libwebsockets - html and http headers parsing fuzz targets

projects/libwebsockets/Dockerfile

@@ -19,5 +19,16 @@ RUN apt-get update && apt-get install -y libssl-dev
 
 RUN git clone --depth 1 https://github.com/warmcat/libwebsockets.git
 COPY build.sh $SRC
+
 COPY lws_upng_inflate_fuzzer.cpp $SRC/libwebsockets/
+COPY lws_lhs_fuzzer.cpp $SRC/libwebsockets/
+COPY lws_parse_uri_fuzzer.cpp $SRC/libwebsockets/
+COPY lws_parse_fuzzer.cpp $SRC/libwebsockets/
+
+COPY lws_lhs_fuzzer.dict $OUT
+COPY lws_parse_fuzzer.dict $OUT
+
+COPY lws_lhs_fuzzer_seed_corpus.zip $OUT
+COPY lws_parse_fuzzer_seed_corpus.zip $OUT
+
 WORKDIR $SRC/libwebsockets

projects/libwebsockets/build.sh

@@ -21,11 +21,40 @@ cd $DIR
 sed -i 's/-Werror//g' ./CMakeLists.txt
 mkdir build && cd build
 cmake -DCMAKE_C_FLAGS="$CFLAGS" -DCMAKE_CXX_FLAGS="$CXXFLAGS" \
-      -DCMAKE_EXE_LINKER_FLAGS="$CFLAGS" -DCMAKE_SHARED_LINKER_FLAGS="$CFLAGS" ..
+      -DCMAKE_EXE_LINKER_FLAGS="$CFLAGS" -DCMAKE_SHARED_LINKER_FLAGS="$CFLAGS" \
+      -DLWS_WITH_CUSTOM_HEADERS=ON \
+      -DLWS_ROLE_WS=ON \
+      ..
 make -j8
 
 cd $DIR
-$CXX $CFLAGS $LIB_FUZZING_ENGINE -I$DIR/build/include \
-	-o $OUT/lws_upng_inflate_fuzzer lws_upng_inflate_fuzzer.cpp \
-	-L$DIR/build/lib -l:libwebsockets.a \
-	-L/usr/lib/x86_64-linux-gnu/ -l:libssl.so -l:libcrypto.so
+
+INCLUDE_DIRS="-I$DIR/build/include \
+	-I$DIR/build \
+	-I$DIR/lib/core/ \
+	-I$DIR/lib/plat/unix -I$DIR/lib/tls/ \
+	-I$DIR/lib/secure-streams/ \
+	-I$DIR/lib/event-libs/ \
+	-I$DIR/lib/system/smd \
+	-I$DIR/lib/system/metrics/ \
+	-I$DIR/lib/core-net \
+	-I$DIR/lib/roles \
+	-I$DIR/lib/roles/http \
+	-I$DIR/lib/roles/h1 \
+	-I$DIR/lib/roles/h2 \
+	-I$DIR/lib/roles/ws"
+
+FUZZER_SRCS=(
+    "lws_lhs_fuzzer.cpp"
+    "lws_upng_inflate_fuzzer.cpp"
+    "lws_parse_uri_fuzzer.cpp"
+    "lws_parse_fuzzer.cpp"
+)
+
+for FUZZER in "${FUZZER_SRCS[@]}"; do
+    FUZZER_NAME=$(basename "$FUZZER" .cpp)
+    $CXX $CFLAGS $LIB_FUZZING_ENGINE $INCLUDE_DIRS \
+        -o "$OUT/$FUZZER_NAME" $FUZZER \
+        -L"$DIR/build/lib" -l:libwebsockets.a \
+        -L/usr/lib/x86_64-linux-gnu/ -l:libssl.so -l:libcrypto.so
+done

