oss-fuzz/projects/binutils/fuzz_disas_ext.c

/* Copyright 2021 Google LLC
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
      http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

/*
 * This disassemble fuzzer can be used for targetting specific architectures
 * and also initilises the target architecture with a random options string.
 * This is useful, for example, to hit architectures the general disassembly
 * fuzzer may not be hitting, and also to fuzz disassemblers in different
 * settings. This fuzzer also targets both big and small endianness. Down
 * the line this fuzzer can be expanded on, e.g. to include symobls and data
 * in the memory that is to be disassembled.
 */
#include "sysdep.h"
#include "bfd.h"
#include "dis-asm.h"
#include "disassemble.h"

#include <stdint.h>

#define MAX_TEXT_SIZE 256

typedef struct
{
  char *buffer;
  size_t pos;
} SFILE;

static int
fuzz_disasm_null_styled_printf (void *stream,
             enum disassembler_style style,
             const char *format, ...)
{
  return 0;
}


static int objdump_sprintf (void *vf, const char *format, ...)
{
  SFILE *f = (SFILE *) vf;
  size_t n;
  va_list args;

  va_start (args, format);
  if (f->pos >= MAX_TEXT_SIZE){
    printf("buffer needs more space\n");
    //reset
    f->pos=0;
    return 0;
  }
  n = vsnprintf (f->buffer + f->pos, MAX_TEXT_SIZE - f->pos, format, args);
  //vfprintf(stdout, format, args);
  va_end (args);
  f->pos += n;
  return n;
}

char options[100]; // Enable the disassemblers to have random options.
char private_data[100]; // This is used for some targets. Watch out when
                        // using it as some disassemblers have pointers
                        // within their private_data.

void
disassemble_architecture(int arch, const uint8_t *Data, size_t Size, int big) {
  char AssemblyText[MAX_TEXT_SIZE];
  struct disassemble_info disasm_info;
  SFILE s;

  init_disassemble_info (&disasm_info, stdout, (fprintf_ftype) fprintf, fuzz_disasm_null_styled_printf);
  disasm_info.fprintf_func = objdump_sprintf;
  disasm_info.print_address_func = generic_print_address;
  disasm_info.display_endian = disasm_info.endian = BFD_ENDIAN_LITTLE;
  disasm_info.buffer = (bfd_byte *) Data+10;
  disasm_info.buffer_vma = 0x1000;
  disasm_info.buffer_length = Size-10;
  disasm_info.insn_info_valid = 0;
  disasm_info.disassembler_options = options;
  disasm_info.created_styled_output = false;

  if (arch == bfd_arch_arm) {
    disasm_info.private_data = private_data;
  }

  s.buffer = AssemblyText;
  s.pos = 0;
  disasm_info.stream = &s;
  disasm_info.bytes_per_line = 0;

  disasm_info.arch = arch;
  disasm_info.mach = bfd_getl64(&Data[Size-9]);
  disasm_info.flavour = Data[Size-10];
  disasm_info.bytes_per_chunk = Data[Size-9];

  if (bfd_lookup_arch (disasm_info.arch, disasm_info.mach) != NULL) {
    disassembler_ftype disasfunc = disassembler(disasm_info.arch, big, disasm_info.mach, NULL);
    if (disasfunc != NULL) {
      disassemble_init_for_target(&disasm_info);
      while (1) {
        s.pos = 0;
        int octets = disasfunc(disasm_info.buffer_vma, &disasm_info);
        if (octets < (int) disasm_info.octets_per_byte)
          break;
        if (disasm_info.buffer_length <= (size_t) octets)
          break;
        disasm_info.buffer += octets;
        disasm_info.buffer_vma += octets / disasm_info.octets_per_byte;
        disasm_info.buffer_length -= octets;
      }
      disassemble_free_target(&disasm_info);
    }
  }
}

int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
  if (Size < 210 || Size > 16394) {
    // 10 bytes for options
    // 16394 limit code to prevent timeouts
    return 0;
  }
  char arch = *Data;

  // Create a random options string
  memcpy(options, Data, 100);
  options[99] = '\0';
  Data += 100;
  Size -= 100;

  // The private data may or may not be used in the disassemble_architecture
  // depending on the the target.
  memcpy(private_data, Data, 100);
  options[99] = '\0';
  Data += 100;
  Size -= 100;

  // FUZZ_TARGET_ARCH must be defined and should be the architecture
  // you target.
  disassemble_architecture(FUZZ_TARGET_ARCH, Data, Size, 1);
  disassemble_architecture(FUZZ_TARGET_ARCH, Data, Size, 0);

  return 0;
}