test-fuzz: add packet version for libfuzzer

configure.ac

@@ -455,6 +455,17 @@ AX_CODE_COVERAGE
 AX_SANITIZER
 AS_IF([test -n "$sanitize_CFLAGS"], [CFLAGS="$CFLAGS $sanitize_CFLAGS"])
 
+# LibFuzzer
+AC_ARG_WITH([libfuzzer],
+  AC_HELP_STRING([--with-libfuzzer=path], [Path to LibFuzzer static library]),
+  [libfuzzer_LIBS="$withval"], [libfuzzer_LIBS=no]
+)
+AS_IF([test "$libfuzzer_LIBS" != no -a "$sanitize_coverage_enabled" != yes], [
+  AC_MSG_ERROR([Sanitizer coverage required for LibFuzzer.])
+])
+AM_CONDITIONAL([HAVE_LIBFUZZER], [test "$libfuzzer_LIBS" != "no"])
+AC_SUBST([libfuzzer_LIBS])
+
 AS_IF([test "$enable_documentation" = "yes"],[
 
 AC_PATH_PROGS([SPHINXBUILD], [sphinx-build sphinx-build-3], [false])
@@ -503,6 +514,7 @@ AC_MSG_RESULT([
     LMDB:     ${enable_lmdb} ${lmdb_LIBS} ${lmdb_CFLAGS}
 
     Sanitizer: ${sanitize_CFLAGS}
+    LibFuzzer: ${libfuzzer_LIBS}
 
     Prefix:		${prefix}
     Run dir:		${run_dir}

tests-fuzz/.gitignore

@@ -3,3 +3,4 @@
 
 /knotd_stdio
 /packet
+/packet_libfuzzer

tests-fuzz/Makefile.am

@@ -10,6 +10,11 @@ check_PROGRAMS = \
 	knotd_stdio \
 	packet
 
+if HAVE_LIBFUZZER
+check_PROGRAMS += packet_libfuzzer
+packet_libfuzzer_LDADD = $(LDADD) $(libfuzzer_LIBS) -lstdc++
+endif
+
 knotd_stdio_SOURCES = wrap/server.c wrap/tcp-handler.c wrap/udp-handler.c
 knotd_stdio_CPPFLAGS = $(AM_CPPFLAGS) $(liburcu_CFLAGS)
 knotd_stdio_LDADD = \

tests-fuzz/packet_libfuzzer.c

+/*  Copyright (C) 2015 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include <assert.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <signal.h>
+
+#include "libknot/libknot.h"
+
+int LLVMFuzzerTestOneInput(const unsigned char *data, size_t size)
+{
+	uint8_t *copy = malloc(size);
+	assert(copy);
+	memcpy(copy, data, size);
+
+	knot_pkt_t *pkt = knot_pkt_new(copy, size, NULL);
+	knot_pkt_parse(pkt, 0);
+	knot_pkt_free(&pkt);
+
+	free(copy);
+
+	return 0;
+}

[Daniel Salzman]

Is this data copy necessary?

[Jan Včelák]

Yes, the copying is necessary.

1. The packet parsing requires non-const buffer.
2. A static buffer larger than the input makes a way for undetected buffer overrun errors.

It could be allocated on stack, but I think it makes a little difference.

[Daniel Salzman]

ok