diff --git a/projects/cpython3/Dockerfile b/projects/cpython3/Dockerfile index ab3038fa1e09..4bb3d39085eb 100644 --- a/projects/cpython3/Dockerfile +++ b/projects/cpython3/Dockerfile @@ -19,7 +19,12 @@ RUN apt-get update && \ apt-get install -y build-essential libncursesw5-dev \ libreadline-dev libssl-dev libgdbm-dev \ libc6-dev libsqlite3-dev tk-dev libbz2-dev \ - zlib1g-dev libffi-dev + libffi-dev autoconf automake autopoint libtool + +# zlib and liblzma are built from source with sanitizer instrumentation +# in build.sh +RUN git clone --depth 1 -b master https://github.com/madler/zlib.git zlib +RUN git clone --depth 1 https://github.com/tukaani-project/xz.git xz RUN git clone https://github.com/python/cpython.git cpython3 WORKDIR cpython3 diff --git a/projects/cpython3/build.sh b/projects/cpython3/build.sh index 022c851feec2..3b396b5ac84a 100644 --- a/projects/cpython3/build.sh +++ b/projects/cpython3/build.sh @@ -30,7 +30,33 @@ CFLAGS="${CFLAGS} -UNDEBUG" # We use some internal CPython API. CFLAGS="${CFLAGS} -IInclude/internal/" +# Build zlib from source with the sanitizer/coverage flags +ZLIB_PREFIX=$WORK/zlib +pushd $SRC/zlib +./configure --static --prefix=$ZLIB_PREFIX +# Build as a static library since it's linked into shared extension modules +make -j$(nproc) CFLAGS="$CFLAGS -fPIC" +make install +popd + +# Build liblzma from source with the sanitizer/coverage flags +LZMA_PREFIX=$WORK/xz +pushd $SRC/xz +./autogen.sh --no-po4a --no-doxygen +# Static + PIC for the same reason as zlib. Also, we can skip the command line tools +./configure --prefix=$LZMA_PREFIX \ + --enable-static --disable-shared --with-pic --enable-debug \ + --disable-xz --disable-xzdec --disable-lzmadec --disable-lzmainfo \ + --disable-nls --disable-doc +make -j$(nproc) +make install +popd + FLAGS=() +FLAGS+=("ZLIB_CFLAGS=-I$ZLIB_PREFIX/include") +FLAGS+=("ZLIB_LIBS=$ZLIB_PREFIX/lib/libz.a") +FLAGS+=("LIBLZMA_CFLAGS=-I$LZMA_PREFIX/include") +FLAGS+=("LIBLZMA_LIBS=$LZMA_PREFIX/lib/liblzma.a -lpthread") case $SANITIZER in address) FLAGS+=("--with-address-sanitizer") diff --git a/projects/git/project.yaml b/projects/git/project.yaml index 3828bfc7a20d..ffeeaaf0af63 100644 --- a/projects/git/project.yaml +++ b/projects/git/project.yaml @@ -1,5 +1,5 @@ homepage: "https://git-scm.com" -language: rust +language: c++ primary_contact: "steadmon@google.com" auto_ccs: - "git-fuzz-reports@google.com" diff --git a/projects/monero/Dockerfile b/projects/monero/Dockerfile index 3c5177c3f981..280929a2bef0 100644 --- a/projects/monero/Dockerfile +++ b/projects/monero/Dockerfile @@ -17,7 +17,7 @@ # Multistage docker build, requires docker 17.05 # builder stage -FROM gcr.io/oss-fuzz-base/base-builder +FROM gcr.io/oss-fuzz-base/base-builder-rust RUN set -ex && \ apt-get update && \ diff --git a/projects/monero/build.sh b/projects/monero/build.sh index 678d10b9a05c..35c46413ece4 100755 --- a/projects/monero/build.sh +++ b/projects/monero/build.sh @@ -30,7 +30,8 @@ export CXXFLAGS="${CXXFLAGS} -fPIC -DBOOST_NO_INCLASS_MEMBER_INITIALIZATION" # `set(Boost_USE_STATIC_RUNTIME ON)`. The OSS-Fuzz image builds Boost with # `runtime-link=static`, so config-mode find_package rejects that variant unless # Boost_USE_STATIC_RUNTIME is ON. Re-supply it here to match the image's Boost. -cmake -D OSSFUZZ=ON -D STATIC=ON -D BUILD_TESTS=ON -D USE_LTO=OFF -D ARCH="default" -D Boost_USE_STATIC_RUNTIME=ON .. +cmake -D OSSFUZZ=ON -D STATIC=ON -D BUILD_TESTS=ON -D USE_LTO=OFF \ + -D USE_DEVICE_TREZOR=OFF -D ARCH="default" -D Boost_USE_STATIC_RUNTIME=ON .. TESTS="\ base58_fuzz_tests \ diff --git a/projects/ogre/Dockerfile b/projects/ogre/Dockerfile index 9cd2c240994c..5226295789fd 100644 --- a/projects/ogre/Dockerfile +++ b/projects/ogre/Dockerfile @@ -17,5 +17,5 @@ FROM gcr.io/oss-fuzz-base/base-builder RUN apt-get update -y && apt-get install -y curl libgtest-dev libx11-dev RUN git clone --depth 1 https://github.com/OGRECave/ogre -COPY build.sh *.cpp *.dict $SRC/ +COPY build.sh $SRC/ WORKDIR ogre diff --git a/projects/ogre/build.sh b/projects/ogre/build.sh index d97e6b708dc2..c0b2310376c8 100644 --- a/projects/ogre/build.sh +++ b/projects/ogre/build.sh @@ -21,7 +21,7 @@ cmake -DOGRE_STATIC=TRUE -DOGRE_BUILD_FUZZERS=TRUE -DCMAKE_CXX_FLAGS="$CXXFLAGS" make -j$(nproc) # copy the fuzzers -for fuzzer in image_fuzz stream_fuzz zip_fuzz ogre_deep_fuzz script_fuzz; do +for fuzzer in image_fuzz stream_fuzz zip_fuzz ogre_deep_fuzz script_fuzz dds_fuzz; do cp bin/${fuzzer} $OUT/${fuzzer} done @@ -55,5 +55,12 @@ for f in $(find .. -name '*.material' -o -name '*.program' \ cp "$f" "/tmp/ogre_script_seeds/$base" done +# Seed corpus for the DDS codec fuzzer +mkdir -p /tmp/ogre_dds_seeds +for f in $(find .. -iname '*.dds'); do + cp "$f" "/tmp/ogre_dds_seeds/$(echo "${f#../}" | tr '/' '_')" +done + cd /tmp/ogre_deep_seeds && zip -q $OUT/ogre_deep_fuzz_seed_corpus.zip * 2>/dev/null || true -cd /tmp/ogre_script_seeds && zip -q $OUT/script_fuzz_seed_corpus.zip * 2>/dev/null || true \ No newline at end of file +cd /tmp/ogre_script_seeds && zip -q $OUT/script_fuzz_seed_corpus.zip * 2>/dev/null || true +cd /tmp/ogre_dds_seeds && zip -q $OUT/dds_fuzz_seed_corpus.zip * 2>/dev/null || true diff --git a/projects/open5gs/build.sh b/projects/open5gs/build.sh index 7e619cd6c8a8..0e07e9201748 100644 --- a/projects/open5gs/build.sh +++ b/projects/open5gs/build.sh @@ -39,10 +39,11 @@ ninja -C builddir -k 0 \ tests/fuzzing/pfcp_message_fuzz \ tests/fuzzing/nas_5gs_message_fuzz \ tests/fuzzing/sbi_nf_profile_fuzz \ - tests/fuzzing/sbi_sm_context_fuzz + tests/fuzzing/sbi_sm_context_fuzz \ + tests/fuzzing/sbi_openapi_model_fuzz \ + tests/fuzzing/sbi_request_fuzz cp builddir/tests/fuzzing/gtp_message_fuzz $OUT/gtp_message_fuzz -cp builddir/tests/fuzzing/ipfw_rule_fuzz $OUT/ipfw_rule_fuzz cp builddir/tests/fuzzing/nas_message_fuzz $OUT/nas_message_fuzz cp builddir/tests/fuzzing/ngap_message_fuzz $OUT/ngap_message_fuzz cp builddir/tests/fuzzing/s1ap_message_fuzz $OUT/s1ap_message_fuzz @@ -53,17 +54,22 @@ mkdir -p $OUT/lib/ cp /lib/x86_64-linux-gnu/libtalloc.so* $OUT/lib/ cp tests/fuzzing/gtp_message_fuzz_seed_corpus.zip $OUT/gtp_message_fuzz_seed_corpus.zip -cp tests/fuzzing/ipfw_rule_fuzz_seed_corpus.zip $OUT/ipfw_rule_fuzz_seed_corpus.zip cp tests/fuzzing/nas_message_fuzz_seed_corpus.zip $OUT/nas_message_fuzz_seed_corpus.zip cp tests/fuzzing/pfcp_message_fuzz_seed_corpus.zip $OUT/pfcp_message_fuzz_seed_corpus.zip cp tests/fuzzing/nas_5gs_message_fuzz_seed_corpus.zip $OUT/nas_5gs_message_fuzz_seed_corpus.zip -# Disable sbi related fuzzers for memory sanitizer because it depends on -# libtalloc which contains a MSAN false positive problem +# Disable sbi/ipfw related fuzzers for memory sanitizer because they depend +# on the system libtalloc, which is not MSAN-instrumented and causes false +# positives. if [ "$SANITIZER" != "memory" ]; then + cp builddir/tests/fuzzing/ipfw_rule_fuzz $OUT/ipfw_rule_fuzz + cp tests/fuzzing/ipfw_rule_fuzz_seed_corpus.zip $OUT/ipfw_rule_fuzz_seed_corpus.zip + cp builddir/tests/fuzzing/sbi_nf_profile_fuzz $OUT/sbi_nf_profile_fuzz cp builddir/tests/fuzzing/sbi_sm_context_fuzz $OUT/sbi_sm_context_fuzz - for fuzzer in sbi_nf_profile_fuzz sbi_sm_context_fuzz; + cp builddir/tests/fuzzing/sbi_openapi_model_fuzz $OUT/sbi_openapi_model_fuzz + cp builddir/tests/fuzzing/sbi_request_fuzz $OUT/sbi_request_fuzz + for fuzzer in sbi_nf_profile_fuzz sbi_sm_context_fuzz sbi_openapi_model_fuzz sbi_request_fuzz; do ldd "$OUT/$fuzzer" 2>/dev/null | awk '/=> \//{print $3}' done | grep -Ev '/(ld-linux|libc|libm|libdl|libpthread|librt|libstdc\+\+|libgcc_s)\.' \ diff --git a/projects/rabbitmq-c/build.sh b/projects/rabbitmq-c/build.sh index d8eda899af68..eecfb6394361 100644 --- a/projects/rabbitmq-c/build.sh +++ b/projects/rabbitmq-c/build.sh @@ -14,7 +14,7 @@ # limitations under the License. # ################################################################################ -mkdir build +mkdir build pushd build/ @@ -35,6 +35,7 @@ cp fuzz/fuzz_method_decode $OUT/fuzz_method_decode cp fuzz/fuzz_handle_input $OUT/fuzz_handle_input cp fuzz/fuzz_properties_decode $OUT/fuzz_properties_decode cp fuzz/fuzz_codec $OUT/fuzz_codec +cp fuzz/fuzz_read_message $OUT/fuzz_read_message popd zip -j ${OUT}/fuzz_url_seed_corpus.zip fuzz/input/fuzz_url.raw