diff --git a/Makefile b/Makefile index 7bbbca4..a5e88ab 100644 --- a/Makefile +++ b/Makefile @@ -1,4 +1,4 @@ -all : fuzzer-html fuzzer-email fuzzer-httpclient fuzzer-json fuzzer-difflib fuzzer-csv fuzzer-decode fuzzer-ast fuzzer-tarfile fuzzer-tarfile-hypothesis fuzzer-zipfile fuzzer-zipfile-hypothesis fuzzer-re fuzzer-configparser fuzzer-tomllib fuzzer-plistlib fuzzer-xml fuzzer-zoneinfo fuzzer-binascii +all : fuzzer-html fuzzer-email fuzzer-httpclient fuzzer-json fuzzer-difflib fuzzer-csv fuzzer-decode fuzzer-ast fuzzer-tarfile fuzzer-tarfile-hypothesis fuzzer-zipfile fuzzer-zipfile-hypothesis fuzzer-re fuzzer-configparser fuzzer-tomllib fuzzer-plistlib fuzzer-xml fuzzer-zoneinfo fuzzer-binascii fuzzer-json-decode PYTHON_CONFIG_PATH=$(CPYTHON_INSTALL_PATH)/bin/python3-config CXXFLAGS += $(shell $(PYTHON_CONFIG_PATH) --cflags) @@ -43,3 +43,6 @@ fuzzer-zoneinfo: fuzzer-binascii: clang++ $(CXXFLAGS) $(LIB_FUZZING_ENGINE) -std=c++17 fuzzer.cpp -DPYTHON_HARNESS_PATH="\"binascii.py\"" -ldl $(LDFLAGS) -o fuzzer-binascii + +fuzzer-json-decode: + clang++ $(CXXFLAGS) $(LIB_FUZZING_ENGINE) -std=c++17 fuzzer.cpp -DPYTHON_HARNESS_PATH="\"json_decode.py\"" -ldl $(LDFLAGS) -o fuzzer-json-decode diff --git a/fuzz_targets.txt b/fuzz_targets.txt index b016889..c7a836b 100644 --- a/fuzz_targets.txt +++ b/fuzz_targets.txt @@ -8,6 +8,7 @@ email email.py html html.py httpclient httpclient.py json json.py +json-decode json_decode.py plistlib plist.py re re.py tarfile tarfile.py diff --git a/json_decode.py b/json_decode.py new file mode 100644 index 0000000..62aa855 --- /dev/null +++ b/json_decode.py @@ -0,0 +1,35 @@ +from fuzzeddataprovider import FuzzedDataProvider +import json + +LOADS = 0 +DECODER_DECODE = 1 +DECODER_RAW_DECODE = 2 + + +# Fuzzes the _json C module's decoding paths (Modules/_json.c). +# Exercises json.loads(), JSONDecoder.decode(), and +# JSONDecoder.raw_decode() with fuzzed byte input decoded as latin-1. +def FuzzerRunOne(FuzzerInput): + if len(FuzzerInput) < 1 or len(FuzzerInput) > 0x100000: + return + fdp = FuzzedDataProvider(FuzzerInput) + target = fdp.ConsumeIntInRange(DECODER_DECODE, DECODER_RAW_DECODE) + n = ( + fdp.ConsumeIntInRange(1, min(fdp.remaining_bytes(), 10000)) + if fdp.remaining_bytes() > 0 + else 0 + ) + if n == 0: + return + s = fdp.ConsumeBytes(n).decode("latin-1") + try: + if target == DECODER_DECODE: + dec = json.JSONDecoder() + dec.decode(s) + elif target == DECODER_RAW_DECODE: + dec = json.JSONDecoder() + dec.raw_decode(s) + except (json.JSONDecodeError, ValueError, RecursionError): + pass + except Exception: + pass