1 | /* |
---|
2 | * zzuf - general purpose fuzzer |
---|
3 | * Copyright (c) 2002, 2007 Sam Hocevar <sam@zoy.org> |
---|
4 | * All Rights Reserved |
---|
5 | * |
---|
6 | * $Id: zzuf.c 1671 2007-01-14 20:47:18Z sam $ |
---|
7 | * |
---|
8 | * This program is free software. It comes without any warranty, to |
---|
9 | * the extent permitted by applicable law. You can redistribute it |
---|
10 | * and/or modify it under the terms of the Do What The Fuck You Want |
---|
11 | * To Public License, Version 2, as published by Sam Hocevar. See |
---|
12 | * http://sam.zoy.org/wtfpl/COPYING for more details. |
---|
13 | */ |
---|
14 | |
---|
15 | /* |
---|
16 | * main.c: main program |
---|
17 | */ |
---|
18 | |
---|
19 | #include "config.h" |
---|
20 | |
---|
21 | #if defined HAVE_STDINT_H |
---|
22 | # include <stdint.h> |
---|
23 | #elif defined HAVE_INTTYPES_H |
---|
24 | # include <inttypes.h> |
---|
25 | #endif |
---|
26 | #if defined(HAVE_GETOPT_H) |
---|
27 | # include <getopt.h> |
---|
28 | #endif |
---|
29 | #include <stdio.h> |
---|
30 | #include <stdlib.h> |
---|
31 | #include <unistd.h> |
---|
32 | #include <regex.h> |
---|
33 | #include <string.h> |
---|
34 | #include <errno.h> |
---|
35 | #include <signal.h> |
---|
36 | #include <sys/wait.h> |
---|
37 | #include <sys/time.h> |
---|
38 | #include <sys/resource.h> |
---|
39 | |
---|
40 | #include "libzzuf.h" |
---|
41 | #include "random.h" |
---|
42 | #include "fd.h" |
---|
43 | #include "fuzz.h" |
---|
44 | #include "md5.h" |
---|
45 | #include "timer.h" |
---|
46 | |
---|
47 | static void loop_stdin(void); |
---|
48 | |
---|
49 | static void spawn_children(void); |
---|
50 | static void clean_children(void); |
---|
51 | static void read_children(void); |
---|
52 | |
---|
53 | static char const *sig2str(int); |
---|
54 | static char *merge_regex(char *, char *); |
---|
55 | static char *merge_file(char *, char *); |
---|
56 | static void set_environment(char const *); |
---|
57 | static void version(void); |
---|
58 | #if defined(HAVE_GETOPT_H) |
---|
59 | static void usage(void); |
---|
60 | #endif |
---|
61 | |
---|
62 | static struct child_list |
---|
63 | { |
---|
64 | enum status |
---|
65 | { |
---|
66 | STATUS_FREE, |
---|
67 | STATUS_RUNNING, |
---|
68 | STATUS_SIGTERM, |
---|
69 | STATUS_SIGKILL, |
---|
70 | STATUS_EOF, |
---|
71 | } status; |
---|
72 | |
---|
73 | pid_t pid; |
---|
74 | int fd[3]; /* 0 is debug, 1 is stderr, 2 is stdout */ |
---|
75 | int bytes, seed; |
---|
76 | int64_t date; |
---|
77 | struct md5 *ctx; |
---|
78 | } *child_list; |
---|
79 | static int maxforks = 1, child_count = 0, maxcrashes = 1, crashes = 0; |
---|
80 | |
---|
81 | static char **newargv; |
---|
82 | static char *protect = NULL, *refuse = NULL; |
---|
83 | static uint32_t seed = DEFAULT_SEED; |
---|
84 | static uint32_t endseed = DEFAULT_SEED + 1; |
---|
85 | static double ratio = DEFAULT_RATIO; |
---|
86 | static double endratio = DEFAULT_RATIO; |
---|
87 | static int quiet = 0; |
---|
88 | static int maxbytes = -1; |
---|
89 | static int md5 = 0; |
---|
90 | static int checkexit = 0; |
---|
91 | static int verbose = 0; |
---|
92 | static int maxmem = -1; |
---|
93 | static int64_t maxtime = -1; |
---|
94 | static int64_t delay = 0; |
---|
95 | static int64_t lastlaunch = 0; |
---|
96 | |
---|
97 | #define ZZUF_FD_SET(fd, p_fdset, maxfd) \ |
---|
98 | if(fd >= 0) \ |
---|
99 | { \ |
---|
100 | FD_SET(fd, p_fdset); \ |
---|
101 | if(fd > maxfd) \ |
---|
102 | maxfd = fd; \ |
---|
103 | } |
---|
104 | |
---|
105 | #define ZZUF_FD_ISSET(fd, p_fdset) \ |
---|
106 | ((fd >= 0) && (FD_ISSET(fd, p_fdset))) |
---|
107 | |
---|
108 | int main(int argc, char *argv[]) |
---|
109 | { |
---|
110 | char *parser, *include, *exclude; |
---|
111 | int i, cmdline = 0; |
---|
112 | |
---|
113 | include = exclude = NULL; |
---|
114 | |
---|
