Return-Path: <awaresystems.be+caf_=filtered=awaresystems.be@gmail.com>
Delivered-To: filtered@awaresystems.be
Received: from mx2.pub.mailpod2-cph3.one.com ([10.27.25.12])
	by mailstorage18.cst.mailpod2-cph3.one.com (Dovecot) with LMTP id TprWBo4Oy1oWugEAQS8vrQ
	for <filtered@awaresystems.be>; Mon, 09 Apr 2018 07:31:01 +0000
X-HalOne-ID: f32aed4a-3bc7-11e8-b780-ec0d9a6ed9fe
Received: from mail-oi0-f49.google.com (unknown [209.85.218.49])
	by mx2.pub.mailpod2-cph3.one.com (Halon) with ESMTPS
	id f32aed4a-3bc7-11e8-b780-ec0d9a6ed9fe;
	Mon, 09 Apr 2018 07:31:00 +0000 (UTC)
Received: by mail-oi0-f49.google.com with SMTP id j143-v6so6655664oih.11
        for <filtered@awaresystems.be>; Mon, 09 Apr 2018 00:31:00 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20161025;
        h=x-original-authentication-results:x-gm-message-state:delivered-to
         :from:mime-version:date:message-id:to:subject:precedence:list-id
         :list-unsubscribe:list-archive:list-post:list-help:list-subscribe
         :mime-version:sender:errors-to;
        bh=M+WhxQVgncimqy2AeGpnSNjk41PVbNlExrkCqRk6J2Y=;
        b=nGNg2IDvWogzswe9rxCcYeqvEl32t6GJWc7Vwgh9I/YqzVO4ZTgyCJacTbZzWtMY6M
         hUv8kxbLCqtaAodYmxW81P6BLvm1lw/TF6pL04J2bVOmDklkG2pBxqNsaPjHDg///71F
         fvrWgh6TfQFrZXWrpjJa1ezAspaViKj5nqcD9G9wdUl1yolIuhZlGuOb7TrF1DcbRW51
         Sj/VPdUF+8HIUt9Xsqt8GXbXE7JabPUYQ5ex0ydLy/XzSovGhCUngUGZKd559IIv30oK
         SJgFZNAqxKwMuZvoeCECAh6EDuR0Dsx7+LNSqNxONPWXYk5zZhMltJJ/Y1Sx+W31oV+j
         JmNw==
X-Original-Authentication-Results: mx.google.com;       spf=neutral (google.com: 94.23.4.142 is neither permitted nor denied by best guess record for domain of tiff-bounces@lists.maptools.org) smtp.mailfrom=tiff-bounces@lists.maptools.org;       dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
X-Gm-Message-State: ALQs6tCtqyTOMMx6UkRtlQDszljcsKjcD/MLZzwvuXqtWB2DbezVNZWz
	+x6duJGp+odltEhYZOjBh5w/wFlrngSn0dq2w+xFtr4/TjUsnLc=
X-Received: by 2002:aca:5612:: with SMTP id k18-v6mr22223420oib.158.1523259059391;
        Mon, 09 Apr 2018 00:30:59 -0700 (PDT)
X-Forwarded-To: filtered@awaresystems.be
X-Forwarded-For: awaresystems.be@gmail.com filtered@awaresystems.be
Delivered-To: awaresystems.be@gmail.com
Received: by 10.74.210.156 with SMTP id h28csp2313111oos;
        Mon, 9 Apr 2018 00:30:58 -0700 (PDT)
X-Google-Smtp-Source: AIpwx48k4aOZCDPaMW3wvV5ITKJtYGTEzQ29ogvv9dVZd8bgi8tkAT5rk7ggry1u3qn2z0jMWkjm
X-Received: by 10.223.133.139 with SMTP id 11mr8031643wrt.28.1523259058163;
        Mon, 09 Apr 2018 00:30:58 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1523259058; cv=none;
        d=google.com; s=arc-20160816;
        b=bW9iGm9tc7gHI/2/51QCut6B4/axmqw8bxTD6yWjlg16DShGnwPcJXV1tYoOLa7Po2
         32E7hbM3gCkO+lXo9t3Do5BszU8XShXBTsbF0iETP6/KwwIvhIpbqweGAGT3kRvFYgSX
         2lqHhVxBU3Sse2NaTiHJYFp5jAuvdaVfwzP4OfG2JTgag5H9NV5BMiETh9K31YE0Y2MX
         bltj2VeP3GMIiUfQaiLnQ+YsVHDcAng3FjVopPlgNj0r5PM7A2BgyPIH/1h5xz0B1hpK
         R4acJugRywOCDzvemXbHShD8tq+ogIfXeEv28UcZiQnNyaB6FTfdVmPLehXWrB7fgiqk
