contrib/oss-fuzz/project.yaml - master - githubmirror/libmicrohttpd

contrib/oss-fuzz/project.yaml
67 строк3 KB
Christian Grothoff
expand fuzzing logic
29 июл 2026, 00:04
29 июл 2026, 00:04d59f304
#
# OSS-Fuzz project configuration for GNU libmicrohttpd.
#
# This file should become projects/libmicrohttpd/project.yaml in the
# google/oss-fuzz repository. 
#

homepage: "https://www.gnu.org/software/libmicrohttpd/"
main_repo: "https://git.gnunet.org/libmicrohttpd.git"

language: c
primary_contact: "grothoff@gmail.com"

# address:   the primary target.  The bug class that motivated this work
#            (commit 5a73c1ae, a stack buffer overflow in the digest-auth hex
#            decoder) is exactly what ASan catches, and the harnesses are
#            written for it: every output buffer in fuzz_str and
#            fuzz_auth_header is an exactly-sized heap allocation so that the
#            ASan redzone traps a single-byte overrun.
# undefined: MHD's parsers do a lot of pointer arithmetic and integer width
#            juggling on attacker-controlled lengths (the read-buffer
#            shift-back underflow of 29eaa56b is of that family).  UBSan is
#            cheap and catches those before they become memory errors.
# memory:    usable here only because build.sh configures --disable-https and
#            --disable-curl, which leaves libc and libpthread as the only
#            external dependencies; there is no uninstrumented third-party
#            library to poison the results.  MSan finds the use of
#            uninitialised parser state that ASan cannot see.
sanitizers:
  - address
  - undefined
  - memory

# i386 matters for MHD because the severity of several of the length bugs
# this suite found depends on the word size (see TESTING.md section P3):
# a size_t underflow that is merely a huge number on x86_64 can be a
# wrap-around on a 32 bit target.
#
# Verified locally: the whole library and all harnesses build with -m32,
# and the entire committed corpus, including every corpus/known-findings/
# reproducer, replays clean on the 32 bit targets.  Note that OSS-Fuzz
# runs i386 only with the address sanitizer under libFuzzer.
#
# One i386 quirk is handled in build.sh rather than here: a -m32 PIE
# linked against any sanitizer runtime dies with SEGV at address 0 before
# main() on current Linux/clang, so the local default adds -no-pie.
architectures:
  - x86_64
  - i386

# The harnesses are plain LLVMFuzzerTestOneInput() targets with no engine
# specific code, so every in-process engine works.  All three listed here
# have been built and driven against the targets locally -- see section 4
# of the README for the exact recipe -- rather than merely assumed to
# work; an engine that is claimed but broken shows up as a dead target on
# the OSS-Fuzz dashboard, not as an error anyone notices.
#
# "centipede" is deliberately not listed: it is supported by OSS-Fuzz but
# has not been tried against these targets.  Do not add it without
# building and running it first.
fuzzing_engines:
  - libfuzzer
  - afl
  - honggfuzz

# Documentation a triager should read before filing/handling a report.
help_url: "https://git.gnunet.org/libmicrohttpd.git/tree/src/fuzz/README"