From aa3de5e675849840af3da697f341365201fb3b06 Mon Sep 17 00:00:00 2001 From: Re-st Date: Thu, 24 Jul 2025 16:27:05 +0900 Subject: [PATCH] [Benchmark] add some MAGMA benchmarks (libpng, libxml2, openssl, sqlite, libsndfile) --- benchmark/asn1/3bd5319-patch/Dockerfile | 32 ++++++++++++++ benchmark/asn1/3bd5319-patch/afl_driver.cpp | 31 ++++++++++++++ benchmark/asn1/3bd5319-patch/build.sh | 37 ++++++++++++++++ benchmark/asn1/3bd5319-patch/canary.c | 4 ++ benchmark/asn1/3bd5319-patch/label.json | 1 + .../a37d483-patch/Dockerfile | 32 ++++++++++++++ .../a37d483-patch/afl_driver.cpp | 31 ++++++++++++++ .../libpng_read_fuzzer/a37d483-patch/build.sh | 37 ++++++++++++++++ .../libpng_read_fuzzer/a37d483-patch/canary.c | 4 ++ .../a37d483-patch/label.json | 1 + benchmark/server/3bd5319-patch/Dockerfile | 32 ++++++++++++++ benchmark/server/3bd5319-patch/afl_driver.cpp | 31 ++++++++++++++ benchmark/server/3bd5319-patch/build.sh | 37 ++++++++++++++++ benchmark/server/3bd5319-patch/canary.c | 4 ++ benchmark/server/3bd5319-patch/label.json | 1 + .../sndfile_fuzzer/86c9f9e-patch/Dockerfile | 33 +++++++++++++++ .../86c9f9e-patch/afl_driver.cpp | 31 ++++++++++++++ .../sndfile_fuzzer/86c9f9e-patch/build.sh | 34 +++++++++++++++ .../sndfile_fuzzer/86c9f9e-patch/canary.c | 4 ++ .../sndfile_fuzzer/86c9f9e-patch/label.json | 1 + .../sqlite3_fuzz/8c43264-patch/Dockerfile | 31 ++++++++++++++ .../sqlite3_fuzz/8c43264-patch/afl_driver.cpp | 31 ++++++++++++++ benchmark/sqlite3_fuzz/8c43264-patch/build.sh | 42 +++++++++++++++++++ benchmark/sqlite3_fuzz/8c43264-patch/canary.c | 4 ++ .../sqlite3_fuzz/8c43264-patch/label.json | 1 + benchmark/xmllint/ec6e3ef-patch/Dockerfile | 34 +++++++++++++++ benchmark/xmllint/ec6e3ef-patch/build.sh | 41 ++++++++++++++++++ benchmark/xmllint/ec6e3ef-patch/canary.c | 4 ++ benchmark/xmllint/ec6e3ef-patch/label.json | 1 + 29 files changed, 607 insertions(+) create mode 100644 benchmark/asn1/3bd5319-patch/Dockerfile create mode 100644 benchmark/asn1/3bd5319-patch/afl_driver.cpp create mode 100755 benchmark/asn1/3bd5319-patch/build.sh create mode 100644 benchmark/asn1/3bd5319-patch/canary.c create mode 100644 benchmark/asn1/3bd5319-patch/label.json create mode 100644 benchmark/libpng_read_fuzzer/a37d483-patch/Dockerfile create mode 100644 benchmark/libpng_read_fuzzer/a37d483-patch/afl_driver.cpp create mode 100755 benchmark/libpng_read_fuzzer/a37d483-patch/build.sh create mode 100644 benchmark/libpng_read_fuzzer/a37d483-patch/canary.c create mode 100644 benchmark/libpng_read_fuzzer/a37d483-patch/label.json create mode 100644 benchmark/server/3bd5319-patch/Dockerfile create mode 100644 benchmark/server/3bd5319-patch/afl_driver.cpp create mode 100755 benchmark/server/3bd5319-patch/build.sh create mode 100644 benchmark/server/3bd5319-patch/canary.c create mode 100644 benchmark/server/3bd5319-patch/label.json create mode 100644 benchmark/sndfile_fuzzer/86c9f9e-patch/Dockerfile create mode 100644 benchmark/sndfile_fuzzer/86c9f9e-patch/afl_driver.cpp create mode 100755 benchmark/sndfile_fuzzer/86c9f9e-patch/build.sh create mode 100644 benchmark/sndfile_fuzzer/86c9f9e-patch/canary.c create mode 100644 benchmark/sndfile_fuzzer/86c9f9e-patch/label.json create mode 100644 benchmark/sqlite3_fuzz/8c43264-patch/Dockerfile create mode 100644 benchmark/sqlite3_fuzz/8c43264-patch/afl_driver.cpp create mode 100755 benchmark/sqlite3_fuzz/8c43264-patch/build.sh create mode 100644 benchmark/sqlite3_fuzz/8c43264-patch/canary.c create mode 100644 