fuzzing/decode_ndr_X: read crashes from a HONGGFUZZ report

In theory, you should be able to run honggfuzz and go

$ lib/fuzzing/decode_ndr_X_crash -H HONGGFUZZ-REPORT.txt > crash-crash-crash.sh

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/lib/fuzzing/decode_ndr_X_crash b/lib/fuzzing/decode_ndr_X_crash
index 8b05e653fcdf7874c9cae73f24e159e94089f251..a6c5158859b84bf582313232118d2fa793bc4943 100755 (executable)
--- a/lib/fuzzing/decode_ndr_X_crash
+++ b/lib/fuzzing/decode_ndr_X_crash
@@ -10,7 +10,7 @@ import os
 from base64 import b64encode
 import struct
 import argparse
-
+import re
 
 TYPE_MASK = 3
 TYPES = ['struct', 'in', 'out']
@@ -67,12 +67,14 @@ def main():
                         help='restrict to this type')
     parser.add_argument('-o', '--opnum', default=None, type=int,
                         help='restrict to this function/struct number')
-    parser.add_argument('FILES', nargs='*', default ='-',
+    parser.add_argument('FILES', nargs='*', default=(),
                         help="read from these files")
     parser.add_argument('-k', '--ignore-errors', action='store_true',
                         help='do not stop on errors')
     parser.add_argument('-v', '--verbose', action='store_true',
                         help='say more')
+    parser.add_argument('-H', '--honggfuzz-file',
+                        help="extract crashes from this honggfuzz report")
 
     args = parser.parse_args()
 
@@ -99,4 +101,25 @@ def main():
                 continue
             raise
 
+    if args.honggfuzz_file:
+        print_if_verbose(f"looking at {args.honggfuzz_file}")
+        with open(args.honggfuzz_file) as f:
+            pipe = None
+            crash = None
+            for line in f:
+                m = re.match(r'^\s*fuzzTarget\s*:\s*bin/fuzz_ndr_(\w+)\s*$', line)
+                if m:
+                    pipe = m.group(1)
+                    print_if_verbose(f"found pipe {pipe}")
+                m = re.match(r'^FUZZ_FNAME: (\S+)$', line)
+                if m:
+                    crash = m.group(1)
+                    print_if_verbose(f"found crash {crash}")
+                if pipe is not None and crash is not None:
+                    with open(crash, 'rb') as f:
+                        process_one_file(f)
+                    pipe = None
+                    crash = None
+
+
 main()