Commit Graph

66 Commits

Author SHA1 Message Date
Ben Wiederhake
4b4f23165f Meta+LibHTTP: Fuzz HTTP request parsing 2020-12-02 10:46:40 +01:00
Ben Wiederhake
a0f6db246e Meta: Document fuzz dump 2020-12-01 11:06:23 +01:00
Luke
030dac8c4d Lagom/Fuzzers: Add URL fuzzer 2020-11-30 11:35:16 +01:00
Luke
5c911ad4b1 Meta: Add GitHub Actions workflow for Lagom with Fuzzers
There are cases where Lagom will build with GCC but not Clang.
This often goes unnoticed for a while as we don't often build with
Clang.

However, this is now important to test in CI because of the
OSS-Fuzz integration.

Note that this only tests the build, it does not run any tests.
Note that it also only builds LagomCore, Lagom and the fuzzers.
It does not build the other programs that use Lagom.
2020-11-29 20:22:56 +01:00
Nico Weber
29e4dc7634 Lagom: Mention OSS-Fuzz in ReadMe
We added OSS-Fuzz integration in #4154, but documentation about it
is spread across several pull requests, IRC, and issues. Let's collect
the important bits in the ReadMe.
2020-11-29 20:22:09 +01:00
AnotherTest
1ecea2f105 Lagom: Add a Shell parser fuzzer 2020-11-29 16:22:44 +01:00
Linus Groh
6a37285d93 Lagom: Add Regex fuzzers 2020-11-29 09:29:26 +01:00
DavidKorczynski
ff8ac60184
Lagom: Various fixes to make Lagom run on OSS-Fuzz (#4176) 2020-11-27 23:57:02 +01:00
Emanuel Sprung
55450055d8 LibRegex: Add a regular expression library
This commit is a mix of several commits, squashed into one because the
commits before 'Move regex to own Library and fix all the broken stuff'
were not fixable in any elegant way.
The commits are listed below for "historical" purposes:

- AK: Add options/flags and Errors for regular expressions

Flags can be provided for any possible flavour by adding a new scoped enum.
Handling of flags is done by templated Options class and the overloaded
'|' and '&' operators.

- AK: Add Lexer for regular expressions

The lexer parses the input and extracts tokens needed to parse a regular
expression.

- AK: Add regex Parser and PosixExtendedParser

This patchset adds a abstract parser class that can be derived to implement
different parsers. A parser produces bytecode to be executed within the
regex matcher.

- AK: Add regex matcher

This patchset adds an regex matcher based on the principles of the T-REX VM.
The bytecode pruduced by the respective Parser is put into the matcher and
the VM will recursively execute the bytecode according to the available OpCodes.
Possible improvement: the recursion could be replaced by multi threading capabilities.

To match a Regular expression, e.g. for the Posix standard regular expression matcher
use the following API:

```
Pattern<PosixExtendedParser> pattern("^.*$");
auto result = pattern.match("Well, hello friends!\nHello World!"); // Match whole needle

EXPECT(result.count == 1);
EXPECT(result.matches.at(0).view.starts_with("Well"));
EXPECT(result.matches.at(0).view.end() == "!");

result = pattern.match("Well, hello friends!\nHello World!", PosixFlags::Multiline); // Match line by line

EXPECT(result.count == 2);
EXPECT(result.matches.at(0).view == "Well, hello friends!");
EXPECT(result.matches.at(1).view == "Hello World!");

EXPECT(pattern.has_match("Well,....")); // Just check if match without a result, which saves some resources.
```

- AK: Rework regex to work with opcodes objects

This patchsets reworks the matcher to work on a more structured base.
For that an abstract OpCode class and derived classes for the specific
OpCodes have been added. The respective opcode logic is contained in
each respective execute() method.

- AK: Add benchmark for regex

- AK: Some optimization in regex for runtime and memory

- LibRegex: Move regex to own Library and fix all the broken stuff

Now regex works again and grep utility is also in place for testing.
This commit also fixes the use of regex.h in C by making `regex_t`
an opaque (-ish) type, which makes its behaviour consistent between
C and C++ compilers.
Previously, <regex.h> would've blown C compilers up, and even if it
didn't, would've caused a leak in C code, and not in C++ code (due to
the existence of `OwnPtr` inside the struct).

To make this whole ordeal easier to deal with (for now), this pulls the
definitions of `reg*()` into LibRegex.

pros:
- The circular dependency between LibC and LibRegex is broken
- Eaiser to test (without accidentally pulling in the host's libc!)

cons:
- Using any of the regex.h functions will require the user to link -lregex
- The symbols will be missing from libc, which will be a big surprise
  down the line (especially with shared libs).

