├── .dockerignore ├── .gitignore ├── .logo.png ├── .ogharn.png ├── Dockerfile ├── LICENSE ├── README.md ├── demos ├── README.md ├── c-ares │ ├── Makefile │ ├── run_ogharn.sh │ ├── seeds_invalid │ │ ├── char │ │ ├── is1 │ │ ├── is2 │ │ └── malformed.raw │ └── seeds_valid │ │ ├── s1 │ │ ├── s2 │ │ ├── s3 │ │ ├── s4 │ │ └── s5 ├── cgltf │ ├── Makefile │ ├── config.yaml │ ├── run_ogharn.sh │ ├── seeds_invalid │ │ ├── BadBasisU.gltf │ │ ├── ToyCar.gltf │ │ └── small.gltf │ └── seeds_valid │ │ ├── s1.gltf │ │ ├── s2.gltf │ │ ├── s3.gltf │ │ └── s4.gltf ├── cjson │ ├── Makefile │ ├── run_ogharn.sh │ ├── seeds_invalid │ │ ├── invalid.json │ │ ├── is2 │ │ ├── is3 │ │ ├── is4 │ │ ├── malformed.json │ │ └── single │ └── seeds_valid │ │ ├── s1.json │ │ ├── s2.json │ │ ├── s3.json │ │ ├── s4.json │ │ └── s5.json ├── faup │ ├── Makefile │ ├── run_ogharn.sh │ ├── seeds_invalid │ │ ├── s3 │ │ ├── s4 │ │ └── small │ └── seeds_valid │ │ ├── s1 │ │ ├── s2 │ │ ├── s3 │ │ └── s4 ├── fyaml │ ├── Makefile │ ├── run_ogharn.sh │ ├── seeds_invalid │ │ ├── is3.yaml │ │ ├── is4.yaml │ │ └── small.yaml │ └── seeds_valid │ │ ├── s1.yaml │ │ ├── s2.yaml │ │ ├── s3.yaml │ │ └── s4.yaml ├── geos │ ├── Makefile │ ├── run_ogharn.sh │ ├── seeds_invalid │ │ └── seed.txt │ └── seeds_valid │ │ ├── seed1.txt │ │ └── seed5.txt ├── gpac │ ├── Makefile │ ├── patch.diff │ ├── run_ogharn.sh │ ├── seeds_invalid │ │ ├── s5.mp4 │ │ ├── s6 │ │ └── s7 │ └── seeds_valid │ │ ├── s1.mp4 │ │ ├── s2.mp4 │ │ ├── s3.mp4 │ │ └── s4.mp4 ├── hdf5 │ ├── Makefile │ ├── run_ogharn.sh │ ├── seeds_invalid │ │ ├── is1 │ │ ├── is2 │ │ ├── is3 │ │ └── is4 │ └── seeds_valid │ │ ├── s1 │ │ ├── s2 │ │ └── s3 ├── ical │ ├── Makefile │ ├── run_ogharn.sh │ ├── seeds_invalid │ │ ├── char │ │ ├── empty │ │ └── s4.ics │ └── seeds_valid │ │ ├── s1.ics │ │ ├── s2.ics │ │ ├── s3.ics │ │ └── s4.ics ├── lcms │ ├── Makefile │ ├── run_ogharn.sh │ ├── seeds_invalid │ │ ├── is1 │ │ ├── is2 │ │ └── is3 │ └── seeds_valid │ │ ├── s1 │ │ ├── s2 │ │ ├── s3 │ │ ├── s4 │ │ ├── s5 │ │ └── s7 ├── lexbor │ ├── Makefile │ ├── run_ogharn.sh │ ├── seeds_invalid │ │ ├── empty │ │ ├── s6.html │ │ ├── s7.html │ │ └── single │ └── seeds_valid │ │ ├── s1.html │ │ ├── s2.html │ │ ├── s3.html │ │ └── s4.html ├── magic │ ├── Makefile │ ├── config.yaml │ ├── run_ogharn.sh │ ├── seeds_invalid │ │ ├── is1 │ │ ├── is2 │ │ └── is3 │ └── seeds_valid │ │ ├── s1 │ │ ├── s2 │ │ ├── s3 │ │ ├── s4 │ │ └── s5 ├── openexr │ ├── Makefile │ ├── run_ogharn.sh │ ├── seeds_invalid │ │ ├── empty │ │ ├── s1.exr │ │ ├── s4.exr │ │ └── single │ └── seeds_valid │ │ ├── s1.exr │ │ ├── s2.exr │ │ ├── s3.exr │ │ └── s4.exr ├── pcap │ ├── Makefile │ ├── config.yaml │ ├── run_ogharn.sh │ ├── seeds_invalid │ │ ├── is1 │ │ ├── is2 │ │ ├── is3 │ │ └── is4 │ └── seeds_valid │ │ ├── s1 │ │ ├── s2 │ │ ├── s4 │ │ ├── s5 │ │ └── s6 ├── pcre2 │ ├── Makefile │ ├── config.yaml │ ├── run_ogharn.sh │ ├── seeds_invalid │ │ ├── is1 │ │ ├── is2 │ │ ├── is3 │ │ └── is4 │ └── seeds_valid │ │ ├── s1 │ │ ├── s2 │ │ ├── s3 │ │ └── s4 ├── raylib │ ├── Makefile │ ├── README.md │ ├── run_ogharn.sh │ ├── seeds_invalid │ │ ├── empty │ │ └── s5.png │ └── seeds_valid │ │ ├── s1.png │ │ ├── s2.png │ │ ├── s3.png │ │ ├── s4.png │ │ └── s5.png ├── sqlite │ ├── Makefile │ ├── config.yaml │ ├── run_ogharn.sh │ ├── seeds_invalid │ │ ├── s1 │ │ ├── s2 │ │ ├── s3 │ │ └── s4 │ └── seeds_valid │ │ ├── s1 │ │ ├── s2 │ │ ├── s3 │ │ ├── s4 │ │ ├── s5 │ │ ├── s6 │ │ └── s7 ├── stormlib │ ├── Makefile │ ├── run_ogharn.sh │ ├── seeds_invalid │ │ ├── invalid.SC2Replay_ │ │ ├── s3.SC2Replay │ │ └── small │ └── seeds_valid │ │ ├── s1.SC2Replay │ │ ├── s2.SC2Replay │ │ ├── s3.SC2Replay │ │ └── s4.SC2Replay ├── ucl │ ├── Makefile │ ├── run_ogharn.sh │ ├── seeds_invalid │ │ ├── s5 │ │ ├── s6.in │ │ └── s7.in │ └── seeds_valid │ │ ├── s1.in │ │ ├── s2.res │ │ ├── s3.in │ │ └── s4.in └── zlib │ ├── Makefile │ ├── config.yaml │ ├── run_ogharn.sh │ ├── seeds_invalid │ ├── is1 │ ├── is2 │ └── is3 │ └── seeds_valid │ ├── s1 │ ├── s2 │ ├── s3 │ └── s4 ├── extras ├── install_dependencies.sh ├── mult-to-c-types.txt ├── set_env.sh └── type-to-val.txt └── src ├── engine.py ├── harness_builder.py ├── ogharn.py └── process_mx.py /.dockerignore: -------------------------------------------------------------------------------- 1 | /output 2 | /demos/*/lib* 3 | extras/AFLplusplus 4 | extras/Multiplier 5 | extras/llvm.sh -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | /output 2 | /demos/*/lib* 3 | **/.DS_Store 4 | /demos/*/bin 5 | /demos/*/mx* 6 | /demos/*/out 7 | /extras/AFLplusplus 8 | /extras/llvm.sh 9 | /extras/multiplier 10 | src/__pycache__ 11 | -------------------------------------------------------------------------------- /.logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/.logo.png -------------------------------------------------------------------------------- /.ogharn.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/.ogharn.png -------------------------------------------------------------------------------- /Dockerfile: -------------------------------------------------------------------------------- 1 | FROM ubuntu:22.04 2 | FROM aflplusplus/aflplusplus:latest 3 | WORKDIR / 4 | ENV DEBIAN_FRONTEND=noninteractive 5 | 6 | # Install dependencies for multiplier 7 | RUN apt-get update \ 8 | && apt-get install -y sudo \ 9 | && apt-get install -y git \ 10 | && apt-get install --no-install-recommends -y curl gnupg software-properties-common lsb-release build-essential libgoogle-glog-dev \ 11 | && apt-get install -y tzdata \ 12 | && ln -fs /usr/share/zoneinfo/Etc/UTC /etc/localtime \ 13 | && echo "Etc/UTC" > /etc/timezone \ 14 | && dpkg-reconfigure -f noninteractive tzdata \ 15 | && sudo add-apt-repository ppa:deadsnakes/ppa \ 16 | && sudo apt install python3.12-dev python3.12-venv -y \ 17 | && sudo apt update \ 18 | && sudo apt clean all \ 19 | && wget https://apt.llvm.org/llvm.sh \ 20 | && chmod u+x llvm.sh \ 21 | && sudo ./llvm.sh 18 \ 22 | && sudo apt install lld-18 lld -y \ 23 | && wget -O - https://apt.kitware.com/keys/kitware-archive-latest.asc 2>/dev/null | gpg --dearmor - | sudo tee /etc/apt/trusted.gpg.d/kitware.gpg >/dev/null \ 24 | && sudo apt-add-repository "deb https://apt.kitware.com/ubuntu/ $(lsb_release -cs) main" \ 25 | && sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 6AF7F09730B3F0A4 \ 26 | && sudo apt update \ 27 | && apt-get install --no-install-recommends -y \ 28 | gpg zip unzip tar git \ 29 | pkg-config ninja-build ccache build-essential \ 30 | doctest-dev \ 31 | clang-18 lld-18 \ 32 | python3.11 python3.11-dev \ 33 | && curl -sS https://bootstrap.pypa.io/get-pip.py | python3.11 \ 34 | && apt-get clean \ 35 | && rm -rf /var/lib/apt/lists/* 36 | 37 | RUN wget https://github.com/Kitware/CMake/releases/download/v3.31.6/cmake-3.31.6-linux-x86_64.tar.gz \ 38 | && apt remove --purge --auto-remove cmake -y \ 39 | && tar xz -f cmake-3.31.6-linux-x86_64.tar.gz -C /opt \ 40 | && ln -s /opt/cmake-3.31.6-linux-x86_64/bin/cmake /usr/local/bin/cmake \ 41 | && ln -s /opt/cmake-3.31.6-linux-x86_64/bin/cmake /usr/bin/cmake 42 | 43 | # download and set up multiplier 44 | RUN mkdir -p /OGHarn 45 | COPY . OGHarn 46 | RUN mkdir OGHarn/extras/multiplier 47 | WORKDIR OGHarn/extras/multiplier 48 | RUN mkdir src build install 49 | 50 | RUN bash -c 'if [[ ! -f "/OGHarn/extras/multiplier/install/bin/activate" ]]; then \ 51 | python3.12 -m venv "/OGHarn/extras/multiplier/install"; \ 52 | fi && \ 53 | . "/OGHarn/extras/multiplier/install/bin/activate"' 54 | 55 | 56 | RUN git clone https://github.com/trailofbits/multiplier.git src/multiplier 57 | 58 | RUN cmake \ 59 | -DCMAKE_BUILD_TYPE=Release \ 60 | -DCMAKE_INSTALL_PREFIX="./install" \ 61 | -DCMAKE_LINKER_TYPE=LLD \ 62 | -DCMAKE_C_COMPILER="$(which clang-18)" \ 63 | -DCMAKE_CXX_COMPILER="$(which clang++-18)" \ 64 | -DMX_ENABLE_INSTALL=ON \ 65 | -DMX_ENABLE_PYTHON_BINDINGS=ON \ 66 | -DLLVM_CONFIG=/usr/bin/llvm-config-18 \ 67 | -DLLVM_DIR=/usr/lib/llvm-18/lib/cmake/llvm/ \ 68 | -DCMAKE_LINKER=$(which lld-18) \ 69 | -GNinja \ 70 | "./src/multiplier" 71 | 72 | RUN ninja install 73 | 74 | # install bear for indexing 75 | RUN sudo apt-key adv --fetch-keys https://apt.kitware.com/keys/kitware-archive-latest.asc \ 76 | && sudo apt update \ 77 | && sudo apt install -y bear 78 | 79 | 80 | WORKDIR /OGHarn/extras -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Copyright 2025 Gabriel Sherman and Stefan Nagy 2 | 3 | Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: 4 | 5 | The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. 6 | 7 | THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 8 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | 2 | # OGHarn: Oracle-guided Fuzzing Harness Generation 3 | 4 | OGHarn logo 5 | 6 | This repository provides the source code for **OGHarn**: a prototype framework for automated generation of fuzzing harnesses for C library APIs. 7 | 8 | This work is presented in our paper **[No Harness, No Problem: Oracle-guided Harnessing for Auto-generating C API Fuzzing Harnesses](https://futures.cs.utah.edu/papers/25ICSE-b.pdf)**, appearing in the 2025 International Conference on Software Engineering (ICSE'25). 9 | 10 | * [Installing OGHarn](#installation) 11 | * [Target Library Setup](#target-library-setup) 12 | * [Generating Harnesses](#generating-harnesses) 13 | * [Additional Notes](#additional-notes) 14 | * [Bug Trophy Case](#bug-trophy-case) 15 | 16 |
OGHarn workflow 17 | 18 | 19 | 20 | 21 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 |
Citing this repository: 22 | @inproceedings{sherman:ogharn, title = {No Harness, No Problem: Oracle-guided Harnessing for Auto-generating C API Fuzzing Harnesses}, author = {Gabriel Sherman and Stefan Nagy}, booktitle = {{IEEE/ACM} {International} {Conference} on {Software Engineering} ({ICSE})}, year = {2025},} 23 |
Developers:Gabriel Sherman (gabe.sherman@utah.edu) and Stefan Nagy (snagy@cs.utah.edu)
License:MIT License
Disclaimer:This software is provided as-is with no warranty.
38 | 39 | Our original paper-version artifact is located at: https://zenodo.org/records/14727592. 40 | 41 | 42 | 43 | # Installation 44 | OGHarn relies on the following tools, which must both be installed to the `/extras` directory: 45 | * [Multiplier](https://github.com/trailofbits/multiplier): a code indexer used in OGHarn's static analysis of the library under test. 46 | * [AFL++](https://github.com/AFLplusplus/AFLplusplus): a grey-box fuzzer used in OGHarn's harness testing and code coverage analysis. 47 | 48 | To install them, run either `/extras/install_dependencies.sh`, or use our available [Dockerfile](Dockerfile). 49 | 50 | Once Multiplier and AFL++ are installed to `/extras`, run `/extras/set_env.sh` to: 51 | - Activate Multiplier's Python virtual environment and allows access to its API. 52 | - Add AFL++, Multiplier, and OGHarn to your system's `PATH`. 53 | - Install OGHarn's other Python dependencies (`PyYAML`, `cfile v0.2.0`). 54 | 55 | 56 | 57 | # Target Library Setup 58 | The following details the necessary steps for configuring harness generation for new libraries. We recommend reviewing the [demos](demos) folder for more detailed examples. 59 | ### Step 1: Initial Setup 60 | - `Library`: Harnesses generated by OGHarn are expected to be compiled with a dynamically-linked library instrumented with AFL++ and off-the-shelf sanitizers. Any of the Makefile targets titled `lib` in the demos folder provide examples for building a library for use by OGHarn. 61 | - `Index`: OGHarn requires a `.db` file generated by Multiplier containing the index of the library. Any of the Makefile targets titled `run_mx` provide examples for indexing a library using Multiplier. Refer to the [Multiplier Docs](https://github.com/trailofbits/multiplier/blob/main/docs/INDEXING.md) for additional guidance. 62 | 63 | ### Step 2: Create Makefile and Define Key Flags 64 | OGHarn relies on a user-supplied `Makefile` to define various flags and commands for compiling the harnesses targeting the library under test. 65 | It must begin with the following: 66 | - `CC_FUZZ` and `CXX_FUZZ`: AFL's compilers (`afl-clang-fast` and `afl-clang-fast++`, respectively). 67 | - `CFLAGS_ASAN` and `CXXFLAGS_ASAN`: Compiler flags for ASAN and UBSan instrumentation. 68 | - `DEPS`: Compile-time inclusion and linking commands for the eventual harnesses (e.g., `-I ... -L ...`). 69 | - `DEPS_STC`: Compile-time library flags for _statically_-linked dependencies. 70 | - `DEPS_DYN`: Compile-time library flags for _dynamically_-linked dependencies. 71 | - `DEPS_LDD`: Path to the directory containing the target's compiled shared library. 72 | 73 | As an example, below are associated `Makefile` definitions for [libMagic](https://github.com/file/file.git): 74 | ``` 75 | # Compilers and instrumentation (leave as-is). 76 | CC_FUZZ = afl-clang-fast 77 | CXX_FUZZ = afl-clang-fast++ 78 | CFLAGS_ASAN = -fsanitize=address,undefined 79 | CXXFLAGS_ASAN = -fsanitize=address,undefined 80 | 81 | # Library-specific settings (update accordingly). 82 | DEPS = -I library/src/ \ 83 | -L library/src/.libs 84 | DEPS_STC = -l:libmagic.a -llzma -lbz2 -lz -lzstd 85 | DEPS_DYN = -l magic 86 | DEPS_LDD = library/src/.libs/ 87 | ``` 88 | 89 | ### Step 3: Define Makefile Commands for Harness Analysis 90 | - `harness`: Command to compile the harness using `CC_FUZZ` and `DEPS_DYN` (dynamic linking). 91 | - `showmap`: Command to execute the harness using `afl-showmap`. Set `DEPS_LDD` accordingly. 92 | 93 | If harnesses must be linked statically, the following commands also need to be supplied. Must be used in conjunction with OGHarn argument `--execute_both` (see [Optional Arguments and Experimental Modes](#optional-arguments-and-experimental-modes)). 94 | - `harness_stc`: Same as above, but with `DEPS_STC` (static linking). 95 | - `showmap_stc`: Same as above, but without setting `LD_LIBRARY_PATH`. 96 | 97 | See the following example. Make sure that `$(OUT)` and `$(SEED)` are present as shown below, as these will be populated and used during OGHarn's harness generation. 98 | ``` 99 | harness: # Command for compiling individual harnesses. 100 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c $(DEPS) $(DEPS_DYN) $(CFLAGS_ASAN) 101 | 102 | showmap: # Command for collecting harness code coverage. 103 | LD_LIBRARY_PATH=$(DEPS_LDD) afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 104 | ``` 105 | These targets will generally be the same across libraries unless the library under test requires extra environment configuration (e.g., setting the `MAGIC` environment variable during execution of harnesses for [magic](demos/magic/Makefile)). 106 | ### Step 4: Select Library Seed Inputs 107 | OGHarn relies on two user-supplied seed file directories: 108 | - `seeds_valid`: Files that will be accepted by the target library (e.g., valid JSONs for [cJSON](https://github.com/FuturesLab/OGharn-Artifact-Final/tree/master/demos/cjson/seeds_valid)). 109 | - `seeds_invalid`: Random, perturbed seeds that will be _rejected_ by the library. 110 | 111 | OGHarn's seeds are no different than those used by fuzzers. For best results, we recommend using a varied corpus of valid and invalid seeds spanning a wide range of file sizes. Example seeds for various formats are available here: https://github.com/FuturesLab/fuzzing-seeds. 112 | 113 | ### Step 5: Optional Configuration 114 | OGHarn allows for extra control over harnessing via a user-supplied `config.yaml`. Available settings include: 115 | - `blacklist`: List of functions to _avoid_ during harnessing. 116 | - `add_preamble`: Library function to be called _before fuzz data injection_ in any harness. 117 | - `add_argument`: Hardcoded argument value for a particular function. 118 | - `add_defines`: Any `#define` statements to include in each harness. 119 | 120 | See [demos/sqlite](demos/sqlite/config.yaml), [demos/magic](demos/magic/config.yaml), and [demos/pcre2](demos/pcre2/config.yaml) for relevant examples. 121 | 122 | 123 | ### Step 6: Final Preparation 124 | Before continuing, ensure that your `Makefile` as well as the `seeds_valid` and `seeds_invalid` directories are contained in the same folder, e.g.: 125 | ``` 126 | in_dir/ 127 | /seeds_valid/ 128 | /seeds_invalid/ 129 | /Makefile 130 | /config.yaml (optional) 131 | ``` 132 | This directory (e.g., `in_dir` above) will serve as your input directory to OGHarn (passed via `--input`). 133 | 134 | 135 | 136 | # Generating Harnesses 137 | To generate harnesses, run `ogharn.py` and update the following arguments accordingly. As an example, OGHarn's command for harnessing [cJSON](https://github.com/DaveGamble/cJSON.git) is: 138 | ``` 139 | ogharn.py -i in -o out -n 3 --m in/lib.db -h cJSON.h -r b 140 | ``` 141 | See the `run_ogharn.sh` scripts in each [demos](demos) sub-directory for more examples. 142 | 143 | ### Required Arguments 144 | - `--input` (`-i`): Path to directory housing the user-provided `Makefile` and both `seeds_` dirs. 145 | - `--output` (`-o`): Path to the output directory where OGHarn's artifacts will be stored. 146 | - `--numfuncs` (`-n`): Maximum functions to call per harness following "data entrypoint" routines. 147 | - `--mxdb` (`-m`): Path to Multiplier's generated `.db` database file. 148 | - `--headers` (`-h`): Library headers to target, to be injected via `#include` in each harness. 149 | - `--readhow` (`-r`): Controls how the harnesses will read fuzzer-generated data: 150 | - `buf` (`b`): Via buffer (e.g., `foo(char* buffer)`). 151 | - `file` (`p`): Via file name/path (e.g., `bar(char* filename)`). 152 | 153 | ### Optional Arguments and Experimental Modes 154 | - `--config` (`-c`): Path to optional `config.yaml` (see [Optional Configuration](#step-5-optional-configuration)). 155 | - `--debug` (`-d`): Report the following information from the harnessing campaign: 156 | - Failed harnesses and why they failed. 157 | - Successfully-generated harnesses. 158 | - Inferred function-to-function dependencies. 159 | - Multiplier-found declarations, typedef aliases, function pointers, enums, and macros. 160 | - Functions that were successfully harnessed. 161 | - Statistics about the harness generation campaign. 162 | - If applicable, values extracted from function call site parameter tracking. 163 | - `--execute_both` (`-e`): Run harnesses both dynamically/statically linked. Useful for linker-related crashes. 164 | - `--recurse_headers` (`-x`): Recursively parse all headers. Useful if definitions are spread across multiple files. 165 | - `--fast_mode` (`-f`): Work faster by disabling exhaustive arg search, keeping only the first-successful one. 166 | - `--target_func` (`-t`): Attempt harnessing to reach only the specified function. Useful for targeted fuzzing. 167 | - `--allow_stderr` (`-as`): Keeps harnesses where `stderr` output seen. Useful if `stderr` is valid API behavior. 168 | - `--allow_lincov` (`-al`): Keeps harnesses with linear codecov deltas. Useful for low input-dependent logic. 169 | - `--allow_consts` (`-ac`): Considers `const` args from one function as potential non-`const` args for others. 170 | - `--allow_deepaux` (`-ad`): Arg resolution via deeper auxiliary sequences. Adds significant cost to harnessing. 171 | - `--allow_pvalret` (`-ap`): Try to retrieve _concrete_ parameter values via Multiplier's callsite analysis. 172 | 173 | # Additional Notes 174 | Below details several enhancements and limitations to OGHarn. We refer readers to [our paper](https://futures.cs.utah.edu/papers/25ICSE-b.pdf) for full details. 175 | 176 | ### Newer Enhancements 177 | The following enhancements were not present in our paper's version of OGHarn. 178 | - **Targeted Harnessing**: OGHarn previously only supported library-wide harnessing, but now supports function-specific harnessing (via `--target_func`). This helped us find bugs like https://github.com/pganalyze/libpg_query/issues/254, https://github.com/htacg/tidy-html5/issues/1120, and https://github.com/OpenPrinting/cups/issues/1026. This is still considered an experimental feature. 179 | - **Struct Member Population**: OGHarn previously avoided structs entirely, but now attempts limited population of their members. This is still considered an experimental feature. We anticipate that OGHarn's current implementation is not well-suited to many struct-based libraries (e.g., libPNG, libVPX, etc.). 180 | - **Deeper Argument Resolution Sequences**: OGHarn previously only resolved API-specific types (e.g., `cJSON *`) by injecting calls to single "auxiliary functions". By toggling-on `--allow_deepaux`, OGHarn will attempt multi-function _sequences_ for resolving such arguments. This is still considered an experimental feature. 181 | - **Concrete Parameter Value Retrieval**: OGHarn previously operated only on targeted header files, but now optionally invokes Multiplier's aggressive _library-wide_ callsite analysis to learn and consider possible concrete values in its mutation of function parameters. This helped us find bugs some bugs like https://github.com/pantoniou/libfyaml/issues/121 and https://github.com/pantoniou/libfyaml/issues/122. Enable this mode via `--allow_pvalret`. 182 | 183 | ### Debugging 184 | If harnessing appears to be failing, we recommend using the `--debug` flag and inspecting OGHarn's reported information in the `output/debug` directory. Two important debugging artifacts are: 185 | - `log_failed.txt`: Each failing harness and why it was discarded by OGHarn. 186 | - `log_multiplier.txt`: Any available information about the library from Multiplier. 187 | 188 | ### Limitations 189 | - **C Libraries**: OGHarn currently supports only C-based libraries. 190 | - **Multiplier**: In cases where Multiplier fails, OGHarn will not work. We aren't sure of the extent of this. 191 | - **Struct Population**: As described above, we are only at the beginning of testing out struct population. We leave refining this to future work. 192 | - **Server-Client APIs**: OGHarn does not support functions requiring complex _server-client_-style setup. 193 | 194 | 195 | # Bug Trophy Case 196 | We are pleased that OGHarn helped uncover the following software bugs and security vulnerabilities: 197 | 198 | | API | Reported Bugs | 199 | | ---- | ---- | 200 | | HDF5 | https://github.com/HDFGroup/hdf5/issues/3790, https://github.com/HDFGroup/hdf5/issues/4431, https://github.com/HDFGroup/hdf5/issues/4432, https://github.com/HDFGroup/hdf5/issues/4433, https://github.com/HDFGroup/hdf5/issues/4434, https://github.com/HDFGroup/hdf5/issues/4435 | 201 | | Lexbor | https://github.com/lexbor/lexbor/issues/220, https://github.com/lexbor/lexbor/issues/221, https://github.com/lexbor/lexbor/issues/222 | 202 | | libFYAML | https://github.com/pantoniou/libfyaml/issues/107, https://github.com/pantoniou/libfyaml/issues/108, https://github.com/pantoniou/libfyaml/issues/118, https://github.com/pantoniou/libfyaml/issues/119, https://github.com/pantoniou/libfyaml/issues/120, https://github.com/pantoniou/libfyaml/issues/121, https://github.com/pantoniou/libfyaml/issues/122, https://github.com/pantoniou/libfyaml/issues/123 | 203 | | libGEOS | https://github.com/libgeos/geos/issues/1021, https://github.com/libgeos/geos/issues/1070, https://github.com/libgeos/geos/issues/1071, https://github.com/libgeos/geos/issues/1072, https://github.com/libgeos/geos/issues/1073, https://github.com/libgeos/geos/issues/1074, https://github.com/libgeos/geos/issues/1084 | 204 | | libICAL | https://github.com/libical/libical/issues/677, https://github.com/libical/libical/issues/678 | 205 | | libUCL | https://github.com/vstakhov/libucl/issues/288, https://github.com/vstakhov/libucl/issues/289, https://github.com/vstakhov/libucl/issues/290, https://github.com/vstakhov/libucl/issues/291, https://github.com/vstakhov/libucl/issues/292, https://github.com/vstakhov/libucl/issues/293 | 206 | | StormLib | https://github.com/ladislav-zezula/StormLib/issues/327, https://github.com/ladislav-zezula/StormLib/issues/328, https://github.com/ladislav-zezula/StormLib/issues/329, https://github.com/ladislav-zezula/StormLib/issues/330, https://github.com/ladislav-zezula/StormLib/issues/331, https://github.com/ladislav-zezula/StormLib/issues/332, https://github.com/ladislav-zezula/StormLib/issues/333, https://github.com/ladislav-zezula/StormLib/issues/334, https://github.com/ladislav-zezula/StormLib/issues/335, https://github.com/ladislav-zezula/StormLib/issues/336, https://github.com/ladislav-zezula/StormLib/issues/337, https://github.com/ladislav-zezula/StormLib/issues/338 | 207 | | RayLib | https://github.com/raysan5/raylib/issues/3924 | 208 | | libPG_Query | https://github.com/pganalyze/libpg_query/issues/254 | 209 | | Tidy-HTML5 | https://github.com/htacg/tidy-html5/issues/1120 | 210 | | PCRE2 | https://github.com/PCRE2Project/pcre2/issues/561 | 211 | | CUPS | https://github.com/OpenPrinting/cups/issues/1026 | 212 | 213 | If you find any other bugs using OGHarn, please let us know! 214 | 215 | 216 | # Acknowledgement 217 | 218 | This material is based upon work supported by the National Science Foundation under Grant No. 2419798: [CICI: TCR: Practical, Systematic Fuzz Testing for Securing Scientific Software](https://www.nsf.gov/awardsearch/showAward?AWD_ID=2419798). 219 | -------------------------------------------------------------------------------- /demos/README.md: -------------------------------------------------------------------------------- 1 | # Running OGHarn Demos 2 | ### Step 1: Installation 3 | - Ensure all dependencies listed in the root [README](../README.md) are installed. 4 | - Set the environment using `/extras/set_env.sh`. The binaries for Multiplier and AFL++ should be in the system path. 5 | 6 | ### Step 2: Build the necessary resources 7 | Navigate to any of the libraries listed in the `/demos` directory and run `make all`. This builds: 8 | 9 | - Dynamically linked library instrumented with AFL++ and ASAN/UBSAN for harness generation. 10 | - Statically linked library instrumented with AFL++ for fuzzing. 11 | - If applicable, a build of the library to be used for indexing with Multiplier. 12 | - Multiplier-produced index of the library for static analysis during harness generation. 