diff --git a/Modules/_xxtestfuzz/dictionaries/fuzz_marshal.dict b/Modules/_xxtestfuzz/dictionaries/fuzz_marshal.dict new file mode 100644 index 00000000000000..3ac1e4ed01d2e8 --- /dev/null +++ b/Modules/_xxtestfuzz/dictionaries/fuzz_marshal.dict @@ -0,0 +1,53 @@ +# marshal type codes (with and without the 0x80 REF flag) and structure tokens +"N" +"F" +"T" +"S" +"i" +"I" +"f" +"g" +"x" +"y" +"A" +"s" +"t" +"u" +"r" +"e" +"c" +"(" +"[" +"{" +"<" +">" +")" +"0" +"C" +"w" +"\x80" +"\x81" +"\x84" +"\x88" +"\x89" +"\x8a" +"\x8d" +"\x8e" +"\x91" +"\xa0" +"\xa1" +"\xa2" +"\xa3" +"\xa4" +"\xa5" +"\xa6" +"\xa7" +"\xa8" +"\xa9" +"\xc0" +"\xc1" +"\xe0" +"\xe9" +"ab" +"aaa" +"\x00\x01" diff --git a/Modules/_xxtestfuzz/dictionaries/fuzz_pickle.dict b/Modules/_xxtestfuzz/dictionaries/fuzz_pickle.dict new file mode 100644 index 00000000000000..2e705efa49fce9 --- /dev/null +++ b/Modules/_xxtestfuzz/dictionaries/fuzz_pickle.dict @@ -0,0 +1,71 @@ +# pickle opcode bytes (protocol 0-5) and typical atoms +"\x80" +"\x80\x02" +"\x80\x04" +"\x80\x05" +"(" +")" +"]" +"}" +"." +"t" +"G" +"X" +"U" +"T" +"V" +"S" +"C" +"B" +"L" +"K" +"M" +"J" +"F" +"I" +"o" +"i" +"R" +"P" +"Q" +"N" +"e" +"a" +"s" +"u" +"r" +"p" +"q" +"h" +"j" +"0" +"1" +"g" +"f" +"\x8a" +"\x8b" +"\x8c" +"\x8d" +"\x8e" +"\x8f" +"\x90" +"\x91" +"\x92" +"\x93" +"\x94" +"\x95" +"\x96" +"\x97" +"\x98" +"builtins" +"__main__" +"copyreg" +"_reconstructor" +"collections" +"OrderedDict" +"defaultdict" +"encode" +"loads" +"\x8cbuiltins" +"\x8cdict" +"\x94" diff --git a/Modules/_xxtestfuzz/fuzz_marshal_corpus/big_tuple_v4.marshal b/Modules/_xxtestfuzz/fuzz_marshal_corpus/big_tuple_v4.marshal new file mode 100644 index 00000000000000..90dd1b28543409 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_marshal_corpus/big_tuple_v4.marshal differ diff --git a/Modules/_xxtestfuzz/fuzz_marshal_corpus/code_nested_v4.marshal b/Modules/_xxtestfuzz/fuzz_marshal_corpus/code_nested_v4.marshal new file mode 100644 index 00000000000000..a6e08893ba1ac9 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_marshal_corpus/code_nested_v4.marshal differ diff --git a/Modules/_xxtestfuzz/fuzz_marshal_corpus/code_object_v4.marshal b/Modules/_xxtestfuzz/fuzz_marshal_corpus/code_object_v4.marshal new file mode 100644 index 00000000000000..c3e16fc62aea04 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_marshal_corpus/code_object_v4.marshal differ diff --git a/Modules/_xxtestfuzz/fuzz_marshal_corpus/containers_v2.marshal b/Modules/_xxtestfuzz/fuzz_marshal_corpus/containers_v2.marshal new file mode 100644 index 00000000000000..a30df32ed72288 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_marshal_corpus/containers_v2.marshal differ diff --git a/Modules/_xxtestfuzz/fuzz_marshal_corpus/containers_v3.marshal b/Modules/_xxtestfuzz/fuzz_marshal_corpus/containers_v3.marshal new file mode 100644 index 00000000000000..30eff82157ba71 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_marshal_corpus/containers_v3.marshal differ diff --git a/Modules/_xxtestfuzz/fuzz_marshal_corpus/containers_v4.marshal b/Modules/_xxtestfuzz/fuzz_marshal_corpus/containers_v4.marshal new file mode 100644 index 00000000000000..1839a3c9e04527 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_marshal_corpus/containers_v4.marshal differ diff --git a/Modules/_xxtestfuzz/fuzz_marshal_corpus/float_variants_v4.marshal b/Modules/_xxtestfuzz/fuzz_marshal_corpus/float_variants_v4.marshal new file mode 100644 index 00000000000000..d430ae22d4d5a0 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_marshal_corpus/float_variants_v4.marshal differ diff --git a/Modules/_xxtestfuzz/fuzz_marshal_corpus/negative_and_huge_ints_v4.marshal b/Modules/_xxtestfuzz/fuzz_marshal_corpus/negative_and_huge_ints_v4.marshal new file mode 100644 index 00000000000000..198f649326c5d1 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_marshal_corpus/negative_and_huge_ints_v4.marshal differ diff --git a/Modules/_xxtestfuzz/fuzz_marshal_corpus/recursive_list_v4.marshal b/Modules/_xxtestfuzz/fuzz_marshal_corpus/recursive_list_v4.marshal new file mode 100644 index 00000000000000..b4f6d3c06906fc Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_marshal_corpus/recursive_list_v4.marshal differ diff --git a/Modules/_xxtestfuzz/fuzz_marshal_corpus/strings_v2.marshal b/Modules/_xxtestfuzz/fuzz_marshal_corpus/strings_v2.marshal new file mode 100644 index 00000000000000..5bd92b22019b12 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_marshal_corpus/strings_v2.marshal differ diff --git a/Modules/_xxtestfuzz/fuzz_marshal_corpus/strings_v3.marshal b/Modules/_xxtestfuzz/fuzz_marshal_corpus/strings_v3.marshal new file mode 100644 index 00000000000000..168cd577dffd3e Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_marshal_corpus/strings_v3.marshal differ diff --git a/Modules/_xxtestfuzz/fuzz_marshal_corpus/strings_v4.marshal b/Modules/_xxtestfuzz/fuzz_marshal_corpus/strings_v4.marshal new file mode 100644 index 00000000000000..6a0efd9d02d6bf Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_marshal_corpus/strings_v4.marshal differ diff --git a/Modules/_xxtestfuzz/fuzz_marshal_corpus/types_v2.marshal b/Modules/_xxtestfuzz/fuzz_marshal_corpus/types_v2.marshal new file mode 100644 index 00000000000000..f26caf7e5da241 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_marshal_corpus/types_v2.marshal differ diff --git a/Modules/_xxtestfuzz/fuzz_marshal_corpus/types_v3.marshal b/Modules/_xxtestfuzz/fuzz_marshal_corpus/types_v3.marshal new file mode 100644 index 00000000000000..0c289c6a738f6d Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_marshal_corpus/types_v3.marshal differ diff --git a/Modules/_xxtestfuzz/fuzz_marshal_corpus/types_v4.marshal b/Modules/_xxtestfuzz/fuzz_marshal_corpus/types_v4.marshal new file mode 100644 index 00000000000000..fdab933222b7bd Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_marshal_corpus/types_v4.marshal differ diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/basic_dict_p0.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/basic_dict_p0.pickle new file mode 100644 index 00000000000000..70f4a59d80db04 --- /dev/null +++ b/Modules/_xxtestfuzz/fuzz_pickle_corpus/basic_dict_p0.pickle @@ -0,0 +1,27 @@ +(dp0 +Valpha +p1 +I1 +sVbeta +p2 +(lp3 +F2.5 +aVx +p4 +ac_codecs +encode +p5 +(Vy +p6 +Vlatin1 +p7 +tp8 +Rp9 +aNaI01 +aI00 +asVgamma +p10 +(I1 +I2 +tp11 +s. \ No newline at end of file diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/basic_dict_p1.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/basic_dict_p1.pickle new file mode 100644 index 00000000000000..4e0833c8417466 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_pickle_corpus/basic_dict_p1.pickle differ diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/basic_dict_p2.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/basic_dict_p2.pickle new file mode 100644 index 00000000000000..8aa587dcf8ab08 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_pickle_corpus/basic_dict_p2.pickle differ diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/basic_dict_p3.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/basic_dict_p3.pickle new file mode 100644 index 00000000000000..138916f1e08729 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_pickle_corpus/basic_dict_p3.pickle differ diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/basic_dict_p4.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/basic_dict_p4.pickle new file mode 100644 index 00000000000000..514bbed0808ca7 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_pickle_corpus/basic_dict_p4.pickle differ diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/basic_dict_p5.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/basic_dict_p5.pickle new file mode 100644 index 00000000000000..980e794161ac47 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_pickle_corpus/basic_dict_p5.pickle differ diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/bytes_and_bytearray.