Rooba
/
oss-fuzz
mirror of https://github.com/google/oss-fuzz.git
1
1
Fork 0
Code Issues Packages Projects Releases Wiki Activity
OSS-Fuzz - continuous fuzzing for open source software.
10,089 Commits 188 Branches 0 Tags 128 MiB
Shell 27.3%
Python 19.3%
Dockerfile 17.4%
Java 17.1%
C 7.2%
Other 11.5%
Go to file
Arthur Chan 6b64a6b331
jackson-datatypes-collections: Fix OOM on Iterable creation of primitive byte array (#11339) 
This PR fixes 3 false positive issues in
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64623,
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64625 and
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64634 which
accidentally loops a very large byte array for too many times.

In `GuavaSerailizerFuzzer` case 11. The logic uses a combination of
`Iterables.cycle(T...)` and `Iterables.limit(Iterable, int)` to create
an iterator for the fuzzing process. But there is a bug in the creation
causing OOM.

In Java, the generic type application is only possible for non-primitive
type. For example, if the following code is run, the result is 2 and
`elements[0] = 1` and `elements[1] = 2` inside `genericTest(T...)`
because the generic type retrieves the Integer type successfully and `T`
is treated as `Integer`.
```java
public class Test {
  public static void main (String[] args) {
    Integer[] test = {1, 2};
    genericTest(test);
  }

  public static <T> T genericTest(T...elements) {
    System.out.println(elements.length);
  }
}
```
But if the code changes to use a primitive type array instead like the
following, the result is 2 and `elements[0][0] = 1` and `elements[0][1]
= 2` inside `genericTest(T...)` because the generic type fails to
convert the primitive type and thus it treats `T` as `int[]`.
```java
public class Test {
  public static void main (String[] args) {
    int[] test = {1, 2};
    genericTest(test);
  }

  public static <T> T genericTest(T...elements) {
    System.out.println(elements.length);
  }
}
```

Because of the above reason, the original code in
`GuavaSerializerFuzzer` shown below provides a `byte[]` to the
`Iterables.cycle(T...)` method. Thus the later
`Iterables.limit(Iterable, int)` is looping through the whole byte[] for
limit time, instead of looping the byte elements in the byte[]. It
results in OOM in some issues when the `data.consumeRemainingAsBytes()`
returns a very large byte array (e.g. 10k bytes). Instead of looping
each byte in the byte array, it actually loops the whole byte array as a
single object for 10k times which uses up the heap memory and causes
OOM.
```java
Iterables.limit(Iterables.cycle(data.consumeRemainingAsBytes()), remainingBytes))
```


This PR fixes the problem by using the `Bytes.asList()` to retrieve the
correct iterable objects for the fuzzing.

Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
 		2023-12-08 16:42:29 +00:00
.allstar Opt out of allstar binary artifacts check (#7816) 2022-06-08 09:37:08 -04:00
.clusterfuzzlite Fuzz OSS-Fuzz with Atheris and ClusterFuzzLite (#8985) 2022-11-30 15:37:36 -05:00
.github PR helper removes maintainers from known contributors. (#10773) 2023-08-02 18:10:24 +10:00
docs Fix a few typos in target_generation.md (#10908) 2023-09-01 10:50:56 +10:00
infra infra: add javascript as a language with builder img (#11106) 2023-11-23 22:20:58 +00:00
projects jackson-datatypes-collections: Fix OOM on Iterable creation of primitive byte array (#11339) 2023-12-08 16:42:29 +00:00
tools/vscode-extension vscode: bump minor version (#11275) 2023-11-27 23:11:59 +00:00
.dockerignore [ClusterFuzzLite] Support GCB and gsutil/gcs as filestore. (#6629) 2021-10-27 10:00:04 -04:00
.gitattributes Add .gitattributes to specify LF as .sh line terminator (#7648) 2022-05-02 10:12:06 -04:00
.gitignore infra: add vscode extension poc (#10592) 2023-08-28 10:51:45 +01:00
.pylintrc Replace terms that are uninclusive. (#5045) 2021-01-25 08:41:34 -08:00
.style.yapf [infra] Add presubmit script (#3196) 2020-01-10 10:19:42 -08:00
CONTRIBUTING.md Delete unnecessary files and fix format in some MD pages (#4115) 2020-07-16 15:27:29 -07:00
LICENSE Create LICENSE 2016-10-03 12:24:25 -07:00
README.md Update blogposts (#10848) 2023-08-17 08:53:46 +10:00

README.md

OSS-Fuzz: Continuous Fuzzing for Open Source Software

Fuzz testing is a well-known technique for uncovering programming errors in software. Many of these detectable errors, like buffer overflow, can have serious security implications. Google has found thousands of security vulnerabilities and stability bugs by deploying guided in-process fuzzing of Chrome components, and we now want to share that service with the open source community.

In cooperation with the Core Infrastructure Initiative and the OpenSSF, OSS-Fuzz aims to make common open source software more secure and stable by combining modern fuzzing techniques with scalable, distributed execution. Projects that do not qualify for OSS-Fuzz (e.g. closed source) can run their own instances of ClusterFuzz or ClusterFuzzLite.

We support the libFuzzer, AFL++, and Honggfuzz fuzzing engines in combination with Sanitizers, as well as ClusterFuzz, a distributed fuzzer execution environment and reporting tool.

Currently, OSS-Fuzz supports C/C++, Rust, Go, Python, Java/JVM, and JavaScript code. Other languages supported by LLVM may work too. OSS-Fuzz supports fuzzing x86_64 and i386 builds.

Overview

OSS-Fuzz process diagram

Documentation

Read our detailed documentation to learn how to use OSS-Fuzz.

Trophies

As of August 2023, OSS-Fuzz has helped identify and fix over 10,000 vulnerabilities and 36,000 bugs across 1,000 projects.

Blog posts