From 9b1d911d0dc703a77ad18313eb389fc0db0ef819 Mon Sep 17 00:00:00 2001 From: pdknsk Date: Sun, 23 Sep 2018 18:28:05 +0200 Subject: [PATCH] [firefox] Fix profile build, enable ubsan, more (#1835) * limit SdpParser to 25kB * separate out mozconfig * fix profile build * accurate library handling * cosmetic * enable undefined sanitizer * limit ContentSecurityPolicyParser to 15kB --- .../ContentSecurityPolicyParser.options | 2 + projects/firefox/Dockerfile | 4 +- projects/firefox/SdpParser.options | 2 + projects/firefox/build.sh | 59 ++++++------------- projects/firefox/mozconfig.address | 6 ++ projects/firefox/mozconfig.profile | 7 +++ projects/firefox/mozconfig.undefined | 6 ++ projects/firefox/project.yaml | 16 +++++ 8 files changed, 59 insertions(+), 43 deletions(-) create mode 100644 projects/firefox/ContentSecurityPolicyParser.options create mode 100644 projects/firefox/SdpParser.options create mode 100644 projects/firefox/mozconfig.address create mode 100644 projects/firefox/mozconfig.profile create mode 100644 projects/firefox/mozconfig.undefined diff --git a/projects/firefox/ContentSecurityPolicyParser.options b/projects/firefox/ContentSecurityPolicyParser.options new file mode 100644 index 000000000..8791e2ffc --- /dev/null +++ b/projects/firefox/ContentSecurityPolicyParser.options @@ -0,0 +1,2 @@ +[libfuzzer] +max_len = 15360 diff --git a/projects/firefox/Dockerfile b/projects/firefox/Dockerfile index b72f41a4d..dd4a3675a 100644 --- a/projects/firefox/Dockerfile +++ b/projects/firefox/Dockerfile @@ -20,6 +20,6 @@ RUN apt-get update && apt-get install -y gawk mercurial RUN hg clone --uncompressed https://hg.mozilla.org/mozilla-central RUN git clone --depth 1 https://github.com/mozillasecurity/fuzzdata WORKDIR mozilla-central -COPY build.sh target.c *options $SRC/ -COPY *diff $SRC/mozilla-central +COPY build.sh target.c *.options mozconfig.* $SRC/ +COPY *.diff $SRC/mozilla-central/ RUN hg patch --no-commit ContentSecurityPolicyParser.diff diff --git a/projects/firefox/SdpParser.options b/projects/firefox/SdpParser.options new file mode 100644 index 000000000..11d0c5f6c --- /dev/null +++ b/projects/firefox/SdpParser.options @@ -0,0 +1,2 @@ +[libfuzzer] +max_len = 25600 diff --git a/projects/firefox/build.sh b/projects/firefox/build.sh index 45023de90..34e36f175 100755 --- a/projects/firefox/build.sh +++ b/projects/firefox/build.sh @@ -15,6 +15,8 @@ # ################################################################################ +[[ $SANITIZER = "coverage" ]] && touch $OUT/exit && exit 0 + # Case-sensitive names of internal Firefox fuzzing targets. Edit to add more. FUZZ_TARGETS=( SdpParser @@ -24,38 +26,15 @@ FUZZ_TARGETS=( # Qcms # needn't be enabled; has its own project with more sanitizers/engines ) -# Firefox object (build) directory. -OBJDIR=$WORK/obj-fuzz - -[[ $SANITIZER = "coverage" ]] && touch $OUT/empty && exit 0 - -# Firefox fuzzing build configuration. -cat << EOF > mozconfig -ac_add_options --disable-debug -ac_add_options --disable-elf-hack -ac_add_options --disable-jemalloc -ac_add_options --disable-crashreporter -ac_add_options --enable-fuzzing -ac_add_options --enable-optimize=-O1 -ac_add_options --enable-debug-symbols=-gline-tables-only -ac_add_options --enable-address-sanitizer -mk_add_options MOZ_OBJDIR=${OBJDIR} -mk_add_options MOZ_MAKE_FLAGS=-j$(nproc) -EOF - -if [[ $SANITIZER = "address" ]] -then -cat << EOF >> mozconfig -mk_add_options CFLAGS= -mk_add_options CXXFLAGS= -EOF -fi +# Firefox object (build) directory and configuration file. +export MOZ_OBJDIR=$WORK/obj-fuzz +export MOZCONFIG=$SRC/mozconfig.