From 75d4433067872c053a1e1165a115b879c9661c2e Mon Sep 17 00:00:00 2001 From: matl4c <32888037+matl4c@users.noreply.github.com> Date: Thu, 22 Dec 2022 18:31:49 -0500 Subject: [PATCH 1/9] added mayhem support --- .github/workflows/mayhem.yml | 77 ++++++++++++++++++++++++++++++++++++ mayhem/Dockerfile | 12 ++++++ mayhem/Mayhemfile | 8 ++++ mayhem/fuzz-codext.py | 26 ++++++++++++ 4 files changed, 123 insertions(+) create mode 100644 .github/workflows/mayhem.yml create mode 100644 mayhem/Dockerfile create mode 100644 mayhem/Mayhemfile create mode 100755 mayhem/fuzz-codext.py diff --git a/.github/workflows/mayhem.yml b/.github/workflows/mayhem.yml new file mode 100644 index 0000000..e2e511a --- /dev/null +++ b/.github/workflows/mayhem.yml @@ -0,0 +1,77 @@ +name: Mayhem +on: + push: + pull_request: + workflow_dispatch: + +env: + REGISTRY: ghcr.io + IMAGE_NAME: ${{ github.repository }} + +jobs: + build: + name: '${{ matrix.os }} shared=${{ matrix.shared }} ${{ matrix.build_type }}' + runs-on: ${{ matrix.os }} + strategy: + matrix: + os: [ubuntu-latest] + shared: [false] + build_type: [Release] + include: + - os: ubuntu-latest + triplet: x64-linux + + steps: + - uses: actions/checkout@v3 + with: + submodules: recursive + + - name: Log in to the Container registry + uses: docker/login-action@v2.1.0 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract metadata (tags, labels) for Docker + id: meta + uses: docker/metadata-action@v4.1.1 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + + - name: Build and push Docker image + uses: docker/build-push-action@v3.2.0 + with: + context: . + push: true + file: mayhem/Dockerfile + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + + outputs: + image: ${{ steps.meta.outputs.tags }} + + mayhem: + needs: build + name: 'fuzz ${{ matrix.mayhemfile }}' + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + mayhemfile: + - mayhem/Mayhemfile + + steps: + - uses: actions/checkout@v3 + + - name: Start analysis for ${{ matrix.mayhemfile }} + uses: ForAllSecure/mcode-action@v1 + with: + mayhem-token: ${{ secrets.MAYHEM_TOKEN }} + args: --image ${{ needs.build.outputs.image }} --file ${{ matrix.mayhemfile }} --duration 300 + sarif-output: sarif + + - name: Upload SARIF file(s) + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: sarif diff --git a/mayhem/Dockerfile b/mayhem/Dockerfile new file mode 100644 index 0000000..bd33a24 --- /dev/null +++ b/mayhem/Dockerfile @@ -0,0 +1,12 @@ +FROM fuzzers/atheris:2.0.7-python3.9 + +RUN apt-get update + +ADD . /src +WORKDIR /src + +RUN python3 -m pip install --upgrade pip +RUN python3 -m pip install codext +RUN chmod +x /src/mayhem/fuzz-codext.py + +CMD ["/src/mayhem/fuzz-codext.py"] diff --git a/mayhem/Mayhemfile b/mayhem/Mayhemfile new file mode 100644 index 0000000..179af6b --- /dev/null +++ b/mayhem/Mayhemfile @@ -0,0 +1,8 @@ +project: codext +target: fuzz-codext + +image: ghcr.io/matl4c/fuzz-codext:latest + +cmds: + - cmd: /src/mayhem/fuzz-codext.py + libfuzzer: true diff --git a/mayhem/fuzz-codext.py b/mayhem/fuzz-codext.py new file mode 100755 index 0000000..a0f3b7f --- /dev/null +++ b/mayhem/fuzz-codext.py @@ -0,0 +1,26 @@ +#! /usr/bin/python3 + +import atheris +import sys +import io +import random + +with atheris.instrument_imports(): + import codext + +def TestOneInput(input_bytes): + try: + fdp = atheris.FuzzedDataProvider(input_bytes) + data = fdp.ConsumeString(sys.maxsize) + encoded = codext.encode(data, "base128") + except UnicodeDecodeError: + pass + except ValueError: + pass + +def main(): + atheris.Setup(sys.argv, TestOneInput) + atheris.Fuzz() + +if __name__ == "__main__": + main() From bc36750adee25ae71479a5c070270245a005303d Mon Sep 17 00:00:00 2001 From: matl4c <32888037+matl4c@users.noreply.github.com> Date: Thu, 22 Dec 2022 19:29:18 -0500 Subject: [PATCH 2/9] new base --- mayhem/fuzz-codext.