115 | #if defined(HAVE_GETOPT_H) |
---|
116 | for(;;) |
---|
117 | { |
---|
118 | # define OPTSTR "AB:cC:dD:E:F:iI:mM:nP:qr:R:s:ST:vxhV" |
---|
119 | # ifdef HAVE_GETOPT_LONG |
---|
120 | # define MOREINFO "Try `%s --help' for more information.\n" |
---|
121 | int option_index = 0; |
---|
122 | static struct option long_options[] = |
---|
123 | { |
---|
124 | /* Long option, needs arg, flag, short option */ |
---|
125 | { "autoinc", 0, NULL, 'A' }, |
---|
126 | { "max-bytes", 1, NULL, 'B' }, |
---|
127 | { "cmdline", 0, NULL, 'c' }, |
---|
128 | { "max-crashes", 1, NULL, 'C' }, |
---|
129 | { "debug", 0, NULL, 'd' }, |
---|
130 | { "delay", 1, NULL, 'D' }, |
---|
131 | { "exclude", 1, NULL, 'E' }, |
---|
132 | { "max-forks", 1, NULL, 'F' }, |
---|
133 | { "stdin", 0, NULL, 'i' }, |
---|
134 | { "include", 1, NULL, 'I' }, |
---|
135 | { "md5", 0, NULL, 'm' }, |
---|
136 | { "max-memory", 1, NULL, 'M' }, |
---|
137 | { "network", 0, NULL, 'n' }, |
---|
138 | { "protect", 1, NULL, 'P' }, |
---|
139 | { "quiet", 0, NULL, 'q' }, |
---|
140 | { "ratio", 1, NULL, 'r' }, |
---|
141 | { "refuse", 1, NULL, 'R' }, |
---|
142 | { "seed", 1, NULL, 's' }, |
---|
143 | { "signal", 0, NULL, 'S' }, |
---|
144 | { "max-time", 1, NULL, 'T' }, |
---|
145 | { "verbose", 0, NULL, 'v' }, |
---|
146 | { "check-exit", 0, NULL, 'x' }, |
---|
147 | { "help", 0, NULL, 'h' }, |
---|
148 | { "version", 0, NULL, 'V' }, |
---|
149 | }; |
---|
150 | int c = getopt_long(argc, argv, OPTSTR, long_options, &option_index); |
---|
151 | # else |
---|
152 | # define MOREINFO "Try `%s -h' for more information.\n" |
---|
153 | int c = getopt(argc, argv, OPTSTR); |
---|
154 | # endif |
---|
155 | if(c == -1) |
---|
156 | break; |
---|
157 | |
---|
158 | switch(c) |
---|
159 | { |
---|
160 | case 'A': /* --autoinc */ |
---|
161 | setenv("ZZUF_AUTOINC", "1", 1); |
---|
162 | break; |
---|
163 | case 'B': /* --max-bytes */ |
---|
164 | maxbytes = atoi(optarg); |
---|
165 | break; |
---|
166 | case 'c': /* --cmdline */ |
---|
167 | cmdline = 1; |
---|
168 | break; |
---|
169 | case 'C': /* --max-crashes */ |
---|
170 | maxcrashes = atoi(optarg); |
---|
171 | if(maxcrashes <= 0) |
---|
172 | maxcrashes = 0; |
---|
173 | break; |
---|
174 | case 'd': /* --debug */ |
---|
175 | setenv("ZZUF_DEBUG", "1", 1); |
---|
176 | break; |
---|
177 | case 'D': /* --delay */ |
---|
178 | delay = (int64_t)(atof(optarg) * 1000000.0); |
---|
179 | break; |
---|
180 | case 'E': /* --exclude */ |
---|
181 | exclude = merge_regex(exclude, optarg); |
---|
182 | if(!exclude) |
---|
183 | { |
---|
184 | printf("%s: invalid regex -- `%s'\n", argv[0], optarg); |
---|
185 | return EXIT_FAILURE; |
---|
186 | } |
---|
187 | break; |
---|
188 | case 'F': /* --max-forks */ |
---|
189 | maxforks = atoi(optarg) > 1 ? atoi(optarg) : 1; |
---|
190 | break; |
---|
191 | case 'i': /* --stdin */ |
---|
192 | setenv("ZZUF_STDIN", "1", 1); |
---|
193 | break; |
---|
194 | case 'I': /* --include */ |
---|
195 | include = merge_regex(include, optarg); |
---|
196 | if(!include) |
---|
197 | { |
---|
198 | printf("%s: invalid regex -- `%s'\n", argv[0], optarg); |
---|
199 | return EXIT_FAILURE; |
---|
200 | } |
---|
201 | break; |
---|
202 | case 'm': /* --md5 */ |
---|
203 | md5 = 1; |
---|
204 | break; |
---|
205 | case 'M': /* --max-memory */ |
---|
206 | setenv("ZZUF_MEMORY", "1", 1); |
---|
207 | maxmem = atoi(optarg); |
---|
208 | break; |
---|
209 | case 'n': /* --network */ |
---|
210 | setenv("ZZUF_NETWORK", "1", 1); |
---|
211 | break; |
---|
212 | case 'P': /* --protect */ |
---|
213 | protect = optarg; |
---|
214 | break; |
---|
215 | case 'q': /* --quiet */ |
---|
216 | quiet = 1; |
---|
217 | break; |
---|
218 | case 'r': /* --ratio */ |
---|
219 | parser = strchr(optarg, ':'); |
---|
220 | ratio = atof(optarg); |
---|
221 | endratio = parser ? atof(parser + 1) : ratio; |
---|
