Fuzzing for fun - unauthenticated denial of service in snac2

Summary

Instead of manually inspecting the source code further, I've decided to employ a technique known as fuzzing in order to find inputs that may crash the parser (located in xs_json.h). If you're not familiar with fuzzing, it's essentially a method for testing code by supplying it with randomly generated inputs. In the most basic case, piping /dev/urandom to a program and waiting for it to crash is a very primitive form of fuzzing. However, for more complex programs, just piping /dev/urandom to a program is going to be very inefficient, and will most likely take a very long time to detect some more complex patterns leading to crashes. Therefore, dedicated fuzzing programs such as AFL++ generate new inputs by using an initial corpus of valid inputs, which are continuously mutated through multiple strategies, employing a relatively complex genetic algorithm. Moreover, by employing compile-time binary instrumentation, a set of modified compilers can insert AFL-specific instructions, that can inform the fuzzer on how many functions and code paths are reached with a given input. Ultimately, this approach allows fuzzers to test as many available code paths as possible. This approach is so powerful, that even with a very trivial input corpus, AFL++ can start pulling JPEGs out of thin air when fuzzing a complete JPEG parser. In snac2 project, I've decided to fuzz the xs_json_load function, which parses JSON data stored as a file (the fact that internally snac2 treats all data streams as FILE pointers is pretty fascinating too). In order to do that, I had to prepare a fuzzing harness - a very simple program which exposes the tested function to the fuzzer. In case of AFL++, I just needed a simple C program which reads a file path from argv[1], opens it, passes it to the parser, and then frees the result: #include <stdio.h> #define XS_IMPLEMENTATION #include "xs.h" #include "xs_json.h" int main(int argc, char **argv) { if(argc < 2) return 0; FILE *f = fopen(argv[1], "r"); xs_val *...