script/gen_fuzz.py

#!/usr/bin/env python3
# SPDX-License-Identifier: BSD-2-Clause
import os
import argparse
import itertools

# Makefile-fuzz-generated.am is created from this template.
MAKEFILE_FUZZ = '''# SPDX-License-Identifier: BSD-2-Clause
# Copyright (c) 2018 Intel Corporation
# All rights reserved.

if ENABLE_TCTI_FUZZING
TESTS_FUZZ = %s
%s
endif # ENABLE_TCTI_FUZZING
'''
# Each fuzz target in Makefile-fuzz-generated.am is created from this template.
MAKEFILE_FUZZ_TARGET = '''
noinst_PROGRAMS += test/fuzz/%s.fuzz
test_fuzz_%s_fuzz_CPPFLAGS = $(FUZZ_CPPFLAGS)
test_fuzz_%s_fuzz_LDADD    = $(FUZZLDADD)
nodist_test_fuzz_%s_fuzz_SOURCES  = test/fuzz/main-sys.cpp \\
        test/fuzz/%s.fuzz.cpp

DISTCLEANFILES += test/fuzz/%s.fuzz.cpp'''
# Common include definitions needed for fuzzing an SYS call
SYS_TEMPLATE_HEADER = '''/* SPDX-License-Identifier: BSD-2-Clause */
/***********************************************************************
 * Copyright (c) 2018, Intel Corporation
 *
 * All rights reserved.
 ***********************************************************************/
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif

#include <inttypes.h>
#include <stdbool.h>
#include <stdio.h>
#include <string.h>
#include <poll.h>
#include <stdarg.h>

#include <setjmp.h>

extern "C" {
#include "tss2_mu.h"
#include "tss2_sys.h"
#include "tss2_tcti_device.h"

#include "tss2-tcti/tcti-common.h"
#include "tss2-tcti/tcti-device.h"

#define LOGMODULE fuzz
#include "tss2_tcti.h"
#include "util/log.h"
#include "test.h"
#include "test-options.h"
#include "context-util.h"
#include "tss2-sys/sysapi_util.h"
#include "tcti/tcti-fuzzing.h"
}

extern "C"
int
test_invoke (
        TSS2_SYS_CONTEXT *sysContext)'''
# Template to call a SYS _Complete function which takes no arguments
SYS_COMPLETE_TEMPLATE_NO_ARGS = SYS_TEMPLATE_HEADER + '''
{
    %s (sysContext);

    return EXIT_SUCCESS;
}
'''
# Template to call a SYS _Complete function which takes arguments
SYS_COMPLETE_TEMPLATE_HAS_ARGS = SYS_TEMPLATE_HEADER + '''
{
    %s

    %s (
        sysContext,
        %s
    );

    return EXIT_SUCCESS;
}
'''
# Template to call a SYS _Prepare function
SYS_PREPARE_TEMPLATE_HAS_ARGS = SYS_TEMPLATE_HEADER + '''
{
    int ret;
    %s

    ret = fuzz_fill (
        sysContext,
        %d,
        %s
    );
    if (ret) {
        return ret;
    }

    %s (
        sysContext,
        %s
    );

    return EXIT_SUCCESS;
}
'''

def gen_file(function):
    '''
    Generate a cpp file used as the fuzz target given the function definition
    from a header file.
    '''
    # Parse the function name from the function definition
    function_name = function.split('\n')[0]\
                            .replace('TSS2_RC', '')\
                            .replace('(', '')\
                            .strip()
    # Parse the function arguments into an array. Do not include sysContext.
    args = [arg.strip() \
            for arg in function[function.index('(') + 1:function.index(');')]\
            .split(',') \
            if not 'TSS2_SYS_CONTEXT' in arg]
    # Prepare and Complete functions require different methods of generation.
    # Call the appropriate function to generate a cpp target specific to that
    # type of function.
    if '_Complete' in function_name:
        return gen_complete(function, function_name, args)
    if '_Prepare' in function_name:
        return gen_prepare(function, function_name, args)
    raise NotImplementedError('Unknown function type %r' % (function_name,))