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mayhem/fuzz-codext.py b/mayhem/fuzz-codext.py index a0f3b7f..58d97c0 100755 --- a/mayhem/fuzz-codext.py +++ b/mayhem/fuzz-codext.py @@ -12,7 +12,7 @@ def TestOneInput(input_bytes): try: fdp = atheris.FuzzedDataProvider(input_bytes) data = fdp.ConsumeString(sys.maxsize) - encoded = codext.encode(data, "base128") + encoded = codext.encode(data, "base100") except UnicodeDecodeError: pass except ValueError: From 3ae01775ffc7ab77aca6a06b14d409e78b04f645 Mon Sep 17 00:00:00 2001 From: matl4c <32888037+matl4c@users.noreply.github.com> Date: Sat, 24 Dec 2022 12:17:18 -0500 Subject: [PATCH 3/9] changed codext fuzzing --- mayhem/fuzz-codext.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/mayhem/fuzz-codext.py b/mayhem/fuzz-codext.py index 58d97c0..9514508 100755 --- a/mayhem/fuzz-codext.py +++ b/mayhem/fuzz-codext.py @@ -13,6 +13,10 @@ def TestOneInput(input_bytes): fdp = atheris.FuzzedDataProvider(input_bytes) data = fdp.ConsumeString(sys.maxsize) encoded = codext.encode(data, "base100") + decoded = codext.decode(data, "base100") + + if data != decoded: + raise Exception("Logic error") except UnicodeDecodeError: pass except ValueError: From 5acc7182077addf699358ea1b6634579f83c0991 Mon Sep 17 00:00:00 2001 From: matl4c <32888037+matl4c@users.noreply.github.com> Date: Sat, 24 Dec 2022 12:40:16 -0500 Subject: [PATCH 4/9] updated mayhem file --- mayhem/Mayhemfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mayhem/Mayhemfile b/mayhem/Mayhemfile index 179af6b..0f2d2e6 100644 --- a/mayhem/Mayhemfile +++ b/mayhem/Mayhemfile @@ -1,4 +1,4 @@ -project: codext +project: python-codext target: fuzz-codext image: ghcr.io/matl4c/fuzz-codext:latest From 373c25079dc23d4967d54fc956ccf69ccce7d5d7 Mon Sep 17 00:00:00 2001 From: matl4c <32888037+matl4c@users.noreply.github.com> Date: Sat, 24 Dec 2022 14:11:30 -0500 Subject: [PATCH 5/9] updated fuzzer --- mayhem/fuzz-codext.py | 4 ---- 1 file changed, 4 deletions(-) diff --git a/mayhem/fuzz-codext.py b/mayhem/fuzz-codext.py index 9514508..58d97c0 100755 --- a/mayhem/fuzz-codext.py +++ b/mayhem/fuzz-codext.py @@ -13,10 +13,6 @@ def TestOneInput(input_bytes): fdp = atheris.FuzzedDataProvider(input_bytes) data = fdp.ConsumeString(sys.maxsize) encoded = codext.encode(data, "base100") - decoded = codext.decode(data, "base100") - - if data != decoded: - raise Exception("Logic error") except UnicodeDecodeError: pass except ValueError: From d3d18381286d7efcd1681f8b8c4849eb509c008a Mon Sep 17 00:00:00 2001 From: matl4c <32888037+matl4c@users.noreply.github.com> Date: Thu, 29 Dec 2022 21:06:02 -0500 Subject: [PATCH 6/9] increased duration --- .github/workflows/mayhem.