initial commit

fuzz/fuzz_targets/fuzz_elf.rs

@@ -0,0 +1,28 @@
+#![no_main]
+//! The ELF64 reader must return `Err` on any malformed input, never panic — no out-of-bounds index,
+//! no arithmetic overflow. `from_bytes` parses section headers, the symbol table, and the relocation
+//! map straight out of attacker-controlled bytes; this drives it and every allocated-section accessor.
+use source2rosetta::elf::CodeImage;
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    let Ok(img) = CodeImage::from_bytes(data.to_vec()) else {
+        return;
+    };
+    // Reloc-driven / eh_frame walks over whatever the header claimed.
+    let _ = img.eh_frame_functions();
+    let targets = img.code_pointer_targets();
+    // Pointer/string reads at reloc slots and their values (bounded — inputs are small anyway).
+    for (slot, val) in img.reloc_slots().take(256) {
+        let _ = img.read_ptr(slot);
+        let _ = img.read_c_string(val);
+        let _ = img.is_code(val);
+        let _ = img.ptrs_to(val);
+    }
+    for &t in targets.iter().take(64) {
+        let _ = img.code_at(t);
+        let _ = img.rodata_at(t, 32);
+        let _ = img.read_i64(t);
+        let _ = img.read_u32(t);
+    }
+});

fuzz/fuzz_targets/fuzz_rtti.rs

@@ -0,0 +1,21 @@
+#![no_main]
+//! The Itanium RTTI reader chases `_ZTV`/`_ZTI`/`_ZTS` pointer chains and demangles names out of the
+//! bytes; `enumerate_vtables` sweeps every reloc slot as a candidate typeinfo. Arbitrary bytes must
+//! not panic it (or the demangler). Also runs the `NetworkStateChanged` slot detector over the slots.
+use source2rosetta::elf::CodeImage;
+use source2rosetta::rtti;
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    let Ok(img) = CodeImage::from_bytes(data.to_vec()) else {
+        return;
+    };
+    let vts = rtti::enumerate_vtables(&img, 128);
+    for cv in vts.iter().take(32) {
+        let _ = (&cv.name, &cv.mangled, cv.offset_to_top, cv.slots.len());
+    }
+    // The by-name lookup path (mangling + candidate walk) on a name pulled from the input itself.
+    if let Some(name) = vts.first().map(|c| c.name.clone()) {
+        let _ = rtti::find_vtable(&img, &name, 128);
+    }
+});

fuzz/fuzz_targets/fuzz_schema.rs

@@ -0,0 +1,23 @@
+#![no_main]
+//! The Source-2 SchemaSystem reader walks reloc-slot candidates as `SchemaClassInfoData_t` structs,
+//! chasing `m_pFields`/`m_pBaseClasses` pointers. A crafted (or truncated) `.so` can point those
+//! anywhere; the reader must survive it with `Err`/empty, never a panic. Also exercises the field and
+//! base-class accessors the derivation reads.
+use source2rosetta::elf::CodeImage;
+use source2rosetta::schema;
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    let Ok(img) = CodeImage::from_bytes(data.to_vec()) else {
+        return;
+    };
+    for c in schema::enumerate_schema(&img) {
+        let _ = c.primary_base();
+        for f in &c.fields {
+            let _ = (f.offset, f.name.len());
+        }
+        for b in &c.bases {
+            let _ = (b.offset, b.name.len());
+        }
+    }
+});

fuzz/fuzz_targets/fuzz_sig_abi.rs

@@ -0,0 +1,19 @@
+#![no_main]
+//! The single-function disassembly consumers: `candidate_entries` linear-sweeps the exec sections,
+//! then `abi_shape` (backward register liveness) and `make_sig` (wildcard-emitting decode) run from
+//! each entry. All decode attacker-controlled code bytes and must never panic — the decoder can hit
+//! any instruction, any truncation, any span boundary.
+use source2rosetta::elf::CodeImage;
+use source2rosetta::{abi, emit, locate};
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    let Ok(img) = CodeImage::from_bytes(data.to_vec()) else {
+        return;
+    };
+    for &addr in locate::candidate_entries(&img).iter().take(96) {
+        // Discard results: this fuzzer only asserts the decoders never panic.
+        let _ = abi::abi_shape(&img, addr);
+        let _ = emit::make_sig(&img, addr, 128);
+    }
+});

fuzz/fuzz_targets/fuzz_xref.rs

@@ -0,0 +1,21 @@
+#![no_main]
+//! The whole-binary cross-reference index decodes every function's `[start,next)` range and records
+//! call/data references; the string-anchor locators then query it. Feeding arbitrary code + rodata
+//! bytes exercises the decode, the containing-function lookup, and the string search — none may panic.
+use source2rosetta::elf::CodeImage;
+use source2rosetta::xref;
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    let Ok(img) = CodeImage::from_bytes(data.to_vec()) else {
+        return;
+    };
+    let xr = xref::XrefIndex::build(&img);
+    // Exercise the lookups over a bounded set of the discovered call targets — none may panic.
+    for &t in xr.call_targets().iter().take(64) {
+        let _ = xr.referrers(t);
+        let _ = xr.refs_to(t);
+        let _ = xr.containing_func(t);
+    }
+    let _ = xref::funcs_using_string(&img, &xr, "CBaseEntity");
+});