Checklist bảo mật và fuzzing

#include <stdint.h>
#include <stddef.h>
#include <string.h>

/* Khung: [1 byte loai][1 byte do dai][du lieu]. Tra ve 0 hoac -1. */
int phan_tich(const uint8_t *du_lieu, size_t co) {
    if (co < 2) return -1;
    uint8_t loai   = du_lieu[0];
    uint8_t do_dai = du_lieu[1];
    (void)loai;

    char bo_dem[16];
    /* LOI: khong kiem tra do_dai so voi 16 hay so voi co */
    memcpy(bo_dem, du_lieu + 2, do_dai);
    return bo_dem[0];
}

#include <stdint.h>
#include <stddef.h>

int phan_tich(const uint8_t *du_lieu, size_t co);

/* libFuzzer goi ham nay HANG TRIEU lan voi du_lieu tu sinh. */
int LLVMFuzzerTestOneInput(const uint8_t *du_lieu, size_t co) {
    phan_tich(du_lieu, co);
    return 0;                       /* luon tra ve 0 */
}

# AFL doc dau vao tu STDIN hoac tu mot tep, nen chuong trinh cua
# ban giu nguyen main() binh thuong. Chi can dich lai bang trinh
# bao boc cua AFL de no chen do do phu:

afl-clang-fast -g -fsanitize=address phan_tich.c chinh.c -o ct

# Tao thu muc hat giong va thu muc ket qua:
mkdir hat_giong ket_qua
printf '\x01\x03abc' > hat_giong/hop_le

# Chay:
afl-fuzz -i hat_giong -o ket_qua -- ./ct @@
#   @@ duoc thay bang ten tep dau vao ma AFL sinh ra

# Man hinh AFL cho thay: so lan chay/giay, so duong da kham pha,
# so lan sap tim duoc. Cac dau vao gay sap nam trong
# ket_qua/crashes/, chay lai duoc de go loi.

# So sanh:
#   libFuzzer  trong tien trinh, nhanh nhat, can viet harness
#   AFL++      ngoai tien trinh, khong can doi ma, ben hon
#              voi chuong trinh phuc tap

/* Ham cong khai, nhan mat khau, dung roi xoa. */
void xu_ly(char *mat_khau_ra) {
    char tam[32];
    strncpy(tam, mat_khau_ra, sizeof tam - 1);
    tam[sizeof tam - 1] = 0;
    for (size_t i = 0; i < sizeof tam; ++i)
        mat_khau_ra[i] = tam[i] ^ 0x5A;     /* gia su bam */
    memset(tam, 0, sizeof tam);             /* xoa dau vet */
}

/* Xoa an toan: khong bi toi uu, vi con tro volatile. */
void xoa_an_toan(void *p, size_t n) {
    volatile unsigned char *v = (volatile unsigned char *)p;
    while (n--) *v++ = 0;
}

void xu_ly(char *mk) {
    char tam[32];
    strncpy(tam, mk, sizeof tam - 1);
    tam[sizeof tam - 1] = 0;
    for (size_t i = 0; i < sizeof tam; ++i) mk[i] = tam[i] ^ 0x5A;
    xoa_an_toan(tam, sizeof tam);       /* KHONG bi toi uu */
}