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/mayhem.yml b/.github/workflows/mayhem.yml index e2e511a..56881b5 100644 --- a/.github/workflows/mayhem.yml +++ b/.github/workflows/mayhem.yml @@ -68,7 +68,7 @@ jobs: uses: ForAllSecure/mcode-action@v1 with: mayhem-token: ${{ secrets.MAYHEM_TOKEN }} - args: --image ${{ needs.build.outputs.image }} --file ${{ matrix.mayhemfile }} --duration 300 + args: --image ${{ needs.build.outputs.image }} --file ${{ matrix.mayhemfile }} --duration 600 sarif-output: sarif - name: Upload SARIF file(s) From 629be0f3d198fc8405c29978abca1b0bae82ad27 Mon Sep 17 00:00:00 2001 From: matl4c <32888037+matl4c@users.noreply.github.com> Date: Tue, 14 Feb 2023 17:48:14 -0500 Subject: [PATCH 7/9] updated mayhemfile --- mayhem/Mayhemfile | 2 -- 1 file changed, 2 deletions(-) diff --git a/mayhem/Mayhemfile b/mayhem/Mayhemfile index 0f2d2e6..d5140ff 100644 --- a/mayhem/Mayhemfile +++ b/mayhem/Mayhemfile @@ -1,8 +1,6 @@ project: python-codext target: fuzz-codext -image: ghcr.io/matl4c/fuzz-codext:latest - cmds: - cmd: /src/mayhem/fuzz-codext.py libfuzzer: true From b1f0db415e01596a253c72369b557fa228711bce Mon Sep 17 00:00:00 2001 From: Azizjon Rizayev Date: Tue, 28 Apr 2026 02:37:40 +0000 Subject: [PATCH 8/9] Update Mayhem workflow: long-runs, remove SARIF, update checkout to v4 --- .github/workflows/mayhem.yml | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/.github/workflows/mayhem.yml b/.github/workflows/mayhem.yml index 56881b5..c54b8fb 100644 --- a/.github/workflows/mayhem.yml +++ b/.github/workflows/mayhem.yml @@ -22,7 +22,7 @@ jobs: triplet: x64-linux steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 with: submodules: recursive @@ -62,16 +62,11 @@ jobs: - mayhem/Mayhemfile steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - name: Start analysis for ${{ matrix.mayhemfile }} - uses: ForAllSecure/mcode-action@v1 + uses: ForAllSecure/mcode-action@long-runs with: mayhem-token: ${{ secrets.MAYHEM_TOKEN }} args: --image ${{ needs.build.outputs.image }} --file ${{ matrix.mayhemfile }} --duration 600 - sarif-output: sarif - - name: Upload SARIF file(s) - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: sarif From 81544a0e7e831c8ca7690e993f9819b6abc05d18 Mon Sep 17 00:00:00 2001 From: Azizjon Rizayev Date: Thu, 4 Jun 2026 20:24:42 +0000 Subject: [PATCH 9/9] Update Mayhem workflow to use latest action versions --- .github/workflows/mayhem.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/mayhem.yml b/.github/workflows/mayhem.yml index c54b8fb..6b185ad 100644 --- a/.github/workflows/mayhem.yml +++ b/.github/workflows/mayhem.yml @@ -22,12 +22,12 @@ jobs: triplet: x64-linux steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6.0.2 with: submodules: recursive - name: Log in to the Container registry - uses: docker/login-action@v2.1.0 + uses: docker/login-action@v4.1.0 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -35,12 +35,12 @@ jobs: - name: Extract metadata (tags, labels) for Docker id: meta - uses: docker/metadata-action@v4.1.1 + uses: docker/metadata-action@v6.0.0 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - name: Build and push Docker image - uses: docker/build-push-action@v3.2.0 + uses: docker/build-push-action@v7.1.0 with: context: . push: true @@ -62,10 +62,10 @@ jobs: - mayhem/Mayhemfile steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6.0.2 - name: Start analysis for ${{ matrix.mayhemfile }} - uses: ForAllSecure/mcode-action@long-runs + uses: forallsecure/mcode-action@long-runs with: mayhem-token: ${{ secrets.MAYHEM_TOKEN }} args: --image ${{ needs.build.outputs.image }} --file ${{ matrix.mayhemfile }} --duration 600