Browse Source

tweak fuzz function + add new corpus file

flashmob 7 years ago
parent
commit
bb23072286
3 changed files with 51 additions and 23 deletions
  1. 17 11
      fuzz.go
  2. 27 12
      fuzz_test.go
  3. 7 0
      workdir/suppressions/5afdf4a0774ce581c66b2a2b30dc6d1d2ca29590

+ 17 - 11
fuzz.go

@@ -104,16 +104,17 @@ func Fuzz(data []byte) int {
 		fuzzServer.handleClient(mockClient)
 		wg.Done()
 	}()
-	b := make([]byte, 1024)
-	if n, err := conn.Client.Read(b); err != nil {
-		return 0
-	} else if isFuzzDebug {
-		fmt.Println("Read", n, string(b))
+	// read in the greeting
+	in := newSMTPBufferedReader(conn.Client)
+	s, _ := in.ReadString('\n')
+	if isFuzzDebug {
+		fmt.Println("Read", s)
 	}
 
 	// Feed the connection with fuzz data (we are the _client_ end of the connection)
 	if _, err = io.Copy(conn.Client, bytes.NewReader(data)); err != nil {
-		return 0
+		fmt.Println(err)
+		return 1
 	}
 
 	// allow handleClient to process
@@ -121,12 +122,17 @@ func Fuzz(data []byte) int {
 
 	if mockClient.bufout.Buffered() == 0 {
 		// nothing to read - no complete commands sent?
-		return 0
+		return 1
 	}
-	if n, err := conn.Client.Read(b); err != nil {
-		return 0
-	} else if isFuzzDebug {
-		fmt.Println("Read", n, string(b))
+
+	var e error
+	var z string
+	for ; e == nil; z, e = in.ReadString('\n') {
+		fmt.Println("Read", z, mockClient.bufout.Buffered())
+		if mockClient.bufout.Buffered() == 0 {
+			break
+		}
+
 	}
 
 	return 1

+ 27 - 12
fuzz_test.go

@@ -45,7 +45,7 @@ func TestGenerateCorpus(t *testing.T) {
 	writeCorpos("1", []byte(str))
 
 	str = "HELO test.com\r\n" +
-		"MAIL FROM:[email protected]\r\n" +
+		"MAIL FROM:=?ISO-2022-JP?B?GyRCJEEkUCRSJG0bKEIgbWFnMiAwMDAxMDIzMTIw?= <[email protected]>\r\n" +
 		"RCPT TO:<[email protected]>\r\n" +
 		"RCPT TO:<[email protected]>\r\n" +
 		"RCPT TO:<[email protected]>\r\n" +
@@ -59,7 +59,7 @@ func TestGenerateCorpus(t *testing.T) {
 	writeCorpos("2", []byte(str))
 
 	str = "HELO test.com\r\n" +
-		"MAIL FROM:[email protected] BODY=8BITMIME\r\n" +
+		"MAIL FROM:=?utf-8?B?2KfZhNit2YjYp9isINmE2YTYstmK2YjYqiDYp9mE2LfYqNmK2LnZitip?=<[email protected]> BODY=8BITMIME\r\n" +
 		"RCPT TO:<[email protected]>\r\n" +
 		"RCPT TO:<[email protected]>\r\n" +
 		"RCPT TO:<[email protected]>\r\n" +
@@ -154,24 +154,39 @@ func TestGenerateCorpus(t *testing.T) {
 	str = "STARTTLS\r\n"
 	writeCorpos("22", []byte(str))
 
+	str = "HELO test.com\r\n" +
+		"MAIL FROM: =?ISO-2022-JP?B?GyRCJEEkUCRSJG0bKEIgbWFnMiAwMDAxMDIzMTIw?= <[email protected]>\r\n" +
+		"RCPT TO:<[email protected]>\r\n" +
+		"DATA\r\n" +
+		"Subject: =?ISO-2022-JP?B?GyRCIVokQSRQJFIkbSFbGyhCMy8xMhskQktcRnw9Kk47ISobKEI=?=\r\n" +
+		" =?ISO-2022-JP?B?UFBDLUUbJEIhViVeJTklPyE8JTMlcyVGJXMlRCFXGyhC?=\r\n" +
+		"\r\n" +
+		"..Now you're just somebody that i used to know\r\n" +
+		".\r\n"
+
+	writeCorpos("23", []byte(str))
+
 }
 
 // Tests the Fuzz function.
 
 func TestFuzz(t *testing.T) {
-	isFuzzDebug = true
-	result := Fuzz([]byte("MAIL from: <\r"))
-	if result != 0 {
-		t.Error("Fuzz test did not return 0")
-	}
-	result = Fuzz([]byte("MAIL from: <\r\nHELP\r\n"))
-	if result != 1 {
-		t.Error("Fuzz test did not return 1")
-	}
-	result = Fuzz([]byte("EHLO me\r\n"))
+	result := Fuzz([]byte("EHLO me\r\nMail From:[email protected]\r\nRcpt to:test@test" +
+		".com\r\nDATA\r\ntest\r\n.\r\n"))
 	if result != 1 {
 		t.Error("Fuzz test did not return 1")
 	}
+	/*
+		isFuzzDebug = true
+		result = Fuzz([]byte("MAIL from: <\r"))
+		if result != 1 {
+			t.Error("Fuzz test did not return 1")
+		}
+		result = Fuzz([]byte("MAIL from: <\r\nHELP\r\n"))
+		if result != 1 {
+			t.Error("Fuzz test did not return 1")
+		}
+	*/
 
 }
 

+ 7 - 0
workdir/suppressions/5afdf4a0774ce581c66b2a2b30dc6d1d2ca29590

@@ -0,0 +1,7 @@
+panic: runtime error: invalid memory address or nil pointer dereference
+github.com/flashmob/go-guerrilla/mail.(*Pool).Borrow
+github.com/flashmob/go-guerrilla.NewClient
+github.com/flashmob/go-guerrilla.(*Pool).Borrow
+github.com/flashmob/go-guerrilla.Fuzz
+go-fuzz-dep.Main
+main.main