benchmark/sqlite3_fuzz/8c43264-patch/label.json create mode 100644 benchmark/xmllint/ec6e3ef-patch/Dockerfile create mode 100755 benchmark/xmllint/ec6e3ef-patch/build.sh create mode 100644 benchmark/xmllint/ec6e3ef-patch/canary.c create mode 100644 benchmark/xmllint/ec6e3ef-patch/label.json diff --git a/benchmark/asn1/3bd5319-patch/Dockerfile b/benchmark/asn1/3bd5319-patch/Dockerfile new file mode 100644 index 0000000..9c0b074 --- /dev/null +++ b/benchmark/asn1/3bd5319-patch/Dockerfile @@ -0,0 +1,32 @@ +FROM prosyslab/bug-bench-base + +RUN apt-get -y update +RUN apt-get -y install wget autoconf texinfo \ + git make autoconf automake libtool + +ENV PROGRAM=asn1 +ENV VERSION=3bd5319 + +RUN mkdir $PROGRAM + +ENV URL=https://github.com/openssl/openssl.git +ENV TAG_NAME="3bd5319" + +RUN git clone $URL $PROGRAM + +WORKDIR $PROGRAM +RUN git reset --hard $TAG_NAME + +RUN git clone --depth 1 --branch v1.2 https://github.com/HexHive/magma.git /tmp/magma && \ + for patch_file in /tmp/magma/targets/openssl/patches/bugs/*.patch; do \ + name=${patch_file##*/} && \ + name=${name%.patch} && \ + sed "s/%MAGMA_BUG%/$name/g" "$patch_file" | patch -p1; \ + done && \ + cp -r /tmp/magma/magma/src ../magma_src && \ + rm -rf /tmp/magma + +COPY canary.c $SRC/magma_src/ +COPY afl_driver.cpp $SRC/magma_src/ + +COPY build.sh $SRC \ No newline at end of file diff --git a/benchmark/asn1/3bd5319-patch/afl_driver.cpp b/benchmark/asn1/3bd5319-patch/afl_driver.cpp new file mode 100644 index 0000000..b413d61 --- /dev/null +++ b/benchmark/asn1/3bd5319-patch/afl_driver.cpp @@ -0,0 +1,31 @@ +#include +#include +#include + +extern "C" { + +__attribute__((weak)) +extern int LLVMFuzzerTestOneInput(const unsigned char *data, size_t size); +__attribute__((weak)) +extern int LLVMFuzzerInitialize(int *argc, char ***argv); +__attribute__((weak)) +int main(int argc, char **argv) { + if (LLVMFuzzerInitialize) + LLVMFuzzerInitialize(&argc, &argv); + for (int i = 1; i < argc; i++) { + FILE *f = fopen(argv[i], "r"); + assert(f); + fseek(f, 0, SEEK_END); + size_t len = ftell(f); + fseek(f, 0, SEEK_SET); + unsigned char *buf = (unsigned char*)malloc(len); + size_t n_read = fread(buf, 1, len, f); + fclose(f); + assert(n_read == len); + LLVMFuzzerTestOneInput(buf, len); + free(buf); + } + return 0; +} + +} \ No newline at end of file diff --git a/benchmark/asn1/3bd5319-patch/build.sh b/benchmark/asn1/3bd5319-patch/build.sh new file mode 100755 index 0000000..029a2f3 --- /dev/null +++ b/benchmark/asn1/3bd5319-patch/build.sh @@ -0,0 +1,37 @@ +#!/bin/bash +SMAKE_I_DIR="sparrow/fuzz" +BIN_PATH="fuzz/asn1" + +if [[ $1 == "haechi" ]]; then + export CC=$GCLANG_BIN + export CFLAGS="$CFLAGS -include /src/magma_src/canary.h -DMAGMA_ENABLE_CANARIES -g -O0" + export CFLAGS_FOR_CONFIG=$CFLAGS + export CFLAGS="$CFLAGS -fno-discard-value-names -Xclang -disable-O0-optnone" + + export CXX=$GCLANG_BIN++ + export CXXFLAGS="$CXXFLAGS -include /src/magma_src/canary.h -DMAGMA_ENABLE_CANARIES -g -O0" + + # Copied from magma/fuzzers/vanilla/build.sh + $CXX $CXXFLAGS -std=c++11 -c "/src/magma_src/afl_driver.cpp" -fPIC \ + -o "/src/magma_src/afl_driver.o" + $CC $CFLAGS -c /src/magma_src/canary.c -o /src/magma_src/canary.o + + export LIBS="$LIBS /src/magma_src/afl_driver.o /src/magma_src/canary.o -lstdc++" + export LDLIBS="$LIBS" + ./config --debug enable-fuzz-libfuzzer enable-fuzz-afl disable-tests -DPEDANTIC \ + -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION no-shared no-module \ + enable-tls1_3 enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-ssl3 \ + enable-ssl3-method enable-nextprotoneg enable-weak-ssl-ciphers \ + $CFLAGS_FOR_CONFIG -fno-sanitize=alignment + + $SMAKE_BIN --init + $SMAKE_BIN -j LDCMD="$CXX $CXXFLAGS" + cp $SMAKE_I_DIR/*.i $SMAKE_OUT + + $GET_BC_BIN $BIN_PATH && + llvm-dis -o $BIN_PATH.ll $BIN_PATH.bc && + opt -mem2reg -S -o $HAECHI_OUT/$(basename $BIN_PATH).ll $BIN_PATH.ll +else + echo "Unknown build target" + exit 1 +fi diff --git a/benchmark/asn1/3bd5319-patch/canary.c b/benchmark/asn1/3bd5319-patch/canary.c new file mode 100644 index 0000000..5252a14 --- /dev/null +++ b/benchmark/asn1/3bd5319-patch/canary.c @@ -0,0 +1,4 @@ +void magma_log(const char *bug, int condition) { + (void)bug; + (void)condition; +} \ No newline at end of file diff --git a/benchmark/asn1/3bd5319-patch/label.json b/benchmark/asn1/3bd5319-patch/label.json new file mode 100644 index 0000000..fe51488 --- /dev/null +++ b/benchmark/asn1/3bd5319-patch/label.json @@ -0,0 +1 @@ +[] diff --git a/benchmark/libpng_read_fuzzer/a37d483-patch/Dockerfile b/benchmark/libpng_read_fuzzer/a37d483-patch/Dockerfile new file mode 100644 index 0000000..1ecb729 --- /dev/null +++ b/benchmark/libpng_read_fuzzer/a37d483-patch/Dockerfile @@ -0,0 +1,32 @@ +FROM prosyslab/bug-bench-base + +RUN apt-get -y update +RUN apt-get -y install wget git automake pkg-config python-is-python3 libtool autogen \ + make autoconf zlib1g-dev + +ENV PROGRAM=libpng_read_fuzzer +ENV VERSION=a37d483 + +RUN mkdir $PROGRAM + +ENV URL=https://github.com/glennrp/libpng.git +ENV TAG_NAME="a37d483" + +RUN git clone $URL $PROGRAM + +WORKDIR $PROGRAM +RUN git reset --hard $TAG_NAME + +RUN git clone --depth 1 --branch v1.2 https://github.com/HexHive/magma.git /tmp/magma && \ + for patch_file in /tmp/magma/targets/libpng/patches/bugs/*.patch; do \ + name=${patch_file##*/} && \ + name=${name%.patch} && \ + sed "s/%MAGMA_BUG%/$name/g" "$patch_file" | patch -p1; \ + done && \ + cp -r /tmp/magma/magma/src ../magma_src && \ + rm -rf /tmp/magma + +COPY canary.c $SRC/magma_src/ +COPY afl_driver.cpp $SRC/magma_src/ + +COPY build.sh $SRC \ No newline at end of file diff --git a/benchmark/libpng_read_fuzzer/a37d483-patch/afl_driver.cpp b/benchmark/libpng_read_fuzzer/a37d483-patch/afl_driver.cpp new file mode 100644 index 0000000..b413d61 --- /dev/null +++ b/benchmark/libpng_read_fuzzer/a37d483-patch/afl_driver.cpp @@ -0,0 +1,31 @@ +#include +#include +#include + +extern "C" { + +__attribute__((weak)) +extern int LLVMFuzzerTestOneInput(const unsigned char *data, size_t size); +__attribute__((weak)) +extern int LLVMFuzzerInitialize(int *argc, char ***argv); +__attribute__((weak)) +int main(int argc, char **argv) { + if (LLVMFuzzerInitialize) + LLVMFuzzerInitialize(&argc, &argv); + for (int i = 1; i < argc; i++) { + FILE *f = fopen(argv[i], "r"); + assert(f); + fseek(f, 0, SEEK_END); + size_t len = ftell(f); + fseek(f, 0, SEEK_SET); + unsigned char *buf = (unsigned char*)malloc(len); + size_t n_read = fread(buf, 1, len, f); + fclose(f); + assert(n_read == len); + LLVMFuzzerTestOneInput(buf, len); + free(buf); + } + return 0; +} + +} \ No newline at end of file diff --git a/benchmark/libpng_read_fuzzer/a37d483-patch/build.sh b/benchmark/libpng_read_fuzzer/a37d483-patch/build.sh new file mode 100755 index 0000000..efd4bb7 --- /dev/null +++ b/benchmark/libpng_read_fuzzer/a37d483-patch/build.sh @@ -0,0 +1,37 @@ +#!