Re: [libvirt] [GSOC] project libvirt fuzzing

On Sun, Mar 5, 2017 at 2:47 AM, Michal Privoznik <mprivozn(a)redhat.com&gt; wrote: Thank you very much for the explanation and encouragement. I am so glad to join the community. 1. Regarding XML config file, one typical usage with libvirt could be: $ virsh define <domain_config_file.xml <http://your_xml_config_file.ml>> 2. I noticed in the source code of libvirt, there exist several files in close relation to xml, including src/util/virxml.{c,h}, which might be the target of this project? 3. And libvirt also is compiled with libxml2. 4. Then in virt-xml-validate, which is a bash script, (in build/bin directory after make install) calling xmllint. I have not been able to get round to figure out the relations of the above pieces yet. I spent some time to try to instrument and compile the executables with AFL, but so far with no luck. (The idea is as simple as changing gcc in Makefile/configure to afl-gcc). The attached figure is just a demo showing using AFL to fuzz virt-admin, which is not instrumented, (so kinda of boring and not quite useful). But I think AFL could be one of the candidate as a fuzzer for this project due its prevalence and proved effectiveness. Regarding fuzzing, I think we can try several fuzzing tools to run in parallel, as different fuzzers tend to find different kinds of bugs. Thus, AFL (American Fuzz Lop) [1], which is a coverage-guided mutation-based fuzzer with genetic algorithm, can take hand-crafted xml seed to fuzz our libvert target. Alternatively, we could develop generation-based grammar module in AFL (which is definitely non-trivial); so far I have not seen active development in AFL community on xml format grammar generation. Another option could be clang-libfuzzer [2]. Several related articles show examples of fuzzing are using AFL to generate SQL [3], llvm-afl [4], and hexml fuzzing with AFL [5]. In combination with lcov, we could compare different fuzzers and guide our fuzzing tuning. NOTE the [5] example is quite interesting; it is fuzzing a haskell-written xml paser. I will probably not update more until next week; I am having three mid-terms this week. [1] http://lcamtuf.coredump.cx/afl/ [2] http://llvm.org/docs/LibFuzzer.html [3] https://lcamtuf.blogspot.com/2015/01/afl-fuzz-making-up-grammar-with.html [4] http://lists.llvm.org/pipermail/llvm-dev/2014-December/079390.html [5] https://github.com/ndmitchell/hexml/issues/6 Again, thanks a lot. Any guidance, comments, or suggestions would be more than welcome and highly appreciated. Best, Dan XML document -> XML parser -> QEMU cmd line generator -> QEMU cmd line