From 0cd0d789f0749356003dfc0914ff5581329458c1 Mon Sep 17 00:00:00 2001 From: Dave Thaler Date: Sun, 13 Aug 2023 13:30:41 -0700 Subject: [PATCH] Fix mismatched alloc/free in verifier_fuzzer The verifier_fuzzer used ebpf_allocate() but then called free() Signed-off-by: Dave Thaler --- ebpf-for-windows.sln | 11 +++---- external/usersim | 2 +- .../kernel/ebpf_store_helper_km.vcxproj | 31 ++++++++++++++++++ .../user/ebpf_store_helper_um.vcxproj | 32 +++++++++++++++++-- .../verifier_fuzzer/libfuzz_harness.cpp | 4 +-- 5 files changed, 69 insertions(+), 11 deletions(-) diff --git a/ebpf-for-windows.sln b/ebpf-for-windows.sln index eca64a2fd1..26714daf90 100644 --- a/ebpf-for-windows.sln +++ b/ebpf-for-windows.sln @@ -2645,9 +2645,8 @@ Global {3569E946-C8B4-49EE-A89D-EDD09DC9F36E}.FuzzerDebug|ARM64.ActiveCfg = Debug|x64 {3569E946-C8B4-49EE-A89D-EDD09DC9F36E}.FuzzerDebug|ARM64.Build.0 = Debug|x64 {3569E946-C8B4-49EE-A89D-EDD09DC9F36E}.FuzzerDebug|ARM64.Deploy.0 = Debug|x64 - {3569E946-C8B4-49EE-A89D-EDD09DC9F36E}.FuzzerDebug|x64.ActiveCfg = Debug|x64 - {3569E946-C8B4-49EE-A89D-EDD09DC9F36E}.FuzzerDebug|x64.Build.0 = Debug|x64 - {3569E946-C8B4-49EE-A89D-EDD09DC9F36E}.FuzzerDebug|x64.Deploy.0 = Debug|x64 + {3569E946-C8B4-49EE-A89D-EDD09DC9F36E}.FuzzerDebug|x64.ActiveCfg = FuzzerDebug|x64 + {3569E946-C8B4-49EE-A89D-EDD09DC9F36E}.FuzzerDebug|x64.Build.0 = FuzzerDebug|x64 {3569E946-C8B4-49EE-A89D-EDD09DC9F36E}.FuzzerDebug|x86.ActiveCfg = Debug|x64 {3569E946-C8B4-49EE-A89D-EDD09DC9F36E}.FuzzerDebug|x86.Build.0 = Debug|x64 {3569E946-C8B4-49EE-A89D-EDD09DC9F36E}.FuzzerDebug|x86.Deploy.0 = Debug|x64 @@ -2708,9 +2707,9 @@ Global {AA933B9F-B5D8-4AA8-AC18-98FE1A161E8A}.FuzzerDebug|ARM64.ActiveCfg = Debug|x64 {AA933B9F-B5D8-4AA8-AC18-98FE1A161E8A}.FuzzerDebug|ARM64.Build.0 = Debug|x64 {AA933B9F-B5D8-4AA8-AC18-98FE1A161E8A}.FuzzerDebug|ARM64.Deploy.0 = Debug|x64 - {AA933B9F-B5D8-4AA8-AC18-98FE1A161E8A}.FuzzerDebug|x64.ActiveCfg = Debug|x64 - {AA933B9F-B5D8-4AA8-AC18-98FE1A161E8A}.FuzzerDebug|x64.Build.0 = Debug|x64 - {AA933B9F-B5D8-4AA8-AC18-98FE1A161E8A}.FuzzerDebug|x64.Deploy.0 = Debug|x64 + {AA933B9F-B5D8-4AA8-AC18-98FE1A161E8A}.FuzzerDebug|x64.ActiveCfg = FuzzerDebug|x64 + {AA933B9F-B5D8-4AA8-AC18-98FE1A161E8A}.FuzzerDebug|x64.Build.0 = FuzzerDebug|x64 + {AA933B9F-B5D8-4AA8-AC18-98FE1A161E8A}.FuzzerDebug|x64.Deploy.0 = FuzzerDebug|x64 {AA933B9F-B5D8-4AA8-AC18-98FE1A161E8A}.FuzzerDebug|x86.ActiveCfg = Debug|x64 {AA933B9F-B5D8-4AA8-AC18-98FE1A161E8A}.FuzzerDebug|x86.Build.0 = Debug|x64 {AA933B9F-B5D8-4AA8-AC18-98FE1A161E8A}.FuzzerDebug|x86.Deploy.0 = Debug|x64 diff --git a/external/usersim b/external/usersim index 82ee9300dc..f9ca4039e8 160000 --- a/external/usersim +++ b/external/usersim @@ -1 +1 @@ -Subproject commit 82ee9300dcbc4320e1207ca8b8a8a28bdf26ff63 +Subproject commit f9ca4039e8e36909b896a685dd985bedf56d0b5f diff --git a/libs/store_helper/kernel/ebpf_store_helper_km.vcxproj b/libs/store_helper/kernel/ebpf_store_helper_km.vcxproj index bd43de23e8..926c8ee092 100644 --- a/libs/store_helper/kernel/ebpf_store_helper_km.vcxproj +++ b/libs/store_helper/kernel/ebpf_store_helper_km.vcxproj @@ -9,6 +9,10 @@ Debug