source2rosetta/fuzz/gen_corpus.rs

//! Seed-corpus generator for the source2rosetta fuzz targets.
//!
//! The targets parse ELF64 bytes, so a good seed is a *valid* ELF that gets the fuzzer past the magic
//! and into the section/symbol/reloc/schema/RTTI parsing where the real edge cases live. We build a
//! minimal-but-structurally-valid ELF in-process (no committed Valve bytes), add a couple of malformed
//! variants to seed the error paths, and — for richer real-world coverage — copy a small system ELF if
//! one is present. libfuzzer mutates + minimises from there.
//!
//! Run: cd source2rosetta/fuzz && cargo +nightly run --bin gen_corpus

use std::fs;
use std::path::Path;

const TARGETS: &[&str] = &[
    "fuzz_elf",
    "fuzz_schema",
    "fuzz_rtti",
    "fuzz_sig_abi",
    "fuzz_xref",
];

fn w16(v: &mut [u8], o: usize, x: u16) {
    v[o..o + 2].copy_from_slice(&x.to_le_bytes());
}
fn w32(v: &mut [u8], o: usize, x: u32) {
    v[o..o + 4].copy_from_slice(&x.to_le_bytes());
}
fn w64(v: &mut [u8], o: usize, x: u64) {
    v[o..o + 8].copy_from_slice(&x.to_le_bytes());
}

/// A 64-byte ELF64 section header, matching the fields `elf.rs` reads.
fn sec_hdr(typ: u32, flags: u64, addr: u64, off: u64, size: u64, link: u32, entsize: u64) -> Vec<u8> {
    let mut h = vec![0u8; 64];
    w32(&mut h, 4, typ);
    w64(&mut h, 8, flags);
    w64(&mut h, 16, addr);
    w64(&mut h, 24, off);
    w64(&mut h, 32, size);
    w32(&mut h, 40, link);
    w64(&mut h, 56, entsize);
    h
}

/// A minimal, valid ELF64 with an executable `.text` (one `mov eax,1; ret`), a `.rodata` carrying an
/// Itanium type name + a distinctive string, a dynstr/dynsym pair, and two relocations (one pointing a
/// slot at the code, one at the type name). Enough for the fuzzer to reach every reader's happy path.
fn minimal_elf() -> Vec<u8> {
    const SHF_ALLOC: u64 = 0x2;
    const SHF_EXEC: u64 = 0x4;
    let text: &[u8] = &[0xB8, 0x01, 0x00, 0x00, 0x00, 0xC3]; // mov eax,1 ; ret
    let rodata: &[u8] = b"11CBaseEntity\0a distinctive fuzz seed string\0";
    let dynstr: &[u8] = b"\0_ZTV11CBaseEntity\0";
    // one Elf64_Sym (24B): st_name=1, st_info=0x12, st_shndx=1(.text), st_value=0x1000, st_size=6
    let mut sym = vec![0u8; 24];
    w32(&mut sym, 0, 1);
    sym[4] = 0x12;
    w16(&mut sym, 6, 1);
    w64(&mut sym, 8, 0x1000);
    w64(&mut sym, 16, text.len() as u64);
    // two Elf64_Rela (24B each): R_X86_64_RELATIVE (type 8), addend = target vaddr
    let mut relas = vec![0u8; 48];
    w64(&mut relas, 0, 0x4010); // slot
    w64(&mut relas, 8, 8); // r_info: type RELATIVE
    w64(&mut relas, 16, 0x1000); // -> .text (a code-pointer target)
    w64(&mut relas, 24, 0x4018);
    w64(&mut relas, 32, 8);
    w64(&mut relas, 40, 0x2000); // -> .rodata type name

    // Lay content out after the 64-byte header; section headers go at the end.
    let mut body: Vec<u8> = Vec::new();
    let push = |data: &[u8], body: &mut Vec<u8>| -> u64 {
        let off = 64 + body.len() as u64;
        body.extend_from_slice(data);
        off
    };
    let text_off = push(text, &mut body);
    let rodata_off = push(rodata, &mut body);
    let dynstr_off = push(dynstr, &mut body);
    let dynsym_off = push(&sym, &mut body);
    let rela_off = push(&relas, &mut body);

    let secs = [
        sec_hdr(0, 0, 0, 0, 0, 0, 0), // [0] null
        sec_hdr(1, SHF_ALLOC | SHF_EXEC, 0x1000, text_off, text.len() as u64, 0, 0), // [1] .text
        sec_hdr(1, SHF_ALLOC, 0x2000, rodata_off, rodata.len() as u64, 0, 0), // [2] .rodata
        sec_hdr(3, SHF_ALLOC, 0x3000, dynstr_off, dynstr.len() as u64, 0, 0), // [3] .dynstr (STRTAB)
        sec_hdr(11, SHF_ALLOC, 0x4000, dynsym_off, sym.len() as u64, 3, 24),  // [4] .dynsym -> link 3
        sec_hdr(4, SHF_ALLOC, 0x5000, rela_off, relas.len() as u64, 4, 24),   // [5] .rela.dyn
    ];
    let shoff = 64 + body.len() as u64;

    let mut elf = vec![0u8; 64];
    elf[0..4].copy_from_slice(b"\x7fELF");
    elf[4] = 2; // ELF64
    elf[5] = 1; // little-endian
    w16(&mut elf, 16, 3); // e_type = ET_DYN
    w16(&mut elf, 18, 0x3e); // e_machine = x86-64
    w64(&mut elf, 40, shoff); // e_shoff
    w16(&mut elf, 58, 64); // e_shentsize
    w16(&mut elf, 60, secs.len() as u16); // e_shnum
    elf.extend_from_slice(&body);
    for s in &secs {
        elf.extend_from_slice(s);
    }
    elf
}

fn write(dir: &Path, name: &str, data: &[u8]) {
    fs::create_dir_all(dir).unwrap();
    fs::write(dir.join(name), data).unwrap();
}

fn main() {
    let minimal = minimal_elf();
    // sanity: the minimal seed must actually parse (else it's a poor seed)
    match source2rosetta::elf::CodeImage::from_bytes(minimal.clone()) {
        Ok(_) => println!("minimal_elf() parses OK ({} bytes)", minimal.len()),
        Err(e) => println!("WARNING: minimal_elf() failed to parse: {e}"),
    }

    let mut magic_only = vec![0u8; 64];
    magic_only[0..4].copy_from_slice(b"\x7fELF");
    magic_only[4] = 2;

    // a small real ELF for richer coverage (real symtab/eh_frame/relocs), if one is around
    let real = ["/usr/bin/true", "/bin/true", "/usr/bin/head"]
        .iter()
        .find_map(|p| fs::read(p).ok());

    for t in TARGETS {
        let dir = Path::new("corpus").join(t);
        write(&dir, "minimal.elf", &minimal);
        write(&dir, "magic_only.bin", &magic_only);
        if let Some(r) = &real {
            write(&dir, "real.elf", r);
        }
        println!(
            "seeded corpus/{t}/ ({} files)",
            2 + real.is_some() as usize
        );
    }
}