ruzzy 0.6.0 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0abba0ffb63d4c50fbbb33fb3624299f8421293a02d65e199525c75b4dbd5f46
-  data.tar.gz: 4787489da1373bb820cd66d62a913a4c9c33c49bda68f251dae25745ccac3679
+  metadata.gz: 64fa385ff3dca5a231ebc02511f7240143838b4cf4314a8ced35a57127ac2dc2
+  data.tar.gz: 1cd94db1a0b30debdc03caddf39394b3759b11f85d0b2ef78037e5769b0761ed
 SHA512:
-  metadata.gz: c029eca231fbeb0d8b19b469a6cb2de99117a939e35c9f42622f803d06a0b4ad85ceacc25dff1bba9e56b1179358ec8fff054a35d894faa11398727891697216
-  data.tar.gz: cb761ff27a1fa8d462295d9022d03490338d2608d94cddc8454fb2919fd308e8ee7ea18b4735e601574ca1366de266607c2966be18e27af21ab1c3e243f60237
+  metadata.gz: ed77800fbbe359a7b2be3e215b00d052b2bf8f1038da0e2ad88c6a8ea9d66bcf2d875ed5658592262ef35a18a23c4b1f5fcc9d44e7f669fc81817310dda96122
+  data.tar.gz: 80ef311558dd4c4aa88697014e08a6b06a164d182a16d5c4718ce9355bc6b2f82c52bce11d3eaa1d1071df2a900eef9ef46148013ad7099ed1fbf07df173b6c3

data/ext/cruzzy/cruzzy.c

@@ -194,11 +194,11 @@ static void event_hook_branch(VALUE counter_hash, rb_trace_arg_t *tracearg) {
 
 static void enable_branch_coverage_hooks()
 {
-    // Call Coverage.setup(branches: true) to activate branch coverage hooks.
+    // Call Coverage.start(branches: true) to activate branch coverage hooks.
     // Branch coverage hooks will not be activated without this call despite
     // adding the event hooks. I suspect rb_set_coverages must be called
     // first, which initializes some global state that we do not have direct
-    // access to. Calling setup initializes coverage state here:
+    // access to. Calling start initializes coverage state here:
     // https://github.com/ruby/ruby/blob/v3_3_0/ext/coverage/coverage.c#L112-L120
     // If rb_set_coverages is not called, then rb_get_coverages returns a NULL
     // pointer, which appears to effectively disable coverage collection here:
@@ -207,10 +207,10 @@ static void enable_branch_coverage_hooks()
     VALUE coverage_mod = rb_const_get(rb_cObject, rb_intern("Coverage"));
     VALUE hash_arg = rb_hash_new();
     rb_hash_aset(hash_arg, ID2SYM(rb_intern("branches")), Qtrue);
-    rb_funcall(coverage_mod, rb_intern("setup"), 1, hash_arg);
+    rb_funcall(coverage_mod, rb_intern("start"), 1, hash_arg);
 }
 
-static VALUE c_trace_branch(VALUE self)
+static VALUE c_trace(VALUE self, VALUE harness_path)
 {
     VALUE counter_hash = rb_hash_new();
 
@@ -230,7 +230,7 @@ static VALUE c_trace_branch(VALUE self)
 
     enable_branch_coverage_hooks();
 
-    return Qnil;
+    return rb_require(StringValueCStr(harness_path));
 }
 
 void Init_cruzzy()
@@ -245,5 +245,5 @@ void Init_cruzzy()
     rb_define_module_function(ruzzy, "c_libfuzzer_is_loaded", &c_libfuzzer_is_loaded, 0);
     rb_define_module_function(ruzzy, "c_trace_cmp8", &c_trace_cmp8, 2);
     rb_define_module_function(ruzzy, "c_trace_div8", &c_trace_div8, 1);
-    rb_define_module_function(ruzzy, "c_trace_branch", &c_trace_branch, 0);
+    rb_define_module_function(ruzzy, "c_trace", &c_trace, 1);
 }

