Re: Question about a design of syscalls for microkernels
Posted: Sun Jun 27, 2021 12:30 pm
So I just fuzzed serde via postcard (serde itself can't serialize or deserialize anything). My code was as follows:
It didn't crash at all during my fuzzing. I didn't run it for long -- it got up to about #134 million -- but my fuzzing might've not been exhaustive/adequate enough. (I know that humans are naturally unpredictable so fuzzing isn't a complete guarantee, but as far as I know its as close as you can get.)
Code: Select all
#![no_main]
use libfuzzer_sys::fuzz_target;
use postcard::from_bytes;
use serde::{Deserialize, Serialize};
#[repr(C)]
#[derive(
Clone, Copy, Debug, Default, Eq, PartialEq, Ord, PartialOrd, Hash, Serialize, Deserialize,
)]
struct ReadRequest {
pub fd: u64,
pub buf_addr: u64,
pub size: usize,
}
fuzz_target!(|data: &[u8]| {
match from_bytes::<ReadRequest>(data) {
Ok(mut req) => {
req.fd = 0;
req.buf_addr = 0;
req.size = 0;
}
Err(_) => {}
}
});