16accb6b24
- 264 license table entries with exact download URLs (224/264 resolved) - Complete sources/ directory with all BitBake recipes - Build configuration: tqma6ul-multi-mba6ulx, spaetzle (musl) - Full traceability for Softwarefreigabeantrag - GCC 13.4.0, Linux 6.6.102, U-Boot 2023.04, musl 1.2.4 - License distribution: GPL-2.0 (24), MIT (23), GPL-2.0+ (18), BSD-3 (16)
117 lines
3.2 KiB
Diff
117 lines
3.2 KiB
Diff
From 4ec9e3d286b6d3e982cb0fc3564dee0bf8d87ede Mon Sep 17 00:00:00 2001
|
|
From: Patrick Griffis <pgriffis@igalia.com>
|
|
Date: Tue, 27 Aug 2024 12:18:58 -0500
|
|
Subject: [PATCH] fuzzing: Cover soup_header_parse_param_list
|
|
|
|
CVE: CVE-2024-52531
|
|
Upstream-Status: Backport
|
|
[https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407/diffs?commit_id=4ec9e3d286b6d3e982cb0fc3564dee0bf8d87ede]
|
|
|
|
Signed-off-by: Changqing Li <changqing.li@windriver.com>
|
|
|
|
---
|
|
fuzzing/fuzz.h | 9 +++++++--
|
|
fuzzing/fuzz_header_parsing.c | 19 +++++++++++++++++++
|
|
fuzzing/fuzz_header_parsing.dict | 8 ++++++++
|
|
fuzzing/meson.build | 2 ++
|
|
4 files changed, 36 insertions(+), 2 deletions(-)
|
|
create mode 100644 fuzzing/fuzz_header_parsing.c
|
|
create mode 100644 fuzzing/fuzz_header_parsing.dict
|
|
|
|
diff --git a/fuzzing/fuzz.h b/fuzzing/fuzz.h
|
|
index 0d380285..f3bd28ee 100644
|
|
--- a/fuzzing/fuzz.h
|
|
+++ b/fuzzing/fuzz.h
|
|
@@ -1,13 +1,14 @@
|
|
#include "libsoup/soup.h"
|
|
|
|
int LLVMFuzzerTestOneInput (const unsigned char *data, size_t size);
|
|
+static int set_logger = 0;
|
|
|
|
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
|
|
static GLogWriterOutput
|
|
empty_logging_func (GLogLevelFlags log_level, const GLogField *fields,
|
|
gsize n_fields, gpointer user_data)
|
|
{
|
|
- return G_LOG_WRITER_HANDLED;
|
|
+ return G_LOG_WRITER_HANDLED;
|
|
}
|
|
#endif
|
|
|
|
@@ -16,6 +17,10 @@ static void
|
|
fuzz_set_logging_func (void)
|
|
{
|
|
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
|
|
- g_log_set_writer_func (empty_logging_func, NULL, NULL);
|
|
+ if (!set_logger)
|
|
+ {
|
|
+ set_logger = 1;
|
|
+ g_log_set_writer_func (empty_logging_func, NULL, NULL);
|
|
+ }
|
|
#endif
|
|
}
|
|
diff --git a/fuzzing/fuzz_header_parsing.c b/fuzzing/fuzz_header_parsing.c
|
|
new file mode 100644
|
|
index 00000000..a8e5c1f9
|
|
--- /dev/null
|
|
+++ b/fuzzing/fuzz_header_parsing.c
|
|
@@ -0,0 +1,19 @@
|
|
+#include "fuzz.h"
|
|
+
|
|
+int
|
|
+LLVMFuzzerTestOneInput (const unsigned char *data, size_t size)
|
|
+{
|
|
+ GHashTable *elements;
|
|
+
|
|
+ // We only accept NUL terminated strings
|
|
+ if (!size || data[size - 1] != '\0')
|
|
+ return 0;
|
|
+
|
|
+ fuzz_set_logging_func ();
|
|
+
|
|
+ elements = soup_header_parse_param_list((char*)data);
|
|
+
|
|
+ g_hash_table_unref(elements);
|
|
+
|
|
+ return 0;
|
|
+}
|
|
\ No newline at end of file
|
|
diff --git a/fuzzing/fuzz_header_parsing.dict b/fuzzing/fuzz_header_parsing.dict
|
|
new file mode 100644
|
|
index 00000000..1562ca3a
|
|
--- /dev/null
|
|
+++ b/fuzzing/fuzz_header_parsing.dict
|
|
@@ -0,0 +1,8 @@
|
|
+"*=UTF-8''"
|
|
+"*=iso-8859-1''"
|
|
+"'"
|
|
+"''"
|
|
+"="
|
|
+"*="
|
|
+"""
|
|
+";"
|
|
\ No newline at end of file
|
|
diff --git a/fuzzing/meson.build b/fuzzing/meson.build
|
|
index b14cbb50..5dd0f417 100644
|
|
--- a/fuzzing/meson.build
|
|
+++ b/fuzzing/meson.build
|
|
@@ -5,6 +5,7 @@ fuzz_targets = [
|
|
'fuzz_cookie_parse',
|
|
'fuzz_content_sniffer',
|
|
'fuzz_date_time',
|
|
+ 'fuzz_header_parsing',
|
|
]
|
|
|
|
fuzzing_args = '-fsanitize=fuzzer,address,undefined'
|
|
@@ -34,6 +35,7 @@ if have_fuzzing and (fuzzing_feature.enabled() or fuzzing_feature.auto())
|
|
'-runs=200000',
|
|
'-artifact_prefix=meson-logs/' + target + '-',
|
|
'-print_final_stats=1',
|
|
+ '-max_len=4096',
|
|
] + extra_args,
|
|
env: [
|
|
'ASAN_OPTIONS=fast_unwind_on_malloc=0',
|
|
--
|
|
2.25.1
|
|
|