         jlsg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=errors-to:sender:mime-version:list-subscribe:list-help:list-post
         :list-archive:list-unsubscribe:list-id:precedence:subject:to
         :message-id:date:mime-version:from:arc-authentication-results;
        bh=M+WhxQVgncimqy2AeGpnSNjk41PVbNlExrkCqRk6J2Y=;
        b=1FRWTLZgFI9HEoinghf4E4pS7wreK5LcwMMyHib3vqBIuCxtIRqlXQ9+u+3TyhfkLe
         dx2fMFjGqEqgH8UIkQFGHZCnQpn8rtQ4+ny8ccfDN56UqM7li7WMksm9dcbSqOpBfREl
         Lf8kH2H3Ps0Ykju0sfREyAwUVm64ZNaveWoCG4o61jJR9EERpkcwHq3AmfzdfFeNqPdX
         cubXy3ItUDBCZO6EGIX4MBfqthXz87VuZ5m8WVXKJd2s3AtXCLvAeOS3A5jAd+jVLuav
         lJGxdgeGMhMlHA7/dhijytWTZqinak4dLw6fWYHw8kRZuf/Wh8sW7iva1iVokiQOYNkq
         24+g==
ARC-Authentication-Results: i=1; mx.google.com;
       spf=neutral (google.com: 94.23.4.142 is neither permitted nor denied by best guess record for domain of tiff-bounces@lists.maptools.org) smtp.mailfrom=tiff-bounces@lists.maptools.org;
       dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
Return-Path: <tiff-bounces@lists.maptools.org>
Received: from lists.maptools.org (ks365428.kimsufi.com. [94.23.4.142])
        by mx.google.com with ESMTP id v98si10984687wrc.286.2018.04.09.00.30.57;
        Mon, 09 Apr 2018 00:30:58 -0700 (PDT)
Received-SPF: neutral (google.com: 94.23.4.142 is neither permitted nor denied by best guess record for domain of tiff-bounces@lists.maptools.org) client-ip=94.23.4.142;
Authentication-Results: mx.google.com;
       spf=neutral (google.com: 94.23.4.142 is neither permitted nor denied by best guess record for domain of tiff-bounces@lists.maptools.org) smtp.mailfrom=tiff-bounces@lists.maptools.org;
       dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
Received: from [10.1.0.241] (localhost.localdomain [127.0.0.1])
	by lists.maptools.org (Postfix) with ESMTP id 2016835C02C;
	Mon,  9 Apr 2018 02:29:52 -0500 (EST)
Received: from mail-qk0-f169.google.com (mail-qk0-f169.google.com
	[209.85.220.169])
	by lists.maptools.org (Postfix) with ESMTPS id D7B2335C029
	for <tiff@lists.maptools.org>; Mon,  9 Apr 2018 02:29:40 -0500 (EST)
Received: by mail-qk0-f169.google.com with SMTP id j73so8223573qke.6
	for <tiff@lists.maptools.org>; Mon, 09 Apr 2018 00:29:40 -0700 (PDT)
X-Received: by 10.55.167.5 with SMTP id q5mr46709213qke.273.1523258979168;
	Mon, 09 Apr 2018 00:29:39 -0700 (PDT)
Received: from 1058052472880 named unknown by gmailapi.google.com with
	HTTPREST; Mon, 9 Apr 2018 03:29:38 -0400
From: Paul Kehrer <paul.l.kehrer@gmail.com>
X-Mailer: Airmail (467)
MIME-Version: 1.0
Date: Mon, 9 Apr 2018 03:29:38 -0400
Message-ID: <CABj5TKTJeeQ+O37e7tyPaftUeV6Hemu3r0oZFjumYZisU9KJ1A@mail.gmail.com>
To: tiff@lists.maptools.org
Subject: [Tiff] fuzzing libtiff with google's oss-fuzz
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=subscribe>
Content-Type: multipart/mixed; boundary="===============0386736314=="
Mime-version: 1.0
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org