/bin/bash +SMAKE_I_DIR="sparrow" +BIN_PATH="contrib/oss-fuzz/libpng_read_fuzzer" + +if [[ $1 == "haechi" ]]; then + export CC=$GCLANG_BIN + export CFLAGS="$CFLAGS -include ../magma_src/canary.h -DMAGMA_ENABLE_CANARIES -g -O0" + export CFLAGS="$CFLAGS -fno-discard-value-names -Xclang -disable-O0-optnone" + export CXX=$GCLANG_BIN++ + export CXXFLAGS="$CXXFLAGS -include ../magma_src/canary.h -DMAGMA_ENABLE_CANARIES -g -O0" + export CXXFLAGS="$CXXFLAGS -fno-discard-value-names -Xclang -disable-O0-optnone" + + autoreconf -f -i + ./configure --disable-shared + + # Copied from magma/fuzzers/vanilla/build.sh + $CXX $CXXFLAGS -std=c++11 -c "/src/magma_src/afl_driver.cpp" -fPIC \ + -o "/src/magma_src/afl_driver.o" + $CC $CFLAGS -c ../magma_src/canary.c -o ../magma_src/canary.o + + $SMAKE_BIN --init + $SMAKE_BIN -j libpng16.la + cp $SMAKE_I_DIR/*.i $SMAKE_OUT + + export LIBS="$LIBS /src/magma_src/afl_driver.o /src/magma_src/canary.o -lstdc++" + $CXX $CXXFLAGS -std=c++11 -I. -include cstdlib \ + $BIN_PATH.cc \ + -o $BIN_PATH \ + .libs/libpng16.a $LIBS -lz + + $GET_BC_BIN $BIN_PATH && + llvm-dis -o $BIN_PATH.ll $BIN_PATH.bc && + opt -mem2reg -S -o $HAECHI_OUT/$(basename $BIN_PATH).ll $BIN_PATH.ll +else + echo "Unknown build target" + exit 1 +fi diff --git a/benchmark/libpng_read_fuzzer/a37d483-patch/canary.c b/benchmark/libpng_read_fuzzer/a37d483-patch/canary.c new file mode 100644 index 0000000..5252a14 --- /dev/null +++ b/benchmark/libpng_read_fuzzer/a37d483-patch/canary.c @@ -0,0 +1,4 @@ +void magma_log(const char *bug, int condition) { + (void)bug; + (void)condition; +} \ No newline at end of file diff --git a/benchmark/libpng_read_fuzzer/a37d483-patch/label.json b/benchmark/libpng_read_fuzzer/a37d483-patch/label.json new file mode 100644 index 0000000..fe51488 --- /dev/null +++ b/benchmark/libpng_read_fuzzer/a37d483-patch/label.json @@ -0,0 +1 @@ +[] diff --git a/benchmark/server/3bd5319-patch/Dockerfile b/benchmark/server/3bd5319-patch/Dockerfile new file mode 100644 index 0000000..d20b760 --- /dev/null +++ b/benchmark/server/3bd5319-patch/Dockerfile @@ -0,0 +1,32 @@ +FROM prosyslab/bug-bench-base + +RUN apt-get -y update +RUN apt-get -y install wget autoconf texinfo \ + git make autoconf automake libtool + +ENV PROGRAM=server +ENV VERSION=3bd5319 + +RUN mkdir $PROGRAM + +ENV URL=https://github.com/openssl/openssl.git +ENV TAG_NAME="3bd5319" + +RUN git clone $URL $PROGRAM + +WORKDIR $PROGRAM +RUN git reset --hard $TAG_NAME + +RUN git clone --depth 1 --branch v1.2 https://github.com/HexHive/magma.git /tmp/magma && \ + for patch_file in /tmp/magma/targets/openssl/patches/bugs/*.patch; do \ + name=${patch_file##*/} && \ + name=${name%.patch} && \ + sed "s/%MAGMA_BUG%/$name/g" "$patch_file" | patch -p1; \ + done && \ + cp -r /tmp/magma/magma/src ../magma_src && \ + rm -rf /tmp/magma + +COPY canary.c $SRC/magma_src/ +COPY afl_driver.cpp $SRC/magma_src/ + +COPY build.sh $SRC \ No newline at end of file diff --git a/benchmark/server/3bd5319-patch/afl_driver.cpp b/benchmark/server/3bd5319-patch/afl_driver.cpp new file mode 100644 index 0000000..b413d61 --- /dev/null +++ b/benchmark/server/3bd5319-patch/afl_driver.cpp @@ -0,0 +1,31 @@ +#include +#include +#include + +extern "C" { + +__attribute__((weak)) +extern int LLVMFuzzerTestOneInput(const unsigned char *data, size_t size); +__attribute__((weak)) +extern int LLVMFuzzerInitialize(int *argc, char ***argv); +__attribute__((weak)) +int main(int argc, char **argv) { + if (LLVMFuzzerInitialize) + LLVMFuzzerInitialize(&argc, &argv); + for (int i = 1; i < argc; i++) { + FILE *f = fopen(argv[i], "r"); + assert(f); + fseek(f, 0, SEEK_END); + size_t len = ftell(f); + fseek(f, 0, SEEK_SET); + unsigned char *buf = (unsigned char*)malloc(len); + size_t n_read = fread(buf, 1, len, f); + fclose(f); + assert(n_read == len); + LLVMFuzzerTestOneInput(buf, len); + free(buf); + } + return 0; +} + +} \ No newline at end of file diff --git a/benchmark/server/3bd5319-patch/build.sh b/benchmark/server/3bd5319-patch/build.sh new file mode 100755 index 0000000..c45fd04 --- /dev/null +++ b/benchmark/server/3bd5319-patch/build.sh @@ -0,0 +1,37 @@ +#!