13 | 14 | 15 | ### Step 3: Begin harness generation 16 | Run `run_ogharn.sh`. This will begin harness generation for the corresponding demo. In some cases OGHarn will quickly discover valid harnesses for libraries, while other libraries will take more time. This is dependent on the size and complexity of the library. Some libraries that demonstrate OGHarn's ability to quickly discover interesting fuzzing harnesses are: [cjson](./cjson), [faup](./faup), [lexbor](./lexbor), [cgltf](./cgltf), [pcre2](./pcre2/), and [ucl](./ucl). 17 | 18 | ### Step 4: Post processing 19 | In order to get a set of harnesses that exercise deep, unique coverage, allowing OGHarn to run until it has exhausted all potential harnessing routines is recommended. This typically takes less than 24 hours. For the purpose of testing, terminating harness generation after OGHarn begins to report successful harnesses is also possible. 20 | 21 | Debugging information and final harnesses will be stored in the output directory provided to OGHarn with the `-o` argument. Final harnesses will be ranked according to the number of unique edges they reach compared to all other harnesses in the corpus. 22 | 23 | Run `make harness_fuzz HARNESS_NUMBER= OUT=` to build a final harness for fuzzing. The binary will be stored in the `bin` directory of the corresponding demo. 24 | 25 | 26 | 27 | -------------------------------------------------------------------------------- /demos/c-ares/Makefile: -------------------------------------------------------------------------------- 1 | CC_FUZZ = afl-clang-fast 2 | CXX_FUZZ = afl-clang-fast++ 3 | CFLAGS_ASAN = -fsanitize=address,undefined 4 | CXXFLAGS_ASAN = -fsanitize=address,undefined 5 | 6 | LIB_NAME = lib 7 | LIB_REPO = https://github.com/c-ares/c-ares.git 8 | 9 | DEPS = -I $(PWD)/$(LIB_NAME)/include \ 10 | -I $(PWD)/$(LIB_NAME)/ \ 11 | -L $(PWD)/$(LIB_NAME)/lib/ 12 | 13 | DEPS_DYN = -lcares 14 | DEPS_STC = -l:libcares_static.a 15 | DEPS_LDD = $(PWD)/$(LIB_NAME)/lib/ 16 | 17 | #------------------------------------------------------------------------ 18 | lib: # build for harness generation. Dynamic linking, asan, and afl instrumentation 19 | export AFL_USE_ASAN=1 20 | export AFL_USE_UBSAN=1 21 | rm -rf $(LIB_NAME) 22 | git clone $(LIB_REPO) $(LIB_NAME) 23 | cd $(LIB_NAME) && \ 24 | git checkout a8c091750d4db206ead3555b9a18e238525d7ca8 && \ 25 | cmake . \ 26 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DCMAKE_EXPORT_COMPILE_COMMANDS=ON && \ 27 | make all -j12 28 | 29 | lib_fuzz: # build for fuzzing. Static linking with afl instrumentation 30 | rm -rf $(LIB_NAME)_fuzz 31 | git clone $(LIB_REPO) $(LIB_NAME)_fuzz 32 | cd $(LIB_NAME)_fuzz && \ 33 | git checkout a8c091750d4db206ead3555b9a18e238525d7ca8 && \ 34 | cmake . \ 35 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DCARES_STATIC=On && \ 36 | make all -j12 37 | 38 | run_mx:# Use Multiplier to index the library 39 | mx-index --db $(PWD)/$(LIB_NAME).db --target $(PWD)/$(LIB_NAME)/compile_commands.json --workspace $(PWD)/mx 40 | 41 | #------------------------------------------------------------------------ 42 | all: lib lib_fuzz run_mx 43 | 44 | #------------------------------------------------------------------------ 45 | 46 | harness: # make command used to make the harness during generation 47 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c $(DEPS) $(DEPS_DYN) $(CFLAGS_ASAN) 48 | 49 | showmap: # command used to get coverage information about library under test 50 | LD_LIBRARY_PATH=$(DEPS_LDD) afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 51 | 52 | harness_fuzz: # compile a harness specifically for fuzzing. Pass the harness number using make harness_fuzz HARNESS_NUMBER=x 53 | @ls bin || mkdir bin 54 | $(eval LIB_NAME=lib_fuzz) \ 55 | $(CC_FUZZ) -o bin/ogharn$(HARNESS_NUMBER)\_fuzz $(OUT)/final-harnesses/src/harness$(HARNESS_NUMBER):*.c -static $(DEPS) $(DEPS_STC) ; 56 | 57 | clean: 58 | rm -rf bin mx lib.db-* 59 | 60 | clean_lib: 61 | rm -rf $(LIB_NAME)* -------------------------------------------------------------------------------- /demos/c-ares/run_ogharn.sh: -------------------------------------------------------------------------------- 1 | ogharn.py -i $PWD -o $PWD/out -n 3 -m $PWD/lib.db -h ares.h -r b -d -f -------------------------------------------------------------------------------- /demos/c-ares/seeds_invalid/char: -------------------------------------------------------------------------------- 1 | S -------------------------------------------------------------------------------- /demos/c-ares/seeds_invalid/is1: -------------------------------------------------------------------------------- 1 | �wwwgooglecwwglecom -------------------------------------------------------------------------------- /demos/c-ares/seeds_invalid/is2: -------------------------------------------------------------------------------- 1 | norma**0834j;name -------------------------------------------------------------------------------- /demos/c-ares/seeds_invalid/malformed.raw: -------------------------------------------------------------------------------- 1 | ���powerdnscom+� +Q����cdgW�b� Jӿ�g[I�2y� +Q�$��}�Z�VPQ�V<�ߗjɜܥ4c���+����N� +Q�$�����U+�y��1~_�aK._`}�S-I�!y�� .Q��+Q�\��[�rߒrcom��+��Y�� �9`�tz���g�͛��� � �=��ŒEX,� -�QV�}h�����Si7� te���l�&�,bt�x%;�Q��Bۊ88b�y�P�B?^P��������`,��)�# 2 | �m0���d gtld-servers�#3��� �0���*]�� �0���)�)� -------------------------------------------------------------------------------- /demos/c-ares/seeds_valid/s1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/c-ares/seeds_valid/s1 -------------------------------------------------------------------------------- /demos/c-ares/seeds_valid/s2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/c-ares/seeds_valid/s2 -------------------------------------------------------------------------------- /demos/c-ares/seeds_valid/s3: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/c-ares/seeds_valid/s3 -------------------------------------------------------------------------------- /demos/c-ares/seeds_valid/s4: -------------------------------------------------------------------------------- 1 | normal.name -------------------------------------------------------------------------------- /demos/c-ares/seeds_valid/s5: -------------------------------------------------------------------------------- 1 | utf8.££.data.com -------------------------------------------------------------------------------- /demos/cgltf/Makefile: -------------------------------------------------------------------------------- 1 | CC_FUZZ = afl-clang-fast 2 | CXX_FUZZ = afl-clang-fast++ 3 | CFLAGS_ASAN = -fsanitize=address,undefined 4 | CXXFLAGS_ASAN = -fsanitize=address,undefined 5 | 6 | LIB_NAME = lib 7 | LIB_REPO = https://github.com/stevenagy/cgltf 8 | 9 | DEPS = -I $(PWD)/$(LIB_NAME)/include \ 10 | -I $(PWD)/$(LIB_NAME)/ \ 11 | -L $(PWD)/$(LIB_NAME)/ 12 | 13 | DEPS_DYN = -lcgltf 14 | DEPS_STC = -l:libcgltf.a 15 | DEPS_LDD = $(PWD)/$(LIB_NAME)/ 16 | 17 | #------------------------------------------------------------------------ 18 | lib: # build for harness generation. Dynamic linking, asan, and afl instrumentation 19 | export AFL_USE_ASAN=1 20 | export AFL_USE_UBSAN=1 21 | rm -rf $(LIB_NAME) 22 | git clone $(LIB_REPO) $(LIB_NAME) 23 | cd $(LIB_NAME) && \ 24 | make CC=$(CC_FUZZ) 25 | 26 | lib_plain: # Plain build for indexing with Multiplier. bear doesn't seem to like afl compilers 27 | rm -rf $(LIB_NAME)_plain 28 | git clone $(LIB_REPO) $(LIB_NAME)_plain 29 | cd $(LIB_NAME)_plain && \ 30 | bear -- make 31 | 32 | lib_fuzz: # Build for fuzzing. Same as build for harnessing except with no asan 33 | rm -rf $(LIB_NAME)_fuzz 34 | git clone $(LIB_REPO) $(LIB_NAME)_fuzz 35 | cd $(LIB_NAME)_fuzz && \ 36 | make CC=$(CC_FUZZ) 37 | 38 | run_mx: # Use Multiplier to index the library 39 | mx-index --db $(PWD)/$(LIB_NAME).db --target $(PWD)/$(LIB_NAME)_plain/compile_commands.json --workspace $(PWD)/mx 40 | 41 | #------------------------------------------------------------------------ 42 | all: lib lib_plain lib_fuzz run_mx 43 | 44 | #------------------------------------------------------------------------ 45 | 46 | harness: # make command used to make the harness during generation 47 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c $(DEPS) $(DEPS_DYN) $(CFLAGS_ASAN) 48 | 49 | showmap: # command used to get coverage information about library under test 50 | LD_LIBRARY_PATH=$(DEPS_LDD) afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 51 | 52 | harness_fuzz: # compile a harness specifically for fuzzing. Pass the harness number using make harness_fuzz HARNESS_NUMBER=x 53 | @ls bin || mkdir bin 54 | $(eval LIB_NAME=lib_fuzz) \ 55 | $(CC_FUZZ) -o bin/ogharn$(HARNESS_NUMBER)\_fuzz $(OUT)/final-harnesses/src/harness$(HARNESS_NUMBER):*.c -static $(DEPS) $(DEPS_STC) ; 56 | 57 | clean: 58 | rm -rf bin mx lib.db-* 59 | 60 | clean_lib: 61 | rm -rf $(LIB_NAME)* -------------------------------------------------------------------------------- /demos/cgltf/config.yaml: -------------------------------------------------------------------------------- 1 | add_define_to_harness: "#define CGLTF_IMPLEMENTATION" -------------------------------------------------------------------------------- /demos/cgltf/run_ogharn.sh: -------------------------------------------------------------------------------- 1 | ogharn.py -i $PWD -o $PWD/out -n 3 -m $PWD/lib.db -h cgltf.h -r f -d -f -c $PWD/config.yaml -ac -al -------------------------------------------------------------------------------- /demos/cgltf/seeds_invalid/BadBasisU.gltf: -------------------------------------------------------------------------------- 1 | {"textures":[{"extensions":{"KHR_texture_basisu":{""}}:{""""},""}]} -------------------------------------------------------------------------------- /demos/cgltf/seeds_invalid/ToyCar.gltf: -------------------------------------------------------------------------------- 1 | { 2 | "asset": { 3 | "version": "2.0", 4 | "generator": "babylon.js glTF exporter for 3dsmax 2020 v20200721.1", 5 | "copyright": "Public domain (CC0). Toy car model created by Guido Odendahl. Materials edited by Eric Chadwick." 6 | }, 7 | "extensionsUsed": 8 | "KHR_texture_transform", 9 | "KHR_mat_transmission", 10 | "KHR_materials_sheen" 11 | ], 12 | "scene": 0, 13 | "scenes: [ 14 | { 15 | "nodes": [ 16 | 0, 17 | 1, 18 | 2, 19 | 3, 20 | 4, 21 | 5, 22 | 6, 23 | 7, 24 | 8, 25 | 9, 26 | 10 27 | ] 28 | } 29 | ], 30 | "nodes": [ 31 | { 32 | "name": "ToyCar", 33 | "mesh": 0, 34 | "rotation": [ 35 | 0.7071068, 36 | 0, 37 | 0, 38 | 0.7071067 39 | ], 40 | "scale": [ 41 | 0.0001, 42 | 0.0001, 43 | 0.0001 44 | ] 45 | }, 46 | { 47 | 48 | 0.7071067 49 | ], 50 | "scale": [ 51 | 0.0001, 52 | 0.0001, 53 | 0.0001 54 | ] 55 | }, 56 | { 57 | "name": "Glass", 58 | "mesh": 2, 59 | "rotation": [ 60 | 0.7071068, 61 | 0, 62 | 0, 63 | 0.7071067 64 | ], 65 | "scale": [ 66 | 0.0001, 67 | 0.0001, 68 | 0.0001 69 | ] 70 | }, 71 | { 72 | "camera": 0, 73 | "translation": [ 74 | -0.0169006381, 75 | 0.0253599286, 76 | 0.0302319955 77 | ], 78 | "rotation": [ 79 | -0.330993533, 80 | -0.274300218, 81 | -0.101194724, 82 | 0.8971969 83 | ], 84 | "scale": [ 85 | 1.00000024, 86 | 1, 87 | 1.00000012 88 | ], 89 | "name": "Camera001" 90 | }, 91 | { 92 | "camera": 1, 93 | "translation": [ 94 | -0.04332856, 95 | 0.0235993266, 96 | 0.0760967 97 | ], 98 | "rotation": [ 99 | -0.12160936, 100 | -0.2651013, 101 | -0.03372518, 102 | 0.9559263 103 | ], 104 | "scale": [ 105 | 0.99999994, 106 | 1.00000036, 107 | 1.00000024 108 | ], 109 | "name": "Camera002" 110 | }, 111 | { 112 | "camera": 2, 113 | "translation": [ 114 | -0.0121543175, 115 | 0.0101683857, 116 | 0.0269274339 -------------------------------------------------------------------------------- /demos/cgltf/seeds_invalid/small.gltf: -------------------------------------------------------------------------------- 1 | S -------------------------------------------------------------------------------- /demos/cgltf/seeds_valid/s1.gltf: -------------------------------------------------------------------------------- 1 | { 2 | "scenes" : [ 3 | { 4 | "nodes" : [ 0 ] 5 | } 6 | ], 7 | 8 | "nodes" : [ 9 | { 10 | "mesh" : 0 11 | } 12 | ], 13 | 14 | "meshes" : [ 15 | { 16 | "primitives" : [ { 17 | "attributes" : { 18 | "POSITION" : 0 19 | } 20 | } ] 21 | } 22 | ], 23 | 24 | "buffers" : [ 25 | { 26 | "uri" : "data:application/octet-stream;base64,AAAAAAAAAAAAAAAAAACAPwAAAAAAAAAAAAAAAAAAgD8AAAAA", 27 | "byteLength" : 36 28 | } 29 | ], 30 | "bufferViews" : [ 31 | { 32 | "buffer" : 0, 33 | "byteOffset" : 0, 34 | "byteLength" : 36, 35 | "target" : 34962 36 | } 37 | ], 38 | "accessors" : [ 39 | { 40 | "bufferView" : 0, 41 | "byteOffset" : 0, 42 | "componentType" : 5126, 43 | "count" : 3, 44 | "type" : "VEC3", 45 | "max" : [ 1.0, 1.0, 0.0 ], 46 | "min" : [ 0.0, 0.0, 0.0 ] 47 | } 48 | ], 49 | 50 | "asset" : { 51 | "version" : "2.0" 52 | } 53 | } -------------------------------------------------------------------------------- /demos/cgltf/seeds_valid/s2.gltf: -------------------------------------------------------------------------------- 1 | { 2 | "accessors": [ 3 | { 4 | "bufferView": 0, 5 | "byteOffset": 0, 6 | "componentType": 5126, 7 | "count": 1968, 8 | "max": [ 9 | 1.3671875, 10 | 0.984375, 11 | 0.8515625 12 | ], 13 | "min": [ 14 | -1.3671875, 15 | -0.984375, 16 | -0.8515625 17 | ], 18 | "normalized": false, 19 | "type": "VEC3" 20 | }, 21 | { 22 | "bufferView": 1, 23 | "byteOffset": 0, 24 | "componentType": 5126, 25 | "count": 1968, 26 | "normalized": false, 27 | "type": "VEC3" 28 | }, 29 | { 30 | "bufferView": 2, 31 | "byteOffset": 0, 32 | "componentType": 5126, 33 | "count": 1968, 34 | "normalized": false, 35 | "type": "VEC2" 36 | }, 37 | { 38 | "bufferView": 3, 39 | "byteOffset": 0, 40 | "componentType": 5125, 41 | "count": 2904, 42 | "normalized": false, 43 | "type": "SCALAR" 44 | }, 45 | { 46 | "componentType": 5126, 47 | "count": 1968, 48 | "max": [ 49 | 0.0518799126, 50 | 0.1578337, 51 | 0.0258048773 52 | ], 53 | "min": [ 54 | -0.0518799126, 55 | -0.188150242, 56 | -0.0214793682 57 | ], 58 | "normalized": false, 59 | "sparse": { 60 | "count": 208, 61 | "indices": { 62 | "bufferView": 4, 63 | "byteOffset": 0, 64 | "componentType": 5125 65 | }, 66 | "values": { 67 | "bufferView": 5, 68 | "byteOffset": 0 69 | } 70 | }, 71 | "type": "VEC3" 72 | }, 73 | { 74 | "componentType": 5126, 75 | "count": 1968, 76 | "normalized": false, 77 | "sparse": { 78 | "count": 208, 79 | "indices": { 80 | "bufferView": 4, 81 | "byteOffset": 0, 82 | "componentType": 5125 83 | }, 84 | "values": { 85 | "bufferView": 6, 86 | "byteOffset": 0 87 | } 88 | }, 89 | "type": "VEC3" 90 | } 91 | ], 92 | "asset": { 93 | "generator": "UniGLTF-1.28", 94 | "version": "2.0" 95 | }, 96 | "buffers": [ 97 | { 98 | "byteLength": 80424, 99 | "uri": "SuzanneMorphSparse.bin" 100 | } 101 | ], 102 | "bufferViews": [ 103 | { 104 | "buffer": 0, 105 | "byteLength": 23616, 106 | "byteOffset": 0, 107 | "target": 34962 108 | }, 109 | { 110 | "buffer": 0, 111 | "byteLength": 23616, 112 | "byteOffset": 23616, 113 | "target": 34962 114 | }, 115 | { 116 | "buffer": 0, 117 | "byteLength": 15744, 118 | "byteOffset": 47232, 119 | "target": 34962 120 | }, 121 | { 122 | "buffer": 0, 123 | "byteLength": 11616, 124 | "byteOffset": 62976, 125 | "target": 34963 126 | }, 127 | { 128 | "buffer": 0, 129 | "byteLength": 832, 130 | "byteOffset": 74592 131 | }, 132 | { 133 | "buffer": 0, 134 | "byteLength": 2496, 135 | "byteOffset": 75432 136 | }, 137 | { 138 | "buffer": 0, 139 | "byteLength": 2496, 140 | "byteOffset": 77928 141 | } 142 | ], 143 | "extensions": { 144 | }, 145 | "extensionsUsed": [ 146 | "KHR_materials_unlit", 147 | "KHR_texture_transform" 148 | ], 149 | "materials": [ 150 | { 151 | "alphaMode": "OPAQUE", 152 | "doubleSided": false, 153 | "name": "material_00", 154 | "pbrMetallicRoughness": { 155 | "baseColorFactor": [ 156 | 1, 157 | 1, 158 | 1, 159 | 1 160 | ], 161 | "metallicFactor": 0, 162 | "roughnessFactor": 0.5 163 | } 164 | } 165 | ], 166 | "meshes": [ 167 | { 168 | "extras": { 169 | "targetNames": [ 170 | "Key 1" 171 | ] 172 | }, 173 | "name": "Basis", 174 | "primitives": [ 175 | { 176 | "attributes": { 177 | "NORMAL": 1, 178 | "POSITION": 0, 179 | "TEXCOORD_0": 2 180 | }, 181 | "extras": { 182 | "targetNames": [ 183 | "Key 1" 184 | ] 185 | }, 186 | "indices": 3, 187 | "material": 0, 188 | "mode": 4, 189 | "targets": [ 190 | { 191 | "NORMAL": 5, 192 | "POSITION": 4 193 | } 194 | ] 195 | } 196 | ] 197 | } 198 | ], 199 | "nodes": [ 200 | { 201 | "mesh": 0, 202 | "name": "Suzanne.dup", 203 | "rotation": [ 204 | 0, 205 | 0, 206 | 0, 207 | 1 208 | ], 209 | "scale": [ 210 | 1, 211 | 1, 212 | 1 213 | ], 214 | "translation": [ 215 | 0, 216 | 0, 217 | 0 218 | ] 219 | } 220 | ], 221 | "scene": 0, 222 | "scenes": [ 223 | { 224 | "nodes": [ 225 | 0 226 | ] 227 | } 228 | ] 229 | } -------------------------------------------------------------------------------- /demos/cjson/Makefile: -------------------------------------------------------------------------------- 1 | CC_FUZZ = afl-clang-fast 2 | CXX_FUZZ = afl-clang-fast++ 3 | CFLAGS_ASAN = -fsanitize=address,undefined 4 | CXXFLAGS_ASAN = -fsanitize=address,undefined 5 | #------------------------------------------------------------------------ 6 | LIB_NAME = lib 7 | LIB_REPO = https://github.com/DaveGamble/cJSON.git 8 | 9 | DEPS = -I $(PWD)/$(LIB_NAME)/ \ 10 | -L $(PWD)/$(LIB_NAME)/ 11 | 12 | DEPS_DYN = -lcjson 13 | DEPS_LDD = $(PWD)/$(LIB_NAME)/ 14 | 15 | DEPS_STC = -l:libcjson.a 16 | 17 | #------------------------------------------------------------------------ 18 | lib: # build for harness generation. Dynamic linking, asan, and afl instrumentation 19 | export AFL_USE_ASAN=1 20 | export AFL_USE_UBSAN=1 21 | rm -rf $(LIB_NAME) 22 | git clone $(LIB_REPO) $(LIB_NAME) 23 | cd $(LIB_NAME) && \ 24 | git checkout 12c4bf1986c288950a3d06da757109a6aa1ece38 && \ 25 | cmake . \ 26 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DCMAKE_EXPORT_COMPILE_COMMANDS=ON && \ 27 | make all -j12 28 | 29 | lib_fuzz: # Build for fuzzing. Static linking and afl instrumentation 30 | rm -rf $(LIB_NAME)_fuzz 31 | git clone $(LIB_REPO) $(LIB_NAME)_fuzz 32 | cd $(LIB_NAME)_fuzz && \ 33 | git checkout 12c4bf1986c288950a3d06da757109a6aa1ece38 && \ 34 | cmake . \ 35 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DBUILD_SHARED_LIBS=Off && \ 36 | make all -j12 37 | 38 | 39 | run_mx:# Use Multiplier to index the library 40 | mx-index --db $(PWD)/$(LIB_NAME).db --target $(PWD)/$(LIB_NAME)/compile_commands.json --workspace $(PWD)/mx 41 | 42 | #------------------------------------------------------------------------ 43 | all: lib lib_fuzz run_mx 44 | 45 | #------------------------------------------------------------------------ 46 | 47 | harness: # make command used to make the harness during generation 48 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c $(DEPS) $(DEPS_DYN) $(CFLAGS_ASAN) 49 | 50 | showmap: # command used to get coverage information about library under test 51 | LD_LIBRARY_PATH=$(DEPS_LDD) afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 52 | 53 | harness_fuzz: # compile a harness specifically for fuzzing. Pass the harness number using make harness_fuzz HARNESS_NUMBER=x 54 | @ls bin || mkdir bin 55 | $(eval LIB_NAME=lib_fuzz) \ 56 | $(CC_FUZZ) -o bin/ogharn$(HARNESS_NUMBER)\_fuzz $(OUT)/final-harnesses/src/harness$(HARNESS_NUMBER):*.c -static $(DEPS) $(DEPS_STC) ; 57 | 58 | clean: 59 | rm -rf bin mx lib.db-* 60 | 61 | clean_lib: 62 | rm -rf $(LIB_NAME)* -------------------------------------------------------------------------------- /demos/cjson/run_ogharn.sh: -------------------------------------------------------------------------------- 1 | ogharn.py -i $PWD -o $PWD/out -n 3 --m $PWD/lib.db -h cJSON.h -r b -d -f -------------------------------------------------------------------------------- /demos/cjson/seeds_invalid/invalid.json: -------------------------------------------------------------------------------- 1 | [ 2 | How about one level down...", 3 | "doc": {"foo":{"foo": 1, "bar": 2}}, 4 | "patch": [], 5 | "expected": {"foo":{"bar":2, "foo": 1}} }, 6 | 7 | { "comment": "add replaces any existing field", 8 | "doc": {"foo": null}, 9 | "patch": [{"op": "add", "path": "/foo", "value":1}], 10 | "expected": {"foo": 1} }, 11 | 12 | { "comment": "toplevel array", 13 | "doc": [], 14 | "patch": [{"op": "add", "path": "/0", "value": "foo"}], 15 | "expected": ["foo"] }, 16 | 17 | { "comment": "toplevel array, no change", 18 | "doc": ["foo"], 19 | "patch": [], 20 | "expected": ["foo"] }, 21 | 22 | { "comment": "toplevel object, numeric string", 23 | "doc": {}, 24 | "patch": [{"op": "add", "path": "/foo", "value": "1"}], 25 | "expected": {"foo":"1"} }, 26 | 27 | { "comment": "toplevel object, integer", 28 | "doc": {}, 29 | "patch": [{"op": "add", "path": "/foo", "value": 1}], 30 | "expected": {"foo":1} }, 31 | 32 | { "comment": "Toplevel scalar values OK?", 33 | "doc": "foo", 34 | "patch": [{"op": "replace", "path": "", "value": "bar"}], 35 | "expected": "bar", 36 | "disabled": true }, 37 | 38 | { "comment": "replace object document with array document?", 39 | "doc": {}, 40 | "patch": [{"op": "add", "path": "", "value": []}], 41 | "expected": [] }, 42 | 43 | { "comment": "replace array document with object document?", 44 | "doc": [], 45 | "patch": [{"op": "add", "path": "", "value": {}}], 46 | "expected": {} }, 47 | 48 | { "comment": "append to root array document?", 49 | "doc": [], 50 | "patch": [{"op": "add", "path": "/-", "value": "hi"}], 51 | "expected": ["hi"] }, 52 | 53 | { "comment": "Add, / target", 54 | "doc": {}, 55 | "patch": [ {"op": "add", "path": "/", "value":1 } ], 56 | "expected": {"":1} }, 57 | 58 | { "comment": "Add, /foo/ deep target (trailing slash)", 59 | "doc": {"foo": {}}, 60 | "patch": [ {"op": "add", "path": "/foo/", "value":1 } ], 61 | "expected": {"foo":{"": 1}} }, 62 | 63 | { "comment": "Add composite value at top level", 64 | "doc": {"foo": 1}, 65 | "patch": [{"op": "add", "path": "/bar", "value": [1, 2]}], 66 | "expected": {"foo": 1, "bar": [1, 2]} }, 67 | 68 | { "comment": "Add into composite value", 69 | "doc": {"foo": 1, "baz": [{"qux": "hello"}]}, 70 | "patch": [{"op": "add", "path": "/baz/0/foo", "value": "world"}], 71 | "expected": {"foo": 1, "baz": [{"qux": "hello", "foo": "world"}]} }, 72 | 73 | { "doc": {"bar": [1, 2]}, 74 | "patch": [{"op": "add", "path": "/bar/8", "value": "5"}], 75 | "error": "Out of bounds (upper)" }, 76 | 77 | { "doc": {"bar": [1, 2]}, 78 | "patch": [{"op": "add", "path": "/bar/-1", "value": "5"}], 79 | "error": "Out of bounds (lower)" }, 80 | 81 | { "doc": {"foo": 1}, 82 | "patch": [{"op": "add", "path": "/bar", "value": true}], 83 | "expected": {"foo": 1, "bar": true} }, 84 | 85 | { "doc": {"foo": 1}, 86 | "patch": [{"op": "add", "path": "/bar", "value": false}], 87 | "expected": {"foo": 1, "bar": false} }, 88 | 89 | { "doc": {"foo": 1}, 90 | "patch": [{"op": "add", "path": "/bar", "value": null}], 91 | "expected": {"foo": 1, "bar": null} }, 92 | 93 | { "comment": "0 can be an array index or object element name", 94 | "doc": {"foo": 1}, 95 | "patch": [{"op": "add", "path": "/0", "value": "bar"}], 96 | "expected": {"foo": 1, "0": "bar" } }, 97 | 98 | { "doc": ["foo"], 99 | "patch": [{"op": "add", "path": "/1", "value": "bar"}], 100 | "expected": ["foo", "bar"] }, 101 | 102 | { "doc": ["foo", "sil"], 103 | "patch": [{"op": "add", "path": "/1", "value": "bar"}], 104 | "expected": ["foo", "bar", "sil"] }, 105 | 106 | { "doc": ["foo", "sil"], 107 | "patch": [{"op": "add", "path": "/0", "value": "bar"}], 108 | "expected": ["bar", "foo", "sil"] }, 109 | 110 | { "comment": "push item to array via last index + 1", 111 | "doc": ["foo", "sil"], 112 | "patch": [{"op":"add", "path": "/2", "value": "bar"}], 113 | "expected": ["foo", "sil", "bar"] }, 114 | 115 | { "comment": "add item to array at index > length should fail", 116 | "doc": ["foo", "sil"], 117 | "patch": [{"op":"add", "path": "/3", "value": "bar"}], 118 | "error": "index is greater than number of items in array" }, 119 | 120 | { "comment": "test against implementation-specific numeric parsing", 121 | "doc": {"1e0": "foo"}, 122 | "patch": [{"op": "test", "path": "/1e0", "value": "foo"}], 123 | "expected": {"1e0": "foo"} }, 124 | 125 | { "comment": "test with bad number should fail", 126 | "doc": ["foo", "bar"], 127 | "patch": [{"op": "test", "path": "/1e0", "value": "bar"}], 128 | "error": "test op shouldn't get array element 1" }, 129 | 130 | { "doc": ["foo", "sil"], 131 | "patch": [{"op": "add", "path": "/bar", "value": 42}], 132 | "error": "Object operation on array target" }, 133 | 134 | { "doc": ["foo", "sil"], 135 | "patch": [{"op": "add", "path": "/1", "value": ["bar", "baz"]}], 136 | "expected": ["foo", ["bar", "baz"], "sil"], 137 | "comment": "value in array add not flattened" }, 138 | 139 | { "doc": {"foo": 1, "bar": [1, 2, 3, 4]}, 140 | "patch": [{"op": "remove", "path": "/bar"}], 141 | "expected": {"foo": 1} }, 142 | 143 | { "doc": {"foo": 1, "baz": [{"qux": "hello"}]}, 144 | "patch": [{"op": "remove", "path": "/baz/0/qux"}], 145 | "expected": {"foo": 1, "baz": [{}]} }, 146 | 147 | { "doc": {"foo": 1, "baz": [{"qux": "hello"}]}, 148 | "patch": [{"op": "replace", "path": "/foo", "value": [1, 2, 3, 4]}], 149 | "expected": {"foo": [1, 2, 3, 4], "baz": [{"qux": "hello"}]} }, 150 | 151 | { "doc": {"foo": [1, 2, 3, 4], "baz": [{"qux": "hello"}]}, 152 | "patch": [{"op": "replace", "path": "/baz/0/qux", "value": "world"}], 153 | "expected": {"foo": [1, 2, 3, 4], "baz": [{"qux": "world"}]} }, 154 | 155 | { "doc": ["foo"], 156 | "patch": [{"op": "replace", "path": "/0", "value": "bar"}], 157 | "expected": ["bar"] }, 158 | 159 | { "doc": [""], 160 | "patch": [{"op": "replace", "path": "/0", "value": 0}], 161 | "expected": [0] }, 162 | 163 | { "doc": [""], 164 | "patch": [{"op": "replace", "path": "/0", "value": true}], 165 | "expected": [true] }, 166 | 167 | { "doc": [""], 168 | "patch": [{"op": "replace", "path": "/0", "value": false}], 169 | "expected": [false] }, 170 | 171 | { "doc": [""], 172 | "patch": [{"op": "replace", "path": "/0", "value": null}], 173 | "expected": [null] }, 174 | 175 | { "doc": ["foo", "sil"], 176 | "patch": [{"op": "replace", "path": "/1", "value": ["bar", "baz"]}], 177 | "expected": ["foo", ["bar", "baz"]], 178 | "comment": "value in array replace not flattened" }, 179 | 180 | { "comment": "replace whole document", 181 | "doc": {"foo": "bar"}, 