Skip to content

Commit

Permalink
Merge pull request #4 from intel/3-add-patch-for-supporting-oss-fuzz-…
Browse files Browse the repository at this point in the history
…and-adding-some-fixes-for-fuzzing-test-cases

3 add patch for supporting oss fuzz and adding some fixes for fuzzing test cases
  • Loading branch information
el-tipton authored Apr 8, 2024
2 parents ae13585 + ab0af28 commit 8bc62f9
Show file tree
Hide file tree
Showing 6 changed files with 52 additions and 77 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,7 @@ VOID
DeviceIndex = 1;
Status = CreateNewDevice (Private, DeviceIndex, 1, 0xFFFF, 0, IdentifyData1);
if (EFI_ERROR (Status)) {
FreePool (Private);
return;
}

Expand Down Expand Up @@ -145,6 +146,7 @@ VOID
DataBuffer
);
FreePool (DataBuffer);
FreePool (Private);

return;
}
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,5 @@ RunTestHarness(
Bus.Usb2Hc = Usb2Hc;

UsbBuildDescTable (&UsbDev);
}


UsbFreeDevice (&UsbDev);
}
60 changes: 30 additions & 30 deletions HBFA/UefiHostFuzzTestCasePkg/UefiHostFuzzTestCasePkg.dsc
Original file line number Diff line number Diff line change
Expand Up @@ -145,14 +145,14 @@
Tpm2DeviceStubLib|UefiHostFuzzTestCasePkg/TestStub/Tpm2DeviceLibStub/Tpm2DeviceLibStub.inf
}

UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Bus/Usb/UsbBusDxe/TestUsb.inf {
<LibraryClasses>
NULL|MdeModulePkg/Bus/Usb/UsbBusDxe/UsbBusDxe.inf
}
UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Bus/Usb/UsbBusPei/TestPeiUsb.inf {
<LibraryClasses>
NULL|MdeModulePkg/Bus/Usb/UsbBusPei/UsbBusPei.inf
}
# UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Bus/Usb/UsbBusDxe/TestUsb.inf {
# <LibraryClasses>
# NULL|MdeModulePkg/Bus/Usb/UsbBusDxe/UsbBusDxe.inf
# }
# UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Bus/Usb/UsbBusPei/TestPeiUsb.inf {
# <LibraryClasses>
# NULL|MdeModulePkg/Bus/Usb/UsbBusPei/UsbBusPei.inf
# }

UefiHostFuzzTestCasePkg/TestCase/SecurityPkg/Library/FmpAuthenticationLibPkcs7/TestFmpAuthenticationLibPkcs7.inf {
<LibraryClasses>
Expand All @@ -165,29 +165,29 @@
BaseCryptLib|UefiHostFuzzTestCasePkg/TestCase/SecurityPkg/Library/FmpAuthenticationLibRsa2048Sha256/CryptoLibStubRsa2048Sha256.inf
}

UefiHostFuzzTestCasePkg/TestCase/FatPkg/FatPei/TestPeiGpt.inf {
<LibraryClasses>
NULL|UefiHostFuzzTestCasePkg/TestCase/FatPkg/FatPei/Override/FatPei.inf
!if $(TEST_WITH_INSTRUMENT)
<BuildOptions>
MSFT: *_*_*_CC_FLAGS = "-DTEST_WITH_INSTRUMENT=TRUE"
GCC:*_*_*_CC_FLAGS = "-DTEST_WITH_INSTRUMENT=TRUE"
<LibraryClasses>
InstrumentHookLib|UefiHostFuzzTestCasePkg/TestCase/FatPkg/FatPei/InstrumentHookLibTestPeiGpt/InstrumentHookLibTestPeiGpt.inf
!endif
}
# UefiHostFuzzTestCasePkg/TestCase/FatPkg/FatPei/TestPeiGpt.inf {
# <LibraryClasses>
# NULL|UefiHostFuzzTestCasePkg/TestCase/FatPkg/FatPei/Override/FatPei.inf
#!if $(TEST_WITH_INSTRUMENT)
# <BuildOptions>
# MSFT: *_*_*_CC_FLAGS = "-DTEST_WITH_INSTRUMENT=TRUE"
# GCC:*_*_*_CC_FLAGS = "-DTEST_WITH_INSTRUMENT=TRUE"
# <LibraryClasses>
# InstrumentHookLib|UefiHostFuzzTestCasePkg/TestCase/FatPkg/FatPei/InstrumentHookLibTestPeiGpt/InstrumentHookLibTestPeiGpt.inf
#!endif
# }

UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Bus/Ata/AhciPei/TestIdentifyAtaDevice.inf{
<LibraryClasses>
NULL|UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Bus/Ata/AhciPei/Override/AhciPei.inf
IoLib|MdePkg/Library/BaseIoLibIntrinsic/BaseIoLibIntrinsic.inf
PeiServicesLib|MdePkg/Library/PeiServicesLib/PeiServicesLib.inf
LockBoxLib|MdeModulePkg/Library/LockBoxNullLib/LockBoxNullLib.inf
PeiServicesTablePointerLib|MdePkg/Library/PeiServicesTablePointerLib/PeiServicesTablePointerLib.inf
TdxLib|MdePkg/Library/TdxLib/TdxLib.inf
CcProbeLib|OvmfPkg/Library/CcProbeLib/DxeCcProbeLib.inf
RegisterFilterLib|MdePkg/Library/RegisterFilterLibNull/RegisterFilterLibNull.inf
}
# UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Bus/Ata/AhciPei/TestIdentifyAtaDevice.inf{
# <LibraryClasses>
# NULL|UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Bus/Ata/AhciPei/Override/AhciPei.inf
# IoLib|MdePkg/Library/BaseIoLibIntrinsic/BaseIoLibIntrinsic.inf
# PeiServicesLib|MdePkg/Library/PeiServicesLib/PeiServicesLib.inf
# LockBoxLib|MdeModulePkg/Library/LockBoxNullLib/LockBoxNullLib.inf
# PeiServicesTablePointerLib|MdePkg/Library/PeiServicesTablePointerLib/PeiServicesTablePointerLib.inf
# TdxLib|MdePkg/Library/TdxLib/TdxLib.inf
# CcProbeLib|OvmfPkg/Library/CcProbeLib/DxeCcProbeLib.inf
# RegisterFilterLib|MdePkg/Library/RegisterFilterLibNull/RegisterFilterLibNull.inf
# }

UefiHostFuzzTestCasePkg/TestCase/SecurityPkg/Library/DxeTpm2MeasureBootLib/TestTcg2MeasureGptTable.inf{
<LibraryClasses>
Expand Down
22 changes: 18 additions & 4 deletions HBFA/UefiHostTestTools/RunLibFuzzer.py
Original file line number Diff line number Diff line change
Expand Up @@ -322,6 +322,14 @@ def updateBuildFlags(SanitizerFlags, buildProfraw):

profrawCcCovFlag = rb'-fprofile-instr-generate -fcoverage-mapping'
profrawLdCovFlag = rb'-fprofile-instr-generate -fcoverage-mapping'
if os.getenv('LIB_FUZZING_ENGINE') is not None:
LIB_FUZZING_ENGINE = os.getenv('LIB_FUZZING_ENGINE')
else:
LIB_FUZZING_ENGINE = ''
if os.getenv('CXXFLAGS') is not None:
CXXFLAGS = os.getenv('CXXFLAGS')
else:
CXXFLAGS = ''

# Patch with appropriate coverage and sanitizer
if buildProfraw:
Expand Down Expand Up @@ -354,20 +362,26 @@ def updateBuildFlags(SanitizerFlags, buildProfraw):
rb'GCC:*_LIBFUZZER_*_CC_FLAGS = '
rb'"-DTEST_WITH_LIBFUZZER=TRUE" -O1'
rb' -fsanitize=fuzzer' +
SanitizerFlags.encode(), raw)
SanitizerFlags.encode() +
rb' ' +
CXXFLAGS.encode(), raw)
raw = re.sub(rb'GCC:\*_LIBFUZZER_\*_DLINK2_FLAGS = -fsanitize='
rb'fuzzer,address',
rb'GCC:*_LIBFUZZER_*_DLINK2_FLAGS = -fsanitize=fuzzer'
+ SanitizerFlags.encode(), raw)
+ SanitizerFlags.encode() +
rb' ' +
LIB_FUZZING_ENGINE.encode(), raw)
raw = re.sub(rb'GCC:\*_CLANG8_\*_CC_FLAGS = -O1 -fsanitize=address'
rb' -fprofile-arcs -ftest-coverage',
rb'GCC:*_CLANG8_*_CC_FLAGS = -O1 -fsanitize='
+ SanitizerFlags[1::].encode() +
rb' -fprofile-arcs -ftest-coverage', raw)
rb' -fprofile-arcs -ftest-coverage ' +
CXXFLAGS.encode(), raw)
raw = re.sub(rb'GCC:\*_CLANG8_\*_DLINK2_FLAGS = -fsanitize=address'
rb' --coverage', rb'GCC:*_CLANG8_*_DLINK2_FLAGS = '
rb'-fsanitize=' + SanitizerFlags[1::].encode() +
rb' --coverage', raw)
rb' --coverage ' +
LIB_FUZZING_ENGINE.encode(), raw)

