fuzz imagemagick

[Dor1s]

https://www.imagemagick.org/script/index.php had a plenty of security problems and probably still has them.

[Dor1s]

@dlemstra, have you heard about OSS-Fuzz?

Would you be interested in getting continuous fuzz testing for ImageMagick? We'd be happy to help.

[dlemstra]

We would love to join. Can you give us some pointers on how to set this up?

[Dor1s]

Sure! It's quite simple. We use docker to provide the same environment for both developers and our infrastructure, more info on adding new project: https://github.com/google/oss-fuzz/blob/master/docs/new_project_guide.md

If you've never touched libFuzzer, it would be good to go through tutorial.libfuzzer.info. It's like writing a unit test.

For example, I see HuffmanDecodeImage in https://github.com/ImageMagick/ImageMagick/blob/f6ff9eaa865134189fce2cf73b109da589178bde/MagickCore/compress.c#L366, such decoding API looks like a juicy target for fuzzing.

That function needs a pointer to Image object, which can be initialized from Blob: https://github.com/ImageMagick/ImageMagick/blob/6a3d581a642ec5b3c8759e67cd18fb77cf32854c/Magick%2B%2B/lib/Image.cpp#L82

A Blob object can be initialized using raw data bytes (https://github.com/ImageMagick/ImageMagick/blob/master/Magick%2B%2B/lib/Blob.cpp#L24) -- the easiest case we might have :)

So, a new fuzz target may be something like:

using namespace Magick;

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
  const Blob blob(Data, Size);
  Image image(blob);
  ExceptionInfo ex;
  auto res = HuffmanDecodeImage(&image, &ex);

  // maybe call something else?
  return 0;
}

[inferno-chromium]

tracked in #402.

@dlemstra - any success so far with OSS-Fuzz integration ?

[dlemstra]

Been away for the whole last month. Haven't given it a try yet. Hope I will be able to work on this in a couple weeks.

[inferno-chromium]

Thanks @dlemstra

[dlemstra]

Could you reopen this issue and assign it to me @inferno-chromium? I lost track of this again.

[inferno-chromium]

@dlemstra - can't assign it to you, but lets keep this open for tracking.

[alex]

This can be closed now, it's happening!