From 7409b02d08c1ca3057305b568a90c6d2773fef47 Mon Sep 17 00:00:00 2001 From: headshog Date: Thu, 25 Sep 2025 14:52:00 +0300 Subject: [PATCH 1/5] Add ollama --- projects/goblin/directed_target/config.toml | 32 ++ projects/goblin/parse-afl++.toml | 2 +- projects/goblin/parse-libafl.toml | 2 +- projects/goblin/parse_elf-libafl.toml | 2 +- projects/image-go/gif-libafl.toml | 2 +- projects/image-go/jpeg-libafl.toml | 2 +- projects/image-go/png-libafl.toml | 2 +- projects/image-go/tiff-libafl.toml | 2 +- projects/image-go/webp-libafl.toml | 2 +- projects/ollama/Dockerfile | 50 +++ projects/ollama/Dockerfile_libafl | 74 +++++ projects/ollama/README.md | 142 +++++++++ projects/ollama/build.sh | 72 +++++ projects/ollama/convert_tokenizer-lf.toml | 28 ++ projects/ollama/convert_tokenizer-libafl.toml | 30 ++ projects/ollama/convert_tokenizer_sydr.go | 12 + projects/ollama/convert_vocabulary-lf.toml | 28 ++ .../ollama/convert_vocabulary-libafl.toml | 30 ++ projects/ollama/convert_vocabulary_sydr.go | 12 + projects/ollama/corpus.zip | Bin 0 -> 37213 bytes projects/ollama/directed_target/Makefile.toml | 229 ++++++++++++++ .../config_convert_tokenizer.toml | 19 ++ .../config_convert_vocabulary.toml | 19 ++ .../directed_target/config_model_decode.toml | 19 ++ .../directed_target/config_model_encode.toml | 19 ++ .../config_parser_parsefile.toml | 19 ++ .../config_server_manifest.toml | 19 ++ .../config_server_newlayer.toml | 19 ++ .../config_thinking_content.toml | 19 ++ .../directed_target/config_thinking_eat.toml | 19 ++ .../config_thinking_state.toml | 19 ++ projects/ollama/fuzz.go | 299 ++++++++++++++++++ projects/ollama/model_decode-lf.toml | 28 ++ projects/ollama/model_decode-libafl.toml | 30 ++ projects/ollama/model_decode_sydr.go | 12 + projects/ollama/model_encode-lf.toml | 28 ++ projects/ollama/model_encode-libafl.toml | 30 ++ projects/ollama/model_encode_sydr.go | 12 + projects/ollama/ollama.patch | 20 ++ projects/ollama/parser_parsefile-lf.toml | 28 ++ projects/ollama/parser_parsefile-libafl.toml | 30 ++ projects/ollama/parser_parsefile_sydr.go | 12 + projects/ollama/server_manifest-lf.toml | 28 ++ projects/ollama/server_manifest-libafl.toml | 30 ++ projects/ollama/server_manifest_sydr.go | 12 + projects/ollama/server_newlayer-lf.toml | 28 ++ projects/ollama/server_newlayer-libafl.toml | 30 ++ projects/ollama/server_newlayer_sydr.go | 12 + projects/ollama/thinking_content-lf.toml | 28 ++ projects/ollama/thinking_content-libafl.toml | 30 ++ projects/ollama/thinking_content_sydr.go | 12 + projects/ollama/thinking_eat-lf.toml | 28 ++ projects/ollama/thinking_eat-libafl.toml | 30 ++ projects/ollama/thinking_eat_sydr.go | 12 + projects/ollama/thinking_state-lf.toml | 28 ++ projects/ollama/thinking_state-libafl.toml | 29 ++ projects/ollama/thinking_state_sydr.go | 12 + 57 files changed, 1815 insertions(+), 8 deletions(-) create mode 100644 projects/ollama/Dockerfile create mode 100644 projects/ollama/Dockerfile_libafl create mode 100644 projects/ollama/README.md create mode 100755 projects/ollama/build.sh create mode 100644 projects/ollama/convert_tokenizer-lf.toml create mode 100644 projects/ollama/convert_tokenizer-libafl.toml create mode 100644 projects/ollama/convert_tokenizer_sydr.go create mode 100644 projects/ollama/convert_vocabulary-lf.toml create mode 100644 projects/ollama/convert_vocabulary-libafl.toml create mode 100644 projects/ollama/convert_vocabulary_sydr.go create mode 100644 projects/ollama/corpus.zip create mode 100644 projects/ollama/directed_target/Makefile.toml create mode 100644 projects/ollama/directed_target/config_convert_tokenizer.toml create mode 100644 projects/ollama/directed_target/config_convert_vocabulary.toml create mode 100644 projects/ollama/directed_target/config_model_decode.toml create mode 100644 projects/ollama/directed_target/config_model_encode.toml create mode 100644 projects/ollama/directed_target/config_parser_parsefile.toml create mode 100644 projects/ollama/directed_target/config_server_manifest.toml create mode 100644 projects/ollama/directed_target/config_server_newlayer.toml create mode 100644 projects/ollama/directed_target/config_thinking_content.toml create mode 100644 projects/ollama/directed_target/config_thinking_eat.toml create mode 100644 projects/ollama/directed_target/config_thinking_state.toml create mode 100644 projects/ollama/fuzz.go create mode 100644 projects/ollama/model_decode-lf.toml create mode 100644 projects/ollama/model_decode-libafl.toml create mode 100644 projects/ollama/model_decode_sydr.go create mode 100644 projects/ollama/model_encode-lf.toml create mode 100644 projects/ollama/model_encode-libafl.toml create mode 100644 projects/ollama/model_encode_sydr.go create mode 100644 projects/ollama/ollama.patch create mode 100644 projects/ollama/parser_parsefile-lf.toml create mode 100644 projects/ollama/parser_parsefile-libafl.toml create mode 100644 projects/ollama/parser_parsefile_sydr.go create mode 100644 projects/ollama/server_manifest-lf.toml create mode 100644 projects/ollama/server_manifest-libafl.toml create mode 100644 projects/ollama/server_manifest_sydr.go create mode 100644 projects/ollama/server_newlayer-lf.toml create mode 100644 projects/ollama/server_newlayer-libafl.toml create mode 100644 projects/ollama/server_newlayer_sydr.go create mode 100644 projects/ollama/thinking_content-lf.toml create mode 100644 projects/ollama/thinking_content-libafl.toml create mode 100644 projects/ollama/thinking_content_sydr.go create mode 100644 projects/ollama/thinking_eat-lf.toml create mode 100644 projects/ollama/thinking_eat-libafl.toml create mode 100644 projects/ollama/thinking_eat_sydr.go create mode 100644 projects/ollama/thinking_state-lf.toml create mode 100644 projects/ollama/thinking_state-libafl.toml create mode 100644 projects/ollama/thinking_state_sydr.go diff --git a/projects/goblin/directed_target/config.toml b/projects/goblin/directed_target/config.toml index 5c28eb733..7267786f8 100644 --- a/projects/goblin/directed_target/config.toml +++ b/projects/goblin/directed_target/config.toml @@ -26,6 +26,38 @@ line = 164 file = "/goblin/src/archive/mod.rs" line = 342 +[[target]] +file = "/goblin/src/elf/mod.rs" +line = 163 + +[[target]] +file = "/goblin/src/elf/mod.rs" +line = 269 + +[[target]] +file = "/goblin/src/elf/mod.rs" +line = 365 + +[[target]] +file = "/goblin/src/mach/mod.rs" +line = 157 + +[[target]] +file = "/goblin/src/mach/mod.rs" +line = 186 + +[[target]] +file = "/goblin/src/mach/mod.rs" +line = 245 + +[[target]] +file = "/goblin/src/pe/mod.rs" +line = 100 + +[[target]] +file = "/goblin/src/pe/mod.rs" +line = 171 + [[target]] file = "/goblin/src/pe/debug.rs" line = 172 diff --git a/projects/goblin/parse-afl++.toml b/projects/goblin/parse-afl++.toml index 149102c93..daa5f92c3 100644 --- a/projects/goblin/parse-afl++.toml +++ b/projects/goblin/parse-afl++.toml @@ -20,7 +20,7 @@ args = "-s 90 --wait-jobs -j2" [aflplusplus] target = "/goblin/fuzz-afl/target/release/afl_parse" -args = "-t 2000+ -i /corpus" +args = "-t 2000 -i /corpus" [cov] target = "/cov_parse @@" diff --git a/projects/goblin/parse-libafl.toml b/projects/goblin/parse-libafl.toml index ef1d5eac1..155e055bd 100644 --- a/projects/goblin/parse-libafl.toml +++ b/projects/goblin/parse-libafl.toml @@ -24,7 +24,7 @@ jobs = 2 [difuzz] path = "/directed_target/sydr/difuzz/libafl_difuzz" target = "/parse_libafl_target @@" -args = "-j4 --sync-limit 200 --sync-jobs 2 -l64 -i /corpus -e /ets_parse.toml" +args = "-j4 --sync-limit 200 --sync-jobs 2 --panic-analysis rust -l64 -i /corpus -e /ets_parse.toml" casr_bin = "/casr_parse" [cov] diff --git a/projects/goblin/parse_elf-libafl.toml b/projects/goblin/parse_elf-libafl.toml index c51837914..3f11cbd0c 100644 --- a/projects/goblin/parse_elf-libafl.toml +++ b/projects/goblin/parse_elf-libafl.toml @@ -24,7 +24,7 @@ jobs = 2 [difuzz] path = "/directed_target/sydr/difuzz/libafl_difuzz" target = "/parse_elf_libafl_target @@" -args = "-j4 --sync-limit 200 --sync-jobs 2 -l64 -i /corpus -e /ets_parse_elf.toml" +args = "-j4 --sync-limit 200 --sync-jobs 2 --panic-analysis rust -l64 -i /corpus -e /ets_parse_elf.toml" casr_bin = "/casr_parse_elf" [cov] diff --git a/projects/image-go/gif-libafl.toml b/projects/image-go/gif-libafl.toml index 729f3e4f8..fafaaf77a 100644 --- a/projects/image-go/gif-libafl.toml +++ b/projects/image-go/gif-libafl.toml @@ -22,7 +22,7 @@ jobs = 2 [difuzz] path = "/directed_target/sydr/difuzz/libafl_difuzz" target = "/difuzz_target_image_gif @@" -args = "-j4 --sync-limit 200 --sync-jobs 2 -l64 -i /go-fuzz-corpus/gif/corpus -e /ets_gif.toml" +args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /go-fuzz-corpus/gif/corpus -e /ets_gif.toml" casr_bin = "/sydr_image_gif" [cov] diff --git a/projects/image-go/jpeg-libafl.toml b/projects/image-go/jpeg-libafl.toml index aca4ec2ff..e823058f8 100644 --- a/projects/image-go/jpeg-libafl.toml +++ b/projects/image-go/jpeg-libafl.toml @@ -22,7 +22,7 @@ jobs = 2 [difuzz] path = "/directed_target/sydr/difuzz/libafl_difuzz" target = "/difuzz_target_image_jpeg @@" -args = "-j4 --sync-limit 200 --sync-jobs 2 -l64 -i /go-fuzz-corpus/jpeg/corpus -e /ets_jpeg.toml" +args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /go-fuzz-corpus/jpeg/corpus -e /ets_jpeg.toml" casr_bin = "/sydr_image_jpeg" [cov] diff --git a/projects/image-go/png-libafl.toml b/projects/image-go/png-libafl.toml index 8b4260af8..1930d8bd6 100644 --- a/projects/image-go/png-libafl.toml +++ b/projects/image-go/png-libafl.toml @@ -22,7 +22,7 @@ jobs = 2 [difuzz] path = "/directed_target/sydr/difuzz/libafl_difuzz" target = "/difuzz_target_image_png @@" -args = "-j4 --sync-limit 200 --sync-jobs 2 -l64 -i /go-fuzz-corpus/png/corpus -e /ets_png.toml" +args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /go-fuzz-corpus/png/corpus -e /ets_png.toml" casr_bin = "/sydr_image_png" [cov] diff --git a/projects/image-go/tiff-libafl.toml b/projects/image-go/tiff-libafl.toml index acfe144e3..c0bf792fc 100644 --- a/projects/image-go/tiff-libafl.toml +++ b/projects/image-go/tiff-libafl.toml @@ -22,7 +22,7 @@ jobs = 2 [difuzz] path = "/directed_target/sydr/difuzz/libafl_difuzz" target = "/difuzz_target_image_tiff @@" -args = "-j4 --sync-limit 200 --sync-jobs 2 -l64 -i /go-fuzz-corpus/tiff/corpus -e /ets_tiff.toml" +args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /go-fuzz-corpus/tiff/corpus -e /ets_tiff.toml" casr_bin = "/sydr_image_tiff" [cov] diff --git a/projects/image-go/webp-libafl.toml b/projects/image-go/webp-libafl.toml index b20f52f6b..c9c9c7093 100644 --- a/projects/image-go/webp-libafl.toml +++ b/projects/image-go/webp-libafl.toml @@ -22,7 +22,7 @@ jobs = 2 [difuzz] path = "/directed_target/sydr/difuzz/libafl_difuzz" target = "/difuzz_target_image_webp @@" -args = "-j4 --sync-limit 200 --sync-jobs 2 -l64 -i /go-fuzz-corpus/webp/corpus -e /ets_webp.toml" +args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /go-fuzz-corpus/webp/corpus -e /ets_webp.toml" casr_bin = "/sydr_image_webp" [cov] diff --git a/projects/ollama/Dockerfile b/projects/ollama/Dockerfile new file mode 100644 index 000000000..3e3161c86 --- /dev/null +++ b/projects/ollama/Dockerfile @@ -0,0 +1,50 @@ +ARG BASE_IMAGE="sydr/ubuntu22.04-sydr-fuzz" +FROM $BASE_IMAGE + +# Clone Ollama. +RUN git clone https://github.com/ollama/ollama.git /ollama + +WORKDIR /ollama + +RUN git checkout 26214125e86ac1d4512dff68c983137589cfddbf + +# Apply patch. +COPY ollama.patch build.sh ./ +RUN git apply ollama.patch + +# Extract corpuses. +COPY corpus.zip / +RUN unzip /corpus.zip -d / + +# Create directories for fuzz targets. +RUN mkdir sydr && cd sydr && mkdir -p convert model parser server thinking + +# Move fuzz targets. +RUN mkdir fuzz +COPY fuzz.go fuzz + +COPY thinking_state_sydr.go sydr/thinking +COPY thinking_eat_sydr.go sydr/thinking +COPY thinking_content_sydr.go sydr/thinking +COPY server_newlayer_sydr.go sydr/server +COPY server_manifest_sydr.go sydr/server +COPY parser_parsefile_sydr.go sydr/parser +COPY model_encode_sydr.go sydr/model +COPY model_decode_sydr.go sydr/model +COPY convert_tokenizer_sydr.go sydr/convert +COPY convert_vocabulary_sydr.go sydr/convert + +# Build GGML. +RUN mkdir -p build && cd build && \ + CC=clang-18 CXX=clang++-18 cmake --preset 'CPU' -DGGML_AVX_VNNI=OFF .. && \ + make -j + +# Install go-fuzz. +RUN go install github.com/dvyukov/go-fuzz/go-fuzz@latest && \ + go install github.com/dvyukov/go-fuzz/go-fuzz-build@latest && \ + go get github.com/dvyukov/go-fuzz/go-fuzz-dep + +# Build targets. +RUN ./build.sh + +WORKDIR / diff --git a/projects/ollama/Dockerfile_libafl b/projects/ollama/Dockerfile_libafl new file mode 100644 index 000000000..1c2f1e219 --- /dev/null +++ b/projects/ollama/Dockerfile_libafl @@ -0,0 +1,74 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +ARG BASE_IMAGE="sydr/ubuntu22.04-sydr-fuzz" +FROM $BASE_IMAGE + +ARG SYDR_ARCHIVE="./sydr.zip" + +WORKDIR / + +# Clone Ollama. +RUN git clone https://github.com/ollama/ollama.git /ollama + +WORKDIR /ollama + +RUN git checkout 26214125e86ac1d4512dff68c983137589cfddbf + +# Apply patch. +COPY ollama.patch build.sh ./ +RUN git apply ollama.patch + +# Extract corpuses. +COPY corpus.zip / +RUN unzip /corpus.zip -d / + +# Create directories for fuzz targets. +RUN mkdir sydr && cd sydr && mkdir -p convert/tokenizer convert/vocabulary \ + model/encode model/decode parser/parsefile server/newlayer server/manifest \ + thinking/state thinking/eat thinking/content + +# Move fuzz targets. +RUN mkdir fuzz +COPY fuzz.go fuzz + +COPY thinking_state_sydr.go sydr/thinking/state/main.go +COPY thinking_eat_sydr.go sydr/thinking/eat/main.go +COPY thinking_content_sydr.go sydr/thinking/content/main.go +COPY server_newlayer_sydr.go sydr/server/newlayer/main.go +COPY server_manifest_sydr.go sydr/server/manifest/main.go +COPY parser_parsefile_sydr.go sydr/parser/parsefile/main.go +COPY model_encode_sydr.go sydr/model/encode/main.go +COPY model_decode_sydr.go sydr/model/decode/main.go +COPY convert_tokenizer_sydr.go sydr/convert/tokenizer/main.go +COPY convert_vocabulary_sydr.go sydr/convert/vocabulary/main.go + +# Build GGML. +RUN mkdir -p build && cd build && \ + CC=clang-18 CXX=clang++-18 cmake --preset 'CPU' -DGGML_AVX_VNNI=OFF .. && \ + make -j + +# Copy LibAFL-DiFuzz target template. +COPY directed_target /directed_target + +WORKDIR /directed_target + +# Build image for LibAFL-DiFuzz. +ADD ${SYDR_ARCHIVE} ./ +RUN unzip -o ${SYDR_ARCHIVE} && rm ${SYDR_ARCHIVE} +RUN OUT_DIR=/ cargo make all + +WORKDIR / diff --git a/projects/ollama/README.md b/projects/ollama/README.md new file mode 100644 index 000000000..c2537c346 --- /dev/null +++ b/projects/ollama/README.md @@ -0,0 +1,142 @@ +# Ollama + +Ollama is an application which lets you run offline large language models locally. + +## Build Docker + + $ sudo docker build -t oss-sydr-fuzz-ollama . + +## Build LibAFL-DiFuzz Docker + +Pass `sydr.zip` as an argument: + + $ sudo docker build --build-arg SYDR_ARCHIVE="sydr.zip" -t oss-sydr-fuzz-libafl-ollama -f ./Dockerfile_libafl . + +## Run Hybrid Fuzzing + +Unzip Sydr (`sydr.zip`) in `projects/ollama` directory: + + $ unzip sydr.zip + +Run docker: + + $ sudo docker run --cap-add=SYS_PTRACE --security-opt seccomp=unconfined -v /etc/localtime:/etc/localtime:ro --rm -it -v $PWD:/fuzz oss-sydr-fuzz-ollama /bin/bash + +Run docker for LibAFL-DiFuzz: + + $ sudo docker run --cap-add=SYS_PTRACE --security-opt seccomp=unconfined -v /etc/localtime:/etc/localtime:ro --rm -it -v $PWD:/fuzz oss-sydr-fuzz-libafl-ollama /bin/bash + +Change directory to `/fuzz`: + + # cd /fuzz + +Run hybrid fuzzing with libfuzzer: + + # sydr-fuzz -c convert_tokenizer-lf.toml run + +Run hybrid fuzzing with LibAFL-DiFuzz: + + # sydr-fuzz -c convert_tokenizer-libafl.toml run + +Minimize corpus (only for libfuzzer): + + # sydr-fuzz -c convert_tokenizer-lf.toml cmin + +Collect coverage: + + # sydr-fuzz -c convert_tokenizer-lf.toml cov-html + # sydr-fuzz -c convert_tokenizer-libafl.toml cov-html + +## Alternative Fuzz Targets + +Ollama project has 10 fuzz targets. + +### convert_vocabulary (libfuzzer) + + # cd /fuzz + # sydr-fuzz -c convert_vocabulary-lf.toml run + +### convert_vocabulary (LibAFL-DiFuzz) + + # cd /fuzz + # sydr-fuzz -c convert_vocabulary-libafl.toml run + +### model_encode (libfuzzer) + + # cd /fuzz + # sydr-fuzz -c model_encode-lf.toml run + +### model_encode (LibAFL-DiFuzz) + + # cd /fuzz + # sydr-fuzz -c model_encode-libafl.toml run + +### model_decode (libfuzzer) + + # cd /fuzz + # sydr-fuzz -c model_decode-lf.toml run + +### model_decode (LibAFL-DiFuzz) + + # cd /fuzz + # sydr-fuzz -c model_encode-libafl.toml run + +### server_manifest (libfuzzer) + + # cd /fuzz + # sydr-fuzz -c server_manifest-lf.toml run + +### server_manifest (LibAFL-DiFuzz) + + # cd /fuzz + # sydr-fuzz -c server_manifest-libafl.toml run + +### server_newlayer (libfuzzer) + + # cd /fuzz + # sydr-fuzz -c server_newlayer-lf.toml run + +### server_newlayer (LibAFL-DiFuzz) + + # cd /fuzz + # sydr-fuzz -c server_newlayer-libafl.toml run + +### thinking_content (libfuzzer) + + # cd /fuzz + # sydr-fuzz -c thinking_content-lf.toml run + +### thinking_content (LibAFL-DiFuzz) + + # cd /fuzz + # sydr-fuzz -c thinking_content-libafl.toml run + +### thinking_state (libfuzzer) + + # cd /fuzz + # sydr-fuzz -c thinking_state-lf.toml run + +### thinking_state (LibAFL-DiFuzz) + + # cd /fuzz + # sydr-fuzz -c thinking_state-libafl.toml run + +### thinking_eat (libfuzzer) + + # cd /fuzz + # sydr-fuzz -c thinking_eat-lf.toml run + +### thinking_eat (LibAFL-DiFuzz) + + # cd /fuzz + # sydr-fuzz -c thinking_eat-libafl.toml run + +### parser_parsefile (libfuzzer) + + # cd /fuzz + # sydr-fuzz -c parser_parsefile-lf.toml run + +### parser_parsefile (LibAFL-DiFuzz) + + # cd /fuzz + # sydr-fuzz -c parser_parsefile-libafl.toml run diff --git a/projects/ollama/build.sh b/projects/ollama/build.sh new file mode 100755 index 000000000..527292c68 --- /dev/null +++ b/projects/ollama/build.sh @@ -0,0 +1,72 @@ +#!/bin/bash -ex + +# Set compiler and flags +export CC=clang-18 +export CXX=clang++-18 +export CFLAGS="-I/ollama/ml/backend/ggml/ggml/include -I/ollama/llama/llama.cpp/vendor -I/ollama/llama/llama.cpp/include -I/ollama/ml/backend/ggml/ggml/src/ggml-cpu" +export CXXFLAGS=$CFLAGS +export CGO_CFLAGS=$CFLAGS +export CGO_CXXFLAGS=$CFLAGS +export LDFLAGS="-ldl" +export CGO_LDFLAGS="-ldl" + +# LibFuzzer targets +LIBFUZZER_TARGETS=( + "parser_parsefile_fuzz:/ollama/fuzz:FuzzParseFile" + "thinking_content_fuzz:/ollama/fuzz:FuzzAddContent" + "thinking_state_fuzz:/ollama/fuzz:FuzzParserState" + "thinking_eat_fuzz:/ollama/fuzz:FuzzEat" + "convert_tokenizer_fuzz:/ollama/fuzz:FuzzParseVocabularyFromTokenizer" + "convert_vocabulary_fuzz:/ollama/fuzz:FuzzParseVocabulary" + "model_encode_fuzz:/ollama/fuzz:FuzzEncode" + "model_decode_fuzz:/ollama/fuzz:FuzzDecode" + "server_manifest_fuzz:/ollama/fuzz:FuzzParseNamedManifest" + "server_newlayer_fuzz:/ollama/fuzz:FuzzNewLayer" +) + +# Sydr targets +SYDR_TARGETS=( + "parser_parsefile_sydr:/ollama/sydr/parser" + "thinking_content_sydr:/ollama/sydr/thinking" + "thinking_state_sydr:/ollama/sydr/thinking" + "thinking_eat_sydr:/ollama/sydr/thinking" + "convert_tokenizer_sydr:/ollama/sydr/convert" + "convert_vocabulary_sydr:/ollama/sydr/convert" + "model_encode_sydr:/ollama/sydr/model" + "model_decode_sydr:/ollama/sydr/model" + "server_manifest_sydr:/ollama/sydr/server" + "server_newlayer_sydr:/ollama/sydr/server" +) + +build_libfuzzer() { + local output_name="$1" pkg_dir="$2" func="$3" + local output_path="/${output_name}" + + echo -e "Building libfuzzer target ${output_name}...\n" + cd "$pkg_dir" + go mod download + go-fuzz-build -libfuzzer -o "${output_path}.a" -func "$func" + $CC -fsanitize=fuzzer "${output_path}.a" -o "$output_path" $LDFLAGS + rm -f "${output_path}.a" +} + +build_sydr() { + local output_name="$1" pkg_dir="$2" + local output_path="/${output_name}" + + echo -e "Building sydr target ${output_name}...\n" + cd "$pkg_dir" + go build -o $output_path "${output_name}.go" +} + +# Build LibFuzzer targets +for target in "${LIBFUZZER_TARGETS[@]}"; do + IFS=':' read -r output_name pkg_dir func <<< "$target" + build_libfuzzer "$output_name" "$pkg_dir" "$func" +done + +# Build Sydr targets +for target in "${SYDR_TARGETS[@]}"; do + IFS=':' read -r output_name pkg_dir <<< "$target" + build_sydr "$output_name" "$pkg_dir" +done diff --git a/projects/ollama/convert_tokenizer-lf.toml b/projects/ollama/convert_tokenizer-lf.toml new file mode 100644 index 000000000..53b664fe7 --- /dev/null +++ b/projects/ollama/convert_tokenizer-lf.toml @@ -0,0 +1,28 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[sydr] +target = "/convert_tokenizer_sydr @@" +args = "-s 90 --wait-jobs -j2" +jobs = 2 + +[libfuzzer] +path = "/convert_tokenizer_fuzz" +args = "-jobs=1000 -workers=4 -rss_limit_mb=8192 /corpus/convert/corpus_tokenizer" + +[cov] +target = "/convert_tokenizer_sydr @@" +source = "/ollama" diff --git a/projects/ollama/convert_tokenizer-libafl.toml b/projects/ollama/convert_tokenizer-libafl.toml new file mode 100644 index 000000000..ab76544ce --- /dev/null +++ b/projects/ollama/convert_tokenizer-libafl.toml @@ -0,0 +1,30 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[sydr] +target = "/convert_tokenizer_sydr @@" +args = "-s 90 --wait-jobs -j2" +jobs = 2 + +[difuzz] +path = "/directed_target/sydr/difuzz/libafl_difuzz" +target = "/difuzz_target_convert_tokenizer @@" +args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /corpus/convert/corpus_tokenizer -e /ets_convert_tokenizer.toml" +casr_bin = "/convert_tokenizer_sydr" + +[cov] +target = "/convert_tokenizer_coverage @@" +source = "/ollama" diff --git a/projects/ollama/convert_tokenizer_sydr.go b/projects/ollama/convert_tokenizer_sydr.go new file mode 100644 index 000000000..228d4769a --- /dev/null +++ b/projects/ollama/convert_tokenizer_sydr.go @@ -0,0 +1,12 @@ +package main + +import ( + "os" + + "github.com/ollama/ollama/fuzz" +) + +func main() { + data, _ := os.ReadFile(os.Args[1]) + fuzz.FuzzParseVocabularyFromTokenizer(data) +} diff --git a/projects/ollama/convert_vocabulary-lf.toml b/projects/ollama/convert_vocabulary-lf.toml new file mode 100644 index 000000000..41f0f69b4 --- /dev/null +++ b/projects/ollama/convert_vocabulary-lf.toml @@ -0,0 +1,28 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[sydr] +target = "/convert_vocabulary_sydr @@" +args = "-s 90 --wait-jobs -j2" +jobs = 2 + +[libfuzzer] +path = "/convert_vocabulary_fuzz" +args = "-jobs=1000 -workers=4 -rss_limit_mb=8192 /corpus/convert/corpus_vocabulary" + +[cov] +target = "/convert_vocabulary_sydr @@" +source = "/ollama" diff --git a/projects/ollama/convert_vocabulary-libafl.toml b/projects/ollama/convert_vocabulary-libafl.toml new file mode 100644 index 000000000..3ce806eff --- /dev/null +++ b/projects/ollama/convert_vocabulary-libafl.toml @@ -0,0 +1,30 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[sydr] +target = "/convert_vocabulary_sydr @@" +args = "-s 90 --wait-jobs -j2" +jobs = 2 + +[difuzz] +path = "/directed_target/sydr/difuzz/libafl_difuzz" +target = "/difuzz_target_convert_vocabulary @@" +args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /corpus/convert/corpus_vocabulary -e /ets_convert_vocabulary.toml" +casr_bin = "/convert_vocabulary_sydr" + +[cov] +target = "/convert_vocabulary_coverage @@" +source = "/ollama" diff --git a/projects/ollama/convert_vocabulary_sydr.go b/projects/ollama/convert_vocabulary_sydr.go new file mode 100644 index 000000000..d3af6baec --- /dev/null +++ b/projects/ollama/convert_vocabulary_sydr.go @@ -0,0 +1,12 @@ +package main + +import ( + "os" + + "github.com/ollama/ollama/fuzz" +) + +func main() { + data, _ := os.ReadFile(os.Args[1]) + fuzz.FuzzParseVocabulary(data) +} diff --git a/projects/ollama/corpus.zip b/projects/ollama/corpus.zip new file mode 100644 index 0000000000000000000000000000000000000000..98f7f08a790cdad2d885ff858e5540cf9ebc3d66 GIT binary patch literal 37213 zcmcg!30#cb_n%Zsn8ZJ8pGlqI`_2^CUN$d)Ya3)z>D ztR*B`r2oD1G|heHo#uJQ@BRFr_k(($&*y&6IrrRi&b`mMUpq@-5qS!H#&~KjXZ_Ig zml#Ev;vNtj7)sZ1SR_pmOKdFi9^6#qJqY{>jgX`WiF_2MP*{K2^$wCr#Sb!&Gl+YD ze;7451RE^pGl{{j?rdL%N;Kx*gJA+XhXuI1x`q0>21jDUD;$mSR^%tEI7OTigA6YV zaP-IwPxE&V@C)>%hETQr0z9a`EYqAwjbWLEhiP(4Ds0UwvU4XETUpy^<<1(AO<23)LWH|KvciLkVuvk$NH8+n1u?*><9k>4+r%Mg1Q*IF(iZP z5gO=Ab9W7)I@3Jp&h$XU7(;;Vp&0GTOfL?Qo0cmX#|L4=kD`9H^AOw`tDs{P@m!`a_{V z7#PVMrU4zG9vltPnVALNkaAEe-Q6{i`k&2-UZmc5Jw1z#FoOt|7Fr|G<$h$M$+sWctS~!gweJT@{}8IbJ2j9-bw~3VpG<Lhl{9{^FH4K1+_$ZD#3G{F+GV%lQoqcIORPB(65LO)LV`xj%%;y~9 z98WnGTM12)3YFj4(qduXVzEIft^A7Bi#Iz<4=ozMY1yVFn7B*Kth!*RfI?yB20u_x zapCXEeTo|r;6wGNt)>QJ6$zA(up&Vx6OKNf#OVKN{$CG3`(CCTmC&F~%H4+~7)#vL zm7n`-l>5VvH!qhtFpCX`o19ZETq`j+I6Nx6CH8LlhFisL)g7K6zy4w@KS z+l661y*%n}vk%Y(>ce}j6oWTYNtidB7UB(p5!Iar)(gu3bdJJ&)`?