/bin/bash +SMAKE_I_DIR="sparrow/fuzz" +BIN_PATH="fuzz/server" + +if [[ $1 == "haechi" ]]; then + export CC=$GCLANG_BIN + export CFLAGS="$CFLAGS -include /src/magma_src/canary.h -DMAGMA_ENABLE_CANARIES -g -O0" + export CFLAGS_FOR_CONFIG=$CFLAGS + export CFLAGS="$CFLAGS -fno-discard-value-names -Xclang -disable-O0-optnone" + + export CXX=$GCLANG_BIN++ + export CXXFLAGS="$CXXFLAGS -include /src/magma_src/canary.h -DMAGMA_ENABLE_CANARIES -g -O0" + + # Copied from magma/fuzzers/vanilla/build.sh + $CXX $CXXFLAGS -std=c++11 -c "/src/magma_src/afl_driver.cpp" -fPIC \ + -o "/src/magma_src/afl_driver.o" + $CC $CFLAGS -c /src/magma_src/canary.c -o /src/magma_src/canary.o + + export LIBS="$LIBS /src/magma_src/afl_driver.o /src/magma_src/canary.o -lstdc++" + export LDLIBS="$LIBS" + ./config --debug enable-fuzz-libfuzzer enable-fuzz-afl disable-tests -DPEDANTIC \ + -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION no-shared no-module \ + enable-tls1_3 enable-rc5 enable-md2 enable-ec_nistp_64_gcc_128 enable-ssl3 \ + enable-ssl3-method enable-nextprotoneg enable-weak-ssl-ciphers \ + $CFLAGS_FOR_CONFIG -fno-sanitize=alignment + + $SMAKE_BIN --init + $SMAKE_BIN -j LDCMD="$CXX $CXXFLAGS" + cp $SMAKE_I_DIR/*.i $SMAKE_OUT + + $GET_BC_BIN $BIN_PATH && + llvm-dis -o $BIN_PATH.ll $BIN_PATH.bc && + opt -mem2reg -S -o $HAECHI_OUT/$(basename $BIN_PATH).ll $BIN_PATH.ll +else + echo "Unknown build target" + exit 1 +fi diff --git a/benchmark/server/3bd5319-patch/canary.c b/benchmark/server/3bd5319-patch/canary.c new file mode 100644 index 0000000..5252a14 --- /dev/null +++ b/benchmark/server/3bd5319-patch/canary.c @@ -0,0 +1,4 @@ +void magma_log(const char *bug, int condition) { + (void)bug; + (void)condition; +} \ No newline at end of file diff --git a/benchmark/server/3bd5319-patch/label.json b/benchmark/server/3bd5319-patch/label.json new file mode 100644 index 0000000..fe51488 --- /dev/null +++ b/benchmark/server/3bd5319-patch/label.json @@ -0,0 +1 @@ +[] diff --git a/benchmark/sndfile_fuzzer/86c9f9e-patch/Dockerfile b/benchmark/sndfile_fuzzer/86c9f9e-patch/Dockerfile new file mode 100644 index 0000000..290d8d6 --- /dev/null +++ b/benchmark/sndfile_fuzzer/86c9f9e-patch/Dockerfile @@ -0,0 +1,33 @@ +FROM prosyslab/bug-bench-base + +RUN apt-get -y update +RUN apt-get -y install wget git automake pkg-config python-is-python3 libtool autogen + + +ENV PROGRAM=sndfile_fuzzer +ENV VERSION=86c9f9e + +RUN mkdir $PROGRAM + +ENV URL=https://github.com/libsndfile/libsndfile.git +ENV TAG_NAME="86c9f9e" + +RUN git clone $URL $PROGRAM + +WORKDIR $PROGRAM +RUN git reset --hard $TAG_NAME + +RUN git clone --depth 1 --branch v1.2 https://github.com/HexHive/magma.git /tmp/magma && \ + patch -p1 -i /tmp/magma/targets/libsndfile/patches/setup/libsndfile.patch && \ + for patch_file in /tmp/magma/targets/libsndfile/patches/bugs/*.patch; do \ + name=${patch_file##*/} && \ + name=${name%.patch} && \ + sed "s/%MAGMA_BUG%/$name/g" "$patch_file" | patch -p1; \ + done && \ + cp -r /tmp/magma/magma/src ../magma_src && \ + rm -rf /tmp/magma + +COPY canary.c $SRC/magma_src/ +COPY afl_driver.cpp $SRC/magma_src/ + +COPY build.sh $SRC \ No newline at end of file diff --git a/benchmark/sndfile_fuzzer/86c9f9e-patch/afl_driver.cpp b/benchmark/sndfile_fuzzer/86c9f9e-patch/afl_driver.cpp new file mode 100644 index 0000000..b413d61 --- /dev/null +++ b/benchmark/sndfile_fuzzer/86c9f9e-patch/afl_driver.cpp @@ -0,0 +1,31 @@ +#include +#include +#include + +extern "C" { + +__attribute__((weak)) +extern int LLVMFuzzerTestOneInput(const unsigned char *data, size_t size); +__attribute__((weak)) +extern int LLVMFuzzerInitialize(int *argc, char ***argv); +__attribute__((weak)) +int main(int argc, char **argv) { + if (LLVMFuzzerInitialize) + LLVMFuzzerInitialize(&argc, &argv); + for (int i = 1; i < argc; i++) { + FILE *f = fopen(argv[i], "r"); + assert(f); + fseek(f, 0, SEEK_END); + size_t len = ftell(f); + fseek(f, 0, SEEK_SET); + unsigned char *buf = (unsigned char*)malloc(len); + size_t n_read = fread(buf, 1, len, f); + fclose(f); + assert(n_read == len); + LLVMFuzzerTestOneInput(buf, len); + free(buf); + } + return 0; +} + +} \ No newline at end of file diff --git a/benchmark/sndfile_fuzzer/86c9f9e-patch/build.sh b/benchmark/sndfile_fuzzer/86c9f9e-patch/build.sh new file mode 100755 index 0000000..ed0845a --- /dev/null +++ b/benchmark/sndfile_fuzzer/86c9f9e-patch/build.sh @@ -0,0 +1,34 @@ +#!/bin/bash +SMAKE_I_DIR="sparrow" +BIN_PATH="ossfuzz/sndfile_fuzzer" +MAKE_PARAMS="-j" + +if [[ $1 == "haechi" ]]; then + export CC=$GCLANG_BIN + export CFLAGS="$CFLAGS -include ../magma_src/canary.h -DMAGMA_ENABLE_CANARIES \ + -g -O0 -fno-discard-value-names -Xclang -disable-O0-optnone" + export CXX=$GCLANG_BIN++ + export CXXFLAGS="$CXXFLAGS -include ../magma_src/canary.h -DMAGMA_ENABLE_CANARIES -g -O0" + + # Copied from magma/fuzzers/vanilla/build.sh + $CXX $CXXFLAGS -std=c++11 -c "/src/magma_src/afl_driver.cpp" -fPIC \ + -o "/src/magma_src/afl_driver.o" + $CC $CFLAGS -c ../magma_src/canary.c -o ../magma_src/canary.o + + export LIBS="$LIBS /src/magma_src/afl_driver.o /src/magma_src/canary.o -lstdc++" + ./autogen.sh + ./configure --disable-shared --enable-ossfuzzers + + $SMAKE_BIN --init + $SMAKE_BIN $MAKE_PARAMS + cp $SMAKE_I_DIR/src/*.i $SMAKE_OUT + cp $SMAKE_I_DIR/ossfuzz/*.ii $SMAKE_OUT + + $GET_BC_BIN $BIN_PATH && + llvm-dis -o $BIN_PATH.ll $BIN_PATH.bc && + opt -mem2reg -S -o $HAECHI_OUT/$(basename $BIN_PATH).ll $BIN_PATH.ll + +else + echo "Unknown build target" + exit 1 +fi diff --git a/benchmark/sndfile_fuzzer/86c9f9e-patch/canary.c b/benchmark/sndfile_fuzzer/86c9f9e-patch/canary.c new file mode 100644 index 0000000..5252a14 --- /dev/null +++ b/benchmark/sndfile_fuzzer/86c9f9e-patch/canary.c @@ -0,0 +1,4 @@ +void magma_log(const char *bug, int condition) { + (void)bug; + (void)condition; +} \ No newline at end of file diff --git a/benchmark/sndfile_fuzzer/86c9f9e-patch/label.json b/benchmark/sndfile_fuzzer/86c9f9e-patch/label.json new file mode 100644 index 0000000..fe51488 --- /dev/null +++ b/benchmark/sndfile_fuzzer/86c9f9e-patch/label.json @@ -0,0 +1 @@ +[] diff --git a/benchmark/sqlite3_fuzz/8c43264-patch/Dockerfile b/benchmark/sqlite3_fuzz/8c43264-patch/Dockerfile new file mode 100644 index 0000000..598c6a6 --- /dev/null +++ b/benchmark/sqlite3_fuzz/8c43264-patch/Dockerfile @@ -0,0 +1,31 @@ +FROM prosyslab/bug-bench-base + +RUN apt-get -y update +RUN apt-get -y install wget \ + make autoconf automake libtool curl tcl zlib1g-dev + +ENV