ispras / oss-sydr-fuzz

OSS-Sydr-Fuzz - OSS-Fuzz fork for hybrid fuzzing (fuzzer+DSE) open source software.

OSS-Sydr-Fuzz: Hybrid Fuzzing for Open Source Software

This repository is a fork of OSS-Fuzz project. OSS-Sydr-Fuzz contains open source software targets for sydr-fuzz that combines fuzzing (libFuzzer, AFL++) with the power of dynamic symbolic execution (Sydr).

Project Structure

Each open source target project provides:

• Fuzz target for libFuzzer
• Fuzz target for AFL++
• Fuzz target for Sydr
• Target built with llvm-cov
• Build script
• Dictionary
• Initial seed corpus
• Dockerfile that installs dependencies, builds targets, creates initial corpus, etc.
• Hybrid fuzzing configuration file for sydr-fuzz
• Instructions to start hybrid fuzzing

NOTE: Some listed above files may not be present or can be gathered from external repositories.

Supported Open Source Projects

Supported projects are located here. In addition to C/C++ projects Sydr-Fuzz currently supports:

• Rust: capstone-rs, image-rs, goblin, libhtp-rs, vector-rs, rust-regex, serde-json, gdb-command;
• Go: image-go;
• Python: crunch, h5py, msgspec, pillow, pytorch-py, ruamel-yaml, tensorflow-py, ultrajson;
• Java: hsqldb, json-sanitizer;
• JavaScript: fast-xml-parser, node-xml2js;
• С#: yamldotnet.

Contributing

Feel free to support new fuzz targets. The workflow is following:

1. Compose targets for libFuzzer and Sydr.
2. Prepare build script.
3. Build Dockerfile with all targets.
4. Provide sydr-fuzz configuration files.
5. Write README with commands to run fuzzing.

Trophies

The list of discovered bugs can be found here.

Cite Us

Sydr-Fuzz: Continuous Hybrid Fuzzing and Dynamic Analysis for Security Development Lifecycle [paper] [demo] [slides]

Vishnyakov A., Kuts D., Logunova V., Parygina D., Kobrin E., Savidov G., Fedotov A. Sydr-Fuzz: Continuous Hybrid Fuzzing and Dynamic Analysis for Security Development Lifecycle. 2022 Ivannikov ISPRAS Open Conference (ISPRAS), IEEE, 2022, pp. 111-123. DOI: 10.1109/ISPRAS57371.2022.10076861

@inproceedings{vishnyakov22-sydr-fuzz,
  title = {{{Sydr-Fuzz}}: Continuous Hybrid Fuzzing and Dynamic Analysis for
           Security Development Lifecycle},
  author = {Vishnyakov, Alexey and Kuts, Daniil and Logunova, Vlada and
            Parygina, Darya and Kobrin, Eli and Savidov, Georgy and Fedotov,
            Andrey},
  booktitle = {2022 Ivannikov ISPRAS Open Conference (ISPRAS)},
  pages = {111--123},
  year = {2022},
  publisher = {IEEE},
  doi = {10.1109/ISPRAS57371.2022.10076861},
}

oss-sydr-fuzz's Issues

Add missing dictionaries to Tarantool

https://github.com/tarantool/tarantool/tree/master/test/static

cc @ligurio

Where is the “sydr.zip”

Hello,
I am very excited to sydr project, but i don`t find the sydr.zip from /projects/project/README.

[openssl] harness for sydr with memory leak

Hi!

I used sydr for fuzzing openssl and discovered that all sydr harnesses lack memory freeing.
This results in a memory leak.
For example, corrected asn1_sydr.c main function looks like this:

int main(int argc, char** argv)
{
  FuzzerInitialize(&argc, &argv);
  FILE* fd = fopen(argv[1], "rb");
  if (!fd) return 1;
  fseek(fd, 0, SEEK_END);
  long fsize = ftell(fd);
  fseek(fd, 0, SEEK_SET);
  char* buffer = (char*)malloc(fsize);
  fread(buffer, 1, fsize, fd);
  fclose(fd);
  int ret = FuzzerTestOneInput((const uint8_t*)buffer, fsize);
  free(buffer); // need to prevent memory leak;
  FuzzerCleanup();
  return ret;
}

I can make a pull request with fixes to openssl, but there are similar cases in other projects.
Do I need to make a pull request with fixes?

Learning/testing the framework: Where is 'sydr.zip'?

To learn and test your framework, I see that it is necessary to have the archive file sydr.zip.
Where can I find it?

## Run Hybrid Fuzzing

Unzip Sydr (`sydr.zip`) in `projects/XXX` directory:

    $ unzip sydr.zip

Add QEMU fuzzer

Currently it's fuzzed by OSS-fuzz:

• https://www.qemu.org/docs/master/devel/fuzzing.html
• https://github.com/google/oss-fuzz/tree/master/projects/qemu

Fix Tarantool swim proto dictionaries

We should fix swim proto dictionaries format and update Tarantool commit hash.

https://github.com/tarantool/tarantool/blob/master/test/static/swim_proto_meta_fuzzer.dict
https://github.com/tarantool/tarantool/blob/master/test/static/swim_proto_member_fuzzer.dict

cc @ligurio