Problem: no fuzz testing for API with variable input

Solution: add tests for zmq_bind, zmq_connect and zmq_z85_decode

Makefile.am

@@ -1108,7 +1108,9 @@ endif
 
 if FUZZING_ENGINE_LIB
 fuzzer_apps = tests/test_bind_null_fuzzer \
-	tests/test_connect_null_fuzzer
+	tests/test_connect_null_fuzzer \
+	tests/test_bind_fuzzer \
+	tests/test_connect_fuzzer
 
 tests_test_bind_null_fuzzer_DEPENDENCIES = src/libzmq.la
 tests_test_bind_null_fuzzer_SOURCES = tests/test_bind_null_fuzzer.cpp
@@ -1126,9 +1128,26 @@ tests_test_connect_null_fuzzer_LDADD = ${TESTUTIL_LIBS} ${FUZZING_ENGINE_LIB} \
 tests_test_connect_null_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
 tests_test_connect_null_fuzzer_CXXFLAGS = -std=c++11
 
+tests_test_bind_fuzzer_DEPENDENCIES = src/libzmq.la
+tests_test_bind_fuzzer_SOURCES = tests/test_bind_fuzzer.cpp
+tests_test_bind_fuzzer_LDADD = ${TESTUTIL_LIBS} ${FUZZING_ENGINE_LIB} \
+		$(top_builddir)/src/.libs/libzmq.a \
+		${src_libzmq_la_LIBADD}
+tests_test_bind_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
+tests_test_bind_fuzzer_CXXFLAGS = -std=c++11
+
+tests_test_connect_fuzzer_DEPENDENCIES = src/libzmq.la
+tests_test_connect_fuzzer_SOURCES = tests/test_connect_fuzzer.cpp
+tests_test_connect_fuzzer_LDADD = ${TESTUTIL_LIBS} ${FUZZING_ENGINE_LIB} \
+		$(top_builddir)/src/.libs/libzmq.a \
+		${src_libzmq_la_LIBADD}
+tests_test_connect_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
+tests_test_connect_fuzzer_CXXFLAGS = -std=c++11
+
 if HAVE_CURVE
 fuzzer_apps += tests/test_bind_curve_fuzzer \
-	tests/test_connect_curve_fuzzer
+	tests/test_connect_curve_fuzzer \
+	tests/test_z85_decode_fuzzer
 
 tests_test_bind_curve_fuzzer_DEPENDENCIES = src/libzmq.la
 tests_test_bind_curve_fuzzer_SOURCES = tests/test_bind_curve_fuzzer.cpp
@@ -1146,11 +1165,22 @@ tests_test_connect_curve_fuzzer_LDADD = ${TESTUTIL_LIBS} ${FUZZING_ENGINE_LIB} \
 tests_test_connect_curve_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
 tests_test_connect_curve_fuzzer_CXXFLAGS = -std=c++11
 
+tests_test_z85_decode_fuzzer_DEPENDENCIES = src/libzmq.la
+tests_test_z85_decode_fuzzer_SOURCES = tests/test_z85_decode_fuzzer.cpp
+tests_test_z85_decode_fuzzer_LDADD = ${TESTUTIL_LIBS} ${FUZZING_ENGINE_LIB} \
+		$(top_builddir)/src/.libs/libzmq.a \
+		${src_libzmq_la_LIBADD}
+tests_test_z85_decode_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
+tests_test_z85_decode_fuzzer_CXXFLAGS = -std=c++11
+endif
+
 FUZZINGdir = ${prefix}/${FUZZING_INSTALLDIR}
 FUZZING_PROGRAMS = ${fuzzer_apps}
 else
 test_apps += tests/test_bind_null_fuzzer \
-	tests/test_connect_null_fuzzer
+	tests/test_connect_null_fuzzer \
+	tests/test_bind_fuzzer \
+	tests/test_connect_fuzzer
 
 tests_test_bind_null_fuzzer_SOURCES = tests/test_bind_null_fuzzer.cpp
 tests_test_bind_null_fuzzer_LDADD = ${TESTUTIL_LIBS} src/libzmq.la
@@ -1160,9 +1190,18 @@ tests_test_connect_null_fuzzer_SOURCES = tests/test_connect_null_fuzzer.cpp
 tests_test_connect_null_fuzzer_LDADD = ${TESTUTIL_LIBS} src/libzmq.la
 tests_test_connect_null_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
 
