mirror of
https://github.com/microsoft/onefuzz.git
synced 2025-06-17 12:28:07 +00:00
Move integration test artifacts into primary source tree (#336)
This commit is contained in:
9
src/integration-tests/libfuzzer-rust/Cargo.toml
Normal file
9
src/integration-tests/libfuzzer-rust/Cargo.toml
Normal file
@ -0,0 +1,9 @@
|
||||
[package]
|
||||
name = "rust_fuzz_example"
|
||||
version = "0.1.0"
|
||||
license = "MIT"
|
||||
authors = ["<fuzzing@microsoft.com>"]
|
||||
edition = "2018"
|
||||
|
||||
[dependencies]
|
||||
libc = "0.2.79"
|
10
src/integration-tests/libfuzzer-rust/Makefile
Normal file
10
src/integration-tests/libfuzzer-rust/Makefile
Normal file
@ -0,0 +1,10 @@
|
||||
.PHONY: all clean
|
||||
|
||||
all:
|
||||
rustup install nightly
|
||||
cargo install cargo-fuzz
|
||||
cargo +nightly fuzz build --release
|
||||
|
||||
clean:
|
||||
cargo clean
|
||||
(cd fuzz; cargo clean)
|
22
src/integration-tests/libfuzzer-rust/README.md
Normal file
22
src/integration-tests/libfuzzer-rust/README.md
Normal file
@ -0,0 +1,22 @@
|
||||
# Fuzzing Rust in OneFuzz
|
||||
|
||||
OneFuzz can orchastrate fuzzing of Rust using
|
||||
[cargo-fuzz](https://crates.io/crates/cargo-fuzz) to build libfuzzer based
|
||||
fuzzing targets.
|
||||
|
||||
Included in this directory is a simple example to demonstrate rust based
|
||||
fuzzing. For more examples, check out the libfuzzer examples in the [rust
|
||||
fuzzing trophy case](https://github.com/rust-fuzz/trophy-case).
|
||||
|
||||
## Example command
|
||||
|
||||
```bash
|
||||
# ensure the latest cargo-fuzz is installed
|
||||
cargo install cargo-fuzz --force
|
||||
# build your fuzzing targets
|
||||
cargo +nightly fuzz build --release
|
||||
# Launch a fuzz job for each of the targets provided by cargo-fuzz
|
||||
for target in $(cargo fuzz list); do
|
||||
onefuzz template libfuzzer basic $PROJECT_NAME $target $BUILD_NUMBER $POOL_NAME --target_exe ./fuzz/target/x86_64-unknown-linux-gnu/release/$target --inputs ./fuzz/corpus/$target
|
||||
done
|
||||
```
|
3
src/integration-tests/libfuzzer-rust/fuzz/.gitignore
vendored
Normal file
3
src/integration-tests/libfuzzer-rust/fuzz/.gitignore
vendored
Normal file
@ -0,0 +1,3 @@
|
||||
target
|
||||
corpus
|
||||
artifacts
|
25
src/integration-tests/libfuzzer-rust/fuzz/Cargo.toml
Normal file
25
src/integration-tests/libfuzzer-rust/fuzz/Cargo.toml
Normal file
@ -0,0 +1,25 @@
|
||||
[package]
|
||||
name = "rust-fuzz"
|
||||
version = "0.0.0"
|
||||
authors = ["Automatically generated"]
|
||||
publish = false
|
||||
edition = "2018"
|
||||
|
||||
[package.metadata]
|
||||
cargo-fuzz = true
|
||||
|
||||
[dependencies]
|
||||
libfuzzer-sys = "0.3"
|
||||
|
||||
[dependencies.rust_fuzz_example]
|
||||
path = ".."
|
||||
|
||||
# Prevent this from interfering with workspaces
|
||||
[workspace]
|
||||
members = ["."]
|
||||
|
||||
[[bin]]
|
||||
name = "fuzz_target_1"
|
||||
path = "fuzz_targets/fuzz_target_1.rs"
|
||||
test = false
|
||||
doc = false
|
@ -0,0 +1,7 @@
|
||||
#![no_main]
|
||||
use libfuzzer_sys::fuzz_target;
|
||||
use rust_fuzz_example;
|
||||
|
||||
fuzz_target!(|data: &[u8]| {
|
||||
rust_fuzz_example::check(data);
|
||||
});
|
34
src/integration-tests/libfuzzer-rust/src/lib.rs
Normal file
34
src/integration-tests/libfuzzer-rust/src/lib.rs
Normal file
@ -0,0 +1,34 @@
|
||||
// Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
// Licensed under the MIT License.
|
||||
|
||||
extern crate libc;
|
||||
|
||||
pub fn check(data: &[u8]) -> bool {
|
||||
if data.len() < 4 {
|
||||
return false;
|
||||
}
|
||||
|
||||
if data[0] != 0x41 {
|
||||
return false;
|
||||
}
|
||||
|
||||
if data[1] != 0x42 {
|
||||
return false;
|
||||
}
|
||||
|
||||
if data[2] != 0x43 {
|
||||
return false;
|
||||
}
|
||||
|
||||
match data[3] {
|
||||
// OOB access
|
||||
4 => data[100000] == 0xFF,
|
||||
// null ptr
|
||||
5 => unsafe {
|
||||
let ptr: *mut u8 = 0 as *mut u8;
|
||||
*ptr = 10;
|
||||
true
|
||||
},
|
||||
_ => false,
|
||||
}
|
||||
}
|
Reference in New Issue
Block a user