Initial implementation of Mayhem and fuzzing

mayhemheroes · Oct 9, 2024 · 16d3b32 · 16d3b32
1 parent d013ece
commit 16d3b32
Show file tree

Hide file tree

Showing 231 changed files with 409 additions and 0 deletions.
diff --git a/.github/workflows/mayhem.yaml b/.github/workflows/mayhem.yaml
@@ -0,0 +1,61 @@
+name: Mayhem
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+  MAYHEMFILE: Mayhemfile
+  PROJECTNAME: kdl-rs
+
+jobs:
+  build:
+    name: '${{ matrix.os }} shared=${{ matrix.shared }} ${{ matrix.build_type }}'
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest]
+        shared: [false]
+        build_type: [Release]
+        include:
+          - os: ubuntu-latest
+            triplet: x64-linux
+
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          file: Dockerfile.mayhem
+
+      - name: Start analysis of kdl-rs parse
+        uses: ForAllSecure/mcode-action@v1
+        with:
+          mayhem-token: ${{ secrets.MAYHEM_TOKEN }}
+          args: --image ${{ steps.meta.outputs.tags }} --project ${{ env.PROJECTNAME }} --file ${{ env.MAYHEMFILE }}
+          sarif-output: sarif
+
+      - name: Upload SARIF file(s)
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          sarif_file: sarif
diff --git a/Dockerfile.mayhem b/Dockerfile.mayhem
@@ -0,0 +1,21 @@
+# Use the example in Mayhem Docs as an example/starting point
+FROM rust:1.60-buster as rust-builder
+RUN cargo install afl
+
+# Add the source code to the image and build the target
+ADD . /kdl-rs
+WORKDIR /kdl-rs/fuzz
+RUN cargo afl build
+# Built target is: /kdl-rs/fuzz/target/debug/fuzz
+
+# To simplify matters, we'll copy the compiled target as well as
+# the fuzz input folder to a new image with AFL. This helps save some space.
+FROM --platform=linux/amd64 rust:1.60-buster
+RUN cargo install afl
+
+# Copy the compiled target and the input cases
+COPY --from=rust-builder /kdl-rs/fuzz/target/debug/fuzz /kdl-rs/fuzz/in /
+
+# Set to fuzz!
+ENTRYPOINT ["cargo", "afl", "fuzz", "-i", "/in", "-o", "/out"]
+CMD ["/fuzz"]
diff --git a/Mayhemfile b/Mayhemfile
@@ -0,0 +1,9 @@
+project: kdl-rs
+target: kdl-rs-parse
+duration: 300
+
+cmds:
+  - cmd: /fuzz
+    env:
+      DISABLE_SMOKETEST: '1'
+    afl: true
diff --git a/fuzz/.gitignore b/fuzz/.gitignore
@@ -0,0 +1,2 @@
+target
+out
diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml
@@ -0,0 +1,10 @@
+[package]
+name = "fuzz"
+version = "0.1.0"
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+afl = "*"
+kdl = { path = ".." }
diff --git a/fuzz/in/all_escapes.kdl b/fuzz/in/all_escapes.kdl
@@ -0,0 +1 @@
+node "\"\\\/\b\f\n\r\t"
diff --git a/fuzz/in/all_node_fields.kdl b/fuzz/in/all_node_fields.kdl
@@ -0,0 +1,3 @@
+node "arg" prop="val" {
+    inner_node
+}
diff --git a/fuzz/in/arg_and_prop_same_name.kdl b/fuzz/in/arg_and_prop_same_name.kdl
