NameDateSize

..Today17

build-coverageH A D13-Aug-20231.1 KiB

clock.cH A D11-Aug-20231.8 KiB

CMakeLists.txtH A D13-Aug-20232.8 KiB

DockerfileH A D13-Aug-2023634

dummy.hH A D13-Aug-20237.5 KiB

export.gnuH A D13-Aug-20236.8 KiB

functions.txtH A D13-Aug-202379.1 KiB

fuzz_assert.cH A D13-Aug-202312.8 KiB

fuzz_bio.cH A D13-Aug-202310.1 KiB

fuzz_cred.cH A D13-Aug-202312.9 KiB

fuzz_credman.cH A D13-Aug-20239.3 KiB

fuzz_hid.cH A D13-Aug-20235.9 KiB

fuzz_largeblob.cH A D13-Aug-20235.7 KiB

fuzz_mgmt.cH A D13-Aug-202312.2 KiB

fuzz_netlink.cH A D13-Aug-20233.3 KiB

fuzz_pcsc.cH A D11-Aug-20236.2 KiB

libfuzzer.cH A D13-Aug-20234.6 KiB

MakefileH A D13-Aug-20232.9 KiB

mutator_aux.cH A D13-Aug-20235.5 KiB

mutator_aux.hH A D13-Aug-20232.9 KiB

pcsc.cH A D11-Aug-20233.9 KiB

preload-fuzz.cH A D13-Aug-20231.9 KiB

preload-snoop.cH A D13-Aug-20234.1 KiB

prng.cH A D05-Dec-20203.9 KiB

READMEH A D13-Aug-20231.9 KiB

report.tgzH A D13-Aug-2023348.6 KiB

summary.txtH A D13-Aug-20239.5 KiB

udev.cH A D13-Aug-20236.6 KiB

uniform_random.cH A D02-Mar-20201.8 KiB

wiredata_fido2.hH A D13-Aug-202333.8 KiB

wiredata_u2f.hH A D13-Aug-20237.2 KiB

wrap.cH A D13-Aug-20239.1 KiB

wrapped.symH A D13-Aug-20231.7 KiB

README

1libfido2 can be fuzzed using AFL or libFuzzer, with or without
2ASAN/MSAN/UBSAN.
3
4AFL is more convenient when fuzzing the path from the authenticator to
5libfido2 in an existing application. To do so, use preload-snoop.c with a real
6authenticator to obtain an initial corpus, rebuild libfido2 with -DFUZZ=ON, and
7use preload-fuzz.c to read device data from stdin.
8
9libFuzzer is better suited for bespoke fuzzers; see fuzz_cred.c, fuzz_credman.c,
10fuzz_assert.c, fuzz_hid.c, and fuzz_mgmt.c for examples. To build these
11harnesses, use -DCMAKE_C_FLAGS=-fsanitize=fuzzer-no-link
12-DFUZZ_LDFLAGS=-fsanitize=fuzzer -DFUZZ=ON.
13
14If -DFUZZ=ON is enabled, symbols listed in wrapped.sym are wrapped in the
15resulting shared object. The wrapper functions simulate failure according to a
16deterministic RNG and probabilities defined in wrap.c. Harnesses wishing to
17use this functionality should call prng_init() with a seed obtained from the
18corpus. To mutate only the seed part of a libFuzzer harness's corpora,
19use '-reduce_inputs=0 --fido-mutate=seed'.
20
21To run under ASAN/MSAN/UBSAN, libfido2 needs to be linked against flavours of
22libcbor and OpenSSL built with the respective sanitiser. In order to keep
23memory utilisation at a manageable level, you can either enforce limits at
24the OS level (e.g. cgroups on Linux), or patch libcbor with the diff below.
25N.B., the patch below is relative to libcbor 0.10.1.
26
27diff --git src/cbor/internal/memory_utils.c src/cbor/internal/memory_utils.c
28index bbea63c..3f7c9af 100644
29--- src/cbor/internal/memory_utils.c
30+++ src/cbor/internal/memory_utils.c
31@@ -41,7 +41,11 @@ size_t _cbor_safe_signaling_add(size_t a, size_t b) {
32 
33 void* _cbor_alloc_multiple(size_t item_size, size_t item_count) {
34   if (_cbor_safe_to_multiply(item_size, item_count)) {
35-    return _cbor_malloc(item_size * item_count);
36+    if (item_count > 1000) {
37+      return NULL;
38+    } else {
39+      return _cbor_malloc(item_size * item_count);
40+    }
41   } else {
42     return NULL;
43   }
44