From 8f5053c6260bfe54b85ce76b3c47bccfadfd831a Mon Sep 17 00:00:00 2001 From: Patrick Georgi Date: Sun, 9 Aug 2015 18:30:44 +0200 Subject: [PATCH] util/fuzz-tests: Add fuzzer for jpeg decoder Mostly a proof of concept for adding fuzzing to our tree. Change-Id: I10e5ef3a426b9c74c288d7232a6d11a1ca59833b Signed-off-by: Patrick Georgi Reviewed-on: http://review.coreboot.org/12183 Tested-by: build bot (Jenkins) Reviewed-by: Martin Roth --- util/fuzz-tests/Makefile | 5 ++ util/fuzz-tests/README | 11 ++++ util/fuzz-tests/jpeg-test-cases/coreboot.jpg | Bin 0 -> 711 bytes .../fuzz-tests/jpeg-test-cases/coreboot_2.jpg | Bin 0 -> 285 bytes util/fuzz-tests/jpeg-test.c | 53 ++++++++++++++++++ 5 files changed, 69 insertions(+) create mode 100644 util/fuzz-tests/Makefile create mode 100644 util/fuzz-tests/README create mode 100644 util/fuzz-tests/jpeg-test-cases/coreboot.jpg create mode 100644 util/fuzz-tests/jpeg-test-cases/coreboot_2.jpg create mode 100644 util/fuzz-tests/jpeg-test.c diff --git a/util/fuzz-tests/Makefile b/util/fuzz-tests/Makefile new file mode 100644 index 0000000000..e97643f333 --- /dev/null +++ b/util/fuzz-tests/Makefile @@ -0,0 +1,5 @@ +all: + afl-gcc -g -m32 -I ../../src/lib -o jpeg-test jpeg-test.c ../../src/lib/jpeg.c + +run: + afl-fuzz -i jpeg-test-cases -o jpeg-results ./jpeg-test @@ diff --git a/util/fuzz-tests/README b/util/fuzz-tests/README new file mode 100644 index 0000000000..52777f818b --- /dev/null +++ b/util/fuzz-tests/README @@ -0,0 +1,11 @@ +Fuzz tests +========== +make run (with afl-fuzz installed) takes a real long time and creates test +cases in jpeg-results/ that crash the jpeg code. + +These test cases can then be used to gdb the test app and dig into the +decoder to fix the issues. + +This is mostly a proof of concept because the jpeg code isn't used very often +(only for splash screens). However there are other regions in coreboot that +could benefit from similar treatment. diff --git a/util/fuzz-tests/jpeg-test-cases/coreboot.jpg b/util/fuzz-tests/jpeg-test-cases/coreboot.jpg new file mode 100644 index 0000000000000000000000000000000000000000..018a3f093e465d1bb2dc0ed61e65f866f025d793 GIT binary patch literal 711 zcmeH@%MHRX42FN>62(c{IxQ@~1Z)5jQYF}reK;@#j|(HPK}fijp15(~i)1CA{D_<` z=>a_q`vF9Ra**!WfoFvhIa8UcV2zm@vCfGVaiI;)H(sQUbFOH1~$Ul&5gS2FLAq!2k8T I8{l+(0b4L0#Q*>R literal 0 HcmV?d00001 diff --git a/util/fuzz-tests/jpeg-test-cases/coreboot_2.jpg b/util/fuzz-tests/jpeg-test-cases/coreboot_2.jpg new file mode 100644 index 0000000000000000000000000000000000000000..8f57a221db5c279c328ae9f06497bf36b09b0fa1 GIT binary patch literal 285 zcmb7;%MHRX42FN#C5n@@by`?}MLxD&zZPZ}y&s#Gy$>X&dWAD~IPbaK-@&yV!~g&Q literal 0 HcmV?d00001 diff --git a/util/fuzz-tests/jpeg-test.c b/util/fuzz-tests/jpeg-test.c new file mode 100644 index 0000000000..2be3e65b44 --- /dev/null +++ b/util/fuzz-tests/jpeg-test.c @@ -0,0 +1,53 @@ +/* + * This file is part of the coreboot project. + * + * Copyright 2015 Google Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; version 2 of the License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc. + */ + +#include +#include +#include "jpeg.h" + +const int depth = 16; + +int main(int argc, char **argv) +{ + FILE *f = fopen(argv[1], "rb"); + unsigned long len; + + if (!f) + return 1; + if (fseek(f, 0, SEEK_END) != 0) + return 1; + len = ftell(f); + if (fseek(f, 0, SEEK_SET) != 0) + return 1; + + char *buf = malloc(len); + struct jpeg_decdata *decdata = malloc(sizeof(*decdata)); + if (fread(buf, len, 1, f) != 1) + return 1; + fclose(f); + + int width; + int height; + jpeg_fetch_size(buf, &width, &height); + //printf("width: %d, height: %d\n", width, height); + char *pic = malloc(depth / 8 * width * height); + int ret = jpeg_decode(buf, pic, width, height, depth, decdata); + //printf("ret: %x\n", ret); + return ret; +}