@@ -0,0 +1 @@
+node "arg" arg="val"
diff --git a/fuzz/in/arg_false_type.kdl b/fuzz/in/arg_false_type.kdl
@@ -0,0 +1 @@
+node (type)false
diff --git a/fuzz/in/arg_float_type.kdl b/fuzz/in/arg_float_type.kdl
@@ -0,0 +1 @@
+node (type)2.5
diff --git a/fuzz/in/arg_hex_type.kdl b/fuzz/in/arg_hex_type.kdl
@@ -0,0 +1 @@
+node (type)0x10
diff --git a/fuzz/in/arg_null_type.kdl b/fuzz/in/arg_null_type.kdl
@@ -0,0 +1 @@
+node (type)null
diff --git a/fuzz/in/arg_raw_string_type.kdl b/fuzz/in/arg_raw_string_type.kdl
@@ -0,0 +1 @@
+node (type)"str"
diff --git a/fuzz/in/arg_string_type.kdl b/fuzz/in/arg_string_type.kdl
@@ -0,0 +1 @@
+node (type)"str"
diff --git a/fuzz/in/arg_true_type.kdl b/fuzz/in/arg_true_type.kdl
@@ -0,0 +1 @@
+node (type)true
diff --git a/fuzz/in/arg_type.kdl b/fuzz/in/arg_type.kdl
@@ -0,0 +1 @@
+node (type)"arg"
diff --git a/fuzz/in/arg_zero_type.kdl b/fuzz/in/arg_zero_type.kdl
@@ -0,0 +1 @@
+node (type)0
diff --git a/fuzz/in/asterisk_in_block_comment.kdl b/fuzz/in/asterisk_in_block_comment.kdl
@@ -0,0 +1 @@
+node /* * */
diff --git a/fuzz/in/backslash_in_bare_id.kdl b/fuzz/in/backslash_in_bare_id.kdl
@@ -0,0 +1 @@
+foo123\bar "weeee"
diff --git a/fuzz/in/bare_arg.kdl b/fuzz/in/bare_arg.kdl
@@ -0,0 +1 @@
+node a
diff --git a/fuzz/in/bare_emoji.kdl b/fuzz/in/bare_emoji.kdl
@@ -0,0 +1 @@
+😁 "happy!"
diff --git a/fuzz/in/binary.kdl b/fuzz/in/binary.kdl
@@ -0,0 +1 @@
+node 0b10
diff --git a/fuzz/in/binary_trailing_underscore.kdl b/fuzz/in/binary_trailing_underscore.kdl
@@ -0,0 +1 @@
+node 0b10_
diff --git a/fuzz/in/binary_underscore.kdl b/fuzz/in/binary_underscore.kdl
@@ -0,0 +1 @@
+node 0b1_0
diff --git a/fuzz/in/blank_arg_type.kdl b/fuzz/in/blank_arg_type.kdl
@@ -0,0 +1 @@
+node ("")10
diff --git a/fuzz/in/blank_node_type.kdl b/fuzz/in/blank_node_type.kdl
@@ -0,0 +1 @@
+("")node
diff --git a/fuzz/in/blank_prop_type.kdl b/fuzz/in/blank_prop_type.kdl
@@ -0,0 +1 @@
+node key=("")true
diff --git a/fuzz/in/block_comment.kdl b/fuzz/in/block_comment.kdl
@@ -0,0 +1 @@
+node /* comment */ "arg"
diff --git a/fuzz/in/block_comment_after_node.kdl b/fuzz/in/block_comment_after_node.kdl
@@ -0,0 +1 @@
+node /* hey */ "arg"
diff --git a/fuzz/in/block_comment_before_node.kdl b/fuzz/in/block_comment_before_node.kdl
@@ -0,0 +1 @@
+/* hey */ node
diff --git a/fuzz/in/block_comment_before_node_no_space.kdl b/fuzz/in/block_comment_before_node_no_space.kdl
@@ -0,0 +1 @@
+/* hey*/node
diff --git a/fuzz/in/block_comment_newline.kdl b/fuzz/in/block_comment_newline.kdl
@@ -0,0 +1 @@
+/* hey */
diff --git a/fuzz/in/boolean_arg.kdl b/fuzz/in/boolean_arg.kdl
@@ -0,0 +1 @@
+node false true
diff --git a/fuzz/in/boolean_prop.kdl b/fuzz/in/boolean_prop.kdl
@@ -0,0 +1 @@
+node prop1=true prop2=false
diff --git a/fuzz/in/brackets_in_bare_id.kdl b/fuzz/in/brackets_in_bare_id.kdl
@@ -0,0 +1 @@
