{"schema":"libjg2-1",
"vpath":"/git/",
"avatar":"/git/avatar/",
"alang":"",
"gen_ut":1748879481,
"reponame":"openssl",
"desc":"OpenSSL",
"owner": { "name": "Andy Green", "email": "andy@warmcat.com", "md5": "c50933ca2aa61e0fe2c43d46bb6b59cb" },"url":"https://warmcat.com/repo/openssl",
"f":3,
"items": [
{ "schema":"libjg2-1",
"oid":{ "oid": "50eaac9f3337667259de725451f201e784599687", "alias": [ "refs/heads/master"]},"tree": [
{ "name": "corpora","mode": "16384", "size":0},
{ "name": "README.md","mode": "33188", "size":4732},
{ "name": "asn1.c","mode": "33188", "size":10878},
{ "name": "asn1parse.c","mode": "33188", "size":1023},
{ "name": "bignum.c","mode": "33188", "size":2513},
{ "name": "bndiv.c","mode": "33188", "size":3431},
{ "name": "build.info","mode": "33188", "size":3526},
{ "name": "client.c","mode": "33188", "size":2739},
{ "name": "cms.c","mode": "33188", "size":1169},
{ "name": "conf.c","mode": "33188", "size":1017},
{ "name": "crl.c","mode": "33188", "size":1089},
{ "name": "ct.c","mode": "33188", "size":1197},
{ "name": "driver.c","mode": "33188", "size":1212},
{ "name": "fuzzer.h","mode": "33188", "size":503},
{ "name": "helper.py","mode": "33261", "size":1363},
{ "name": "mkfuzzoids.pl","mode": "33261", "size":937},
{ "name": "oids.txt","mode": "33188", "size":57286},
{ "name": "rand.inc","mode": "33188", "size":765},
{ "name": "server.c","mode": "33188", "size":36523},
{ "name": "test-corpus.c","mode": "33188", "size":2612},
{ "name": "x509.c","mode": "33188", "size":1217}],"s":{"c":1748879481,"u": 2816}}
,{"schema":"libjg2-1",
"cid":"58ccf7b7b13277ff581e4698f169a4c8",
"oid":{ "oid": "50eaac9f3337667259de725451f201e784599687", "alias": [ "refs/heads/master"]},"blobname": "fuzz/README.md", "blob": "# I Can Haz Fuzz?\n\nLibFuzzer\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nOr, how to fuzz OpenSSL with [libfuzzer](http://llvm.org/docs/LibFuzzer.html).\n\nStarting from a vanilla+OpenSSH server Ubuntu install.\n\nUse Chrome's handy recent build of clang. Older versions may also work.\n\n $ sudo apt-get install git\n $ mkdir git-work\n $ git clone https://chromium.googlesource.com/chromium/src/tools/clang\n $ clang/scripts/update.py\n\nYou may want to git pull and re-run the update from time to time.\n\nUpdate your path:\n\n $ PATH\u003d~/third_party/llvm-build/Release+Asserts/bin/:$PATH\n\nGet and build libFuzzer (there is a git mirror at\nhttps://github.com/llvm-mirror/llvm/tree/master/lib/Fuzzer if you prefer):\n\n $ cd\n $ sudo apt-get install subversion\n $ mkdir svn-work\n $ cd svn-work\n $ svn co https://llvm.org/svn/llvm-project/compiler-rt/trunk/lib/fuzzer Fuzzer\n $ cd Fuzzer\n $ clang++ -c -g -O2 -std\u003dc++11 *.cpp\n $ ar r libFuzzer.a *.o\n $ ranlib libFuzzer.a\n\nConfigure for fuzzing:\n\n $ CC\u003dclang ./config enable-fuzz-libfuzzer \u005c\n --with-fuzzer-include\u003d../../svn-work/Fuzzer \u005c\n --with-fuzzer-lib\u003d../../svn-work/Fuzzer/libFuzzer.a \u005c\n -DPEDANTIC enable-asan enable-ubsan no-shared \u005c\n -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION \u005c\n -fsanitize-coverage\u003dtrace-pc-guard,indirect-calls,trace-cmp \u005c\n enable-ec_nistp_64_gcc_128 -fno-sanitize\u003dalignment enable-tls1_3 \u005c\n enable-weak-ssl-ciphers enable-rc5 enable-md2 \u005c\n enable-ssl3 enable-ssl3-method enable-nextprotoneg \u005c\n --debug\n $ sudo apt-get install make\n $ LDCMD\u003dclang++ make -j\n $ fuzz/helper.py $FUZZER\n\nWhere $FUZZER is one of the executables in `fuzz/`.