<commit_before>class: center, middle

## LibFuzzerfication stubs
## OUSPG Open, 2016-07-12

---

# Introduction
Purpose of libFuzzerfication is to do fuzz-testing for applications and libraries. Today we are going to write some libFuzzer stubs for libFuzzerfication.

Fuzzing is to automatically generate lots of test input to crash your code and to increase code coverage.
Some important terms:

Target:
- A function that consumes array of bytes and does something non trivial to them.

Fuzzer engine
- A tool that needs a fuzz target with different random inputs

Corpus
- A set on inputs that are either valid or invalid.
- Collected manually or by fuzzing or by crawling from web
- Can be minimized (to have only files with different code coverage)

---
# Motivation
There have been lots of vulnerabilities in popular libraries that should have been (theoretically) easy to test. We want to offer easy way to fuzz-test these libraries and increase awareness about the situation. We also want this to be available to everyone.

---

# About libfuzzer
* LibFuzzer is open-source library (part of LLVM)
* Relies on compiler instrumentation to get coverage feedback
* It is linked with the library under test
* Works fully inside the running program (a process) -> Fast!

---

# How to get started writing stubs?
You need:
- Docker
- Clang, libFuzzer (included in libfuzzer-base image)

List of targets to fuzz:
- https://docs.google.com/spreadsheets/d/1oj0L44gKTn3wlrJk6b554b9o8H0r1bVfb6LJrw62BEE/pubhtml

---
# How to get started writing stubs?

First clone the repo:
```
git clone https://github.com/ouspg/libfuzzerfication.git
```

Second step is to build base image. Go to libfuzzerfication/docker directory and write:
```
docker-compose build libfuzzer-base
```
Or alternatively pull the ready to go automagically built image from dockerhub:
```
docker pull ouspg/libfuzzer-base
```

Then you can start developing:
```
docker run -it --rm -v <host_dir>:<container_dir> --entrypoint bash <image>
```

---

Then you can implement a fuzzing target function that accepts a sequence of bytes, like this:

```
// libxml2_fuzzer.cc
#include "libxml/parser.h"
void ignore(void *ctx, const char *msg, ...) {
  // Error handler to avoid spam of error messages from libxml parser.
}
extern "C" int LLVMFuzzerTestOneInput(const unsigned char *data, size_t size) {
  xmlSetGenericErrorFunc(NULL, &ignore);
  auto doc = xmlReadMemory(reinterpret_cast<const char *>(data), size, "noname.xml", NULL, 0);
  //if (doc) {
    xmlFreeDoc(doc);
    xmlCleanupParser();
  //}
  return 0;
}
```

LibFuzzer is already installed in base image.
(Show build.sh and Dockerfile, show example)<commit_msg>add # to docker commands<commit_after>class: center, middle

## LibFuzzerfication stubs
## OUSPG Open, 2016-07-12

---

# Introduction
Purpose of libFuzzerfication is to do fuzz-testing for applications and libraries. Today we are going to write some libFuzzer stubs for libFuzzerfication.

Fuzzing is to automatically generate lots of test input to crash your code and to increase code coverage.
Some important terms:

Target:
- A function that consumes array of bytes and does something non trivial to them.

Fuzzer engine
- A tool that needs a fuzz target with different random inputs

Corpus
- A set on inputs that are either valid or invalid.
- Collected manually or by fuzzing or by crawling from web
- Can be minimized (to have only files with different code coverage)

---
# Motivation
There have been lots of vulnerabilities in popular libraries that should have been (theoretically) easy to test. We want to offer easy way to fuzz-test these libraries and increase awareness about the situation. We also want this to be available to everyone.

---

# About libfuzzer
* LibFuzzer is open-source library (part of LLVM)
* Relies on compiler instrumentation to get coverage feedback
* It is linked with the library under test
* Works fully inside the running program (a process) -> Fast!

---

# How to get started writing stubs?
You need:
- Docker
- Clang, libFuzzer (included in libfuzzer-base image)

List of targets to fuzz:
- https://docs.google.com/spreadsheets/d/1oj0L44gKTn3wlrJk6b554b9o8H0r1bVfb6LJrw62BEE/pubhtml

---
# How to get started writing stubs?

First clone the repo:
```
git clone https://github.com/ouspg/libfuzzerfication.git
```

Second step is to build base image. Go to libfuzzerfication/docker directory and write:
```
# docker-compose build libfuzzer-base
```
Or alternatively pull the ready to go automagically built image from dockerhub:
```
# docker pull ouspg/libfuzzer-base
```

Then you can start developing:
```
# docker run -it --rm -v <host_dir>:<container_dir> --entrypoint bash <image>
```

---

Then you can implement a fuzzing target function that accepts a sequence of bytes, like this:

```
// libxml2_fuzzer.cc
#include "libxml/parser.h"
void ignore(void *ctx, const char *msg, ...) {
  // Error handler to avoid spam of error messages from libxml parser.
}
extern "C" int LLVMFuzzerTestOneInput(const unsigned char *data, size_t size) {
  xmlSetGenericErrorFunc(NULL, &ignore);
  auto doc = xmlReadMemory(reinterpret_cast<const char *>(data), size, "noname.xml", NULL, 0);
  //if (doc) {
    xmlFreeDoc(doc);
    xmlCleanupParser();
  //}
  return 0;
}
```

LibFuzzer is already installed in base image.
(Show build.sh and Dockerfile, show example)
{'fraction_non_alphanumeric': 0.08291503997025469, 'fraction_numerical': 0.010039040713887339, 'mean_word_length': 4.193050193050193, 'pattern_counts': {'":': 0, '<': 11, '<?xml version=': 0, '>': 13, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 16}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '308393', 'n_tokens_mistral': 1701, 'n_tokens_neox': 1612, 'n_words': 688}