182 | "patch": [{"op": "replace", "path": "", "value": {"baz": "qux"}}], 183 | "expected": {"baz": "qux"} }, 184 | 185 | { "comment": "test replace with missing parent key should fail", 186 | "doc": {"bar": "baz"}, 187 | "patch": [{"op": "replace", "path": "/foo/bar", "value": false}], 188 | "error": "replace op should fail with missing parent key" }, 189 | 190 | { "comment": "spurious patch properties", 191 | "doc": {"foo": 1}, 192 | "patch": [{"op": "test", "path": "/foo", "value": 1, "spurious": 1}], 193 | "expected": {"foo": 1} }, 194 | 195 | { "doc": {"foo": null}, 196 | "patch": [{"op": "test", "path": "/foo", "value": null}], 197 | "expected": {"foo": null}, 198 | "comment": "null value should be valid obj property" }, 199 | 200 | { "doc": {"foo": null}, 201 | "patch": [{"op": "replace", "path": "/foo", "value": "truthy"}], 202 | "expected": {"foo": "truthy"}, 203 | "comment": "null value should be valid obj property to be replaced with something truthy" }, 204 | 205 | { "doc": {"foo": null}, 206 | "patch": [{"op": "move", "from": "/foo", "path": "/bar"}], 207 | "expected": {"bar": null}, 208 | "comment": "null value should be valid obj property to be moved" }, 209 | 210 | { "doc": {"foo": null}, 211 | "patch": [{"op": "copy", "from": "/foo", "path": "/bar"}], 212 | "expected": {"foo": null, "bar": null}, 213 | "comment": "null value should be valid obj property to be copied" }, 214 | 215 | { "doc": {"foo": null}, 216 | "patch": [{"op": "remove", "path": "/foo"}], 217 | "expected": {}, 218 | "comment": "null value should be valid obj property to be removed" }, 219 | 220 | { "doc": {"foo": "bar"}, 221 | "patch": [{"op": "replace", "path": "/foo", "value": null}], 222 | "expected": {"foo": null}, 223 | "comment": "null value should still be valid obj property replace other value" }, 224 | 225 | { "doc": {"foo": {"foo": 1, "bar": 2}}, 226 | "patch": [{"op": "test", "path": "/foo", "value": {"bar": 2, "foo": 1}}], 227 | "expected": {"foo": {"foo": 1, "bar": 2}}, 228 | "comment": "test should pass despite rearrangement" }, 229 | 230 | { "doc": {"foo": [{"foo": 1, "bar": 2}]}, 231 | "patch": [{"op": "test", "path": "/foo", "value": [{"bar": 2, "foo": 1}]}], 232 | "expected": {"foo": [{"foo": 1, "bar": 2}]}, 233 | "comment": "test should pass despite (nested) rearrangement" }, 234 | 235 | { "doc": {"foo": {"bar": [1, 2, 5, 4]}}, 236 | "patch": [{"op": "test", "path": "/foo", "value": {"bar": [1, 2, 5, 4]}}], 237 | "expected": {"foo": {"bar": [1, 2, 5, 4]}}, 238 | "comment": "test should pass - no error" }, 239 | 240 | { "doc": {"foo": {"bar": [1, 2, 5, 4]}}, 241 | "patch": [{"op": "test", "path": "/foo", "value": [1, 2]}], 242 | "error": "test op should fail" }, 243 | 244 | { "comment": "Whole document", 245 | "doc": { "foo": 1 }, 246 | "patch": [{"op": "test", "path": "", "value": {"foo": 1}}], 247 | "disabled": true }, 248 | 249 | { "comment": "Empty-string element", 250 | "doc": { "": 1 }, 251 | "patch": [{"op": "test", "path": "/", "value": 1}], 252 | "expected": { "": 1 } }, 253 | 254 | { "doc": { 255 | "foo": ["bar", "baz"], 256 | "": 0, 257 | "a/b": 1, 258 | "c%d": 2, 259 | "e^f": 3, 260 | "g|h": 4, 261 | "i\\j": 5, 262 | "k\"l": 6, 263 | " ": 7, 264 | "m~n": 8 265 | }, 266 | "patch": [{"op": "test", "path": "/foo", "value": ["bar", "baz"]}, 267 | {"op": "test", "path": "/foo/0", "value": "bar"}, 268 | {"op": "test", "path": "/", "value": 0}, 269 | {"op": "test", "path": "/a~1b", "value": 1}, 270 | {"op": "test", "path": "/c%d", "value": 2}, 271 | {"op": "test", "path": "/e^f", "value": 3}, 272 | {"op": "test", "path": "/g|h", "value": 4}, 273 | {"op": "test", "path": "/i\\j", "value": 5}, 274 | {"op": "test", "path": "/k\"l", "value": 6}, 275 | {"op": "test", "path": "/ ", "value": 7}, 276 | {"op": "test", "path": "/m~0n", "value": 8}], 277 | "expected": { 278 | "": 0, 279 | " ": 7, 280 | "a/b": 1, 281 | "c%d": 2, 282 | "e^f": 3, 283 | "foo": [ 284 | "bar", 285 | "baz" 286 | ], 287 | "g|h": 4, 288 | "i\\j": 5, 289 | "k\"l": 6, 290 | "m~n": 8 291 | } 292 | }, 293 | { "comment": "Move to same location has no effect", 294 | "doc": {"foo": 1}, 295 | "patch": [{"op": "move", "from": "/foo", "path": "/foo"}], 296 | "expected": {"foo": 1} }, 297 | 298 | { "doc": {"foo": 1, "baz": [{"qux": "hello"}]}, 299 | "patch": [{"op": "move", "from": "/foo", "path": "/bar"}], 300 | "expected": {"baz": [{"qux": "hello"}], "bar": 1} }, 301 | 302 | { "doc": {"baz": [{"qux": "hello"}], "bar": 1}, 303 | "patch": [{"op": "move", "from": "/baz/0/qux", "path": "/baz/1"}], 304 | "expected": {"baz": [{}, "hello"], "bar": 1} }, 305 | 306 | { "doc": {"baz": [{"qux": "hello"}], "bar": 1}, 307 | "patch": [{"op": "copy", "from": "/baz/0", "path": "/boo"}], 308 | "expected": {"baz":[{"qux":"hello"}],"bar":1,"boo":{"qux":"hello"}} }, 309 | 310 | { "comment": "replacing the root of the document is possible with add", 311 | "doc": {"foo": "bar"}, 312 | "patch": [{"op": "add", "path": "", "value": {"baz": "qux"}}], 313 | "expected": {"baz":"qux"}}, 314 | 315 | { "comment": "Adding to \"/-\" adds to the end of the array", 316 | "doc": [ 1, 2 ], 317 | "patch": [ { "op": "add", "path": "/-", "value": { "foo": [ "bar", "baz" ] } } ], 318 | "expected": [ 1, 2, { "foo": [ "bar", "baz" ] } ]}, 319 | 320 | { "comment": "Adding to \"/-\" adds to the end of the array, even n levels down", 321 | "doc": [ 1, 2, [ 3, [ 4, 5 ] ] ], 322 | "patch": [ { "op": "add", "path": "/2/1/-", "value": { "foo": [ "bar", "baz" ] } } ], 323 | "expected": [ 1, 2, [ 3, [ 4, 5, { "foo": [ "bar", "baz" ] } ] ] ]}, 324 | 325 | { "comment": "test remove with bad number should fail", 326 | "doc": {"foo": 1, "baz": [{"qux": "hello"}]}, 327 | "patch": [{"op": "remove", "path": "/baz/1e0/qux"}], 328 | "error": "remove op shouldn't remove from array with bad number" }, 329 | 330 | { "comment": "test remove on array", 331 | "doc": [1, 2, 3, 4], 332 | "patch": [{"op": "remove", "path": "/0"}], 333 | "expected": [2, 3, 4] }, 334 | 335 | { "comment": "test repeated removes", 336 | "doc": [1, 2, 3, 4], 337 | "patch": [{ "op": "remove", "path": "/1" }, 338 | { "op": "remove", "path": "/2" }], 339 | "expected": [1, 3] }, 340 | 341 | { "comment": "test remove with bad index should fail", 342 | "doc": [1, 2, 3, 4], 343 | "patch": [{"op": "remove", "path": "/1e0"}], 344 | "error": "remove op shouldn't remove from array with bad number" }, 345 | 346 | { "comment": "test replace with bad number should fail", 347 | "doc": [""], 348 | "patch": [{"op": "replace", "path": "/1e0", "value": false}], 349 | "error": "replace op shouldn't replace in array with bad number" }, 350 | 351 | { "comment": "test copy with bad number should fail", 352 | "doc": {"baz": [1,2,3], "bar": 1}, 353 | "patch": [{"op": "copy", "from": "/baz/1e0", "path": "/boo"}], 354 | "error": "copy op shouldn't work with bad number" }, 355 | 356 | { "comment": "test move with bad number should fail", 357 | "doc": {"foo": 1, "baz": [1,2,3,4]}, 358 | "patch": [{"op": "move", "from": "/baz/1e0", "path": "/foo"}], 359 | "error": "move op shouldn't work with bad number" }, 360 | 361 | { "comment": "test add with bad number should fail", 362 | "doc": ["foo", "sil"], 363 | "patch": [{"op": "add", "path": "/1e0", "value": "bar"}], 364 | "error": "add op shouldn't add to array with bad number" }, 365 | 366 | { "comment": "missing 'value' parameter to add", 367 | "doc": [ 1 ], 368 | "patch": [ { "op": "add", "path": "/-" } ], 369 | "error": "missing 'value' parameter" }, 370 | 371 | { "comment": "missing 'value' parameter to replace", 372 | "doc": [ 1 ], 373 | "patch": [ { "op": "replace", "path": "/0" } ], 374 | "error": "missing 'value' parameter" }, 375 | 376 | { "comment": "missing 'value' parameter to test", 377 | "doc": [ null ], 378 | "patch": [ { "op": "test", "path": "/0" } ], 379 | "error": "missing 'value' parameter" }, 380 | 381 | { "comment": "missing value parameter to test - where undef is falsy", 382 | "doc": [ false ], 383 | "patch": [ { "op": "test", "path": "/0" } ], 384 | "error": "missing 'value' parameter" }, 385 | 386 | { "comment": "missing from parameter to copy", 387 | "doc": [ 1 ], 388 | "patch": [ { "op": "copy", "path": "/-" } ], 389 | "error": "missing 'from' parameter" }, 390 | 391 | { "comment": "missing from location to copy", 392 | "doc": { "foo": 1 }, 393 | "patch": [ { "op": "copy", "from": "/bar", "path": "/foo" } ], 394 | "error": "missing 'from' location" }, 395 | 396 | { "comment": "missing from parameter to move", 397 | "doc": { "foo": 1 }, 398 | "patch": [ { "op": "move", "path": "" } ], 399 | "error": "missing 'from' parameter" }, 400 | 401 | { "comment": "missing from location to move", 402 | "doc": { "foo": 1 }, 403 | "patch": [ { "op": "move", "from": "/bar", "path": "/foo" } ], 404 | "error": "mis 405 | { "comment": "test with bad array number that has leading zeros", 406 | "docd fail" }, 407 | 408 | { "comment": "Removing nonexistent index", 409 | "doc": ["foo", "bar"], 410 | "patch": [{"op": "remove", "path": "/2"}], 411 | "error": "removing a nonexistent index should fail" }, 412 | 413 | { "comment": "Patch with different capitalisation than doc", 414 | "doc": {"foo":"bar"}, 415 | "patch": [{"op": "add", "path": "/FOO", "value": "BAR"}], 416 | "expected": {"foo": "bar", "FOO": "BAR"} 417 | } 418 | 419 | ] 420 | -------------------------------------------------------------------------------- /demos/cjson/seeds_invalid/is3: -------------------------------------------------------------------------------- 1 | "" -------------------------------------------------------------------------------- /demos/cjson/seeds_invalid/is4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/cjson/seeds_invalid/is4 -------------------------------------------------------------------------------- /demos/cjson/seeds_invalid/malformed.json: -------------------------------------------------------------------------------- 1 | } -------------------------------------------------------------------------------- /demos/cjson/seeds_invalid/single: -------------------------------------------------------------------------------- 1 | S -------------------------------------------------------------------------------- /demos/cjson/seeds_valid/s1.json: -------------------------------------------------------------------------------- 1 | { 2 | "glossary": { 3 | "title": "example glossary", 4 | "GlossDiv": { 5 | "title": "S", 6 | "GlossList": { 7 | "GlossEntry": { 8 | "ID": "SGML", 9 | "SortAs": "SGML", 10 | "GlossTerm": "Standard Generalized Markup Language", 11 | "Acronym": "SGML", 12 | "Abbrev": "ISO 8879:1986", 13 | "GlossDef": { 14 | "para": "A meta-markup language, used to create markup languages such as DocBook.", 15 | "GlossSeeAlso": ["GML", "XML"] 16 | }, 17 | "GlossSee": "markup" 18 | } 19 | } 20 | } 21 | } 22 | } 23 | -------------------------------------------------------------------------------- /demos/cjson/seeds_valid/s2.json: -------------------------------------------------------------------------------- 1 | [ 2 | { 3 | "comment": "4.1. add with missing object", 4 | "doc": { "q": { "bar": 2 } }, 5 | "patch": [ {"op": "add", "path": "/a/b", "value": 1} ], 6 | "error": 7 | "path /a does not exist -- missing objects are not created recursively" 8 | }, 9 | 10 | { 11 | "comment": "A.1. Adding an Object Member", 12 | "doc": { 13 | "foo": "bar" 14 | }, 15 | "patch": [ 16 | { "op": "add", "path": "/baz", "value": "qux" } 17 | ], 18 | "expected": { 19 | "baz": "qux", 20 | "foo": "bar" 21 | } 22 | }, 23 | 24 | { 25 | "comment": "A.2. Adding an Array Element", 26 | "doc": { 27 | "foo": [ "bar", "baz" ] 28 | }, 29 | "patch": [ 30 | { "op": "add", "path": "/foo/1", "value": "qux" } 31 | ], 32 | "expected": { 33 | "foo": [ "bar", "qux", "baz" ] 34 | } 35 | }, 36 | 37 | { 38 | "comment": "A.3. Removing an Object Member", 39 | "doc": { 40 | "baz": "qux", 41 | "foo": "bar" 42 | }, 43 | "patch": [ 44 | { "op": "remove", "path": "/baz" } 45 | ], 46 | "expected": { 47 | "foo": "bar" 48 | } 49 | }, 50 | 51 | { 52 | "comment": "A.4. Removing an Array Element", 53 | "doc": { 54 | "foo": [ "bar", "qux", "baz" ] 55 | }, 56 | "patch": [ 57 | { "op": "remove", "path": "/foo/1" } 58 | ], 59 | "expected": { 60 | "foo": [ "bar", "baz" ] 61 | } 62 | }, 63 | 64 | { 65 | "comment": "A.5. Replacing a Value", 66 | "doc": { 67 | "baz": "qux", 68 | "foo": "bar" 69 | }, 70 | "patch": [ 71 | { "op": "replace", "path": "/baz", "value": "boo" } 72 | ], 73 | "expected": { 74 | "baz": "boo", 75 | "foo": "bar" 76 | } 77 | }, 78 | 79 | { 80 | "comment": "A.6. Moving a Value", 81 | "doc": { 82 | "foo": { 83 | "bar": "baz", 84 | "waldo": "fred" 85 | }, 86 | "qux": { 87 | "corge": "grault" 88 | } 89 | }, 90 | "patch": [ 91 | { "op": "move", "from": "/foo/waldo", "path": "/qux/thud" } 92 | ], 93 | "expected": { 94 | "foo": { 95 | "bar": "baz" 96 | }, 97 | "qux": { 98 | "corge": "grault", 99 | "thud": "fred" 100 | } 101 | } 102 | }, 103 | 104 | { 105 | "comment": "A.7. Moving an Array Element", 106 | "doc": { 107 | "foo": [ "all", "grass", "cows", "eat" ] 108 | }, 109 | "patch": [ 110 | { "op": "move", "from": "/foo/1", "path": "/foo/3" } 111 | ], 112 | "expected": { 113 | "foo": [ "all", "cows", "eat", "grass" ] 114 | } 115 | 116 | }, 117 | 118 | { 119 | "comment": "A.8. Testing a Value: Success", 120 | "doc": { 121 | "baz": "qux", 122 | "foo": [ "a", 2, "c" ] 123 | }, 124 | "patch": [ 125 | { "op": "test", "path": "/baz", "value": "qux" }, 126 | { "op": "test", "path": "/foo/1", "value": 2 } 127 | ], 128 | "expected": { 129 | "baz": "qux", 130 | "foo": [ "a", 2, "c" ] 131 | } 132 | }, 133 | 134 | { 135 | "comment": "A.9. Testing a Value: Error", 136 | "doc": { 137 | "baz": "qux" 138 | }, 139 | "patch": [ 140 | { "op": "test", "path": "/baz", "value": "bar" } 141 | ], 142 | "error": "string not equivalent" 143 | }, 144 | 145 | { 146 | "comment": "A.10. Adding a nested Member Object", 147 | "doc": { 148 | "foo": "bar" 149 | }, 150 | "patch": [ 151 | { "op": "add", "path": "/child", "value": { "grandchild": { } } } 152 | ], 153 | "expected": { 154 | "foo": "bar", 155 | "child": { 156 | "grandchild": { 157 | } 158 | } 159 | } 160 | }, 161 | 162 | { 163 | "comment": "A.11. Ignoring Unrecognized Elements", 164 | "doc": { 165 | "foo":"bar" 166 | }, 167 | "patch": [ 168 | { "op": "add", "path": "/baz", "value": "qux", "xyz": 123 } 169 | ], 170 | "expected": { 171 | "foo":"bar", 172 | "baz":"qux" 173 | } 174 | }, 175 | 176 | { 177 | "comment": "A.12. Adding to a Non-existent Target", 178 | "doc": { 179 | "foo": "bar" 180 | }, 181 | "patch": [ 182 | { "op": "add", "path": "/baz/bat", "value": "qux" } 183 | ], 184 | "error": "add to a non-existent target" 185 | }, 186 | 187 | { 188 | "comment": "A.13 Invalid JSON Patch Document", 189 | "doc": { 190 | "foo": "bar" 191 | }, 192 | "patch": [ 193 | { "op": "add", "path": "/baz", "value": "qux", "op": "remove" } 194 | ], 195 | "error": "operation has two 'op' members", 196 | "disabled": true 197 | }, 198 | 199 | { 200 | "comment": "A.14. ~ Escape Ordering", 201 | "doc": { 202 | "/": 9, 203 | "~1": 10 204 | }, 205 | "patch": [{"op": "test", "path": "/~01", "value": 10}], 206 | "expected": { 207 | "/": 9, 208 | "~1": 10 209 | } 210 | }, 211 | 212 | { 213 | "comment": "A.15. Comparing Strings and Numbers", 214 | "doc": { 215 | "/": 9, 216 | "~1": 10 217 | }, 218 | "patch": [{"op": "test", "path": "/~01", "value": "10"}], 219 | "error": "number is not equal to string" 220 | }, 221 | 222 | { 223 | "comment": "A.16. Adding an Array Value", 224 | "doc": { 225 | "foo": ["bar"] 226 | }, 227 | "patch": [{ "op": "add", "path": "/foo/-", "value": ["abc", "def"] }], 228 | "expected": { 229 | "foo": ["bar", ["abc", "def"]] 230 | } 231 | } 232 | 233 | ] 234 | -------------------------------------------------------------------------------- /demos/cjson/seeds_valid/s4.json: -------------------------------------------------------------------------------- 1 | uf{"widget": { 2 | "debug": "on", 3 | "window": { 4 | "title": "Sample Konfabulator Widget", 5 | "name": "main_window", 6 | "width": 500, 7 | "height": 500 8 | }, 9 | "image": { 10 | "src": "Images/Sun.png", 11 | "name": "sun1", 12 | "hOffset": 250, 13 | "vOffset": 250, 14 | "alignment": "center" 15 | }, 16 | "text": { 17 | "data": "Click Here", 18 | "size": 36, 19 | "style": "bold", 20 | "name": "text1", 21 | "hOffset": 250, 22 | "vOffset": 100, 23 | "alignment": "center", 24 | "onMouseUp": "sun1.opacity = (sun1.opacity / 100) * 90;" 25 | } 26 | }} -------------------------------------------------------------------------------- /demos/cjson/seeds_valid/s5.json: -------------------------------------------------------------------------------- 1 | bf{"menu": { 2 | "header": "SVG Viewer", 3 | "items": [ 4 | {"id": "Open"}, 5 | {"id": "OpenNew", "label": "Open New"}, 6 | null, 7 | {"id": "ZoomIn", "label": "Zoom In"}, 8 | {"id": "ZoomOut", "label": "Zoom Out"}, 9 | {"id": "OriginalView", "label": "Original View"}, 10 | null, 11 | {"id": "Quality"}, 12 | {"id": "Pause"}, 13 | {"id": "Mute"}, 14 | null, 15 | {"id": "Find", "label": "Find..."}, 16 | {"id": "FindAgain", "label": "Find Again"}, 17 | {"id": "Copy"}, 18 | {"id": "CopyAgain", "label": "Copy Again"}, 19 | {"id": "CopySVG", "label": "Copy SVG"}, 20 | {"id": "ViewSVG", "label": "View SVG"}, 21 | {"id": "ViewSource", "label": "View Source"}, 22 | {"id": "SaveAs", "label": "Save As"}, 23 | null, 24 | {"id": "Help"}, 25 | {"id": "About", "label": "About Adobe CVG Viewer..."} 26 | ] 27 | }} -------------------------------------------------------------------------------- /demos/faup/Makefile: -------------------------------------------------------------------------------- 1 | CC_FUZZ = afl-clang-fast 2 | CXX_FUZZ = afl-clang-fast++ 3 | CFLAGS_ASAN = -fsanitize=address,undefined 4 | CXXFLAGS_ASAN = -fsanitize=address,undefined 5 | 6 | LIB_NAME = lib 7 | LIB_REPO = https://github.com/stricaud/faup/ 8 | 9 | DEPS = -I $(PWD)/$(LIB_NAME)/build/src/lib/ \ 10 | -I $(PWD)/$(LIB_NAME)/build/src/lib/include \ 11 | -I $(PWD)/$(LIB_NAME)/src/lib/include \ 12 | -L $(PWD)/$(LIB_NAME)/build/src/lib/ 13 | 14 | DEPS_DYN = -lfaupl 15 | DEPS_STC = -l:libfaup_static.a 16 | DEPS_LDD = $(PWD)/$(LIB_NAME)/build/src/lib 17 | 18 | #------------------------------------------------------------------------ 19 | lib: # build for harness generation. Dynamic linking, asan, and afl instrumentation 20 | export AFL_USE_ASAN=1 21 | export AFL_USE_UBSAN=1 22 | rm -rf $(LIB_NAME) 23 | git clone $(LIB_REPO) $(LIB_NAME) 24 | cd $(LIB_NAME) && cd build && \ 25 | git checkout 3a26d0a0d643f5035e1d846e6df9472569a6ef0e &&\ 26 | cmake .. \ 27 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CC_FUZZ) -DCMAKE_EXPORT_COMPILE_COMMANDS=ON && \ 28 | make all 29 | 30 | lib_fuzz: # build for fuzzing. Static linking with afl instrumentation 31 | rm -rf $(LIB_NAME)_fuzz 32 | git clone $(LIB_REPO) $(LIB_NAME)_fuzz 33 | cd $(LIB_NAME)_fuzz && \ 34 | git checkout 3a26d0a0d643f5035e1d846e6df9472569a6ef0e &&\ 35 | cd build && \ 36 | cmake .. \ 37 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DBUILD_SHARED_LIBS=OFF && \ 38 | make all -j12 39 | 40 | run_mx: # Use Multiplier to index the library 41 | mx-index --db $(PWD)/$(LIB_NAME).db --target $(PWD)/$(LIB_NAME)/build/compile_commands.json --workspace $(PWD)/mx 42 | 43 | #------------------------------------------------------------------------ 44 | all: lib lib_fuzz run_mx 45 | 46 | #------------------------------------------------------------------------ 47 | harness: # make command used to make the harness during generation 48 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c $(DEPS) $(DEPS_DYN) $(CFLAGS_ASAN) 49 | 50 | showmap: # command used to get coverage information about library under test 51 | LD_LIBRARY_PATH=$(DEPS_LDD) afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 52 | 53 | 54 | harness_fuzz: # compile a harness specifically for fuzzing. Pass the harness number using make harness_fuzz HARNESS_NUMBER=x 55 | @ls bin || mkdir bin 56 | $(eval LIB_NAME=lib_fuzz) \ 57 | $(CC_FUZZ) -o bin/ogharn$(HARNESS_NUMBER)\_fuzz $(OUT)/final-harnesses/src/harness$(HARNESS_NUMBER):*.c -static $(DEPS) $(DEPS_STC) ; 58 | 59 | clean: 60 | rm -rf bin mx lib.db-* 61 | 62 | clean_lib: 63 | rm -rf $(LIB_NAME)* -------------------------------------------------------------------------------- /demos/faup/run_ogharn.sh: -------------------------------------------------------------------------------- 1 | ogharn.py -i $PWD -o $PWD/out -n 3 -m $PWD/lib.db -h faup/decode.h faup/faup.h faup/options.h faup/features.h -r b -d -as -------------------------------------------------------------------------------- /demos/faup/seeds_invalid/s3: -------------------------------------------------------------------------------- 1 | http:chart.apis.google.comchart?chs=500x500&chma0,0,100,100&cht=p&chco=FF0000!!%2CF FFF00%78000%2C00FF00%7C00FF00%2C0000FF&chd=t%3A122%2C42%2C17%2C10%2C8%2C7%2C7%2C7%2C7%2C6%2C6%2C6%2C6%2C5%2C5&chl=122%7C42%7C17%7C10%7C8%7C7%7C7%7C7%7C7%7C6%7C6%7C6%7C6%7C5%7C5&chdl=android%7Cjava%7Cstack-trace%7Cbroadcastreceiver%7Candroid-ndk%7Cuser-agent%7Candroid-webview%7Cwebview%7Cbackground%7Cmultithreading%7Candroid-source%7Csms%7Cadb%7Csollections%7Cactivity|Chart -------------------------------------------------------------------------------- /demos/faup/seeds_invalid/s4: -------------------------------------------------------------------------------- 1 | http/golang.rg@@. /p kg/neturl/#ParseQuery 2 | -------------------------------------------------------------------------------- /demos/faup/seeds_invalid/small: -------------------------------------------------------------------------------- 1 | t -------------------------------------------------------------------------------- /demos/faup/seeds_valid/s1: -------------------------------------------------------------------------------- 1 | news:comp.infosystems.www.servers.unix 2 | -------------------------------------------------------------------------------- /demos/faup/seeds_valid/s2: -------------------------------------------------------------------------------- 1 | p://[-0xfC6c.0x3df1f832ED3:db8::7] -------------------------------------------------------------------------------- /demos/faup/seeds_valid/s3: -------------------------------------------------------------------------------- 1 | http://chart.apis.google.com/chart?chs=500x500&chma=0,0,100,100&cht=p&chco=FF0000%2CFFFF00%7CFF8000%2C00FF00%7C00FF00%2C0000FF&chd=t%3A122%2C42%2C17%2C10%2C8%2C7%2C7%2C7%2C7%2C6%2C6%2C6%2C6%2C5%2C5&chl=122%7C42%7C17%7C10%7C8%7C7%7C7%7C7%7C7%7C6%7C6%7C6%7C6%7C5%7C5&chdl=android%7Cjava%7Cstack-trace%7Cbroadcastreceiver%7Candroid-ndk%7Cuser-agent%7Candroid-webview%7Cwebview%7Cbackground%7Cmultithreading%7Candroid-source%7Csms%7Cadb%7Csollections%7Cactivity|Chart -------------------------------------------------------------------------------- /demos/faup/seeds_valid/s4: -------------------------------------------------------------------------------- 1 | http://golang.org/pkg/net/url/#ParseQuery 2 | -------------------------------------------------------------------------------- /demos/fyaml/Makefile: -------------------------------------------------------------------------------- 1 | CC_FUZZ = afl-clang-fast 2 | CXX_FUZZ = afl-clang-fast++ 3 | CFLAGS_ASAN = -fsanitize=address,undefined 4 | CXXFLAGS_ASAN = -fsanitize=address,undefined 5 | 6 | LIB_NAME = lib 7 | LIB_REPO = https://github.com/pantoniou/libfyaml/ 8 | 9 | DEPS = -I $(PWD)/$(LIB_NAME)/include/ \ 10 | -I $(PWD)/$(LIB_NAME)/ \ 11 | -L $(PWD)/$(LIB_NAME)/ 12 | 13 | DEPS_DYN=-lfyaml 14 | DEPS_STC = -l:libfyaml.a 15 | DEPS_LDD = $(PWD)/$(LIB_NAME)/ 16 | 17 | #------------------------------------------------------------------------ 18 | lib: # build for harness generation. Dynamic linking, asan, and afl instrumentation 19 | export AFL_USE_ASAN=1 20 | export AFL_USE_UBSAN=1 21 | rm -rf $(LIB_NAME) 22 | git clone $(LIB_REPO) $(LIB_NAME) 23 | cd $(LIB_NAME) && \ 24 | git checkout 1f520e6717113136763cd4485bebfb51fde6a41e && \ 25 | cmake . \ 26 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DBUILD_SHARED_LIBS=ON \ 27 | -DCMAKE_EXPORT_COMPILE_COMMANDS=ON && \ 28 | make all -j12 29 | 30 | lib_fuzz: # build for fuzzing. Static linking with afl instrumentation 31 | rm -rf $(LIB_NAME)_fuzz 32 | git clone $(LIB_REPO) $(LIB_NAME)_fuzz 33 | cd $(LIB_NAME)_fuzz && \ 34 | git checkout 1f520e6717113136763cd4485bebfb51fde6a41e && \ 35 | cmake . \ 36 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DBUILD_SHARED_LIBS=OFF && \ 37 | make all -j12 38 | 39 | run_mx: # Use Multiplier to index the library 40 | mx-index --db $(PWD)/$(LIB_NAME).db --target $(PWD)/$(LIB_NAME)/compile_commands.json --workspace $(PWD)/mx 41 | 42 | #------------------------------------------------------------------------ 43 | all: lib lib_fuzz run_mx 44 | 45 | #------------------------------------------------------------------------ 46 | harness: # make command used to make the harness during generation 47 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c $(DEPS) $(DEPS_DYN) $(CFLAGS_ASAN) 48 | 49 | showmap: # command used to get coverage information about library under test 50 | LD_LIBRARY_PATH=$(DEPS_LDD) afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 51 | 52 | 53 | harness_fuzz: # compile a harness specifically for fuzzing. Pass the harness number using make harness_fuzz HARNESS_NUMBER=x 54 | @ls bin || mkdir bin 55 | $(eval LIB_NAME=lib_fuzz) \ 56 | $(CC_FUZZ) -o bin/ogharn$(HARNESS_NUMBER)\_fuzz $(OUT)/final-harnesses/src/harness$(HARNESS_NUMBER):*.c -static $(DEPS) $(DEPS_STC) ; 57 | 58 | clean: 59 | rm -rf bin mx lib.db-* 60 | 61 | clean_lib: 62 | rm -rf $(LIB_NAME)* -------------------------------------------------------------------------------- /demos/fyaml/run_ogharn.sh: -------------------------------------------------------------------------------- 1 | ogharn.py -i $PWD -o $PWD/out -n 3 -m $PWD/lib.db -h libfyaml.h -r f -d -f -------------------------------------------------------------------------------- /demos/fyaml/seeds_invalid/is4.yaml: -------------------------------------------------------------------------------- 1 | 2 | # 777 3 | 4872 4 | text Pretty vector drawing. 