+foo123{bar}foo "weeee"
diff --git a/fuzz/in/chevrons_in_bare_id.kdl b/fuzz/in/chevrons_in_bare_id.kdl
@@ -0,0 +1 @@
+foo123<bar>foo "weeee"
diff --git a/fuzz/in/comma_in_bare_id.kdl b/fuzz/in/comma_in_bare_id.kdl
@@ -0,0 +1 @@
+foo123,bar "weeee"
diff --git a/fuzz/in/comment_after_arg_type.kdl b/fuzz/in/comment_after_arg_type.kdl
@@ -0,0 +1 @@
+node (type)/*huh*/10
diff --git a/fuzz/in/comment_after_node_type.kdl b/fuzz/in/comment_after_node_type.kdl
@@ -0,0 +1 @@
+(type)/*huh*/node
diff --git a/fuzz/in/comment_after_prop_type.kdl b/fuzz/in/comment_after_prop_type.kdl
@@ -0,0 +1 @@
+node key=(type)/*huh*/10
diff --git a/fuzz/in/comment_in_arg_type.kdl b/fuzz/in/comment_in_arg_type.kdl
@@ -0,0 +1 @@
+node (type/*huh*/)10
diff --git a/fuzz/in/comment_in_node_type.kdl b/fuzz/in/comment_in_node_type.kdl
@@ -0,0 +1 @@
+(type/*huh*/)node
diff --git a/fuzz/in/comment_in_prop_type.kdl b/fuzz/in/comment_in_prop_type.kdl
@@ -0,0 +1 @@
+node key=(type/*huh*/)10
diff --git a/fuzz/in/commented_arg.kdl b/fuzz/in/commented_arg.kdl
@@ -0,0 +1 @@
+node /- "arg1" "arg2"
diff --git a/fuzz/in/commented_child.kdl b/fuzz/in/commented_child.kdl
@@ -0,0 +1,3 @@
+node "arg" /- {
+     inner_node
+}
diff --git a/fuzz/in/commented_line.kdl b/fuzz/in/commented_line.kdl
@@ -0,0 +1,2 @@
+// node_1
+node_2
diff --git a/fuzz/in/commented_node.kdl b/fuzz/in/commented_node.kdl
@@ -0,0 +1,2 @@
+/- node_1
+node_2
diff --git a/fuzz/in/commented_prop.kdl b/fuzz/in/commented_prop.kdl
@@ -0,0 +1 @@
+node /- prop="val" "arg"
diff --git a/fuzz/in/crlf_between_nodes.kdl b/fuzz/in/crlf_between_nodes.kdl
@@ -0,0 +1,2 @@
+node1
+node2
diff --git a/fuzz/in/dash_dash.kdl b/fuzz/in/dash_dash.kdl
@@ -0,0 +1 @@
+node --
diff --git a/fuzz/in/dot_but_no_fraction.kdl b/fuzz/in/dot_but_no_fraction.kdl
@@ -0,0 +1 @@
+node 1.
diff --git a/fuzz/in/dot_but_no_fraction_before_exponent.kdl b/fuzz/in/dot_but_no_fraction_before_exponent.kdl
@@ -0,0 +1 @@
+node 1.e7
diff --git a/fuzz/in/dot_in_exponent.kdl b/fuzz/in/dot_in_exponent.kdl
@@ -0,0 +1 @@
+node 1.0.0
diff --git a/fuzz/in/dot_zero.kdl b/fuzz/in/dot_zero.kdl
@@ -0,0 +1 @@
+node .0
diff --git a/fuzz/in/emoji.kdl b/fuzz/in/emoji.kdl
@@ -0,0 +1 @@
+node "😀"
diff --git a/fuzz/in/empty.kdl b/fuzz/in/empty.kdl
diff --git a/fuzz/in/empty_arg_type.kdl b/fuzz/in/empty_arg_type.kdl
@@ -0,0 +1 @@
+node ()10
diff --git a/fuzz/in/empty_child.kdl b/fuzz/in/empty_child.kdl
@@ -0,0 +1,2 @@
+node {
+}
diff --git a/fuzz/in/empty_child_different_lines.kdl b/fuzz/in/empty_child_different_lines.kdl
@@ -0,0 +1,2 @@
+node {
+}
diff --git a/fuzz/in/empty_child_same_line.kdl b/fuzz/in/empty_child_same_line.kdl
@@ -0,0 +1 @@
+node {}
diff --git a/fuzz/in/empty_child_whitespace.kdl b/fuzz/in/empty_child_whitespace.kdl
@@ -0,0 +1,3 @@
+node {
+
+     }
diff --git a/fuzz/in/empty_node_type.kdl b/fuzz/in/empty_node_type.kdl
