This directory contains fuzz targets. Fuzz targets are simple codes using the library. They are used with a so-called fuzz driver, which will generate inputs, try to process them with the fuzz target, and alert in case of an unwanted behavior (such as a buffer overflow for instance).
These targets were meant to be used with oss-fuzz but can be used in other contexts.
This code was contributed by Philippe Antoine ( Catena cyber ).
To run the fuzz targets like oss-fuzz:
git clone https://github.com/google/oss-fuzz cd oss-fuzz python infra/helper.py build_image mbedtls python infra/helper.py build_fuzzers --sanitizer address mbedtls python infra/helper.py run_fuzzer mbedtls fuzz_client
You can use
undefined sanitizer as well as
address sanitizer. And you can run any of the fuzz targets like
To run the fuzz targets without oss-fuzz, you first need to install one libFuzzingEngine (libFuzzer for instance). Then you need to compile the code with the compiler flags of the wished sanitizer.
perl scripts/config.py set MBEDTLS_PLATFORM_TIME_ALT mkdir build cd build cmake .. make
Finally, you can run the targets like
These targets use network trafic as inputs :
They also use the last bytes as configuration options.
To generate corpus for these targets, you can do the following, not fully automated steps :
reproducibleoption turned on while capturing trafic into test.pcap
tshark -Tfields -e tcp.dstport -e tcp.payload -r test.pcap > test.txt
python dummy.py test.txt > test.cor
Here is an example of dummy.py for extracting payload from client to server (if we used
tcp.dstport in tshark command)
import sys import binascii f = open(sys.argv) for l in f.readlines(): portAndPl=l.split() if len(portAndPl) == 2: # determine client or server based on port if portAndPl == "4433": print(binascii.unhexlify(portAndPl.replace(":","")))