mirror of
https://github.com/xroche/httrack.git
synced 2026-07-23 17:19:17 +03:00
407916e3f6
New fuzz/ tree with a libFuzzer harness per pure (buf,size) parser that ingests network-sourced bytes: the charset/UTF-8/IDNA codecs, the HTML <meta> charset scan, HTML entity and URL percent decoders, the wildcard filter matcher, and the URL splitter. Gated behind --enable-fuzzers (requires clang, forces --disable-shared so clang's static sanitizer runtimes link); a normal build is untouched. A CI job builds the harnesses under ASan+UBSan+LeakSanitizer and replays each seed corpus. Replay, not open-ended mutation, keeps the job deterministic and avoids strjoker's catastrophic backtracking (a data-dependent exponential in the wildcard matcher, tracked separately). Maintainers run the timed mutation mode locally for discovery; OSS-Fuzz is the next step. The corpora carry the reproducers for the four parser bugs these harnesses found, so the job also pins those regressions. It depends on the fixes in the preceding commit; merge that first. Signed-off-by: Xavier Roche <roche@httrack.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
724 B
724 B
Fuzzing httrack
libFuzzer harnesses for the pure hostile-input parsers (charset/UTF-8/IDNA codecs, entity and percent decoders, wildcard filters, URL splitter). Off by default; needs clang.
./bootstrap
mkdir /var/tmp/bld-fuzz && cd /var/tmp/bld-fuzz
CC=clang CFLAGS="-fsanitize=address,undefined -fno-sanitize-recover=all -g -O1" \
LDFLAGS="-fsanitize=address,undefined" \
bash /path/to/httrack/configure --enable-fuzzers --disable-shared
make
bash /path/to/httrack/fuzz/run-fuzzers.sh fuzz 60 # 60s per target
Run one target by hand: fuzz/fuzz-url -max_total_time=300 corpusdir fuzz/corpus/url. Seed corpora live in corpus/<target>/; a crash reproducer is replayed with fuzz/fuzz-url crash-file.