+tests_test_bind_fuzzer_SOURCES = tests/test_bind_fuzzer.cpp
+tests_test_bind_fuzzer_LDADD = ${TESTUTIL_LIBS} src/libzmq.la
+tests_test_bind_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
+
+tests_test_connect_fuzzer_SOURCES = tests/test_connect_fuzzer.cpp
+tests_test_connect_fuzzer_LDADD = ${TESTUTIL_LIBS} src/libzmq.la
+tests_test_connect_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
+
 if HAVE_CURVE
 test_apps += tests/test_bind_curve_fuzzer \
-	tests/test_connect_curve_fuzzer
+	tests/test_connect_curve_fuzzer \
+	tests/test_z85_decode_fuzzer
 
 tests_test_bind_curve_fuzzer_SOURCES = tests/test_bind_curve_fuzzer.cpp
 tests_test_bind_curve_fuzzer_LDADD = ${TESTUTIL_LIBS} src/libzmq.la
@@ -1171,6 +1210,11 @@ tests_test_bind_curve_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
 tests_test_connect_curve_fuzzer_SOURCES = tests/test_connect_curve_fuzzer.cpp
 tests_test_connect_curve_fuzzer_LDADD = ${TESTUTIL_LIBS} src/libzmq.la
 tests_test_connect_curve_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
+
+tests_test_z85_decode_fuzzer_SOURCES = tests/test_z85_decode_fuzzer.cpp
+tests_test_z85_decode_fuzzer_LDADD = ${TESTUTIL_LIBS} src/libzmq.la
+tests_test_z85_decode_fuzzer_CPPFLAGS = ${TESTUTIL_CPPFLAGS}
+endif
 endif
 
 if ENABLE_STATIC

tests/CMakeLists.txt

@@ -75,13 +75,13 @@ set(tests
     test_mock_pub_sub)
 
 if(NOT WIN32)
-  list(APPEND tests test_security_gssapi test_socks test_connect_null_fuzzer test_bind_null_fuzzer)
+  list(APPEND tests test_security_gssapi test_socks test_connect_null_fuzzer test_bind_null_fuzzer test_connect_fuzzer test_bind_fuzzer)
 endif()
 
 if(ZMQ_HAVE_CURVE)
   list(APPEND tests test_security_curve)
   if(NOT WIN32)
-    list(APPEND tests test_connect_curve_fuzzer test_bind_curve_fuzzer)
+    list(APPEND tests test_connect_curve_fuzzer test_bind_curve_fuzzer test_z85_decode_fuzzer)
   endif()
 endif()
 

tests/test_bind_fuzzer.cpp

+/*
+    Copyright (c) 2020 Contributors as noted in the AUTHORS file
+
+    This file is part of libzmq, the ZeroMQ core engine in C++.
+
+    libzmq is free software; you can redistribute it and/or modify it under
+    the terms of the GNU Lesser General Public License (LGPL) as published
+    by the Free Software Foundation; either version 3 of the License, or
+    (at your option) any later version.
+
+    As a special exception, the Contributors give you permission to link
+    this library with independent modules to produce an executable,
+    regardless of the license terms of these independent modules, and to
+    copy and distribute the resulting executable under terms of your choice,
+    provided that you also meet, for each linked independent module, the
+    terms and conditions of the license of that module. An independent
+    module is a module which is not derived from or based on this library.
+    If you modify this library, you must extend this exception to your
+    version of the library.
+
+    libzmq is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+    FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public
+    License for more details.
+
+    You should have received a copy of the GNU Lesser General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifdef ZMQ_USE_FUZZING_ENGINE
+#include <fuzzer/FuzzedDataProvider.h>
+#endif
+
+#include <string>
+
+#include "testutil.hpp"
+#include "testutil_unity.hpp"
+
+// Test that zmq_bind can handle malformed strings
+extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
+{
+    setup_test_context ();
+    std::string my_endpoint (reinterpret_cast<const char *> (data), size);
+    void *socket = test_context_socket (ZMQ_PUB);
+    zmq_bind (socket, my_endpoint.c_str ());
+
+    test_context_socket_close_zero_linger (socket);
+    teardown_test_context ();
+
+    return 0;
+}
+
+#ifndef ZMQ_USE_FUZZING_ENGINE
+void test_bind_fuzzer ()
+{
+    uint8_t buffer[32] = {0};
+
+    TEST_ASSERT_SUCCESS_ERRNO (
+      LLVMFuzzerTestOneInput (buffer, sizeof (buffer)));
+}
+
+int main (int argc, char **argv)
+{
+    setup_test_environment ();
+
+    UNITY_BEGIN ();
+    RUN_TEST (test_bind_fuzzer);
+
+    return UNITY_END ();
+}
+#endif