$SANITIZER # Install dependencies. Note that bootstrap installs cargo, which must be added # to PATH via source. In a successive run (for a different sanitizer), the # cargo installation carries over, but bootstrap fails if cargo is not in PATH. export SHELL=/bin/bash -[ -f "$HOME/.cargo/env" ] && source $HOME/.cargo/env +[[ -f "$HOME/.cargo/env" ]] && source $HOME/.cargo/env ./mach bootstrap --no-interactive --application-choice browser source $HOME/.cargo/env @@ -68,23 +47,20 @@ source $HOME/.cargo/env # Packages Firefox only to immediately extract the archive. Some files are # replaced with gtest-variants, which is required by the fuzzing interface. -# Weighs in shy of 1GB afterwards. -make -j$(nproc) -C $OBJDIR package -tar -xf $OBJDIR/dist/firefox*bz2 -C $OUT -mv $OBJDIR/toolkit/library/gtest/libxul.so $OUT/firefox -mv $OUT/firefox/dependentlibs.list $OUT/firefox/dependentlibs.list.gtest +# Weighs in shy of 1GB afterwards. About double for profile builds. +make -j$(nproc) -C $MOZ_OBJDIR package +tar -xf $MOZ_OBJDIR/dist/firefox*bz2 -C $OUT +cp -L $MOZ_OBJDIR/dist/bin/gtest/libxul.so $OUT/firefox +cp $OUT/firefox/dependentlibs.list $OUT/firefox/dependentlibs.list.gtest -# Get the absolute paths of the required system libraries. -export LD_LIBRARY_PATH=${LD_LIBRARY_PATH:-}:$OUT/firefox -REQUIRED_LIBRARIES=($(ldd $OUT/firefox/libxul.so | gawk '/=> [/]/ {print $3}')) -REQUIRED_LIBRARIES=(${REQUIRED_LIBRARIES[@]##$OUT/*}) +# Get absolute paths of the required system libraries. +LIBRARIES=$({ + xargs -I{} ldd $OUT/firefox/{} | gawk '/=> [/]/ {print $3}' | sort -u +} < $OUT/firefox/dependentlibs.list) # Copy libraries. Less than 50MB total. mkdir -p $OUT/lib -for REQUIRED_LIBRARY in ${REQUIRED_LIBRARIES[@]} -do - cp -L $REQUIRED_LIBRARY $OUT/lib -done +for LIBRARY in $LIBRARIES; do cp -L $LIBRARY $OUT/lib; done # Build a wrapper binary for each target to set environment variables. for FUZZ_TARGET in ${FUZZ_TARGETS[@]} @@ -94,6 +70,8 @@ do $SRC/target.c -o $OUT/$FUZZ_TARGET done +cp $SRC/*.options $OUT + # SdpParser find media/webrtc -iname "*.sdp" \ -type f -exec zip -qu $OUT/SdpParser_seed_corpus.zip "{}" \; @@ -106,7 +84,6 @@ cp $SRC/fuzzdata/dicts/stun.dict $OUT/StunParser.dict # ContentParentIPC cp $SRC/fuzzdata/settings/ipc/libfuzzer.content.blacklist.txt $OUT/firefox -cp $SRC/ContentParentIPC.options $OUT # ContentSecurityPolicyParser cp dom/security/fuzztest/csp_fuzzer.dict $OUT/ContentSecurityPolicyParser.dict diff --git a/projects/firefox/mozconfig.address b/projects/firefox/mozconfig.address new file mode 100644 index 000000000..158f9ed74 --- /dev/null +++ b/projects/firefox/mozconfig.address @@ -0,0 +1,6 @@ +. $SRC/mozconfig.profile + +ac_add_options --enable-address-sanitizer + +unset CFLAGS +unset CXXFLAGS diff --git a/projects/firefox/mozconfig.profile b/projects/firefox/mozconfig.profile new file mode 100644 index 000000000..86459bde4 --- /dev/null +++ b/projects/firefox/mozconfig.profile @@ -0,0 +1,7 @@ +ac_add_options --disable-debug +ac_add_options --disable-elf-hack +ac_add_options --disable-jemalloc +ac_add_options --disable-crashreporter +ac_add_options --enable-fuzzing +ac_add_options --enable-optimize=-O1 +ac_add_options --enable-debug-symbols=-gline-tables-only diff --git a/projects/firefox/mozconfig.undefined b/projects/firefox/mozconfig.undefined new file mode 100644 index 000000000..ac0605da3 --- /dev/null +++ b/projects/firefox/mozconfig.undefined @@ -0,0 +1,6 @@ +. $SRC/mozconfig.profile + +ac_add_options --enable-undefined-sanitizer=bool,bounds,return,pointer-overflow,signed-integer-overflow,vla-bound + +unset CFLAGS +unset CXXFLAGS diff --git a/projects/firefox/project.yaml b/projects/firefox/project.yaml index d247ea671..c61931223 100644 --- a/projects/firefox/project.yaml +++ b/projects/firefox/project.yaml @@ -7,4 +7,20 @@ fuzzing_engines: - libfuzzer sanitizers: - address + - undefined run_tests: False +# libraries from $OUT/firefox/dependentlibs.list +coverage_extra_args: > + -object firefox/firefox + -object firefox/libnspr4.so + -object firefox/libplc4.so + -object firefox/libplds4.so + -object firefox/libmozsandbox.so + -object firefox/liblgpllibs.so + -object firefox/libnssutil3.so + -object firefox/libnss3.so + -object firefox/libsmime3.so + -object firefox/libmozsqlite3.so + -object firefox/libssl3.so + -object firefox/libmozgtk.so + -object firefox/libxul.so