Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix crashers found via fuzzing #5

Merged
merged 3 commits into from
Nov 2, 2015
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions fuzz.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
// +build gofuzz

package stalecucumber

import (
"bytes"
)

func Fuzz(data []byte) int {
if _, err := Unpickle(bytes.NewReader(data)); err != nil {
return 0
}
return 1
}
20 changes: 20 additions & 0 deletions fuzz_test.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
package stalecucumber

import (
"strings"
"testing"
)

func TestFuzzCrashers(t *testing.T) {

var crashers = []string{
"}}(s", //protocol_0 SETITEM hash of unhashable
"((d}d", //protocol_0.go opcode_DICT hash of unhashable
"}(}(a}u", //protocol_1 SETITEMS hash of unhashable
"(p0\nj0000", //pickle_machine flushMemoBuffer index out of range
}

for _, f := range crashers {
Unpickle(strings.NewReader(f))
}
}
29 changes: 27 additions & 2 deletions protocol_0.go
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ package stalecucumber
import "strconv"
import "fmt"
import "math/big"
import "errors"

//import "unicode/utf8"
import "unicode/utf16"
Expand Down Expand Up @@ -354,7 +355,19 @@ Build a dict out of the topmost stack slice, after markobject.
Stack before: [mark, stackslice]
Stack after: [dict]
**/
func (pm *PickleMachine) opcode_DICT() error {
func (pm *PickleMachine) opcode_DICT() (err error) {
defer func() {
if r := recover(); r != nil {
switch x := r.(type) {
case string:
err = errors.New(x)
case error:
err = x
default:
err = errors.New("Unknown panic")
}
}
}()
markIndex, err := pm.findMark()
if err != nil {
return err
Expand Down Expand Up @@ -391,7 +404,19 @@ Add a key+value pair to an existing dict.
Stack before: [dict, any, any]
Stack after: [dict]
**/
func (pm *PickleMachine) opcode_SETITEM() error {
func (pm *PickleMachine) opcode_SETITEM() (err error) {
defer func() {
if r := recover(); r != nil {
switch x := r.(type) {
case string:
err = errors.New(x)
case error:
err = x
default:
err = errors.New("Unknown panic")
}
}
}()
v, err := pm.pop()
if err != nil {
return err
Expand Down
47 changes: 42 additions & 5 deletions protocol_1.go
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package stalecucumber

import "fmt"
import "errors"

/**
Opcode: BININT (0x4a)
Expand Down Expand Up @@ -272,7 +273,19 @@ Add an arbitrary number of key+value pairs to an existing dict.
Stack before: [dict, mark, stackslice]
Stack after: [dict]
**/
func (pm *PickleMachine) opcode_SETITEMS() error {
func (pm *PickleMachine) opcode_SETITEMS() (err error) {
defer func() {
if r := recover(); r != nil {
switch x := r.(type) {
case string:
err = errors.New(x)
case error:
err = x
default:
err = errors.New("Unknown panic")
}
}
}()
markIndex, err := pm.findMark()
if err != nil {
return err
Expand Down Expand Up @@ -333,9 +346,21 @@ Read an object from the memo and push it on the stack.
Stack before: []
Stack after: [any]
**/
func (pm *PickleMachine) opcode_BINGET() error {
func (pm *PickleMachine) opcode_BINGET() (err error) {
defer func() {
if r := recover(); r != nil {
switch x := r.(type) {
case string:
err = errors.New(x)
case error:
err = x
default:
err = errors.New("Unknown panic")
}
}
}()
var index uint8
err := pm.readBinaryInto(&index, false)
err = pm.readBinaryInto(&index, false)
if err != nil {
return err
}
Expand All @@ -362,9 +387,21 @@ Read an object from the memo and push it on the stack.
Stack before: []
Stack after: [any]
**/
func (pm *PickleMachine) opcode_LONG_BINGET() error {
func (pm *PickleMachine) opcode_LONG_BINGET() (err error) {
defer func() {
if r := recover(); r != nil {
switch x := r.(type) {
case string:
err = errors.New(x)
case error:
err = x
default:
err = errors.New("Unknown panic")
}
}
}()
var index int32
err := pm.readBinaryInto(&index, false)
err = pm.readBinaryInto(&index, false)
if err != nil {
return err
}
Expand Down