data/ext/cruzzy/extconf.rb

@@ -64,6 +64,7 @@ def merge_sanitizer_libfuzzer_lib(sanitizer_lib, fuzzer_no_main_lib, merged_outp
       '-Wl,--no-whole-archive',
       '-lpthread',
       '-ldl',
+      '-lstdc++',
       '-shared',
       '-o',
       merged_output
@@ -137,4 +138,6 @@ merge_sanitizer_libfuzzer_lib(
 # For more information, see https://github.com/ruby/ruby/blob/master/lib/mkmf.rb.
 $LOCAL_LIBS = fuzzer_no_main_lib
 
+$LIBS << ' -lstdc++'
+
 create_makefile('cruzzy/cruzzy')

data/ext/dummy/dummy.c

@@ -6,17 +6,18 @@
 // https://llvm.org/docs/LibFuzzer.html#toy-example
 static int _c_dummy_test_one_input(const uint8_t *data, size_t size)
 {
-    char test[] = {'a', 'b', 'c'};
+    volatile char boom = 'x';
 
-    if (size > 0 && data[0] == 'H') {
-        if (size > 1 && data[1] == 'I') {
-            // This code exists specifically to test the driver and ensure
-            // libFuzzer is functioning as expected, so we can safely ignore
-            // the warning.
-            #pragma clang diagnostic push
-            #pragma clang diagnostic ignored "-Warray-bounds"
-            test[1024] = 'd';
-            #pragma clang diagnostic pop
+    if (size == 2) {
+        if (data[0] == 'H') {
+            if (data[1] == 'I') {
+                // Intentional heap-use-after-free for testing purposes
+                char * volatile ptr = malloc(128);
+                ptr[0] = 'x';
+                free(ptr);
+                boom = ptr[0];
+                (void) boom;
+            }
         }
     }
 

data/lib/ruzzy.rb

@@ -2,7 +2,7 @@
 
 require 'pathname'
 
-# A Ruby C extension fuzzer
+# A coverage-guided fuzzer for pure Ruby code and Ruby C extensions
 module Ruzzy
   require 'cruzzy/cruzzy'
 
@@ -15,10 +15,6 @@ module Ruzzy
     c_fuzz(test_one_input, args)
   end
 
-  def dummy
-    fuzz(->(data) { Ruzzy.dummy_test_one_input(data) })
-  end
-
   def dummy_test_one_input(data)
     # This 'require' depends on LD_PRELOAD, so it's placed inside the function
     # scope. This allows us to access EXT_PATH for LD_PRELOAD and not have a
@@ -28,9 +24,28 @@ module Ruzzy
     c_dummy_test_one_input(data)
   end
 
+  def dummy
+    fuzz(->(data) { dummy_test_one_input(data) })
+  end
+
+  def trace(harness_script)
+    harness_path = Pathname.new(harness_script)
+
+    # Mimic require_relative. If harness script is provided as an absolute path,
+    # then use that. If not, then assume the script is in the same directory as
+    # as the tracer script, i.e. the caller.
+    if !harness_path.absolute?
+      caller_path = Pathname.new(caller_locations.first.path)
+      harness_path = (caller_path.parent / harness_path).realpath
+    end
+
+    c_trace(harness_path.to_s)
+  end
+
   module_function :fuzz
-  module_function :dummy
   module_function :dummy_test_one_input
+  module_function :dummy
+  module_function :trace
 end
 
 # Hook Integer operations for tracing in SantizerCoverage

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ruzzy
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.7.0
 platform: ruby
 authors:
 - Trail of Bits
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-02-13 00:00:00.000000000 Z
+date: 2024-03-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -101,5 +101,5 @@ requirements: []
 rubygems_version: 3.5.3
 signing_key: 
 specification_version: 4
-summary: A Ruby C extension fuzzer
+summary: A coverage-guided fuzzer for pure Ruby code and Ruby C extensions
 test_files: []