On 251112 0036, Navid Emamdoost wrote: > Add a new generic fuzz target for the QEMU VNC server. This target > exercises both the standard VNC protocol and the VNC-over-WebSocket > transport layer, increasing coverage of a primary remote attack surface. > > To support parallel fuzzing (e.g., with oss-fuzz), the VNC unix > socket paths are generated dynamically. The fuzzer harness inspects the > command line for placeholders and replaces them with unique paths > created by mkstemp() before execution. > > --- > > This new target increases code coverage in the VNC subsystem > and related networking and I/O code. > The baseline coverage below was generated by running all existing fuzz > targets with the oss-fuzz corpus. The new target shows significant gains: > > ---------------------------------------------------------------------------- > File New Target Baseline Change > ---------------------------------------------------------------------------- > vnc.c 339/3212 (10.6%) 3/3212 (0.1%) +336 > keymaps.c 91/184 (49.5%) 0/184 (0.0%) +91 > net-listener.c 76/198 (38.4%) 3/198 (1.5%) +73 > channel-socket.c 73/575 (12.7%) 19/575 (3.3%) +54 > qemu-sockets.c 44/1019 (4.3%) 0/1019 (0.0%) +44 > vnc-jobs.c 41/219 (18.7%) 0/219 (0.0%) +41 > dns-resolver.c 28/145 (19.3%) 3/145 (2.1%) +25 > > Signed-off-by: Navid Emamdoost <[email protected]>
Reviewed-by: Alexander Bulekov <[email protected]> > --- > tests/qtest/fuzz/generic_fuzz_configs.h | 50 +++++++++++++++++++++++++ > 1 file changed, 50 insertions(+) > > diff --git a/tests/qtest/fuzz/generic_fuzz_configs.h > b/tests/qtest/fuzz/generic_fuzz_configs.h > index ef0ad95712..9c46e106a4 100644 > --- a/tests/qtest/fuzz/generic_fuzz_configs.h > +++ b/tests/qtest/fuzz/generic_fuzz_configs.h > @@ -29,6 +29,52 @@ static inline gchar *generic_fuzzer_virtio_9p_args(void){ > "writeout=immediate,fmode=0600,dmode=0700", tmpdir); > } > > +/* > + * Global variables and cleanup handler for VNC fuzzer sockets. > + * These are needed because the socket paths must be available at exit. > + */ > +static char g_vnc_socket_path[sizeof("/tmp/qemu-vnc.XXXXXX")]; > +static char g_vnc_ws_socket_path[sizeof("/tmp/qemu-vnc-ws.XXXXXX")]; > + > +static void cleanup_vnc_sockets(void) > +{ > + if (g_vnc_socket_path[0] != '\0') { > + unlink(g_vnc_socket_path); > + } > + if (g_vnc_ws_socket_path[0] != '\0') { > + unlink(g_vnc_ws_socket_path); > + } > +} > + > +/* > + * Dynamically generate VNC arguments with unique unix socket paths. > + * This allows multiple fuzzing jobs to run in parallel without conflict. > + */ > +static inline gchar *generic_fuzzer_vnc_args(void) > +{ > + static bool cleanup_registered = false; > + int fd; > + > + strcpy(g_vnc_socket_path, "/tmp/qemu-vnc.XXXXXX"); > + fd = g_mkstemp(g_vnc_socket_path); > + g_assert_cmpint(fd, !=, -1); > + close(fd); > + > + strcpy(g_vnc_ws_socket_path, "/tmp/qemu-vnc-ws.XXXXXX"); > + fd = g_mkstemp(g_vnc_ws_socket_path); > + g_assert_cmpint(fd, !=, -1); > + close(fd); > + > + if (!cleanup_registered) { > + atexit(cleanup_vnc_sockets); > + cleanup_registered = true; > + } > + > + return g_strdup_printf("-machine q35 -nodefaults " > + "-vnc vnc=unix:%s,websocket=unix:%s", > + g_vnc_socket_path, g_vnc_ws_socket_path); > +} > + > const generic_fuzz_config predefined_configs[] = { > { > .name = "virtio-net-pci-slirp", > @@ -247,6 +293,10 @@ const generic_fuzz_config predefined_configs[] = { > .args = "-machine q35 -nodefaults " > "-parallel file:/dev/null", > .objects = "parallel*", > + },{ > + .name = "vnc", > + .argfunc = generic_fuzzer_vnc_args, > + .objects = "*", > } > }; > > -- > 2.51.2.1041.gc1ab5b90ca-goog > >