def gen_complete(function, function_name, args):
    '''
    Generate the cpp fuzz target for a SYS _Complete call
    '''
    if not args:
        # Fill in the no args template. Simple case.
        return function_name, SYS_COMPLETE_TEMPLATE_NO_ARGS % (function_name)
    # Generate the cpp variable definitions.
    arg_definitions = (';\n' + ' ' * 4).join([
        arg.replace('*', '') for arg in args]) + ';'
    # Generate the cpp arguments. For arguments that are pointers find replace *
    # with & so that we pass a pointer to the definition which has been
    # allocated on the stack.
    arg_call = (',\n' + ' ' * 8).join([
        arg.replace('*', '&').split()[-1] for arg in args])
    # Fill in the template
    return function_name, SYS_COMPLETE_TEMPLATE_HAS_ARGS % (arg_definitions,
                                                             function_name,
                                                             arg_call)

def gen_prepare(function, function_name, args):
    '''
    Generate the cpp fuzz target for a SYS _Prepare call
    '''
    if not args:
        return function_name, None
    # Generate the cpp variable definitions. Make sure to initialize to empty
    # structs (works for initializing anything) or cpp compiler will complain.
    arg_definitions = (' = {0};\n' + ' ' * 4).join([
        arg.replace('*', '').replace('const', '') for arg in args]) + ' = {0};'
    # Generate the cpp arguments. For arguments that are pointers find replace *
    # with & so that we pass a pointer to the definition which has been
    # allocated on the stack.
    arg_call = (',\n' + ' ' * 8).join([
        arg.replace('*', '&').split()[-1] for arg in args])
    # Generate the call to fuzz_fill. The call should be the sysContext, double
    # the number of arguments for the _Prepare call, and then for each _Prepare
    # argument pass two to fuzz_fill, the sizeof the _Prepare argument, and a
    # pointer to it.
    fill_fuzz_args = (',\n' + ' ' * 8).join([
        ('sizeof (%s), &%s' % \
                tuple([arg.replace('*', '').split()[-1]] * 2)) \
        for arg in args])
    # Fill in the template
    return function_name, SYS_PREPARE_TEMPLATE_HAS_ARGS % (arg_definitions,
                                                            len(args) * 2,
                                                            fill_fuzz_args,
                                                            function_name,
                                                            arg_call)

def functions_from_include(header):
    '''
    Parse out and yield each function definition from a header file.
    '''
    with open(header, 'r') as header_fd:
        current_function = ''
        for line in header_fd:
            # Functions we are interested in start with _Complete or _Prepare
            if '_Complete' in line or '_Prepare' in line:
                # Set the current_function to this line
                current_function = line
            elif current_function and ');' in line:
                # When we reach the closing parenthesis yield the function
                yield current_function + line.rstrip()
                current_function = ''
            elif current_function:
                # Add all the arguments to the function
                current_function += line

def gen_files(header):
    # Generate a fuzz target cpp file from each function in the header file
    for current_function in functions_from_include(header):
        function_name, contents = gen_file(current_function)
        # Skip the yield if there is no fuzz target that can be generated
        if contents is None:
            continue
        # Yield the function name and the contents of its generated file
        yield function_name, contents

def main():
    parser = argparse.ArgumentParser(description='Generate libfuzzer for sys')
    parser.add_argument('--header', default='include/tss2/tss2_sys.h',
            help='Header file to look in (default include/tss2/tss2_sys.h)')
    args = parser.parse_args()

    functions = dict(gen_files(args.header))
    # Write the generated target to the file for its function name
    for function_name, contents in functions.items():
        filepath = os.path.join('test', 'fuzz', function_name + '.fuzz.cpp')
        with open(filepath, 'w') as fuzzer_fd:
            fuzzer_fd.write(contents)
    # Fill in the Makefile-fuzz-generated.am template using the function names.
    # Create a list of the compiled fuzz targets
    files = ' \\\n    '.join(['test/fuzz/%s.fuzz' % (function) \
                              for function in functions])
    # Create the Makefile targets for each generated file
    targets = '\n'.join([MAKEFILE_FUZZ_TARGET % tuple(list(itertools.chain(\
            ([function] * 6)))) for function in functions])
    # Write out the Makefile-fuzz-generated.am file
    with open('Makefile-fuzz-generated.am', 'w') as makefile_fd:
        makefile_fd.write(MAKEFILE_FUZZ % (files, targets))

if __name__ == '__main__':
    main()