate, etc) parsing. Change-Id: I5f53282263eaaff69b1a03c819cca73750433653 Reviewed-on: https://boringssl-review.googlesource.com/6460 Reviewed-by: Adam Langley <agl@google.com>
generated by cgit v1.1 at 2024-08-05 01:40:30 +0000