4 files changed, 112 insertions, 7 deletions

diff --git a/fuzzing/Android.bp b/fuzzing/Android.bp
index 09b1f4a..da1bfa6 100644
--- a/fuzzing/Android.bp
+++ b/fuzzing/Android.bp
@@ -11,10 +11,29 @@ cc_fuzz {
     static_libs: [
         "libfdt",
     ],
-    host_supported: true,
+    corpus: ["corpus/*"],
     fuzz_config: {
         cc: [
             "ptosi@google.com",
         ],
     },
+    host_supported: true,
+}
+
+
+cc_afl_fuzz {
+    name: "afl_libfdt_fuzzer",
+    srcs: [
+        "libfdt_fuzzer.c",
+    ],
+    static_libs: [
+      "libfdt",
+    ],
+    corpus: ["corpus/*"],
+    fuzz_config: {
+        cc: [
+            "mikemcternan@google.com",
+        ],
+    },
+    host_supported: true,
 }
diff --git a/fuzzing/corpus/hardy-octopus b/fuzzing/corpus/hardy-octopus
new file mode 100644
index 0000000..81615e9
--- /dev/null
+++ b/fuzzing/corpus/hardy-octopus
diff --git a/fuzzing/corpus/meson-g12a-sei510-android.dtb b/fuzzing/corpus/meson-g12a-sei510-android.dtb
new file mode 100644
index 0000000..317175d
--- /dev/null
+++ b/fuzzing/corpus/meson-g12a-sei510-android.dtb
diff --git a/fuzzing/libfdt_fuzzer.c b/fuzzing/libfdt_fuzzer.c
index 227e711..b433bbc 100644
--- a/fuzzing/libfdt_fuzzer.c
+++ b/fuzzing/libfdt_fuzzer.c
@@ -1,18 +1,77 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/* Ensure assert() catches logical errors during fuzzing */
+#ifdef NDEBUG
+#undef NDEBUG
+#endif
+
+#include <inttypes.h>
 #include <assert.h>
+#include <stdbool.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <ctype.h>
+
+#include <sanitizer/asan_interface.h>
+#include <sanitizer/msan_interface.h>
 
 #include "libfdt.h"
 #include "libfdt_env.h"
 
-void walk_device_tree(const void *device_tree, int parent_node) {
+/* check memory region is valid, for the purpose of tooling such as asan */
+static void check_mem(const void *mem, size_t len) {
+
+  assert(mem);
+
+#if __has_feature(memory_sanitizer)
+  /* dumps if check fails */
+  __msan_check_mem_is_initialized((void *)mem, len);
+#endif
+
+#if __has_feature(address_sanitizer) || defined(__SANITIZE_ADDRESS__)
+  assert(!__asan_region_is_poisoned((void *)mem, len));
+#else
+  const volatile uint8_t *mem8 = mem;
+
+  /* Read each byte of memory for instrumentation */
+  for(size_t i = 0; i < len; i++) {
+    (void)mem8[i];
+  }
+#endif
+}
+
+
+static void walk_node_properties(const void *device_tree, int node) {
+  int property, len = 0;
+
+  fdt_for_each_property_offset(property, device_tree, node) {
+    const struct fdt_property *prop = fdt_get_property_by_offset(device_tree,
+                                                                 property, &len);
+    check_mem(prop->data, fdt32_to_cpu(prop->len));
+  }
+}
+
+
+static void walk_device_tree(const void *device_tree, int parent_node) {
   int len = 0;
   const char *node_name = fdt_get_name(device_tree, parent_node, &len);
   if (node_name != NULL) {
-    // avoid clang complaining about unused variable node_name and force
-    // ASan to validate string pointer in strlen call.
-    assert(strlen(node_name) == len);
+    check_mem(node_name, len);
   }
 
   uint32_t phandle = fdt_get_phandle(device_tree, parent_node);
@@ -20,6 +79,8 @@ void walk_device_tree(const void *device_tree, int parent_node) {
     assert(parent_node == fdt_node_offset_by_phandle(device_tree, phandle));
   }
 
+  walk_node_properties(device_tree, parent_node);
+
   // recursively walk the node's children
   for (int node = fdt_first_subnode(device_tree, parent_node); node >= 0;
        node = fdt_next_subnode(device_tree, node)) {
@@ -27,6 +88,7 @@ void walk_device_tree(const void *device_tree, int parent_node) {
   }
 }
 
+
 // Information on device tree is available in external/dtc/Documentation/
 // folder.
 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
@@ -35,8 +97,32 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 
   if (fdt_check_full(data, size) != 0) return 0;
 
-  int root_node_offset = 0;
-  walk_device_tree(data, root_node_offset);
+  walk_device_tree(data, /* parent_node */ 0);
 
   return 0;
 }
+
+#ifdef AFL_STANDALONE
+/* Entry point suitable for direct afl-fuzz invocation */
+int main(int argc, char *argv[]) {
+  uint8_t data[1024 * 1024];
+
+  if (argc != 2) {
+    fprintf(stderr, "missing argument\n");
+    return EXIT_FAILURE;
+  }
+
+  FILE *f = fopen(argv[1], "r");
+  if (!f) {
+    perror("fopen() failed");
+    return EXIT_FAILURE;
+  }
+
+  size_t size = fread(data, 1, sizeof(data), f);
+
+  fclose(f);
+
+  return LLVMFuzzerTestOneInput(data, size);
+}
+#endif
+