httrack

rms/httrack

Fork 0

mirror of https://github.com/xroche/httrack.git synced 2026-07-09 02:16:50 +03:00

Author	SHA1	Message	Date
Xavier Roche	a707d4b845	Add libFuzzer harnesses for the HTTP header and cache-index parsers (reland) (#509 ) * Add libFuzzer harnesses for the HTTP header and cache-index parsers P3-5 fuzz Tier-2. Two more harnesses over hostile-input parsers that read structured bytes into fixed buffers: fuzz-header drives treatfirstline plus treathead on each response-header line (the Content-Type/-Encoding path hardened in #506, and the cookie/Location/Content-Range fields); fuzz-cachendx drives the hts-cache/.ndx length-prefixed scan that cache_readex_new loads on --update. fuzz-cachendx found the over-advance fixed in the parent commit; its seed corpus carries the two crash reproducers as replay regressions. The cache harness stops at the scan rather than the trailing coucal insert, whose murmur hash trips a separate pointer-overflow the .ndx parser does not own. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com> Correct copyright year on the new fuzz harnesses (2026) fuzz-header.c and fuzz-cachendx.c are new in the 2026 audit cycle; match the sibling *_selftest.c files rather than the boilerplate 1998. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com> --------- Signed-off-by: Xavier Roche <roche@httrack.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-08 21:44:19 +02:00
Xavier Roche	65c1016a4e	Bound the cache-index (.ndx) parser to its buffer (#507 ) * Bound the cache-index (.ndx) parser to its buffer cache_brstr trusted the on-disk length prefix for its cursor advance (off += i, i up to 32768), so a corrupt or truncated hts-cache/.ndx whose declared length overstates the file walked the length-prefixed scan past the end of the readfile() buffer; the next binput()/strchr() in the loader then read out of bounds. A cache truncated by a crash or a full disk, or one handed to --update/--continue, reaches it. Bound both the copy and the advance in cache_brstr to the bytes actually present (strnlen up to the terminating NUL), and add cache_binput(), a binput() that refuses to start a read at or past end-of-buffer, for the two loader scan loops in htscache.c and htscoremain.c; the latter also gains the a < end guard the former already had. Regression: -#test=cacheindex plus 01_engine-cacheindex.test (the deterministic bound check fails on the old advance; the ASan CI jobs also exercise the scan). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com> gitignore: ignore dist/ release staging artifacts httrack-gh-release stages its signed tarballs in dist/ inside the checkout; only root-level /httrack-*.tar.gz was ignored, so a broad git add swept the 3.49.10/3.49.11 artifacts into this branch's first commit (since rewritten out). Ignore the directory. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Xavier Roche <roche@httrack.com> --------- Signed-off-by: Xavier Roche <roche@httrack.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-08 21:02:27 +02:00

Author

SHA1

Message

Date

Xavier Roche

a707d4b845

Add libFuzzer harnesses for the HTTP header and cache-index parsers (reland) (#509 )

* Add libFuzzer harnesses for the HTTP header and cache-index parsers

P3-5 fuzz Tier-2. Two more harnesses over hostile-input parsers that read
structured bytes into fixed buffers: fuzz-header drives treatfirstline plus
treathead on each response-header line (the Content-Type/-Encoding path hardened
in #506, and the cookie/Location/Content-Range fields); fuzz-cachendx drives the
hts-cache/*.ndx length-prefixed scan that cache_readex_new loads on --update.

fuzz-cachendx found the over-advance fixed in the parent commit; its seed corpus
carries the two crash reproducers as replay regressions. The cache harness stops
at the scan rather than the trailing coucal insert, whose murmur hash trips a
separate pointer-overflow the .ndx parser does not own.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Xavier Roche <roche@httrack.com>

* Correct copyright year on the new fuzz harnesses (2026)

fuzz-header.c and fuzz-cachendx.c are new in the 2026 audit cycle;
match the sibling *_selftest.c files rather than the boilerplate 1998.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Xavier Roche <roche@httrack.com>

---------

Signed-off-by: Xavier Roche <roche@httrack.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-08 21:44:19 +02:00

Xavier Roche

65c1016a4e

Bound the cache-index (.ndx) parser to its buffer (#507 )

* Bound the cache-index (.ndx) parser to its buffer

cache_brstr trusted the on-disk length prefix for its cursor advance
(off += i, i up to 32768), so a corrupt or truncated hts-cache/*.ndx
whose declared length overstates the file walked the length-prefixed scan
past the end of the readfile() buffer; the next binput()/strchr() in the
loader then read out of bounds. A cache truncated by a crash or a full
disk, or one handed to --update/--continue, reaches it.

Bound both the copy and the advance in cache_brstr to the bytes actually
present (strnlen up to the terminating NUL), and add cache_binput(), a
binput() that refuses to start a read at or past end-of-buffer, for the
two loader scan loops in htscache.c and htscoremain.c; the latter also
gains the a < end guard the former already had. Regression: -#test=cacheindex
plus 01_engine-cacheindex.test (the deterministic bound check fails on the
old advance; the ASan CI jobs also exercise the scan).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Xavier Roche <roche@httrack.com>

* gitignore: ignore dist/ release staging artifacts

httrack-gh-release stages its signed tarballs in dist/ inside the
checkout; only root-level /httrack-*.tar.gz was ignored, so a broad
git add swept the 3.49.10/3.49.11 artifacts into this branch's first
commit (since rewritten out). Ignore the directory.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Xavier Roche <roche@httrack.com>

---------

Signed-off-by: Xavier Roche <roche@httrack.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-08 21:02:27 +02:00

2 changed files with 2 additions and 2 deletions

									
										2

fuzz/fuzz-cachendx.c
									
												View File
												
				@@ -1,7 +1,7 @@

				/* ------------------------------------------------------------ */

				/*

				HTTrack Website Copier, Offline Browser for Windows and Unix

				Copyright (C) 1998 Xavier Roche and other contributors

				Copyright (C) 2026 Xavier Roche and other contributors

				SPDX-License-Identifier: GPL-3.0-or-later

									
										2

fuzz/fuzz-header.c
									
												View File
												
				@@ -1,7 +1,7 @@

				/* ------------------------------------------------------------ */

				/*

				HTTrack Website Copier, Offline Browser for Windows and Unix

				Copyright (C) 1998 Xavier Roche and other contributors

				Copyright (C) 2026 Xavier Roche and other contributors

				SPDX-License-Identifier: GPL-3.0-or-later

Compare commits

2 Commits

fix-cache- ... master

2

fuzz/fuzz-cachendx.c

View File

2

fuzz/fuzz-header.c

View File

Compare commits

2 Commits fix-cache- ... master

2 fuzz/fuzz-cachendx.c Unescape Escape View File

2 fuzz/fuzz-header.c Unescape Escape View File

2 Commits

fix-cache- ... master

2

fuzz/fuzz-cachendx.c

View File

2

fuzz/fuzz-header.c

View File