5 | -------------------------------------------------------------------------------- /demos/fyaml/seeds_invalid/small.yaml: -------------------------------------------------------------------------------- 1 | S -------------------------------------------------------------------------------- /demos/fyaml/seeds_valid/s1.yaml: -------------------------------------------------------------------------------- 1 | { ? { complex: 2 }: value } 2 | -------------------------------------------------------------------------------- /demos/fyaml/seeds_valid/s2.yaml: -------------------------------------------------------------------------------- 1 | "top1" : 2 | "key1" : &alias1 scalar1 3 | 'top2' : 4 | 'key2' : &alias2 scalar2 5 | top3: &node3 6 | *alias1 : scalar3 7 | top4: 8 | *alias2 : scalar4 9 | top5 : 10 | scalar5 11 | top6: 12 | &anchor6 'key6' : scalar6 13 | -------------------------------------------------------------------------------- /demos/fyaml/seeds_valid/s4.yaml: -------------------------------------------------------------------------------- 1 | %TAG ! tag:clarkevans.com,2002: 2 | --- !shape 3 | # Use the ! handle for presenting 4 | # tag:clarkevans.com,2002:circle 5 | - !circle 6 | center: &ORIGIN {x: 73, y: 129} 7 | radius: 7 8 | - !line 9 | start: *ORIGIN 10 | finish: { x: 89, y: 102 } 11 | - !label 12 | start: *ORIGIN 13 | color: 0xFFEEBB 14 | text: Pretty vector drawing. 15 | -------------------------------------------------------------------------------- /demos/geos/Makefile: -------------------------------------------------------------------------------- 1 | CC_FUZZ = afl-clang-fast 2 | CXX_FUZZ = afl-clang-fast++ 3 | CFLAGS_ASAN = -fsanitize=address,undefined 4 | CXXFLAGS_ASAN = -fsanitize=address,undefined 5 | 6 | #------------------------------------------------------------------------ 7 | # Edit these below accordingly... 8 | 9 | LIB_NAME = lib 10 | LIB_REPO = https://github.com/libgeos/geos 11 | 12 | DEPS = -I $(PWD)/$(LIB_NAME)/capi/ \ 13 | -I $(PWD)/$(LIB_NAME)/include/ \ 14 | -L $(PWD)/$(LIB_NAME)/lib/ 15 | 16 | DEPS_DYN = -lgeos_c 17 | DEPS_STC = -l:libgeos_c.a -lgeos -static -lstdc++ -lm -lz -lpthread 18 | DEPS_LDD = $(PWD)/$(LIB_NAME)/lib/ 19 | 20 | #------------------------------------------------------------------------ 21 | lib: # build for harness generation. Dynamic linking, asan, and afl instrumentation 22 | export AFL_USE_ASAN=1 23 | export AFL_USE_UBSAN=1 24 | rm -rf $(LIB_NAME) 25 | git clone $(LIB_REPO) $(LIB_NAME) 26 | cd $(LIB_NAME) && \ 27 | git checkout c8b889be9e8fa22de8a34bea50fec3bb073f6898 && \ 28 | cmake . \ 29 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \ 30 | && \ 31 | make all -j12 32 | 33 | lib_fuzz: # build for fuzzing. Static linking with afl instrumentation 34 | rm -rf $(LIB_NAME)_fuzz 35 | git clone $(LIB_REPO) $(LIB_NAME)_fuzz 36 | cd $(LIB_NAME)_fuzz && \ 37 | git checkout c8b889be9e8fa22de8a34bea50fec3bb073f6898 && \ 38 | cmake . \ 39 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DBUILD_SHARED_LIBS=OFF && \ 40 | make all -j12 41 | 42 | run_mx: # Use Multiplier to index the library 43 | mx-index --db $(PWD)/$(LIB_NAME).db --target $(PWD)/$(LIB_NAME)/compile_commands.json --workspace $(PWD)/mx 44 | 45 | #------------------------------------------------------------------------ 46 | all: lib lib_fuzz run_mx 47 | 48 | #------------------------------------------------------------------------ 49 | harness: # make command used to make the harness during generation 50 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c $(DEPS) $(DEPS_DYN) $(CFLAGS_ASAN) 51 | 52 | showmap: # command used to get coverage information about library under test 53 | LD_LIBRARY_PATH=$(DEPS_LDD) afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 54 | 55 | 56 | harness_fuzz: # compile a harness specifically for fuzzing. Pass the harness number using make harness_fuzz HARNESS_NUMBER=x 57 | @ls bin || mkdir bin 58 | $(eval LIB_NAME=lib_fuzz) \ 59 | $(CC_FUZZ) -o bin/ogharn$(HARNESS_NUMBER)\_fuzz $(OUT)/final-harnesses/src/harness$(HARNESS_NUMBER):*.c -static $(DEPS) $(DEPS_STC) ; 60 | 61 | clean: 62 | rm -rf bin mx lib.db-* 63 | 64 | clean_lib: 65 | rm -rf $(LIB_NAME)* -------------------------------------------------------------------------------- /demos/geos/run_ogharn.sh: -------------------------------------------------------------------------------- 1 | ogharn.py -i $PWD -o $PWD/out -n 3 -m $PWD/lib.db -h geos_c.h -r b -d -f -------------------------------------------------------------------------------- /demos/geos/seeds_invalid/seed.txt: -------------------------------------------------------------------------------- 1 | POLYGON((0 0, 10 0, 10 10, 0 10, 0 0) -------------------------------------------------------------------------------- /demos/geos/seeds_valid/seed1.txt: -------------------------------------------------------------------------------- 1 | POLYGON((0 0, 10 0, 10 10, 0 10, 0 0)) -------------------------------------------------------------------------------- /demos/geos/seeds_valid/seed5.txt: -------------------------------------------------------------------------------- 1 | LINESTRING(0 0 1, 1 1 1, 2 1 2) -------------------------------------------------------------------------------- /demos/gpac/Makefile: -------------------------------------------------------------------------------- 1 | CC_FUZZ = afl-clang-fast 2 | CXX_FUZZ = afl-clang-fast++ 3 | CFLAGS_ASAN = -fsanitize=address,undefined 4 | CXXFLAGS_ASAN = -fsanitize=address,undefined 5 | 6 | LIB_NAME = lib 7 | LIB_REPO = https://github.com/gpac/gpac 8 | 9 | DEPS = -I $(PWD)/$(LIB_NAME)/include/ \ 10 | -I $(PWD)/$(LIB_NAME)/ \ 11 | -L $(PWD)/$(LIB_NAME)/bin/gcc/ 12 | 13 | DEPS_DYN = -lgpac 14 | DEPS_STC = -l:libgpac_static.a -lm -lssl -lcrypto -lz -lGLU -lGL -lpng -ljpeg -lvorbis -llzma 15 | DEPS_LDD = $(PWD)/$(LIB_NAME)/bin/gcc 16 | 17 | # NEED TO REPLACE lib/include/gpac/configuration.h with lib/config.h 18 | 19 | #------------------------------------------------------------------------ 20 | lib: # build for harness generation. Dynamic linking, asan, and afl instrumentation -- cp statement at bottom since config file isn't happy 21 | export AFL_USE_ASAN=1 22 | export AFL_USE_UBSAN=1 23 | rm -rf $(LIB_NAME) 24 | git clone $(LIB_REPO) $(LIB_NAME) 25 | cd $(LIB_NAME) && \ 26 | git checkout 5d70253ac94e5840be7b86054131dd753af63cc7 && \ 27 | patch -u include/gpac/internal/isomedia_dev.h \ 28 | -i ../patch.diff && \ 29 | ./configure --enable-static \ 30 | --cc=$(CC_FUZZ) --cxx=$(CXX_FUZZ) && \ 31 | make all -j12 32 | cp $(LIB_NAME)/config.h $(LIB_NAME)/include/gpac/configuration.h 33 | 34 | lib_plain: # build for indexing with multiplier 35 | rm -rf $(LIB_NAME)_plain 36 | git clone $(LIB_REPO) $(LIB_NAME)_plain 37 | cd $(LIB_NAME)_plain && \ 38 | git checkout 5d70253ac94e5840be7b86054131dd753af63cc7 && \ 39 | patch -u include/gpac/internal/isomedia_dev.h \ 40 | -i ../patch.diff && \ 41 | ./configure --enable-static && \ 42 | bear -- make all -j12 43 | 44 | lib_fuzz: # build for fuzzing. Static linking with afl instrumentation -- cp statement at bottom since config file isn't happy 45 | rm -rf $(LIB_NAME) 46 | git clone $(LIB_REPO) $(LIB_NAME)_fuzz 47 | cd $(LIB_NAME)_fuzz && \ 48 | git checkout 5d70253ac94e5840be7b86054131dd753af63cc7 && \ 49 | patch -u include/gpac/internal/isomedia_dev.h \ 50 | -i ../patch.diff && \ 51 | ./configure --enable-static \ 52 | --cc=$(CC_FUZZ) --cxx=$(CXX_FUZZ) && \ 53 | make all -j12 54 | cp $(LIB_NAME)_fuzz/config.h $(LIB_NAME)_fuzz/include/gpac/configuration.h 55 | 56 | run_mx: # Use Multiplier to index the library 57 | mx-index --db $(PWD)/$(LIB_NAME).db --target $(PWD)/$(LIB_NAME)_plain/compile_commands.json --workspace $(PWD)/mx 58 | 59 | #------------------------------------------------------------------------ 60 | all: lib lib_plain lib_fuzz run_mx 61 | 62 | #------------------------------------------------------------------------ 63 | harness: # make command used to make the harness during generation 64 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c $(DEPS) $(CFLAGS_ASAN) 65 | 66 | showmap: # command used to get coverage information about library under test 67 | LD_LIBRARY_PATH=$(DEPS_LDD) afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 68 | 69 | 70 | harness_fuzz: # compile a harness specifically for fuzzing. Pass the harness number using make harness_fuzz HARNESS_NUMBER=x 71 | @ls bin || mkdir bin 72 | $(eval LIB_NAME=lib_fuzz) \ 73 | $(CC_FUZZ) -o bin/ogharn$(HARNESS_NUMBER)\_fuzz $(OUT)/final-harnesses/src/harness$(HARNESS_NUMBER):*.c -static $(DEPS) $(DEPS_STC) ; 74 | 75 | clean: 76 | rm -rf bin mx lib.db-* 77 | 78 | clean_lib: 79 | rm -rf $(LIB_NAME)* -------------------------------------------------------------------------------- /demos/gpac/run_ogharn.sh: -------------------------------------------------------------------------------- 1 | ogharn.py -i $PWD -o $PWD/out -n 3 -m $PWD/lib.db -h gpac/internal/isomedia_dev.h gpac/constants.h gpac/isomedia.h -r f -d -f -------------------------------------------------------------------------------- /demos/gpac/seeds_invalid/s6: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/gpac/seeds_invalid/s6 -------------------------------------------------------------------------------- /demos/gpac/seeds_invalid/s7: -------------------------------------------------------------------------------- 1 | f -------------------------------------------------------------------------------- /demos/gpac/seeds_valid/s1.mp4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/gpac/seeds_valid/s1.mp4 -------------------------------------------------------------------------------- /demos/gpac/seeds_valid/s2.mp4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/gpac/seeds_valid/s2.mp4 -------------------------------------------------------------------------------- /demos/gpac/seeds_valid/s3.mp4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/gpac/seeds_valid/s3.mp4 -------------------------------------------------------------------------------- /demos/gpac/seeds_valid/s4.mp4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/gpac/seeds_valid/s4.mp4 -------------------------------------------------------------------------------- /demos/hdf5/Makefile: -------------------------------------------------------------------------------- 1 | CC_FUZZ = afl-clang-fast 2 | CXX_FUZZ = afl-clang-fast++ 3 | CFLAGS_ASAN = -fsanitize=address,undefined 4 | CXXFLAGS_ASAN = -fsanitize=address,undefined 5 | 6 | LIB_NAME = lib 7 | LIB_REPO = https://github.com/hdfgroup/hdf5 8 | 9 | DEPS = -I $(PWD)/$(LIB_NAME)/src/ \ 10 | -I $(PWD)/$(LIB_NAME)/src/H5FDsubfiling \ 11 | -L $(PWD)/$(LIB_NAME)/src/.libs/ 12 | 13 | DEPS_DYN= -lhdf5 14 | DEPS_LDD = $(PWD)/$(LIB_NAME)/src/.libs/ 15 | DEPS_STC = -l:libhdf5.a -lsz -lz -lm -lsz -laec 16 | 17 | #------------------------------------------------------------------------ 18 | lib: # build for harness generation. Dynamic linking, asan, and afl instrumentation 19 | export AFL_USE_ASAN=1 20 | export AFL_USE_UBSAN=1 21 | rm -rf $(LIB_NAME) 22 | git clone $(LIB_REPO) $(LIB_NAME) 23 | cd $(LIB_NAME) && \ 24 | git checkout 0394b03f66dc45fe96e2c772b7bce293e4316ad2 && \ 25 | ./autogen.sh && ./configure \ 26 | CC=$(CC_FUZZ) CXX=$(CC_FUZZ) && \ 27 | make all -j12 28 | 29 | lib_plain: # build for indexing with multiplier 30 | export AFL_USE_ASAN=1 31 | export AFL_USE_UBSAN=1 32 | rm -rf $(LIB_NAME) 33 | git clone $(LIB_REPO) $(LIB_NAME)_plain 34 | cd $(LIB_NAME)_plain && \ 35 | git checkout 0394b03f66dc45fe96e2c772b7bce293e4316ad2 && \ 36 | ./autogen.sh && ./configure && \ 37 | bear -- make all -j12 38 | 39 | lib_fuzz: # build for fuzzing. Static linking with afl instrumentation 40 | rm -rf $(LIB_NAME)_fuzz 41 | git clone $(LIB_REPO) $(LIB_NAME)_fuzz 42 | cd $(LIB_NAME)_fuzz && \ 43 | git checkout 0394b03f66dc45fe96e2c772b7bce293e4316ad2 && \ 44 | ./autogen.sh && ./configure --enable-static \ 45 | CC=$(CC_FUZZ) CXX=$(CXX_FUZZ) && \ 46 | make all -j12 47 | 48 | run_mx: # Use Multiplier to index the library 49 | mx-index --db $(PWD)/$(LIB_NAME).db --target $(PWD)/$(LIB_NAME)_plain/compile_commands.json --workspace $(PWD)/mx 50 | 51 | #------------------------------------------------------------------------ 52 | all: lib lib_plain lib_fuzz run_mx 53 | 54 | #------------------------------------------------------------------------ 55 | harness: # make command used to make the harness during generation 56 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c $(DEPS) $(DEPS_DYN) $(CFLAGS_ASAN) 57 | 58 | showmap: # command used to get coverage information about library under test 59 | LD_LIBRARY_PATH=$(DEPS_LDD) afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 60 | 61 | harness_fuzz: # compile a harness specifically for fuzzing. Pass the harness number using make harness_fuzz HARNESS_NUMBER=x 62 | @ls bin || mkdir bin 63 | $(eval LIB_NAME=lib_fuzz) \ 64 | $(CC_FUZZ) -o bin/ogharn$(HARNESS_NUMBER)\_fuzz $(OUT)/final-harnesses/src/harness$(HARNESS_NUMBER):*.c -static $(DEPS) $(DEPS_STC) ; 65 | 66 | clean: 67 | rm -rf bin mx lib.db-* 68 | 69 | clean_lib: 70 | rm -rf $(LIB_NAME)* -------------------------------------------------------------------------------- /demos/hdf5/run_ogharn.sh: -------------------------------------------------------------------------------- 1 | ogharn.py -i $PWD -o $PWD/out -n 3 -m $PWD/lib.db -h hdf5.h H5Fpublic.h H5Gpublic.h H5Ipublic.h -r f -d -f -------------------------------------------------------------------------------- /demos/hdf5/seeds_invalid/is1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/hdf5/seeds_invalid/is1 -------------------------------------------------------------------------------- /demos/hdf5/seeds_invalid/is2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/hdf5/seeds_invalid/is2 -------------------------------------------------------------------------------- /demos/hdf5/seeds_invalid/is3: -------------------------------------------------------------------------------- 1 | Testing error API H5Eset/get_auto 2 | Testing error API based on data I/O 3 | All error API tests passed. 4 | This program tests the Error API compatible with HDF5 version (number). There are supposed to be some error messages 5 | ********* Print error stack in HDF5 default way ********* 6 | HDF5-DIAG: Error detected in HDF5 (version (number)) thread (IDs): 7 | #000: (file name) line (number) in main(): fake error message 1 8 | major: Error API 9 | minor: Bad value 10 | 11 | ********* Print error stack in customized way ********* 12 | error #000: (file name) in main(): line (number) 13 | major: Error API 14 | minor: Bad value 15 | HDF5-DIAG: Error detected in HDF5 (version (number)) thread (IDs): 16 | #000: (file name) line (number) in H5Dcreate2(): unable to synchronously create dataset 17 | major: Dataset 18 | minor: Unable to create file 19 | #001: (file name) line (number) in H5D__create_api_common(): can't set object access arguments 20 | major: Dataset 21 | minor: Can't set value 22 | #002: (file name) line (number) in H5VL_setup_acc_args(): invalid location identifier 23 | major: Invalid arguments to routine 24 | minor: Inappropriate type 25 | #003: (file name) line (number) in H5VL_vol_object(): invalid identifier type to function 26 | major: Invalid arguments to routine 27 | minor: Inappropriate type 28 | 29 | ********* Print error stack in customized way ********* 30 | error #000: (file name) in H5VL_vol_object(): line (number) 31 | major: Invalid arguments to routine 32 | minor: Inappropriate type 33 | error #001: (file name) in H5VL_setup_acc_args(): line (number) 34 | major: Invalid arguments to routine 35 | minor: Inappropriate type 36 | error #002: (file name) in H5D__create_api_common(): line (number) 37 | major: Dataset 38 | minor: Can't set value 39 | error #003: (file name) in H5Dcreate2(): line (number) 40 | major: Dataset 41 | minor: Unable to create file 42 | 43 | ********* Print error stack in customized way ********* 44 | error #000: (file name) in H5VL_vol_object(): line (number) 45 | major: Invalid arguments to routine 46 | minor: Inappropriate type 47 | error #001: (file name) in H5VL_setup_acc_args(): line (number) 48 | major: Invalid arguments to routine 49 | minor: Inappropriate type 50 | error #002: (file name) in H5D__create_api_common(): line (number) 51 | major: Dataset 52 | minor: Can't set value 53 | error #003: (file name) in H5Dcreate2(): line (number) 54 | major: Dataset 55 | minor: Unable to create file 56 | error #004: (file name) in H5Eget_auto(1 or 2)(): line (number) 57 | major: Error API 58 | minor: Can't get value 59 | 60 | ********* Print error stack in customized way ********* 61 | error #000: (file name) in H5VL_vol_object(): line (number) 62 | major: Invalid arguments to routine 63 | minor: Inappropriate type 64 | error #001: (file name) in H5VL_setup_acc_args(): line (number) 65 | major: Invalid arguments to routine 66 | minor: Inappropriate type 67 | error #002: (file name) in H5D__create_api_common(): line (number) 68 | major: Dataset 69 | minor: Can't set value 70 | error #003: (file name) in H5Dcreate2(): line (number) 71 | major: Dataset 72 | minor: Unable to create file 73 | HDF5-DIAG: Error detected in HDF5 (version (number)) thread (IDs): 74 | #000: (file name) line (number) in H5Dcreate2(): unable to synchronously create dataset 75 | major: Dataset 76 | minor: Unable to create file 77 | #001: (file name) line (number) in H5D__create_api_common(): can't set object access arguments 78 | major: Dataset 79 | minor: Can't set value 80 | #002: (file name) line (number) in H5VL_setup_acc_args(): invalid location identifier 81 | major: Invalid arguments to routine 82 | minor: Inappropriate type 83 | #003: (file name) line (number) in H5VL_vol_object(): invalid identifier type to function 84 | major: Invalid arguments to routine 85 | minor: Inappropriate type 86 | HDF5-DIAG: Error detected in HDF5 (version (number)) thread (IDs): 87 | #000: (file name) line (number) in main(): fake error message 2 88 | major: Error API 89 | minor: Unrecognized message 90 | #001: (file name) line (number) in test_h5epush1(): expected H5Dwrite error 91 | major: Error API 92 | minor: Write failed 93 | #002: (file name) line (number) in H5Dwrite(): can't synchronously write data 94 | major: Dataset 95 | minor: Write failed 96 | #003: (file name) line (number) in H5D__write_api_common(): dset_id is not a dataset ID 97 | major: Invalid arguments to routine 98 | minor: Inappropriate type 99 | -------------------------------------------------------------------------------- /demos/hdf5/seeds_invalid/is4: -------------------------------------------------------------------------------- 1 | ' -------------------------------------------------------------------------------- /demos/hdf5/seeds_valid/s1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/hdf5/seeds_valid/s1 -------------------------------------------------------------------------------- /demos/hdf5/seeds_valid/s2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/hdf5/seeds_valid/s2 -------------------------------------------------------------------------------- /demos/hdf5/seeds_valid/s3: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/hdf5/seeds_valid/s3 -------------------------------------------------------------------------------- /demos/ical/Makefile: -------------------------------------------------------------------------------- 1 | #------------------------------------------------------------------------ 2 | # Leave these as-is (unless you must change the compiler)! 3 | CC = clang-18 4 | CXX = clang++-18 5 | CC_FUZZ = afl-clang-fast 6 | CXX_FUZZ = afl-clang-fast++ 7 | CFLAGS_ASAN = -fsanitize=address,undefined 8 | CXXFLAGS_ASAN = -fsanitize=address,undefined 9 | 10 | #------------------------------------------------------------------------ 11 | # Edit these below accordingly... 12 | 13 | LIB_NAME = lib 14 | LIB_REPO = https://github.com/libical/libical 15 | 16 | DEPS = -I $(PWD)/$(LIB_NAME)/src/ \ 17 | -I $(PWD)/$(LIB_NAME)/lib/ \ 18 | -L $(PWD)/$(LIB_NAME)/lib/ 19 | 20 | DEPS_DYN = -lical 21 | DEPS_STC = -l:libical.a -licui18n -licuuc -licudata -lstdc++ -lm 22 | DEPS_LDD = $(PWD)/$(LIB_NAME)/lib/ 23 | 24 | #------------------------------------------------------------------------ 25 | lib: # build for harness generation. Dynamic linking, asan, and afl instrumentation 26 | export AFL_USE_ASAN=1 27 | export AFL_USE_UBSAN=1 28 | rm -rf $(LIB_NAME) 29 | git clone $(LIB_REPO) $(LIB_NAME) 30 | cd $(LIB_NAME) && \ 31 | git checkout 460b8d71e70ceb1b88bca6ce8d3aefb2ace05900 && \ 32 | cmake . \ 33 | -DICAL_GLIB_BUILD_DOCS=False -DENABLE_GTK_DOC=OFF -DGOBJECT_INTROSPECTION=False \ 34 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DCMAKE_EXPORT_COMPILE_COMMANDS=ON && \ 35 | make all -j12 36 | 37 | lib_fuzz: # build for fuzzing. Static linking with afl instrumentation 38 | rm -rf $(LIB_NAME)_fuzz 39 | git clone $(LIB_REPO) $(LIB_NAME)_fuzz 40 | cd $(LIB_NAME)_fuzz && \ 41 | git checkout 460b8d71e70ceb1b88bca6ce8d3aefb2ace05900 && \ 42 | cmake . \ 43 | -DENABLE_GTK_DOC=OFF \ 44 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DBUILD_SHARED_LIBS=OFF && \ 45 | make all -j12 46 | 47 | run_mx: # Use Multiplier to index the library 48 | mx-index --db $(PWD)/$(LIB_NAME).db --target $(PWD)/$(LIB_NAME)/compile_commands.json --workspace $(PWD)/mx 49 | 50 | #------------------------------------------------------------------------ 51 | all: lib lib_fuzz run_mx 52 | 53 | #------------------------------------------------------------------------ 54 | harness: # make command used to make the harness during generation 55 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c $(DEPS) $(DEPS_DYN) $(CFLAGS_ASAN) 56 | 57 | showmap: # command used to get coverage information about library under test 58 | LD_LIBRARY_PATH=$(DEPS_LDD) afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 59 | 60 | 61 | harness_fuzz: # compile a harness specifically for fuzzing. Pass the harness number using make harness_fuzz HARNESS_NUMBER=x 62 | @ls bin || mkdir bin 63 | $(eval LIB_NAME=lib_fuzz) \ 64 | $(CC_FUZZ) -o bin/ogharn$(HARNESS_NUMBER)\_fuzz $(OUT)/final-harnesses/src/harness$(HARNESS_NUMBER):*.c -static $(DEPS) $(DEPS_STC) ; 65 | 66 | clean: 67 | rm -rf bin mx lib.db-* 68 | 69 | clean_lib: 70 | rm -rf $(LIB_NAME)* -------------------------------------------------------------------------------- /demos/ical/run_ogharn.sh: -------------------------------------------------------------------------------- 1 | ogharn.py -i $PWD -o $PWD/out -n 3 -m $PWD/lib.db -h libical/ical.h -r b -d -f -------------------------------------------------------------------------------- /demos/ical/seeds_invalid/char: -------------------------------------------------------------------------------- 1 | C -------------------------------------------------------------------------------- /demos/ical/seeds_invalid/empty: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/ical/seeds_invalid/empty -------------------------------------------------------------------------------- /demos/ical/seeds_valid/s1.ics: -------------------------------------------------------------------------------- 1 | BEGIN:VCALENDAR 2 | BEGIN:VEVENT 3 | SUMMARY:Bastille Day Party This option indicates that xauth should attempt to break any authority file locks before proceeding. 4 | SUMMARY:Bastille Day Party This option indicates that xauth should 5 | attempt to break any authority file locks before proceeding. 6 | END:VEVENT 7 | END:VCALENDAR 8 | -------------------------------------------------------------------------------- /demos/ical/seeds_valid/s2.ics: -------------------------------------------------------------------------------- 1 | BEGIN:VCALENDAR 2 | VERSION:0.3 3 | PRODID;a="b":c 4 | CALSCALE;a="c","c";b="c","b":b 5 | METHOD;a=;c="b","c":a 6 | BEGIN:VTIMEZONE 7 | TZID;VALUE=DATE:18640509 8 | RDATE:18640509T181412Z 9 | TZNAME;LANGUAGE="b":b 10 | a: 11 | END:DAYLIGHT 12 | BEGIN:DAYLIGHT 13 | DTSTART;TZID="a":18640509T133726 14 | TZOFFSETTO:+000001 15 | TZOFFSETFROM:+0000 16 | RRULE:FREQ=WEEKLY;COUNT=0;INTERVAL=0;BYSECOND=0;BYHOUR=0;BYMONTH=0;WKST=WE 17 | COMMENT:c 18 | COMMENT;LANGUAGE="c":c 19 | c: 20 | END:DAYLIGHT 21 | BEGIN:DAYLIGHT 22 | DTSTART;VALUE=DATE:18640509 23 | TZOFFSETTO:-000001 24 | TZOFFSETFROM:+0000 25 | COMMENT:c 26 | RDATE;VALUE=DATE: 27 | RDATE;VALUE=PERIOD: 28 | TZNAME;LANGUAGE="a":c 29 | a: 30 | b: 31 | END:DAYLIGHT 32 | b: 33 | c;b="c": 34 | a;c=: 35 | END:VTIMEZONE 36 | BEGIN:VEVENT 37 | DTSTAMP;a="c":18640509T190600Z 38 | UID;c=:a 39 | CREATED;b="c":18640508T035626Z 40 | DESCRIPTION;ALTREP="?