Merge branch 'master' of github.com:sctplab/usrsctp

Author: tuexen

CMakeLists.txt

@@ -259,8 +259,9 @@ elseif (CMAKE_C_COMPILER_ID MATCHES "Clang" OR CMAKE_C_COMPILER_ID MATCHES "Appl
 	endif ()
 
 	if (sctp_build_fuzzer)
+		set(CMAKE_BUILD_TYPE "DEBUG")
 		add_definitions(-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
-		set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fsanitize=fuzzer-no-link")
+		set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -O1 -fsanitize=fuzzer-no-link")
 	endif ()
 endif ()
 

fuzzer/CORPUS_CONNECT/addip-000000

@@ -41,7 +41,7 @@ pwd
 find . -iwholename '*cmake*' -not -name CMakeLists.txt -delete
 
 # Build with ASAN / MSAN
-cmake -Dsctp_build_fuzzer=1 -Dsctp_build_programs=0 -Dsctp_invariants=1 -Dsctp_sanitizer_address=1 -DCMAKE_LINKER="$CC" -DCMAKE_C_COMPILER="$CC" -DCMAKE_BUILD_TYPE=Debug .
-#cmake -Dsctp_build_fuzzer=1 -Dsctp_build_programs=0 -Dsctp_invariants=1 -Dsctp_sanitizer_memory=1 -DCMAKE_LINKER="$CC" -DCMAKE_C_COMPILER="$CC" -DCMAKE_BUILD_TYPE=RelWithDebInfo .
+cmake -Dsctp_build_fuzzer=1 -Dsctp_build_programs=0 -Dsctp_invariants=1 -Dsctp_sanitizer_address=1 -DCMAKE_LINKER="$CC" -DCMAKE_C_COMPILER="$CC" .
+#cmake -Dsctp_build_fuzzer=1 -Dsctp_build_programs=0 -Dsctp_invariants=1 -Dsctp_sanitizer_memory=1 -DCMAKE_LINKER="$CC" -DCMAKE_C_COMPILER="$CC" .
 
 make -j"$NPROC"

fuzzer/CORPUS_CONNECT/addip-000001

@@ -18,7 +18,7 @@ echo "########## Beginning Fuzzer Chain"
 echo ""
 
 set +e
-./fuzzer_connect_multi_verbose -timeout=30 $1 > $1.log 2>&1
+./fuzzer_connect_multi_verbose -timeout=10 $1 > $1.log 2>&1
 FUZZER_RETVAL=$?
 set -e
 

fuzzer/CORPUS_CONNECT/addip-000002

@@ -5,7 +5,6 @@
 import re
 
 reportdir = "reports/"
-fuzzer = "./fuzzer_connect_multi"
 
 class bcolors:
 	HEADER = '\033[95m'

fuzzer/CORPUS_CONNECT/addip-000003

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-export ASAN_OPTIONS=abort_on_error=1:disable_core=0:unmap_shadow_on_exit=1:disable_coredump=0:detect_leaks=1
+#export ASAN_OPTIONS=abort_on_error=1:disable_core=0:unmap_shadow_on_exit=1:disable_coredump=0:detect_leaks=1
 ulimit -c unlimited
 mkdir -p CORPUS_CONNECT
 
@@ -19,4 +19,4 @@ fi
 echo "$NPROC"
 
 
-./fuzzer_connect_multi -jobs=64 -timeout=10 -max_len=32000 CORPUS_CONNECT
+./fuzzer_connect_multi -jobs=64 -timeout=10 -max_len=32000 -use_value_profile=1 CORPUS_CONNECT

fuzzer/CORPUS_CONNECT/addip-000004

@@ -52,10 +52,24 @@ void
 debug_printf_stack(const char *format, ...)
 {
 	va_list ap;
+	char charbuf[1024];
+	static struct timeval time_main;
+	struct timeval time_now;
+	struct timeval time_delta;
+
+	if (time_main.tv_sec == 0  && time_main.tv_usec == 0) {
+		gettimeofday(&time_main, NULL);
+	}
+
+	gettimeofday(&time_now, NULL);
+	timersub(&time_now, &time_main, &time_delta);
 
 	va_start(ap, format);
-	vprintf(format, ap);
+	//vfprintf(stderr, format, ap);
+	vsnprintf(charbuf, 1024, format, ap);
 	va_end(ap);
+
+	fprintf(stderr, "[S][%u.%03u] %s", (unsigned int) time_delta.tv_sec, (unsigned int) time_delta.tv_usec / 1000, charbuf);
 }
 
 static void

fuzzer/CORPUS_CONNECT/addip-000005

@@ -43,6 +43,8 @@ set(includedir 				${prefix}/include/usrsctp)
 set(CMAKE_REQUIRED_INCLUDES ${CMAKE_CURRENT_SOURCE_DIR})
 set(CMAKE_MACOSX_RPATH 		1)
 