projects/libwebsockets/lws_lhs_fuzzer.cpp

@@ -0,0 +1,87 @@
+/* Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+##############################################################################*/
+
+#include <stdlib.h>
+#include "libwebsockets.h"
+
+static unsigned int m, step;
+
+static int
+dump_atr(lws_dll2_t *d, void *user)
+{
+	lws_container_of(d, lhp_atr_t, list);
+	//lhp_atr_t *atr = lws_container_of(d, lhp_atr_t, list);
+	//const char *p = (const char *)&atr[1];
+
+	//printf("{ \"%.*s\", \"%.*s\" }, ",
+	//	    (int)atr->name_len, p, (int)atr->value_len, p + atr->name_len + 1);
+
+	return 0;
+}
+
+static lws_stateful_ret_t
+test_cb(lhp_ctx_t *ctx, char reason)
+{
+	lhp_pstack_t *ps = lws_container_of(ctx->stack.tail, lhp_pstack_t, list);
+	if (reason == LHPCB_ELEMENT_START || reason == LHPCB_ELEMENT_END) {
+		lws_dll2_foreach_safe(&ps->atr, NULL, dump_atr);
+		lws_css_cascade_get_prop_atr(ctx, LCSP_PROP_DISPLAY);
+		lws_css_cascade_get_prop_atr(ctx, LCSP_PROP_COLOR);
+		lws_css_cascade_get_prop_atr(ctx, LCSP_PROP_FONT_SIZE);
+		lws_css_cascade_get_prop_atr(ctx, LCSP_PROP_FONT_FAMILY);
+	}
+	return (lws_stateful_ret_t)0;
+}
+
+static const lws_surface_info_t ic = {
+	.wh_px = { { 600,0 },       { 448,0 } },
+	.wh_mm = { { 114,5000000 }, {  82,5000000 } },
+};
+
+static lws_displaylist_t displaylist;
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, uint32_t size) {
+	struct lws_context_creation_info info = {0};
+	struct lws_context *cx = NULL;
+	lhp_ctx_t ctx;
+	lws_dl_rend_t drt;
+	size_t ssize;
+	const uint8_t *sdata;
+
+	if (!size)
+	  return (0);
+	memset(&ctx, 0, sizeof(ctx));
+	drt.dl = &displaylist;
+	drt.w = ic.wh_px[0].whole;
+	drt.h = ic.wh_px[1].whole;
+	if (lws_lhp_construct(&ctx, test_cb, &drt, &ic))
+		return (-1);
+
+	lws_context_info_defaults(&info, NULL);
+	if (!(cx = lws_create_context(&info)))
+	  return (0);
+	ctx.user1 = (uint8_t *)cx;
+
+	ctx.flags = LHP_FLAG_DOCUMENT_END;
+	if (!(ctx.base_url = strdup("")))
+		return (-1);
+	ssize = (size_t)size;
+	sdata = data;
+	lws_lhp_parse(&ctx, &sdata, &ssize);
+	lws_lhp_destruct(&ctx);
+	lws_context_destroy(cx);
+	return (0);
+}

