diff --git a/contrib/fuzz/cap_fuzzer.go b/contrib/fuzz/cap_fuzzer.go deleted file mode 100644 index f03a5630e..000000000 --- a/contrib/fuzz/cap_fuzzer.go +++ /dev/null @@ -1,28 +0,0 @@ -//go:build gofuzz -// +build gofuzz - -/* - Copyright The containerd Authors. - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - http://www.apache.org/licenses/LICENSE-2.0 - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package fuzz - -import ( - "bytes" - - "github.com/containerd/containerd/pkg/cap" -) - -func FuzzParseProcPIDStatus(data []byte) int { - _, _ = cap.ParseProcPIDStatus(bytes.NewReader(data)) - return 1 -} diff --git a/contrib/fuzz/oss_fuzz_build.sh b/contrib/fuzz/oss_fuzz_build.sh index 8257bbfcf..6ab1f4269 100755 --- a/contrib/fuzz/oss_fuzz_build.sh +++ b/contrib/fuzz/oss_fuzz_build.sh @@ -69,6 +69,7 @@ mv $SRC/cmd-containerd-backup $SRC/containerd/cmd/containerd mv $SRC/containerd/filters/filter_test.go $SRC/containerd/filters/filter_test_fuzz.go go get github.com/AdamKorcz/go-118-fuzz-build/utils compile_native_go_fuzzer github.com/containerd/containerd/filters FuzzFiltersParse fuzz_filters_parse +compile_native_go_fuzzer github.com/containerd/containerd/pkg/cap FuzzParseProcPIDStatus fuzz_parse_proc_pid_status compile_go_fuzzer github.com/containerd/containerd/remotes/docker FuzzFetcher fuzz_fetcher compile_go_fuzzer github.com/containerd/containerd/remotes/docker FuzzParseDockerRef fuzz_parse_docker_ref @@ -78,7 +79,6 @@ compile_go_fuzzer github.com/containerd/containerd/contrib/fuzz FuzzImportIndex compile_go_fuzzer github.com/containerd/containerd/contrib/fuzz FuzzCSWalk fuzz_cs_walk compile_go_fuzzer github.com/containerd/containerd/contrib/fuzz FuzzArchiveExport fuzz_archive_export compile_go_fuzzer github.com/containerd/containerd/contrib/fuzz FuzzParseAuth fuzz_parse_auth -compile_go_fuzzer github.com/containerd/containerd/contrib/fuzz FuzzParseProcPIDStatus fuzz_parse_proc_pid_status compile_go_fuzzer github.com/containerd/containerd/contrib/fuzz FuzzImageStore fuzz_image_store compile_go_fuzzer github.com/containerd/containerd/contrib/fuzz FuzzLeaseManager fuzz_lease_manager compile_go_fuzzer github.com/containerd/containerd/contrib/fuzz FuzzContainerStore fuzz_container_store diff --git a/pkg/cap/cap_linux_test.go b/pkg/cap/cap_linux_test.go index 85b380f11..26a9142c7 100644 --- a/pkg/cap/cap_linux_test.go +++ b/pkg/cap/cap_linux_test.go @@ -17,12 +17,70 @@ package cap import ( + "bytes" "strings" "testing" "github.com/stretchr/testify/assert" ) +const procPIDStatus = `Name: cat +Umask: 0022 +State: R (running) +Tgid: 170065 +Ngid: 0 +Pid: 170065 +PPid: 170064 +TracerPid: 0 +Uid: 0 0 0 0 +Gid: 0 0 0 0 +FDSize: 64 +Groups: 0 +NStgid: 170065 +NSpid: 170065 +NSpgid: 170064 +NSsid: 3784 +VmPeak: 8216 kB +VmSize: 8216 kB +VmLck: 0 kB +VmPin: 0 kB +VmHWM: 676 kB +VmRSS: 676 kB +RssAnon: 72 kB +RssFile: 604 kB +RssShmem: 0 kB +VmData: 324 kB +VmStk: 132 kB +VmExe: 20 kB +VmLib: 1612 kB +VmPTE: 56 kB +VmSwap: 0 kB +HugetlbPages: 0 kB +CoreDumping: 0 +THP_enabled: 1 +Threads: 1 +SigQ: 0/63692 +SigPnd: 0000000000000000 +ShdPnd: 0000000000000000 +SigBlk: 0000000000000000 +SigIgn: 0000000000000000 +SigCgt: 0000000000000000 +CapInh: 0000000000000000 +CapPrm: 000000ffffffffff +CapEff: 000000ffffffffff +CapBnd: 000000ffffffffff +CapAmb: 0000000000000000 +NoNewPrivs: 0 +Seccomp: 0 +Speculation_Store_Bypass: thread vulnerable +Cpus_allowed: 00000000,00000000,00000000,0000000f +Cpus_allowed_list: 0-3 +Mems_allowed: 00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001 +Mems_allowed_list: 0 +voluntary_ctxt_switches: 0 +nonvoluntary_ctxt_switches: 0 +` + func TestCapsList(t *testing.T) { assert.Len(t, caps316, 38) assert.Len(t, caps58, 40) @@ -89,62 +147,6 @@ func TestFromBitmap(t *testing.T) { } func TestParseProcPIDStatus(t *testing.T) { - procPIDStatus := `Name: cat -Umask: 0022 -State: R (running) -Tgid: 170065 -Ngid: 0 -Pid: 170065 -PPid: 170064 -TracerPid: 0 -Uid: 0 0 0 0 -Gid: 0 0 0 0 -FDSize: 64 -Groups: 0 -NStgid: 170065 -NSpid: 170065 -NSpgid: 170064 -NSsid: 3784 -VmPeak: 8216 kB -VmSize: 8216 kB -VmLck: 0 kB -VmPin: 0 kB -VmHWM: 676 kB -VmRSS: 676 kB -RssAnon: 72 kB -RssFile: 604 kB -RssShmem: 0 kB -VmData: 324 kB -VmStk: 132 kB -VmExe: 20 kB -VmLib: 1612 kB -VmPTE: 56 kB -VmSwap: 0 kB -HugetlbPages: 0 kB -CoreDumping: 0 -THP_enabled: 1 -Threads: 1 -SigQ: 0/63692 -SigPnd: 0000000000000000 -ShdPnd: 0000000000000000 -SigBlk: 0000000000000000 -SigIgn: 0000000000000000 -SigCgt: 0000000000000000 -CapInh: 0000000000000000 -CapPrm: 000000ffffffffff -CapEff: 000000ffffffffff -CapBnd: 000000ffffffffff -CapAmb: 0000000000000000 -NoNewPrivs: 0 -Seccomp: 0 -Speculation_Store_Bypass: thread vulnerable -Cpus_allowed: 00000000,00000000,00000000,0000000f -Cpus_allowed_list: 0-3 -Mems_allowed: 00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001 -Mems_allowed_list: 0 -voluntary_ctxt_switches: 0 -nonvoluntary_ctxt_switches: 0 -` res, err := ParseProcPIDStatus(strings.NewReader(procPIDStatus)) assert.NoError(t, err) expected := map[Type]uint64{ @@ -167,3 +169,13 @@ func TestKnown(t *testing.T) { caps := Known() assert.EqualValues(t, caps59, caps) } + +func FuzzParseProcPIDStatus(f *testing.F) { + f.Add(procPIDStatus) + f.Fuzz(func(t *testing.T, s string) { + result, err := ParseProcPIDStatus(bytes.NewReader([]byte(s))) + if err != nil && result != nil { + t.Errorf("either %+v or %+v must be nil", result, err) + } + }) +}