# Write out file
fws = open(OutputBuildOptionFile, 'wb')
Expand Down
5 changes: 0 additions & 5 deletions docs/src/harness/includedfuzzharnesses.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,22 +8,19 @@ A number of fuzzing test harness cases are included in HBFA-FL. These, test-harn
| TestBmpSupportLib | HBFA/UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Library/BaseBmpSupportLib/TestBmpSupportLib.{c,inf} |
| TestPartition | HBFA/UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Universal/Disk/PartitionDxe/TestPartition.{c,inf} |
| TestUdf | HBFA/UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Universal/Disk/UdfDxe/TestUdf.{c,inf} |
| TestUsb | HBFA/UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Bus/Usb/UsbBusDxe/TestUsb.{c,inf} |
| TestPeiUsb | HBFA/UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Bus/Usb/UsbBusPei/TestPeiUsb.{c,inf} |
| TestVariableSmm | HBFA/UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Universal/Variable/RuntimeDxe/TestVariableSmm.{c,inf} |
| TestFmpAuthenticationLibPkcs7 | HBFA/UefiHostFuzzTestCasePkg/TestCase/SecurityPkg/Library/FmpAuthenticationLibPkcs7/TestFmpAuthenticationLibPkcs7.{c,inf} |
| TestFmpAuthenticationLibRsa2048Sha256 | HBFA/UefiHostFuzzTestCasePkg/TestCase/SecurityPkg/Library/FmpAuthenticationLibRsa2048Sha256/TestFmpAuthenticationLibRsa2048Sha256.{c,inf} |
| TestCapsulePei | HBFA/UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Universal/CapsulePei/Common/TestCapsulePei.{c,inf} |
| TestFileName | HBFA/UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Universal/Disk/UdfDxe/TestFileName.{c,inf} |
| TestPeiGpt | HBFA/UefiHostFuzzTestCasePkg/TestCase/FatPkg/FatPei/TestPeiGpt.{c,inf} |
| TestValidateTdxCfv | HBFA/UefiHostFuzzTestCasePkg/TestCase/OvmfPkg/EmuVariableFvbRuntimeDxe/TestValidateTdxCfv.{c,inf} |
| TestTcg2MeasureGptTable | HBFA/UefiHostFuzzTestCasePkg/TestCase/SecurityPkg/Library/DxeTpm2MeasureBootLib/TestTcg2MeasureGptTable.{c,inf} |
| TestTcg2MeasurePeImage | HBFA/UefiHostFuzzTestCasePkg/TestCase/SecurityPkg/Library/DxeTpm2MeasureBootLib/TestTcg2MeasurePeImage.{c,inf} |
| TestVirtioPciDevice | HBFA/UefiHostFuzzTestCasePkg/TestCase/OvmfPkg/VirtioPciDeviceDxe/TestVirtioPciDevice.{c,inf} |
| TestVirtio10Blk | HBFA/UefiHostFuzzTestCasePkg/TestCase/OvmfPkg/Virtio10BlkDxe/TestVirtio10Blk.{c,inf} |
| TestVirtioBlk | HBFA/UefiHostFuzzTestCasePkg/TestCase/OvmfPkg/VirtioBlkDxe/TestVirtioBlk.{c,inf} |
| TestVirtioBlkReadWrite | HBFA/UefiHostFuzzTestCasePkg/TestCase/OvmfPkg/VirtioBlkReadWrite/TestVirtioBlkReadWrite.{c,inf} |
| TestIdentifyAtaDevice | HBFA/UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Bus/Ata/AhciPei/TestIdentifyAtaDevice.{c,inf} |

Additionally, many of the test-cases make use of stub-libraries to simulate responses from function call that would interact with hardware. These libraries are included in HBFA in the relative directory:

