initial commit

2026-08-19 01:14:35 +00:00 · 2026-08-19 01:23:15 +05:30
commit 00a3adf890
89 changed files with 21608 additions and 0 deletions
@@ -0,0 +1,29 @@
+@echo off
+setlocal
+set CLANG=%LLVM_HOME%\bin\clang.exe
+if not exist "%CLANG%" set CLANG=C:\Program Files\LLVM\bin\clang.exe
+if not exist "%CLANG%" (
+    echo [X] clang not found. install LLVM or set LLVM_HOME.
+    exit /b 1
+)
+
+set W3=..\..\driver\wasm3
+
+"%CLANG%" -O2 -g -fsanitize=fuzzer,address ^
+    -DM3_IMPLEMENT_ERROR_STRINGS ^
+    -Dd_m3HasFloat=0 ^
+    -I"%W3%" ^
+    fuzz_parse.c ^
+    "%W3%\m3_bind.c"    "%W3%\m3_code.c"     "%W3%\m3_compile.c" ^
+    "%W3%\m3_core.c"    "%W3%\m3_env.c"      "%W3%\m3_exec.c" ^
+    "%W3%\m3_function.c" "%W3%\m3_info.c"    "%W3%\m3_module.c" ^
+    "%W3%\m3_parse.c"   "%W3%\m3_validate.c" ^
+    -o fuzz_parse.exe
+
+if not exist corpus mkdir corpus
+if exist ..\..\sample_guest\sample_guest.wasm copy /Y ..\..\sample_guest\sample_guest.wasm corpus\ >nul
+
+echo [+] built fuzz_parse.exe. run with:
+echo     fuzz_parse.exe corpus -max_len=65536 -jobs=4
+
+endlocal
@@ -0,0 +1,46 @@
+/* fuzz_parse.c - libfuzzer target for m3_ParseModule.
+ *
+ * exercises the wasm3 parser with attacker-controlled bytes.
+ * kernel driver embeds the same parser; parser bugs here = potential
+ * bugcheck when someone loads a crafted .wasm via IOCTL_GVM_LOAD_MODULE.
+ *
+ * build (clang):
+ *   clang -O2 -g -fsanitize=fuzzer,address                                  \
+ *         -DM3_IMPLEMENT_ERROR_STRINGS                                       \
+ *         -I../../driver/wasm3                                               \
+ *         fuzz_parse.c ../../driver/wasm3/m3_*.c                             \
+ *         -o fuzz_parse.exe
+ *
+ * run:
+ *   fuzz_parse.exe corpus/ -max_len=65536
+ *
+ * seed corpus:
+ *   mkdir corpus && cp ../../sample_guest/sample_guest.wasm corpus/
+ */
+#include <stdint.h>
+#include <stddef.h>
+#include <string.h>
+#include "wasm3.h"
+
+int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    if (size < 8 || size > (16u * 1024u * 1024u)) return 0;
+
+    IM3Environment env = m3_NewEnvironment();
+    if (!env) return 0;
+
+    IM3Runtime rt = m3_NewRuntime(env, 64 * 1024, NULL);
+    if (!rt) { m3_FreeEnvironment(env); return 0; }
+
+    IM3Module mod = NULL;
+    M3Result r = m3_ParseModule(env, &mod, data, (uint32_t)size);
+    if (!r && mod) {
+        m3_LoadModule(rt, mod);
+        // no m3_Call here. parse+load exercises the surface we care about.
+        // if wasm3 signals load failure, module is not owned by us to free.
+    }
+
+    m3_FreeRuntime(rt);
+    m3_FreeEnvironment(env);
+    return 0;
+}