+include(CheckCCompilerFlag)
+
 add_definitions(-D__Userspace__)
 add_definitions(-D__Userspace_os_${CMAKE_SYSTEM_NAME})
 add_definitions(-DSCTP_SIMPLE_ALLOCATOR)
@@ -53,11 +55,16 @@ add_definitions(-DSCTP_PROCESS_LEVEL_LOCKS)
 # OS DEPENDENT
 #################################################
 
-check_c_compiler_flag(-Wno-address-of-packed-member has_wno_address_of_packet_member)
-if (has_wno_address_of_packet_member)
+check_c_compiler_flag(-Wno-address-of-packed-member has_wno_address_of_packed_member)
+if (has_wno_address_of_packed_member)
 	set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-address-of-packed-member")
 endif ()
 
+check_c_compiler_flag(-Wno-deprecated-declarations has_wno_deprecated_declarations)
+if (has_wno_deprecated_declarations)
+	set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-deprecated-declarations")
+endif ()
+
 if (CMAKE_SYSTEM_NAME MATCHES "Linux")
 	add_definitions(-D_GNU_SOURCE)
 endif ()
@@ -69,7 +76,6 @@ endif ()
 if (CMAKE_SYSTEM_NAME MATCHES "Darwin")
 	add_definitions(-U__APPLE__)
 	add_definitions(-D__APPLE_USE_RFC_2292)
-	set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-deprecated-declarations")
 endif ()
 
 if (CMAKE_SYSTEM_NAME MATCHES "DragonFly")

fuzzer/CORPUS_CONNECT/addip-000006

@@ -1650,6 +1650,11 @@ sctp_handle_auth(struct sctp_tcb *stcb, struct sctp_auth_chunk *auth,
 		"SCTP AUTH Chunk: shared key %u, HMAC id %u\n",
 		shared_key_id, hmac_id);
 
+#if defined(__Userspace__)
+#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+	return (0);
+#endif
+#endif
 	/* is the indicated HMAC supported? */
 	if (!sctp_auth_is_supported_hmac(stcb->asoc.local_hmacs, hmac_id)) {
 		struct mbuf *op_err;
@@ -1730,11 +1735,6 @@ sctp_handle_auth(struct sctp_tcb *stcb, struct sctp_auth_chunk *auth,
 	(void)sctp_compute_hmac_m(hmac_id, stcb->asoc.authinfo.recv_key,
 	    m, offset, computed_digest);
 
-#if defined(__Userspace__)
-#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
-	return (0);
-#endif
-#endif
 	/* compare the computed digest with the one in the AUTH chunk */
 	if (timingsafe_bcmp(digest, computed_digest, digestlen) != 0) {
 		SCTP_STAT_INCR(sctps_recvauthfailed);

fuzzer/CORPUS_CONNECT/addip-000007

@@ -203,6 +203,8 @@ sctp_startup_iterator(void)
 #elif defined(__Userspace__)
 	if (sctp_userspace_thread_create(&sctp_it_ctl.thread_proc, &sctp_iterator_thread)) {
 		SCTP_PRINTF("ERROR: Creating sctp_iterator_thread failed.\n");
+	} else {
+		SCTP_BASE_VAR(iterator_thread_started) = 1;
 	}
 #endif
 }

fuzzer/CORPUS_CONNECT/addip-000008

@@ -227,6 +227,8 @@ sctp_start_timer(void)
 	rc = sctp_userspace_thread_create(&SCTP_BASE_VAR(timer_thread), user_sctp_timer_iterate);
 	if (rc) {
 		SCTP_PRINTF("ERROR; return code from sctp_thread_create() is %d\n", rc);
+	} else {
+		SCTP_BASE_VAR(timer_thread_started) = 1;
 	}
 }
 

fuzzer/CORPUS_CONNECT/addip-000009

@@ -34,7 +34,7 @@
 
 #ifdef __FreeBSD__
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sys/netinet/sctp_constants.h 357500 2020-02-04 12:34:16Z tuexen $");
+__FBSDID("$FreeBSD: head/sys/netinet/sctp_constants.h 358169 2020-02-20 15:37:44Z tuexen $");
 #endif
 
