28 lines
1.1 KiB
Rust
28 lines
1.1 KiB
Rust
#![no_main]
|
|
//! The ELF64 reader must return `Err` on any malformed input, never panic — no out-of-bounds index,
|
|
//! no arithmetic overflow. `from_bytes` parses section headers, the symbol table, and the relocation
|
|
//! map straight out of attacker-controlled bytes; this drives it and every allocated-section accessor.
|
|
use source2rosetta::elf::CodeImage;
|
|
use libfuzzer_sys::fuzz_target;
|
|
|
|
fuzz_target!(|data: &[u8]| {
|
|
let Ok(img) = CodeImage::from_bytes(data.to_vec()) else {
|
|
return;
|
|
};
|
|
// Reloc-driven / eh_frame walks over whatever the header claimed.
|
|
let _ = img.eh_frame_functions();
|
|
let targets = img.code_pointer_targets();
|
|
// Pointer/string reads at reloc slots and their values (bounded — inputs are small anyway).
|
|
for (slot, val) in img.reloc_slots().take(256) {
|
|
let _ = img.read_ptr(slot);
|
|
let _ = img.read_c_string(val);
|
|
let _ = img.is_code(val);
|
|
let _ = img.ptrs_to(val);
|
|
}
|
|
for &t in targets.iter().take(64) {
|
|
let _ = img.code_at(t);
|
|
let _ = img.rodata_at(t, 32);
|
|
let _ = img.read_i64(t);
|
|
let _ = img.read_u32(t);
|
|
}
|
|
});
|