x64 + + FuzzerDebug + x64 + NativeOnlyDebug x64 @@ -42,6 +46,15 @@ Unicode false + + Windows10 + true + WindowsKernelModeDriver10.0 + Universal + StaticLibrary + Unicode + false + Windows10 true @@ -80,6 +93,10 @@ $(IncludePath);$(KMDF_INC_PATH)$(KMDF_VER_PATH);$(SolutionDir)\include;$(SolutionDir)\libs\store_helper\kernel;$(SolutionDir)\libs\platform\kernel;$(SolutionDir)\external\ebpf-verifier\src $(SolutionDir)$(Platform)\$(Configuration)\ + + $(IncludePath);$(KMDF_INC_PATH)$(KMDF_VER_PATH);$(SolutionDir)\include;$(SolutionDir)\libs\store_helper\kernel;$(SolutionDir)\libs\platform\kernel;$(SolutionDir)\external\ebpf-verifier\src + $(SolutionDir)$(Platform)\$(Configuration)\ + $(IncludePath);$(KMDF_INC_PATH)$(KMDF_VER_PATH);$(SolutionDir)\include;$(SolutionDir)\libs\store_helper\kernel;$(SolutionDir)\libs\platform\kernel;$(SolutionDir)\external\ebpf-verifier\src $(SolutionDir)$(Platform)\$(Configuration)\ @@ -105,6 +122,20 @@ true + + + Level3 + true + _DEBUG;_LIB;%(PreprocessorDefinitions) + true + NotUsing + + + + + true + + Level3 diff --git a/libs/store_helper/user/ebpf_store_helper_um.vcxproj b/libs/store_helper/user/ebpf_store_helper_um.vcxproj index af15e950dd..668236237c 100644 --- a/libs/store_helper/user/ebpf_store_helper_um.vcxproj +++ b/libs/store_helper/user/ebpf_store_helper_um.vcxproj @@ -9,6 +9,10 @@ Debug x64 + + FuzzerDebug + x64 + Release x64 @@ -29,7 +33,13 @@ v143 StaticLibrary Unicode - false + + + Windows10 + true + v143 + StaticLibrary + Unicode Windows10 @@ -37,7 +47,6 @@ v143 StaticLibrary Unicode - false @@ -51,6 +60,11 @@ $(VC_LibraryPath_x64);$(WindowsSDK_LibraryPath_x64) $(SolutionDir)$(Platform)\$(Configuration)\ + + $(VC_IncludePath);$(WindowsSDK_IncludePath);$(SolutionDir)\include;$(SolutionDir)\libs\store_helper\user;$(SolutionDir)\libs\platform;$(SolutionDir)\libs\platform\user;$(SolutionDir)\external\ebpf-verifier\src;$(SolutionDir)external\usersim\inc + $(VC_LibraryPath_x64);$(WindowsSDK_LibraryPath_x64) + $(SolutionDir)$(Platform)\$(Configuration)\ + $(VC_IncludePath);$(WindowsSDK_IncludePath);$(SolutionDir)\include;$(SolutionDir)\libs\store_helper\user;$(SolutionDir)\libs\platform;$(SolutionDir)\libs\platform\user;$(SolutionDir)\external\ebpf-verifier\src;$(SolutionDir)external\usersim\inc $(VC_LibraryPath_x64);$(WindowsSDK_LibraryPath_x64) @@ -69,6 +83,20 @@ true + + + Level3 + true + _DEBUG;_LIB;USER_MODE;%(PreprocessorDefinitions) + true + NotUsing + + + + + true + + Level3 diff --git a/tests/libfuzzer/verifier_fuzzer/libfuzz_harness.cpp b/tests/libfuzzer/verifier_fuzzer/libfuzz_harness.cpp index 2cf90052ec..dc2d5c8316 100644 --- a/tests/libfuzzer/verifier_fuzzer/libfuzz_harness.cpp +++ b/tests/libfuzzer/verifier_fuzzer/libfuzz_harness.cpp @@ -19,8 +19,8 @@ FUZZ_EXPORT int __cdecl LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) const char* error_message = nullptr; ebpf_api_elf_verify_section_from_memory( reinterpret_cast(data), size, "", nullptr, false, &report, &error_message, nullptr); - free(const_cast(report)); - free(const_cast(error_message)); + ebpf_free_string(report); + ebpf_free_string(error_message); } catch (std::runtime_error&) { }