opened
catenacyber
username_0
This fuzz harness reuses code from test.c (for the input format)
There are some fixes to it to avoid overflows with some invalid inputs

I used `htp_config_set_server_personality(cfg, HTP_SERVER_IDS)` to maximize coverage.

I think that the build system for this can be improved (there is a specific target test_fuzz to build a standalone tool, which is not included during the main build)
Integration with oss-fuzz
issue
created
victorjulien
username_1
Hi Philippe, thanks for looking into this. I just had a brief look now. Can this also be run with afl?
comment
created
catenacyber
username_0
oss-fuzz currently uses libfuzzer and afl :-)

And you can use this harness to run with afl using the binary `test_fuzz`that is now compiled with `make check`
comment
created
victorjulien
username_1
I've tried getting it to work with afl this weekend, and it works indeed. However I was unable to compile the tests with ASAN enabled. Have you been able to get that working?

I tried both afl-gcc and afl-clang-fast.
comment
created
victorjulien
username_1
This is the error i get
<pre>
[+] Instrumented 514 locations (64-bit, hardened mode, ratio 100%).
/bin/bash ../libtool  --tag=CXX   --mode=link afl-g++  -g -O2   -o test_all test_bstr.o test_gunzip.o test_hybrid.o test_main.o test_multipart.o test.o test_utils.o test_bench.o libgtest.a -lpthread ../htp/libhtp.la -lz   -lz 
libtool: link: afl-g++ -g -O2 -o .libs/test_all test_bstr.o test_gunzip.o test_hybrid.o test_main.o test_multipart.o test.o test_utils.o test_bench.o  libgtest.a -lpthread ../htp/.libs/libhtp.so -lz
afl-cc 2.52b by <lcamtuf@google.com>
/usr/bin/ld: test.o: undefined reference to symbol '__asan_stack_malloc_5'
//usr/lib/x86_64-linux-gnu/libasan.so.4: error adding symbols: DSO missing from command line
collect2: error: ld returned 1 exit status
Makefile:629: recipe for target 'test_all' failed
make[2]: *** [test_all] Error 1
</pre>
comment
created
victorjulien
username_1
Don't know what I did, but it works w/o modification now. So I've merged this as is. Thanks a lot Philippe!
comment
created
catenacyber
username_0
Great, let's now wait for the merge in oss-fuzz
comment
created
catenacyber
username_0
And the first benign integer overflow is when you get `Host: www.example.com:555555555555555555555555555555`

The patch should be something like this : checking overflow before doing the operation in `bstr_util_mem_to_pint` :
```
if (((LLONG_MAX - d) / base) < rval) {
                 // Overflow
                 return -2;
             }
```

See as well
https://wiki.sei.cmu.edu/confluence/display/c/INT32-C.+Ensure+that+operations+on+signed+integers+do+not+result+in+overflow
comment