222 | break; |
---|
223 | case 'R': /* --refuse */ |
---|
224 | refuse = optarg; |
---|
225 | break; |
---|
226 | case 's': /* --seed */ |
---|
227 | parser = strchr(optarg, ':'); |
---|
228 | seed = atol(optarg); |
---|
229 | endseed = parser ? (uint32_t)atoi(parser + 1) : seed + 1; |
---|
230 | break; |
---|
231 | case 'S': /* --signal */ |
---|
232 | setenv("ZZUF_SIGNAL", "1", 1); |
---|
233 | break; |
---|
234 | case 'T': /* --max-time */ |
---|
235 | maxtime = (int64_t)(atof(optarg) * 1000000.0); |
---|
236 | break; |
---|
237 | case 'x': /* --check-exit */ |
---|
238 | checkexit = 1; |
---|
239 | break; |
---|
240 | case 'v': /* --verbose */ |
---|
241 | verbose = 1; |
---|
242 | break; |
---|
243 | case 'h': /* --help */ |
---|
244 | usage(); |
---|
245 | return 0; |
---|
246 | case 'V': /* --version */ |
---|
247 | version(); |
---|
248 | return 0; |
---|
249 | default: |
---|
250 | printf("%s: invalid option -- %c\n", argv[0], c); |
---|
251 | printf(MOREINFO, argv[0]); |
---|
252 | return EXIT_FAILURE; |
---|
253 | } |
---|
254 | } |
---|
255 | #else |
---|
256 | # define MOREINFO "Usage: %s message...\n" |
---|
257 | int optind = 1; |
---|
258 | #endif |
---|
259 | |
---|
260 | /* If asked to read from the standard input */ |
---|
261 | if(optind >= argc) |
---|
262 | { |
---|
263 | if(endseed != seed + 1) |
---|
264 | { |
---|
265 | printf("%s: seed ranges are incompatible with stdin fuzzing\n", |
---|
266 | argv[0]); |
---|
267 | printf(MOREINFO, argv[0]); |
---|
268 | return EXIT_FAILURE; |
---|
269 | } |
---|
270 | |
---|
271 | _zz_setseed(seed); |
---|
272 | _zz_setratio(ratio); |
---|
273 | |
---|
274 | loop_stdin(); |
---|
275 | |
---|
276 | return EXIT_SUCCESS; |
---|
277 | } |
---|
278 | |
---|
279 | /* If asked to launch programs */ |
---|
280 | if(cmdline) |
---|
281 | { |
---|
282 | int dashdash = 0; |
---|
283 | |
---|
284 | for(i = optind + 1; i < argc; i++) |
---|
285 | { |
---|
286 | if(dashdash) |
---|
287 | include = merge_file(include, argv[i]); |
---|
288 | else if(!strcmp("--", argv[i])) |
---|
289 | dashdash = 1; |
---|
290 | else if(argv[i][0] != '-') |
---|
291 | include = merge_file(include, argv[i]); |
---|
292 | } |
---|
293 | } |
---|
294 | |
---|
295 | if(include) |
---|
296 | setenv("ZZUF_INCLUDE", include, 1); |
---|
297 | if(exclude) |
---|
298 | setenv("ZZUF_EXCLUDE", exclude, 1); |
---|
299 | if(protect) |
---|
300 | setenv("ZZUF_PROTECT", protect, 1); |
---|
301 | if(refuse) |
---|
302 | setenv("ZZUF_REFUSE", refuse, 1); |
---|
303 | |
---|
304 | /* Allocate memory for children handling */ |
---|
305 | child_list = malloc(maxforks * sizeof(struct child_list)); |
---|
306 | for(i = 0; i < maxforks; i++) |
---|
307 | child_list[i].status = STATUS_FREE; |
---|
308 | child_count = 0; |
---|
309 | |
---|
310 | /* Preload libzzuf.so */ |
---|
311 | set_environment(argv[0]); |
---|
312 | |
---|
313 | /* Create new argv */ |
---|
314 | newargv = malloc((argc - optind + 1) * sizeof(char *)); |
---|
315 | memcpy(newargv, argv + optind, (argc - optind) * sizeof(char *)); |
---|
316 | newargv[argc - optind] = (char *)NULL; |
---|
317 | |
---|
318 | /* Main loop */ |
---|
319 | while(child_count || seed < endseed) |
---|
320 | { |
---|
321 | /* Spawn new children, if necessary */ |
---|
322 | spawn_children(); |
---|
323 | |
---|
324 | /* Cleanup dead or dying children */ |
---|
325 | clean_children(); |
---|
326 | |
---|
327 | /* Read data from children */ |
---|
328 | read_children(); |
---|
329 | |
---|
330 | if(maxcrashes && crashes >= maxcrashes && child_count == 0) |
---|
331 | break; |
---|
332 | } |
---|
333 | |
---|
334 | /* Clean up */ |
---|
335 | free(newargv); |
---|
336 | free(child_list); |
---|
337 | |
---|
338 | return crashes ? EXIT_FAILURE : EXIT_SUCCESS; |
---|
339 | } |
---|
340 | |
---|
341 | static void loop_stdin(void) |
---|
342 | { |
---|