Expand All @@ -47,7 +44,6 @@ HBFA-FL includes some seed corpus for the included test-cases. The relative loca
| TestBmpSupportLib | HBFA/UefiHostFuzzTestCasePkg/Seed/BMP/Raw
| TestPartition | HBFA/UefiHostFuzzTestCasePkg/Seed/UDF/Raw/Partition
| TestUdf | HBFA/UefiHostFuzzTestCasePkg/Seed/UDF/Raw/FileSystem
| TestUsb | HBFA/UefiHostFuzzTestCasePkg/Seed/USB/Raw
| TestPeiUsb | HBFA/UefiHostFuzzTestCasePkg/Seed/USB/Raw
| TestDxeCapsuleLibFmp | HBFA/UefiHostFuzzTestCasePkg/Seed/Capsule
| TestVariableSmm | HBFA/UefiHostFuzzTestCasePkg/Seed/VariableSmm/Raw
Expand All @@ -57,7 +53,6 @@ HBFA-FL includes some seed corpus for the included test-cases. The relative loca
| TestUpdateLockBoxFuzzLength | HBFA/UefiHostFuzzTestCasePkg/Seed/LockBox/Raw
| TestUpdateLockBoxFuzzOffset | HBFA/UefiHostFuzzTestCasePkg/Seed/LockBox/Raw
| TestFileName | HBFA/UefiHostFuzzTestCasePkg/Seed/UDF/Raw/FileName
| TestPeiGpt | HBFA/UefiHostFuzzTestCasePkg/Seed/Gpt/Raw

## Test-cases presently not included in HBFA-FL

Expand Down
35 changes: 0 additions & 35 deletions docs/src/tutorials/writingafuzzingharness.md
Original file line number Diff line number Diff line change
Expand Up @@ -1140,22 +1140,19 @@ A number of fuzzing test harness cases are included in HBFA. Carefully examining
| TestBmpSupportLib | HBFA/UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Library/BaseBmpSupportLib/TestBmpSupportLib.{c,inf} |
| TestPartition | HBFA/UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Universal/Disk/PartitionDxe/TestPartition.{c,inf} |
| TestUdf | HBFA/UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Universal/Disk/UdfDxe/TestUdf.{c,inf} |
| TestUsb | HBFA/UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Bus/Usb/UsbBusDxe/TestUsb.{c,inf} |
| TestPeiUsb | HBFA/UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Bus/Usb/UsbBusPei/TestPeiUsb.{c,inf} |
| TestVariableSmm | HBFA/UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Universal/Variable/RuntimeDxe/TestVariableSmm.{c,inf} |
| TestFmpAuthenticationLibPkcs7 | HBFA/UefiHostFuzzTestCasePkg/TestCase/SecurityPkg/Library/FmpAuthenticationLibPkcs7/TestFmpAuthenticationLibPkcs7.{c,inf} |
| TestFmpAuthenticationLibRsa2048Sha256 | HBFA/UefiHostFuzzTestCasePkg/TestCase/SecurityPkg/Library/FmpAuthenticationLibRsa2048Sha256/TestFmpAuthenticationLibRsa2048Sha256.{c,inf} |
| TestCapsulePei | HBFA/UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Universal/CapsulePei/Common/TestCapsulePei.{c,inf} |
| TestFileName | HBFA/UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Universal/Disk/UdfDxe/TestFileName.{c,inf} |
| TestPeiGpt | HBFA/UefiHostFuzzTestCasePkg/TestCase/FatPkg/FatPei/TestPeiGpt.{c,inf} |
| TestValidateTdxCfv | HBFA/UefiHostFuzzTestCasePkg/TestCase/OvmfPkg/EmuVariableFvbRuntimeDxe/TestValidateTdxCfv.{c,inf} |
| TestTcg2MeasureGptTable | HBFA/UefiHostFuzzTestCasePkg/TestCase/SecurityPkg/Library/DxeTpm2MeasureBootLib/TestTcg2MeasureGptTable.{c,inf} |
| TestTcg2MeasurePeImage | HBFA/UefiHostFuzzTestCasePkg/TestCase/SecurityPkg/Library/DxeTpm2MeasureBootLib/TestTcg2MeasurePeImage.{c,inf} |
| TestVirtioPciDevice | HBFA/UefiHostFuzzTestCasePkg/TestCase/OvmfPkg/VirtioPciDeviceDxe/TestVirtioPciDevice.{c,inf} |
| TestVirtio10Blk | HBFA/UefiHostFuzzTestCasePkg/TestCase/OvmfPkg/Virtio10BlkDxe/TestVirtio10Blk.{c,inf} |
| TestVirtioBlk | HBFA/UefiHostFuzzTestCasePkg/TestCase/OvmfPkg/VirtioBlkDxe/TestVirtioBlk.{c,inf} |
| TestVirtioBlkReadWrite | HBFA/UefiHostFuzzTestCasePkg/TestCase/OvmfPkg/VirtioBlkReadWrite/TestVirtioBlkReadWrite.{c,inf} |
| TestIdentifyAtaDevice | HBFA/UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Bus/Ata/AhciPei/TestIdentifyAtaDevice.{c,inf} |