//by";a=:c 41 | GEO;b=:1.583617;8.557201 42 | LAST-MODIFIED:18640511T002829Z 43 | ORGANIZER;CN="c";DIR="//jü ";SENT-BY=" kÏ";LANGUAGE="c";c="b":F//žî 44 | PRIORITY;a="b":0 45 | SEQUENCE;a=:-2 46 | STATUS;c=:CONFIRMED 47 | SUMMARY;ALTREP="//";LANGUAGE="a":b 48 | RECURRENCE-ID;VALUE=DATE:18640510 49 | RRULE:FREQ=SECONDLY;INTERVAL=0;BYSECOND=0,0;BYMINUTE=0;BYDAY=0FR;BYYEARDAY= 50 | 0;BYWEEKNO=0;BYMONTH=0;WKST=FR 51 | RRULE:FREQ=SECONDLY;UNTIL=18640509;INTERVAL=-1;BYSECOND=0,0;BYMINUTE=0;BYHO 52 | UR=0;BYDAY=0SU;BYMONTHDAY=0,0;BYYEARDAY=0;BYWEEKNO=0,0;WKST=TU 53 | RRULE;b=:FREQ=YEARLY;UNTIL=18640509;BYSECOND=0;BYMINUTE=0,0;BYHOUR=0;BYDAY= 54 | SU;BYMONTHDAY=0;BYYEARDAY=0,0;BYWEEKNO=0,0;BYMONTH=0,0;WKST=TU 55 | DTEND;VALUE=DATE:18640510 56 | ATTENDEE;ROLE=CHAIR;PARTSTAT="c";DELEGATED-FROM="a//`ï";SENT-BY="//^";CN= 57 | "c";DIR="P";LANGUAGE="b"://F 58 | COMMENT;ALTREP="E":a 59 | CONTACT;LANGUAGE="b";b="a":b 60 | CONTACT;ALTREP="B{":c 61 | REQUEST-STATUS;LANGUAGE="a";b=:0;c;b 62 | RELATED-TO:a 63 | RELATED-TO;c="c";RELTYPE=CHILD:b 64 | RELATED-TO;a="c";RELTYPE=SIBLING:c 65 | RESOURCES;ALTREP="//)";LANGUAGE="a";b=: 66 | RESOURCES;LANGUAGE="c";a="b":b,c 67 | RESOURCES;LANGUAGE="b":c 68 | BEGIN:VALARM 69 | ACTION;b="a":DISPLAY 70 | TRIGGER;VALUE=DATE-TIME:18640509T022805Z 71 | DESCRIPTION:a 72 | END:VALARM 73 | BEGIN:VALARM 74 | ACTION:b 75 | TRIGGER;VALUE=DATE-TIME:18640510T133001Z 76 | a: 77 | END:VALARM 78 | c: 79 | a;b="b": 80 | c: 81 | END:VEVENT 82 | BEGIN:VEVENT 83 | DTSTAMP;b=:18640510T040130Z 84 | UID;a="c":c 85 | DTSTART;VALUE=DATE:18640510 86 | CLASS;a="b":CONFIDENTIAL 87 | CREATED;b="a":18640510T194649Z 88 | GEO;a="a":3.482412;-1.933961 89 | LAST-MODIFIED:18640511T050946Z 90 | ORGANIZER;CN="c";DIR="­";SENT-BY="h//²O":Ç// 91 | PRIORITY;a=:-2 92 | SEQUENCE;b="a":1 93 | SUMMARY;ALTREP="s//QÅ";LANGUAGE="c":b 94 | TRANSP;a=:TRANSPARENT 95 | URL:{ 96 | RECURRENCE-ID;VALUE=DATE;RANGE=THISANDFUTURE:18640508 97 | RRULE:FREQ=DAILY;COUNT=-1;BYMINUTE=0;BYHOUR=0;BYDAY=SU;BYYEARDAY=0,0;BYWEEK 98 | NO=0;BYMONTH=0,0;BYSETPOS=0,0;WKST=SU 99 | ATTENDEE;CUTYPE="a";MEMBER="//+‰";ROLE="b";PARTSTAT=DELEGATED;DELEGATED-FR 100 | OM="//v 101 | >","Æ?";SENT-BY="x";CN="a";DIR="k˜";a=://' 102 | ATTENDEE;CUTYPE=UNKNOWN;MEMBER="//q","b//{L";ROLE=NON-PARTICIPANT;PARTSTAT 103 | =TENTATIVE;RSVP=TRUE;DELEGATED-TO="Ɉt","//8";CN="c";LANGUAGE="b":”// + 104 | ATTENDEE;CUTYPE=GROUP;ROLE="a";PARTSTAT="a";DELEGATED-FROM="//Ï","'//%Q";C 105 | N="c";LANGUAGE="c":·5• 106 | CATEGORIES;LANGUAGE="a": 107 | COMMENT;ALTREP="c˜":b 108 | COMMENT;ALTREP="//Í";LANGUAGE="b";a="b":b 109 | COMMENT;ALTREP="//";a="c":c 110 | CONTACT;ALTREP="[//]„";LANGUAGE="a";b="b":a 111 | CONTACT;ALTREP="l//"Q";LANGUAGE="b";a="c":a 112 | EXDATE;VALUE=DATE;a=:18640508 113 | EXDATE;VALUE=DATE:18640510 114 | EXDATE;VALUE=DATE;b=:18640510 115 | REQUEST-STATUS;c=:;b;b 116 | REQUEST-STATUS:;c;c 117 | RELATED-TO;c="a";RELTYPE=SIBLING:b 118 | RESOURCES;ALTREP="//";LANGUAGE="c":a 119 | RESOURCES;LANGUAGE="c":b 120 | RESOURCES;ALTREP="Cô":c 121 | RDATE;VALUE=DATE:18640509 122 | RDATE;VALUE=PERIOD: 123 | RDATE;VALUE=PERIOD;c=: 124 | c: 125 | b: 126 | END:VEVENT 127 | BEGIN:Vb 128 | END:Vb 129 | BEGIN:Vb 130 | c: 131 | b;b=: 132 | END:Vb 133 | END:VCALENDAR 134 | -------------------------------------------------------------------------------- /demos/ical/seeds_valid/s3.ics: -------------------------------------------------------------------------------- 1 | BEGIN:VCALENDAR 2 | VERSION:2.0 3 | PRODID:-//hacksw/handcal//NONSGML v1.0//EN 4 | BEGIN:VEVENT 5 | DTSTART:19970714T170000Z 6 | DTEND:19970715T035959Z 7 | SUMMARY:Bastille Day Party 8 | END:VEVENT 9 | END:VCALENDAR 10 | 11 | BEGIN:VEVENT 12 | UID:19970901T130000Z-123401@host.com 13 | DTSTAMP:19970901T130000Z 14 | DTSTART:19970903T163000Z 15 | DTEND:19970903T190000Z 16 | SUMMARY:Annual Employee Review 17 | CLASS:PRIVATE 18 | CATEGORIES:BUSINESS,HUMAN RESOURCES 19 | END:VEVENT 20 | 21 | BEGIN:VEVENT 22 | UID:19970901T130000Z-123402@host.com 23 | DTSTAMP:19970901T130000Z 24 | DTSTART:19970401T163000Z 25 | DTEND:19970402T010000Z 26 | SUMMARY:Laurel is in sensitivity awareness class. 27 | CLASS:PUBLIC 28 | CATEGORIES:BUSINESS,HUMAN RESOURCES 29 | TRANSP:TRANSPARENT 30 | END:VEVENT 31 | 32 | BEGIN:VEVENT 33 | UID:19970901T130000Z-123403@host.com 34 | DTSTAMP:19970901T130000Z 35 | DTSTART:19971102 36 | SUMMARY:Our Blissful Anniversary 37 | CLASS:CONFIDENTIAL 38 | CATEGORIES:ANNIVERSARY,PERSONAL,SPECIAL OCCASION 39 | RRULE:FREQ=YEARLY 40 | END:VEVENT 41 | 42 | BEGIN:VTODO 43 | UID:19970901T130000Z-123404@host.com 44 | DTSTAMP:19970901T130000Z 45 | DTSTART:19970415T133000Z 46 | DUE:19970416T045959Z 47 | SUMMARY:1996 Income Tax Preparation 48 | CLASS:CONFIDENTIAL 49 | CATEGORIES:FAMILY,FINANCE 50 | PRIORITY:1 51 | STATUS:NEEDS-ACTION 52 | END:VTODO 53 | 54 | BEGIN:VJOURNAL 55 | UID:19970901T130000Z-123405@host.com 56 | DTSTAMP:19970901T130000Z 57 | DTSTART;VALUE=DATE:19970317 58 | SUMMARY:Staff meeting minutes 59 | DESCRIPTION:1. Staff meeting: Participants include Joe\, Lisa 60 | and Bob. Aurora project plans were reviewed. There is currently 61 | no budget reserves for this project. Lisa will escalate to 62 | management. Next meeting on Tuesday.\n 63 | 2. Telephone Conference: ABC Corp. sales representative called 64 | to discuss new printer. Promised to get us a demo by Friday.\n 65 | 3. Henry Miller (Handsoff Insurance): Car was totaled by tree. 66 | Is looking into a loaner car. 654-2323 (tel). 67 | END:VJOURNAL 68 | BEGIN:VFREEBUSY 69 | ORGANIZER:MAILTO:jane_doe@host1.com 70 | ATTENDEE:MAILTO:john_public@host2.com 71 | DTSTART:19971015T050000Z 72 | DTEND:19971016T050000Z 73 | DTSTAMP:19970901T083000Z 74 | END:VFREEBUSY 75 | 76 | BEGIN:VFREEBUSY 77 | ORGANIZER:MAILTO:jane_doe@host1.com 78 | ATTENDEE:MAILTO:john_public@host2.com 79 | DTSTAMP:19970901T100000Z 80 | DTSTART:19971015T050000Z 81 | DTEND:19971016T050000Z 82 | FREEBUSY;VALUE=PERIOD:19971015T050000Z/PT8H30M, 83 | 19971015T160000Z/PT5H30M,19971015T223000Z/PT6H30M 84 | URL:http://host2.com/pub/busy/jpublic-01.ifb 85 | COMMENT:This iCalendar file contains busy time information for 86 | the next three months. 87 | END:VFREEBUSY 88 | 89 | BEGIN:VFREEBUSY 90 | ORGANIZER:jsmith@host.com 91 | DTSTART:19980313T141711Z 92 | DTEND:19980410T141711Z 93 | FREEBUSY:19980314T233000Z/19980315T003000Z 94 | FREEBUSY:19980316T153000Z/19980316T163000Z 95 | FREEBUSY:19980318T030000Z/19980318T040000Z 96 | URL:http://www.host.com/calendar/busytime/jsmith.ifb 97 | END:VFREEBUSY 98 | BEGIN:VTIMEZONE 99 | TZID:US-Eastern 100 | LAST-MODIFIED:19870101T000000Z 101 | BEGIN:STANDARD 102 | DTSTART:19971026T020000 103 | RDATE:19971026T020000 104 | TZOFFSETFROM:-0400 105 | TZOFFSETTO:-0500 106 | TZNAME:EST 107 | END:STANDARD 108 | BEGIN:DAYLIGHT 109 | DTSTART:19971026T020000 110 | RDATE:19970406T020000 111 | TZOFFSETFROM:-0500 112 | TZOFFSETTO:-0400 113 | TZNAME:EDT 114 | END:DAYLIGHT 115 | END:VTIMEZONE 116 | BEGIN:VTIMEZONE 117 | TZID:US-Eastern 118 | LAST-MODIFIED:19870101T000000Z 119 | TZURL:http://zones.stds_r_us.net/tz/US-Eastern 120 | BEGIN:STANDARD 121 | DTSTART:19671029T020000 122 | RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10 123 | TZOFFSETFROM:-0400 124 | TZOFFSETTO:-0500 125 | TZNAME:EST 126 | END:STANDARD 127 | BEGIN:DAYLIGHT 128 | DTSTART:19870405T020000 129 | RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4 130 | TZOFFSETFROM:-0500 131 | TZOFFSETTO:-0400 132 | TZNAME:EDT 133 | END:DAYLIGHT 134 | END:VTIMEZONE 135 | BEGIN:VTIMEZONE 136 | TZID:US--Fictitious-Eastern 137 | LAST-MODIFIED:19870101T000000Z 138 | BEGIN:STANDARD 139 | DTSTART:19671029T020000 140 | RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10 141 | TZOFFSETFROM:-0400 142 | TZOFFSETTO:-0500 143 | TZNAME:EST 144 | END:STANDARD 145 | BEGIN:DAYLIGHT 146 | DTSTART:19870405T020000 147 | RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4;UNTIL=19980404T070000Z 148 | TZOFFSETFROM:-0500 149 | TZOFFSETTO:-0400 150 | TZNAME:EDT 151 | END:DAYLIGHT 152 | END:VTIMEZONE 153 | BEGIN:VTIMEZONE 154 | TZID:US--Fictitious-Eastern 155 | LAST-MODIFIED:19870101T000000Z 156 | BEGIN:STANDARD 157 | DTSTART:19671029T020000 158 | RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10 159 | TZOFFSETFROM:-0400 160 | TZOFFSETTO:-0500 161 | TZNAME:EST 162 | END:STANDARD 163 | BEGIN:DAYLIGHT 164 | DTSTART:19870405T020000 165 | RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4;UNTIL=19980404T070000Z 166 | TZOFFSETFROM:-0500 167 | TZOFFSETTO:-0400 168 | TZNAME:EDT 169 | END:DAYLIGHT 170 | BEGIN:DAYLIGHT 171 | DTSTART:19990424T020000 172 | RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=4 173 | TZOFFSETFROM:-0500 174 | TZOFFSETTO:-0400 175 | TZNAME:EDT 176 | END:DAYLIGHT 177 | END:VTIMEZONE 178 | BEGIN:VALARM 179 | TRIGGER;VALUE=DATE-TIME:19970317T133000Z 180 | REPEAT:4 181 | DURATION:PT15M 182 | ACTION:AUDIO 183 | ATTACH;FMTTYPE=audio/basic:ftp://host.com/pub/sounds/bell-01.aud 184 | END:VALARM 185 | BEGIN:VALARM 186 | TRIGGER:-PT30M 187 | REPEAT:2 188 | DURATION:PT15M 189 | ACTION:DISPLAY 190 | DESCRIPTION:Breakfast meeting with executive\n 191 | team at 8:30 AM EST. 192 | END:VALARM 193 | BEGIN:VALARM 194 | TRIGGER:-P2D 195 | ACTION:EMAIL 196 | ATTENDEE:MAILTO:john_doe@host.com 197 | SUMMARY:*** REMINDER: SEND AGENDA FOR WEEKLY STAFF MEETING *** 198 | DESCRIPTION:A draft agenda needs to be sent out to the attendees 199 | to the weekly managers meeting (MGR-LIST). Attached is a 200 | pointer the document template for the agenda file. 201 | ATTACH;FMTTYPE=application/binary:http://host.com/templates/agen 202 | da.doc 203 | END:VALARM 204 | BEGIN:VALARM 205 | TRIGGER;VALUE=DATE-TIME:19980101T050000Z 206 | REPEAT:23 207 | DURATION:PT1H 208 | ACTION:PROCEDURE 209 | ATTACH;FMTTYPE=application/binary:ftp://host.com/novo- 210 | procs/felizano.exe 211 | END:VALARM 212 | 213 | BEGIN:VCALENDAR 214 | PRODID:-//RDU Software//NONSGML HandCal//EN 215 | VERSION:2.0 216 | BEGIN:VTIMEZONE 217 | TZID:US-Eastern 218 | BEGIN:STANDARD 219 | DTSTART:19981025T020000 220 | RDATE:19981025T020000 221 | TZOFFSETFROM:-0400 222 | TZOFFSETTO:-0500 223 | TZNAME:EST 224 | END:STANDARD 225 | BEGIN:DAYLIGHT 226 | DTSTART:19990404T020000 227 | RDATE:19990404T020000 228 | TZOFFSETFROM:-0500 229 | TZOFFSETTO:-0400 230 | TZNAME:EDT 231 | END:DAYLIGHT 232 | END:VTIMEZONE 233 | BEGIN:VEVENT 234 | DTSTAMP:19980309T231000Z 235 | UID:guid-1.host1.com 236 | ORGANIZER;ROLE=CHAIR:MAILTO:mrbig@host.com 237 | ATTENDEE;RSVP=TRUE;ROLE=REQ-PARTICIPANT;CUTYPE=GROUP: 238 | MAILTO:employee-A@host.com 239 | DESCRIPTION:Project XYZ Review Meeting 240 | CATEGORIES:MEETING 241 | CLASS:PUBLIC 242 | CREATED:19980309T130000Z 243 | SUMMARY:XYZ Project Review 244 | DTSTART;TZID=US-Eastern:19980312T083000 245 | DTEND;TZID=US-Eastern:19980312T093000 246 | LOCATION:1CP Conference Room 4350 247 | END:VEVENT 248 | END:VCALENDAR 249 | 250 | 251 | BEGIN:VCALENDAR 252 | METHOD:PUBLISH 253 | VERSION:2.0 254 | PRODID:-//ABC Corporation//NONSGML My Product//EN 255 | BEGIN:VEVENT 256 | DTSTAMP:19970324T120000Z 257 | SEQUENCE:0 258 | UID:uid3@host1.com 259 | ORGANIZER:MAILTO:jdoe@host1.com 260 | DTSTART:19970324T123000Z 261 | DTEND:19970324T210000Z 262 | CATEGORIES:MEETING,PROJECT 263 | CLASS:PUBLIC 264 | SUMMARY:Calendaring Interoperability Planning Meeting 265 | DESCRIPTION:Discuss how we can test c&s interoperability\n 266 | using iCalendar and other IETF standards. 267 | LOCATION:LDB Lobby 268 | ATTACH;FMTTYPE=application/postscript:ftp://xyzCorp.com/pub/ 269 | conf/bkgrnd.ps 270 | END:VEVENT 271 | END:VCALENDAR 272 | 273 | BEGIN:VCALENDAR 274 | VERSION:2.0 275 | PRODID:-//ABC Corporation//NONSGML My Product//EN 276 | BEGIN:VTODO 277 | DTSTAMP:19980130T134500Z 278 | SEQUENCE:2 279 | UID:uid4@host1.com 280 | ORGANIZER:MAILTO:unclesam@us.gov 281 | ATTENDEE;PARTSTAT=ACCEPTED:MAILTO:jqpublic@host.com 282 | DUE:19980415T235959 283 | STATUS:NEEDS-ACTION 284 | SUMMARY:Submit Income Taxes 285 | BEGIN:VALARM 286 | ACTION:AUDIO 287 | TRIGGER:P1DT25M 288 | ATTACH;FMTTYPE=audio/basic:http://host.com/pub/audio- 289 | files/ssbanner.aud 290 | REPEAT:4 291 | DURATION:PT1H 292 | END:VALARM 293 | END:VTODO 294 | END:VCALENDAR 295 | 296 | BEGIN:VCALENDAR 297 | VERSION:2.0 298 | PRODID:-//ABC Corporation//NONSGML My Product//EN 299 | BEGIN:VJOURNAL 300 | DTSTAMP:19970324T120000Z 301 | UID:uid5@host1.com 302 | ORGANIZER:MAILTO:jsmith@host.com 303 | STATUS:DRAFT 304 | CLASS:PUBLIC 305 | CATEGORIES:Project Report, XYZ, Weekly Meeting 306 | DESCRIPTION:Project xyz Review Meeting Minutes\n 307 | Agenda\n1. Review of project version 1.0 requirements.\n2. 308 | Definition 309 | of project processes.\n3. Review of project schedule.\n 310 | Participants: John Smith\, Jane Doe\, Jim Dandy\n-It was 311 | decided that the requirements need to be signed off by 312 | product marketing.\n-Project processes were accepted.\n 313 | -Project schedule needs to account for scheduled holidays 314 | and employee vacation time. Check with HR for specific 315 | dates.\n-New schedule will be distributed by Friday.\n- 316 | Next weeks meeting is cancelled. No meeting until 3/23. 317 | END:VJOURNAL 318 | END:VCALENDAR 319 | BEGIN:VCALENDAR 320 | VERSION:2.0 321 | PRODID:-//RDU Software//NONSGML HandCal//EN 322 | BEGIN:VFREEBUSY 323 | ORGANIZER:MAILTO:jsmith@host.com 324 | DTSTART:19980313T141711Z 325 | DTEND:19980410T141711Z 326 | FREEBUSY:19980314T233000Z/19980315T003000Z 327 | FREEBUSY:19980316T153000Z/19980316T163000Z 328 | FREEBUSY:19980318T030000Z/19980318T040000Z 329 | URL:http://www.host.com/calendar/busytime/jsmith.ifb 330 | END:VFREEBUSY 331 | END:VCALENDAR 332 | -------------------------------------------------------------------------------- /demos/lcms/Makefile: -------------------------------------------------------------------------------- 1 | CC_FUZZ = afl-cc 2 | CXX_FUZZ = afl-c++ 3 | CFLAGS_ASAN = -fsanitize=address,undefined 4 | CXXFLAGS_ASAN = -fsanitize=address,undefined 5 | 6 | LIB_NAME = lib 7 | LIB_REPO = https://github.com/mm2/Little-CMS.git 8 | 9 | DEPS = -I $(PWD)/$(LIB_NAME)/include/ \ 10 | -L $(PWD)/$(LIB_NAME)/src/.libs \ 11 | 12 | DEPS_DYN = -llcms2 13 | DEPS_STC = -l:liblcms2.a -lm 14 | DEPS_LDD = $(PWD)/$(LIB_NAME)/src/.libs 15 | 16 | #------------------------------------------------------------------------ 17 | lib: # build for harness generation. Dynamic linking, asan, and afl instrumentation 18 | export AFL_USE_ASAN=1 19 | export AFL_USE_UBSAN=1 20 | rm -rf $(LIB_NAME) 21 | git clone $(LIB_REPO) $(LIB_NAME) 22 | cd $(LIB_NAME) && \ 23 | git checkout 676e803e4c34aa223da0b811c8a3ef11ed801afb && \ 24 | ./autogen.sh && ./configure \ 25 | CC=$(CC_FUZZ) CXX=$(CXX_FUZZ) CFLAGS=$(CFLAGS_ASAN) CXXFLAGS=$(CXXFLAGS_ASAN) --enable-static && \ 26 | make all -j12 27 | 28 | 29 | lib_plain: # build for indexing with multiplier 30 | rm -rf $(LIB_NAME)_plain 31 | git clone $(LIB_REPO) $(LIB_NAME)_plain 32 | cd $(LIB_NAME)_plain && \ 33 | git checkout 676e803e4c34aa223da0b811c8a3ef11ed801afb && \ 34 | ./autogen.sh && ./configure \ 35 | CC=$(CC) CXX=$(CXX) --enable-static && \ 36 | bear -- make all -j12 37 | 38 | lib_fuzz: # build for fuzzing. Static linking with afl instrumentation 39 | rm -rf $(LIB_NAME)_fuzz 40 | git clone $(LIB_REPO) $(LIB_NAME)_fuzz 41 | cd $(LIB_NAME)_fuzz && \ 42 | git checkout 676e803e4c34aa223da0b811c8a3ef11ed801afb && \ 43 | ./autogen.sh && ./configure \ 44 | CC=$(CC_FUZZ) CXX=$(CXX_FUZZ) --enable-static && \ 45 | make all -j12 46 | 47 | run_mx: # Use Multiplier to index the library 48 | mx-index --db $(PWD)/$(LIB_NAME).db --target $(PWD)/$(LIB_NAME)/compile_commands.json --workspace $(PWD)/mx 49 | 50 | #------------------------------------------------------------------------ 51 | all: lib lib_fuzz run_mx 52 | 53 | #------------------------------------------------------------------------ 54 | harness: # make command used to make the harness during generation 55 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c $(DEPS) $(DEPS_DYN) $(CFLAGS_ASAN) 56 | 57 | showmap: # command used to get coverage information about library under test 58 | LD_LIBRARY_PATH=$(DEPS_LDD) afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 59 | 60 | harness_fuzz: # compile a harness specifically for fuzzing. Pass the harness number using make harness_fuzz HARNESS_NUMBER=x 61 | @ls bin || mkdir bin 62 | $(eval LIB_NAME=lib_fuzz) \ 63 | $(CC_FUZZ) -o bin/ogharn$(HARNESS_NUMBER)\_fuzz $(OUT)/final-harnesses/src/harness$(HARNESS_NUMBER):*.c -static $(DEPS) $(DEPS_STC) ; 64 | 65 | clean: 66 | rm -rf bin mx lib.db-* 67 | 68 | clean_lib: 69 | rm -rf $(LIB_NAME)* -------------------------------------------------------------------------------- /demos/lcms/run_ogharn.sh: -------------------------------------------------------------------------------- 1 | ogharn.py -i $PWD -o $PWD/out -n 3 -m $PWD/lib.db -h lcms2.h -r b -d -f -------------------------------------------------------------------------------- /demos/lcms/seeds_invalid/is1: -------------------------------------------------------------------------------- 1 | * -------------------------------------------------------------------------------- /demos/lcms/seeds_invalid/is2: -------------------------------------------------------------------------------- 1 | msmntrRGB XYZ � a= 2 |  3 |  4 | $ 5 | ) 6 | / 7 | 4 8 | : 9 | ? 10 | E 11 | J 12 | P 13 | V 14 | [ 15 | a 16 | f 17 | l 18 | r 19 | w 20 | } 21 | � 22 | � 23 | � 24 | � 25 | � 26 | � 27 | � 28 | � 29 | � 30 | � 31 | � 32 | � 33 | � 34 | � 35 | � 36 | � 37 | � 38 | � 39 | � 40 | � 41 | � 42 | �      $ * / 5 ; A G M S Y _ d j p v | � � � � � � � � � � � � � � � � � � � � �   43 |   & , 2 8 > E K Q W ] d j p v } � � � � � � � � � � � � � � � � � � � � 44 |  45 |  46 |  47 |  48 |  49 | ! 50 | ( 51 | . 52 | 5 53 | ; 54 | B 55 | H 56 | O 57 | U 58 | \ 59 | b 60 | i 61 | o 62 | v 63 | | 64 | � 65 | � 66 | � 67 | � 68 | � 69 | � 70 | � 71 | � 72 | � 73 | � 74 | � 75 | � 76 | � 77 | � 78 | � 79 | � 80 | � 81 | � 82 | �")/6=DJQX_flsz�������������������  '.5<CJQX_fmt{������������������ 83 |  '/6=DLSZbipx����������������� #*29AHPW_gnv}����������������'.6>FNU]emu}���������������� #+3;DLT\dlt|���������������� (08AIQZbjs{��������������� 84 | #,4=ENW_hpy��������������� &/7@IRZclu~�������������� &/8AJS\enw�������������� $.7@IR\enw�������������� )2;ENXakt~������������� 85 |  *3=FPZcmw�������������� '0:DNXblu������������ )3=GQ[epz�������������'1;EPZdoy������������ 86 | *4>IS^hs}������������'2<GR\gr|������������    ) 4 ? J T _ j u � � � � � � � � � � � �!!!!%!0!;!F!Q!\!g!r!~!�!�!�!�!�!�!�!�!�!�!�""""%"0"<"G"R"^"i"t""�"�"�"�"�"�"�"�"�"�"�####*#5#A#L#X#c#o#z#�#�#�#�#�#�#�#�#�#�#�$$$$($3$?$K$V$b$n$y$�$�$�$�$�$�$�$�$�$�$�%%%%)%5%A%M%Y%e%p%|%�%�%�%�%�%�%�%�%�%�%�& &&#&/&;&G&S&_&k&w&�&�&�&�&�&�&�&�&�&�&�' ''!'-'9'F'R'^'j'v'�'�'�'�'�'�'�'�'�'�'�( 87 | ((#(/(;(H(T(`(m(y(�(�(�(�(�(�(�(�(�(�))))()4)A)M)Z)g)s)�)�)�)�)�)�)�)�)�)�)�* **$*1*>*J*W*d*q*}*�*�*�*�*�*�*�*�*�*�+ 88 | ++$+1+>+K+X+e+r++�+�+�+�+�+�+�+�+�,,,,(,5,B,O,\,i,v,�,�,�,�,�,�,�,�,�,�---!-/-<-I-V-d-q-~-�-�-�-�-�-�-�-�-�....,.9.G.T.a.o.|.�.�.�.�.�.�.�.�.�////,/:/G/U/b/p/~/�/�/�/�/�/�/�/�/�000"0/0=0K0Y0g0t0�0�0�0�0�0�0�0�0�0�1 89 | 11(161D1R1`1n1|1�1�1�1�1�1�1�1�1�222$222@2N2\2j2y2�2�2�2�2�2�2�2�2�333#313?3M3\3j3x3�3�3�3�3�3�3�3�3�444$434A4O4^4l4{4�4�4�4�4�4�4�4�4�5 55)575F5T5c5r5�5�5�5�5�5�5�5�5�666!606?6N6\6k6z6�6�6�6�6�6�6�6�6�777,7;7I7X7g7v7�7�7�7�7�7�7�7�7�8 88*898H8W8f8u8�8�8�8�8�8�8�8�8�9 99+9:9I9X9g9w9�9�9�9�9�9�9�9�::::.:=:M:\:k:{:�:�:�:�:�:�:�:�;;;%;4;D;S;c;r;�;�;�;�;�;�;�;�;�<<<-<=>>'>7>G>W>g>w>�>�>�>�>�>�>�>�???'?7?G?W?g?x?�?�?�?�?�?�?�?�@ @@*@:@J@Z@k@{@�@�@�@�@�@�@�@�AAA/A?AOA`ApA�A�A�A�A�A�A�A�BBB&B6BGBWBhBxB�B�B�B�B�B�B�B�CCC/C@CQCaCrC�C�C�C�C�C�C�C�D DD+D;DLD]DnDD�D�D�D�D�D�D�EEE(E9EJE[ElE}E�E�E�E�E�E�E�FFF(F9FJF[FlF}F�F�F�F�F�F�F�GGG)G;GLG]GnG�G�G�G�G�G�G�G�H 90 | HH-H?HPHaHsH�H�H�H�H�H�H�H�II"I3IEIVIhIzI�I�I�I�I�I�I�JJJ*J;JMJ_JqJ�J�J�J�J�J�J�J�KK"K4KFKXKiK{K�K�K�K�K�K�K�L 91 | LL.L@LRLdLvL�L�L�L�L�L�L�MMM+M=MOMaMsM�M�M�M�M�M�M�NNN)N;NMN_NrN�N�N�N�N�N�N�OOO)O;ONO`OrO�O�O�O�O�O�O�PPP+P=PPPbPuP�P�P�P�P�P�P�Q QQ/QAQTQgQyQ�Q�Q�Q�Q�Q�Q�RR"R4RGRZRmR�R�R�R�R�R�R�SSS)SUQUeUxU�U�U�U�U�U�U�VV%V8VKV_VrV�V�V�V�V�V�V�W 93 | W W4WGW[WnW�W�W�W�W�W�W�X 94 | XX1XEXXXlX�X�X�X�X�X�X�Y YY0YDYXYkYY�Y�Y�Y�Y�Y�Z ZZ1ZEZYZlZ�Z�Z�Z�Z�Z�Z�[ [[3[G[[[o[�[�[�[�[�[�[�\\#\7\K\`\t\�\�\�\�\�\�]]])]=]Q]e]z]�]�]�]�]�]�^^^0^D^Y^m^�^�^�^�^�^�^�__%_9_N_b_w_�_�_�_�_�_�```/`D`X`m`�`�`�`�`�`�`�aa'a;aPaeaza�a�a�a�a�a�b b b5bIb^bsb�b�b�b�b�b�ccc/cDcYcnc�c�c�c�c�c�ddd+d@dUdjdd�d�d�d�d�d�ee)e>eSehe}e�e�e�e�e�e�ff'f=fRfgf}f�f�f�f�f�f�gg(g=gSghg~g�g�g�g�g�g�hh*h?hUhjh�h�h�h�h�h�iii-iCiXini�i�i�i�i�i�jjj2jHj]jsj�j�j�j�j�j�k k"k8kNkdkzk�k�k�k�k�k�ll*l@lVlll�l�l�l�l�l�mmm3mIm_mum�m�m�m�m�m�nn'n=nSnjn�n�n�n�n�n�ooo3oIo`ovo�o�o�o�o�o�pp*p@pWpmp�p�p�p�p�p�q q"q8qOqfq|q�q�q�q�q�rrr2rHr_rvr�r�r�r�r�r�ss,sCsZsqs�s�s�s�s�s�tt(t?tVtmt�t�t�t�t�t�uu&u=uTuku�u�u�u�u�u�v 95 | v$v;vRvjv�v�v�v�v�v�w w$w;wRwjw�w�w�w�w�w�x 96 | x%xyVyny�y�y�y�y�y�zz*zBzZzqz�z�z�z�z�{{{/{G{_{v{�{�{�{�{�|||5|M|e|}|�|�|�|�|�} }$}<}T}l}�}�}�}�}�}�~~-~E~]~u~�~�~�~�~�7Og�������)�A�Z�r�������Ԁ���5�N�f������ȁ����*�C�[�t�������ւ�� �9�Q�j�������̓����0�H�a�z�����Ą݄���(�A�Z�r�������օ��!�:�S�l�������І���4�M�g�������ˇ����0�I�b�{�����Lj�����,�F�_�x�����ĉމ���*�C�]�v�����Š܊���(�B�[�u�����‹ۋ���(�B�[�u�����Œ܌���)�B�\�v�����Íݍ���+�D�^�x�����Ǝ�����-�G�a�{�����ɏ����1�K�e������ΐ���6�P�k�������ӑ��"�<�W�q�������ڒ���)�D�^�x�����ȓ����1�L�f�������Д�� �;�U�p�������ڕ���*�E�_�z�����ʖ���5�P�k�������֗� �'�B�]�w�����Ș����4�O�j�������֙� �'�B�^�y�����ʚ���7�R�m�������ڛ���,�G�c�~�����М��"�=�Y�t�����Ɲ����4�P�k�������ڞ���,�H�c������ҟ� �%�A�\�x�����ˠ���:�V�r�����ơ����5�Q�m�������ݢ���1�M�i�������٣���-�I�e�������֤��*�G�c������ԥ� �)�E�a�~�����Ӧ� �(�D�`�}�����ҧ� �(�D�a�}�����Ө� �)�E�b�~�����ԩ��*�G�d�������ת��-�J�g�������ګ���0�M�j�������ެ���5�R�o�����ƭ���:�W�t�����̮��#�@�^�{�����ӯ� 97 | �*�H�e�������ڰ���2�P�m�����ű���;�Y�v�����ϲ� 98 | �'�E�b�������ٳ���2�O�m�����ƴ���=�[�y�����ҵ��,�I�g�������߶���9�W�u�����Ϸ�� �)�G�e�������ݸ���8�V�t�����ι�� �)�G�f�������ߺ���:�X�v�����ѻ��-�K�j�����ż�� �?�]�|�����ؽ���3�R�q�����;� 99 | �)�G�f�����¿����>�\�{����������4�S�r��������� 100 | �,�K�j‰¨������$�C�bÁà��������<�[�{ĚĹ������6�U�uŔų������0�P�oƏƮ����� �,�K�kNJǪ������(�G�gȆȦ������$�D�dɃɣ������"�A�aʁʡ������ �@�_�˟˿������?�^�~̞̾������>�^�~͞;������?�_�Οο����� �@�`πϠ������!�B�bЂТ������$�D�eхѥ������'�G�h҈ҩ����� 101 | �+�L�lӍӭ������0�P�qԒԲ������5�V�w՗ո������;�\�}ֿ֞����!�B�cׄץ������)�J�k،ح������1�R�sٔٵ������:�[�|ڞڿ����"�D�eۆۨ����� �-�N�oܑܲ������8�Y�{ݜݾ����"�D�eއި����� 102 | �/�P�rߔߵ������<�^��������(�J�l��������7�Y�z������$�F�h��������4�V�x������#�E�g��������4�V�y������$�F�i��������7�Y�{�������(�J�m��������<�^������� �.�Q�s�������!�D�f��������7�Z�}��������+�N�q������� �C�f��������8�[�~������ �.�Q�t������$�H�k��������?�b��������6�Z�}������� �/�R�v��������'�K�o���������!�D�h����������>�b����������9�]����������4�X�|������� �0�T�x��������,�P�u��������)�M�r��������'�K�o��������%�I�m��������chrm��T{L���&f\ -------------------------------------------------------------------------------- /demos/lcms/seeds_invalid/is3: -------------------------------------------------------------------------------- 1 | "8lcmsmntrRGB XYZ � acspAPPL�� -------------------------------------------------------------------------------- /demos/lcms/seeds_valid/s1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/lcms/seeds_valid/s1 -------------------------------------------------------------------------------- /demos/lcms/seeds_valid/s2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/lcms/seeds_valid/s2 -------------------------------------------------------------------------------- /demos/lcms/seeds_valid/s3: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/lcms/seeds_valid/s3 -------------------------------------------------------------------------------- /demos/lcms/seeds_valid/s4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/lcms/seeds_valid/s4 -------------------------------------------------------------------------------- /demos/lcms/seeds_valid/s5: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/lcms/seeds_valid/s5 -------------------------------------------------------------------------------- /demos/lcms/seeds_valid/s7: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/lcms/seeds_valid/s7 -------------------------------------------------------------------------------- /demos/lexbor/Makefile: -------------------------------------------------------------------------------- 1 | CC_FUZZ = afl-clang-fast 2 | CXX_FUZZ = afl-clang-fast++ 3 | CFLAGS_ASAN = -fsanitize=address,undefined 4 | CXXFLAGS_ASAN = -fsanitize=address,undefined 5 | 6 | LIB_NAME = lib 7 | LIB_REPO = https://github.com/lexbor/lexbor 8 | 9 | DEPS = -I $(PWD)/$(LIB_NAME)/source/ \ 10 | -I $(PWD)/$(LIB_NAME)/ \ 11 | -L $(PWD)/$(LIB_NAME)/ 12 | 13 | DEPS_DYN = -llexbor 14 | DEPS_STC = -l:liblexbor_static.a -lm 15 | DEPS_LDD = $(PWD)/$(LIB_NAME)/ 16 | 17 | #------------------------------------------------------------------------ 18 | lib: # build for harness generation. Dynamic linking, asan, and afl instrumentation 19 | export AFL_USE_ASAN=1 20 | export AFL_USE_UBSAN=1 21 | rm -rf $(LIB_NAME) 22 | git clone $(LIB_REPO) $(LIB_NAME) 23 | cd $(LIB_NAME) && \ 24 | git checkout 6c219fe4ec9866067e9a635c5ad1b74cb617e154 && \ 25 | cmake . \ 26 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DCMAKE_EXPORT_COMPILE_COMMANDS=ON && \ 27 | make all -j12 28 | 29 | lib_fuzz: # build for fuzzing. Static linking with afl instrumentation 30 | rm -rf $(LIB_NAME)_fuzz 31 | git clone $(LIB_REPO) $(LIB_NAME)_fuzz 32 | cd $(LIB_NAME)_fuzz && \ 33 | git checkout 6c219fe4ec9866067e9a635c5ad1b74cb617e154 && \ 34 | cmake . \ 35 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DBUILD_SHARED_LIBS=OFF && \ 36 | make all -j12 37 | 38 | run_mx: # Use Multiplier to index the library 39 | mx-index --db $(PWD)/$(LIB_NAME).db --target $(PWD)/$(LIB_NAME)/compile_commands.json --workspace $(PWD)/mx 40 | 41 | #------------------------------------------------------------------------ 42 | all: lib lib_fuzz run_mx 43 | 44 | #------------------------------------------------------------------------ 45 | harness: # make command used to make the harness during generation 46 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c $(DEPS) $(DEPS_DYN) $(CFLAGS_ASAN) 47 | 48 | showmap: # command used to get coverage information about library under test 49 | LD_LIBRARY_PATH=$(DEPS_LDD) afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 50 | 51 | harness_fuzz: # compile a harness specifically for fuzzing. Pass the harness number using make harness_fuzz HARNESS_NUMBER=x 52 | @ls bin || mkdir bin 53 | $(eval LIB_NAME=lib_fuzz) \ 54 | $(CC_FUZZ) -o bin/ogharn$(HARNESS_NUMBER)\_fuzz $(OUT)/final-harnesses/src/harness$(HARNESS_NUMBER):*.c -static $(DEPS) $(DEPS_STC) ; 55 | 56 | clean: 57 | rm -rf bin mx lib.db-* 58 | 59 | clean_lib: 60 | rm -rf $(LIB_NAME)* -------------------------------------------------------------------------------- /demos/lexbor/run_ogharn.sh: -------------------------------------------------------------------------------- 1 | ogharn.py -i $PWD -o $PWD/out -n 3 --m $PWD/lib.db -h lexbor/html/interfaces/document.h -r b -d -f -------------------------------------------------------------------------------- /demos/lexbor/seeds_invalid/empty: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/lexbor/seeds_invalid/empty -------------------------------------------------------------------------------- /demos/lexbor/seeds_invalid/s6.html: -------------------------------------------------------------------------------- 1 | 3 | 4 | 5 | 6 | Postfix manual - canonical(5) 7 | 
  8 | CANONICAL(5)                                                      CANONICAL(5)
  9 | 
 10 | NAME
 11 |        canonical - Postfix canonical table format
 12 | 
 13 | SYNOPSIS
 14 |        postmap /etc/postfix/canonical
 15 | 
 16 |        postmap -q "string" /etc/postfix/canonical
 17 | 
 18 |        postmap -q - /etc/postfix/canonical <inputfile
 19 | 
 20 | DESCRIPTION
 21 |        The  optional canonical(5) table specifies an address mapping for local
 22 |        and non-local addresses. The mapping is used by the cleanup(8)  daemon,
 23 |        before  mail  is  stored into the queue.  The address mapping is recur-
 24 |        sive.