%GHBeYq^wrgq z;sGPig$}uB`>TuX^SjQ9Dc2Rsq0~t@UrizNiJtKOvUaSB$(=q zSy-$)^`xY}J#+nesa+@cZ+%JaR7s5TKKV_4{)H7g>ULx(y3KU>we#i6{JaUCjP%6{ z`y-w$|0HWI>}Ol3k@0lbn}Dw=nyZW#m%e6MBRgZ7Ssc(8>df03!@--rgB)kxk?OZM z$nh~kUqS9ImesC3vA(7VkRdv6xnMn{PGXh>EbE*al^lm8q(8E-FqGW*s4!-PM@&*OL9(bOSbU_J-cC=PUZCe5#=NINn037mp<)abU8=2KJD*y<61(!vuE4L z)N1L8Q5ho_Rc{lyti0*$(Q0nuGW44F zHOq`tdeKeg=Bp;<=Hn-d2e_Bl#h7Rf-g_?E-}TJB37hA84yVVg-@0wmzW5Z=ugUHg zzkGHc?YFIcW_5O=LDGB8&f~hR>mLIx#l+9u&zu{KBs? zTcSu;N~HSgk)YgI=JEAu8;?D<5I5J7J2*%0&o6a)!Hbar7yEBnP@ntsZ2E@L(#u5> zH@c*+%5c&2RNj5sb(ip!;sxjLkDglAE;-?5*|F6Dr;eQd@^D47Ox;kAYo0;_MH1b^ zPruK2v@8ABGX<#a6nl3$f1nT4iK8u=>P)~JO%mGnlr0=R1qnUdA1o+^Tk!=s8IJ1d znr055zS2?Cv%j}Mz0B6es-MK8eh$o`X(yu{9zE=-xD?FhN6!YbLHRh6quzNOydfib zPgTp2oR4Gn6*TqkA*JDJgLNNsjeML=A2`W8zGy|#fkXTE9rsAyvv1*{Wr~@{cON{m zQ{wGnjpRi`nf)A2D(oI6G-OZ1gbAvQjiU{1)<4&8532ukH$if=;n~Ho=3JfQ{TncAr+x=`LuTrG_TwBa`Aq#tYfD%( zyjUX<`FZK7f_LgRJN6B?%vLRwir)DAMSAAl&hWW|k`E@Id>0$ov_#bPfOxvceP3~x z%JMtql%o#TKF?)G1^N8rc{4NapXPG`4v9Jsv`78kE#F+w7`jo;sN->DgmGQ`7ccFR zFPO7Nywj6m={jRgs%|jQ25N-q3VxvEbDiW#a~3G;;0r5jOUaz$U18$S@f5j->N&;p zpu(*mHgM|=67@1VFxVMWl=u&9z}hSP03-LY+wJV`?v4UB5EBPKboU1%!cmd==Tc-O ze>}ZOM1XwH<+#8Il$-MZi1nZ9MPx+1|57m`FwBb3`TB4XvNHx!JCQpY5h>>G;pXW| zb$<_CP)z)GT7wrF|ij(k>zcO97z1T)t=Eo)pv6cfeYc?|YE3NXZ9yvi>9ky(yFP&w*1k7{40Mj#Pz+ zaBSYFLx@qa%)N`bE+@YL~ANnU#Y%WvtbOB;mU%cMk4?UMB*(2 z8JlCC!$*it-6+#Xo7?5`*6pjiFUiurYw_v1|F${mM#F$iM6-<<9Xe7U>8Vrq`Z|Ez zG;KpfrpL?9;0+C45E%f=a(s~aWjWN?gGi`J zXzhY)-#ZR{UYJ$oaPgYBS;eK93P3Y4apmI^{N=#-5QDd-8pN7n>5h-4k|kyiYMK>R zm5yfWr8-p$&C0Uuiq$K$)EtX-EVb;_ge=~Vb97K=zCDTA#OS!Ku_nNU*u1485%&m} z04wg*Gj`QS@2Y2H)-#UQGqT=Z-19zp8?;Pp(C|?HagW6ECk%TnW)&qRi`A-hO3g8^ zw@-N(k6-@429zsYJ4+ePE-KJ9n9lxU@_@|NGXDgAYdQK~WA*GUStEPWe0#Q+nYT!6 zFVVqa)VJy5ma0=zr%&R0e5L z3S}a(f_|X)znoU#T(C#!pgR>ClVe=S{?$XcaJGT06!uT|hE}-^3}5A8#r>m^f2<7l-Kk(5flOvJ z&Jz`)P@si5YZSG;A((&UxTmlAXB}(#QR#G7FDjw=>5|`nITXV~$=BaQrDeiG!X4DK zY_#m{zOxomw4~}#1+Srd$GuCYP$wm0y)fPJw7I%K7AOyINoRsL+9bRr)Hj3%8ktDC z3L>in+i~sH%qz6av@A3yYFRkwR!@E}v0X|gsMW!4Yq^etnaEZu^PN01`JGx277fZ5 z?%4$!MxcPaMIQs+AZ4C29R5F4!l(W`uuV8Q9 zYH}7tgFaXg*tEtCPEAq+0ze^niwAo;NUYhQ(0~xChjR$XGQObqj*N^w@kOH7_wDUV zwJIi-yk)Hcbs%rCxu&`3)}BuuwYBo)IxJ!O67`EPg`!3rURdo>zBGSwLYgUwg5D>o zH8-$+BENMKBCs_QV(~UuKkyc5kL)W_^n5WQG*nMprkk9O7(Ca4qw~gv6NP-<=nI$T z&k6v}pjXrnbQ}s2rM~}=r2qI9vL*cIuh!5X^w+)K#fr9eAj~#kUS)Xvd@albP$b^M z!u=+R<%rcRaIOgDtbY^C$yslDVrS=!={sP_4dHkT0;4L4I+Ezl0sg*NODmu9 zX`y3aWmSbWXp}0hDocNB?-*EKrc+|3Wp5TMPR9~XovP>7(Eyqg)WI*5yM33Rp!NhU z%Gd{pcVx=XFB$mqa};M`^o-S0A^KCpeO)8jW2csps6NrLVe&ybqxu+|?R8$OX@S~a zt65$Tq53F5%gS^Xm@P8PD%I@iG916^b<)4n4=RT>I784S)REP!;0#)y0_fTyuE8Wk z+132cg(Cbe|Gm_ueNv)Jbc#=9*an&x{8_5qe zS1%Xn%sPBQ>te_wk#>MzPOCCo5c?l+v|wV~bm+d)$#^%P+qq8}l4HYOXk>bq1I=YSsOd zc4XF@)^3eGw(f18epuCCZ`$r$RlGrJmDA)(yL&%ft6f|$6SUhWY}o{qgo^Suffjg! z1erculNDnGR9Q^&!CpCuoi(5@RltN zyqQesu72!F7;X;*_1L{5+hrz#8QOOG-FJGRRg}wdFE{Uf!#&!*-OU@xc$0Q!`K&*N za%Q?~zyCN{r}^c!k?SL!KifOjXQ%sBoFAOovS-z%N1v=zuQ_$Zc14!P*O}JUt^D)3 zwPod|T{Mveku8Vv8s!4ZT|B68~viz|Jl{$^YdPVSoGUJKbx=rasJud zowqbB>dEj|%CA2aY|9t&>owA66P>wCU0*No<8%ZHYZ?ilF%xm%|^c&3xiweN*5yb^~#y5gRdShpst z_Svy_ZJF+pGj)E28=XkoKPqpGTa{*J!7P)AXy<=^Ys-J6N$9@{o_1dyzIx}YY{pvK7brvvxQpL?P! z#r^4%_J=DYyq@Q5vM*hJ^2(LV*ME0Cw~jPeyPV$XFgi|Y^`Dm3OAl5W=9hU!Idypz zH0_=J`BuR|_wAz2d*Y*VoN^D|4{twPccfc)lJbpBP51m0D-V1129QLbsfDn^3)+FV zg*?C;r1tH@LLtGS{_wtuhd|!bZM2|y(=@gN;-UoW5pRD`#Ru(N{L39wevNIy`C`3M?@6r|f_ zhJQV;TAG>RWp(eeplXYongDbeeI)%&6hf(5B{nuJ8~^+ec6%R(DzN9V-=b& zPVIhB*jX0yZe-Q8Kl$HB3r}kMc_7r}%AFOx3*!54ZIx|6Tc|N+3-AM_lWds;ie;K7 zmELnntbk0JgpS<`u#oB;?@GO6_td+v979?KAy^-UQbJ;(Oth|4Z1Z%{Ck~TcO$Scj z{LO9p?lZHK6E;~79(Sc+q~5nrXSzCneXbi{MjsTidFa`x{YM-+6@0-qW1dOi{uw!A zZ*->U&oxj|^bWgLY%ZJ&AD~HrxUNpb(eyC(kQF&eV>#(YajjSHu^?K$T zQi1x=1RN)9Lkxcryy>%6=`{|!h75@Wmxwq`OXvHx&dTlCu+wzzueI}bC#&nv)BQ2c zE_~O%+S$8KZP}Xo>3aRp>~l|=*M_HT+O7UcTfI&iSq)S9r`uhXPfI5_RTq%P9DYs>j_deeuu~G>Mzf`FiVs6G#sxhWV^4*ad5$}%;fX0k|Um@I?SXE`VHsO!aL_dQEd#qb`RJt2@>OlM5_|&Cc z4D1K3#M^%0tOGq*;TOC}SugW!&p|=|b4Oo@g25pGZ)o_@jCkt&145i(*MIM=8$Lln zvZPqkk#g+H@4=hqie|Y)&B89#&>o1Kg<$XxZ&9k1$ykB4!z5*eihWhVO7o=dG)GD- zK5KVk{DoyNri0-^A{V%@Rbmkxb!)!iioAu?3 z)2wGY-)y3`oqYeSzUXsv^Vese8wi5ghP5BX* ze?4m{yYJV%{_ypvlLPa&z2Dn8u&pAi>cYLf)W&aP0s>Yg*tUM0rM>*ol@CovU%q(x z@!-X7O1Eajx0f@W7Mu7u+qN}Xch&h6zIT?7T$}Zb@-eilwM8K=zhi#a<&K-S&e|89 zj$FIeX*)a0b^45%*WS{*K9qMVth*f5^6lpzjr+3}wHZFR9u#!L{>|&x{VslOOAbMRoOfJsHbe zaTAlfpKx zIKOMi{(#b#dNuDH>sEbv+3$_Wt%Om>Yj-RN-fwq!b5Zz4@rPUFRSWUBc<_Ut%~F(Ws4YyHe?P;z_OnPF`9BryBT!-qM- zviD1>Eyoo<$ao~xbgBR4*wsNP)e2P6-~%5w)b?l6!PhOtkfe_@g|aUjbfnB3Hh!?k zlDL(oc7+!7sgxZio8vn7Y}haS(8A_OuH@|xYok|$q|^Ne*R9!>ba=(c<(E_^7WDhAT=r0b@^KiO+ z@k^?1XhYeQ%E9GAakNaYyHhr|Ug)q>8JrQAdbOf|7iDgyy2;X}obzXkFB*tmhPS3G8e1Ea@9XW}SdecRxgeG2yewv}bQrlNnRj5)})>^`H zUS#4t7n^Qpcya9h>ofP~4OwogyOlH5CmcGIJM& zH*V9f7gx-tqn-!+WzKK!x-h-+SFsKwx7uy(LN~n3C+&$ z=|SUpj7jdv8D^%Q-yA<1y)GH%ol9#dRuw66TeNS;`HZiOTM;)y#>8F9JXf1lzIeNv zYWk0wy(NuJBA0&TQID;@dpSxvM|hX5#kQx1B_=f9Uizf@K=JrbBOX4uky*`HcGWvI z?MTw`GY;d_6ixd%I94b%eM)$xrBV1{z?z^9<7#vB z_QkQwvt!uQd0xYxjycmX)%~)|aMSH~vh$lQqD5CrE8avGF?1PHZAUb7_@FP3fulFu7M}O0I z6Drcz$*dT>yzHa?)_?Xt(46+6P4U~8FYgy0aqb!b^N#hfhq}K-C=?i1c}LtkAQltX zg?=E8+PjxhpT18#BBW6Wo&=~J}+sEAv;m(Og%8?5Xb^vw7#EV?j z;~79fs3dRoCxe7cV$To}66}g8Pp%kDNHVs$1+||sueK?*dZ={#s10(;263AXM*QPB z;-tkrnY051^}Ev_=fq!s8I^rys6}$kp_)R)ShJKe$0-AiLcIq#?Hx3JqN|eFq$H7u zLr+$Ht`LpMlV6zXUwSF*M##;5Kb|YiJigB$;oI6{PD+_p-L)1IgtD&`8z-(l+r2T; zxude_a>f@%n$w?(n-Q_^+Mdtx`t*+W{+otq#2BSUoi`^7Gh~LeHVQwrKlLo{GbLWh zIQ3VeUrO7}Kc#CNcHchJCIsy#Y`ZF^2-pr<39}#gg>sMU2wj%aOBE904R)`8=zv26Tv+be9@0ukoT76NK8}Z|T!XXrhpfYMh|tHLkYB$O ziV54!kZZhsDTEyn6M^PVEGaH8t1P$7*D%-8&aT-^XHAlC_#sVLQQ=$MP$}SdA`()7 zFF@dgg}fBGjNI?`@s{=reSZwH7guGixDUtPPll~V5R$XvP+?TS8|1*JFO#s2L%2T3 z@|lo@c6R4_&9l%>4H!sh>j#wq6QLO37Fx3GcX-zng7X#&exXIKV)7L$FqrB|i*Tlg zdV+t5?4_Y*VO@5bBb+66!5>Uty!_r1LJpXK23eOMjs+q>F?b6I31g72XnhF?zDb6_ z%gXM)0d(x^D<7+Am}#n)Se0kj=&(HtbL{K!iSVlj1!D4+W&n7DqzzKiIET1;5m_sj zEea;cYvH{2@aq?Z<1NS_@CIqjAQB`XkcyEr@UaTA&M^C6-xKf1k5z!{3?lND1@>+T0o$Xbi#|HZ_KCWGt2KzW64sQv7yQ90vz9e9sZ}fhi z=OY8h6lJh&U|UHU*5ljj!9c^9|y1@K5xmy!5d_g*_UK&_a);hJ?kBlK&|4m z6aKOT0HmOS2mX#U>T^p#b^Tuw3&I4!YvBJhsf+}QAY@p)@B~dLme!hEbg-l%iFy0A z8J@dg<1_^0J)@A#gFp;HGYSwRn?YwMl?5JyrUPs-@jc@%AA)i~MBcK%(8Q%K^2$`%lxp+xr|{JaCx9K_`<(RlENPtJuB(L;lS148{hh;y!n`5CqB-t-2o zRI|AyxFz1c-g1KkOQ6+LXNHbqLG~pOY%?C)cliSa>REh*F}hchp8T=J7FdTRMv!xL zfdT-6V7%=j2Hx;VV~7}73KJk{U?1gVbQ6+bx`05uMSux~z!Ky`G*BI^94j3R{G0cy zDgW-FK%)@!3qDmS)c=2u&Mg11#Aak-NPll-fC+JVo1;H?!zXK@GeSBlW7fFw?U*Bs z`w#)c20#2OCL`A#xI-B|1bp+u_7X5j5i;nYhK5jlW*Hm$KaI<<*+`}D6^0=S8kse; zL4#fbJ2qpzUye8X%fsjc0eR0UTz?aYL}8VPoNgv&^@wEYYz^r~*w_A^=-V zyfu2>RsJg;E=Ht#iT50{^FFN4NG*AG3=(5WVLW=4KL0uqRwsPo4mLUeTaHkJQza_# zQDqA#gP?6xo;GR0Yd;X1_dLN2%O`JPQu)y$K-*`}=9efqXL5ELndfUZ=Vr1bxzuIC zD&`>`Z%JTf%O?t8lCWl{w>^)a!?33(zf8xhBA(+eafcVFLFdGO0zlU-EaLd=4>3X5 z?t-~6nXuIB!I;AwjGFoI-`6crIbay)6R0sc$ma>2o^{O56t1)M?P1F#gt4;}>L)J@ zH(a2i;=#kpdIA3GGKN24=M`8~#g#ojC`&8&5XySsnqfaoMzjzK zZ8=GY59JAp35iEg7F5X5%6^!PHZqtvsvy$zil`8f<^?4xg_~~n!(^NT_8^>Q@;qHA zFw`Dp9K}!gPVilm5Li%FRBm{bI26*FvL7a64meyVgh%=E{>t{y1Skn8q$p)SOhyM8 z8UBW_6g2}}evsH5e6!KLNf?L-N}ZA5D=OT z1^%ClYdFvL7bn4XDY8?2EN83eJ?tEd|O7iC<@5L4i*s1(Mmx zFjR7bql}HPEN4GVMjR*>iNOCpy`e;i_?f4H`j7}$V0K7UZMd>fMnXLNR&d-*2rnr2 zA~!rr5eR$p*bkGj0aVCD@VLt6uN)sG`h#0U_QPcO%M#-YLQBZ4IZCL9M^*!08Hh9& zgjNtmhT#omxWg~Af51l{B4pNLCr{spfTZdXUKy+;O%*C=(qV5`Jc2KTXEVxQE7YoJkYjaWWGGLdoeMaS8ijGIIF?5fb3B ztpzgzTP1c5gr{`uhsjU@dw86+@G22g-|>UOE0x3_ijeq@JkoFeNQAU^{E+bG^B&6I ze1zmw=GOOC-L-oiFg%Z%= zl~MsmW_*+)q-5hpLRshVPO*zWk{%(w9XAweKfF@npjU*CQiP;-+(;KJtemB(mdHs&6C*aQM#0d;)u4-$;f0kx0i0h=8(XCG-gC=ujv)Qz#!C-hM6op$MtxxRFrWH@s4-z*lm9 zN@0ta4*?iA6w2*}SE`9W6d}(UHxf$ahF6LXz6A19ijX;u8w$n;cIw3|^@TqaAyXVT z63W_!S8ACuf29PrA498}oC>TSW(5n4}op zIH?JOp-gM|L!QB)J+x;T^(gW$FxJ5yIfggXDIhM&G6u~Z<0DgrsWZ``}5Hx)ds4F0W7q`kNFBatBVn0lVqBIb4HKQ}!Kpvg}*j;3%OL-lOjjgJb!D6q^<|F3MMh57f4r zgh~rUp2bFn4#bNOi|trl#veGyJvWkBftW8l7ALi%TuE?D$dAQ-nvC_edbPseb{2pw zi<8+Q7Rq3S|2UaMh{g6AlI&S*6T+iX2#u0O!Fv(xhshWQ7}|Q`LLX`hPMF1wj`B3& z(baT_(0g)@0Q6Mc=qM8te!*yfYe4*UXRQ~Kq%PdJD7g{jd160I#$7_(-ts~a&K+(6 zQ2rmh*&FqU6c?OPi5nf|*1>-^vzSbT{x^(6-1sQ*4L%k6>J#A$%ICw4jS|h^b+?^D zgpGZv7K~_zjSpQ6rJRAkdqYB=|YYmAMWrtMqWHQ|7DD4P-nx9Q2LhoJS0&uu+dACdMRvL5~|1y`+rKu!}4R zHD$XNiQ6u0To?`6QIZ`Q@t=Jk_KgcK{`Ce&5?!-wAa*!Ldvuu$9m_rygg}24iqSjD z=&chb;|PDWzYD|YHDo-Tsuf@5{w@TgcZ~7QlEWYFe+<9qRbqU$nQP5gP4f4d+5XAS zspz#~cxRLSFc}Z{L-wqRUN`N7u7w*9y(5ed@hfcjs>oi0r0<<^Bcm6D@tW50NB+w= zhhG21*GDUC`D*&tF%G@-i;w1C_#?7y`#;7v^doYU@hZDMwZv}l^}5bqL^%8e-X?72J%N^Nw;_9T zm>U|sq>GOQwM5YWW1vMZ<>CYUs)Ynf3v?xzTVwPNE`EjnAi^bm0hk*Ty>E-(Ppn%+ ppeuWV|2pQPS8eezP}G3{n{?C_1$WRWl#SrOLU2|R3&y2T{trlGbvOV3 literal 0 HcmV?d00001 diff --git a/projects/ollama/directed_target/Makefile.toml b/projects/ollama/directed_target/Makefile.toml new file mode 100644 index 000000000..7ce686064 --- /dev/null +++ b/projects/ollama/directed_target/Makefile.toml @@ -0,0 +1,229 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +# Variables +[env] +PROJECT_DIR = { script = ["pwd"], condition = { env_not_set = ["PROJECT_DIR"] } } +EXAMPLE_DIR = { value = "/ollama" } +EXAMPLE_DIR_INSTR = { value = "/ollama-instr" } +DIFUZZ_DIR = { value = "/directed_target/sydr/difuzz", condition = { env_not_set = ["DIFUZZ_DIR"] } } +DIFUZZ_DIR_ABS = { script = ["realpath ${DIFUZZ_DIR}"] } +LIBFORKSERVER_DIR = { value = "${DIFUZZ_DIR_ABS}", condition = { env_not_set = ["LIBFORKSERVER_DIR"] } } +LIBFORKSERVER_DIR_ABS = { script = ["realpath ${LIBFORKSERVER_DIR}"] } +OUT_DIR = { value = "${PROJECT_DIR}", condition = { env_not_set = ["OUT_DIR"] } } +OUT_DIR_ABS = { script = ["realpath ${OUT_DIR}"] } +DIFUZZ_ARGS = { value = "--weights reverse -o difuzz -j8", condition = { env_not_set = ["DIFUZZ_ARGS"] } } +CARGO_TARGET_DIR = { value = "${PROJECT_DIR}/target", condition = { env_not_set = [ + "CARGO_TARGET_DIR", +] } } +PROFILE = { value = "release", condition = { env_not_set = ["PROFILE"] } } +FUZZER = '${DIFUZZ_DIR_ABS}/libafl_difuzz' +GOINSTR_DIFUZZ = '${DIFUZZ_DIR_ABS}/goinstr_difuzz' +GOINSTR_SANCOV = '${DIFUZZ_DIR_ABS}/goinstr_sancov' +GOINSTR_COVERAGE = '${DIFUZZ_DIR_ABS}/goinstr_coverage' + +[tasks.unsupported] +script_runner = "@shell" +script = ''' +echo "Cargo-make not integrated yet on this" +''' + +[tasks.debug] +linux_alias = "debug_unix" +mac_alias = "debug_unix" +windows_alias = "unsupported" + +[tasks.debug_unix] +script_runner = "@shell" +script = ''' +cd ${EXAMPLE_DIR}/sydr/convert/tokenizer +go build -o ${OUT_DIR_ABS}/convert_tokenizer_sydr +cd ${EXAMPLE_DIR}/sydr/convert/vocabulary +go build -o ${OUT_DIR_ABS}/convert_vocabulary_sydr +cd ${EXAMPLE_DIR}/sydr/model/encode +go build -o ${OUT_DIR_ABS}/model_encode_sydr +cd ${EXAMPLE_DIR}/sydr/model/decode +go build -o ${OUT_DIR_ABS}/model_decode_sydr +cd ${EXAMPLE_DIR}/sydr/parser/parsefile +go build -o ${OUT_DIR_ABS}/parser_parsefile_sydr +cd ${EXAMPLE_DIR}/sydr/server/manifest +go build -o ${OUT_DIR_ABS}/server_manifest_sydr +cd ${EXAMPLE_DIR}/sydr/server/newlayer +go build -o ${OUT_DIR_ABS}/server_newlayer_sydr +cd ${EXAMPLE_DIR}/sydr/thinking/content +go build -o ${OUT_DIR_ABS}/thinking_content_sydr +cd ${EXAMPLE_DIR}/sydr/thinking/state +go build -o ${OUT_DIR_ABS}/thinking_state_sydr +cd ${EXAMPLE_DIR}/sydr/thinking/eat +go build -o ${OUT_DIR_ABS}/thinking_eat_sydr +''' + +[tasks.coverage] +linux_alias = "coverage_unix" +mac_alias = "coverage_unix" +windows_alias = "unsupported" + +[tasks.coverage_unix] +script_runner = "@shell" +script = ''' +cd ${EXAMPLE_DIR} +${GOINSTR_COVERAGE} -i sydr/convert/tokenizer/main.go -a insert -l info +go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/convert_tokenizer_coverage sydr/convert/tokenizer/main.go +${GOINSTR_COVERAGE} -i sydr/convert/tokenizer/main.go -a remove -l info + +${GOINSTR_COVERAGE} -i sydr/convert/vocabulary/main.go -a insert -l info +go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/convert_vocabulary_coverage sydr/convert/vocabulary/main.go +${GOINSTR_COVERAGE} -i sydr/convert/vocabulary/main.go -a remove -l info + +${GOINSTR_COVERAGE} -i sydr/model/encode/main.go -a insert -l info +go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/model_encode_coverage sydr/model/encode/main.go +${GOINSTR_COVERAGE} -i sydr/model/encode/main.go -a remove -l info + +${GOINSTR_COVERAGE} -i sydr/model/decode/main.go -a insert -l info +go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/model_decode_coverage sydr/model/decode/main.go +${GOINSTR_COVERAGE} -i sydr/model/decode/main.go -a remove -l info + +${GOINSTR_COVERAGE} -i sydr/parser/parsefile/main.go -a insert -l info +go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/parser_parsefile_coverage