343 | uint8_t md5sum[16]; |
---|
344 | struct md5 *ctx = NULL; |
---|
345 | |
---|
346 | if(md5) |
---|
347 | ctx = _zz_md5_init(); |
---|
348 | |
---|
349 | if(protect) |
---|
350 | _zz_protect(protect); |
---|
351 | if(refuse) |
---|
352 | _zz_refuse(refuse); |
---|
353 | |
---|
354 | _zz_fd_init(); |
---|
355 | _zz_register(0); |
---|
356 | |
---|
357 | for(;;) |
---|
358 | { |
---|
359 | uint8_t buf[BUFSIZ]; |
---|
360 | int ret, off = 0, nw = 0; |
---|
361 | |
---|
362 | ret = read(0, buf, BUFSIZ); |
---|
363 | if(ret <= 0) |
---|
364 | break; |
---|
365 | |
---|
366 | _zz_fuzz(0, buf, ret); |
---|
367 | _zz_addpos(0, ret); |
---|
368 | |
---|
369 | if(md5) |
---|
370 | _zz_md5_add(ctx, buf, ret); |
---|
371 | else while(ret) |
---|
372 | { |
---|
373 | if((nw = write(1, buf + off, (size_t)ret)) < 0) |
---|
374 | break; |
---|
375 | ret -= nw; |
---|
376 | off += nw; |
---|
377 | } |
---|
378 | } |
---|
379 | |
---|
380 | if(md5) |
---|
381 | { |
---|
382 | _zz_md5_fini(md5sum, ctx); |
---|
383 | fprintf(stderr, "zzuf[seed=%i]: %.02x%.02x%.02x%.02x%.02x%.02x" |
---|
384 | "%.02x%.02x%.02x%.02x%.02x%.02x%.02x%.02x%.02x%.02x\n", |
---|
385 | seed, md5sum[0], md5sum[1], md5sum[2], md5sum[3], |
---|
386 | md5sum[4], md5sum[5], md5sum[6], md5sum[7], |
---|
387 | md5sum[8], md5sum[9], md5sum[10], md5sum[11], |
---|
388 | md5sum[12], md5sum[13], md5sum[14], md5sum[15]); |
---|
389 | } |
---|
390 | |
---|
391 | _zz_unregister(0); |
---|
392 | _zz_fd_fini(); |
---|
393 | } |
---|
394 | |
---|
395 | static char *merge_file(char *regex, char *file) |
---|
396 | { |
---|
397 | char *newfile = malloc(5 + 2 * strlen(file) + 1 + 1), *tmp = newfile; |
---|
398 | |
---|
399 | *tmp++ = '('; |
---|
400 | *tmp++ = '^'; |
---|
401 | *tmp++ = '|'; |
---|
402 | *tmp++ = '/'; |
---|
403 | *tmp++ = ')'; |
---|
404 | while(*file) |
---|
405 | { |
---|
406 | if(strchr("^.[$()|*+?{\\", *file)) |
---|
407 | *tmp++ = '\\'; |
---|
408 | *tmp++ = *file++; |
---|
409 | } |
---|
410 | *tmp++ = '$'; |
---|
411 | *tmp++ = '\0'; |
---|
412 | |
---|
413 | tmp = merge_regex(regex, newfile); |
---|
414 | free(newfile); |
---|
415 | return tmp; |
---|
416 | } |
---|
417 | |
---|
418 | static char *merge_regex(char *regex, char *string) |
---|
419 | { |
---|
420 | regex_t optre; |
---|
421 | |
---|
422 | if(regex) |
---|
423 | { |
---|
424 | regex = realloc(regex, strlen(regex) + strlen(string) + 1 + 1); |
---|
425 | sprintf(regex + strlen(regex) - 1, "|%s)", string); |
---|
426 | } |
---|
427 | else |
---|
428 | { |
---|
429 | regex = malloc(1 + strlen(string) + 1 + 1); |
---|
430 | sprintf(regex, "(%s)", string); |
---|
431 | } |
---|
432 | |
---|
433 | if(regcomp(&optre, regex, REG_EXTENDED) != 0) |
---|
434 | { |
---|
435 | free(regex); |
---|
436 | return NULL; |
---|
437 | } |
---|
438 | regfree(&optre); |
---|
439 | |
---|
440 | return regex; |
---|
441 | } |
---|
442 | |
---|
443 | static void spawn_children(void) |
---|
444 | { |
---|
445 | static int const files[] = { DEBUG_FILENO, STDERR_FILENO, STDOUT_FILENO }; |
---|
446 | char buf[64]; |
---|
447 | int fd[3][2]; |
---|
448 | int64_t now = _zz_time(); |
---|
449 | pid_t pid; |
---|
450 | int i, j; |
---|
451 | |
---|
452 | if(child_count == maxforks) |
---|
453 | return; /* no slot */ |
---|
454 | |
---|
455 | if(seed == endseed) |
---|
456 | return; /* job finished */ |
---|
457 | |
---|
458 | if(maxcrashes && crashes >= maxcrashes) |
---|
459 | return; /* all jobs crashed */ |
---|
460 | |
---|
461 | if(delay > 0 && lastlaunch + delay > now) |
---|
462 | return; /* too early */ |
---|
463 | |
---|
464 | /* Find the empty slot */ |
---|
465 | for(i = 0; i < maxforks; i++) |
---|
466 | if(child_list[i].status == STATUS_FREE) |
---|
467 | break; |
---|
468 | |
---|
469 | /* Prepare communication pipe */ |
---|
470 | for(j = 0; j < 3; j++) |
---|
471 | if(pipe(fd[j]) == -1) |