projects/libwebsockets/lws_lhs_fuzzer.dict

@@ -0,0 +1,160 @@
+#
+# AFL dictionary for HTML parsers (tags only)
+# -------------------------------------------
+#
+# A basic collection of HTML tags likely to matter to HTML parsers. Does *not*
+# include any attributes or attribute values.
+#
+# Created by Michal Zalewski
+#
+
+tag_a="<a>"
+tag_abbr="<abbr>"
+tag_acronym="<acronym>"
+tag_address="<address>"
+tag_annotation_xml="<annotation-xml>"
+tag_applet="<applet>"
+tag_area="<area>"
+tag_article="<article>"
+tag_aside="<aside>"
+tag_audio="<audio>"
+tag_b="<b>"
+tag_base="<base>"
+tag_basefont="<basefont>"
+tag_bdi="<bdi>"
+tag_bdo="<bdo>"
+tag_bgsound="<bgsound>"
+tag_big="<big>"
+tag_blink="<blink>"
+tag_blockquote="<blockquote>"
+tag_body="<body>"
+tag_br="<br>"
+tag_button="<button>"
+tag_canvas="<canvas>"
+tag_caption="<caption>"
+tag_center="<center>"
+tag_cite="<cite>"
+tag_code="<code>"
+tag_col="<col>"
+tag_colgroup="<colgroup>"
+tag_data="<data>"
+tag_datalist="<datalist>"
+tag_dd="<dd>"
+tag_del="<del>"
+tag_desc="<desc>"
+tag_details="<details>"
+tag_dfn="<dfn>"
+tag_dir="<dir>"
+tag_div="<div>"
+tag_dl="<dl>"
+tag_dt="<dt>"
+tag_em="<em>"
+tag_embed="<embed>"
+tag_fieldset="<fieldset>"
+tag_figcaption="<figcaption>"
+tag_figure="<figure>"
+tag_font="<font>"
+tag_footer="<footer>"
+tag_foreignobject="<foreignobject>"
+tag_form="<form>"
+tag_frame="<frame>"
+tag_frameset="<frameset>"
+tag_h1="<h1>"
+tag_h2="<h2>"
+tag_h3="<h3>"
+tag_h4="<h4>"
+tag_h5="<h5>"
+tag_h6="<h6>"
+tag_head="<head>"
+tag_header="<header>"
+tag_hgroup="<hgroup>"
+tag_hr="<hr>"
+tag_html="<html>"
+tag_i="<i>"
+tag_iframe="<iframe>"
+tag_image="<image>"
+tag_img="<img>"
+tag_input="<input>"
+tag_ins="<ins>"
+tag_isindex="<isindex>"
+tag_kbd="<kbd>"
+tag_keygen="<keygen>"
+tag_label="<label>"
+tag_legend="<legend>"
+tag_li="<li>"
+tag_link="<link>"
+tag_listing="<listing>"
+tag_main="<main>"
+tag_malignmark="<malignmark>"
+tag_map="<map>"
+tag_mark="<mark>"
+tag_marquee="<marquee>"
+tag_math="<math>"
+tag_menu="<menu>"
+tag_menuitem="<menuitem>"
+tag_meta="<meta>"
+tag_meter="<meter>"
+tag_mglyph="<mglyph>"
+tag_mi="<mi>"
+tag_mn="<mn>"
+tag_mo="<mo>"
+tag_ms="<ms>"
+tag_mtext="<mtext>"
+tag_multicol="<multicol>"
+tag_nav="<nav>"
+tag_nextid="<nextid>"
+tag_nobr="<nobr>"
+tag_noembed="<noembed>"
+tag_noframes="<noframes>"
+tag_noscript="<noscript>"
+tag_object="<object>"
+tag_ol="<ol>"
+tag_optgroup="<optgroup>"
+tag_option="<option>"
+tag_output="<output>"
+tag_p="<p>"
+tag_param="<param>"
+tag_plaintext="<plaintext>"
+tag_pre="<pre>"
+tag_progress="<progress>"
+tag_q="<q>"
+tag_rb="<rb>"
+tag_rp="<rp>"
+tag_rt="<rt>"
+tag_rtc="<rtc>"
+tag_ruby="<ruby>"
+tag_s="<s>"
+tag_samp="<samp>"
+tag_script="<script>"
+tag_section="<section>"
+tag_select="<select>"
+tag_small="<small>"
+tag_source="<source>"
+tag_spacer="<spacer>"
+tag_span="<span>"
+tag_strike="<strike>"
+tag_strong="<strong>"
+tag_style="<style>"
+tag_sub="<sub>"
+tag_summary="<summary>"
+tag_sup="<sup>"
+tag_svg="<svg>"
+tag_table="<table>"
+tag_tbody="<tbody>"
+tag_td="<td>"
+tag_template="<template>"
+tag_textarea="<textarea>"
+tag_tfoot="<tfoot>"
+tag_th="<th>"
+tag_thead="<thead>"
+tag_time="<time>"
+tag_title="<title>"
+tag_tr="<tr>"
+tag_track="<track>"
+tag_tt="<tt>"
+tag_u="<u>"
+tag_ul="<ul>"
+tag_var="<var>"
+tag_video="<video>"
+tag_wbr="<wbr>"
+tag_xmp="<xmp>"