sydr/parser/parsefile/main.go +${GOINSTR_COVERAGE} -i sydr/parser/parsefile/main.go -a remove -l info + +${GOINSTR_COVERAGE} -i sydr/server/manifest/main.go -a insert -l info +go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/server_manifest_coverage sydr/server/manifest/main.go +${GOINSTR_COVERAGE} -i sydr/server/manifest/main.go -a remove -l info + +${GOINSTR_COVERAGE} -i sydr/server/newlayer/main.go -a insert -l info +go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/server_newlayer_coverage sydr/server/newlayer/main.go +${GOINSTR_COVERAGE} -i sydr/server/newlayer/main.go -a remove -l info + +${GOINSTR_COVERAGE} -i sydr/thinking/content/main.go -a insert -l info +go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/thinking_content_coverage sydr/thinking/content/main.go +${GOINSTR_COVERAGE} -i sydr/thinking/content/main.go -a remove -l info + +${GOINSTR_COVERAGE} -i sydr/thinking/state/main.go -a insert -l info +go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/thinking_state_coverage sydr/thinking/state/main.go +${GOINSTR_COVERAGE} -i sydr/thinking/state/main.go -a remove -l info + +${GOINSTR_COVERAGE} -i sydr/thinking/eat/main.go -a insert -l info +go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/thinking_eat_coverage sydr/thinking/eat/main.go +${GOINSTR_COVERAGE} -i sydr/thinking/eat/main.go -a remove -l info +''' + +[tasks.difuzz] +linux_alias = "difuzz_unix" +mac_alias = "difuzz_unix" +windows_alias = "unsupported" + +[tasks.difuzz_unix] +script_runner = "@shell" +script = ''' +${DIFUZZ_DIR_ABS}/difuzz-go -r tokenizer.main -c ${PROJECT_DIR}/config_convert_tokenizer.toml -p ${EXAMPLE_DIR}/sydr/convert/tokenizer/main.go -e ${OUT_DIR_ABS}/ets_convert_tokenizer.toml ${DIFUZZ_ARGS} +${DIFUZZ_DIR_ABS}/difuzz-go -r vocabulary.main -c ${PROJECT_DIR}/config_convert_vocabulary.toml -p ${EXAMPLE_DIR}/sydr/convert/vocabulary/main.go -e ${OUT_DIR_ABS}/ets_convert_vocabulary.toml ${DIFUZZ_ARGS} +${DIFUZZ_DIR_ABS}/difuzz-go -r decode.main -c ${PROJECT_DIR}/config_model_decode.toml -p ${EXAMPLE_DIR}/sydr/model/decode/main.go -e ${OUT_DIR_ABS}/ets_model_decode.toml ${DIFUZZ_ARGS} +${DIFUZZ_DIR_ABS}/difuzz-go -r encode.main -c ${PROJECT_DIR}/config_model_encode.toml -p ${EXAMPLE_DIR}/sydr/model/encode/main.go -e ${OUT_DIR_ABS}/ets_model_encode.toml ${DIFUZZ_ARGS} +${DIFUZZ_DIR_ABS}/difuzz-go -r parsefile.main -c ${PROJECT_DIR}/config_parser_parsefile.toml -p ${EXAMPLE_DIR}/sydr/parser/parsefile/main.go -e ${OUT_DIR_ABS}/ets_parser_parsefile.toml ${DIFUZZ_ARGS} +${DIFUZZ_DIR_ABS}/difuzz-go -r manifest.main -c ${PROJECT_DIR}/config_server_manifest.toml -p ${EXAMPLE_DIR}/sydr/server/manifest/main.go -e ${OUT_DIR_ABS}/ets_server_manifest.toml ${DIFUZZ_ARGS} +${DIFUZZ_DIR_ABS}/difuzz-go -r newlayer.main -c ${PROJECT_DIR}/config_server_newlayer.toml -p ${EXAMPLE_DIR}/sydr/server/newlayer/main.go -e ${OUT_DIR_ABS}/ets_server_newlayer.toml ${DIFUZZ_ARGS} +${DIFUZZ_DIR_ABS}/difuzz-go -r content.main -c ${PROJECT_DIR}/config_thinking_content.toml -p ${EXAMPLE_DIR}/sydr/thinking/content/main.go -e ${OUT_DIR_ABS}/ets_thinking_content.toml ${DIFUZZ_ARGS} +${DIFUZZ_DIR_ABS}/difuzz-go -r state.main -c ${PROJECT_DIR}/config_thinking_state.toml -p ${EXAMPLE_DIR}/sydr/thinking/state/main.go -e ${OUT_DIR_ABS}/ets_thinking_state.toml ${DIFUZZ_ARGS} +${DIFUZZ_DIR_ABS}/difuzz-go -r eat.main -c ${PROJECT_DIR}/config_thinking_eat.toml -p ${EXAMPLE_DIR}/sydr/thinking/eat/main.go -e ${OUT_DIR_ABS}/ets_thinking_eat.toml ${DIFUZZ_ARGS} +''' + +[tasks.target] +linux_alias = "target_unix" +mac_alias = "target_unix" +windows_alias = "unsupported" + +[tasks.target_unix] +script_runner = "@shell" +script = ''' +${GOINSTR_DIFUZZ} -a insert -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_convert_tokenizer.toml -l info -j 8 +${GOINSTR_SANCOV} -a insert -i ${EXAMPLE_DIR} -o / -l info -j 8 +cd ${EXAMPLE_DIR_INSTR}/sydr/convert/tokenizer +CGO_LDFLAGS="-L${LIBFORKSERVER_DIR_ABS}" go build -o ${OUT_DIR_ABS}/difuzz_target_convert_tokenizer +${GOINSTR_DIFUZZ} -a remove -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_convert_tokenizer.toml -keep-ets -l info + +${GOINSTR_DIFUZZ} -a insert -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_convert_vocabulary.toml -l info -j 8 +${GOINSTR_SANCOV} -a insert -i ${EXAMPLE_DIR} -o / -l info -j 8 +cd ${EXAMPLE_DIR_INSTR}/sydr/convert/vocabulary +CGO_LDFLAGS="-L${LIBFORKSERVER_DIR_ABS}" go build -o ${OUT_DIR_ABS}/difuzz_target_convert_vocabulary +${GOINSTR_DIFUZZ} -a remove -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_convert_vocabulary.toml -keep-ets -l info + +${GOINSTR_DIFUZZ} -a insert -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_model_decode.toml -l info -j 8 +${GOINSTR_SANCOV} -a insert -i ${EXAMPLE_DIR} -o / -l info -j 8 +cd ${EXAMPLE_DIR_INSTR}/sydr/model/decode +CGO_LDFLAGS="-L${LIBFORKSERVER_DIR_ABS}" go build -o ${OUT_DIR_ABS}/difuzz_target_model_decode +${GOINSTR_DIFUZZ} -a remove -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_model_decode.toml -keep-ets -l info + +${GOINSTR_DIFUZZ} -a insert -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_model_encode.toml -l info -j 8 +${GOINSTR_SANCOV} -a insert -i ${EXAMPLE_DIR} -o / -l info -j 8 +cd ${EXAMPLE_DIR_INSTR}/sydr/model/encode +CGO_LDFLAGS="-L${LIBFORKSERVER_DIR_ABS}" go build -o ${OUT_DIR_ABS}/difuzz_target_model_encode +${GOINSTR_DIFUZZ} -a remove -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_model_encode.toml -keep-ets -l info + +${GOINSTR_DIFUZZ} -a insert -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_parser_parsefile.toml -l info -j 8 +${GOINSTR_SANCOV} -a insert -i ${EXAMPLE_DIR} -o / -l info -j 8 +cd ${EXAMPLE_DIR_INSTR}/sydr/parser/parsefile +CGO_LDFLAGS="-L${LIBFORKSERVER_DIR_ABS}" go build -o ${OUT_DIR_ABS}/difuzz_target_parser_parsefile +${GOINSTR_DIFUZZ} -a remove -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_parser_parsefile.toml -keep-ets -l info + +${GOINSTR_DIFUZZ} -a insert -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_server_manifest.toml -l info -j 8 +${GOINSTR_SANCOV} -a insert -i ${EXAMPLE_DIR} -o / -l info -j 8 +cd ${EXAMPLE_DIR_INSTR}/sydr/server/manifest +CGO_LDFLAGS="-L${LIBFORKSERVER_DIR_ABS}" go build -o ${OUT_DIR_ABS}/difuzz_target_server_manifest +${GOINSTR_DIFUZZ} -a remove -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_server_manifest.toml -keep-ets -l info + +${GOINSTR_DIFUZZ} -a insert -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_server_newlayer.toml -l info -j 8 +${GOINSTR_SANCOV} -a insert -i ${EXAMPLE_DIR} -o / -l info -j 8 +cd ${EXAMPLE_DIR_INSTR}/sydr/server/newlayer +CGO_LDFLAGS="-L${LIBFORKSERVER_DIR_ABS}" go build -o ${OUT_DIR_ABS}/difuzz_target_server_newlayer +${GOINSTR_DIFUZZ} -a remove -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_server_newlayer.toml -keep-ets -l info + +${GOINSTR_DIFUZZ} -a insert -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_thinking_content.toml -l info -j 8 +${GOINSTR_SANCOV} -a insert -i ${EXAMPLE_DIR} -o / -l info -j 8 +cd ${EXAMPLE_DIR_INSTR}/sydr/thinking/content +CGO_LDFLAGS="-L${LIBFORKSERVER_DIR_ABS}" go build -o ${OUT_DIR_ABS}/difuzz_target_thinking_content +${GOINSTR_DIFUZZ} -a remove -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_thinking_content.toml -keep-ets -l info + +${GOINSTR_DIFUZZ} -a insert -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_thinking_state.toml -l info -j 8 +${GOINSTR_SANCOV} -a insert -i ${EXAMPLE_DIR} -o / -l info -j 8 +cd ${EXAMPLE_DIR_INSTR}/sydr/thinking/state +CGO_LDFLAGS="-L${LIBFORKSERVER_DIR_ABS}" go build -o ${OUT_DIR_ABS}/difuzz_target_thinking_state +${GOINSTR_DIFUZZ} -a remove -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_thinking_state.toml -keep-ets -l info + +${GOINSTR_DIFUZZ} -a insert -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_thinking_eat.toml -l info -j 8 +${GOINSTR_SANCOV} -a insert -i ${EXAMPLE_DIR} -o / -l info -j 8 +cd ${EXAMPLE_DIR_INSTR}/sydr/thinking/eat +CGO_LDFLAGS="-L${LIBFORKSERVER_DIR_ABS}" go build -o ${OUT_DIR_ABS}/difuzz_target_thinking_eat +${GOINSTR_DIFUZZ} -a remove -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_thinking_eat.toml -keep-ets -l info +''' +dependencies = ["difuzz"] + +# Clean all built artifacts +[tasks.cleanall] +script_runner = "@shell" +script = ''' +cd ${PROJECT_DIR} +rm -rf corpus crashes target ${CARGO_TARGET_DIR} difuzz difuzz_target_* debug_* coverage_* Cargo.lock ets.toml fuzzer.log target.log .cur_input* +pkill difuzz_ || true +''' + +[tasks.all] +linux_alias = "all_unix" +mac_alias = "all_unix" +windows_alias = "unsupported" + +[tasks.all_unix] +dependencies = ["target", "debug", "coverage"] diff --git a/projects/ollama/directed_target/config_convert_tokenizer.toml b/projects/ollama/directed_target/config_convert_tokenizer.toml new file mode 100644 index 000000000..c97265e0a --- /dev/null +++ b/projects/ollama/directed_target/config_convert_tokenizer.toml @@ -0,0 +1,19 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[[target]] +file = "/ollama/sydr/convert/tokenizer/main.go" +line = 10 diff --git a/projects/ollama/directed_target/config_convert_vocabulary.toml b/projects/ollama/directed_target/config_convert_vocabulary.toml new file mode 100644 index 000000000..8c6de9883 --- /dev/null +++ b/projects/ollama/directed_target/config_convert_vocabulary.toml @@ -0,0 +1,19 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[[target]] +file = "/ollama/sydr/convert/vocabulary/main.go" +line = 10 diff --git a/projects/ollama/directed_target/config_model_decode.toml b/projects/ollama/directed_target/config_model_decode.toml new file mode 100644 index 000000000..b174c4f80 --- /dev/null +++ b/projects/ollama/directed_target/config_model_decode.toml @@ -0,0 +1,19 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[[target]] +file = "/ollama/sydr/model/decode/main.go" +line = 10 diff --git a/projects/ollama/directed_target/config_model_encode.toml b/projects/ollama/directed_target/config_model_encode.toml new file mode 100644 index 000000000..42484b648 --- /dev/null +++ b/projects/ollama/directed_target/config_model_encode.toml @@ -0,0 +1,19 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[[target]] +file = "/ollama/sydr/model/encode/main.go" +line = 10 diff --git a/projects/ollama/directed_target/config_parser_parsefile.toml b/projects/ollama/directed_target/config_parser_parsefile.toml new file mode 100644 index 000000000..e542fa42c --- /dev/null +++ b/projects/ollama/directed_target/config_parser_parsefile.toml @@ -0,0 +1,19 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[[target]] +file = "/ollama/sydr/parser/parsefile/main.go" +line = 10 diff --git a/projects/ollama/directed_target/config_server_manifest.toml b/projects/ollama/directed_target/config_server_manifest.toml new file mode 100644 index 000000000..9c42a045a --- /dev/null +++ b/projects/ollama/directed_target/config_server_manifest.toml @@ -0,0 +1,19 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[[target]] +file = "/ollama/sydr/server/manifest/main.go" +line = 10 diff --git a/projects/ollama/directed_target/config_server_newlayer.toml b/projects/ollama/directed_target/config_server_newlayer.toml new file mode 100644 index 000000000..ed82f1a3e --- /dev/null +++ b/projects/ollama/directed_target/config_server_newlayer.toml @@ -0,0 +1,19 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[[target]] +file = "/ollama/sydr/server/newlayer/main.go" +line = 10 diff --git a/projects/ollama/directed_target/config_thinking_content.toml b/projects/ollama/directed_target/config_thinking_content.toml new file mode 100644 index 000000000..682288203 --- /dev/null +++ b/projects/ollama/directed_target/config_thinking_content.toml @@ -0,0 +1,19 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[[target]] +file = "/ollama/sydr/thinking/content/main.go" +line = 10 diff --git a/projects/ollama/directed_target/config_thinking_eat.toml b/projects/ollama/directed_target/config_thinking_eat.toml new file mode 100644 index 000000000..6be5a7e25 --- /dev/null +++ b/projects/ollama/directed_target/config_thinking_eat.toml @@ -0,0 +1,19 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[[target]] +file = "/ollama/sydr/thinking/eat/main.go" +line = 10 diff --git a/projects/ollama/directed_target/config_thinking_state.toml b/projects/ollama/directed_target/config_thinking_state.toml new file mode 100644 index 000000000..ae23ccfce --- /dev/null +++ b/projects/ollama/directed_target/config_thinking_state.toml @@ -0,0 +1,19 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[[target]] +file = "/ollama/sydr/thinking/state/main.go" +line = 10 diff --git a/projects/ollama/fuzz.go b/projects/ollama/fuzz.go new file mode 100644 index 000000000..7cf624d6b --- /dev/null +++ b/projects/ollama/fuzz.go @@ -0,0 +1,299 @@ +package fuzz + +import ( + "bytes" + "encoding/json" + "os" + "path/filepath" + "strings" + "unicode/utf8" + + "github.com/ollama/ollama/convert" + model "github.com/ollama/ollama/model" + "github.com/ollama/ollama/parser" + "github.com/ollama/ollama/server" + "github.com/ollama/ollama/thinking" + typesmodel "github.com/ollama/ollama/types/model" +) + +func FuzzParseVocabularyFromTokenizer(data []byte) int { + tmpDir, err := os.MkdirTemp("", "fuzz-") + if err != nil { + return 0 + } + defer os.RemoveAll(tmpDir) + + tokenizerFile := tmpDir + "/tokenizer.json" + if err := os.WriteFile(tokenizerFile, data, 0644); err != nil { + return 0 + } + + fsys := os.DirFS(tmpDir) + _, err = convert.ParseVocabularyFromTokenizer(fsys) + if err != nil { + return 0 + } + + return 1 +} + +func FuzzParseVocabulary(data []byte) int { + if FuzzParseVocabularyFromTokenizer(data) == 1 { + return 1 + } + + tmpDir, err := os.MkdirTemp("", "fuzz-") + if err != nil { + return 0 + } + defer os.RemoveAll(tmpDir) + + modelFile := tmpDir + "/tokenizer.model" + if err := os.WriteFile(modelFile, data, 0644); err != nil { + return 0 + } + + fsys := os.DirFS(tmpDir) + _, err = convert.ParseVocabulary(fsys) + if err != nil { + return 0 + } + + return 1 +} + +func FuzzEncode(data []byte) int { + var ( + testVocab *model.Vocabulary + testSpm *model.SentencePieceModel + ) + if testVocab == nil || testSpm == nil { + return -1 + } + + if !utf8.Valid(data) { + return -1 + } + + // Test both with and without special tokens + for _, addSpecial := range []bool{true, false} { + ids, err := testSpm.Encode(string(data), addSpecial) + if err != nil { + return 0 + } + + // Verify we can round-trip the data + decoded, err := testSpm.Decode(ids) + if err != nil { + return 0 + } + + if !utf8.ValidString(decoded) { + panic("decoded string is not valid UTF-8") + } + } + + return 1 +} + +func FuzzDecode(data []byte) int { + var ( + testVocab *model.Vocabulary + testSpm *model.SentencePieceModel + ) + if testVocab == nil || testSpm == nil { + return -1 + } + + // Convert bytes to int32 IDs (simple approach) + var ids []int32 + for i := 0; i < len(data); i += 4 { + if i+4 > len(data) { + break + } + id := int32(data[i])<<24 | int32(data[i+1])<<16 | + int32(data[i+2])<<8 | int32(data[i+3]) + ids = append(ids, id) + } + + decoded, err := testSpm.Decode(ids) + if err != nil { + return 0 + } + + if !utf8.ValidString(decoded) { + panic("decoded string is not valid UTF-8") + } + + return 1 +} + +func FuzzParseFile(data []byte) int { + _, err := parser.ParseFile(bytes.NewReader(data)) + if err != nil { + return 0 + } + return 1 +} + +func FuzzNewLayer(data []byte) int { + const maxSize = 10 * 1024 * 1024 + if len(data) > maxSize { + return 0 + } + + r := bytes.NewReader(data) + layer, err := server.NewLayer(r, "application/vnd.docker.image.rootfs.diff.tar.gzip") + if err != nil { + return 0 + } + + var getBlobsPath = func(digest string) (string, error) { + dir, err := os.MkdirTemp("", "ollama-blobs-fuzz") + if err != nil { + return "", err + } + if digest != "" { + return filepath.Join(dir, digest), nil + } + return dir, nil + } + if layer.Digest != "" { + blobPath, _ := getBlobsPath(layer.Digest) + os.Remove(blobPath) + } + + return 1 +} + +func FuzzParseNamedManifest(data []byte) int { + const maxSize = 100 * 1024 + if len(data) > maxSize { + return 0 + } + + var manifest struct { + SchemaVersion int `json:"schemaVersion"` + MediaType string `json:"mediaType"` + Config struct { + MediaType string `json:"mediaType"` + Size int64 `json:"size"` + Digest string `json:"digest"` + } `json:"config"` + Layers []struct { + MediaType string `json:"mediaType"` + Size int64 `json:"size"` + Digest string `json:"digest"` + } `json:"layers"` + } + + if err := json.Unmarshal(data, &manifest); err != nil { + return 0 + } + + name := typesmodel.Name{ + Host: "registry.ollama.ai", + Namespace: "library", + Model: "fuzz-test", + Tag: "latest", + } + + manifestDir, err := os.MkdirTemp("", "ollama-manifest-fuzz") + if err != nil { + return 0 + } + defer os.RemoveAll(manifestDir) + + manifestPath := filepath.Join(manifestDir, name.Filepath()) + if err := os.MkdirAll(filepath.Dir(manifestPath), 0755); err != nil { + return 0 + } + + if err := os.WriteFile(manifestPath, data, 0644); err != nil { + return 0 + } + + if _, err := server.ParseNamedManifest(name); err != nil { + return 0 + } + + return 1 +} + +func FuzzAddContent(data []byte) int { + if len(data) == 0 { + return -1 + } + + p := &thinking.Parser{ + OpeningTag: "", + ClosingTag: "", + } + + const maxSize = 10 * 1024 + if len(data) > maxSize { + data = data[:maxSize] + } + + content := string(data) + thinkingContent, remaining := p.AddContent(content) + + if !strings.Contains(thinkingContent, content) || !strings.Contains(remaining, content) { + return 0 + } + + return 1 +} + +func FuzzParserState(data []byte) int { + if len(data) == 0 { + return -1 + } + + p := &thinking.Parser{ + OpeningTag: "", + ClosingTag: "", + } + + content := string(data) + p.AddContent(content) + + // We can't check internal state directly, so we'll verify behavior instead + // by checking if the parser correctly handles valid/invalid content + if strings.Contains(content, "") && strings.Contains(content, "") { + // Valid thinking tags - should return some thinking content + thinkingContent, _ := p.AddContent("") + if thinkingContent == "" { + return 0 + } + } else { + // No thinking tags - should return empty thinking content + thinkingContent, _ := p.AddContent("") + if thinkingContent != "" { + return 0 + } + } + + return 1 +} + +func FuzzEat(data []byte) int { + if len(data) == 0 { + return -1 + } + + p := &thinking.Parser{ + OpeningTag: "", + ClosingTag: "", + } + + // Test AddContent which internally uses eat() + thinkingContent, remaining := p.AddContent(string(data)) + + content := string(data) + if !strings.Contains(thinkingContent, content) || !strings.Contains(remaining, content) { + return 0 + } + + return 1 +} diff --git a/projects/ollama/model_decode-lf.toml b/projects/ollama/model_decode-lf.toml new file mode 100644 index 000000000..b622b7edf --- /dev/null +++ b/projects/ollama/model_decode-lf.toml @@ -0,0 +1,28 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[sydr] +target = "/model_decode_sydr @@" +args = "-s 90 --wait-jobs -j2" +jobs = 2 + +[libfuzzer] +path = "/model_decode_fuzz" +args = "-jobs=1000 -workers=4 -rss_limit_mb=8192 /corpus/model/corpus_decode" + +[cov] +target = "/model_decode_sydr @@" +source = "/ollama" diff --git a/projects/ollama/model_decode-libafl.toml b/projects/ollama/model_decode-libafl.toml new file mode 100644 index 000000000..20bc615eb --- /dev/null +++ b/projects/ollama/model_decode-libafl.toml @@ -0,0 +1,30 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[sydr] +target = "/model_decode_sydr @@" +args = "-s 90 --wait-jobs -j2" +jobs = 2 + +[difuzz] +path = "/directed_target/sydr/difuzz/libafl_difuzz" +target = "/difuzz_target_model_decode @@" +args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /corpus/model/corpus_decode -e /ets_model_decode.toml" +casr_bin = "/model_decode_sydr" + +[cov] +target = "/model_decode_coverage @@" +source = "/ollama" diff --git a/projects/ollama/model_decode_sydr.go b/projects/ollama/model_decode_sydr.go new file mode 100644 index 000000000..868c3fb99 --- /dev/null +++ b/projects/ollama/model_decode_sydr.go @@ -0,0 +1,12 @@ +package main + +import ( + "os" + + "github.com/ollama/ollama/fuzz" +) + +func main() { + data, _ := os.ReadFile(os.Args[1]) + fuzz.FuzzDecode(data) +} diff --git a/projects/ollama/model_encode-lf.toml b/projects/ollama/model_encode-lf.toml new file mode 100644 index 000000000..3cd01ea65 --- /dev/null +++ b/projects/ollama/model_encode-lf.toml @@ -0,0 +1,28 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[sydr] +target = "/model_encode_sydr @@" +args = "-s 90 --wait-jobs -j2" +jobs = 2 + +[libfuzzer] +path = "/model_encode_fuzz" +args = "-jobs=1000 -workers=4 -rss_limit_mb=8192 /corpus/model/corpus_encode" + +[cov] +target = "/model_encode_sydr @@" +source = "/ollama" diff --git a/projects/ollama/model_encode-libafl.toml b/projects/ollama/model_encode-libafl.toml new file mode 100644 index 000000000..74a48766d --- /dev/null +++ b/projects/ollama/model_encode-libafl.toml @@ -0,0 +1,30 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[sydr] +target = "/model_encode_sydr @@" +args = "-s 90 --wait-jobs -j2" +jobs = 2 + +[difuzz] +path = "/directed_target/sydr/difuzz/libafl_difuzz" +target = "/difuzz_target_model_encode @@" +args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /corpus/model/corpus_encode -e /ets_model_encode.toml" +casr_bin = "/model_encode_sydr" + +[cov] +target = "/model_encode_coverage @@" +source = "/ollama" diff --git a/projects/ollama/model_encode_sydr.go b/projects/ollama/model_encode_sydr.go new file mode 100644 index 000000000..a5949ca52 --- /dev/null +++ b/projects/ollama/model_encode_sydr.go @@ -0,0 +1,12 @@ +package main + +import ( + "os" + + "github.com/ollama/ollama/fuzz" +) + +func main() { + data, _ := os.ReadFile(os.Args[1]) + fuzz.FuzzEncode(data) +} diff --git a/projects/ollama/ollama.patch b/projects/ollama/ollama.patch new file mode 100644 index 000000000..ca1e66b5b --- /dev/null +++ b/projects/ollama/ollama.patch @@ -0,0 +1,20 @@ +diff --git a/convert/tokenizer.go b/convert/tokenizer.go +index bedcd4f8..ab9c67a3 100644 +--- a/convert/tokenizer.go ++++ b/convert/tokenizer.go +@@ -329,3 +329,15 @@ func (sv SpecialVocabulary) Key() string { + + panic("unknown special vocabulary type") + } ++ ++// ParseVocabularyFromTokenizer is the exported wrapper for parseVocabularyFromTokenizer ++// for use in fuzz testing. ++func ParseVocabularyFromTokenizer(fsys fs.FS) (*Vocabulary, error) { ++ return parseVocabularyFromTokenizer(fsys) ++} ++ ++// ParseVocabulary is the exported wrapper for parseVocabulary ++// for use in fuzz testing. ++func ParseVocabulary(fsys fs.FS) (*Vocabulary, error) { ++ return parseVocabulary(fsys) ++} diff --git a/projects/ollama/parser_parsefile-lf.toml b/projects/ollama/parser_parsefile-lf.toml new file mode 100644 index 000000000..4793442c6 --- /dev/null +++ b/projects/ollama/parser_parsefile-lf.toml @@ -0,0 +1,28 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[sydr] +target = "/parser_parsefile_sydr @@" +args = "-s 90 --wait-jobs -j2" +jobs = 2 + +[libfuzzer] +path = "/parser_parsefile_fuzz" +args = "-jobs=1000 -workers=4 -rss_limit_mb=8192 /corpus/parser/corpus_parsefile" + +[cov] +target = "/parser_parsefile_sydr @@" +source = "/ollama" diff --git a/projects/ollama/parser_parsefile-libafl.toml b/projects/ollama/parser_parsefile-libafl.toml new file mode 100644 index 000000000..4305a8dd9 --- /dev/null +++ b/projects/ollama/parser_parsefile-libafl.toml @@ -0,0 +1,30 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[sydr] +target = "/parser_parsefile_sydr @@" +args = "-s 90 --wait-jobs -j2" +jobs = 2 + +[difuzz] +path = "/directed_target/sydr/difuzz/libafl_difuzz" +target = "/difuzz_target_parser_parsefile @@" +args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /corpus/parser/corpus_parsefile -e /ets_parser_parsefile.toml" +casr_bin = "/parser_parsefile_sydr" + +[cov] +target = "/parser_parsefile_coverage @@" +source = "/ollama" diff --git a/projects/ollama/parser_parsefile_sydr.go b/projects/ollama/parser_parsefile_sydr.go new file mode 100644 index 000000000..0471a2999 --- /dev/null +++ b/projects/ollama/parser_parsefile_sydr.go @@ -0,0 +1,12 @@ +package main + +import ( + "os" + + "github.com/ollama/ollama/fuzz" +) + +func main() { + data, _ := os.ReadFile(os.Args[1]) + fuzz.FuzzParseFile(data) +} diff --git a/projects/ollama/server_manifest-lf.toml b/projects/ollama/server_manifest-lf.toml new file mode 100644 index 000000000..cc15756fd --- /dev/null +++ b/projects/ollama/server_manifest-lf.toml @@ -0,0 +1,28 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[sydr] +target = "/server_manifest_sydr @@" +args = "-s 90 --wait-jobs -j2" +jobs = 2 + +[libfuzzer] +path = "/server_manifest_fuzz" +args = "-jobs=1000 -workers=4 -rss_limit_mb=8192 /corpus/server/corpus_manifest" + +[cov] +target = "/server_manifest_sydr @@" +source = "/ollama" diff --git a/projects/ollama/server_manifest-libafl.toml b/projects/ollama/server_manifest-libafl.toml new file mode 100644 index 000000000..23dc9b3a0 --- /dev/null +++ b/projects/ollama/server_manifest-libafl.toml @@ -0,0 +1,30 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[sydr] +target = "/server_manifest_sydr @@" +args = "-s 90 --wait-jobs -j2" +jobs = 2 + +[difuzz] +path = "/directed_target/sydr/difuzz/libafl_difuzz" +target = "/difuzz_target_server_manifest @@" +args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /corpus/server/corpus_manifest -e /ets_server_manifest.toml" +casr_bin = "/server_manifest_sydr" + +[cov] +target = "/server_manifest_coverage @@" +source = "/ollama" diff --git a/projects/ollama/server_manifest_sydr.go b/projects/ollama/server_manifest_sydr.go new file mode 100644 index 000000000..59807f9d8 --- /dev/null +++ b/projects/ollama/server_manifest_sydr.go @@ -0,0 +1,12 @@ +package main + +import ( + "os" + + "github.com/ollama/ollama/fuzz" +) + +func main() { + data, _ := os.ReadFile(os.Args[1]) + fuzz.FuzzParseNamedManifest(data) +} diff --git a/projects/ollama/server_newlayer-lf.toml b/projects/ollama/server_newlayer-lf.toml new file mode 100644 index 000000000..0d76a047f --- /dev/null +++ b/projects/ollama/server_newlayer-lf.toml @@ -0,0 +1,28 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[sydr] +target = "/server_newlayer_sydr @@" +args = "-s 90 --wait-jobs -j2" +jobs = 2 + +[libfuzzer] +path = "/server_newlayer_fuzz" +args = "-jobs=1000 -workers=4 -rss_limit_mb=8192 /corpus/server/corpus_newlayer" + +[cov] +target = "/server_newlayer_sydr @@" +source = "/ollama" diff --git a/projects/ollama/server_newlayer-libafl.toml b/projects/ollama/server_newlayer-libafl.toml new file mode 100644 index 000000000..99d60af30 --- /dev/null +++ b/projects/ollama/server_newlayer-libafl.toml @@ -0,0 +1,30 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[sydr] +target = "/server_newlayer_sydr @@" +args = "-s 90 --wait-jobs -j2" +jobs = 2 + +[difuzz] +path = "/directed_target/sydr/difuzz/libafl_difuzz" +target = "/difuzz_target_server_newlayer @@" +args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /corpus/server/corpus_newlayer -e /ets_server_newlayer.toml" +casr_bin = "/server_newlayer_sydr" + +[cov] +target = "/server_newlayer_coverage @@" +source = "/ollama" diff --git a/projects/ollama/server_newlayer_sydr.go b/projects/ollama/server_newlayer_sydr.go new file mode 100644 index 000000000..76ad7f116 --- /dev/null +++ b/projects/ollama/server_newlayer_sydr.go @@ -0,0 +1,12 @@ +package main + +import ( + "os" + + "github.com/ollama/ollama/fuzz" +) + +func main() { + data, _ := os.ReadFile(os.Args[1]) + fuzz.FuzzNewLayer(data) +} diff --git a/projects/ollama/thinking_content-lf.toml b/projects/ollama/thinking_content-lf.toml new file mode 100644 index 000000000..fd9a190b8 --- /dev/null +++ b/projects/ollama/thinking_content-lf.toml @@ -0,0 +1,28 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[sydr] +target = "/thinking_content_sydr @@" +args = "-s 90 --wait-jobs -j2" +jobs = 2 + +[libfuzzer] +path = "/thinking_content_fuzz" +args = "-jobs=1000 -workers=4 -rss_limit_mb=8192 /corpus/thinking/corpus_content" + +[cov] +target = "/thinking_content_sydr @@" +source = "/ollama" diff --git a/projects/ollama/thinking_content-libafl.toml b/projects/ollama/thinking_content-libafl.toml new file mode 100644 index 000000000..689fdb595 --- /dev/null +++ b/projects/ollama/thinking_content-libafl.toml @@ -0,0 +1,30 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[sydr] +target = "/thinking_content_sydr @@" +args = "-s 90 --wait-jobs -j2" +jobs = 2 + +[difuzz] +path = "/directed_target/sydr/difuzz/libafl_difuzz" +target = "/difuzz_target_thinking_content @@" +args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /corpus/thinking/corpus_content -e /ets_thinking_content.toml" +casr_bin = "/thinking_content_sydr" + +[cov] +target = "/thinking_content_coverage @@" +source = "/ollama" diff --git a/projects/ollama/thinking_content_sydr.go b/projects/ollama/thinking_content_sydr.go new file mode 100644 index 000000000..48c507d26 --- /dev/null +++ b/projects/ollama/thinking_content_sydr.go @@ -0,0 +1,12 @@ +package main + +import ( + "os" + + "github.com/ollama/ollama/fuzz" +) + +func main() { + data, _ := os.ReadFile(os.Args[1]) + fuzz.FuzzAddContent(data) +} diff --git a/projects/ollama/thinking_eat-lf.toml b/projects/ollama/thinking_eat-lf.toml new file mode 100644 index 000000000..0c1e56a13 --- /dev/null +++ b/projects/ollama/thinking_eat-lf.toml @@ -0,0 +1,28 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[sydr] +target = "/thinking_eat_sydr @@" +args = "-s 90 --wait-jobs -j2" +jobs = 2 + +[libfuzzer] +path = "/thinking_eat_fuzz" +args = "-jobs=1000 -workers=4 -rss_limit_mb=8192 /corpus/thinking/corpus_eat" + +[cov] +target = "/thinking_eat_sydr @@" +source = "/ollama" diff --git a/projects/ollama/thinking_eat-libafl.toml b/projects/ollama/thinking_eat-libafl.toml new file mode 100644 index 000000000..a09d54766 --- /dev/null +++ b/projects/ollama/thinking_eat-libafl.toml @@ -0,0 +1,30 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[sydr] +target = "/thinking_eat_sydr @@" +args = "-s 90 --wait-jobs -j2" +jobs = 2 + +[difuzz] +path = "/directed_target/sydr/difuzz/libafl_difuzz" +target = "/difuzz_target_thinking_eat @@" +args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /corpus/thinking/corpus_eat -e /ets_thinking_eat.toml" +casr_bin = "/thinking_eat_sydr" + +[cov] +target = "/thinking_eat_coverage @@" +source = "/ollama" diff --git a/projects/ollama/thinking_eat_sydr.go b/projects/ollama/thinking_eat_sydr.go new file mode 100644 index 000000000..48fb05d10 --- /dev/null +++ b/projects/ollama/thinking_eat_sydr.go @@ -0,0 +1,12 @@ +package main + +import ( + "os" + + "github.com/ollama/ollama/fuzz" +) + +func main() { + data, _ := os.ReadFile(os.Args[1]) + fuzz.FuzzEat(data) +} diff --git a/projects/ollama/thinking_state-lf.toml b/projects/ollama/thinking_state-lf.toml new file mode 100644 index 000000000..2ad5238d9 --- /dev/null +++ b/projects/ollama/thinking_state-lf.toml @@ -0,0 +1,28 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[sydr] +target = "/thinking_state_sydr @@" +args = "-s 90 --wait-jobs -j2" +jobs = 2 + +[libfuzzer] +path = "/thinking_state_fuzz" +args = "-jobs=1000 -workers=4 -rss_limit_mb=8192 /corpus/thinking/corpus_state" + +[cov] +target = "/thinking_state_sydr @@" +source = "/ollama" diff --git a/projects/ollama/thinking_state-libafl.toml b/projects/ollama/thinking_state-libafl.toml new file mode 100644 index 000000000..67abc5b25 --- /dev/null +++ b/projects/ollama/thinking_state-libafl.toml @@ -0,0 +1,29 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +[sydr] +target = "/thinking_state_sydr @@" +args = "-s 90 --wait-jobs -j2" +jobs = 2 + +[difuzz] +path = "/directed_target/sydr/difuzz/libafl_difuzz" +target = "/difuzz_target_thinking_state @@" +args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /corpus/thinking/corpus_state -e /ets_thinking_state.toml" +casr_bin = "/thinking_state_sydr" +[cov] +target = "/thinking_state_coverage @@" +source = "/ollama" diff --git a/projects/ollama/thinking_state_sydr.go b/projects/ollama/thinking_state_sydr.go new file mode 100644 index 000000000..0fb0e6595 --- /dev/null +++ b/projects/ollama/thinking_state_sydr.go @@ -0,0 +1,12 @@ +package main + +import ( + "os" + + "github.com/ollama/ollama/fuzz" +) + +func main() { + data, _ := os.ReadFile(os.Args[1]) + fuzz.FuzzParserState(data) +} From 46c6b681392bf25d4ac4a5a26a3c986207338d9c Mon Sep 17 00:00:00 2001 From: headshog Date: Thu, 2 Oct 2025 16:42:44 +0300 Subject: [PATCH 2/5] Remove useless targets and add new --- projects/ollama/Dockerfile | 8 +- projects/ollama/Dockerfile_libafl | 10 +- projects/ollama/README.md | 40 +++---- projects/ollama/build.sh | 8 +- projects/ollama/corpus.zip | Bin 37213 -> 39473 bytes projects/ollama/directed_target/Makefile.toml | 52 ++++----- ...decode.toml => config_harmony_parser.toml} | 2 +- ...odel_encode.toml => config_wordpiece.toml} | 2 +- projects/ollama/fuzz.go | 105 +++++++----------- ..._decode-lf.toml => harmony_parser-lf.toml} | 8 +- ...libafl.toml => harmony_parser-libafl.toml} | 10 +- ..._encode_sydr.go => harmony_parser_sydr.go} | 2 +- projects/ollama/ollama.patch | 19 +++- ...model_encode-lf.toml => wordpiece-lf.toml} | 8 +- ...code-libafl.toml => wordpiece-libafl.toml} | 10 +- ...model_decode_sydr.go => wordpiece_sydr.go} | 2 +- 16 files changed, 136 insertions(+), 150 deletions(-) rename projects/ollama/directed_target/{config_model_decode.toml => config_harmony_parser.toml} (93%) rename projects/ollama/directed_target/{config_model_encode.toml => config_wordpiece.toml} (93%) rename projects/ollama/{model_decode-lf.toml => harmony_parser-lf.toml} (81%) rename projects/ollama/{model_encode-libafl.toml => harmony_parser-libafl.toml} (80%) rename projects/ollama/{model_encode_sydr.go => harmony_parser_sydr.go} (79%) rename projects/ollama/{model_encode-lf.toml => wordpiece-lf.toml} (81%) rename projects/ollama/{model_decode-libafl.toml => wordpiece-libafl.toml} (80%) rename projects/ollama/{model_decode_sydr.go => wordpiece_sydr.go} (81%) diff --git a/projects/ollama/Dockerfile b/projects/ollama/Dockerfile index 3e3161c86..b7315985d 100644 --- a/projects/ollama/Dockerfile +++ b/projects/ollama/Dockerfile @@ -6,7 +6,7 @@ RUN git clone https://github.com/ollama/ollama.git /ollama WORKDIR /ollama -RUN git checkout 26214125e86ac1d4512dff68c983137589cfddbf +RUN git checkout 05a43e078a89247dcc71c703c1bee2af97c1655d # Apply patch. COPY ollama.patch build.sh ./ @@ -17,7 +17,7 @@ COPY corpus.zip / RUN unzip /corpus.zip -d / # Create directories for fuzz targets. -RUN mkdir sydr && cd sydr && mkdir -p convert model parser server thinking +RUN mkdir sydr && cd sydr && mkdir -p convert parser server thinking harmony wordpiece # Move fuzz targets. RUN mkdir fuzz @@ -29,10 +29,10 @@ COPY thinking_content_sydr.go sydr/thinking COPY server_newlayer_sydr.go sydr/server COPY server_manifest_sydr.go sydr/server COPY parser_parsefile_sydr.go sydr/parser -COPY model_encode_sydr.go sydr/model -COPY model_decode_sydr.go sydr/model COPY convert_tokenizer_sydr.go sydr/convert COPY convert_vocabulary_sydr.go sydr/convert +COPY harmony_parser_sydr.go /ollama/sydr/harmony +COPY wordpiece_sydr.go /ollama/sydr/wordpiece # Build GGML. RUN mkdir -p build && cd build && \ diff --git a/projects/ollama/Dockerfile_libafl b/projects/ollama/Dockerfile_libafl index 1c2f1e219..11add74b9 100644 --- a/projects/ollama/Dockerfile_libafl +++ b/projects/ollama/Dockerfile_libafl @@ -26,7 +26,7 @@ RUN git clone https://github.com/ollama/ollama.git /ollama WORKDIR /ollama -RUN git checkout 26214125e86ac1d4512dff68c983137589cfddbf +RUN git checkout 05a43e078a89247dcc71c703c1bee2af97c1655d # Apply patch. COPY ollama.patch build.sh ./ @@ -38,8 +38,8 @@ RUN unzip /corpus.zip -d / # Create directories for fuzz targets. RUN mkdir sydr && cd sydr && mkdir -p convert/tokenizer convert/vocabulary \ - model/encode model/decode parser/parsefile server/newlayer server/manifest \ - thinking/state thinking/eat thinking/content + parser/parsefile server/newlayer server/manifest thinking/state thinking/eat \ + thinking/content harmony/parser wordpiece/encode # Move fuzz targets. RUN mkdir fuzz @@ -51,10 +51,10 @@ COPY thinking_content_sydr.go sydr/thinking/content/main.go COPY server_newlayer_sydr.go sydr/server/newlayer/main.go COPY server_manifest_sydr.go sydr/server/manifest/main.go COPY parser_parsefile_sydr.go sydr/parser/parsefile/main.go -COPY model_encode_sydr.go sydr/model/encode/main.go -COPY model_decode_sydr.go sydr/model/decode/main.go COPY convert_tokenizer_sydr.go sydr/convert/tokenizer/main.go COPY convert_vocabulary_sydr.go sydr/convert/vocabulary/main.go +COPY harmony_parser_sydr.go sydr/harmony/parser/main.go +COPY wordpiece_sydr.go sydr/wordpiece/encode/main.go # Build GGML. RUN mkdir -p build && cd build && \ diff --git a/projects/ollama/README.md b/projects/ollama/README.md index c2537c346..fbea686fd 100644 --- a/projects/ollama/README.md +++ b/projects/ollama/README.md @@ -61,26 +61,6 @@ Ollama project has 10 fuzz targets. # cd /fuzz # sydr-fuzz -c convert_vocabulary-libafl.toml run -### model_encode (libfuzzer) - - # cd /fuzz - # sydr-fuzz -c model_encode-lf.toml run - -### model_encode (LibAFL-DiFuzz) - - # cd /fuzz - # sydr-fuzz -c model_encode-libafl.toml run - -### model_decode (libfuzzer) - - # cd /fuzz - # sydr-fuzz -c model_decode-lf.toml run - -### model_decode (LibAFL-DiFuzz) - - # cd /fuzz - # sydr-fuzz -c model_encode-libafl.toml run - ### server_manifest (libfuzzer) # cd /fuzz @@ -140,3 +120,23 @@ Ollama project has 10 fuzz targets. # cd /fuzz # sydr-fuzz -c parser_parsefile-libafl.toml run + +### harmony_parser (libfuzzer) + + # cd /fuzz + # sydr-fuzz -c harmony_parser-lf.toml run + +### harmony_parser (LibAFL-DiFuzz) + + # cd /fuzz + # sydr-fuzz -c harmony_parser-libafl.toml run + +### wordpiece (libfuzzer) + + # cd /fuzz + # sydr-fuzz -c wordpiece-lf.toml run + +### wordpiece (LibAFL-DiFuzz) + + # cd /fuzz + # sydr-fuzz -c wordpiece-libafl.toml run diff --git a/projects/ollama/build.sh b/projects/ollama/build.sh index 527292c68..44a620a95 100755 --- a/projects/ollama/build.sh +++ b/projects/ollama/build.sh @@ -18,10 +18,10 @@ LIBFUZZER_TARGETS=( "thinking_eat_fuzz:/ollama/fuzz:FuzzEat" "convert_tokenizer_fuzz:/ollama/fuzz:FuzzParseVocabularyFromTokenizer" "convert_vocabulary_fuzz:/ollama/fuzz:FuzzParseVocabulary" - "model_encode_fuzz:/ollama/fuzz:FuzzEncode" - "model_decode_fuzz:/ollama/fuzz:FuzzDecode" "server_manifest_fuzz:/ollama/fuzz:FuzzParseNamedManifest" "server_newlayer_fuzz:/ollama/fuzz:FuzzNewLayer" + "harmony_parser_fuzz:/ollama/fuzz:FuzzHarmonyParser" + "wordpiece_fuzz:/ollama/fuzz:FuzzWordPiece" ) # Sydr targets @@ -32,10 +32,10 @@ SYDR_TARGETS=( "thinking_eat_sydr:/ollama/sydr/thinking" "convert_tokenizer_sydr:/ollama/sydr/convert" "convert_vocabulary_sydr:/ollama/sydr/convert" - "model_encode_sydr:/ollama/sydr/model" - "model_decode_sydr:/ollama/sydr/model" "server_manifest_sydr:/ollama/sydr/server" "server_newlayer_sydr:/ollama/sydr/server" + "harmony_parser_sydr:/ollama/sydr/harmony" + "wordpiece_sydr:/ollama/sydr/wordpiece" ) build_libfuzzer() { diff --git a/projects/ollama/corpus.zip b/projects/ollama/corpus.zip index 98f7f08a790cdad2d885ff858e5540cf9ebc3d66..4deda937fdc867a238864a11b7febdac1d77d6ae 100644 GIT binary patch literal 39473 zcmb_l2|UzY_a{qbizqE(P$IG=QBqQ}leL}}27}3N2vKNNk~XbKrA1mSrA51*QV6A# z_Oxed7n1+I^D{H|H_PugJ@4Q9xo=O;+k3v}oO{l>=Pti*t`1`2QX=rDW95wb%zxI03R80bvmV zv`|dU?N1fNV$S7v{)6fln*W3A4tW7wq03CE|l7!<1+$ChC_u|s0q{JRv=ZO zwSwDX$B1ZJ7=<3mhz+9zM1)2}QyBCZ3N?%t!|??)qR0E#Oc{U$$0%YvBO@Zf&wF>S z|Galo+2_3*GVl;UGW&E)4+SATff_`L?vs&HZ-Uzvzg#a7tiAJY{igSR{iIv4j>)i2?s}D0OK9C~rY{ z1t3FICrrn;#QkulUSPd5-RkWX&xP)Z? z0eI=`kPyNpSP>E+{=bXG3J$4Q?vx{&KrAj`((x(Ig0&@a@qhFIiBut7z@5eR2chREu6A%Z@3tXbX@E<=}lA@cu%pL1Bq&z1sdc;xNUqUf=4BB}l~rl%nap9pq$buH4lRasqir`q9+yQ{Xoot~Y9)CbLVIwDA$0X3jb zGjWpz=x~fC(;z&;Cx#ltAVLOzgy{t4ALPsigxZsA`GD1x>ytr6Qln$&)KDM)&lT#vQLU|<+**T#_{hSB3`0Y3f_;W4!E7$USnj%y1~)vqlr7VZ-f9-2UeXu&eilKsc=uKlrM)EWHabt zk)ebMSjx^mU6^|r26p51i|f})qk9(ax`Lb&uuenYet0TCbD+a1OW=cg)61tPx2|Ga)ue3`U4x`AXqgZ3@hvYri|i~ zF3P8_oK;##Z0Z9e@+PN}u`~l(;sJqC>>mp84E|+~Uz!@Y4cobkh^P}w{+kR3F|m%7 z-&iB?-)dgJ3N{r%I^Wh%a8-N1x9g1rSWZATcbQ#)u&fcuu~-U{7Uy zbxU_}a}WJKCqTi1E8YPd`$tW%L;KcL(hA0L+YKcRW!5fTms~I_mf+g*SJ8)e0TV})au&R=z=nuuC(Kjs3&(N*Igf44LehyB~XaBeePSFSpN8* zsySN~2QjW7yPTfs1e-WG2&x@R3sx*JD;|+I`u-rNceKRUq0ya&bk=bqLF%$_g)8W= zef9~aMbq$DFU88Xczd*KjxAzsB?+1y79z`qLRDLOIK<*)>HGcfCcp;EP&n)UrskHWma+=2 zg4+NsBo|%<;;**`apDAAAcRGPCtwA(!-3?Q>md+im+-+v9cT}SBCjBNxDj?f@E!<* zgX_-BA_;8rqGOUQV;Qt)i=;3bgFy|VC0SY|(ZU0gEH$J!{wfD(N6r4(R|1e!MFpW@ zCnv=K2@Wo_uuLbZYtv;`cjRisjGvmaK|*0^sz$if7{>#n!X_BnDMVc;kD3$v()e{x zQY~#7WkSZe88^P@TP?`76|db^xYD)Xw!$kJuKlO>W%kvtX~gylnT0g zr&dQH4oSaDdu8dZpYG?TsZik>5bHBp?eMK=qo-EQ zKTS%L``dS(ychcO?y6Kq?B>d8TUEn~>rVaq)}Z#@Z?k{ieU#vY<_ci`Fd1((xIDu# zn6I;$b;=r84hNU@R0e|%yd556kpymv!oz8yNtV=bYG?xZ*GxZS%jS9jG`Gt3A?yL* z;0uJg*#m$qAONDoL`)5g4fl_sM}#x~6aiBo~RZEZtSZ3@28r)nLo-`Yv+Y8bF z3#(X&&Z~j!?Kx5@6nTj&z0NNOPPR(Onj7F?{d`5YM!!LOFIS``MoA3|?(U=%4@+!)-6QS(&VR=Wg@{Rd(>UHg0aQBClW(OD)PaM4sAH$OJAgiL zaJgSlsCx%fV<>b6#h9W?F`m{J_{e;~bhYVGb({`h;ouLA9m>L#g@Xs0XTp(O^XNOp zqEP)JVq=(B9?`U@SkT|0%3xEI50sgFK`y`sC}IZ&-{8P>Sqb!jgG(3L+w}ue3}qy) zBp;6KH@5DChWgC;#Rhd23i~P^KW`qrUtA*l!{aa0=cyED-{_f0Eh}46)9>NatxJzf z+ILHCyrCsAb>YjM%QsUyFGmeS29>(_A;E$<=`>JDYWvu#Y~Y{|0%r_6jXebPfrCq@u#Lr1{fy*i zCSKOaAFAN6PNzroaf)8l#qca?6-_D8!CnkP$pd{EuFHFxxhn+j=> zA1$|MZ~i`Qq|V{Q1KI`h?ULI*Nn6<*vuPb?w|eH&X=gWm8orBqrS17u=P}m?OZ^*}cDP^4CKEnlT$FfT z%<+95F!aN-k_f_R!0uxbfsJr**-0J^3(5mUTiWa{dWjueHeuNmRqb@m?f1@J)~bGR zL-iUG4OsEo1~h7Fo3wQ@a624);}bix4+7f2!KD$qN(wAqAW!^>3)mB&h11zUbu*xW zqrd>b9P=5d00);Er3E_Ryk}fNvF>>1@g)VfoW|=rJGvY%{$^Wq>(-e9yBddr;?mRt zJ3ak7;>O?XHw_6KHzO+wJ;bO7N}MqmJ98#b044|jx`Fwk2`B¨Cp-SDCq5SMDA# zAakGl+39t@(i7MINg0qF&q%ZwbJwe6xZ(QEw@c@*sy$!S>8Y#Mzhz0;f%3U8evA<- z(VePa*4m#FE%$*!ROyZOu0WZ&0u{ni^(9aS4sL~RU6oBS93XP#vb&k6qKBpP4Ed0) zGcxMd4y^dpzD4(gmCNWYiQV)$TMUf1=2lvJw)Dnj6zAMCYclMA=*}3=Ck6JeEWhX0 zAL}>Wu2?gw6KRTSfO6yo9=kfY3lxKcOS%7A;5Pwi!{6y(PXhNP0%8_J_64YLa3TNg zGK=NPT7WzLtgHj!LXTA`Cx8hD7cM(j_@slt^g&v>VxWQ7v|*YsL}3l#AEMYTW)6Ud zgG&W=o;dVnLg?Zx69#|#>c&X%OIT-~HJ!R=_mhTKudaV@7*YOt!}Yz;b0`Fb|BIz`L);p`YB+aog5S9CIMiD$)gF}g*D9|1= zJGRR}8XR24F<;!MBMvhILR%;5PJ*XE@PI*pP^>$v1_I&W66)@8UE(a4%?K`2b|W!6nbZF@Hp5jn)9Sd&N4& zMq?C}{KXa^D$f8Aauc-Q!e>)(2v8Zzna4mp99$5fhzHOD1A-Vq!GQrtyEPHWKGf`c zigo-dKsJ^aH-KC?xMVZmNKw=&>e$?2>2{Ip9#M`H5MU1pwm;ae>ps~n;@Ly^TSVl% ztWQqgaSHQyf%MS6h%LM>@E#FU5DKn#-@erncoYug!SDfpfEtF~=Rq7k zH;FcGE>0BY>qjY9D>o~rSst_8C^6tPfEG=SiH)XF4D}~TxzBU=nB_##m=_UCp@M%G zObd++j19%MfgCL-9XQnhyKp!Rc-+WiK0SO1HIxpoqm)bzziAdN$=lPWH9s&2ka3F_`f}BTV_){ZkKJe9^uqpxPxH?*S%%W((%MK~# zQ#o$u_$eCnXXP?-+$2bgFnTyWj2g-;LxQG`%T8C-%f~6eMmUfY5W7 zhDwOSFF+VHS^z}@JSss?0-&$MmPv`r1N=7d`W87-6r@9FM0k)7`+`V-oeb%(9iFx- z5(j*hWD>7PFbfV=(;#ARI(;TQra(pNVk$Ixpcb-8wy-d`~8W+2omtSLL<(9<6 zd1`~6&&~BKZ1ucXNNWvM4jQ^+^xG^EnsF9dxuI5XKAbxWk5;kcRrb-UAgy9!0?qy^ z;#e8U_4*W8=Y!BSQc_6OkV4i$X!&!k!1eHw6=s_d^8u3| z+{ZIGcjN-1z}+kIPHl}-jqaSv+Ny%rZeEeqRR*_g$Gh3C8NfiVWuOub4NBFlN+d+R zjEao_mnJ^2?1h2{9zv!AC+jsdm=#xwnf)v&8XDZQ5#>DhJ!}0Eq7Y$+rasIfDWpoA zlM(2Jw843sw7@jLp+jDext^W~miM zqg5BRcQ>Cqr~0nBGiFLnMf=w?7yN$d*VbxwO?{l(vncH3a_`6Y+ua`@UjDpn+2i)| zvi7cJ&wnnvtk$%AdgJ>dg|Q*VyDREbKSnOeo1&tsJ?L=%riw4AU6IT4rpd_54^R}B zxhpwv@oVl%?b0c;m$a9ntusGZP-btGU^K?a$i8cdX_q0bOFj&1l{vckjJW&n z6rdOUCPgUSV#De1LGk~GZpvB}6}sd#&mj#x^dKeX zWDBd5B2ArO4}z{GFd{mP7NEbF5rJLT3h-Z|1~mY@&hUwe2%&{DG$zka)Sw4wOg7Tf z0Mg+rEse<<;Q2TBA2pUOL`n)&OHp#o>xsZ|>f$0I6FId_uv*Mk1JqJ*fcpR8z%0;> zY*;}ZwC#Iq=y$3_s%5_K3-s|%D$vo?TrMX7=m-Z=?*;1^4cg#{Fn!ROF~e?u9^bG# zvvBvMd57sgms}9j452^MddXPgoY*;H|BSAYL24sDZfp1VTmI|rwa)6 zd+lcb+SjGdPli`Gx*Jb>BdvRH{L-a&R=9P)9&X?MZQ;Vq-5%4#B2@}@w9XiQCcS%> z$xzNhvJx0_u+c0Xc6D$F6{&Ra=@WcH6+=U^=n#K%ESPy_X~EpZGc1vLhPA;ZHaANH zz`_$4p~5ea8bb4l4+}+rVWr@gzB;#RoojTQl5AhTcRw zO*ozE-?Vh$p^P^e7Q%#FUk~rY0HF*%2BR@8MD!9cza(YF^kBlHCH7sFTh>I{No-nW z=~!-g-3&V|;nbGAdmnO4fSxnJFcn7Ea9R*GhQ5U6Ll5{L^5gs(cJ)gr_^@uwE?NOr z|FXK|bGYl@R=JK{6Z-r)Nf;diVk1N8{-8no-<0H3XnJR-eb>W-TL!03ck422?UHXs z`*=9#Kt1*kvTGBZ!kl|_0kg~Lj9?j?YwOqp=LwcF}h*dys zb#Sz^b6RJ>jBu|a&or+iUX_lb#xk)=TfTj>cl&0aqH?hMg5%RyTW)82j9LB9>bdBF z8&r*LH~0tSofemB%-T&~$~q>2+7Nz&37z_&MarI47m+qapk(37;-VH6uOS%)jrR7F zq*pawU8$y=w0P%l`iYSiW4E9bv{SWO2*o{}*GsEal$2dm$(@_y; zCD+YqE^RtdkfJ6#Up#Y_Z^7cDzIuU_ZO5ov#V%CNIdxCXtg2Ib?6s=>OCyf#J=XSM zLA%`Zp#hfyMF)vz`o|r6ceHV9LC0g{_6W}X)Wkf)XkgW5Fpy20z!~c6nn-OL<>VlB z%~1YnqEy1Cc}L3Mj&t6;bGSpX)>WAmtDZb9D7@JnH&Y>NPuAhLYa(0cN>FzXC7f%^^IzgeV$GsPvljjLM8`ZD@>c*UKHV(X>ea(_4hWV_VSk4Rf^_a4-?|8o~O43 z>5qDvKW)TYBRQl&hLLyak<%skWCaevs|jbukadjR%m~P9LCp-Zok=>TuQp%X)a>?qvj(k3U!!UC`+qiVN^W1eXSk}P zMEa2=J%im#>dO6wx+=>vjGZK}eX@1POt~1GogndON$|*im*zEutj?J=%K6{iw&mtu z<7;G=ipRI?_J68%QT0lPf_2Clrdv6y&3V)c`7aNXQ0xH>%3@Z>b zN;5lD{U3a|cD~9pzjD%W>mseINm7HOk8Y4W~-kcJ_+tz#?lfgh_(F<(^}ZfO#tPvPX+^$@-1==iG)ni8&=ly~Y*j*?N|^ z*&ApZx!s*JuFA#Pv7c09KhON32M@3CYfn#;*omT6MduI;6)H#ouqZwEAHE)ye z30<51_e?Wv4Ak8#4b2Wqo4DmKKP9vE@UHdGXx*Bb$-#%eD9t{-VDt0MM@RZudUkAi z_UugA*uc~RZ{=O_kLQ1scM=P8xvG1#Y3r+q&$)Vwt-No)M1mEDLD9WJ%Q#@QC3qtz zR2aaMS4K=U_)H2hSwI-HKClAM9%LlyF5dk0N&osn#*pFprcuLG9{a7-J{Y(6j{3|^ z7ZzUg3HV`W?K|{R@Fj<%d5nr{l=h3()plca21NK*KVNA*e(;W>72(w5cgL=s9XOn^ za{2lV#yita$f$#q%*4dD`kV}h?iKhAl(rKXqNN}G5Kzz1=8Jnz} zuN%tD>X@>~zlC*!3N}*$KgZ)_1;tQ2lnM+Ufu1fIfy3>08Xj|&RMSp6p#jkn$>&c9uk8kPk zzUWHCtE;paygGdKsN9erEn-b>M;@1b5=mFF%InAs%l&oj&+SCdZT}wsg}ju7zM|h3 zKLOw7!hy8c0(=!75#s}U8}^1mfSbT`GzNSR2mU;TO0jo$aYi~D2z#W1apMtygtuHs zH!J{_eMK2cO`t`S&(i5kr*KepZ92?ny$;)~erS4?`8ZQg<(0k0(_1P{H;cS!8?}~V zI-r>9|LA$O#pQEKv|Ia+#fps_rLpwpgM&L?pQ@L7`L1EH{jgK5qGLuc-nqm%>dl)) z{ZAMkN_p&mCqYauW8=EGSN_WDOnmd>B*z=+e_yKLFkxU_z3j-M-EsFv?OgUH`*7i- zP#L9vx+aPF%lZ{BsPOXgyK|&z(BS@N^-CH)Pmx*RxoF$DapLV;*PSXdvaovbb3^NU z#-zcM4$OA8-&6bV7TF)mzj|eMP8c-5`QxX=?|I)&zE4kvRS3I6g-(<#+V@lpI1vuy z{!D-qnVU^c1rjiGiOaZVYLmygPwN1{Sul{-=mJ1k*R(MSku>soTDY+ob__E+l4fno z8fP-g@cR_kxUD-Irf)s6ZhhXz%gsZJiypNn#pSNvHtw-%|M!vAN-Gy199MhfsORuH zg>0XJyLP`VG8$QtWwCPCnad+3bf#9$c$wFul)a?>SyV%d&h*r=Bd#3Ct!~?XuCU7{ zU};3Sd*ig%mHzs=)l*Gwx=SlpscCyD7pD#4RCidHmK)inM-e8#n9U+-fYt1*jaHc@bE7>$%KL=t zp)sfbd1}%B-_@`39_%gJ^ibz<{`&l{ZNW3N^;OQ+C+>Rs#ku>;fj{}}dt6SowJnV(p(Fe`+cJyyws7o83nyocz(#eP+_V9bMPr)Kq^zQ)@jFf4<}K zx2k(#y~}ehCm$YkX2ZK3-GhGBoUA>4cL%NIi+V)F;tZD`AExQgZ@lonb>Fk6&pzxq z+bhzm7ysp%ybY|oEx%4ui1X7`-$y5{1ee|FK{ zOP9J`rYBP^rdnQl&FFbw-L1UreDb$1KmX|7o96Lr(*4U(QCHkvy?oj4>?bq3=+M`z z?=~sF@>~9+QL0z^)kE_sY0@q`!^9u9)Xx+f`P0=x#Hg%d+pgRGqjk=X8<%b*=Wtz7 zo@RE}bfm++xl@im$(U^X`TND+BG<33J2f{?N2c90rc=A@$>W4LOOdF!id9$6i4Xlz zG+NuJXoiw^i=)Y>E=@b{@*Ca zD*{4t9l9rr%n3DmPX~)DbpmPcYjD}kj!U*OSq9Sn?6{I7N0lm%AGlE%wX}k zX$x&!ui7)rL^fNmP3zvCvP3`oRtymCKzz84wJaNOOoCTxipVLfu^w~nB zxar4&jOcm(V`!$?=kJYwNIj+~b+O!WxM}RH0@}9p@rs9J=57y?&!#Awc*ht8EINO- zEzdCaP1VFZgR4c;=!HQyC$9Z*y318_@X^S;i#3uxA~OreS$d$GqJB zd0+2~riqQPaW0IP8m-r0QDUES&s+9}qSPoO3yF!bnWtAY9W_~~A1bdUdPhv&Ny=eX zLgp6RmF6YKsU_zJJ(+EiW0bwb$GxPsKFs-KnPRcMP2&d3s~?I&=Q-4+Wh6~HZ2V*% zJ#tETg`)hwHdltojhi3q@?hwbakg=9N33XFHC#4#=;JZw+jV5;7b{jhEc<94k{hYK zcJYfBJCB$8Sf8}mX?Xa?wY$Ftx@a~{+~>bzQ@&Et(U`h6HNfL?+Z%?=0gGSzr@m82o4B`IT>PHiNK>i8QjfTn z4JOS4Miz_Y1?DKb%`+Z;&D+Pr)9_`egp{*0A7G`kP8E@mqc#JBOS)`Z@J_{IwYMv~z_;4JWI;H~MK6 ze6QbetEE-^-1jot{-rn1C(D+IZFRBV(3B%Jw&mY>kJ@)vj`=v^!Tl?Rb*cYc49+{a zchiC6o};x#+Vu1Es!?hEnDJt~?$!4L6QfebH2f?aeb93ChTTyox1Fr_csDSu{7|WF zn^#X@*D$kLLBpHWkH0bVKkqx-X5)?GGwt@tHp`^n^gDdVT5fvv5$~FJq9I+UMd|Wc zTL&De2p@aBa92rMVxWu7m2p$DVz-TBcs!h@G0gVF{hHfR43X_(jjr;a@1Dz7`(olJ zT47>PSTlHj)d!RHlXuAVcK23BQxbjlOoEiCR?)wh$c3yP)os{+W`11#|<9zGi%XdPS-yvx0KcB=k?aRAP`hQ{2Z}M!AdDts3U|;p)&rCAsltk@e4X zRyMm$@X5_tdGpGIEUB=jr|WlK8Zok>I^E36E_pG{ee=o%Em7*h%`Ojn-^BT3R!|b$ z_jDm!*ESFqz(V$qz+F)|Esoi7V7sC`vRx6B+v%3EZZ(jc4u(J%vgP)@Cy4>OBYp67 zmwwPv<}D*c;?ve_ZGY=4BKG!-vdTHR;R8-tF7W@f^k(AQtm>&wjS~Y+21csv`qkQh z{;vbpTY-O|Ml^^WAo+KjXt%NDKd)}O}OKF_b0W^*BAX>6`GqF zVs;fCbsYdh;0}XhZr`yEd}_(~8-tgf+bNUKq zFI+f(`FGC~rv%fa`HXH)wKSEbf4==VcYooeGgX1fi+X~}TX#(VbiI6#|3(R)?di!S zi%R$0i|ah`d~dIzG3CnY*1O@EcXEQ*-oUmB&>K+(`k|~_6y%K)zKdsjBPJSr@CB~U z0)+5{S~@sHfoqkO_zt3(G#ZBBqNx{`*eZTc%DC73~w)koKiG^;~@RLnT zNgL7f^r1pk`lu;O^t6ATDE2j&TeM@!g>Sn$s@fWVw@vNH?!NgW`{tu%#?^N$@8w>y zW7bWMEn^nH+{Ahrgq`NBV+etcWF zI_r1YvbgY`n&y(Z32nE2pRMgly)=9Ny;Wh!%l~Zc3Hf>VP5%|I|NLyf{Kw~KdvDpi zCCQJ5zo5MQSia$mXc!-dglGj}ouW11RZ&c=Odf|Kg#QRP2-tRIg zUU$p9=)}f*Cr-VwE4R5`SW{YEySHn{e1(?Y-b3jDzrXa>if8UR7;C?W@hLkernkM+ z|Bqs_{KaZMCjJp`UsUs-rCz8C?2$^=VM%(8de?Co`WXo@{u$ z|Lw0re`!mDjyUr}2Y0EKsr%LH6_!u4j$h$3`M18(2fCEWi|8pw)UTd5OC9aJ$5?D- z%*P5_Nm)sZVUiPCUw`XsZUCNymw4pm5<3b{2m@~zL;k8<%67^P|9nd8cHz+=$Gab= zs8v^1E5)xqSoEOkcxzq$>dZgs=OX5hm~-Ev=jlFo_4?w|jhBAdNrcVyJJ%7no7(Xv zxoS$-g}3Xcy6oyqYJAXsu6xCvj@qidmrgFP+FKg?uC-f3x&5qJ@BORYRV&|)s-5!Z z%vUur<6l2_$68;wv4D@=?#q9+Yymbq0auVm5Oa&`11_*5{>JKeGGLLAm}^jZ zehJrK|4MIpcEoq;hh(4I`%jM9d*=7j)_<0F{)v!bJ}jDJC}ne1dzb|8Z}v&cJvr$c z>{S2oR-VEYxI~KfQx(HXDKA6vFyIIHBQMfp1%Jg(U_px^f$=4CeIbDg<7G=mg+Xb3 z!kF)OFp-cunLs2jb23L{t5q7e$iCxZHjgsU8Pcti0N`1aF#u3YMDkPN6&X%vJOKDE z1t369WfBBDZ!(JD1b_$-Aho7&5I|G*j|!9D4Et?z$GvO zd?6$p0-i+~MF=EDFajTJ3kQMcP(~rDNFanoz>_GW2zua*mcUKmYilAKurkfdqKqPB z5F;2(Acnwd0yF1u%*iOkZxRUbJ(X});F*(A2p@4mKN(^1Bt&B48Iw_n+r$t;`w35! zj3P{wAT)x+O`Ms)^CP1OdBg~SSAl3EI0$$GWE4Rie4a=Uutq}FKW-w{k?i6mFVbqY zP5=a(2^rV`Nm&UBEF>hw^B|)(JR=6cOn~&HBna%{3jSdf+XT2sn1QcC`FROpM+Qdx zB?P{NXA(nTCH#LvctebUrJN85c+O;OBB1N?Q>TC}B9WW05-tP;Ium#|?IwX>W`qz3 zcn)RMh|k0bSP2&b0kr`iP0j;}-Gr5<{|VwC2?SP~NFcb=8gIpK5(q4wgh*`EQTWMr z2NjGUp8k`c@CXIO2tv7umxCD%r(R+Ntb~(H1TP;mTK+u2Aqjz(z{lXi)h0YIGm3DM z7@=>GATffMo0;V%xDSz&VH?5bL1iiqnVJdeHaDLtCr07YGnbE4%vBg+F}6X0{HlB* zuzn0e;5nOdz9EBP?xE4o=)i0UM8uYCh=}KCMiGqwZFApzvt5NVip@$V91@W}L z(q&=6@N~>5SQz-emoQ9NlgA-v7S5Mwz1G0BNl(cj`#yvq!r{aSo}C#r%^ZAlL}(gz zt0AlpQG@WUYms0e$lgi}z_A3+&5T+ip&-x_2=G_6gM)`>V@B~-65}zClCe+kg_|Qh z^D>Gg3aC2;%n`H<e*vEtef*t{$15cgdSFt3uhy#LWSw?NSNe;sD9mcs# zWEIDGc!FgVaOzM}tNvpF#4{?Rm{)|v=C|A)7E?