From a6cfa01085847cdfe74cde2ef4afeedd0b96f6a7 Mon Sep 17 00:00:00 2001 From: Paul Kehrer Date: Tue, 17 Apr 2018 08:52:07 +0000 Subject: [PATCH] move oss-fuzz build script and fuzzer into libtiff tree --- contrib/oss-fuzz/build.sh | 52 +++++++++++++ contrib/oss-fuzz/tiff_read_rgba_fuzzer.cc | 90 +++++++++++++++++++++++ 2 files changed, 142 insertions(+) create mode 100755 contrib/oss-fuzz/build.sh create mode 100644 contrib/oss-fuzz/tiff_read_rgba_fuzzer.cc diff --git a/contrib/oss-fuzz/build.sh b/contrib/oss-fuzz/build.sh new file mode 100755 index 00000000..c3ac121f --- /dev/null +++ b/contrib/oss-fuzz/build.sh @@ -0,0 +1,52 @@ +#!/bin/bash -eu +# Copyright (c) 1988-1997 Sam Leffler +# Copyright (c) 1991-1997 Silicon Graphics, Inc. +# +# Permission to use, copy, modify, distribute, and sell this software and +# its documentation for any purpose is hereby granted without fee, provided +# that (i) the above copyright notices and this permission notice appear in +# all copies of the software and related documentation, and (ii) the names of +# Sam Leffler and Silicon Graphics may not be used in any advertising or +# publicity relating to the software without the specific, prior written +# permission of Sam Leffler and Silicon Graphics. +# +# THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND, +# EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY +# WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. +# +# IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR +# ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND, +# OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, +# WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF +# LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE +# OF THIS SOFTWARE. + +# build zlib +pushd "$SRC/zlib" +./configure --static --prefix="$WORK" +make -j$(nproc) CFLAGS="$CFLAGS -fPIC" +make install +popd + +# Build libjpeg-turbo +pushd "$SRC/libjpeg-turbo" +cmake . -DCMAKE_INSTALL_PREFIX=$WORK -DENABLE_STATIC=on -DENABLE_SHARED=off +make -j$(nproc) +make install +popd + +cmake . -DCMAKE_INSTALL_PREFIX=$WORK -DBUILD_SHARED_LIBS=off +make -j$(nproc) +make install + +$CXX $CXXFLAGS -std=c++11 -I$WORK/include \ + $SRC/libtiff/contrib/oss-fuzz/tiff_read_rgba_fuzzer.cc -o $OUT/tiff_read_rgba_fuzzer \ + -lFuzzingEngine $WORK/lib/libtiffxx.a $WORK/lib/libtiff.a $WORK/lib/libz.a $WORK/lib/libjpeg.a + +mkdir afl_testcases +(cd afl_testcases; tar xf "$SRC/afl_testcases.tgz") +mkdir tif +find afl_testcases -type f -name '*.tif' -exec mv -n {} tif/ \; +zip -rj tif.zip tif/ +cp tif.zip "$OUT/tiff_read_rgba_fuzzer_seed_corpus.zip" +cp "$SRC/tiff.dict" "$OUT/tiff_read_rgba_fuzzer.dict" diff --git a/contrib/oss-fuzz/tiff_read_rgba_fuzzer.cc b/contrib/oss-fuzz/tiff_read_rgba_fuzzer.cc new file mode 100644 index 00000000..919bbc6c --- /dev/null +++ b/contrib/oss-fuzz/tiff_read_rgba_fuzzer.cc @@ -0,0 +1,90 @@ +/* Copyright (c) 1988-1997 Sam Leffler + * Copyright (c) 1991-1997 Silicon Graphics, Inc. + * + * Permission to use, copy, modify, distribute, and sell this software and + * its documentation for any purpose is hereby granted without fee, provided + * that (i) the above copyright notices and this permission notice appear in + * all copies of the software and related documentation, and (ii) the names of + * Sam Leffler and Silicon Graphics may not be used in any advertising or + * publicity relating to the software without the specific, prior written + * permission of Sam Leffler and Silicon Graphics. + * + * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND, + * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY + * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. + * + * IN NO EVENT SHALL SAM LEFFLER OR SILICON GRAPHICS BE LIABLE FOR + * ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND, + * OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, + * WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF + * LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE + * OF THIS SOFTWARE. + */ + +#include +#include +#include +#include + + +/* stolen from tiffiop.h, which is a private header so we can't just include it */ +/* safe multiply returns either the multiplied value or 0 if it overflowed */ +#define __TIFFSafeMultiply(t,v,m) ((((t)(m) != (t)0) && (((t)(((v)*(m))/(m))) == (t)(v))) ? (t)((v)*(m)) : (t)0) + +const uint64 MAX_SIZE = 500000000; + +extern "C" void handle_error(const char *unused, const char *unused2, va_list unused3) { + return; +} + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + TIFFSetErrorHandler(handle_error); + TIFFSetWarningHandler(handle_error); + std::istringstream s(std::string(Data,Data+Size)); + TIFF* tif = TIFFStreamOpen("MemTIFF", &s); + if (!tif) { + return 0; + } + uint32 w, h; + size_t npixels; + uint32* raster; + + TIFFGetField(tif, TIFFTAG_IMAGEWIDTH, &w); + TIFFGetField(tif, TIFFTAG_IMAGELENGTH, &h); + /* don't continue if file size is ludicrous */ + if (TIFFTileSize64(tif) > MAX_SIZE) { + TIFFClose(tif); + return 0; + } + uint64 bufsize = TIFFTileSize64(tif) * 4; + /* don't continue if the buffer size greater than the max allowed by the fuzzer */ + if (bufsize > MAX_SIZE || bufsize == 0) { + TIFFClose(tif); + return 0; + } + /* another hack to work around an OOM in tif_fax3.c */ + uint32 tilewidth = 0; + uint32 imagewidth = 0; + TIFFGetField(tif, TIFFTAG_TILEWIDTH, &tilewidth); + TIFFGetField(tif, TIFFTAG_IMAGEWIDTH, &imagewidth); + tilewidth = __TIFFSafeMultiply(uint32, tilewidth, 2); + imagewidth = __TIFFSafeMultiply(uint32, imagewidth, 2); + if (tilewidth * 2 > MAX_SIZE || imagewidth * 2 > MAX_SIZE || tilewidth == 0 || imagewidth == 0) { + TIFFClose(tif); + return 0; + } + npixels = w * h; + uint32 size = __TIFFSafeMultiply(uint32, w, h); + if (size > MAX_SIZE || size == 0) { + TIFFClose(tif); + return 0; + } + raster = (uint32*) _TIFFmalloc(npixels * sizeof (uint32)); + if (raster != NULL) { + TIFFReadRGBAImage(tif, w, h, raster, 0); + _TIFFfree(raster); + } + TIFFClose(tif); + + return 0; +}