 25 | 
 26 |        Normally, the canonical(5) table is  specified  as  a  text  file  that
 27 |        serves as input to the postmap(1) command.  The result, an indexed file
 28 |        in dbm or db format, is used for fast searching  by  the  mail  system.
 29 |        Execute  the  command  "postmap  /etc/postfix/canonical"  to rebuild an
 30 |        indexed file after changing the corresponding text file.
 31 | 
 32 |        When the table is provided via other means such as NIS,  LDAP  or  SQL,
 33 |        the same lookups are done as for ordinary indexed files.
 34 | 
 35 |        Alternatively,  the  table  can be provided as a regular-expression map
 36 |        where patterns are given as regular  expressions,  or  lookups  can  be
 37 |        directed to a TCP-based server. In those cases, the lookups are done in
 38 |        a slightly different way as described below under  "REGULAR  EXPRESSION
 39 |        TABLES" or "TCP-BASED TABLES".
 40 | 
 41 |        By  default  the  canonical(5)  mapping  affects  both  message  header
 42 |        addresses (i.e. addresses that  appear  inside  messages)  and  message
 43 |        envelope  addresses  (for  example, the addresses that are used in SMTP
 44 |        protocol commands).  This  is  controlled  with  the  canonical_classes
 45 |        parameter.
 46 | 
 47 |        NOTE:  Postfix  versions  2.2  and  later  rewrite message headers from
 48 |        remote SMTP clients only if the  client  matches  the  local_header_re-
 49 |        write_clients parameter, or if the remote_header_rewrite_domain config-
 50 |        uration parameter specifies a non-empty  value.  To  get  the  behavior
 51 |        before    Postfix    2.2,   specify   "local_header_rewrite_clients   =
 52 |        static:all".
 53 | 
 54 |        Typically, one would use the canonical(5) table to replace login  names
 55 |        by Firstname.Lastname, or to clean up addresses produced by legacy mail
 56 |        systems.
 57 | 
 58 |        The canonical(5) mapping is not to be confused with virtual alias  sup-
 59 |        port  or  with  local  aliasing.  To change the destination but not the
 60 |        headers, use the virtual(5) or aliases(5) map instead.
 61 | 
 62 | CASE FOLDING
 63 |        The search string is folded to lowercase before database lookup. As  of
 64 |        Postfix  2.3,  the search string is not case folded with database types
 65 |        such as regexp: or pcre: whose lookup fields can match both  upper  and
 66 |        lower case.
 67 | 
 68 | TABLE FORMAT
 69 |        The input format for the postmap(1) command is as follows:
 70 | 
 71 |        pattern address
 72 |               When  pattern  matches  a mail address, replace it by the corre-
 73 |               sponding address.
 74 | 
 75 |        blank lines and comments
 76 |               Empty lines and whitespace-only lines are ignored, as are  lines
 77 |               whose first non-whitespace character is a `#'.
 78 | 
 79 |        multi-line text
 80 |               A  logical  line  starts  with  non-whitespace text. A line that
 81 |               starts with whitespace continues a logical line.
 82 | 
 83 | TABLE SEARCH ORDER
 84 |        With lookups from indexed files such as DB or DBM,  or  from  networked
 85 |        tables  such  as  NIS,  LDAP  or SQL, each user@domain query produces a
 86 |        sequence of query patterns as described below.
 87 | 
 88 |        Each query pattern is sent to each specified lookup table before trying
 89 |        the next query pattern, until a match is found.
 90 | 
 91 |        user@domain address
 92 |               Replace user@domain by address. This form has the highest prece-
 93 |               dence.
 94 | 
 95 |               This is useful to clean up addresses  produced  by  legacy  mail
 96 |               systems.   It  can  also  be  used to produce Firstname.Lastname
 97 |               style addresses, but see below for a simpler solution.
 98 | 
 99 |        user address
100 |               Replace user@site by address when site is  equal  to  $myorigin,
101 |               when  site  is listed in $mydestination, or when it is listed in
102 |               $inet_interfaces or $proxy_interfaces.
103 | 
104 |               This form is useful for replacing login names by Firstname.Last-
105 |               name.
106 | 
107 |        @domain address
108 |               Replace other addresses in domain by address.  This form has the
109 |               lowest precedence.
110 | 
111 |               Note: @domain is a wild-card.  When  this  form  is  applied  to
112 |               recipient  addresses,  the  Postfix SMTP server accepts mail for
113 |               any recipient in domain, regardless of  whether  that  recipient
114 |               exists.   This  may  turn  your  mail  system into a backscatter
115 |               source: Postfix first accepts mail for  non-existent  recipients
116 |               and  then  tries  to  return that mail as "undeliverable" to the
117 |               often forged sender address.
118 | 
119 |               To avoid backscatter with mail for a wild-card  domain,  replace
120 |               the  wild-card  mapping  with  explicit  1:1  mappings, or add a
121 |               reject_unverified_recipient restriction for that domain:
122 | 
123 |                   smtpd_recipient_restrictions =
124 |                       ...
125 |                       reject_unauth_destination
126 |                       check_recipient_access
127 |                           inline:{example.com=reject_unverified_recipient}
128 |                   unverified_recipient_reject_code = 550
129 | 
130 |               In the above example, Postfix may contact a remote server if the
131 |               recipient is rewritten to a remote address.
132 | 
133 | RESULT ADDRESS REWRITING
134 |        The lookup result is subject to address rewriting:
135 | 
136 |        o      When  the  result  has the form @otherdomain, the result becomes
137 |               the same user in otherdomain.
138 | 
139 |        o      When "append_at_myorigin=yes", append "@$myorigin" to  addresses
140 |               without "@domain".
141 | 
142 |        o      When "append_dot_mydomain=yes", append ".$mydomain" to addresses
143 |               without ".domain".
144 | 
145 | ADDRESS EXTENSION
146 |        When a mail address localpart contains the optional recipient delimiter
147 |        (e.g.,  user+foo@domain),  the  lookup  order becomes: user+foo@domain,
148 |        user@domain, user+foo, user, and @domain.
149 | 
150 |        The  propagate_unmatched_extensions  parameter  controls   whether   an
151 |        unmatched address extension (+foo) is propagated to the result of table
152 |        lookup.
153 | 
154 | REGULAR EXPRESSION TABLES
155 |        This section describes how the table lookups change when the  table  is
156 |        given  in the form of regular expressions. For a description of regular
157 |        expression lookup table syntax, see regexp_table(5) or pcre_table(5).
158 | 
159 |        Each pattern is a regular expression that  is  applied  to  the  entire
160 |        address  being looked up. Thus, user@domain mail addresses are not bro-
161 |        ken up into their user and @domain constituent parts, nor  is  user+foo
162 |        broken up into user and foo.
163 | 
164 |        Patterns  are  applied  in the order as specified in the table, until a
165 |        pattern is found that matches the search string.
166 | 
167 |        Results are the same as with indexed file lookups, with the  additional
168 |        feature  that parenthesized substrings from the pattern can be interpo-
169 |        lated as $1, $2 and so on.
170 | 
171 | TCP-BASED TABLES
172 |        This section describes how the table lookups change  when  lookups  are
173 |        directed   to  a  TCP-based  server.  For  a  description  of  the  TCP
174 |        client/server lookup protocol, see tcp_table(5).  This feature  is  not
175 |        available up to and including Postfix version 2.4.
176 | 
177 |        Each  lookup operation uses the entire address once.  Thus, user@domain
178 |        mail addresses are not broken up  into  their  user  and  @domain  con-
179 |        stituent parts, nor is user+foo broken up into user and foo.
180 | 
181 |        Results are the same as with indexed file lookups.
182 | 
183 | BUGS
184 |        The table format does not understand quoting conventions.
185 | 
186 | CONFIGURATION PARAMETERS
187 |        The  following  main.cf  parameters  are especially relevant.  The text
188 |        below provides only a  parameter  summary.  See  postconf(5)  for  more
189 |        details including examples.
190 | 
191 |        canonical_classes  (envelope_sender, envelope_recipient, header_sender,
192 |        header_recipient)
193 |               What addresses are subject to canonical_maps address mapping.
194 | 
195 |        canonical_maps (empty)
196 |               Optional  address  mapping lookup tables for message headers and
197 |               envelopes.
198 | 
199 |        recipient_canonical_maps (empty)
200 |               Optional address mapping lookup tables for envelope  and  header
201 |               recipient addresses.
202 | 
203 |        sender_canonical_maps (empty)
204 |               Optional  address  mapping lookup tables for envelope and header
205 |               sender addresses.
206 | 
207 |        propagate_unmatched_extensions (canonical, virtual)
208 |               What address lookup tables copy an address  extension  from  the
209 |               lookup key to the lookup result.
210 | 
211 |        Other parameters of interest:
212 | 
213 |        inet_interfaces (all)
214 |               The  network  interface addresses that this mail system receives
215 |               mail on.
216 | 
217 |        local_header_rewrite_clients (permit_inet_interfaces)
218 |               Rewrite message header addresses in mail from these clients  and
219 |               update incomplete addresses with the domain name in $myorigin or
220 |               $mydomain; either  don't  rewrite  message  headers  from  other
221 |               clients at all, or rewrite message headers and update incomplete
222 |               addresses with the domain  specified  in  the  remote_header_re-
223 |               write_domain parameter.
224 | 
225 |        proxy_interfaces (empty)
226 |               The  network  interface addresses that this mail system receives
227 |               mail on by way of a proxy or network address translation unit.
228 | 
229 |        masquerade_classes (envelope_sender, header_sender, header_recipient)
230 |               What addresses are subject to address masquerading.
231 | 
232 |        masquerade_domains (empty)
233 |               Optional list of  domains  whose  subdomain  structure  will  be
234 |               stripped off in email addresses.
235 | 
236 |        masquerade_exceptions (empty)
237 |               Optional  list  of  user names that are not subjected to address
238 |               masquerading,  even  when  their   addresses   match   $masquer-
239 |               ade_domains.
240 | 
241 |        mydestination ($myhostname, localhost.$mydomain, localhost)
242 |               The  list of domains that are delivered via the $local_transport
243 |               mail delivery transport.
244 | 
245 |        myorigin ($myhostname)
246 |               The domain name that locally-posted mail appears to  come  from,
247 |               and that locally posted mail is delivered to.
248 | 
249 |        owner_request_special (yes)
250 |               Enable  special  treatment  for  owner-listname  entries  in the
251 |               aliases(5)  file,  and  don't  split  owner-listname  and  list-
252 |               name-request  address localparts when the recipient_delimiter is
253 |               set to "-".
254 | 
255 |        remote_header_rewrite_domain (empty)
256 |               Don't rewrite message headers from remote clients  at  all  when
257 |               this  parameter is empty; otherwise, rewrite message headers and
258 |               append the specified domain name to incomplete addresses.
259 | 
260 | SEE ALSO
261 |        cleanup(8), canonicalize and enqueue mail
262 |        postmap(1), Postfix lookup table manager
263 |        postconf(5), configuration parameters
264 |        virtual(5), virtual aliasing
265 | 
266 | README FILES
267 |        DATABASE_README, Postfix lookup table overview
268 |        ADDRESS_REWRITING_README, address rewriting guide
269 | 
270 | LICENSE
271 |        The Secure Mailer license must be distributed with this software.
272 | 
273 | AUTHOR(S)
274 |        Wietse Venema
275 |        IBM T.J. Watson Research
276 |        P.O. Box 704
277 |        Yorktown Heights, NY 10598, USA
278 | 
279 |        Wietse Venema
280 |        Google, Inc.
281 |        111 8th Avenue
282 |        New York, NY 10011, USA
283 | 
284 |                                                                   CANONICAL(5)
285 |
286 | -------------------------------------------------------------------------------- /demos/lexbor/seeds_invalid/single: -------------------------------------------------------------------------------- 1 | S -------------------------------------------------------------------------------- /demos/lexbor/seeds_valid/s1.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 |

My First Heading

6 |

My first paragraph.

7 | 8 | 9 | -------------------------------------------------------------------------------- /demos/magic/Makefile: -------------------------------------------------------------------------------- 1 | CC_FUZZ = afl-clang-fast 2 | CXX_FUZZ = afl-clang-fast++ 3 | CFLAGS_ASAN = -fsanitize=address,undefined 4 | CXXFLAGS_ASAN = -fsanitize=address,undefined 5 | 6 | LIB_NAME = lib 7 | LIB_REPO = https://github.com/file/file.git 8 | 9 | DEPS = -I $(PWD)/$(LIB_NAME)/src/ \ 10 | -L $(PWD)/$(LIB_NAME)/src/.libs 11 | 12 | DEPS_DYN = -l magic 13 | DEPS_STC = -l:libmagic.a -llzma -lbz2 -lz -lzstd 14 | DEPS_LDD = $(PWD)/$(LIB_NAME)/src/.libs/ 15 | 16 | #------------------------------------------------------------------------ 17 | lib: # build for harness generation. Dynamic linking, asan, and afl instrumentation 18 | export AFL_USE_ASAN=1 19 | export AFL_USE_UBSAN=1 20 | rm -rf $(LIB_NAME) 21 | git clone $(LIB_REPO) $(LIB_NAME) 22 | cd $(LIB_NAME) && \ 23 | git checkout 0fa2c8c3e64c372d038d46969bafaaa09a13a87b && \ 24 | autoreconf -i && ./configure \ 25 | CC=$(CC_FUZZ) CXX=$(CC_FUZZ) --enable-static && \ 26 | make all -j12 27 | 28 | lib_plain: # Build for indexing with multiplier 29 | export AFL_USE_ASAN=1 30 | export AFL_USE_UBSAN=1 31 | rm -rf $(LIB_NAME)_plain 32 | git clone $(LIB_REPO) $(LIB_NAME)_plain 33 | cd $(LIB_NAME)_plain && \ 34 | git checkout 0fa2c8c3e64c372d038d46969bafaaa09a13a87b && \ 35 | autoreconf -i && ./configure \ 36 | CC=$(CC) CXX=$(CXX) && \ 37 | bear -- make all -j12 38 | 39 | lib_fuzz: # build for fuzzing. Static linking with afl instrumentation 40 | rm -rf $(LIB_NAME)_fuzz 41 | git clone $(LIB_REPO) $(LIB_NAME)_fuzz 42 | cd $(LIB_NAME)_fuzz && \ 43 | git checkout 0fa2c8c3e64c372d038d46969bafaaa09a13a87b && \ 44 | autoreconf -i && ./configure \ 45 | CC=$(CC_FUZZ) CXX=$(CXX_FUZZ) --enable-static && \ 46 | make all -j12 47 | 48 | run_mx: 49 | mx-index --db $(PWD)/$(LIB_NAME).db --target $(PWD)/$(LIB_NAME)_plain/compile_commands.json --workspace $(PWD)/mx 50 | 51 | #------------------------------------------------------------------------ 52 | all: lib lib_plain lib_fuzz run_mx 53 | 54 | #------------------------------------------------------------------------ 55 | harness: # make command used to make the harness during generation 56 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c $(DEPS) $(DEPS_DYN) $(CFLAGS_ASAN) 57 | 58 | showmap: # command used to get coverage information about library under test 59 | LD_LIBRARY_PATH=$(DEPS_LDD) MAGIC=$(PWD)lib/magic/magic.mgc afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 60 | 61 | harness_fuzz: # compile a harness specifically for fuzzing. Pass the harness number using make harness_fuzz HARNESS_NUMBER=x 62 | @ls bin || mkdir bin 63 | $(eval LIB_NAME=lib_fuzz) \ 64 | $(CC_FUZZ) -o bin/ogharn$(HARNESS_NUMBER)\_fuzz $(OUT)/final-harnesses/src/harness$(HARNESS_NUMBER):*.c -static $(DEPS) $(DEPS_STC) ; 65 | 66 | clean: 67 | rm -rf bin mx lib.db-* 68 | 69 | clean_lib: 70 | rm -rf $(LIB_NAME)* -------------------------------------------------------------------------------- /demos/magic/config.yaml: -------------------------------------------------------------------------------- 1 | blacklist: 2 | 3 | preamble_func: magic_load 4 | 5 | arg_keys: 6 | magic_load: 7 | - {"index": 1, "value": "NULL"} 8 | magic_open: 9 | - {"index": 0, "value": "MAGIC_NONE"} -------------------------------------------------------------------------------- /demos/magic/run_ogharn.sh: -------------------------------------------------------------------------------- 1 | ogharn.py -i $PWD -o $PWD/out -n 3 --m $PWD/lib.db -h magic.h file.h -r b -d -f -as -c $PWD/config.yaml -------------------------------------------------------------------------------- /demos/magic/seeds_invalid/is1: -------------------------------------------------------------------------------- 1 | G 2 |  3 | 4 | IHDR D���tEXtSoftwareAdobe ImageReadyq�e<PLTEf�����3�f���>L�aIDATx�ܓ1� �����4 �:aa�7��$ DD�n� 5 | G��ূoϺT�!0o�V�<zM L��0�DH�D"LC�8��՛Ql��&\ �f5��˚IEND�B`� -------------------------------------------------------------------------------- /demos/magic/seeds_invalid/is3: -------------------------------------------------------------------------------- 1 | * -------------------------------------------------------------------------------- /demos/magic/seeds_valid/s1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/magic/seeds_valid/s1 -------------------------------------------------------------------------------- /demos/magic/seeds_valid/s2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/magic/seeds_valid/s2 -------------------------------------------------------------------------------- /demos/magic/seeds_valid/s3: -------------------------------------------------------------------------------- 1 | create table t1(one smallint); 2 | insert into t1 values(1); 3 | select * from t1; 4 | -------------------------------------------------------------------------------- /demos/magic/seeds_valid/s4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/magic/seeds_valid/s4 -------------------------------------------------------------------------------- /demos/magic/seeds_valid/s5: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/magic/seeds_valid/s5 -------------------------------------------------------------------------------- /demos/openexr/Makefile: -------------------------------------------------------------------------------- 1 | CC_FUZZ = afl-clang-fast 2 | CXX_FUZZ = afl-clang-fast++ 3 | CFLAGS_ASAN = -fsanitize=address,undefined 4 | CXXFLAGS_ASAN = -fsanitize=address,undefined 5 | 6 | LIB_NAME = lib 7 | LIB_REPO = https://github.com/AcademySoftwareFoundation/openexr 8 | 9 | DEPS = -I $(PWD)/$(LIB_NAME)/src/lib/OpenEXR \ 10 | -I $(PWD)/$(LIB_NAME)/src/lib/OpenEXRUtil/ \ 11 | -I $(PWD)/$(LIB_NAME)/cmake \ 12 | -L $(PWD)/$(LIB_NAME)/src/lib/OpenEXR/ \ 13 | -L $(PWD)/$(LIB_NAME)/src/lib/IlmThread/ \ 14 | -L $(PWD)/$(LIB_NAME)/src/lib/Iex/ \ 15 | -L $(PWD)/$(LIB_NAME)/_deps/imath-build/src/Imath \ 16 | -L $(PWD)/$(LIB_NAME)/src/lib/OpenEXRCore/ \ 17 | -L $(PWD)/$(LIB_NAME)/src/lib/OpenEXRUtil/ 18 | 19 | DEPS_DYN = -lOpenEXR -lOpenEXRUtil 20 | DEPS_STC = -l:libOpenEXRUtil-3_3.a -l:libOpenEXR-3_3.a -l:libOpenEXRCore-3_3.a -l:libIex-3_3.a -l:libIlmThread-3_3.a -l:libImath-3_2.a -lstdc++ -lm -ldeflate 21 | DEPS_LDD = $(PWD)/$(LIB_NAME)/src/lib/OpenEXR:$(PWD)/$(LIB_NAME)/src/lib/OpenEXRUtil/:$(PWD)/$(LIB_NAME)/src/lib/OpenEXRCore/ 22 | 23 | #------------------------------------------------------------------------ 24 | lib: # build for harness generation. Dynamic linking, asan, and afl instrumentation 25 | export AFL_USE_ASAN=1 26 | export AFL_USE_UBSAN=1 27 | rm -rf $(LIB_NAME) 28 | git clone $(LIB_REPO) $(LIB_NAME) 29 | cd $(LIB_NAME) && \ 30 | git checkout d669510fda59ac26dc183e8bc271208c0eb737ad && \ 31 | cmake . \ 32 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DCMAKE_EXPORT_COMPILE_COMMANDS=ON -DBUILD_TESTING=OFF \ 33 | BUILD_TESTING=OFF && \ 34 | make all -j12 35 | 36 | lib_fuzz: # build for fuzzing. Static linking with afl instrumentation 37 | rm -rf $(LIB_NAME)_fuzz 38 | git clone $(LIB_REPO) $(LIB_NAME)_fuzz 39 | cd $(LIB_NAME)_fuzz && \ 40 | git checkout d669510fda59ac26dc183e8bc271208c0eb737ad && \ 41 | cmake . \ 42 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DBUILD_SHARED_LIBS=OFF -DBUILD_TESTING=OFF && \ 43 | make all -j12 44 | 45 | run_mx: # Use Multiplier to index the library 46 | mx-index --db $(PWD)/$(LIB_NAME).db --target $(PWD)/$(LIB_NAME)/compile_commands.json --workspace $(PWD)/mx 47 | 48 | #------------------------------------------------------------------------ 49 | all: lib lib_fuzz run_mx 50 | 51 | #------------------------------------------------------------------------ 52 | harness: # make command used to make the harness during generation 53 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c $(DEPS) $(DEPS_DYN) $(CFLAGS_ASAN) 54 | 55 | showmap: # command used to get coverage information about library under test 56 | LD_LIBRARY_PATH=$(DEPS_LDD) afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 57 | 58 | harness_fuzz: # compile a harness specifically for fuzzing. Pass the harness number using make harness_fuzz HARNESS_NUMBER=x 59 | @ls bin || mkdir bin 60 | $(eval LIB_NAME=lib_fuzz) \ 61 | $(CC_FUZZ) -o bin/ogharn$(HARNESS_NUMBER)\_fuzz $(OUT)/final-harnesses/src/harness$(HARNESS_NUMBER):*.c -static $(DEPS) $(DEPS_STC) ; 62 | 63 | clean: 64 | rm -rf bin mx lib.db-* 65 | 66 | clean_lib: 67 | rm -rf $(LIB_NAME)* -------------------------------------------------------------------------------- /demos/openexr/run_ogharn.sh: -------------------------------------------------------------------------------- 1 | ogharn.py -i $PWD -o $PWD/out -n 3 --m $PWD/lib.db -h ImfCRgbaFile.h -r f -d -f -as -------------------------------------------------------------------------------- /demos/openexr/seeds_invalid/empty: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/openexr/seeds_invalid/empty -------------------------------------------------------------------------------- /demos/openexr/seeds_invalid/single: -------------------------------------------------------------------------------- 1 | S -------------------------------------------------------------------------------- /demos/openexr/seeds_valid/s1.exr: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/openexr/seeds_valid/s1.exr -------------------------------------------------------------------------------- /demos/openexr/seeds_valid/s2.exr: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/openexr/seeds_valid/s2.exr -------------------------------------------------------------------------------- /demos/openexr/seeds_valid/s3.exr: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/openexr/seeds_valid/s3.exr -------------------------------------------------------------------------------- /demos/openexr/seeds_valid/s4.exr: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/openexr/seeds_valid/s4.exr -------------------------------------------------------------------------------- /demos/pcap/Makefile: -------------------------------------------------------------------------------- 1 | CC_FUZZ = afl-clang-fast 2 | CXX_FUZZ = afl-clang-fast++ 3 | CFLAGS_ASAN = -fsanitize=address,undefined 4 | CXXFLAGS_ASAN = -fsanitize=address,undefined 5 | 6 | LIB_NAME = lib 7 | LIB_REPO = https://github.com/the-tcpdump-group/libpcap.git 8 | 9 | DEPS = -I $(PWD)/$(LIB_NAME)/ \ 10 | -L $(PWD)/$(LIB_NAME)/ \ 11 | -L $(PWD)/$(LIB_NAME)/systemd/build 12 | 13 | DEPS_DYN = -lpcap -ldbus-1 -libverbs -lnl-3 -lnl-genl-3 -lnl-route-3 -lnl-genl-3 14 | DEPS_STC = -l:libpcap.a -ldbus-1 -l:libsystemd.a -libverbs -lnl-3 -lnl-genl-3 -lnl-route-3 -lcap -lnl-genl-3 15 | DEPS_LDD = $(PWD)/$(LIB_NAME)/ 16 | 17 | #------------------------------------------------------------------------ 18 | lib: # build for harness generation. Dynamic linking, asan, and afl instrumentation 19 | export AFL_USE_ASAN=1 20 | export AFL_USE_UBSAN=1 21 | rm -rf $(LIB_NAME) 22 | git clone $(LIB_REPO) $(LIB_NAME) 23 | cd $(LIB_NAME) && \ 24 | git checkout e17fe06d6a54abc85fb17998d0cb1742d490382a && \ 25 | ./autogen.sh && ./configure \ 26 | CC=$(CC_FUZZ) CXX=$(CC_FUZZ) && \ 27 | make all -j12 28 | 29 | lib_plain: # build for indexing with multiplier 30 | export AFL_USE_ASAN=1 31 | export AFL_USE_UBSAN=1 32 | rm -rf $(LIB_NAME)_plain 33 | git clone $(LIB_REPO) $(LIB_NAME)_plain 34 | cd $(LIB_NAME)_plain && \ 35 | git checkout e17fe06d6a54abc85fb17998d0cb1742d490382a && \ 36 | ./autogen.sh && ./configure \ 37 | CC=$(CC) CXX=$(CXX) && \ 38 | bear -- make all -j12 39 | 40 | lib_fuzz: # build for fuzzing. Static linking with afl instrumentation 41 | rm -rf $(LIB_NAME)_fuzz 42 | git clone $(LIB_REPO) $(LIB_NAME)_fuzz 43 | cd $(LIB_NAME)_fuzz && \ 44 | git checkout e17fe06d6a54abc85fb17998d0cb1742d490382a && \ 45 | git clone https://github.com/systemd/systemd.git && \ 46 | cd systemd && \ 47 | meson build --buildtype=release -Dstatic-libsystemd=true && \ 48 | cd build && ninja && cd ../.. && \ 49 | ./autogen.sh && ./configure \ 50 | CC=$(CC_FUZZ) CXX=$(CXX_FUZZ) --enable-static && \ 51 | make all -j12 52 | 53 | run_mx: # Use Multiplier to index the library 54 | mx-index --db $(PWD)/$(LIB_NAME).db --target $(PWD)/$(LIB_NAME)_plain/compile_commands.json --workspace $(PWD)/mx 55 | 56 | #------------------------------------------------------------------------ 57 | all: lib lib_plain lib_fuzz run_mx 58 | 59 | #------------------------------------------------------------------------ 60 | harness: # make command used to make the harness during generation 61 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c $(DEPS) $(DEPS_DYN) $(CFLAGS_ASAN) 62 | 63 | showmap: # command used to get coverage information about library under test 64 | LD_LIBRARY_PATH=$(DEPS_LDD) afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 65 | 66 | harness_fuzz: # compile a harness specifically for fuzzing. Pass the harness number using make harness_fuzz HARNESS_NUMBER=x 67 | @ls bin || mkdir bin 68 | $(eval LIB_NAME=lib_fuzz) \ 69 | $(CC_FUZZ) -o bin/ogharn$(HARNESS_NUMBER)\_fuzz $(OUT)/final-harnesses/src/harness$(HARNESS_NUMBER):*.c -static $(DEPS) $(DEPS_STC) ; 70 | 71 | clean: 72 | rm -rf bin mx lib.db-* 73 | 74 | clean_lib: 75 | rm -rf $(LIB_NAME)* -------------------------------------------------------------------------------- /demos/pcap/config.yaml: -------------------------------------------------------------------------------- 1 | blacklist: 2 | - pcap_compile_nopcap 3 | - pcap_lookupdev 4 | - pcap_fileno 5 | - pcap_open_live 6 | - pcap_dump_file 7 | - pcap_activate 8 | - pcap_dump 9 | - pcap_file -------------------------------------------------------------------------------- /demos/pcap/run_ogharn.sh: -------------------------------------------------------------------------------- 1 | ogharn.py -i $PWD -o $PWD/out -n 3 --m $PWD/lib.db -h pcap/pcap.h -r b -d -c $PWD/config.yaml -f -------------------------------------------------------------------------------- /demos/pcap/seeds_invalid/is1: -------------------------------------------------------------------------------- 1 | 00000000�00000000000000MGC000000000000000000000000000000000000000000000000000000000000000000000000000000000965798***732'000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 -------------------------------------------------------------------------------- /demos/pcap/seeds_invalid/is2: -------------------------------------------------------------------------------- 1 | �ò� -------------------------------------------------------------------------------- /demos/pcap/seeds_invalid/is3: -------------------------------------------------------------------------------- 1 | * -------------------------------------------------------------------------------- /demos/pcap/seeds_invalid/is4: -------------------------------------------------------------------------------- 1 | tcp[tcpflags]&tcp-sy--943* != 0 or tcp[cpflags]&tcp-fin or tp[tcpflagtcp-rst != 0 2 | -------------------------------------------------------------------------------- /demos/pcap/seeds_valid/s1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/pcap/seeds_valid/s1 -------------------------------------------------------------------------------- /demos/pcap/seeds_valid/s2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/pcap/seeds_valid/s2 -------------------------------------------------------------------------------- /demos/pcap/seeds_valid/s4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/pcap/seeds_valid/s4 -------------------------------------------------------------------------------- /demos/pcap/seeds_valid/s5: -------------------------------------------------------------------------------- 1 | tcp[tcpflags]&tcp-syn != 0 or tcp[tcpflags]&tcp-fin != 0 or tcp[tcpflags]&tcp-rst != 0 2 | -------------------------------------------------------------------------------- /demos/pcap/seeds_valid/s6: -------------------------------------------------------------------------------- 1 | ip and ((icmp and dst host 1.1.1.1 and not host 2.2.2.2) or (host 1.1.1.1 and src host 3.3.3.3)) 2 | -------------------------------------------------------------------------------- /demos/pcre2/Makefile: -------------------------------------------------------------------------------- 1 | CC_FUZZ = afl-clang-fast 2 | CXX_FUZZ = afl-clang-fast++ 3 | CFLAGS_ASAN = -fsanitize=address,undefined 4 | CXXFLAGS_ASAN = -fsanitize=address,undefined 5 | 6 | LIB_NAME = lib 7 | LIB_REPO = https://github.com/PCRE2Project/pcre2.git 8 | 9 | DEPS = -I $(PWD)/$(LIB_NAME)/ \ 10 | -I $(PWD)/$(LIB_NAME)/src \ 11 | -L $(PWD)/$(LIB_NAME)/ \ 12 | 13 | DEPS_DYN = -l:libpcre2-8.a 14 | DEPS_STC = -l:libpcre2-8.a 15 | DEPS_LDD = $(PWD)/$(LIB_NAME)/ 16 | 17 | #------------------------------------------------------------------------ 18 | lib: # build for harness generation. Dynamic linking, asan, and afl instrumentation 19 | export AFL_USE_ASAN=1 20 | export AFL_USE_UBSAN=1 21 | rm -rf $(LIB_NAME) 22 | git clone $(LIB_REPO) $(LIB_NAME) 23 | cd $(LIB_NAME) && \ 24 | git checkout a67878318cd08eb92e7f3afa2a15b55d46d285e2 && \ 25 | cmake . \ 26 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DCMAKE_EXPORT_COMPILE_COMMANDS=ON && \ 27 | make all -j12 28 | 29 | lib_fuzz: # build for fuzzing. Static linking with afl instrumentation 30 | rm -rf $(LIB_NAME)_fuzz 31 | git clone $(LIB_REPO) $(LIB_NAME)_fuzz 32 | cd $(LIB_NAME)_fuzz && \ 33 | git checkout a67878318cd08eb92e7f3afa2a15b55d46d285e2 && \ 34 | cmake . \ 35 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DBUILD_SHARED_LIBS=Off && \ 36 | make all -j12 37 | 38 | run_mx: # Use Multiplier to index the library 39 | mx-index --db $(PWD)/$(LIB_NAME).db --target $(PWD)/$(LIB_NAME)/compile_commands.json --workspace $(PWD)/mx 40 | 41 | #------------------------------------------------------------------------ 42 | all: lib lib_fuzz run_mx 43 | 44 | #------------------------------------------------------------------------ 45 | harness: # make command used to make the harness during generation 46 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c $(DEPS) $(DEPS_DYN) $(CFLAGS_ASAN) 47 | 48 | harness_static: # command used to statically compile harness during harness generation 49 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c -static $(DEPS) $(DEPS_DYN) 50 | 51 | showmap: # command used to get coverage information about library under test 52 | LD_LIBRARY_PATH=$(DEPS_LDD) afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 53 | 54 | showmap_static: 55 | afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 56 | 57 | harness_fuzz: # compile a harness specifically for fuzzing. Pass the harness number using make harness_fuzz HARNESS_NUMBER=x 58 | @ls bin || mkdir bin 59 | $(eval LIB_NAME=lib_fuzz) \ 60 | $(CC_FUZZ) -o bin/ogharn$(HARNESS_NUMBER)\_fuzz $(OUT)/final-harnesses/src/harness$(HARNESS_NUMBER):*.c -static $(DEPS) $(DEPS_STC) ; 61 | 62 | clean: 63 | rm -rf bin mx lib.db-* 64 | 65 | clean_lib: 66 | rm -rf $(LIB_NAME)* 67 | 68 | -------------------------------------------------------------------------------- /demos/pcre2/config.yaml: -------------------------------------------------------------------------------- 1 | add_define_to_harness: "#ifndef PCRE2_CODE_UNIT_WIDTH\n#define PCRE2_CODE_UNIT_WIDTH 8\n#endif" -------------------------------------------------------------------------------- /demos/pcre2/run_ogharn.sh: -------------------------------------------------------------------------------- 1 | ogharn.py -i $PWD -o $PWD/out -n 3 --m $PWD/lib.db -h pcre2.h -r b -d -e -f -c $PWD/config.yaml -------------------------------------------------------------------------------- /demos/pcre2/seeds_invalid/is1: -------------------------------------------------------------------------------- 1 | (*3497) -------------------------------------------------------------------------------- /demos/pcre2/seeds_invalid/is2: -------------------------------------------------------------------------------- 1 | "" -------------------------------------------------------------------------------- /demos/pcre2/seeds_invalid/is3: -------------------------------------------------------------------------------- 1 | ) -------------------------------------------------------------------------------- /demos/pcre2/seeds_invalid/is4: -------------------------------------------------------------------------------- 1 | ^([a-zA-Z0-9_\-\.]+)@([a-Z0-9_\-\.]+)\[a-zA-Z]5})$ -------------------------------------------------------------------------------- /demos/pcre2/seeds_valid/s1: -------------------------------------------------------------------------------- 1 | abc -------------------------------------------------------------------------------- /demos/pcre2/seeds_valid/s2: -------------------------------------------------------------------------------- 1 | (a(b(c(d(e))))) -------------------------------------------------------------------------------- /demos/pcre2/seeds_valid/s3: -------------------------------------------------------------------------------- 1 | ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ -------------------------------------------------------------------------------- /demos/pcre2/seeds_valid/s4: -------------------------------------------------------------------------------- 1 | ([A-Z]\w+) contains two different elements of the regular 2 | expression combined together. This expression will match any pattern 3 | containing uppercase letter followed by any character. -------------------------------------------------------------------------------- /demos/raylib/Makefile: -------------------------------------------------------------------------------- 1 | CC_FUZZ = afl-clang-fast 2 | CXX_FUZZ = afl-clang-fast++ 3 | CFLAGS_ASAN = -fsanitize=address,undefined 4 | CXXFLAGS_ASAN = -fsanitize=address,undefined 5 | 6 | LIB_NAME = lib 7 | LIB_REPO = https://github.com/raysan5/raylib 8 | 9 | DEPS = -I $(PWD)/$(LIB_NAME)/lib \ 10 | -I $(PWD)/$(LIB_NAME)/src \ 11 | -I $(PWD)/$(LIB_NAME)/ \ 12 | -L $(PWD)/$(LIB_NAME)/raylib \ 13 | -L $(PWD)/$(LIB_NAME)/lib 14 | 15 | DEPS_STC = -l:libraylib.a -lm 16 | DEPS_DYN = -lraylib 17 | DEPS_LDD = $(PWD)/$(LIB_NAME)/raylib/ 18 | 19 | #------------------------------------------------------------------------ 20 | lib: # build for harness generation. Dynamic linking, asan, and afl instrumentation 21 | export AFL_USE_ASAN=1 22 | export AFL_USE_UBSAN=1 23 | rm -rf $(LIB_NAME) 24 | git clone $(LIB_REPO) $(LIB_NAME) 25 | cd $(LIB_NAME) && \ 26 | git checkout a17a81f05b62d92af1bff103721d17a180aa84e5 && \ 27 | cmake . \ 28 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DBUILD_SHARED_LIBS=ON \ 29 | -DCMAKE_EXPORT_COMPILE_COMMANDS=ON && \ 30 | make PLATFORM=PLATFORM_DESKTOP RAYLIB_LIBTYPE=SHARED all -j12 31 | 32 | lib_fuzz: # build for fuzzing. Static linking with afl instrumentation 33 | rm -rf $(LIB_NAME)_fuzz 34 | git clone $(LIB_REPO) $(LIB_NAME)_fuzz 35 | cd $(LIB_NAME)_fuzz && \ 36 | git checkout a17a81f05b62d92af1bff103721d17a180aa84e5 && \ 37 | cmake . \ 38 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DBUILD_SHARED_LIBS=OFF && \ 39 | make PLATFORM=PLATFORM_DESKTOP RAYLIB_LIBTYPE=SHARED all -j12 40 | 41 | run_mx: # Use Multiplier to index the library 42 | mx-index --db $(PWD)/$(LIB_NAME).db --target $(PWD)/$(LIB_NAME)/compile_commands.json --workspace $(PWD)/mx 43 | 44 | #------------------------------------------------------------------------ 45 | all: lib lib_fuzz run_mx 46 | 47 | #------------------------------------------------------------------------ 48 | harness: # make command used to make the harness during generation 49 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c $(DEPS) $(DEPS_DYN) $(CFLAGS_ASAN) 50 | 51 | showmap: # command used to get coverage information about library under test 52 | LD_LIBRARY_PATH=$(DEPS_LDD) afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 53 | 54 | harness_fuzz: # compile a harness specifically for fuzzing. Pass the harness number using make harness_fuzz HARNESS_NUMBER=x 55 | @ls bin || mkdir bin 56 | $(eval LIB_NAME=lib_fuzz) \ 57 | $(CC_FUZZ) -o bin/ogharn$(HARNESS_NUMBER)\_fuzz $(OUT)/final-harnesses/src/harness$(HARNESS_NUMBER):*.c -static $(DEPS) $(DEPS_STC) ; 58 | 59 | 60 | clean: 61 | rm -rf bin mx lib.db-* 62 | 63 | clean_lib: 64 | rm -rf $(LIB_NAME)* -------------------------------------------------------------------------------- /demos/raylib/README.md: -------------------------------------------------------------------------------- 1 | #### Note: For fuzzing raylib harnesses, the -e '.png' command line argument is necessary. -------------------------------------------------------------------------------- /demos/raylib/run_ogharn.sh: -------------------------------------------------------------------------------- 1 | ogharn.py -i $PWD -o $PWD/out -n 3 --m $PWD/lib.db -h raylib.h -r f -d -f -as -------------------------------------------------------------------------------- /demos/raylib/seeds_invalid/empty: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/raylib/seeds_invalid/empty -------------------------------------------------------------------------------- /demos/raylib/seeds_invalid/s5.png: -------------------------------------------------------------------------------- 1 | �PNG 2 |  3 | �g ����V���*��x=�E�R�����#��n�Z�=$�_ayyssi�L�G��n��L��y��C@���|�<�l��--�� ��m]d�4�4e��-�������:�h�˪�*�9�hf��1�»̕���贅I)��%$��=�� �nJ��n��wAP�n 5�;62X3�"5��-�g��,��Ӑ�Ǐ_��/�ڪ�bpG>]��{U���ut ��V�V�k�03X�"���Jc���{��U[{�p���V���Vw+�BA��lw�BK�$IDo� �=�g�YB���8��%�G���V�Ωn���=a�p:��4V��$�[����WkB&,L�v�� 4 | �=��[��a����LH�%�3�tƟ n���ZH$i�Fb&cB�N2��FD����u��&�H��y�z��x�834Ӗm�S}�p 5 | +Q��4Ƅ`�t~��Xo 6 | u!�J���4���T:�Q������t`%����y�Zfy1E��]���G��_�~QڮeX�����o 7 | -�[�v�o il2B9��;�2�����7q[SJ�+v㼼�{`�%}d�`�a,�����쉞,���j_1���q��F�T�0 8 | 9 | V+��� 0L_�WncCCA�N��$&�7��󿟆򜷹�IEND�B`� -------------------------------------------------------------------------------- /demos/raylib/seeds_valid/s1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/raylib/seeds_valid/s1.png -------------------------------------------------------------------------------- /demos/raylib/seeds_valid/s2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/raylib/seeds_valid/s2.png -------------------------------------------------------------------------------- /demos/raylib/seeds_valid/s3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/raylib/seeds_valid/s3.png -------------------------------------------------------------------------------- /demos/raylib/seeds_valid/s4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/raylib/seeds_valid/s4.png -------------------------------------------------------------------------------- /demos/raylib/seeds_valid/s5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/raylib/seeds_valid/s5.png -------------------------------------------------------------------------------- /demos/sqlite/Makefile: -------------------------------------------------------------------------------- 1 | #------------------------------------------------------------------------ 2 | # Leave these as-is (unless you must change the compiler)! 3 | 4 | CC_FUZZ = afl-clang-fast 5 | CXX_FUZZ = afl-clang-fast++ 6 | CC = clang 7 | CXX = clang++ 8 | CFLAGS_ASAN = -fsanitize=address,undefined 9 | CXXFLAGS_ASAN = -fsanitize=address,undefined 10 | 11 | #------------------------------------------------------------------------ 12 | # Edit these below accordingly... 13 | 14 | LIB_NAME = lib 15 | LIB_REPO = https://github.com/sqlite/sqlite.git 16 | 17 | DEPS = -I $(PWD)/$(LIB_NAME)/ \ 18 | -L $(PWD)/$(LIB_NAME)/ 19 | 20 | DEPS_STAT = -I $(PWD)/$(LIB_NAME)_static/ \ 21 | -L $(PWD)/$(LIB_NAME)_static/ 22 | 23 | DEPS_DYN = -lsqlite3 24 | DEPS_STC = -l:libsqlite3.a -lm 25 | DEPS_LDD = $(PWD)/$(LIB_NAME)/ 26 | 27 | #------------------------------------------------------------------------ 28 | lib: # build for harness generation. Dynamic linking, asan, and afl instrumentation 29 | export AFL_USE_ASAN=1 30 | export AFL_USE_UBSAN=1 31 | rm -rf $(LIB_NAME) 32 | git clone $(LIB_REPO) $(LIB_NAME) 33 | cd $(LIB_NAME) && \ 34 | git checkout 0df847cc776131919935658230fe2e629906dabb && \ 35 | ./configure \ 36 | CC=$(CC_FUZZ) CXX=$(CXX_FUZZ) \ 37 | CFLAGS="-DSQLITE_ENABLE_API_ARMOR" \ 38 | CXXFLAGS="-DSQLITE_ENABLE_API_ARMOR" && \ 39 | make all -j12 40 | 41 | lib_plain: # build for harness generation. Dynamic linking, asan, and afl instrumentation 42 | rm -rf $(LIB_NAME)_plain 43 | git clone $(LIB_REPO) $(LIB_NAME)_plain 44 | cd $(LIB_NAME)_plain && \ 45 | git checkout 0df847cc776131919935658230fe2e629906dabb && \ 46 | ./configure \ 47 | CC=$(CC) CXX=$(CXX) \ 48 | CFLAGS="-DSQLITE_ENABLE_API_ARMOR" \ 49 | CXXFLAGS="-DSQLITE_ENABLE_API_ARMOR" && \ 50 | bear -- make all -j12 51 | 52 | lib_static: 53 | rm -rf $(LIB_NAME)_static 54 | git clone $(LIB_REPO) $(LIB_NAME)_static 55 | cd $(LIB_NAME)_static && \ 56 | git checkout 0df847cc776131919935658230fe2e629906dabb && \ 57 | ./configure --static \ 58 | CC=$(CC_FUZZ) CXX=$(CXX_FUZZ) \ 59 | CFLAGS="-DSQLITE_ENABLE_API_ARMOR" \ 60 | CXXFLAGS="-DSQLITE_ENABLE_API_ARMOR" && \ 61 | make all -j12 62 | 63 | 64 | lib_fuzz: # build for fuzzing. Static linking with afl instrumentation 65 | rm -rf $(LIB_NAME)_fuzz 66 | git clone $(LIB_REPO) $(LIB_NAME)_fuzz 67 | cd $(LIB_NAME)_fuzz && \ 68 | git checkout 0df847cc776131919935658230fe2e629906dabb && \ 69 | ./configure --static --with-tclsh=/usr/bin/tclsh8.6 \ 70 | CC=$(CC_FUZZ) CXX=$(CXX_FUZZ) \ 71 | CFLAGS="-DSQLITE_ENABLE_API_ARMOR" \ 72 | CXXFLAGS="-DSQLITE_ENABLE_API_ARMOR" && \ 73 | make all -j12 74 | 75 | run_mx: # Use Multiplier to index the library 76 | mx-index --db $(PWD)/$(LIB_NAME).db --target $(PWD)/$(LIB_NAME)_plain/compile_commands.json --workspace $(PWD)/mx 77 | 78 | #------------------------------------------------------------------------ 79 | all: lib lib_plain lib_fuzz run_mx 80 | 81 | #------------------------------------------------------------------------ 82 | harness: # make command used to make the harness during generation 83 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c $(DEPS) $(DEPS_DYN) $(CFLAGS_ASAN) 84 | 85 | harness_static: # command used to statically compile harness during harness generation 86 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c -static $(DEPS) $(DEPS_STC) 87 | 88 | showmap: # command used to get coverage information about library under test 89 | LD_LIBRARY_PATH=$(DEPS_LDD) afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 90 | 91 | showmap_static: # command used to get coverage information about the statically linked harness 92 | afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 93 | 94 | 95 | harness_fuzz: # compile a harness specifically for fuzzing. Pass the harness number using make harness_fuzz HARNESS_NUMBER=x 96 | @ls bin || mkdir bin 97 | $(eval LIB_NAME=lib_fuzz) \ 98 | $(CC_FUZZ) -o bin/ogharn$(HARNESS_NUMBER)\_fuzz $(OUT)/final-harnesses/src/harness$(HARNESS_NUMBER):*.c -static $(DEPS) $(DEPS_STC) ; 99 | 100 | clean: 101 | rm -rf bin mx lib.db-* 102 | 103 | clean_lib: 104 | rm -rf $(LIB_NAME)* -------------------------------------------------------------------------------- /demos/sqlite/config.yaml: -------------------------------------------------------------------------------- 1 | blacklist: 2 | - sqlite3_mprintf 3 | - sqlite3_vmprintf 4 | - sqlite3_snprintf 5 | - sqlite3_vsnprintf 6 | - sqlite3_open16 7 | - sqlite3_open_v2 8 | 9 | preamble_func: sqlite3_open 10 | 11 | arg_keys: 12 | sqlite3_open: 13 | - {"index": 0, "value": "\":memory:\""} # 0th arg to sqlite3_open should be ":memory:" to avoid filesystem overhead -------------------------------------------------------------------------------- /demos/sqlite/run_ogharn.sh: -------------------------------------------------------------------------------- 1 | ogharn.py -i $PWD -o $PWD/out -n 3 --m $PWD/lib.db -h sqlite3.h -r b -d -f -c $PWD/config.yaml -e -------------------------------------------------------------------------------- /demos/sqlite/seeds_invalid/s1: -------------------------------------------------------------------------------- 1 | SELECT * FROM json_tree('{"id":"0001","type":"donut","name":"Cake","ppu":0.55,"batters":{"batter":[{"id":"1001","type":"Regular"},{"id":"1002","type":"Chocolate"},{"id":"1003","type":"Blueberry"},{"id":"1004","type":"Devil''s Food"}]},"topping":[{"id":"5001","type":"None"},{"id":"5002","type":"Glazed"},{"id":"5005","type":"Sugar"},{"id":"5007","type":"Powdered Sugar"},{"id":"5006","type":"Chocolate with Sprinkles"},{"id":"5003","type":"Chocolate"},{"id":"5004","type":"Maple"}]},{"id":"0002","type":"donut","name":"Raised","ppu":0.55,"batters":{"batter":[{"id":"1001","type":"Regular"}]},"topping":[{"id":"5001","type":"None"},{"id":"5002","type":"Glazed"},{"id":"5005","type":"Sugar"},{"id":"5003","type":"Chocolate"},{"id":"5004","type":"Maple"}]},{"id":"0003","type":"donut","name":"Old Fashioned","ppu":0.55,"batters":{"batter":[{"id":"1001","type":"Regular"},{"id":"1002","type":"Chocolate"}]},"topping":[{"id":"5001","type":"None"},{"id":"5002","type":"Glazed"},{"id":"5003","type":"Chocolate"},{"id":"5004","type":"Maple"}]}]'); 2 | -------------------------------------------------------------------------------- /demos/sqlite/seeds_invalid/s2: -------------------------------------------------------------------------------- 1 | .open --he 2 | | size 2040 pagesize 4096 filename altertable001.txt.db 3 | | page 1 offset 0 4 | | 0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 SQLite format 3. 5 | | 16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 05 .....@ ........ 6 | | 32: 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 04 ................ 7 | | 48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 ................ 8 | | 96: 00 00 00 00 0d 00 00 00 05 0e 55 00 0f 74 0f 3c ..........U..t.< 9 | | 112: 0e f9 0e d1 0e 55 00 00 00 00 00 00 00 00 00 00 .....U.......... 10 | | 3664: 00 00 00 00 00 7a 05 07 15 11 11 08 81 63 76 69 .....z.......cvi 11 | | 3680: 65 77 76 31 76 31 43 52 45 41 54 45 20 56 49 45 ewv1v1CREATE VIE 12 | | 3696: 57 20 76 31 28 78 2c 79 29 20 41 53 0a 53 45 4c W v1(x,y) AS.SEL 13 | | 3712: 45 43 54 20 74 31 2e 62 2c 74 32 2e 62 20 46 52 ECT t1.b,t2.b FR 14 | | 3728: 4f 4d 20 74 31 2c 74 32 20 57 48 45 52 45 20 74 OM t1,t2 WHERE t 15 | | 3744: 31 2e 61 3d 74 32 2e 61 20 47 52 4f 55 50 20 42 1.a=t2.a GROUP B 16 | | 3760: 59 20 31 20 48 41 56 49 4e 47 20 74 32 2e 63 20 Y 1 HAVING t2.c 17 | | 3776: 4e 4f 54 20 4e 55 4c 4c 0a 4c 49 4d 49 54 20 31 NOT NULL.LIMIT 1 18 | | 3792: 30 26 04 06 17 11 11 01 39 74 61 62 6c 65 74 32 0&......9tablet2 19 | | 3808: 74 32 05 43 52 45 41 54 45 20 54 41 42 4c 45 20 t2.CREATE TABLE 20 | | 3824: 74 32 28 61 2c 62 2c 63 29 41 03 06 17 15 11 01 t2(a,b,c)A...... 21 | | 3840: 6b 69 6e 64 65 78 74 31 78 31 74 31 04 43 52 45 kindext1x1t1.CRE 22 | | 3856: 41 54 45 20 49 4e 44 45 58 20 74 31 78 31 20 4f ATE INDEX t1x1 O 23 | | 3872: 4e 20 74 31 28 64 29 20 57 48 45 52 45 20 65 65 N t1(d) WHERE ee 24 | | 3888: 20 49 53 20 4e 4f 54 20 4e 55 4c 4c 36 02 06 17 IS NOT NULL6... 25 | | 3904: 17 11 01 53 69 6e 64 65 78 74 31 61 62 63 74 31 ...Sindext1abct1 26 | | 3920: 03 43 52 45 41 54 45 20 49 4e 44 45 58 20 74 31 .CREATE INDEX t1 27 | | 3936: 61 62 63 20 4f 4e 20 74 31 28 61 2c 62 2c 63 2b abc ON t1(a,b,c+ 28 | | 3952: 64 2b 65 29 81 09 01 07 17 11 11 01 81 7d 74 61 d+e)..........ta 29 | | 3968: 62 6c 65 74 31 74 31 02 43 52 45 41 54 45 20 54 blet1t1.CREATE T 30 | | 3984: 41 42 4c 45 20 74 31 28 61 2c 62 2c 63 2c 64 2c ABLE t1(a,b,c,d, 31 | | 4000: 65 2c 66 2c 67 2c 68 2c 6a 2c 6a 6a 2c 6a 6a 6a e,f,g,h,j,jj,jjj 32 | | 4016: 2c 6b 2c 61 61 2c 62 62 2c 63 63 2c 64 64 2c 65 ,k,aa,bb,cc,dd,e 33 | | 4032: 65 20 44 45 46 41 55 4c 54 20 33 2e 31 34 2c 0a e DEFAULT 3.14,. 34 | | 4048: 66 66 20 44 45 46 41 55 4c 54 28 27 68 69 63 63 ff DEFAULT('hicc 35 | | 4064: 75 70 27 29 2c 67 67 20 4e 4f 54 20 4e 55 4c 4c up'),gg NOT NULL 36 | | 4080: 20 44 45 46 41 55 4c 54 28 66 61 6c 73 65 29 29 DEFAULT(false)) 37 | | page 2 offset 4096 38 | | 0: 0d 00 00 00 0a 0e 7b 00 0f dc 0f b6 0f 8f 0f 68 ...............h 39 | | 16: 0f 41 0f 1a 0e f3 0e cb 0e a3 0e 7b 00 00 00 00 .A.............. 40 | | 3696: 00 00 00 00 00 00 00 00 00 00 00 26 0a 14 01 01 ...........&.... 41 | | 3712: 02 08 00 00 00 00 00 00 00 00 00 00 00 00 07 19 ................ 42 | | 3728: 08 09 5a 00 b4 40 09 1e b8 51 eb 85 1f 68 69 63 ..Z..@...Q...hic 43 | | 3744: 63 75 70 26 09 14 01 01 02 08 00 00 00 00 00 00 cup&............ 44 | | 3760: 00 00 00 00 00 00 07 19 08 08 50 00 a0 40 09 1e ..........P..@.. 45 | | 3776: b8 51 eb 85 1f 68 69 63 63 75 70 26 08 14 01 01 .Q...hiccup&.... 46 | | 3792: 02 08 00 00 00 00 00 00 00 00 00 00 00 00 07 19 ................ 47 | | 3808: 08 07 46 00 8c 40 09 1e b8 51 eb 85 1f 68 69 63 ..F..@...Q...hic 48 | | 3824: 63 75 70 25 07 14 01 01 01 08 00 00 00 00 00 00 cup%............ 49 | | 3840: 00 00 00 00 00 00 07 19 08 06 3c 78 40 09 1e b8 ..........