diff --git a/projects/karchive/Dockerfile b/projects/karchive/Dockerfile new file mode 100644 index 000000000..bcc1f8fbb --- /dev/null +++ b/projects/karchive/Dockerfile @@ -0,0 +1,31 @@ +# Copyright 2019 Google Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +FROM gcr.io/oss-fuzz-base/base-builder +MAINTAINER tsdgeos@gmail.com +RUN apt-get update && apt-get install --yes cmake make autoconf automake autopoint libtool wget +RUN git clone --depth 1 https://github.com/madler/zlib.git +RUN git clone --depth 1 https://github.com/nih-at/libzip.git +RUN wget https://sourceware.org/pub/bzip2/bzip2-1.0.6.tar.gz +RUN git clone https://git.tukaani.org/xz.git +RUN git clone --depth 1 git://code.qt.io/qt/qtbase.git +RUN git clone --depth 1 git://anongit.kde.org/extra-cmake-modules +RUN git clone --depth 1 git://anongit.kde.org/karchive +COPY build.sh $SRC +COPY karchive_fuzzer.cc $SRC +WORKDIR karchive + + diff --git a/projects/karchive/build.sh b/projects/karchive/build.sh new file mode 100644 index 000000000..e2889e28a --- /dev/null +++ b/projects/karchive/build.sh @@ -0,0 +1,86 @@ +#!/bin/bash -eu +# Copyright 2019 Google Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +# Build zlib +cd $SRC +cd zlib +./configure --static +make install -j$(nproc) + +# Build libzip +cd $SRC +cd libzip +cmake . -DBUILD_SHARED_LIBS=OFF +make install -j$(nproc) + +# Build bzip2 +# Inspired from ../bzip2/build +cd $SRC +tar xzf bzip2-*.tar.gz && rm -f bzip2-*.tar.gz +cd bzip2-* +SRCL=(blocksort.o huffman.o crctable.o randtable.o compress.o decompress.o bzlib.o) + +for source in ${SRCL[@]}; do + name=$(basename $source .o) + $CC $CFLAGS -c ${name}.c +done +rm -f libbz2.a +ar cq libbz2.a ${SRCL[@]} +cp -f bzlib.h /usr/local/include +cp -f libbz2.a /usr/local/lib + +# Build xz +cd $SRC +cd xz +./autogen.sh +./configure --enable-static --disable-debug --disable-shared --disable-xz --disable-xzdec --disable-lzmainfo +make install -j$(nproc) + +# Build extra-cmake-modules +cd $SRC +cd extra-cmake-modules +cmake . +make install -j$(nproc) + +# Build qtbase +cd $SRC +cd qtbase +# add the flags to Qt build too, we may as well sanitize Qt too (and also fixes memory sanitizer build) +sed -i -e "s/QMAKE_CXXFLAGS += -stdlib=libc++/QMAKE_CXXFLAGS += -stdlib=libc++ $CXXFLAGS/g" mkspecs/linux-clang-libc++/qmake.conf +sed -i -e "s/QMAKE_LFLAGS += -stdlib=libc++/QMAKE_LFLAGS += -stdlib=libc++ -lpthread $CXXFLAGS/g" mkspecs/linux-clang-libc++/qmake.conf +# make qmake compile faster TODO +sed -i -e "s/MAKE\")/MAKE\" -j10)/g" configure +# Disable compressing rcc files, triggers a warning in the memory sanitizer that i'm not sure is valid. TODO investigate properly +sed -i -e "s/DEFINES += QT_RCC QT_NO_CAST_FROM_ASCII QT_NO_FOREACH/DEFINES += QT_NO_COMPRESS QT_RCC QT_NO_CAST_FROM_ASCII QT_NO_FOREACH/g" src/tools/rcc/rcc.pro +# add QT_NO_WARNING_OUTPUT to make the output a bit cleaner by not containing lots of QBuffer::seek: Invalid pos +sed -i -e "s/DEFINES += QT_NO_USING_NAMESPACE QT_NO_FOREACH/DEFINES += QT_NO_USING_NAMESPACE QT_NO_FOREACH QT_NO_WARNING_OUTPUT/g" src/corelib/corelib.pro +./configure --glib=no --libpng=qt -opensource -confirm-license -static -no-opengl -no-icu -platform linux-clang-libc++ -v +cd src +../bin/qmake -o Makefile src.pro +make sub-corelib -j$(nproc) + +# Build karchive +cd $SRC +cd karchive +cmake . -DBUILD_SHARED_LIBS=OFF -DQt5Core_DIR=$SRC/qtbase/lib/cmake/Qt5Core/ -DBUILD_TESTING=OFF +make install -j$(nproc) + +# Build karchive_fuzzer +$CXX $CXXFLAGS -fPIC -std=c++11 $SRC/karchive_fuzzer.cc -o $OUT/karchive_fuzzer -I $SRC/qtbase/include/QtCore/ -I $SRC/qtbase/include/ -I $SRC/qtbase/include//QtGui -I $SRC/qtbase/mkspecs/linux-clang-libc++/ -I /usr/local/include/KF5/KArchive -L $SRC/qtbase/lib -lQt5Core -lm -lqtpcre2 -ldl -lpthread -lFuzzingEngine /usr/local/lib/libzip.a /usr/local/lib/libz.a -lKF5Archive /usr/local/lib/libbz2.a -llzma -lQt5Core + +cd $SRC +find . -name "*.gz" -o -name "*.zip" -o -name "*.xz" -o -name "*.tar" | zip -q $OUT/karchive_fuzzer_seed_corpus.zip -@ diff --git a/projects/karchive/karchive_fuzzer.cc b/projects/karchive/karchive_fuzzer.cc new file mode 100644 index 000000000..36642e426 --- /dev/null +++ b/projects/karchive/karchive_fuzzer.cc @@ -0,0 +1,59 @@ +/* +# Copyright 2019 Google Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ +*/ + +/* + Usage: + python infra/helper.py build_image karchive + python infra/helper.py build_fuzzers --sanitizer undefined|address|memory karchive + python infra/helper.py run_fuzzer karchive karchive_fuzzer +*/ + + +#include +#include +#include + +#include +#include +#include +#include + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + int argc = 0; + QCoreApplication a(argc, nullptr); + + QBuffer b; + b.setData((const char *)data, size); + + const QVector handlers = { + new K7Zip(&b), + new KTar(&b), + new KZip(&b), + new KAr(&b) + }; + + for (KArchive *h : handlers) { + h->open(QIODevice::ReadOnly); + h->close(); + } + + qDeleteAll(handlers); + + return 0; +} diff --git a/projects/karchive/project.yaml b/projects/karchive/project.yaml new file mode 100644 index 000000000..be82a3a64 --- /dev/null +++ b/projects/karchive/project.yaml @@ -0,0 +1,6 @@ +homepage: https://cgit.kde.org/karchive.git/ +primary_contact: tsdgeos@gmail.com +sanitizers: + - address + - memory + - undefined