libmicrohttpd

HTTP/1.x server C library (MHD 1.x, stable)
Log | Files | Refs | Submodules | README | LICENSE

project.yaml (3027B)

      1 #
      2 # OSS-Fuzz project configuration for GNU libmicrohttpd.
      3 #
      4 # This file should become projects/libmicrohttpd/project.yaml in the
      5 # google/oss-fuzz repository. 
      6 #
      7 
      8 homepage: "https://www.gnu.org/software/libmicrohttpd/"
      9 main_repo: "https://git.gnunet.org/libmicrohttpd.git"
     10 
     11 language: c
     12 primary_contact: "grothoff@gmail.com"
     13 
     14 # address:   the primary target.  The bug class that motivated this work
     15 #            (commit 5a73c1ae, a stack buffer overflow in the digest-auth hex
     16 #            decoder) is exactly what ASan catches, and the harnesses are
     17 #            written for it: every output buffer in fuzz_str and
     18 #            fuzz_auth_header is an exactly-sized heap allocation so that the
     19 #            ASan redzone traps a single-byte overrun.
     20 # undefined: MHD's parsers do a lot of pointer arithmetic and integer width
     21 #            juggling on attacker-controlled lengths (the read-buffer
     22 #            shift-back underflow of 29eaa56b is of that family).  UBSan is
     23 #            cheap and catches those before they become memory errors.
     24 # memory:    usable here only because build.sh configures --disable-https and
     25 #            --disable-curl, which leaves libc and libpthread as the only
     26 #            external dependencies; there is no uninstrumented third-party
     27 #            library to poison the results.  MSan finds the use of
     28 #            uninitialised parser state that ASan cannot see.
     29 sanitizers:
     30   - address
     31   - undefined
     32   - memory
     33 
     34 # i386 matters for MHD because the severity of several of the length bugs
     35 # this suite found depends on the word size (see TESTING.md section P3):
     36 # a size_t underflow that is merely a huge number on x86_64 can be a
     37 # wrap-around on a 32 bit target.
     38 #
     39 # Verified locally: the whole library and all harnesses build with -m32,
     40 # and the entire committed corpus, including every corpus/known-findings/
     41 # reproducer, replays clean on the 32 bit targets.  Note that OSS-Fuzz
     42 # runs i386 only with the address sanitizer under libFuzzer.
     43 #
     44 # One i386 quirk is handled in build.sh rather than here: a -m32 PIE
     45 # linked against any sanitizer runtime dies with SEGV at address 0 before
     46 # main() on current Linux/clang, so the local default adds -no-pie.
     47 architectures:
     48   - x86_64
     49   - i386
     50 
     51 # The harnesses are plain LLVMFuzzerTestOneInput() targets with no engine
     52 # specific code, so every in-process engine works.  All three listed here
     53 # have been built and driven against the targets locally -- see section 4
     54 # of the README for the exact recipe -- rather than merely assumed to
     55 # work; an engine that is claimed but broken shows up as a dead target on
     56 # the OSS-Fuzz dashboard, not as an error anyone notices.
     57 #
     58 # "centipede" is deliberately not listed: it is supported by OSS-Fuzz but
     59 # has not been tried against these targets.  Do not add it without
     60 # building and running it first.
     61 fuzzing_engines:
     62   - libfuzzer
     63   - afl
     64   - honggfuzz
     65 
     66 # Documentation a triager should read before filing/handling a report.
     67 help_url: "https://git.gnunet.org/libmicrohttpd.git/tree/src/fuzz/README"
     68