Fixed xpath crashes discovered by fuzzing

Added fuzz code for xpath
Test: added negative xpath tests
This commit is contained in:
Olof hagsand 2022-11-04 16:12:22 +01:00
parent 05cdbf5c4f
commit 779fcf5458
16 changed files with 197 additions and 29 deletions

31
test/fuzz/xpath/README.md Normal file
View file

@ -0,0 +1,31 @@
# Clixon xpath fuzzing
This dir contains code for fuzzing clixon xpaths.
## Prereqs
Install AFL, see [..](..)
## Build
Build clixon clixon_util_xpath statically with the afl-clang compiler:
```
CC=/usr/bin/afl-clang-fast LINKAGE=static INSTALLFLAGS="" ./configure
make clean
cd lib
make
sudo make install
cd ../util
make clixon_util_xpath
sudo install clixon_util_xpath /usr/local/bin/ # some utils have complex dependencies
```
## Run tests
Run the script `runfuzz.sh` to run one test with a yang spec and an input string, eg:
```
./runfuzz.sh
```
After (or during) the test, investigate results in the output dir.

View file

@ -0,0 +1 @@
/ex:table[ex:parameter='x']

34
test/fuzz/xpath/runfuzz.sh Executable file
View file

@ -0,0 +1,34 @@
#!/usr/bin/env bash
# Run a fuzzing test using american fuzzy lop
set -eux
if [ $# -ne 0 ]; then
echo "usage: $0\n"
exit 255
fi
APPNAME=example
xml=example.xml
cat <<EOF > $xml
<table xmlns="urn:example:clixon">
<parameter>
<name>x</name>
<value>42</value>
</parameter>
</table>
EOF
MEGS=500 # memory limit for child process (50 MB)
# remove input and input dirs
#test ! -d input || rm -rf input
test ! -d output || rm -rf output
# create if dirs dont exists
#test -d input || mkdir input
test -d output || mkdir output
# Run script
afl-fuzz -i input -o output -m $MEGS -- clixon_util_xpath -f $xml -n ex:urn:example:clixon -y /usr/local/share/clixon/clixon-example@2022-11-01.yang -Y /usr/local/share/clixon