---|
472 | { |
---|
473 | perror("pipe"); |
---|
474 | return; |
---|
475 | } |
---|
476 | |
---|
477 | /* Fork and launch child */ |
---|
478 | pid = fork(); |
---|
479 | switch(pid) |
---|
480 | { |
---|
481 | case -1: |
---|
482 | perror("fork"); |
---|
483 | return; |
---|
484 | case 0: |
---|
485 | /* We’re the child */ |
---|
486 | if(maxmem >= 0) |
---|
487 | { |
---|
488 | struct rlimit rlim; |
---|
489 | rlim.rlim_cur = maxmem * 1000000; |
---|
490 | rlim.rlim_max = maxmem * 1000000; |
---|
491 | setrlimit(RLIMIT_AS, &rlim); |
---|
492 | } |
---|
493 | |
---|
494 | /* We loop in reverse order so that files[0] is done last, |
---|
495 | * just in case one of the other dup2()ed fds had the value */ |
---|
496 | for(j = 3; j--; ) |
---|
497 | { |
---|
498 | close(fd[j][0]); |
---|
499 | if(fd[j][1] != files[j]) |
---|
500 | { |
---|
501 | dup2(fd[j][1], files[j]); |
---|
502 | close(fd[j][1]); |
---|
503 | } |
---|
504 | } |
---|
505 | |
---|
506 | /* Set environment variables */ |
---|
507 | sprintf(buf, "%i", seed); |
---|
508 | setenv("ZZUF_SEED", buf, 1); |
---|
509 | sprintf(buf, "%g", ratio); |
---|
510 | setenv("ZZUF_RATIO", buf, 1); |
---|
511 | |
---|
512 | /* Run our process */ |
---|
513 | if(execvp(newargv[0], newargv)) |
---|
514 | { |
---|
515 | perror(newargv[0]); |
---|
516 | exit(EXIT_FAILURE); |
---|
517 | } |
---|
518 | return; |
---|
519 | } |
---|
520 | |
---|
521 | if(verbose) |
---|
522 | fprintf(stderr, "zzuf[seed=%i]: launched %s\n", seed, newargv[0]); |
---|
523 | |
---|
524 | /* We’re the parent, acknowledge spawn */ |
---|
525 | child_list[i].date = now; |
---|
526 | child_list[i].pid = pid; |
---|
527 | for(j = 0; j < 3; j++) |
---|
528 | { |
---|
529 | close(fd[j][1]); |
---|
530 | child_list[i].fd[j] = fd[j][0]; |
---|
531 | } |
---|
532 | child_list[i].bytes = 0; |
---|
533 | child_list[i].seed = seed; |
---|
534 | child_list[i].status = STATUS_RUNNING; |
---|
535 | if(md5) |
---|
536 | child_list[i].ctx = _zz_md5_init(); |
---|
537 | |
---|
538 | lastlaunch = now; |
---|
539 | child_count++; |
---|
540 | seed++; |
---|
541 | } |
---|
542 | |
---|
543 | static void clean_children(void) |
---|
544 | { |
---|
545 | int64_t now = _zz_time(); |
---|
546 | int i, j; |
---|
547 | |
---|
548 | /* Terminate children if necessary */ |
---|
549 | for(i = 0; i < maxforks; i++) |
---|
550 | { |
---|
551 | if(child_list[i].status == STATUS_RUNNING |
---|
552 | && maxbytes >= 0 && child_list[i].bytes > maxbytes) |
---|
553 | { |
---|
554 | if(verbose) |
---|
555 | fprintf(stderr, "zzuf[seed=%i]: data output exceeded," |
---|
556 | " sending SIGTERM\n", child_list[i].seed); |
---|
557 | kill(child_list[i].pid, SIGTERM); |
---|
558 | child_list[i].date = now; |
---|
559 | child_list[i].status = STATUS_SIGTERM; |
---|
560 | } |
---|
561 | |
---|
562 | if(child_list[i].status == STATUS_RUNNING |
---|
563 | && maxtime >= 0 |
---|
564 | && now > child_list[i].date + maxtime) |
---|
565 | { |
---|
566 | if(verbose) |
---|
567 | fprintf(stderr, "zzuf[seed=%i]: running time exceeded," |
---|
568 | " sending SIGTERM\n", child_list[i].seed); |
---|
569 | kill(child_list[i].pid, SIGTERM); |
---|
570 | child_list[i].date = now; |
---|
571 | child_list[i].status = STATUS_SIGTERM; |
---|
572 | } |
---|
573 | } |
---|
574 | |
---|
575 | /* Kill children if necessary (still there after 2 seconds) */ |
---|
576 | for(i = 0; i < maxforks; i++) |
---|
577 | { |
---|
578 | if(child_list[i].status == STATUS_SIGTERM |
---|
579 | && now > child_list[i].date + 2000000) |
---|
580 | { |
---|
581 | if(verbose) |
---|
582 | fprintf(stderr, "zzuf[seed=%i]: not responding," |
---|
583 | " sending SIGKILL\n", child_list[i].seed); |
---|
584 | kill(child_list[i].pid, SIGKILL); |
---|
585 | child_list[i].status = STATUS_SIGKILL; |
---|
586 | } |
---|
587 | } |
---|
588 | |
---|
