commit | 68e49ad51cfa4e84c5263bf04d51ac7fc3b52392 | [log] [tgz] |
---|---|---|
author | Vitaly Buka <vitalybuka@chromium.org> | Fri Feb 24 14:24:31 2017 -0800 |
committer | Vitaly Buka <vitalybuka@gmail.com> | Fri Feb 24 14:43:55 2017 -0800 |
tree | 5a90634f4225084c3cb5091313470209f171e5a8 | |
parent | c01ab1c68f57f2d78b0d56159a5347b23263b5d3 [diff] |
Generate empty string in LibFuzzerProtobufMutator LLVMFuzzerMutate does not produce empty strings.
libprotobuf-mutator is a library to randomly mutate protobuffers.
It could be used together with guided fuzzing engines, such as libFuzzer.
Install prerequisites:
sudo apt-get update sudo apt-get install binutils cmake ninja-build liblzma-dev libz-dev docbook2x
Compile and test everything:
mkdir build cd build cmake .. -GNinja -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ -DCMAKE_BUILD_TYPE=Debug ninja check
Clang is only needed for libFuzzer integration.
To use libprotobuf-mutator simply include protobuf_mutator.h and protobuf_mutator.cc into your build files.
The ProtobufMutator
class implements mutations of the protobuf tree structure and mutations of individual fields. The field mutation logic is very basic -- for better results you should override the ProtobufMutator::Mutate*
methods with more sophisticated logic, e.g. using libFuzzer's mutators.
To apply one mutation to a protobuf object do the following:
class MyProtobufMutator : public ProtobufMutator { public: MyProtobufMutator(uint32_t seed) : ProtobufMutator(seed) {} // Optionally redefine the Mutate* methods to perform more sophisticated mutations. } void Mutate(MyMessage* message) { MyProtobufMutator mutator(my_random_seed); mutator.Mutate(message, 200); }
See also the ProtobufMutatorMessagesTest.UsageExample
test from protobuf_mutator_test.cc.
LibFuzzerProtobufMutator can help to integrate with libFuzzer. For example
#include "libfuzzer_protobuf_mutator.h" extern "C" size_t LLVMFuzzerCustomMutator(uint8_t* data, size_t size, size_t max_size, unsigned int seed) { MyMessageType message; return protobuf_mutator::MutateTextMessage(data, size, max_size, seed, &message); } extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { MyMessageType message; protobuf_mutator::ParseTextMessage(data, size, &message); // Code which needs to be fuzzed. ConsumeMyMessageType(message); return 0; }
Please see libfuzzer_example.cc as an example.