(x,y,z) FROM t1; 7 | SELECT (a,b,c)<(x,y,z) FROM t1; 8 | SELECT (a,b,c)<=(x,y,z) FROM t1; 9 | SELECT (a,b,c)>(x,y,z) FROM t1; 10 | SELECT (a,b,c)>=(x,y,z) FROM t1; 11 | SELECT (a,b,c) IS (x,y,z) FROM t1; 12 | SELECT (a,b,c) IS NOT (x,y,z) FROM t1; 13 | SELECT rowid FROM t1 WHERE (a,b,c)==(x,y,z); 14 | SELECT rowid FROM t1 WHERE (a,b,c)<>(x,y,z); 15 | SELECT rowid FROM t1 WHERE (a,b,c)<(x,y,z); 16 | SELECT rowid FROM t1 WHERE (a,b,c)<=(x,y,z); 17 | SELECT rowid FROM t1 WHERE (a,b,c)>(x,y,z); 18 | SELECT rowid FROM t1 WHERE (a,b,c)>=(x,y,z); 19 | SELECT rowid FROM t1 WHERE (a,b,c)IS (x,y,z); 20 | SELECT rowid FROM t1 WHERE (a,b,c)IS NOT(x,y,z); -------------------------------------------------------------------------------- /demos/sqlite/seeds_valid/s6: -------------------------------------------------------------------------------- 1 | CREATE TABLE t15(a INTEGER PRIMARY KEY, b); 2 | INSERT INTO t15(a,b)VALUES(10,'0'),(20,'000'),(30,'000'); 3 | ALTER TABLE t15 ADD COLUMN c; 4 | CREATE INDEX t000 ON t15(c); 5 | INSERT INTO t15(a,b) 6 | VALUES(5,'000'),(15,'000'),(25,'000'),(35,'000'); 7 | UPDATE t15 SET a=printf("0%d",b) WHERE c IS NULL; 8 | SELECT a,b,c,'0'FROM t15 ORDER BY a; 9 | -------------------------------------------------------------------------------- /demos/sqlite/seeds_valid/s7: -------------------------------------------------------------------------------- 1 | SELECT '' -------------------------------------------------------------------------------- /demos/stormlib/Makefile: -------------------------------------------------------------------------------- 1 | CC_FUZZ = afl-clang-fast 2 | CXX_FUZZ = afl-clang-fast++ 3 | CFLAGS_ASAN = -fsanitize=address,undefined 4 | CXXFLAGS_ASAN = -fsanitize=address,undefined 5 | 6 | 7 | LIB_NAME = lib 8 | LIB_REPO = https://github.com/ladislav-zezula/StormLib 9 | 10 | DEPS = -I $(PWD)/$(LIB_NAME)/src/ \ 11 | -I $(PWD)/$(LIB_NAME)/ \ 12 | -L $(PWD)/$(LIB_NAME)/ 13 | 14 | DEPS_DYN = -lstorm 15 | DEPS_STC = -l:libstorm.a -lz -lbz2 -lstdc++ 16 | DEPS_LDD = $(PWD)/$(LIB_NAME)/ 17 | 18 | #------------------------------------------------------------------------ 19 | lib: # build for harness generation. Dynamic linking, asan, and afl instrumentation 20 | export AFL_USE_ASAN=1 21 | export AFL_USE_UBSAN=1 22 | rm -rf $(LIB_NAME) 23 | git clone $(LIB_REPO) $(LIB_NAME) 24 | cd $(LIB_NAME) && \ 25 | git checkout 605222393594f5885b877bfc0086dae756674965 && \ 26 | cmake . \ 27 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DBUILD_SHARED_LIBS=ON \ 28 | -DCMAKE_EXPORT_COMPILE_COMMANDS=ON && \ 29 | make all -j12 30 | 31 | lib_fuzz: # build for fuzzing. Static linking with afl instrumentation 32 | rm -rf $(LIB_NAME)_fuzz 33 | git clone $(LIB_REPO) $(LIB_NAME)_fuzz 34 | cd $(LIB_NAME)_fuzz && \ 35 | git checkout 605222393594f5885b877bfc0086dae756674965 && \ 36 | cmake . \ 37 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DBUILD_SHARED_LIBS=OFF && \ 38 | make all -j12 39 | 40 | run_mx: # Use Multiplier to index the library 41 | mx-index --db $(PWD)/$(LIB_NAME).db --target $(PWD)/$(LIB_NAME)_plain/compile_commands.json --workspace $(PWD)/mx 42 | 43 | #------------------------------------------------------------------------ 44 | all: lib lib_fuzz run_mx 45 | 46 | #------------------------------------------------------------------------ 47 | harness: # make command used to make the harness during generation 48 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c $(DEPS) $(DEPS_DYN) $(CFLAGS_ASAN) 49 | 50 | showmap: # command used to get coverage information about library under test 51 | LD_LIBRARY_PATH=$(DEPS_LDD) afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 52 | 53 | harness_fuzz: # compile a harness specifically for fuzzing. Pass the harness number using make harness_fuzz HARNESS_NUMBER=x 54 | @ls bin || mkdir bin 55 | $(eval LIB_NAME=lib_fuzz) \ 56 | $(CC_FUZZ) -o bin/ogharn$(HARNESS_NUMBER)\_fuzz $(OUT)/final-harnesses/src/harness$(HARNESS_NUMBER):*.c -static $(DEPS) $(DEPS_STC) ; 57 | 58 | clean: 59 | rm -rf bin mx lib.db-* 60 | 61 | clean_lib: 62 | rm -rf $(LIB_NAME)* -------------------------------------------------------------------------------- /demos/stormlib/run_ogharn.sh: -------------------------------------------------------------------------------- 1 | ogharn.py -i $PWD -o $PWD/out -n 3 --m $PWD/lib.db -h StormLib.h -r f -d -f -------------------------------------------------------------------------------- /demos/stormlib/seeds_invalid/invalid.SC2Replay_: -------------------------------------------------------------------------------- 1 | MPQQasdfasdfasdfasdf -------------------------------------------------------------------------------- /demos/stormlib/seeds_invalid/small: -------------------------------------------------------------------------------- 1 | S -------------------------------------------------------------------------------- /demos/stormlib/seeds_valid/s1.SC2Replay: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/stormlib/seeds_valid/s1.SC2Replay -------------------------------------------------------------------------------- /demos/stormlib/seeds_valid/s2.SC2Replay: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/stormlib/seeds_valid/s2.SC2Replay -------------------------------------------------------------------------------- /demos/stormlib/seeds_valid/s3.SC2Replay: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/stormlib/seeds_valid/s3.SC2Replay -------------------------------------------------------------------------------- /demos/stormlib/seeds_valid/s4.SC2Replay: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/stormlib/seeds_valid/s4.SC2Replay -------------------------------------------------------------------------------- /demos/ucl/Makefile: -------------------------------------------------------------------------------- 1 | CC_FUZZ = afl-clang-fast 2 | CXX_FUZZ = afl-clang-fast++ 3 | CFLAGS_ASAN = -fsanitize=address,undefined 4 | CXXFLAGS_ASAN = -fsanitize=address,undefined 5 | 6 | #------------------------------------------------------------------------ 7 | # Edit these below accordingly... 8 | 9 | LIB_NAME = lib 10 | LIB_REPO = https://github.com/vstakhov/libucl 11 | 12 | DEPS = -I $(PWD)/$(LIB_NAME)/ \ 13 | -I $(PWD)/$(LIB_NAME)/include \ 14 | -I $(PWD)/$(LIB_NAME)/src \ 15 | -I $(PWD)/$(LIB_NAME)/uthash \ 16 | -L $(PWD)/$(LIB_NAME)/ 17 | 18 | DEPS_DYN = -lucl 19 | DEPS_STC = -l:libucl.a 20 | DEPS_LDD = $(PWD)/$(LIB_NAME)/ 21 | 22 | #------------------------------------------------------------------------ 23 | lib: # build for harness generation. Dynamic linking, asan, and afl instrumentation 24 | export AFL_USE_ASAN=1 25 | export AFL_USE_UBSAN=1 26 | rm -rf $(LIB_NAME) 27 | git clone $(LIB_REPO) $(LIB_NAME) 28 | cd $(LIB_NAME)&& \ 29 | git checkout 51c5e2f0526c41efc5e919e0b834a87b1976f33c && \ 30 | cmake . \ 31 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DBUILD_SHARED_LIBS=OFF -DCMAKE_EXPORT_COMPILE_COMMANDS=ON && \ 32 | make all -j12 33 | 34 | lib_fuzz: # build for fuzzing. Static linking with afl instrumentation 35 | rm -rf $(LIB_NAME)_fuzz 36 | git clone $(LIB_REPO) $(LIB_NAME)_fuzz 37 | cd $(LIB_NAME)_fuzz && \ 38 | git checkout 51c5e2f0526c41efc5e919e0b834a87b1976f33c && \ 39 | cmake . \ 40 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) -DBUILD_SHARED_LIBS=OFF && \ 41 | make all -j12 42 | 43 | run_mx: # Use Multiplier to index the library 44 | mx-index --db $(PWD)/$(LIB_NAME).db --target $(PWD)/$(LIB_NAME)/compile_commands.json --workspace $(PWD)/mx 45 | 46 | #------------------------------------------------------------------------ 47 | all: lib lib_fuzz run_mx 48 | 49 | #------------------------------------------------------------------------ 50 | harness: # make command used to make the harness during generation 51 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c $(DEPS) $(DEPS_DYN) $(CFLAGS_ASAN) 52 | 53 | showmap: # command used to get coverage information about library under test 54 | LD_LIBRARY_PATH=$(DEPS_LDD) afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 55 | 56 | harness_fuzz: # compile a harness specifically for fuzzing. Pass the harness number using make harness_fuzz HARNESS_NUMBER=x 57 | @ls bin || mkdir bin 58 | $(eval LIB_NAME=lib_fuzz) \ 59 | $(CC_FUZZ) -o bin/ogharn$(HARNESS_NUMBER)\_fuzz $(OUT)/final-harnesses/src/harness$(HARNESS_NUMBER):*.c -static $(DEPS) $(DEPS_STC) ; 60 | 61 | clean: 62 | rm -rf bin mx lib.db-* 63 | 64 | clean_lib: 65 | rm -rf $(LIB_NAME)* -------------------------------------------------------------------------------- /demos/ucl/run_ogharn.sh: -------------------------------------------------------------------------------- 1 | ogharn.py -i $PWD -o $PWD/out -n 3 -m $PWD/lib.db -h ucl.h -r b -d -f -------------------------------------------------------------------------------- /demos/ucl/seeds_invalid/s5: -------------------------------------------------------------------------------- 1 | S -------------------------------------------------------------------------------- /demos/ucl/seeds_invalid/s6.in: -------------------------------------------------------------------------------- 1 | section1 { param1 = value; param2 = value, 2 | section3 {param = value; param2 = value, param3 = ["value1", value2, 100500]}} 3 | section2 { param1 = {key = value}, param1 = ["key"]} 4 | 5 | # Numbers 6 | key1 = 1=s 7 | key2 = 1min@@ # 8 | key3 = 1kb 9 | key4 = 5M 10 | key5 = 10mS 11 | key6 = 10y 12 | 13 | # Strings 14 | key1 "some string"; 15 | key2 = /some/path; 16 | key3 = 111some, 17 | key4: s1, 18 | "key5": "\n\r123" 19 | 20 | # Variables 21 | keyvar = "$ABItest 22 | keyvar = "${ABI}$ABI${ABI}${$ABI}" 23 | keyvar = "${some}$no${}$$test$$$$$$$"; 24 | keyvar = "$ABI$$ABI$$$ABI$$$$"; 25 | -------------------------------------------------------------------------------- /demos/ucl/seeds_invalid/s7.in: -------------------------------------------------------------------------------- 1 | section1 param1 = value; param2 = value, 2 | section3 {pam = value; param2 = value, param3 = [value1", value2, 100500]}} 3 | section2 param1 = {key = value}, param1 = ["key"]} 4 | 5 | # Numbers 6 | key1 = 1=s 7 | key2 = 1min@@ # 8 | key3 = 1kb 9 | key4 = 5M 10 | key5 = 10mS 11 | key6 = 10y 12 | 13 | # Strings 14 | key1 "some string"; 15 | key2 = /some/path; 16 | key3 = 111some, 17 | key4: s1, 18 | "key5": "\n\r123" 19 | 20 | # Variables 21 | keyvar = "$ABItest 22 | keyvar = "${ABI}$ABI${ABI}${$ABI}" 23 | keyvar = "${some}$no${}$$test$$$$$$$"; 24 | keyvar = "$ABI$$ABI$$$ABI$$$$"; 25 | -------------------------------------------------------------------------------- /demos/ucl/seeds_valid/s1.in: -------------------------------------------------------------------------------- 1 | 2 | 3 | {"key": "value"} 4 | -------------------------------------------------------------------------------- /demos/ucl/seeds_valid/s2.res: -------------------------------------------------------------------------------- 1 | overrided { 2 | key = "overrided"; 3 | } 4 | section { 5 | value = "test"; 6 | } 7 | 8 | -------------------------------------------------------------------------------- /demos/ucl/seeds_valid/s3.in: -------------------------------------------------------------------------------- 1 | section blah { # test 2 | param = "value" 3 | } 4 | section test { 5 | key = test; 6 | subsection testsub { 7 | flag on; 8 | subsubsection testsubsub1 testsubsub2 { 9 | key = [1, 2, 3]; 10 | } 11 | } 12 | } 13 | 14 | section test { 15 | /* Empty */ 16 | } 17 | 18 | 19 | section foo { # test 20 | param = 123.2; 21 | } 22 | 23 | array = [] 24 | -------------------------------------------------------------------------------- /demos/ucl/seeds_valid/s4.in: -------------------------------------------------------------------------------- 1 | section1 { param1 = value; param2 = value, 2 | section3 {param = value; param2 = value, param3 = ["value1", value2, 100500]}} 3 | section2 { param1 = {key = value}, param1 = ["key"]} 4 | 5 | # Numbers 6 | key1 = 1s 7 | key2 = 1min 8 | key3 = 1kb 9 | key4 = 5M 10 | key5 = 10mS 11 | key6 = 10y 12 | 13 | # Strings 14 | key1 = "some string"; 15 | key2 = /some/path; 16 | key3 = 111some, 17 | key4: s1, 18 | "key5": "\n\r123" 19 | 20 | # Variables 21 | keyvar = "$ABItest"; 22 | keyvar = "${ABI}$ABI${ABI}${$ABI}"; 23 | keyvar = "${some}$no${}$$test$$$$$$$"; 24 | keyvar = "$ABI$$ABI$$$ABI$$$$"; 25 | -------------------------------------------------------------------------------- /demos/zlib/Makefile: -------------------------------------------------------------------------------- 1 | CC_FUZZ = afl-clang-fast 2 | CXX_FUZZ = afl-clang-fast++ 3 | CFLAGS_ASAN = -fsanitize=address,undefined 4 | CXXFLAGS_ASAN = -fsanitize=address,undefined 5 | 6 | LIB_NAME = lib 7 | LIB_REPO = https://github.com/madler/zlib.git 8 | 9 | DEPS = -I $(PWD)/$(LIB_NAME)/ \ 10 | -L $(PWD)/$(LIB_NAME)/ 11 | 12 | # link against 13 | DEPS_DYN = -lz 14 | DEPS_STC = -l:libz.a 15 | DEPS_LDD = $(PWD)/$(LIB_NAME)/ 16 | 17 | #------------------------------------------------------------------------ 18 | lib: # build for harness generation. Dynamic linking, asan, and afl instrumentation 19 | export AFL_USE_ASAN=1 20 | export AFL_USE_UBSAN=1 21 | rm -rf $(LIB_NAME) 22 | git clone $(LIB_REPO) $(LIB_NAME) 23 | cd $(LIB_NAME) && \ 24 | git checkout ef24c4c7502169f016dcd2a26923dbaf3216748c && \ 25 | cmake . \ 26 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) \ 27 | -DCMAKE_EXPORT_COMPILE_COMMANDS=ON && \ 28 | make all -j12 29 | 30 | lib_fuzz: # build for fuzzing. Static linking with afl instrumentation 31 | rm -rf $(LIB_NAME)_fuzz 32 | git clone $(LIB_REPO) $(LIB_NAME)_fuzz 33 | cd $(LIB_NAME)_fuzz && \ 34 | git checkout ef24c4c7502169f016dcd2a26923dbaf3216748c && \ 35 | cmake . \ 36 | -DCMAKE_C_COMPILER=$(CC_FUZZ) -DCMAKE_CXX_COMPILER=$(CXX_FUZZ) \ 37 | -DBUILD_SHARED_LIBS=OFF && \ 38 | make all -j12 39 | 40 | 41 | run_mx: # Use Multiplier to index the library 42 | mx-index --db $(PWD)/$(LIB_NAME).db --target $(PWD)/$(LIB_NAME)/compile_commands.json --workspace $(PWD)/mx 43 | 44 | #------------------------------------------------------------------------ 45 | all: lib lib_fuzz run_mx 46 | 47 | #------------------------------------------------------------------------ 48 | harness: # make command used to make the harness during generation 49 | $(CC_FUZZ) -o $(OUT)/harness.out $(OUT)/harness.c $(DEPS) $(DEPS_DYN) $(CFLAGS_ASAN) 50 | 51 | showmap: # command used to get coverage information about library under test 52 | LD_LIBRARY_PATH=$(DEPS_LDD) afl-showmap -o $(OUT)/tempfile -- $(OUT)/harness.out $(SEED) 53 | 54 | harness_fuzz: # compile a harness specifically for fuzzing. Pass the harness number using make harness_fuzz HARNESS_NUMBER=x 55 | @ls bin || mkdir bin 56 | $(eval LIB_NAME=lib_fuzz) \ 57 | $(CC_FUZZ) -o bin/ogharn$(HARNESS_NUMBER)\_fuzz $(OUT)/final-harnesses/src/harness$(HARNESS_NUMBER):*.c -static $(DEPS) $(DEPS_STC) ; 58 | 59 | clean: 60 | rm -rf bin mx lib.db-* 61 | 62 | clean_lib: 63 | rm -rf $(LIB_NAME)* -------------------------------------------------------------------------------- /demos/zlib/config.yaml: -------------------------------------------------------------------------------- 1 | blacklist: 2 | - gzvprintf 3 | - gzprintf 4 | - gzfwrite 5 | - gzfread -------------------------------------------------------------------------------- /demos/zlib/run_ogharn.sh: -------------------------------------------------------------------------------- 1 | ogharn.py -i $PWD -o $PWD/out -n 3 --m $PWD/lib.db -h zlib.h -r b -d -c $PWD/config.yaml -f -------------------------------------------------------------------------------- /demos/zlib/seeds_invalid/is1: -------------------------------------------------------------------------------- 1 | ��T@e��1401T@e��140124��TAe�x�[40124��� -------------------------------------------------------------------------------- /demos/zlib/seeds_invalid/is2: -------------------------------------------------------------------------------- 1 | �[����T@e��1401T@e��140124��TAe�x�[40124��� -------------------------------------------------------------------------------- /demos/zlib/seeds_invalid/is3: -------------------------------------------------------------------------------- 1 | * -------------------------------------------------------------------------------- /demos/zlib/seeds_valid/s1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/zlib/seeds_valid/s1 -------------------------------------------------------------------------------- /demos/zlib/seeds_valid/s2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/zlib/seeds_valid/s2 -------------------------------------------------------------------------------- /demos/zlib/seeds_valid/s3: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/zlib/seeds_valid/s3 -------------------------------------------------------------------------------- /demos/zlib/seeds_valid/s4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FuturesLab/OGHarn/ed713caab5edfef123eab53bfd2c948e515cae1f/demos/zlib/seeds_valid/s4 -------------------------------------------------------------------------------- /extras/install_dependencies.sh: -------------------------------------------------------------------------------- 1 | SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) 2 | 3 | # Get clang-18 4 | wget https://apt.llvm.org/llvm.sh 5 | chmod u+x llvm.sh 6 | sudo ./llvm.sh 18 7 | 8 | sudo apt install curl 9 | 10 | # Add kitware's repo GPG key to the system for authentication 11 | curl -sSL https://apt.kitware.com/keys/kitware-archive-latest.asc | \ 12 | gpg --dearmor - | \ 13 | sudo tee /etc/apt/trusted.gpg.d/kitware.gpg 14 | sudo apt-add-repository "deb https://apt.kitware.com/ubuntu/ $(lsb_release -cs) main" 15 | sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 6AF7F09730B3F0A4 16 | 17 | 18 | # Add deadsnakes repo to apt so python3.12 can be installed 19 | sudo add-apt-repository ppa:deadsnakes/ppa 20 | 21 | # Installing dependencies 22 | sudo apt update 23 | sudo apt install build-essential ninja-build cmake graphviz xdot 24 | sudo apt-get install clang-18 25 | sudo apt install python3.12-dev python3.12-venv 26 | sudo apt install kitware-archive-keyring 27 | sudo apt install bear 28 | sudo apt install cmake 29 | sudo apt install lld llvm 30 | sudo apt install libzstd-dev 31 | 32 | # Build Multiplier directories 33 | WORKSPACE_DIR="${SCRIPT_DIR}/multiplier" 34 | mkdir -p "${WORKSPACE_DIR}/build" 35 | mkdir -p "${WORKSPACE_DIR}/src" 36 | mkdir -p "${WORKSPACE_DIR}/install" 37 | 38 | # Create a new venv for Multiplier's Python API 39 | if [[ ! -f "${WORKSPACE_DIR}/install/bin/activate" ]]; then 40 | python3.12 -m venv "${WORKSPACE_DIR}/install" 41 | fi 42 | source "${WORKSPACE_DIR}/install/bin/activate" 43 | 44 | # Clone Multiplier 45 | cd "${WORKSPACE_DIR}/src" 46 | git clone https://github.com/trailofbits/multiplier.git 47 | 48 | # Build Multiplier 49 | cmake \ 50 | -DCMAKE_BUILD_TYPE=Release \ 51 | -DCMAKE_INSTALL_PREFIX="${WORKSPACE_DIR}/install" \ 52 | -DCMAKE_LINKER_TYPE=LLD \ 53 | -DCMAKE_C_COMPILER="$(which clang-18)" \ 54 | -DCMAKE_CXX_COMPILER="$(which clang++-18)" \ 55 | -DMX_ENABLE_INSTALL=ON \ 56 | -DMX_ENABLE_PYTHON_BINDINGS=ON \ 57 | -DLLVM_CONFIG=/usr/bin/llvm-config-18 \ 58 | -DLLVM_DIR=/usr/lib/llvm-18/lib/cmake/llvm/ \ 59 | -DCMAKE_LINKER=$(which lld-18) \ 60 | -GNinja \ 61 | "${WORKSPACE_DIR}/src/multiplier" 62 | 63 | ninja install 64 | 65 | # Clone and build AFLplusplus 66 | cd "${SCRIPT_DIR}" && git clone https://github.com/AFLplusplus/AFLplusplus.git 67 | cd "${SCRIPT_DIR}/AFLplusplus" && make all -j12 && cd "${SCRIPT_DIR}" 68 | -------------------------------------------------------------------------------- /extras/mult-to-c-types.txt: -------------------------------------------------------------------------------- 1 | FLOAT = float 2 | DOUBLE = double 3 | LONG_DOUBLE = long double 4 | FLOAT16 = _Float16 5 | B_FLOAT16 = __bf16 6 | FLOAT128 = __float128 7 | IBM128 = __ibm128 8 | VOID = void 9 | BOOLEAN = bool 10 | CHARACTER_U = char 11 | U_CHAR = unsigned char 12 | W_CHAR_U = wchar_t 13 | CHAR8 = char8_t 14 | CHAR16 = char16_t 15 | CHAR32 = char32_t 16 | U_SHORT = unsigned short 17 | U_INT = unsigned int 18 | U_LONG = unsigned long 19 | U_LONG_LONG = unsigned long long 20 | U_INT128 = unsigned __int128 21 | CHARACTER_S = char 22 | S_CHAR = signed char 23 | W_CHAR_S = wchar_t 24 | SHORT = short 25 | INT = int 26 | LONG = long 27 | LONG_LONG = long long 28 | INT128 = __int128 29 | -------------------------------------------------------------------------------- /extras/set_env.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) 4 | PARENT_DIR=$(dirname "$SCRIPT_DIR")/src 5 | 6 | # add Multiplier, AFL++, and OGHarn to the path 7 | export MULT_PATH=$SCRIPT_DIR/multiplier/install/bin 8 | export AFL_PATH=$SCRIPT_DIR/AFLplusplus 9 | export PATH=$PATH:$MULT_PATH:$AFL_PATH:$PARENT_DIR 10 | 11 | # activate the virtual environment and install the necessary packages 12 | source $SCRIPT_DIR/multiplier/install/bin/activate 13 | pip install -Iv cfile==0.2.0 14 | pip install PyYAML 15 | -------------------------------------------------------------------------------- /extras/type-to-val.txt: -------------------------------------------------------------------------------- 1 | float = 2.0 2 | double = 2.0 3 | long double = 2.0 4 | _Float16 = 2.0 5 | __bf16 = 2.0 6 | __float128 = 2.0 7 | __ibm128 = 1 8 | void = NULL 9 | bool = 1 10 | char = 's' 11 | unsigned char = 's' 12 | wchar_t = 's' 13 | char8_t = 's' 14 | char16_t = 's' 15 | char32_t = 's' 16 | unsigned short = 1 17 | unsigned int = 1 18 | unsigned long = 1 19 | unsigned long long = 1 20 | unsigned __int128 = 1 21 | char = 's' 22 | signed char = 's' 23 | wchar_t = 's' 24 | short = 1 25 | int = 1 26 | long = 1 27 | long long = 1 28 | __int128 = 1 29 | size_t = 1 30 | -------------------------------------------------------------------------------- /src/process_mx.py: -------------------------------------------------------------------------------- 1 | import multiplier as mx 2 | import engine 3 | 4 | class Index_Target_Header: 5 | def __init__(self, db_path, headers, recurse): 6 | self.index = mx.Index.in_memory_cache(mx.Index.from_database(db_path)) 7 | self.recurse = recurse 8 | self.headers = headers 9 | self.mx_headers = [] 10 | self.valid_paths = set() 11 | self.functions = [] 12 | self.enums = {} 13 | self.typedefs = {} 14 | self.fps = {} 15 | self.macros = [] 16 | self.builtIns = [] 17 | 18 | self.get_includes() 19 | 20 | def file_contained_in_headers(self, filename): 21 | for header in self.headers: 22 | if header in filename and filename.split("/")[-1] == header.split("/")[-1]: 23 | return True 24 | return False 25 | 26 | def get_includes(self): 27 | file_queue = [] 28 | for file in self.index.files: 29 | filename = self.get_file_name(file) 30 | if self.file_contained_in_headers(filename): 31 | file_queue.append(file) 32 | 33 | # get the directory the header files are stored in 34 | if not len(file_queue): 35 | raise ValueError("Indexed library does not contain files - The supplied .db file is likely malformed or incomplete.") 36 | 37 | base_path = "/".join(self.get_file_name(file_queue[0]).split("/")[:-1]) 38 | 39 | if self.recurse: 40 | # recursively pull in #included files, 41 | while len(file_queue): 42 | file = file_queue.pop(0) 43 | for reference in mx.frontend.IncludeLikeMacroDirective.IN(file): 44 | referenced_filename = self.get_file_name(reference.included_file) 45 | if base_path in referenced_filename and not self.file_contained_in_headers(referenced_filename): 46 | file_queue.append(reference.included_file) 47 | self.headers.append(referenced_filename) 48 | 49 | def extractArtifacts(self): 50 | self.get_enums() 51 | self.get_macrodefs() 52 | self.get_typedefs() 53 | # function return type and arguments have both string representation and multiplier representation 54 | self.get_functions() 55 | return self.functions, self.macros, self.enums, self.fps, self.typedefs 56 | 57 | def get_func_info(self, func): 58 | return [p.original_type for p in func.parameters], func.return_type 59 | 60 | def get_file_name(self, file): 61 | for p in file.paths: 62 | return str(p) 63 | 64 | def contained_in_API_specific_header(self, entity): 65 | if file := mx.frontend.File.containing(entity): 66 | filename = self.get_file_name(file) 67 | return self.file_contained_in_headers(filename) 68 | return False 69 | 70 | def get_typedefs(self): 71 | for typeDef in mx.ast.TypedefDecl.IN(self.index): 72 | if not self.contained_in_API_specific_header(typeDef): 73 | continue 74 | if isinstance(typeDef.underlying_type, mx.ast.ElaboratedType): 75 | if isinstance(typeDef.underlying_type.named_type, mx.ast.EnumType): 76 | self.add_enum(typeDef.underlying_type.named_type.declaration, typeDef.name) 77 | continue 78 | #function pointers are declared as pointer types and then FunctionProtoType types 79 | if isinstance(typeDef.underlying_type, mx.ast.PointerType) and isinstance(typeDef.underlying_type.pointee_type, mx.ast.FunctionProtoType): 80 | self.fps[typeDef.name] = typeDef.underlying_type.pointee_type 81 | elif typeDef.name in self.typedefs: 82 | self.typedefs[typeDef.name].add(typeDef.underlying_type) 83 | else: 84 | self.typedefs[typeDef.name] = set() 85 | self.typedefs[typeDef.name].add(typeDef.underlying_type) 86 | 87 | def get_macrodefs(self): 88 | for macro in mx.frontend.DefineMacroDirective.IN(self.index): 89 | if not self.contained_in_API_specific_header(macro): 90 | continue 91 | if macro.is_function_like: 92 | # don't really care about function-like macros for now 93 | continue 94 | self.macros.append(macro.name.data) 95 | 96 | 97 | def get_functions(self): 98 | func_occurrences = {} 99 | func_mapping = {} 100 | for func in mx.ast.FunctionDecl.IN(self.index): 101 | if not self.contained_in_API_specific_header(func): 102 | continue 103 | mult_args, mult_ret = self.get_func_info(func) 104 | func_name = func.name 105 | if func.name in func_mapping: 106 | if not any(x == mult_args for x in func_mapping[func.name]): 107 | # storing overloaded functions if necessary 108 | func_name = f"{func.name}overload{func_occurrences[func.name]}" 109 | func_occurrences[func.name] += 1 110 | func_mapping[func.name].append(mult_args) 111 | self.functions.append(engine.Function(func_name, mult_args, mult_ret)) 112 | else: 113 | func_mapping[func.name] = [mult_args] 114 | func_occurrences[func.name] = 1 115 | self.functions.append(engine.Function(func_name, mult_args, mult_ret)) 116 | 117 | 118 | def add_enum(self, enum, name): 119 | if not self.contained_in_API_specific_header(enum): 120 | return 121 | self.enums[name] = [] 122 | for val in enum.enumerators: 123 | self.enums[name].append(val.name) 124 | 125 | def get_enums(self): 126 | for enum in mx.ast.EnumDecl.IN(self.index): 127 | if enum.name: 128 | self.add_enum(enum, enum.name) 129 | elif enum.typedef_name_for_anonymous_declaration: 130 | self.add_enum(enum, enum.typedef_name_for_anonymous_declaration.name) --------------------------------------------------------------------------------