589 | /* Collect dead children */ |
---|
590 | for(i = 0; i < maxforks; i++) |
---|
591 | { |
---|
592 | uint8_t md5sum[16]; |
---|
593 | int status; |
---|
594 | pid_t pid; |
---|
595 | |
---|
596 | if(child_list[i].status != STATUS_SIGKILL |
---|
597 | && child_list[i].status != STATUS_SIGTERM |
---|
598 | && child_list[i].status != STATUS_EOF) |
---|
599 | continue; |
---|
600 | |
---|
601 | pid = waitpid(child_list[i].pid, &status, WNOHANG); |
---|
602 | if(pid <= 0) |
---|
603 | continue; |
---|
604 | |
---|
605 | if(checkexit && WIFEXITED(status) && WEXITSTATUS(status)) |
---|
606 | { |
---|
607 | fprintf(stderr, "zzuf[seed=%i]: exit %i\n", |
---|
608 | child_list[i].seed, WEXITSTATUS(status)); |
---|
609 | crashes++; |
---|
610 | } |
---|
611 | else if(WIFSIGNALED(status) |
---|
612 | && !(WTERMSIG(status) == SIGTERM |
---|
613 | && child_list[i].status == STATUS_SIGTERM)) |
---|
614 | { |
---|
615 | fprintf(stderr, "zzuf[seed=%i]: signal %i%s%s\n", |
---|
616 | child_list[i].seed, WTERMSIG(status), |
---|
617 | sig2str(WTERMSIG(status)), |
---|
618 | (WTERMSIG(status) == SIGKILL && maxmem >= 0) ? |
---|
619 | " (memory exceeded?)" : ""); |
---|
620 | crashes++; |
---|
621 | } |
---|
622 | |
---|
623 | for(j = 0; j < 3; j++) |
---|
624 | if(child_list[i].fd[j] >= 0) |
---|
625 | close(child_list[i].fd[j]); |
---|
626 | |
---|
627 | if(md5) |
---|
628 | { |
---|
629 | _zz_md5_fini(md5sum, child_list[i].ctx); |
---|
630 | fprintf(stderr, "zzuf[seed=%i]: %.02x%.02x%.02x%.02x%.02x%.02x" |
---|
631 | "%.02x%.02x%.02x%.02x%.02x%.02x%.02x%.02x%.02x%.02x\n", |
---|
632 | child_list[i].seed, md5sum[0], md5sum[1], md5sum[2], |
---|
633 | md5sum[3], md5sum[4], md5sum[5], md5sum[6], md5sum[7], |
---|
634 | md5sum[8], md5sum[9], md5sum[10], md5sum[11], md5sum[12], |
---|
635 | md5sum[13], md5sum[14], md5sum[15]); |
---|
636 | } |
---|
637 | child_list[i].status = STATUS_FREE; |
---|
638 | child_count--; |
---|
639 | } |
---|
640 | } |
---|
641 | |
---|
642 | static void read_children(void) |
---|
643 | { |
---|
644 | struct timeval tv; |
---|
645 | fd_set fdset; |
---|
646 | int i, j, ret, maxfd = 0; |
---|
647 | |
---|
648 | /* Read data from all sockets */ |
---|
649 | FD_ZERO(&fdset); |
---|
650 | for(i = 0; i < maxforks; i++) |
---|
651 | { |
---|
652 | if(child_list[i].status != STATUS_RUNNING) |
---|
653 | continue; |
---|
654 | |
---|
655 | for(j = 0; j < 3; j++) |
---|
656 | ZZUF_FD_SET(child_list[i].fd[j], &fdset, maxfd); |
---|
657 | } |
---|
658 | tv.tv_sec = 0; |
---|
659 | tv.tv_usec = 1000; |
---|
660 | |
---|
661 | ret = select(maxfd + 1, &fdset, NULL, NULL, &tv); |
---|
662 | if(ret < 0) |
---|
663 | perror("select"); |
---|
664 | if(ret <= 0) |
---|
665 | return; |
---|
666 | |
---|
667 | /* XXX: cute (i, j) iterating hack */ |
---|
668 | for(i = 0, j = 0; i < maxforks; i += (j == 2), j = (j + 1) % 3) |
---|
669 | { |
---|
670 | uint8_t buf[BUFSIZ]; |
---|
671 | |
---|
672 | if(child_list[i].status != STATUS_RUNNING) |
---|
673 | continue; |
---|
674 | |
---|
675 | if(!ZZUF_FD_ISSET(child_list[i].fd[j], &fdset)) |
---|
676 | continue; |
---|
677 | |
---|
678 | ret = read(child_list[i].fd[j], buf, BUFSIZ - 1); |
---|
679 | if(ret > 0) |
---|
680 | { |
---|
681 | /* We got data */ |
---|
682 | if(j != 0) |
---|
683 | child_list[i].bytes += ret; |
---|
684 | |
---|
685 | if(md5 && j == 2) |
---|
686 | _zz_md5_add(child_list[i].ctx, buf, ret); |
---|
687 | else if(!quiet || j == 0) |
---|
688 | write((j < 2) ? STDERR_FILENO : STDOUT_FILENO, buf, ret); |
---|
689 | } |
---|
690 | else if(ret == 0) |
---|
691 | { |
---|
692 | /* End of file reached */ |
---|
693 | close(child_list[i].fd[j]); |
---|
694 | child_list[i].fd[j] = -1; |
---|
695 | |
---|
696 | if(child_list[i].fd[0] == -1 && child_list[i].fd[1] == -1 |
---|
697 | && child_list[i].fd[2] == -1) |
---|
698 | child_list[i].status = STATUS_EOF; |