\n\nIf you get a crash, you should find a corresponding input file in\n`fuzz/corpora/$FUZZER-crash/`.\n\nAFL\n\u003d\u003d\u003d\n\nConfigure for fuzzing:\n\n $ sudo apt-get install afl-clang\n $ CC\u003dafl-clang-fast ./config enable-fuzz-afl no-shared -DPEDANTIC \u005c\n enable-tls1_3 enable-weak-ssl-ciphers enable-rc5 enable-md2 \u005c\n enable-ssl3 enable-ssl3-method enable-nextprotoneg \u005c\n enable-ec_nistp_64_gcc_128 -fno-sanitize\u003dalignment \u005c\n --debug\n $ make\n\nThe following options can also be enabled: enable-asan, enable-ubsan, enable-msan\n\nRun one of the fuzzers:\n\n $ afl-fuzz -i fuzz/corpora/$FUZZER -o fuzz/corpora/$FUZZER/out fuzz/$FUZZER\n\nWhere $FUZZER is one of the executables in `fuzz/`.\n\nReproducing issues\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nIf a fuzzer generates a reproducible error, you can reproduce the problem using\nthe fuzz/*-test binaries and the file generated by the fuzzer. They binaries\ndon't need to be build for fuzzing, there is no need to set CC or the call\nconfig with enable-fuzz-* or -fsanitize-coverage, but some of the other options\nabove might be needed. For instance the enable-asan or enable-ubsan option might\nbe useful to show you when the problem happens. For the client and server fuzzer\nit might be needed to use -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION to\nreproduce the generated random numbers.\n\nTo reproduce the crash you can run:\n\n $ fuzz/$FUZZER-test $file\n\nRandom numbers\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nThe client and server fuzzer normally generate random numbers as part of the TLS\nconnection setup. This results in the coverage of the fuzzing corpus changing\ndepending on the random numbers. This also has an effect for coverage of the\nrest of the test suite and you see the coverage change for each commit even when\nno code has been modified.\n\nSince we want to maximize the coverage of the fuzzing corpus, the client and\nserver fuzzer will use predictable numbers instead of the random numbers. This\nis controlled by the FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION define.\n\nThe coverage depends on the way the numbers are generated. We don't disable any\ncheck of hashes, but the corpus has the correct hash in it for the random\nnumbers that were generated. For instance the client fuzzer will always generate\nthe same client hello with the same random number in it, and so the server, as\nemulated by the file, can be generated for that client hello.\n\nCoverage changes\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSince the corpus depends on the default behaviour of the client and the server,\nchanges in what they send by default will have an impact on the coverage. The\ncorpus will need to be updated in that case.\n\nUpdating the corpus\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nThe client and server corpus is generated with multiple config options:\n- The options as documented above\n- Without enable-ec_nistp_64_gcc_128 and without --debug\n- With no-asm\n- Using 32 bit\n- A default config, plus options needed to generate the fuzzer.\n\nThe libfuzzer merge option is used to add the additional coverage\nfrom each config to the minimal set.\n","s":{"c":1748879481,"u": 566}}
],"g": 6222,"chitpc": 0,"ehitpc": 0,"indexed":0
,
"ab": 1, "si": 0, "db":0, "di":1, "sat":0, "lfc": "0000"}