PROGRAM=sqlite3_fuzz + +RUN mkdir $PROGRAM + +ENV URL=https://www.sqlite.org/src/tarball/sqlite.tar.gz?r=8c432642572c8c4b + +RUN wget $URL -O sqlite.tar.gz +RUN tar -xzvf sqlite.tar.gz -C $PROGRAM --strip-components 1 + +WORKDIR $PROGRAM + +RUN git clone --depth 1 --branch v1.2 https://github.com/HexHive/magma.git /tmp/magma && \ + patch -p1 -i /tmp/magma/targets/sqlite3/patches/setup/tclexec-ignore-stderr.patch && \ + for patch_file in /tmp/magma/targets/sqlite3/patches/bugs/*.patch; do \ + name=${patch_file##*/} && \ + name=${name%.patch} && \ + sed "s/%MAGMA_BUG%/$name/g" "$patch_file" | patch -p1; \ + done && \ + cp -r /tmp/magma/magma/src ../magma_src && \ + rm -rf /tmp/magma + +COPY canary.c $SRC/magma_src/ +COPY afl_driver.cpp $SRC/magma_src/ + +COPY build.sh $SRC \ No newline at end of file diff --git a/benchmark/sqlite3_fuzz/8c43264-patch/afl_driver.cpp b/benchmark/sqlite3_fuzz/8c43264-patch/afl_driver.cpp new file mode 100644 index 0000000..b413d61 --- /dev/null +++ b/benchmark/sqlite3_fuzz/8c43264-patch/afl_driver.cpp @@ -0,0 +1,31 @@ +#include +#include +#include + +extern "C" { + +__attribute__((weak)) +extern int LLVMFuzzerTestOneInput(const unsigned char *data, size_t size); +__attribute__((weak)) +extern int LLVMFuzzerInitialize(int *argc, char ***argv); +__attribute__((weak)) +int main(int argc, char **argv) { + if (LLVMFuzzerInitialize) + LLVMFuzzerInitialize(&argc, &argv); + for (int i = 1; i < argc; i++) { + FILE *f = fopen(argv[i], "r"); + assert(f); + fseek(f, 0, SEEK_END); + size_t len = ftell(f); + fseek(f, 0, SEEK_SET); + unsigned char *buf = (unsigned char*)malloc(len); + size_t n_read = fread(buf, 1, len, f); + fclose(f); + assert(n_read == len); + LLVMFuzzerTestOneInput(buf, len); + free(buf); + } + return 0; +} + +} \ No newline at end of file diff --git a/benchmark/sqlite3_fuzz/8c43264-patch/build.sh b/benchmark/sqlite3_fuzz/8c43264-patch/build.sh new file mode 100755 index 0000000..a883977 --- /dev/null +++ b/benchmark/sqlite3_fuzz/8c43264-patch/build.sh @@ -0,0 +1,42 @@ +#!/usr/bin/env bash +SMAKE_I_DIR="sparrow/sqlite3" +BIN_PATH="sqlite3" +MAKE_PARAMS="-j" +export CFLAGS="$CFLAGS -DSQLITE_MAX_LENGTH=128000000 \ + -DSQLITE_MAX_SQL_LENGTH=128000000 \ + -DSQLITE_MAX_MEMORY=25000000 \ + -DSQLITE_PRINTF_PRECISION_LIMIT=1048576 \ + -DSQLITE_DEBUG=1 \ + -DSQLITE_MAX_PAGE_COUNT=16384" + +if [[ $1 == "haechi" ]]; then + export CC=$GCLANG_BIN + export CFLAGS="$CFLAGS -include ../magma_src/canary.h -DMAGMA_ENABLE_CANARIES \ + -g -O0 -fno-discard-value-names -Xclang -disable-O0-optnone" + export CXX=$GCLANG_BIN++ + export CXXFLAGS="$CXXFLAGS -include ../magma_src/canary.h -DMAGMA_ENABLE_CANARIES -g -O0" + + # Copied from magma/fuzzers/vanilla/build.sh + $CXX $CXXFLAGS -std=c++11 -c "/src/magma_src/afl_driver.cpp" -fPIC \ + -o "/src/magma_src/afl_driver.o" + $CC $CFLAGS -c ../magma_src/canary.c -o ../magma_src/canary.o + + ./configure --disable-shared --enable-rtree + + export LIBS="$LIBS /src/magma_src/afl_driver.o /src/magma_src/canary.o -lstdc++" + $SMAKE_BIN --init + $SMAKE_BIN $MAKE_PARAMS + $SMAKE_BIN sqlite3.c + + cp $SMAKE_I_DIR/*.i $SMAKE_OUT + + $CC $CFLAGS -I. "test/ossfuzz.c" "./$BIN_PATH.o" -o $BIN_PATH \ + $LDFLAGS $LIBS -pthread -ldl -lm + + $GET_BC_BIN $BIN_PATH && + llvm-dis -o $BIN_PATH.ll $BIN_PATH.bc && + opt -mem2reg -S -o $HAECHI_OUT/$(basename $BIN_PATH).ll $BIN_PATH.ll +else + echo "Unknown build target" + exit 1 +fi diff --git a/benchmark/sqlite3_fuzz/8c43264-patch/canary.c b/benchmark/sqlite3_fuzz/8c43264-patch/canary.c