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/bytes_and_bytearray.pickle new file mode 100644 index 00000000000000..23f30ad629b918 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_pickle_corpus/bytes_and_bytearray.pickle differ diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/complex_and_ellipsis.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/complex_and_ellipsis.pickle new file mode 100644 index 00000000000000..9245e3bd3a8459 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_pickle_corpus/complex_and_ellipsis.pickle differ diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/empty_stream_variants.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/empty_stream_variants.pickle new file mode 100644 index 00000000000000..ebcd9b56446573 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_pickle_corpus/empty_stream_variants.pickle differ diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/float_values.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/float_values.pickle new file mode 100644 index 00000000000000..3cd750d01307ae Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_pickle_corpus/float_values.pickle differ diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/framed_proto4.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/framed_proto4.pickle new file mode 100644 index 00000000000000..42a395ed247be0 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_pickle_corpus/framed_proto4.pickle differ diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/global_ref_type.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/global_ref_type.pickle new file mode 100644 index 00000000000000..f0abfbc055dc90 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_pickle_corpus/global_ref_type.pickle differ diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/long_int.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/long_int.pickle new file mode 100644 index 00000000000000..b9048d77029f0b Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_pickle_corpus/long_int.pickle differ diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/memo_reuse.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/memo_reuse.pickle new file mode 100644 index 00000000000000..59918eb3e138af Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_pickle_corpus/memo_reuse.pickle differ diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/neg_int_p2.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/neg_int_p2.pickle new file mode 100644 index 00000000000000..7c0dd063998e8f --- /dev/null +++ b/Modules/_xxtestfuzz/fuzz_pickle_corpus/neg_int_p2.pickle @@ -0,0 +1 @@ +€Jë2¤ø. \ No newline at end of file diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/nested_p0.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/nested_p0.pickle new file mode 100644 index 00000000000000..bf547bace5dbaf --- /dev/null +++ b/Modules/_xxtestfuzz/fuzz_pickle_corpus/nested_p0.pickle @@ -0,0 +1,41 @@ +(dp0 +Vlist +p1 +(lp2 +I1 +a(lp3 +I2 +a(lp4 +I3 +a(dp5 +Vdeep +p6 +(I4 +I5 +tp7 +saaasVset +p8 +c__builtin__ +set +p9 +((lp10 +I1 +aI2 +aI3 +atp11 +Rp12 +sVfrozenset +p13 +c__builtin__ +frozenset +p14 +((lp15 +Va +p16 +aVb +p17 +aVc +p18 +atp19 +Rp20 +s. \ No newline at end of file diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/nested_p1.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/nested_p1.pickle new file mode 100644 index 00000000000000..b09ac0c5063f82 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_pickle_corpus/nested_p1.pickle differ diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/nested_p2.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/nested_p2.pickle new file mode 100644 index 00000000000000..ff66986ca95f1e Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_pickle_corpus/nested_p2.pickle differ diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/nested_p3.