Add a Minimal Fuzzing test #1580
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
This looks great. I had exactly this on my mind after releasing the fixes, but did not manage to get a time to figure out how to plug the the project into the oss-fuzz. I believe this will be useful. Thanks! |
|
I still need to figure out how to run some tests in OSS-Fuzz, but the at least the project is already accepted... Note that the script in this PR is a standalone test without the need of Google's infrastructure. |
This was referenced Jan 16, 2019
Closed
frankmorgner
force-pushed
the
fuzzing
branch
2 times, most recently
from
21dfc4a
to
067fd13
Compare
calling it with size 0 leads to a free, which eventually may lead to a double free corruption.
Statically link opensc-pkcs11 into pkcs11-tool with --disable-shared
prevents NULL pointer dereference
|
I think the findings and fixes are now stabilized and ready to be merged. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds a small script to fuzz OpenSC with arbitrary PC/SC commands. See https://www.x41-dsec.de/lab/blog/smartcards/ for a summary.
I hope to activate fuzzing for CI soon, see google/oss-fuzz#2084.