new file mode 100644 index 0000000..5252a14 --- /dev/null +++ b/benchmark/sqlite3_fuzz/8c43264-patch/canary.c @@ -0,0 +1,4 @@ +void magma_log(const char *bug, int condition) { + (void)bug; + (void)condition; +} \ No newline at end of file diff --git a/benchmark/sqlite3_fuzz/8c43264-patch/label.json b/benchmark/sqlite3_fuzz/8c43264-patch/label.json new file mode 100644 index 0000000..fe51488 --- /dev/null +++ b/benchmark/sqlite3_fuzz/8c43264-patch/label.json @@ -0,0 +1 @@ +[] diff --git a/benchmark/xmllint/ec6e3ef-patch/Dockerfile b/benchmark/xmllint/ec6e3ef-patch/Dockerfile new file mode 100644 index 0000000..ead4c56 --- /dev/null +++ b/benchmark/xmllint/ec6e3ef-patch/Dockerfile @@ -0,0 +1,34 @@ +FROM prosyslab/bug-bench-base + +RUN apt-get -y update +RUN apt-get -y install wget autoconf texinfo \ + git make autoconf automake libtool pkg-config zlib1g-dev \ + liblzma-dev + +ENV PROGRAM=xmllint +ENV VERSION=ec6e3ef + +RUN mkdir $PROGRAM + +ENV URL=https://gitlab.gnome.org/GNOME/libxml2.git +ENV TAG_NAME="ec6e3ef" + +RUN git clone $URL $PROGRAM + +WORKDIR $PROGRAM +RUN git reset --hard $TAG_NAME + +RUN git clone --depth 1 --branch v1.2 https://github.com/HexHive/magma.git /tmp/magma && \ + patch -p1 -i /tmp/magma/targets/libxml2/patches/setup/libxml2.patch && \ + for patch_file in /tmp/magma/targets/libxml2/patches/bugs/*.patch; do \ + name=${patch_file##*/} && \ + name=${name%.patch} && \ + sed "s/%MAGMA_BUG%/$name/g" "$patch_file" | patch -p1; \ + done && \ + mv /tmp/magma/targets/libxml2/src ./src && \ + cp -r /tmp/magma/magma/src ../magma_src && \ + rm -rf /tmp/magma + +COPY canary.c $SRC/magma_src/ + +COPY build.sh $SRC \ No newline at end of file diff --git a/benchmark/xmllint/ec6e3ef-patch/build.sh b/benchmark/xmllint/ec6e3ef-patch/build.sh new file mode 100755 index 0000000..973ab0b --- /dev/null +++ b/benchmark/xmllint/ec6e3ef-patch/build.sh @@ -0,0 +1,41 @@ +#!/bin/bash +SMAKE_I_DIR="sparrow/xmllint" +BIN_PATH="xmllint" + +if [[ $1 == "sparrow" ]]; then + ./autogen.sh \ + --with-http=no \ + --with-python=no \ + --with-lzma=yes \ + --with-threads=no \ + --disable-shared + $SMAKE_BIN --init + $SMAKE_BIN all + cp $SMAKE_I_DIR/*.i $SMAKE_OUT +elif [[ $1 == "haechi" ]]; then + export CC=$GCLANG_BIN + export CXX=$GCLANG_BIN++ + ./autogen.sh \ + --with-http=no \ + --with-python=no \ + --with-lzma=yes \ + --with-threads=no \ + --disable-shared + export CFLAGS="$CFLAGS -include ../magma_src/canary.h -DMAGMA_ENABLE_CANARIES \ + -g -O0 -fno-discard-value-names -Xclang -disable-O0-optnone" + + $CC $CFLAGS -c ../magma_src/canary.c -o ../magma_src/canary.o + + export LIBS="$LIBS /src/magma_src/canary.o -lstdc++" + + $SMAKE_BIN --init + $SMAKE_BIN all + cp $SMAKE_I_DIR/*.i $SMAKE_OUT + + $GET_BC_BIN $BIN_PATH && + llvm-dis -o $BIN_PATH.ll $BIN_PATH.bc && + opt -mem2reg -S -o $HAECHI_OUT/$(basename $BIN_PATH).ll $BIN_PATH.ll +else + echo "Unknown build target" + exit 1 +fi diff --git a/benchmark/xmllint/ec6e3ef-patch/canary.c b/benchmark/xmllint/ec6e3ef-patch/canary.c new file mode 100644 index 0000000..5252a14 --- /dev/null +++ b/benchmark/xmllint/ec6e3ef-patch/canary.c @@ -0,0 +1,4 @@ +void magma_log(const char *bug, int condition) { + (void)bug; + (void)condition; +} \ No newline at end of file diff --git a/benchmark/xmllint/ec6e3ef-patch/label.json b/benchmark/xmllint/ec6e3ef-patch/label.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/benchmark/xmllint/ec6e3ef-patch/label.json @@ -0,0 +1 @@ +[] \ No newline at end of file