Additionally, many of the test-cases make use of stub-libraries to simulate responses from function call that would interact with hardware. These libraries are included in HBFA in the relative directory:

Expand Down Expand Up @@ -1659,15 +1656,6 @@ Importantly, for a fuzzing test harness in HBFA, you must ensure that there is a
Tpm2DeviceStubLib|UefiHostFuzzTestCasePkg/TestStub/Tpm2DeviceLibStub/Tpm2DeviceLibStub.inf
}

UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Bus/Usb/UsbBusDxe/TestUsb.inf {
<LibraryClasses>
NULL|MdeModulePkg/Bus/Usb/UsbBusDxe/UsbBusDxe.inf
}
UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Bus/Usb/UsbBusPei/TestPeiUsb.inf {
<LibraryClasses>
NULL|MdeModulePkg/Bus/Usb/UsbBusPei/UsbBusPei.inf
}

UefiHostFuzzTestCasePkg/TestCase/SecurityPkg/Library/FmpAuthenticationLibPkcs7/TestFmpAuthenticationLibPkcs7.inf {
<LibraryClasses>
FmpAuthenticationLib|SecurityPkg/Library/FmpAuthenticationLibPkcs7/FmpAuthenticationLibPkcs7.inf
Expand All @@ -1679,18 +1667,6 @@ Importantly, for a fuzzing test harness in HBFA, you must ensure that there is a
BaseCryptLib|UefiHostFuzzTestCasePkg/TestCase/SecurityPkg/Library/FmpAuthenticationLibRsa2048Sha256/CryptoLibStubRsa2048Sha256.inf
}

UefiHostFuzzTestCasePkg/TestCase/FatPkg/FatPei/TestPeiGpt.inf {
<LibraryClasses>
NULL|UefiHostFuzzTestCasePkg/TestCase/FatPkg/FatPei/Override/FatPei.inf
!if $(TEST_WITH_INSTRUMENT)
<BuildOptions>
MSFT: *_*_*_CC_FLAGS = "-DTEST_WITH_INSTRUMENT=TRUE"
GCC:*_*_*_CC_FLAGS = "-DTEST_WITH_INSTRUMENT=TRUE"
<LibraryClasses>
InstrumentHookLib|UefiHostFuzzTestCasePkg/TestCase/FatPkg/FatPei/InstrumentHookLibTestPeiGpt/InstrumentHookLibTestPeiGpt.inf
!endif
}

UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Library/SmmLockBoxLib/UpdateLockBoxTestCase/TestUpdateLockBoxFuzzLength.inf {
<LibraryClasses>
NULL|MdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxSmmLib.inf
Expand All @@ -1699,17 +1675,6 @@ Importantly, for a fuzzing test harness in HBFA, you must ensure that there is a
<LibraryClasses>
NULL|MdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxSmmLib.inf
}
UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Bus/Ata/AhciPei/TestIdentifyAtaDevice.inf{
<LibraryClasses>
NULL|UefiHostFuzzTestCasePkg/TestCase/MdeModulePkg/Bus/Ata/AhciPei/Override/AhciPei.inf
IoLib|MdePkg/Library/BaseIoLibIntrinsic/BaseIoLibIntrinsic.inf
PeiServicesLib|MdePkg/Library/PeiServicesLib/PeiServicesLib.inf
LockBoxLib|MdeModulePkg/Library/LockBoxNullLib/LockBoxNullLib.inf
PeiServicesTablePointerLib|MdePkg/Library/PeiServicesTablePointerLib/PeiServicesTablePointerLib.inf
TdxLib|MdePkg/Library/TdxLib/TdxLib.inf
CcProbeLib|OvmfPkg/Library/CcProbeLib/DxeCcProbeLib.inf
RegisterFilterLib|MdePkg/Library/RegisterFilterLibNull/RegisterFilterLibNull.inf
}

UefiHostFuzzTestCasePkg/TestCase/OvmfPkg/Library/TdxStartupLib/TestHobList.inf {
<LibraryClasses>
Expand Down

0 comments on commit 8bc62f9

Please sign in to comment.