tests/test_connect_fuzzer.cpp

+/*
+    Copyright (c) 2020 Contributors as noted in the AUTHORS file
+
+    This file is part of libzmq, the ZeroMQ core engine in C++.
+
+    libzmq is free software; you can redistribute it and/or modify it under
+    the terms of the GNU Lesser General Public License (LGPL) as published
+    by the Free Software Foundation; either version 3 of the License, or
+    (at your option) any later version.
+
+    As a special exception, the Contributors give you permission to link
+    this library with independent modules to produce an executable,
+    regardless of the license terms of these independent modules, and to
+    copy and distribute the resulting executable under terms of your choice,
+    provided that you also meet, for each linked independent module, the
+    terms and conditions of the license of that module. An independent
+    module is a module which is not derived from or based on this library.
+    If you modify this library, you must extend this exception to your
+    version of the library.
+
+    libzmq is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+    FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public
+    License for more details.
+
+    You should have received a copy of the GNU Lesser General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifdef ZMQ_USE_FUZZING_ENGINE
+#include <fuzzer/FuzzedDataProvider.h>
+#endif
+
+#include <string>
+
+#include "testutil.hpp"
+#include "testutil_unity.hpp"
+
+// Test that zmq_connect can handle malformed strings
+extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
+{
+    setup_test_context ();
+    std::string my_endpoint (reinterpret_cast<const char *> (data), size);
+    void *socket = test_context_socket (ZMQ_PUB);
+    zmq_connect (socket, my_endpoint.c_str ());
+
+    test_context_socket_close_zero_linger (socket);
+    teardown_test_context ();
+
+    return 0;
+}
+
+#ifndef ZMQ_USE_FUZZING_ENGINE
+void test_connect_fuzzer ()
+{
+    uint8_t buffer[32] = {0};
+
+    TEST_ASSERT_SUCCESS_ERRNO (
+      LLVMFuzzerTestOneInput (buffer, sizeof (buffer)));
+}
+
+int main (int argc, char **argv)
+{
+    setup_test_environment ();
+
+    UNITY_BEGIN ();
+    RUN_TEST (test_connect_fuzzer);
+
+    return UNITY_END ();
+}
+#endif

tests/test_z85_decode_fuzzer.cpp

+/*
+    Copyright (c) 2020 Contributors as noted in the AUTHORS file
+
+    This file is part of libzmq, the ZeroMQ core engine in C++.
+
+    libzmq is free software; you can redistribute it and/or modify it under
+    the terms of the GNU Lesser General Public License (LGPL) as published
+    by the Free Software Foundation; either version 3 of the License, or
+    (at your option) any later version.
+
+    As a special exception, the Contributors give you permission to link
+    this library with independent modules to produce an executable,
+    regardless of the license terms of these independent modules, and to
+    copy and distribute the resulting executable under terms of your choice,
+    provided that you also meet, for each linked independent module, the
+    terms and conditions of the license of that module. An independent
+    module is a module which is not derived from or based on this library.
+    If you modify this library, you must extend this exception to your
+    version of the library.
+
+    libzmq is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+    FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public
+    License for more details.
+
+    You should have received a copy of the GNU Lesser General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifdef ZMQ_USE_FUZZING_ENGINE
+#include <fuzzer/FuzzedDataProvider.h>
+#endif
+
+#include <string>
+#include <stdlib.h>
+
+#include "testutil.hpp"
+#include "testutil_unity.hpp"
+
+extern "C" int LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
+{
+    uint8_t *secret_key;
+
+    // As per API definition, input must be divisible by 5, so truncate it if it's not
+    size -= size % 5;
+    // As per API definition, the destination must be at least 0.8 times the input data
+    TEST_ASSERT_NOT_NULL (secret_key = (uint8_t *) malloc (size * 4 / 5));
+
+    std::string z85_secret_key (reinterpret_cast<const char *> (data), size);
+    TEST_ASSERT_NOT_NULL (zmq_z85_decode (secret_key, z85_secret_key.c_str ()));
+
+    free (secret_key);
+
+    return 0;
+}
+
+#ifndef ZMQ_USE_FUZZING_ENGINE
+void test_bind_null_fuzzer ()
+{
+    uint8_t buffer[32] = {0};
+
+    TEST_ASSERT_SUCCESS_ERRNO (
+      LLVMFuzzerTestOneInput (buffer, sizeof (buffer)));
+}
+
+int main (int argc, char **argv)
+{
+    setup_test_environment ();
+
+    UNITY_BEGIN ();
+    RUN_TEST (test_bind_null_fuzzer);
+
+    return UNITY_END ();
+}
+#endif