Google yakavhurwa munguva pfupi yapfuura kuburitswa kwe Atheris chirongwa, inova budiriro ye seti yeakavhurika sosi maturusi nyanzvi yekuedza kusanzwisisika kwePython kodhi uye zvinongedzo zveCCython zvakanyorwa muC / C ++.
Iyo purojekiti inoshandisa libFuzzer yakavakirwa injini uye inogona kushandiswa pamwe chete neKero Sanitizer uye Undefined Behaeve Sanitizer maturusi ekuona zvimwe zvikanganiso. Iyo kodhi yakavhurwa pasi peiyo Apache 2.0 rezinesi.
NezveGoogle Atheris
Mumashoko eGoogle Atheris, ibhuku rekushandisa iro rinogona kushandiswa kutsvaga otomatiki zvikanganiso muPython kodhi uye ekuwedzera ekuwedzera. Atheris ndeye 'kufukidza inotyairwa' fuzzer, zvinoreva kuti Atheris anozoedza kakawanda zvigadzirwa zvakasiyana kuchirongwa chako achitarisa ichimhanya uye kuyedza kutsvaga nzira dzinonakidza.
Code kodhi ye Python 2.7 uye Python 3.3+ inotsigirwa, asi pakuvhara kwakazara kwakatungamirwa, zvinokurudzirwa kushandisa iyo Python 3.8 uye 3.9 matavi, ayo ave kutsigira opcode manhamba neopcode.
Mukuita, Atheris inonyora kusanganisa kusanganisa kwedata rekuisa uye inogadzira mushumo pane zvese zvakaonekwa zvikanganiso uye zvisingawanikwe.
Semuenzaniso, kana uchitarisa raibhurari yekuparadzanisa yeYAML muAtheris, zvakaonekwa kuti mamwe maYAML anovaka, senge kutsanangura "-_" pachinzvimbo chekukosha kwenhamba kana kushandisa runyorwa pachinzvimbo chekiyi, kanda chisaririra chisingatarisirwe pane YAMLErrors mwero kukanganisa.
Iyo fuzz bvunzo inzira inozivikanwa yekutsvaga zvikanganiso zvehurongwa. Mazhinji emakanganiso aya anoonekwa ane zvakakomba kuchengetedzeka. Google yawana zviuru zvekuchengetedzeka uye zvimwe zvipenga kana uchishandisa nzira iyi. Fuzzing inowanzo shandiswa mumitauro yemuno seC kana C ++, asi gore rapfuura takagadzira nyowani Python fuzzing injini. Nhasi, isu takaburitsa iyo Atheris fuzzing injini seyakavhurwa sosi.
Atheris inogona zvakare kushandiswa kuona kusiyana kwehunhu emaraibhurari anotarisa zvakafanana mabasa. Semuenzaniso, pfupiso cheki yeiyo Python package "idna" uye raibhurari "libidn2", iyo inoita basa rekumisikidza mazita epasirese epasi rose, vakaona kuti havawanzo gadzira mhedzisiro yakafanana.
Imwe yemashandisirwo akanakisa eAtheris ndeyemisiyano yekuparadzira Aya mafuzzers anotarisa misiyano mumaitiro emaraibhurari maviri anoitirwa kuita zvakafanana. Mumwe weye muenzaniso fuzzers akasungwa neAtheris anoita chaizvo izvi kuenzanisa Python's "idna" package ne C "libidn2" package.
Kunyanya, kana dura racho rakashandisa Unicode kuteedzana, ipapo "idna" uye "libidn2" zvakashandura zita repasi rose rezita kuva akasiyana mauto.
Kazhinji, Atheris inobatsira mune yakachena Python kodhi chero bedzi iine nzira yekuratidza kuti chii "chakarurama" maitiro, kana zvirinani kuratidza kuti ndeapi maitiro asiri echokwadi. Izvi zvinogona kuve zvakaoma seyakajairika kodhi mune iyo fuzzer iyo inoongorora iko kweicho raibhurari kuburitsa, kana yakapusa sekutarisa kuti hapana zvisingatarisirwi zvinosara zvinomutswa.
Zvakakosha kufunga nezve izvo fuzzing bvunzo dzinogadzira rukova rwemarudzi ese emhando dzakasarudzika dzekusanganisa dhata yekuisa, padhuze neiyo chaiyo data (semuenzaniso html mapeji ane yakasarudzika tag parameter, mafaera kana mifananidzo ine isina kujairika misoro, nezvimwewo) uye gadzirisa zvingangoita glitches mukuita.
Kana chero kuteedzana kuchikonzera kunze kana kusingaenderane nemhinduro inotarisirwa, hunhu uhwu hunogona kuratidza bug kana kutambura.
Pakupedzisira, sezvakataurwa Atheris inoshanda ne Python kodhi mushanduro 2.7 uye 3.3+, kunyangwe Google ichikurudzira zvine simba kushandisa 3.8+ uye zviwanikwa zvekuwedzera zvakanyorerwa CPython.
Windows haisati iri pakati peanoshanda masystem anoshanda, saka injini inongofarira veLinux uye Mac OS X vashandisi izvozvi.
Kuti uishandise pamapuratifomu, vagadziri vanofanirwa kuve neiyo yazvino vhezheni yeClang compiler kumberi yakaiswa.
Kana iwe uchida kuziva zvakawanda nezvazvo, unogona kutarisa chinyorwa chekutanga mu inotevera chinongedzo.