--===============0386736314==
Content-Type: multipart/alternative; boundary="001a114fca425ab6f80569655e29"

--001a114fca425ab6f80569655e29
Content-Type: text/plain; charset="UTF-8"

I've been experimenting with fuzzing libtiff recently and was wondering if
there is interest in integrating libtiff into Google's OSS-Fuzz (
https://github.com/google/oss-fuzz)? OSS-Fuzz is a public infrastructure
for running continuous fuzzing. The system will automatically fuzz the
targets you define, aggregate duplicate bug reports, and file issues with
minimal reproducers and stack traces so that project developers can easily
verify and fix issues. libtiff appears to be getting some fuzzing by proxy
via other projects, but I'd be happy to manage the process of integration
and submit PRs so that you can directly receive reports and get better
coverage.

The primary challenge at the moment is controlling libtiff's memory
allocations (it looks like several previous OSS fuzz related fixes have
attempted to address that in various code paths?). It is very easy to craft
files that will cause extremely large malloc and I've been unable to find a
library level way to constrain that. However, I've modified my existing
fuzzer a bit to throw out most test cases that would trigger OOMs for now
(at least all the ones I was able to generate locally). Ideally in the
longer term those would be removed as libtiff gets better at avoiding large
allocations on invalid files.  Additionally, at the moment the fuzzer I
wrote only uses TIFFReadRGBAImage -- do people have suggestions for other
functions that might be worthwhile to fuzz? You can see the current diff
adding libtiff to the oss-fuzz repo (this includes building libz and
libjpeg-turbo as well as compiling the fuzzer) here:
https://github.com/google/oss-fuzz/compare/master...reaperhulk:libtiff?expand=1

If there's interest I just need to know who to put as the primary project
email contact and any other people you want to grant access. Those email
addresses will need to be associated with a Google account so that you can
log into oss-fuzz.com to view the reports.

-Paul Kehrer (reaperhulk)

--001a114fca425ab6f80569655e29
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style>=
</head><body style=3D"word-wrap:break-word;line-break:after-white-space"><d=
iv id=3D"bloop_customfont" style=3D"font-family:Helvetica,Arial;font-size:1=
3px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto"><div id=3D"bloop_cus=
tomfont" style=3D"margin:0px">I&#39;ve been experimenting with fuzzing libt=
iff recently and was wondering if there is interest in integrating libtiff =
into Google&#39;s OSS-Fuzz (<a href=3D"https://github.com/google/oss-fuzz">=
https://github.com/google/oss-fuzz</a>)? OSS-Fuzz is a public infrastructur=
e for running continuous fuzzing. The system will automatically fuzz the ta=
rgets you define, aggregate duplicate bug reports, and file issues with min=
imal reproducers and stack traces so that project developers can easily ver=
ify and fix issues. libtiff appears to be getting some fuzzing by proxy via=
 other projects, but I&#39;d be happy to manage the process of integration =
and submit PRs so that you can directly receive reports and get better cove=
rage.</div><div id=3D"bloop_customfont" style=3D"margin:0px"><br></div><div=
 id=3D"bloop_customfont" style=3D"margin:0px">The primary challenge at the =
moment is controlling libtiff&#39;s memory allocations (it looks like sever=
al previous OSS fuzz related fixes have attempted to address that in variou=
s code paths?). It is very easy to craft files that will cause extremely la=
rge malloc and I&#39;ve been unable to find a library level way to constrai=
n that. However, I&#39;ve modified my existing fuzzer a bit to throw out mo=
st test cases that would trigger OOMs for now (at least all the ones I was =
able to generate locally). Ideally in the longer term those would be remove=
d as libtiff gets better at avoiding large allocations on invalid files.=C2=
=A0 Additionally, at the moment the fuzzer I wrote only uses TIFFReadRGBAIm=
age -- do people have suggestions for other functions that might be worthwh=
ile to fuzz? You can see the current diff adding libtiff to the oss-fuzz re=
po (this includes building libz and libjpeg-turbo as well as compiling the =
fuzzer) here: <a href=3D"https://github.com/google/oss-fuzz/compare/master.=
..reaperhulk:libtiff?expand=3D1">https://github.com/google/oss-fuzz/compare=
/master...reaperhulk:libtiff?expand=3D1</a></div><div id=3D"bloop_customfon=
t" style=3D"margin:0px"><br></div><div id=3D"bloop_customfont" style=3D"mar=
gin:0px">If there&#39;s interest I just need to know who to put as the prim=
ary project email contact and any other people you want to grant access. Th=
ose email addresses will need to be associated with a Google account so tha=
t you can log into <a href=3D"http://oss-fuzz.com">oss-fuzz.com</a> to view=
 the reports.</div><div id=3D"bloop_customfont" style=3D"margin:0px"><br></=
div><div id=3D"bloop_customfont" style=3D"margin:0px">-Paul Kehrer (reaperh=
ulk)</div></div></body></html>

--001a114fca425ab6f80569655e29--

--===============0386736314==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
--===============0386736314==--