---|
699 | } |
---|
700 | } |
---|
701 | } |
---|
702 | |
---|
703 | static char const *sig2str(int signum) |
---|
704 | { |
---|
705 | switch(signum) |
---|
706 | { |
---|
707 | case SIGABRT: return " (SIGABRT)"; |
---|
708 | case SIGFPE: return " (SIGFPE)"; |
---|
709 | case SIGILL: return " (SIGILL)"; |
---|
710 | case SIGQUIT: return " (SIGQUIT)"; |
---|
711 | case SIGSEGV: return " (SIGSEGV)"; |
---|
712 | case SIGTRAP: return " (SIGTRAP)"; |
---|
713 | #ifdef SIGSYS |
---|
714 | case SIGSYS: return " (SIGSYS)"; |
---|
715 | #endif |
---|
716 | #ifdef SIGEMT |
---|
717 | case SIGEMT: return " (SIGEMT)"; |
---|
718 | #endif |
---|
719 | #ifdef SIGBUS |
---|
720 | case SIGBUS: return " (SIGBUS)"; |
---|
721 | #endif |
---|
722 | #ifdef SIGXCPU |
---|
723 | case SIGXCPU: return " (SIGXCPU)"; |
---|
724 | #endif |
---|
725 | #ifdef SIGXFSZ |
---|
726 | case SIGXFSZ: return " (SIGXFSZ)"; |
---|
727 | #endif |
---|
728 | } |
---|
729 | |
---|
730 | return ""; |
---|
731 | } |
---|
732 | |
---|
733 | static void set_environment(char const *progpath) |
---|
734 | { |
---|
735 | char *libpath, *tmp; |
---|
736 | int ret, len = strlen(progpath); |
---|
737 | #if defined __APPLE__ |
---|
738 | # define FILENAME "libzzuf.dylib" |
---|
739 | # define EXTRAINFO "" |
---|
740 | # define PRELOAD "DYLD_INSERT_LIBRARIES" |
---|
741 | setenv("DYLD_FORCE_FLAT_NAMESPACE", "1", 1); |
---|
742 | #elif defined __osf__ |
---|
743 | # define FILENAME "libzzuf.so" |
---|
744 | # define EXTRAINFO ":DEFAULT" |
---|
745 | # define PRELOAD "_RLD_LIST" |
---|
746 | #else |
---|
747 | # define FILENAME "libzzuf.so" |
---|
748 | # define EXTRAINFO "" |
---|
749 | # define PRELOAD "LD_PRELOAD" |
---|
750 | #endif |
---|
751 | |
---|
752 | libpath = malloc(len + strlen("/.libs/" FILENAME EXTRAINFO) + 1); |
---|
753 | strcpy(libpath, progpath); |
---|
754 | |
---|
755 | tmp = strrchr(libpath, '/'); |
---|
756 | strcpy(tmp ? tmp + 1 : libpath, ".libs/" FILENAME); |
---|
757 | ret = access(libpath, R_OK); |
---|
758 | |
---|
759 | strcpy(tmp ? tmp + 1 : libpath, ".libs/" FILENAME EXTRAINFO); |
---|
760 | if(ret == 0) |
---|
761 | setenv(PRELOAD, libpath, 1); |
---|
762 | else |
---|
763 | setenv(PRELOAD, LIBDIR "/" FILENAME EXTRAINFO, 1); |
---|
764 | free(libpath); |
---|
765 | } |
---|
766 | |
---|
767 | static void version(void) |
---|
768 | { |
---|
769 | printf("zzuf %s\n", VERSION); |
---|
770 | printf("Copyright (C) 2002, 2007 Sam Hocevar <sam@zoy.org>\n"); |
---|
771 | printf("This is free software. You may redistribute copies of it under the\n"); |
---|
772 | printf("terms of the Do What The Fuck You Want To Public License, Version 2\n"); |
---|
773 | printf("<http://sam.zoy.org/wtfpl/>.\n"); |
---|
774 | printf("There is NO WARRANTY, to the extent permitted by law.\n"); |
---|
775 | printf("\n"); |
---|
776 | printf("Written by Sam Hocevar. Report bugs to <sam@zoy.org>.\n"); |
---|
777 | } |
---|
778 | |
---|
779 | #if defined(HAVE_GETOPT_H) |
---|
780 | static void usage(void) |
---|
781 | { |
---|
782 | printf("Usage: zzuf [-AcdimnqSvx] [-r ratio] [-s seed | -s start:stop]\n"); |
---|
783 | printf(" [-D delay] [-F forks] [-C crashes] [-B bytes]\n"); |
---|
784 | printf(" [-T seconds] [-M bytes] [-P protect] [-R refuse]\n"); |
---|
785 | printf(" [-I include] [-E exclude] [PROGRAM [--] [ARGS]...]\n"); |
---|
786 | # ifdef HAVE_GETOPT_LONG |
---|
787 | printf(" zzuf -h | --help\n"); |
---|
788 | printf(" zzuf -V | --version\n"); |
---|
789 | # else |
---|
790 | printf(" zzuf -h\n"); |
---|
791 | printf(" zzuf -V\n"); |
---|
792 | # endif |
---|
793 | printf("Run PROGRAM with optional arguments ARGS and fuzz its input.\n"); |
---|
794 | printf("\n"); |
---|
795 | printf("Mandatory arguments to long options are mandatory for short options too.\n"); |
---|
796 | # ifdef HAVE_GETOPT_LONG |
---|