@@ -0,0 +1 @@
+()node
diff --git a/fuzz/in/empty_prop_type.kdl b/fuzz/in/empty_prop_type.kdl
@@ -0,0 +1 @@
+node key=()false
diff --git a/fuzz/in/empty_quoted_node_id.kdl b/fuzz/in/empty_quoted_node_id.kdl
@@ -0,0 +1 @@
+"" "arg"
diff --git a/fuzz/in/empty_quoted_prop_key.kdl b/fuzz/in/empty_quoted_prop_key.kdl
@@ -0,0 +1 @@
+node ""="empty"
diff --git a/fuzz/in/empty_string_arg.kdl b/fuzz/in/empty_string_arg.kdl
@@ -0,0 +1 @@
+node ""
diff --git a/fuzz/in/esc_newline_in_string.kdl b/fuzz/in/esc_newline_in_string.kdl
@@ -0,0 +1 @@
+node "hello\nworld"
diff --git a/fuzz/in/esc_unicode_in_string.kdl b/fuzz/in/esc_unicode_in_string.kdl
@@ -0,0 +1 @@
+node "hello\u{0a}world"
diff --git a/fuzz/in/escline.kdl b/fuzz/in/escline.kdl
@@ -0,0 +1,2 @@
+node \
+    "arg"
diff --git a/fuzz/in/escline_comment_node.kdl b/fuzz/in/escline_comment_node.kdl
@@ -0,0 +1,3 @@
+node1
+  \// hey
+   node2
diff --git a/fuzz/in/escline_line_comment.kdl b/fuzz/in/escline_line_comment.kdl
@@ -0,0 +1,4 @@
+node \   // comment
+    "arg" \// comment
+    "arg2
+"
diff --git a/fuzz/in/escline_node.kdl b/fuzz/in/escline_node.kdl
@@ -0,0 +1,2 @@
+node1
+node2
diff --git a/fuzz/in/false_prefix_in_bare_id.kdl b/fuzz/in/false_prefix_in_bare_id.kdl
@@ -0,0 +1 @@
+false_id
diff --git a/fuzz/in/false_prefix_in_prop_key.kdl b/fuzz/in/false_prefix_in_prop_key.kdl
@@ -0,0 +1 @@
+node false_id=1
diff --git a/fuzz/in/false_prop_key.kdl b/fuzz/in/false_prop_key.kdl
@@ -0,0 +1 @@
+node false=1
diff --git a/fuzz/in/hex.kdl b/fuzz/in/hex.kdl
@@ -0,0 +1 @@
+node 0x1234567890abcdef
diff --git a/fuzz/in/hex_int.kdl b/fuzz/in/hex_int.kdl
@@ -0,0 +1 @@
+node 0x1234567890ABCDEF
diff --git a/fuzz/in/hex_int_underscores.kdl b/fuzz/in/hex_int_underscores.kdl
@@ -0,0 +1 @@
+node 0xABC_def_0123
diff --git a/fuzz/in/hex_leading_zero.kdl b/fuzz/in/hex_leading_zero.kdl
@@ -0,0 +1 @@
+node 0x01
diff --git a/fuzz/in/illegal_char_in_binary.kdl b/fuzz/in/illegal_char_in_binary.kdl
@@ -0,0 +1 @@
+node 0bx01
diff --git a/fuzz/in/illegal_char_in_hex.kdl b/fuzz/in/illegal_char_in_hex.kdl
@@ -0,0 +1 @@
+node 0x10g10
diff --git a/fuzz/in/illegal_char_in_octal.kdl b/fuzz/in/illegal_char_in_octal.kdl
@@ -0,0 +1 @@
+node 0o45678
diff --git a/fuzz/in/int_multiple_underscore.kdl b/fuzz/in/int_multiple_underscore.kdl
@@ -0,0 +1 @@
+node 1_2_3_4
diff --git a/fuzz/in/just_block_comment.kdl b/fuzz/in/just_block_comment.kdl
@@ -0,0 +1 @@
+/* hey */
diff --git a/fuzz/in/just_child.kdl b/fuzz/in/just_child.kdl
@@ -0,0 +1,3 @@
+node {
+    inner_node
+}
diff --git a/fuzz/in/just_newline.kdl b/fuzz/in/just_newline.kdl
@@ -0,0 +1 @@
+
diff --git a/fuzz/in/just_node_id.kdl b/fuzz/in/just_node_id.kdl
@@ -0,0 +1 @@
+node
diff --git a/fuzz/in/just_space.kdl b/fuzz/in/just_space.kdl
@@ -0,0 +1 @@
+
