From 3994674279d869f1958252feb2c2387494f03b93 Mon Sep 17 00:00:00 2001 From: Jeka Pats Date: Sun, 7 Jul 2019 10:47:05 +0300 Subject: [PATCH 1/3] Add sanity test via fuzzit --- .travis.yml | 35 ++++++++++++++++++++++------------- README.md | 1 + 2 files changed, 23 insertions(+), 13 deletions(-) diff --git a/.travis.yml b/.travis.yml index c9dc29b..a7a9f45 100644 --- a/.travis.yml +++ b/.travis.yml @@ -2,28 +2,37 @@ language: cpp dist: xenial compiler: clang +branches: + only: + - master + stages: - name: Fuzzing -# if: type = cron jobs: include: - stage: Fuzzing - name: Continuous Fuzzing via Fuzzit (fuzzing daily) + name: Continuous Fuzzing via Fuzzit language: bash compiler: clang script: - - export CC=`which clang` - - export CXX=`which clang++` - - mkdir -p build - - cd build - - cmake .. -DCMAKE_BUILD_TYPE=AddressSanitizer - - make - - wget -O fuzzit https://github.com/fuzzitdev/fuzzit/releases/download/v1.2.5/fuzzit_1.2.5_Linux_x86_64 - - chmod a+x fuzzit - - ./fuzzit auth ${FUZZIT_AUTH_KEY} - - export TARGET_ID=Ba04ssna9qEd7bwN27Xz - - ./fuzzit create job --branch ${TRAVIS_BRANCH} --revision ${TRAVIS_COMMIT} ${TARGET_ID} ./fuzz/fuzz_test_string + - | + if [ "$TRAVIS_PULL_REQUEST" = "false" ]; then + export FUZZING_TYPE="fuzzing" + else + export FUZZING_TYPE="sanity" + fi + export CC=`which clang` + export CXX=`which clang++` + mkdir -p build + cd build + cmake .. -DCMAKE_BUILD_TYPE=AddressSanitizer + make + wget -O fuzzit https://github.com/fuzzitdev/fuzzit/releases/download/v1.2.5/fuzzit_1.2.5_Linux_x86_64 + chmod a+x fuzzit + ./fuzzit auth ${FUZZIT_AUTH_KEY} + export TARGET_ID=Ba04ssna9qEd7bwN27Xz + ./fuzzit create job --type ${FUZZING_TYPE} --branch ${TRAVIS_BRANCH} --revision ${TRAVIS_COMMIT} ${TARGET_ID} ./fuzz/fuzz_test_string env: global: diff --git a/README.md b/README.md index 801df4e..76cc319 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,4 @@ +[![Build Status](https://travis-ci.org/fuzzitdev/example.svg?branch=master)](https://travis-ci.org/fuzzitdev/example) ![fuzzit](https://app.fuzzit.dev/badge?org_id=hP8u8bNAda91Cnj0mKPX&branch=master) # Continuous Fuzzing Example From ab1b3396b2e7847a7ab740f59d2f45d89ff1b715 Mon Sep 17 00:00:00 2001 From: Jeka Pats Date: Sun, 7 Jul 2019 11:20:41 +0300 Subject: [PATCH 2/3] fix4 --- src/test_string.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/test_string.cpp b/src/test_string.cpp index e71cfb2..4fe74bf 100644 --- a/src/test_string.cpp +++ b/src/test_string.cpp @@ -12,7 +12,7 @@ int test_string(const char *src, size_t len) } else { if (strncmp(src, FLAG, strlen(FLAG)) == 0) { // TRIGGER HEAP OVERFLOW READ - if (src[len] == 0) { + if (src[len-1] == 0) { return -2; } return -1; From 024676222f0bb857a0811914b90d42bdc5a0914b Mon Sep 17 00:00:00 2001 From: Jeka Pats Date: Sun, 7 Jul 2019 11:26:40 +0300 Subject: [PATCH 3/3] introduce bug again by mistake --- src/test_string.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/test_string.cpp b/src/test_string.cpp index 4fe74bf..e71cfb2 100644 --- a/src/test_string.cpp +++ b/src/test_string.cpp @@ -12,7 +12,7 @@ int test_string(const char *src, size_t len) } else { if (strncmp(src, FLAG, strlen(FLAG)) == 0) { // TRIGGER HEAP OVERFLOW READ - if (src[len-1] == 0) { + if (src[len] == 0) { return -2; } return -1;