797 | printf(" -A, --autoinc increment seed each time a new file is opened\n"); |
---|
798 | printf(" -B, --max-bytes <n> kill children that output more than <n> bytes\n"); |
---|
799 | printf(" -c, --cmdline only fuzz files specified in the command line\n"); |
---|
800 | printf(" -C, --max-crashes <n> stop after <n> children have crashed (default 1)\n"); |
---|
801 | printf(" -d, --debug print debug messages\n"); |
---|
802 | printf(" -D, --delay delay between forks\n"); |
---|
803 | printf(" -E, --exclude <regex> do not fuzz files matching <regex>\n"); |
---|
804 | printf(" -F, --max-forks <n> number of concurrent children (default 1)\n"); |
---|
805 | printf(" -i, --stdin fuzz standard input\n"); |
---|
806 | printf(" -I, --include <regex> only fuzz files matching <regex>\n"); |
---|
807 | printf(" -m, --md5 compute the output's MD5 hash\n"); |
---|
808 | printf(" -M, --max-memory <n> maximum child virtual memory size in MB\n"); |
---|
809 | printf(" -n, --network fuzz network input\n"); |
---|
810 | printf(" -P, --protect <list> protect bytes and characters in <list>\n"); |
---|
811 | printf(" -q, --quiet do not print children's messages\n"); |
---|
812 | printf(" -r, --ratio <ratio> bit fuzzing ratio (default 0.004)\n"); |
---|
813 | printf(" -R, --refuse <list> refuse bytes and characters in <list>\n"); |
---|
814 | printf(" -s, --seed <seed> random seed (default 0)\n"); |
---|
815 | printf(" --seed <start:stop> specify a seed range\n"); |
---|
816 | printf(" -S, --signal prevent children from diverting crashing signals\n"); |
---|
817 | printf(" -T, --max-time <n> kill children that run for more than <n> seconds\n"); |
---|
818 | printf(" -v, --verbose print information during the run\n"); |
---|
819 | printf(" -x, --check-exit report processes that exit with a non-zero status\n"); |
---|
820 | printf(" -h, --help display this help and exit\n"); |
---|
821 | printf(" -V, --version output version information and exit\n"); |
---|
822 | # else |
---|
823 | printf(" -A increment seed each time a new file is opened\n"); |
---|
824 | printf(" -B <n> kill children that output more than <n> bytes\n"); |
---|
825 | printf(" -c only fuzz files specified in the command line\n"); |
---|
826 | printf(" -C <n> stop after <n> children have crashed (default 1)\n"); |
---|
827 | printf(" -d print debug messages\n"); |
---|
828 | printf(" -D delay between forks\n"); |
---|
829 | printf(" -E <regex> do not fuzz files matching <regex>\n"); |
---|
830 | printf(" -F <n> number of concurrent forks (default 1)\n"); |
---|
831 | printf(" -i fuzz standard input\n"); |
---|
832 | printf(" -I <regex> only fuzz files matching <regex>\n"); |
---|
833 | printf(" -m compute the output's MD5 hash\n"); |
---|
834 | printf(" -M maximum child virtual memory size in MB\n"); |
---|
835 | printf(" -n fuzz network input\n"); |
---|
836 | printf(" -P <list> protect bytes and characters in <list>\n"); |
---|
837 | printf(" -q do not print the fuzzed application's messages\n"); |
---|
838 | printf(" -r <ratio> bit fuzzing ratio (default 0.004)\n"); |
---|
839 | printf(" -R <list> refuse bytes and characters in <list>\n"); |
---|
840 | printf(" -s <seed> random seed (default 0)\n"); |
---|
841 | printf(" <start:stop> specify a seed range\n"); |
---|
842 | printf(" -S prevent children from diverting crashing signals\n"); |
---|
843 | printf(" -T <n> kill children that run for more than <n> seconds\n"); |
---|
844 | printf(" -v print information during the run\n"); |
---|
845 | printf(" -x report processes that exit with a non-zero status\n"); |
---|
846 | printf(" -h display this help and exit\n"); |
---|
847 | printf(" -V output version information and exit\n"); |
---|
848 | # endif |
---|
849 | printf("\n"); |
---|
850 | printf("Written by Sam Hocevar. Report bugs to <sam@zoy.org>.\n"); |
---|
851 | } |
---|
852 | #endif |
---|
853 | |
---|