Co-Authored-By: Ali Mohammad Pur <ali.mpfard@gmail.com>
2020-11-27 21:32:41 +01:00
Nico Weber
f160df123b Lagom: Rename FuzzBMP to FuzzBMPLoader 2020-11-26 09:59:46 +01:00
Nico Weber
ec4c2f971b Lagom: Make BMP fuzzer look like the other image loader fuzzers 2020-11-26 09:59:46 +01:00
Nico Weber
4f12efe191 Lagom: Add fuzzers for remaining image loaders: ICO, PNG, PBM, PGM 2020-11-26 09:59:46 +01:00
Linus Groh
4e68f179d6 Lagom: Fix FuzzJs build
This was broken with the JS::Parser::Error position changes, but I don't
actually see a reason to do anything with the parser errors here, so
let's remove it and consider simply not crashing a success. :^)
2020-11-25 20:00:23 +01:00
Nico Weber
f13a38aa4d Lagom: Add a gif loader fuzzer 2020-11-20 21:17:58 +01:00
Nico Weber
812892ef86 Lagom: Add a jpg fuzzer 2020-11-19 21:21:45 +01:00
Nico Weber
3f3a7d128b Lagom: Make fuzzer cmake less repetitive 2020-11-19 21:21:45 +01:00
Nico Weber
f5967c4745 Lagom: Add a PPM fuzzer
It finds the problem fixed in 69518bd178 but nothing else.
2020-11-19 14:04:35 +01:00
Nico Weber
39ce7251f7 Lagom: Use -fsanitize=fuzzer, not -fsanitize=fuzzer-no-link
Fuzzers don't link for me without this change.
2020-11-14 10:09:03 +01:00
Nico Weber
d775dea13c Lagom: Add a gemini fuzzer
Didn't find anything interesting, but might as well check it in.
2020-11-14 10:09:03 +01:00
Nico Weber
8ed83f9a1d Lagom: Augment fuzzing readme a bit
Recommend using asan, don't set the c compiler (c++ compiler is
sufficient), mention how to run on several cores, and how to get less
output.
2020-11-14 10:09:03 +01:00
Nico Weber
5c2e8b6189 Lagom: Add ntpquery to lagom build 2020-11-12 21:21:33 +01:00
Nico Weber
5fcd34b810 Userland: Add an "adjtime" utility
It's a thin userland wrapper around adjtime(2). It can be used
to view current pending time adjustments, and root can use it to
smoothly adjust the system time.

As far as I can tell, other systems don't have a userland utility
for this, but it seems useful. Useful enough that I'm adding it to
the lagom build so I can use it on my linux box too :)
2020-11-10 19:03:08 +01:00
Linus Groh
46cd9157cd Lagom/Fuzzers: Add a Dockerfile for FuzzilliJs
Based on Fedora. This allows building and running FuzzilliJs and Fuzzilli
itself in a Docker/Podman container.
2020-11-08 11:01:07 +01:00
Linus Groh
2c9e6585f8 Documentation: Update required GCC version to >= 10
I initially thought as long as Lagom is not built >= 9 would be fine,
but LagomCore is always built for the code generators.
2020-11-07 18:22:18 +01:00
Luke
8928607455 Lagom/Fuzzers: Add Fuzzilli version of FuzzJs
Fuzzilli is a JavaScript engine fuzzer made by googleprojectzero.

https://github.com/googleprojectzero/fuzzilli/
2020-11-07 10:09:55 +01:00
Linus Groh
21912123c4 Travis: Update host GCC to version 10
This allows us to use the latest C++20 features in programs which we
compile and run as part of Lagom.
2020-11-02 13:12:35 +01:00
AnotherTest
37c089fb7b LibTLS: (Almost) verify certificate chain against root CA certificates
Also adds a very primitive systemwide ca_certs.ini file.
2020-10-30 23:42:03 +01:00
asynts
607931268e CMake: Use CONFIGURE_DEPENDS in existing globs. 2020-10-29 11:52:47 +01:00
Ben Wiederhake
25ccd40d5a Meta: Describe how to analyze an LLVM fuzzer crash 2020-09-12 00:13:29 +02:00
Ben Wiederhake
98bfcb4b57 Meta+LibGfx: Fuzz BMP parsing 2020-09-12 00:13:29 +02:00
Ben Wiederhake
5d3c437cce LibJS: Fix start position of multi-line tokens
This broke in case of unterminated regular expressions, causing goofy location
numbers, and 'source_location_hint' to eat up all memory:

Unexpected token UnterminatedRegexLiteral. Expected statement (line: 2, column: 4294967292)
2020-09-12 00:13:29 +02:00
Andreas Kling
e002cbb06b Build: Add some -Wno-unknown-warning-option flags to CXXFLAGS
Patch from Anonymous.
2020-09-01 12:00:53 +02:00
AnotherTest
465d46c665 Meta+Userland: Run the TLS test too
While this _does_ add a point of failure, it'll be a pretty bad day when
google goes down.
And this is unlikely to put a (positive) dent in their incoming
requests, so let's just roll with it until we have our own TLS server.
2020-08-24 09:29:39 +02:00
Andreas Kling
a37331e236 Lagom: Add LibHTTP to Lagom (it builds fine without changes) 2020-08-15 00:05:45 +02:00
Nico Weber
00f658b984
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071)
If a buffer smaller than Elf32_Ehdr was passed to Image, header()
would do an out-of-bounds read.