diff --git a/fuzz/in/just_space_in_arg_type.kdl b/fuzz/in/just_space_in_arg_type.kdl
@@ -0,0 +1 @@
+node ( )false
diff --git a/fuzz/in/just_space_in_node_type.kdl b/fuzz/in/just_space_in_node_type.kdl
@@ -0,0 +1 @@
+( )node
diff --git a/fuzz/in/just_space_in_prop_type.kdl b/fuzz/in/just_space_in_prop_type.kdl
@@ -0,0 +1 @@
+node key=()0x10
diff --git a/fuzz/in/just_type_no_arg.kdl b/fuzz/in/just_type_no_arg.kdl
@@ -0,0 +1 @@
+node (type)
diff --git a/fuzz/in/just_type_no_node_id.kdl b/fuzz/in/just_type_no_node_id.kdl
@@ -0,0 +1 @@
+(type)
diff --git a/fuzz/in/just_type_no_prop.kdl b/fuzz/in/just_type_no_prop.kdl
@@ -0,0 +1 @@
+node key=(type)
diff --git a/fuzz/in/leading_newline.kdl b/fuzz/in/leading_newline.kdl
@@ -0,0 +1,2 @@
+
+node
diff --git a/fuzz/in/leading_zero_binary.kdl b/fuzz/in/leading_zero_binary.kdl
@@ -0,0 +1 @@
+node 0b01
diff --git a/fuzz/in/leading_zero_int.kdl b/fuzz/in/leading_zero_int.kdl
@@ -0,0 +1 @@
+node 011
diff --git a/fuzz/in/leading_zero_oct.kdl b/fuzz/in/leading_zero_oct.kdl
@@ -0,0 +1 @@
+node 0o01
diff --git a/fuzz/in/multiline_comment.kdl b/fuzz/in/multiline_comment.kdl
@@ -0,0 +1,4 @@
+node /*
+some
+comments
+*/ "arg"
diff --git a/fuzz/in/multiline_nodes.kdl b/fuzz/in/multiline_nodes.kdl
@@ -0,0 +1,3 @@
+node \
+    "arg1" \// comment
+    "arg2"
diff --git a/fuzz/in/multiline_string.kdl b/fuzz/in/multiline_string.kdl
@@ -0,0 +1,4 @@
+node " hey
+everyone
+how goes?
+"
diff --git a/fuzz/in/multiple_dots_in_float.kdl b/fuzz/in/multiple_dots_in_float.kdl
@@ -0,0 +1 @@
+node 1.0.0
diff --git a/fuzz/in/multiple_dots_in_float_before_exponent.kdl b/fuzz/in/multiple_dots_in_float_before_exponent.kdl
@@ -0,0 +1 @@
+node 1.0.0e7
diff --git a/fuzz/in/multiple_es_in_float.kdl b/fuzz/in/multiple_es_in_float.kdl
@@ -0,0 +1 @@
+node 1.0E10e10
diff --git a/fuzz/in/multiple_x_in_hex.kdl b/fuzz/in/multiple_x_in_hex.kdl
@@ -0,0 +1 @@
+node 0xx10
diff --git a/fuzz/in/negative_exponent.kdl b/fuzz/in/negative_exponent.kdl
@@ -0,0 +1 @@
+node 1.0e-10
diff --git a/fuzz/in/negative_float.kdl b/fuzz/in/negative_float.kdl
@@ -0,0 +1 @@
+node -1.0 key=-10.0
diff --git a/fuzz/in/negative_int.kdl b/fuzz/in/negative_int.kdl
@@ -0,0 +1 @@
+node -10 prop=-15
diff --git a/fuzz/in/nested_block_comment.kdl b/fuzz/in/nested_block_comment.kdl
@@ -0,0 +1 @@
+node /* hi /* there */ everyone */ "arg"
diff --git a/fuzz/in/nested_children.kdl b/fuzz/in/nested_children.kdl
@@ -0,0 +1,5 @@
+node1 {
+    node2 {
+        node
+    }
+}
diff --git a/fuzz/in/nested_comments.kdl b/fuzz/in/nested_comments.kdl
@@ -0,0 +1 @@
+node /*/* nested */*/ "arg"
diff --git a/fuzz/in/nested_multiline_block_comment.kdl b/fuzz/in/nested_multiline_block_comment.kdl
@@ -0,0 +1,6 @@
+node /*
+hey /*
+how's
+*/
+    it going
+    */ "arg"
-Original file line number
+Diff line change
@@ -0,0 +1,3 @@
+    node1
+      \// hey
+       node2