 #ifndef _NETINET_SCTP_CONSTANTS_H_
@@ -551,14 +551,13 @@ extern void getwintimeofday(struct timeval *tv);
 #define SCTP_TIMER_TYPE_ASCONF		10
 #define SCTP_TIMER_TYPE_SHUTDOWNGUARD	11
 #define SCTP_TIMER_TYPE_AUTOCLOSE	12
-#define SCTP_TIMER_TYPE_EVENTWAKE	13
-#define SCTP_TIMER_TYPE_STRRESET        14
-#define SCTP_TIMER_TYPE_INPKILL         15
-#define SCTP_TIMER_TYPE_ASOCKILL        16
-#define SCTP_TIMER_TYPE_ADDR_WQ         17
-#define SCTP_TIMER_TYPE_PRIM_DELETED    18
+#define SCTP_TIMER_TYPE_STRRESET	13
+#define SCTP_TIMER_TYPE_INPKILL		14
+#define SCTP_TIMER_TYPE_ASOCKILL	15
+#define SCTP_TIMER_TYPE_ADDR_WQ		16
+#define SCTP_TIMER_TYPE_PRIM_DELETED	17
 /* add new timers here - and increment LAST */
-#define SCTP_TIMER_TYPE_LAST            19
+#define SCTP_TIMER_TYPE_LAST		18
 
 #define SCTP_IS_TIMER_TYPE_VALID(t)	(((t) > SCTP_TIMER_TYPE_NONE) && \
 					 ((t) < SCTP_TIMER_TYPE_LAST))

fuzzer/CORPUS_CONNECT/addip-000010

@@ -6871,7 +6871,7 @@ sctp_pcb_finish(void)
 	}
 #endif
 #if defined(__Userspace__)
-	if (sctp_it_ctl.thread_proc) {
+	if (SCTP_BASE_VAR(iterator_thread_started)) {
 #if defined(__Userspace_os_Windows)
 		WaitForSingleObject(sctp_it_ctl.thread_proc, INFINITE);
 		CloseHandle(sctp_it_ctl.thread_proc);

fuzzer/CORPUS_CONNECT/addip-000011

@@ -315,6 +315,8 @@ struct sctp_base_info {
 	userland_mutex_t timer_mtx;
 	userland_thread_t timer_thread;
 	int timer_thread_should_exit;
+	int iterator_thread_started;
+	int timer_thread_started;
 #if !defined(__Userspace_os_Windows)
 	pthread_mutexattr_t mtx_attr;
 #if defined(INET) || defined(INET6)

fuzzer/CORPUS_CONNECT/dummy-01

@@ -161,11 +161,14 @@ sctp_init(void)
 	SCTP_BASE_VAR(conn_output) = conn_output;
 	SCTP_BASE_VAR(debug_printf) = debug_printf;
 	SCTP_BASE_VAR(crc32c_offloaded) = 0;
+	SCTP_BASE_VAR(iterator_thread_started) = 0;
+	SCTP_BASE_VAR(timer_thread_started) = 0;
 #endif
 #if defined(__Userspace__)
 	sctp_pcb_init(start_threads);
-	if (start_threads)
+	if (start_threads) {
 		sctp_start_timer();
+	}
 #else
 	sctp_pcb_init();
 #endif
@@ -252,12 +255,14 @@ sctp_finish(void)
 	}
 #endif
 	atomic_cmpset_int(&SCTP_BASE_VAR(timer_thread_should_exit), 0, 1);
+	if (SCTP_BASE_VAR(timer_thread_started)) {
 #if defined(__Userspace_os_Windows)
-	WaitForSingleObject(SCTP_BASE_VAR(timer_thread), INFINITE);
-	CloseHandle(SCTP_BASE_VAR(timer_thread));
+		WaitForSingleObject(SCTP_BASE_VAR(timer_thread), INFINITE);
+		CloseHandle(SCTP_BASE_VAR(timer_thread));
 #else
-	pthread_join(SCTP_BASE_VAR(timer_thread), NULL);
+		pthread_join(SCTP_BASE_VAR(timer_thread), NULL);
 #endif
+	}
 #endif
 	sctp_pcb_finish();
 #if defined(__Windows__)