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/nested_p3.pickle new file mode 100644 index 00000000000000..3c66a18b518ad2 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_pickle_corpus/nested_p3.pickle differ diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/nested_p4.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/nested_p4.pickle new file mode 100644 index 00000000000000..1bededb0b8487d Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_pickle_corpus/nested_p4.pickle differ diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/nested_p5.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/nested_p5.pickle new file mode 100644 index 00000000000000..8283c4c792a24b Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_pickle_corpus/nested_p5.pickle differ diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/proto0_text.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/proto0_text.pickle new file mode 100644 index 00000000000000..794fd76efb88a0 --- /dev/null +++ b/Modules/_xxtestfuzz/fuzz_pickle_corpus/proto0_text.pickle @@ -0,0 +1,12 @@ +(dp0 +Vkey +p1 +Vvalue +p2 +sVn +p3 +(lp4 +I1 +aI2 +aI3 +as. \ No newline at end of file diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/recursive_list.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/recursive_list.pickle new file mode 100644 index 00000000000000..aad58cf463cf4c Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_pickle_corpus/recursive_list.pickle differ diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/stopiteration_and_range.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/stopiteration_and_range.pickle new file mode 100644 index 00000000000000..c2b9ccb857dea3 Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_pickle_corpus/stopiteration_and_range.pickle differ diff --git a/Modules/_xxtestfuzz/fuzz_pickle_corpus/unicode_strs.pickle b/Modules/_xxtestfuzz/fuzz_pickle_corpus/unicode_strs.pickle new file mode 100644 index 00000000000000..58312d5d0d3f7b Binary files /dev/null and b/Modules/_xxtestfuzz/fuzz_pickle_corpus/unicode_strs.pickle differ diff --git a/Modules/_xxtestfuzz/fuzz_tests.txt b/Modules/_xxtestfuzz/fuzz_tests.txt index ea6f982eefc9da..84657d358274d6 100644 --- a/Modules/_xxtestfuzz/fuzz_tests.txt +++ b/Modules/_xxtestfuzz/fuzz_tests.txt @@ -9,3 +9,5 @@ fuzz_struct_unpack fuzz_ast_literal_eval fuzz_elementtree_parsewhole fuzz_pycompile +fuzz_marshal +fuzz_pickle diff --git a/Modules/_xxtestfuzz/fuzzer.c b/Modules/_xxtestfuzz/fuzzer.c index 8c2d0e93cd72d4..a91659da38a3d6 100644 --- a/Modules/_xxtestfuzz/fuzzer.c +++ b/Modules/_xxtestfuzz/fuzzer.c @@ -17,6 +17,7 @@ #include #include #include +#include /* PyMarshal_ReadObjectFromString for fuzz_marshal */ /* Fuzz PyFloat_FromString as a proxy for float(str). */ static int fuzz_builtin_float(const char* data, size_t size) { @@ -595,6 +596,125 @@ static int _run_fuzz(const uint8_t *data, size_t size, int(*fuzzer)(const char* return rv; } +#define MAX_DESERIALISE_TEST_SIZE 0x100000 + +/* Fuzz marshal.loads() via PyMarshal_ReadObjectFromString. marshal is the + deserialiser behind .pyc files and marshal.dumps()/loads(); unmarshalling + attacker-supplied bytes must stay memory-safe (invalid type tags, negative + or oversized length fields, dangling ref tags, malformed code objects). */ +static int fuzz_marshal(const char* data, size_t size) { + if (size > MAX_DESERIALISE_TEST_SIZE) { + return 0; + } + PyObject* obj = PyMarshal_ReadObjectFromString(data, (Py_ssize_t)size); + if (obj == NULL) { + /* Expected for attacker-controlled bytes: truncated streams raise + EOFError, invalid tags raise ValueError, malformed code objects + raise TypeError, deeply nested data raises RecursionError and + oversized length fields raise MemoryError. */ + if (PyErr_ExceptionMatches(PyExc_EOFError) || + PyErr_ExceptionMatches(PyExc_ValueError) || + PyErr_ExceptionMatches(PyExc_TypeError) || + PyErr_ExceptionMatches(PyExc_RecursionError) || + PyErr_ExceptionMatches(PyExc_MemoryError)) + { + PyErr_Clear(); + } + } + Py_XDECREF(obj); + return 0; +} + +/* Fuzz the C unpickler over attacker-controlled bytes: pickle is the classic + "never unpickle untrusted data" surface. The load loop stays in C (we + subclass the C _pickle.Unpickler); find_class is overridden to raise so + mutated payloads cannot import arbitrary modules or execute code inside + the fuzzer process, while every opcode-handling code path (stack/memo + manipulation, string and framing parsing, object reconstruction) remains + covered. Memory-safety bugs still crash the sanitizer. */ +static PyObject* pickle_bytesio_type = NULL; +static PyObject* safe_unpickler_type = NULL; + +static const char* safe_unpickler_code = + "class _SafeUnpickler(_pickle.Unpickler):\n" + " def find_class(self, module, name):\n" + " raise _pickle.UnpicklingError('find_class is disabled')\n"; + +/* Called by LLVMFuzzerTestOneInput for initialization */ +static int init_pickle(void) { + PyObject* pickle_module = PyImport_ImportModule("_pickle"); + if (pickle_module == NULL) { + return 0; + } + PyObject* io_module = PyImport_ImportModule("io"); + if (io_module == NULL) { + Py_DECREF(pickle_module); + return 0; + } + pickle_bytesio_type = PyObject_GetAttrString(io_module, "BytesIO"); + Py_DECREF(io_module); + if (pickle_bytesio_type == NULL) { + Py_DECREF(pickle_module); + return 0; + } + + /* Create the restricted Unpickler subclass once. */ + PyObject* globals = PyDict_New(); + if (globals == NULL) { + Py_DECREF(pickle_module); + return 0; + } + if (PyDict_SetItemString(globals, "_pickle", pickle_module) < 0) { + Py_DECREF(globals); + Py_DECREF(pickle_module); + return 0; + } + PyObject* result = PyRun_String(safe_unpickler_code, Py_file_input, + globals, globals); + Py_DECREF(pickle_module); /* the new class holds its own references */ + if (result != NULL) { + Py_DECREF(result); + safe_unpickler_type = PyDict_GetItemString(globals, "_SafeUnpickler"); + Py_XINCREF(safe_unpickler_type); + } + Py_DECREF(globals); + return safe_unpickler_type != NULL; +} + +/* Fuzz _pickle.Unpickler.load() over untrusted bytes */ +static int fuzz_pickle(const char* data, size_t size) { + if (size > MAX_DESERIALISE_TEST_SIZE) { + return 0; + } + PyObject* input = PyObject_CallFunction(pickle_bytesio_type, "y#", + data, (Py_ssize_t)size); + if (input == NULL) { + PyErr_Print(); + abort(); + } + PyObject* unpickler = PyObject_CallFunctionObjArgs(safe_unpickler_type, + input, NULL); + Py_DECREF(input); + if (unpickler == NULL) { + PyErr_Print(); + abort(); + } + PyObject* result = PyObject_CallMethod(unpickler, "load", NULL); + Py_DECREF(unpickler); + if (result == NULL) { + /* Expected for attacker-controlled pickle bytes: invalid streams + raise UnpicklingError/EOFError, and object reconstruction (REDUCE, + SETSTATE, APPEND on built-in containers) can raise arbitrary + exceptions. Python-level failures are cleared here; memory-safety + bugs in the opcode machinery still crash the sanitizer. */ + PyErr_Clear(); + } else { + Py_DECREF(result); + } + return 0; +} + + /* CPython generates a lot of leak warnings for whatever reason. */ int __lsan_is_turned_off(void) { return 1; } @@ -726,6 +846,20 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { #endif #if !defined(_Py_FUZZ_ONE) || defined(_Py_FUZZ_fuzz_pycompile) rv |= _run_fuzz(data, size, fuzz_pycompile); +#endif +#if !defined(_Py_FUZZ_ONE) || defined(_Py_FUZZ_fuzz_marshal) + rv |= _run_fuzz(data, size, fuzz_marshal); +#endif +#if !defined(_Py_FUZZ_ONE) || defined(_Py_FUZZ_fuzz_pickle) + static int PICKLE_INITIALIZED = 0; + if (!PICKLE_INITIALIZED && !init_pickle()) { + PyErr_Print(); + abort(); + } else { + PICKLE_INITIALIZED = 1; + } + + rv |= _run_fuzz(data, size, fuzz_pickle); #endif return rv; }