Make parse() check for that. Make most Image methods assert that the image
is_valid(). For that to work, set m_valid early in Image::parse()
instead of only at its end.

Also reorder a few things so that the fuzzer doesn't hit (valid)
assertions, which were harmless from a security PoV but which still
allowed userspace to crash the kernel with an invalid ELF file.

Make dbgprintf()s configurable at run time so that the fuzzer doesn't
produce lots of logspam.
2020-08-10 15:55:17 +02:00
Nico Weber
700f5cfc90 Lagom: Pass -Wno-deprecated-copy to clang too
Due to Serenity's use of concepts, it now requires clang 10 or newer,
and clang 10 or newer both understands and requires
-Wno-deprecated-copy.
2020-08-09 21:13:06 +02:00
Nico Weber
9c136be08b disasm: For ELF files, disassemble .text section
Since disasm is built in lagom, this requires adding LibELF to lagom.
2020-08-09 21:12:54 +02:00
Nico Weber
a619943001 Build: Make things build with clang without needing local changes
Useful for sanitizer fuzzer builds.

clang doesn't have a -fconcepts switch (I'm guessing it just enables
concepts automatically with -std=c++2a, but I haven't checked),
and at least the version on my system doesn't understand
-Wno-deprecated-move, so pass these two flags only to gcc.
In return, disable -Woverloaded-virtual which fires in many places.

The preceding commits fixed the handful of -Wunused-private-field
warnings that clang emitted.
2020-08-04 17:42:08 +02:00
stelar7
98e18d7339 LibCompress: Add LibCompress
For now this only contains DEFLATE, and a very simple Zlib
Eventually GZip, etc. can go here as well.
2020-08-04 11:27:07 +02:00
Nico Weber
c7652a2166 Lagom: Clean up glob after puff.c -> puff.cpp rename 2020-07-29 15:11:04 +02:00
Andreas Kling
96dce6893f Lagom: Build with -std=c++2a -Wno-deprecated-copy 2020-07-27 21:54:22 +02:00
Nico Weber
3f45e9ab1e Lagom: Add LibGemini, LibGfx
They are dependencies of LibWeb and might be useful for
running test-web on GitHub actions one day.
2020-07-23 23:02:28 +02:00
Nico Weber
c22790adb2 Lagom: Add a markdown fuzzer 2020-07-14 17:45:16 +02:00
Nico Weber
417caeb14a Lagom: Add a note on how to build the fuzzers to readme 2020-07-14 17:45:16 +02:00
Matthew Olsson
b9cf7a833f LibJS/test-js: Create test-js program, prepare for test suite refactor
This moves most of the work from run-tests.sh to test-js.cpp. This way,
we have a lot more control over how the test suite runs, as well as how
it outputs. This should result in some cool functionality!

This commit also refactors test-common.js to mimic the jest library.
This should allow tests to be much more expressive :)
2020-07-06 23:40:35 +02:00
AnotherTest
639c1a1737 Shell: Build as part of Lagom as well
Bringing the Serenity Shell to your very own host system :^)
2020-07-05 15:43:14 +02:00
Matthew Olsson
e8e728454c AK: JsonParser improvements
- Parsing invalid JSON no longer asserts
    Instead of asserting when coming across malformed JSON,
    JsonParser::parse now returns an Optional<JsonValue>.
- Disallow trailing commas in JSON objects and arrays
- No longer parse 'undefined', as that is a purely JS thing
- No longer allow non-whitespace after anything consumed by the initial
  parse() call. Examples of things that were valid and no longer are:
    - undefineddfz
    - {"foo": 1}abcd
    - [1,2,3]4
- JsonObject.for_each_member now iterates in original insertion order
2020-06-13 12:43:22 +02:00
AnotherTest
40829b849a Meta: Run Crypto tests in CI
We skip the tests that are not self-contained (TLS) to avoid adding
extra variables to the tests.
2020-06-07 19:29:40 +02:00
Sergey Bugaev
80f671e16c Lagom: Fix target name 2020-06-01 17:37:44 +02:00
Andreas Kling
5f9de61bf2 Lagom: Build LibCrypto, LibTLS and test-crypto :^) 2020-05-27 12:28:39 +02:00