Opened 3 years ago

Last modified 3 years ago

#21476 new enhancement

Extend HTTP fuzzer so it fuzzes the GET handler functions

Reported by: teor Owned by:
Priority: Medium Milestone: Tor: unspecified
Component: Core Tor/Tor Version:
Severity: Normal Keywords: fuzz, triaged-out-20170308
Cc: Actual Points:
Parent ID: Points: 1
Reviewer: Sponsor:


I have a draft branch for this, I'm going to fuzz with it for a while to make sure there are no show-stoppers.

I'm also curious to see if it finds #21471 in an unfixed codebase.

Child Tickets

Change History (8)

comment:1 Changed 3 years ago by teor

I should also add the '-x' option to the instructions, like:

../afl/afl-fuzz -i ../fuzzing-corpora/http -o ../fuzzing-corpora/http_findings -x src/test/fuzz/dict/http -m none -- src/test/fuzz/fuzz-http

comment:2 Changed 3 years ago by teor

right in the case of that bug it has to be a valid base64 string decoding to 32 bytes
to hit the "ret == 0"
oh wow, ok
perhaps I need to add an example request to the inputs then
or add more tokens to the dictionary

comment:3 Changed 3 years ago by teor

I also need to MOCK dirserv_have_any_microdesc() and similar to return 0, otherwise they crash when trying to find the data directory.

(There appears to be some code reordering here: the tor_assert() on the data directory is not triggered, but the strlen() on it fails with a NULL pointer error.)

comment:4 Changed 3 years ago by nickm

Component: Core TorCore Tor/Tor

comment:5 Changed 3 years ago by nickm

Keywords: triaged-out-20170308 added
Milestone: Tor: 0.3.1.x-finalTor: unspecified

Deferring all 0.3.1 tickets with status == new, owner == nobody, sponsor == nobody, points > 0.5, and priority < high.

I'd still take patches for most of these -- there's just nobody currently lined up to work on them in this timeframe.

comment:6 Changed 3 years ago by teor

Owner: set to teor
Status: newassigned

comment:7 Changed 3 years ago by teor

Owner: teor deleted

Disowning tickets I don't intend to work on in the next 6 months.

comment:8 Changed 3 years ago by teor

Status: assignednew

Mark all tickets that are assigned to nobody as "new".

Note: See TracTickets for help on using tickets.