%Bwj{c`owE>Y^Ul6c_VywwPFdxQbOfXgoc`1=m!Q1%?#tu06kRziS z^O6mtg0sNiG{mbhvt!^xJB-TZ8G})|DS$7TM_=ragb#Nx zsxL3?FDh3N{QV$2a{KO-b_h}!t9-nqzNp}hda zwP;B2GR&fK%lXO0PA&Ox&7%79a>k-^tu*-PYlJDxhdmY*%*z9d3ckTtFs3mdMp#rZ zFP|$a*jtmI##l`7VRl7b%*(}!3jWSlFm@rshm{o-%*(Wj3XTBJw0M#Olgo#56_v}& zq>9RY$4@R6!+bbZQ4jO-qoQ)@WBBOXck|DODHTPw*0-qLO#>my9hPd?-*+ouMo6^rxugHvW>aFc#F`}j-7BAE{pDk_&Eh@()`KcY`Ando40GCOUDjX)BVCm+}BAyZyg)1Y6LkU8KvkuRUiNdKGky?iZDRY@%?xqErhlLC; zHztOMEvXwgcr5A)rclU~NwD1U@?>&^wp!ii7220-IMz(yE69b%7Y3UeCixSNGZXcd zp)uQ6EZuowco{SSEF{MufyL8dqOjG%!19t~62W3K1+B&NTcWVh6NIpqo9&Val;dJN zdnF1w&_oDO{#=$s(3riDMg>nwi9utl?QvnCQ7$$B2&q;0&MOAUOCE{Zx&*M^^{o$r z!wI3_>LX+Yu#ifUFD&L_UgAg;_KPsE+%%E^lq7YabMX|BC}Sa=RcBHwb#6lxylLKj{bhL{U7k3+b|Tww&xAjgS#W=6~~tT_BD1d6b= zf#XO#gCgq4jLGCy;R2@bn_wbua&YndhA3_jU}WZ>ryOtM*$#;iIiAHc52A?EEXWa& zB8c%20#K4Th2;oOHi&{=6#|sG`9OK%$U)(PiYEg^LAOsOw-hZvLQg5Q70=d(!iIvs zHHB4TQPF}Uj9Ed=ae6?Z%l9BSb|GsrE()54J($4kD3A!3__xz=pN zzHgzKl^jyB@oj%Fhw&1zab&hyZxC(7?BS=`RzHVn^oMuf*P5>IP};_V^DV;?c%sHBK+IdSLDBX)lcDh}Nc|Kt8yX7959~N0tJ5MNoFWNk_+Kb@e~j!s-8C)D%L4-6G8}wi>F{faYxT3 c!{tZFAP7}L5>|k{;6L5d!QWCa5B~1|0H#Epc>n+a literal 37213 zcmcg!30#cb_n%Zsn8ZJ8pGlqI`_2^CUN$d)Ya3)z>D ztR*B`r2oD1G|heHo#uJQ@BRFr_k(($&*y&6IrrRi&b`mMUpq@-5qS!H#&~KjXZ_Ig zml#Ev;vNtj7)sZ1SR_pmOKdFi9^6#qJqY{>jgX`WiF_2MP*{K2^$wCr#Sb!&Gl+YD ze;7451RE^pGl{{j?rdL%N;Kx*gJA+XhXuI1x`q0>21jDUD;$mSR^%tEI7OTigA6YV zaP-IwPxE&V@C)>%hETQr0z9a`EYqAwjbWLEhiP(4Ds0UwvU4XETUpy^<<1(AO<23)LWH|KvciLkVuvk$NH8+n1u?*><9k>4+r%Mg1Q*IF(iZP z5gO=Ab9W7)I@3Jp&h$XU7(;;Vp&0GTOfL?Qo0cmX#|L4=kD`9H^AOw`tDs{P@m!`a_{V z7#PVMrU4zG9vltPnVALNkaAEe-Q6{i`k&2-UZmc5Jw1z#FoOt|7Fr|G<$h$M$+sWctS~!gweJT@{}8IbJ2j9-bw~3VpG<Lhl{9{^FH4K1+_$ZD#3G{F+GV%lQoqcIORPB(65LO)LV`xj%%;y~9 z98WnGTM12)3YFj4(qduXVzEIft^A7Bi#Iz<4=ozMY1yVFn7B*Kth!*RfI?yB20u_x zapCXEeTo|r;6wGNt)>QJ6$zA(up&Vx6OKNf#OVKN{$CG3`(CCTmC&F~%H4+~7)#vL zm7n`-l>5VvH!qhtFpCX`o19ZETq`j+I6Nx6CH8LlhFisL)g7K6zy4w@KS z+l661y*%n}vk%Y(>ce}j6oWTYNtidB7UB(p5!Iar)(gu3bdJJ&)`?%GHBeYq^wrgq z;sGPig$}uB`>TuX^SjQ9Dc2Rsq0~t@UrizNiJtKOvUaSB$(=q zSy-$)^`xY}J#+nesa+@cZ+%JaR7s5TKKV_4{)H7g>ULx(y3KU>we#i6{JaUCjP%6{ z`y-w$|0HWI>}Ol3k@0lbn}Dw=nyZW#m%e6MBRgZ7Ssc(8>df03!@--rgB)kxk?OZM z$nh~kUqS9ImesC3vA(7VkRdv6xnMn{PGXh>EbE*al^lm8q(8E-FqGW*s4!-PM@&*OL9(bOSbU_J-cC=PUZCe5#=NINn037mp<)abU8=2KJD*y<61(!vuE4L z)N1L8Q5ho_Rc{lyti0*$(Q0nuGW44F zHOq`tdeKeg=Bp;<=Hn-d2e_Bl#h7Rf-g_?E-}TJB37hA84yVVg-@0wmzW5Z=ugUHg zzkGHc?YFIcW_5O=LDGB8&f~hR>mLIx#l+9u&zu{KBs? zTcSu;N~HSgk)YgI=JEAu8;?D<5I5J7J2*%0&o6a)!Hbar7yEBnP@ntsZ2E@L(#u5> zH@c*+%5c&2RNj5sb(ip!;sxjLkDglAE;-?5*|F6Dr;eQd@^D47Ox;kAYo0;_MH1b^ zPruK2v@8ABGX<#a6nl3$f1nT4iK8u=>P)~JO%mGnlr0=R1qnUdA1o+^Tk!=s8IJ1d znr055zS2?Cv%j}Mz0B6es-MK8eh$o`X(yu{9zE=-xD?FhN6!YbLHRh6quzNOydfib zPgTp2oR4Gn6*TqkA*JDJgLNNsjeML=A2`W8zGy|#fkXTE9rsAyvv1*{Wr~@{cON{m zQ{wGnjpRi`nf)A2D(oI6G-OZ1gbAvQjiU{1)<4&8532ukH$if=;n~Ho=3JfQ{TncAr+x=`LuTrG_TwBa`Aq#tYfD%( zyjUX<`FZK7f_LgRJN6B?%vLRwir)DAMSAAl&hWW|k`E@Id>0$ov_#bPfOxvceP3~x z%JMtql%o#TKF?)G1^N8rc{4NapXPG`4v9Jsv`78kE#F+w7`jo;sN->DgmGQ`7ccFR zFPO7Nywj6m={jRgs%|jQ25N-q3VxvEbDiW#a~3G;;0r5jOUaz$U18$S@f5j->N&;p zpu(*mHgM|=67@1VFxVMWl=u&9z}hSP03-LY+wJV`?v4UB5EBPKboU1%!cmd==Tc-O ze>}ZOM1XwH<+#8Il$-MZi1nZ9MPx+1|57m`FwBb3`TB4XvNHx!JCQpY5h>>G;pXW| zb$<_CP)z)GT7wrF|ij(k>zcO97z1T)t=Eo)pv6cfeYc?|YE3NXZ9yvi>9ky(yFP&w*1k7{40Mj#Pz+ zaBSYFLx@qa%)N`bE+@YL~ANnU#Y%WvtbOB;mU%cMk4?UMB*(2 z8JlCC!$*it-6+#Xo7?5`*6pjiFUiurYw_v1|F${mM#F$iM6-<<9Xe7U>8Vrq`Z|Ez zG;KpfrpL?9;0+C45E%f=a(s~aWjWN?gGi`J zXzhY)-#ZR{UYJ$oaPgYBS;eK93P3Y4apmI^{N=#-5QDd-8pN7n>5h-4k|kyiYMK>R zm5yfWr8-p$&C0Uuiq$K$)EtX-EVb;_ge=~Vb97K=zCDTA#OS!Ku_nNU*u1485%&m} z04wg*Gj`QS@2Y2H)-#UQGqT=Z-19zp8?;Pp(C|?HagW6ECk%TnW)&qRi`A-hO3g8^ zw@-N(k6-@429zsYJ4+ePE-KJ9n9lxU@_@|NGXDgAYdQK~WA*GUStEPWe0#Q+nYT!6 zFVVqa)VJy5ma0=zr%&R0e5L z3S}a(f_|X)znoU#T(C#!pgR>ClVe=S{?$XcaJGT06!uT|hE}-^3}5A8#r>m^f2<7l-Kk(5flOvJ z&Jz`)P@si5YZSG;A((&UxTmlAXB}(#QR#G7FDjw=>5|`nITXV~$=BaQrDeiG!X4DK zY_#m{zOxomw4~}#1+Srd$GuCYP$wm0y)fPJw7I%K7AOyINoRsL+9bRr)Hj3%8ktDC z3L>in+i~sH%qz6av@A3yYFRkwR!@E}v0X|gsMW!4Yq^etnaEZu^PN01`JGx277fZ5 z?%4$!MxcPaMIQs+AZ4C29R5F4!l(W`uuV8Q9 zYH}7tgFaXg*tEtCPEAq+0ze^niwAo;NUYhQ(0~xChjR$XGQObqj*N^w@kOH7_wDUV zwJIi-yk)Hcbs%rCxu&`3)}BuuwYBo)IxJ!O67`EPg`!3rURdo>zBGSwLYgUwg5D>o zH8-$+BENMKBCs_QV(~UuKkyc5kL)W_^n5WQG*nMprkk9O7(Ca4qw~gv6NP-<=nI$T z&k6v}pjXrnbQ}s2rM~}=r2qI9vL*cIuh!5X^w+)K#fr9eAj~#kUS)Xvd@albP$b^M z!u=+R<%rcRaIOgDtbY^C$yslDVrS=!={sP_4dHkT0;4L4I+Ezl0sg*NODmu9 zX`y3aWmSbWXp}0hDocNB?-*EKrc+|3Wp5TMPR9~XovP>7(Eyqg)WI*5yM33Rp!NhU z%Gd{pcVx=XFB$mqa};M`^o-S0A^KCpeO)8jW2csps6NrLVe&ybqxu+|?R8$OX@S~a zt65$Tq53F5%gS^Xm@P8PD%I@iG916^b<)4n4=RT>I784S)REP!;0#)y0_fTyuE8Wk z+132cg(Cbe|Gm_ueNv)Jbc#=9*an&x{8_5qe zS1%Xn%sPBQ>te_wk#>MzPOCCo5c?l+v|wV~bm+d)$#^%P+qq8}l4HYOXk>bq1I=YSsOd zc4XF@)^3eGw(f18epuCCZ`$r$RlGrJmDA)(yL&%ft6f|$6SUhWY}o{qgo^Suffjg! z1erculNDnGR9Q^&!CpCuoi(5@RltN zyqQesu72!F7;X;*_1L{5+hrz#8QOOG-FJGRRg}wdFE{Uf!#&!*-OU@xc$0Q!`K&*N za%Q?~zyCN{r}^c!k?SL!KifOjXQ%sBoFAOovS-z%N1v=zuQ_$Zc14!P*O}JUt^D)3 zwPod|T{Mveku8Vv8s!4ZT|B68~viz|Jl{$^YdPVSoGUJKbx=rasJud zowqbB>dEj|%CA2aY|9t&>owA66P>wCU0*No<8%ZHYZ?ilF%xm%|^c&3xiweN*5yb^~#y5gRdShpst z_Svy_ZJF+pGj)E28=XkoKPqpGTa{*J!7P)AXy<=^Ys-J6N$9@{o_1dyzIx}YY{pvK7brvvxQpL?P! z#r^4%_J=DYyq@Q5vM*hJ^2(LV*ME0Cw~jPeyPV$XFgi|Y^`Dm3OAl5W=9hU!Idypz zH0_=J`BuR|_wAz2d*Y*VoN^D|4{twPccfc)lJbpBP51m0D-V1129QLbsfDn^3)+FV zg*?C;r1tH@LLtGS{_wtuhd|!bZM2|y(=@gN;-UoW5pRD`#Ru(N{L39wevNIy`C`3M?@6r|f_ zhJQV;TAG>RWp(eeplXYongDbeeI)%&6hf(5B{nuJ8~^+ec6%R(DzN9V-=b& zPVIhB*jX0yZe-Q8Kl$HB3r}kMc_7r}%AFOx3*!54ZIx|6Tc|N+3-AM_lWds;ie;K7 zmELnntbk0JgpS<`u#oB;?@GO6_td+v979?KAy^-UQbJ;(Oth|4Z1Z%{Ck~TcO$Scj z{LO9p?lZHK6E;~79(Sc+q~5nrXSzCneXbi{MjsTidFa`x{YM-+6@0-qW1dOi{uw!A zZ*->U&oxj|^bWgLY%ZJ&AD~HrxUNpb(eyC(kQF&eV>#(YajjSHu^?K$T zQi1x=1RN)9Lkxcryy>%6=`{|!h75@Wmxwq`OXvHx&dTlCu+wzzueI}bC#&nv)BQ2c zE_~O%+S$8KZP}Xo>3aRp>~l|=*M_HT+O7UcTfI&iSq)S9r`uhXPfI5_RTq%P9DYs>j_deeuu~G>Mzf`FiVs6G#sxhWV^4*ad5$}%;fX0k|Um@I?SXE`VHsO!aL_dQEd#qb`RJt2@>OlM5_|&Cc z4D1K3#M^%0tOGq*;TOC}SugW!&p|=|b4Oo@g25pGZ)o_@jCkt&145i(*MIM=8$Lln zvZPqkk#g+H@4=hqie|Y)&B89#&>o1Kg<$XxZ&9k1$ykB4!z5*eihWhVO7o=dG)GD- zK5KVk{DoyNri0-^A{V%@Rbmkxb!)!iioAu?3 z)2wGY-)y3`oqYeSzUXsv^Vese8wi5ghP5BX* ze?4m{yYJV%{_ypvlLPa&z2Dn8u&pAi>cYLf)W&aP0s>Yg*tUM0rM>*ol@CovU%q(x z@!-X7O1Eajx0f@W7Mu7u+qN}Xch&h6zIT?7T$}Zb@-eilwM8K=zhi#a<&K-S&e|89 zj$FIeX*)a0b^45%*WS{*K9qMVth*f5^6lpzjr+3}wHZFR9u#!L{>|&x{VslOOAbMRoOfJsHbe zaTAlfpKx zIKOMi{(#b#dNuDH>sEbv+3$_Wt%Om>Yj-RN-fwq!b5Zz4@rPUFRSWUBc<_Ut%~F(Ws4YyHe?P;z_OnPF`9BryBT!-qM- zviD1>Eyoo<$ao~xbgBR4*wsNP)e2P6-~%5w)b?l6!PhOtkfe_@g|aUjbfnB3Hh!?k zlDL(oc7+!7sgxZio8vn7Y}haS(8A_OuH@|xYok|$q|^Ne*R9!>ba=(c<(E_^7WDhAT=r0b@^KiO+ z@k^?1XhYeQ%E9GAakNaYyHhr|Ug)q>8JrQAdbOf|7iDgyy2;X}obzXkFB*tmhPS3G8e1Ea@9XW}SdecRxgeG2yewv}bQrlNnRj5)})>^`H zUS#4t7n^Qpcya9h>ofP~4OwogyOlH5CmcGIJM& zH*V9f7gx-tqn-!+WzKK!x-h-+SFsKwx7uy(LN~n3C+&$ z=|SUpj7jdv8D^%Q-yA<1y)GH%ol9#dRuw66TeNS;`HZiOTM;)y#>8F9JXf1lzIeNv zYWk0wy(NuJBA0&TQID;@dpSxvM|hX5#kQx1B_=f9Uizf@K=JrbBOX4uky*`HcGWvI z?MTw`GY;d_6ixd%I94b%eM)$xrBV1{z?z^9<7#vB z_QkQwvt!uQd0xYxjycmX)%~)|aMSH~vh$lQqD5CrE8avGF?1PHZAUb7_@FP3fulFu7M}O0I z6Drcz$*dT>yzHa?)_?Xt(46+6P4U~8FYgy0aqb!b^N#hfhq}K-C=?i1c}LtkAQltX zg?=E8+PjxhpT18#BBW6Wo&=~J}+sEAv;m(Og%8?5Xb^vw7#EV?j z;~79fs3dRoCxe7cV$To}66}g8Pp%kDNHVs$1+||sueK?*dZ={#s10(;263AXM*QPB z;-tkrnY051^}Ev_=fq!s8I^rys6}$kp_)R)ShJKe$0-AiLcIq#?Hx3JqN|eFq$H7u zLr+$Ht`LpMlV6zXUwSF*M##;5Kb|YiJigB$;oI6{PD+_p-L)1IgtD&`8z-(l+r2T; zxude_a>f@%n$w?(n-Q_^+Mdtx`t*+W{+otq#2BSUoi`^7Gh~LeHVQwrKlLo{GbLWh zIQ3VeUrO7}Kc#CNcHchJCIsy#Y`ZF^2-pr<39}#gg>sMU2wj%aOBE904R)`8=zv26Tv+be9@0ukoT76NK8}Z|T!XXrhpfYMh|tHLkYB$O ziV54!kZZhsDTEyn6M^PVEGaH8t1P$7*D%-8&aT-^XHAlC_#sVLQQ=$MP$}SdA`()7 zFF@dgg}fBGjNI?`@s{=reSZwH7guGixDUtPPll~V5R$XvP+?TS8|1*JFO#s2L%2T3 z@|lo@c6R4_&9l%>4H!sh>j#wq6QLO37Fx3GcX-zng7X#&exXIKV)7L$FqrB|i*Tlg zdV+t5?4_Y*VO@5bBb+66!5>Uty!_r1LJpXK23eOMjs+q>F?b6I31g72XnhF?zDb6_ z%gXM)0d(x^D<7+Am}#n)Se0kj=&(HtbL{K!iSVlj1!D4+W&n7DqzzKiIET1;5m_sj zEea;cYvH{2@aq?Z<1NS_@CIqjAQB`XkcyEr@UaTA&M^C6-xKf1k5z!{3?lND1@>+T0o$Xbi#|HZ_KCWGt2KzW64sQv7yQ90vz9e9sZ}fhi z=OY8h6lJh&U|UHU*5ljj!9c^9|y1@K5xmy!5d_g*_UK&_a);hJ?kBlK&|4m z6aKOT0HmOS2mX#U>T^p#b^Tuw3&I4!YvBJhsf+}QAY@p)@B~dLme!hEbg-l%iFy0A z8J@dg<1_^0J)@A#gFp;HGYSwRn?YwMl?5JyrUPs-@jc@%AA)i~MBcK%(8Q%K^2$`%lxp+xr|{JaCx9K_`<(RlENPtJuB(L;lS148{hh;y!n`5CqB-t-2o zRI|AyxFz1c-g1KkOQ6+LXNHbqLG~pOY%?C)cliSa>REh*F}hchp8T=J7FdTRMv!xL zfdT-6V7%=j2Hx;VV~7}73KJk{U?1gVbQ6+bx`05uMSux~z!Ky`G*BI^94j3R{G0cy zDgW-FK%)@!3qDmS)c=2u&Mg11#Aak-NPll-fC+JVo1;H?!zXK@GeSBlW7fFw?U*Bs z`w#)c20#2OCL`A#xI-B|1bp+u_7X5j5i;nYhK5jlW*Hm$KaI<<*+`}D6^0=S8kse; zL4#fbJ2qpzUye8X%fsjc0eR0UTz?aYL}8VPoNgv&^@wEYYz^r~*w_A^=-V zyfu2>RsJg;E=Ht#iT50{^FFN4NG*AG3=(5WVLW=4KL0uqRwsPo4mLUeTaHkJQza_# zQDqA#gP?6xo;GR0Yd;X1_dLN2%O`JPQu)y$K-*`}=9efqXL5ELndfUZ=Vr1bxzuIC zD&`>`Z%JTf%O?t8lCWl{w>^)a!?33(zf8xhBA(+eafcVFLFdGO0zlU-EaLd=4>3X5 z?t-~6nXuIB!I;AwjGFoI-`6crIbay)6R0sc$ma>2o^{O56t1)M?P1F#gt4;}>L)J@ zH(a2i;=#kpdIA3GGKN24=M`8~#g#ojC`&8&5XySsnqfaoMzjzK zZ8=GY59JAp35iEg7F5X5%6^!PHZqtvsvy$zil`8f<^?4xg_~~n!(^NT_8^>Q@;qHA zFw`Dp9K}!gPVilm5Li%FRBm{bI26*FvL7a64meyVgh%=E{>t{y1Skn8q$p)SOhyM8 z8UBW_6g2}}evsH5e6!KLNf?L-N}ZA5D=OT z1^%ClYdFvL7bn4XDY8?2EN83eJ?tEd|O7iC<@5L4i*s1(Mmx zFjR7bql}HPEN4GVMjR*>iNOCpy`e;i_?f4H`j7}$V0K7UZMd>fMnXLNR&d-*2rnr2 zA~!rr5eR$p*bkGj0aVCD@VLt6uN)sG`h#0U_QPcO%M#-YLQBZ4IZCL9M^*!08Hh9& zgjNtmhT#omxWg~Af51l{B4pNLCr{spfTZdXUKy+;O%*C=(qV5`Jc2KTXEVxQE7YoJkYjaWWGGLdoeMaS8ijGIIF?5fb3B ztpzgzTP1c5gr{`uhsjU@dw86+@G22g-|>UOE0x3_ijeq@JkoFeNQAU^{E+bG^B&6I ze1zmw=GOOC-L-oiFg%Z%= zl~MsmW_*+)q-5hpLRshVPO*zWk{%(w9XAweKfF@npjU*CQiP;-+(;KJtemB(mdHs&6C*aQM#0d;)u4-$;f0kx0i0h=8(XCG-gC=ujv)Qz#!C-hM6op$MtxxRFrWH@s4-z*lm9 zN@0ta4*?iA6w2*}SE`9W6d}(UHxf$ahF6LXz6A19ijX;u8w$n;cIw3|^@TqaAyXVT z63W_!S8ACuf29PrA498}oC>TSW(5n4}op zIH?JOp-gM|L!QB)J+x;T^(gW$FxJ5yIfggXDIhM&G6u~Z<0DgrsWZ``}5Hx)ds4F0W7q`kNFBatBVn0lVqBIb4HKQ}!Kpvg}*j;3%OL-lOjjgJb!D6q^<|F3MMh57f4r zgh~rUp2bFn4#bNOi|trl#veGyJvWkBftW8l7ALi%TuE?D$dAQ-nvC_edbPseb{2pw zi<8+Q7Rq3S|2UaMh{g6AlI&S*6T+iX2#u0O!Fv(xhshWQ7}|Q`LLX`hPMF1wj`B3& z(baT_(0g)@0Q6Mc=qM8te!*yfYe4*UXRQ~Kq%PdJD7g{jd160I#$7_(-ts~a&K+(6 zQ2rmh*&FqU6c?OPi5nf|*1>-^vzSbT{x^(6-1sQ*4L%k6>J#A$%ICw4jS|h^b+?^D zgpGZv7K~_zjSpQ6rJRAkdqYB=|YYmAMWrtMqWHQ|7DD4P-nx9Q2LhoJS0&uu+dACdMRvL5~|1y`+rKu!}4R zHD$XNiQ6u0To?`6QIZ`Q@t=Jk_KgcK{`Ce&5?!-wAa*!Ldvuu$9m_rygg}24iqSjD z=&chb;|PDWzYD|YHDo-Tsuf@5{w@TgcZ~7QlEWYFe+<9qRbqU$nQP5gP4f4d+5XAS zspz#~cxRLSFc}Z{L-wqRUN`N7u7w*9y(5ed@hfcjs>oi0r0<<^Bcm6D@tW50NB+w= zhhG21*GDUC`D*&tF%G@-i;w1C_#?7y`#;7v^doYU@hZDMwZv}l^}5bqL^%8e-X?72J%N^Nw;_9T zm>U|sq>GOQwM5YWW1vMZ<>CYUs)Ynf3v?xzTVwPNE`EjnAi^bm0hk*Ty>E-(Ppn%+ ppeuWV|2pQPS8eezP}G3{n{?C_1$WRWl#SrOLU2|R3&y2T{trlGbvOV3 diff --git a/projects/ollama/directed_target/Makefile.toml b/projects/ollama/directed_target/Makefile.toml index 7ce686064..b754954b2 100644 --- a/projects/ollama/directed_target/Makefile.toml +++ b/projects/ollama/directed_target/Makefile.toml @@ -53,10 +53,6 @@ cd ${EXAMPLE_DIR}/sydr/convert/tokenizer go build -o ${OUT_DIR_ABS}/convert_tokenizer_sydr cd ${EXAMPLE_DIR}/sydr/convert/vocabulary go build -o ${OUT_DIR_ABS}/convert_vocabulary_sydr -cd ${EXAMPLE_DIR}/sydr/model/encode -go build -o ${OUT_DIR_ABS}/model_encode_sydr -cd ${EXAMPLE_DIR}/sydr/model/decode -go build -o ${OUT_DIR_ABS}/model_decode_sydr cd ${EXAMPLE_DIR}/sydr/parser/parsefile go build -o ${OUT_DIR_ABS}/parser_parsefile_sydr cd ${EXAMPLE_DIR}/sydr/server/manifest @@ -69,6 +65,10 @@ cd ${EXAMPLE_DIR}/sydr/thinking/state go build -o ${OUT_DIR_ABS}/thinking_state_sydr cd ${EXAMPLE_DIR}/sydr/thinking/eat go build -o ${OUT_DIR_ABS}/thinking_eat_sydr +cd ${EXAMPLE_DIR}/sydr/harmony/parser +go build -o ${OUT_DIR_ABS}/harmony_parser_sydr +cd ${EXAMPLE_DIR}/sydr/wordpiece/encode +go build -o ${OUT_DIR_ABS}/wordpiece_sydr ''' [tasks.coverage] @@ -88,14 +88,6 @@ ${GOINSTR_COVERAGE} -i sydr/convert/vocabulary/main.go -a insert -l info go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/convert_vocabulary_coverage sydr/convert/vocabulary/main.go ${GOINSTR_COVERAGE} -i sydr/convert/vocabulary/main.go -a remove -l info -${GOINSTR_COVERAGE} -i sydr/model/encode/main.go -a insert -l info -go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/model_encode_coverage sydr/model/encode/main.go -${GOINSTR_COVERAGE} -i sydr/model/encode/main.go -a remove -l info - -${GOINSTR_COVERAGE} -i sydr/model/decode/main.go -a insert -l info -go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/model_decode_coverage sydr/model/decode/main.go -${GOINSTR_COVERAGE} -i sydr/model/decode/main.go -a remove -l info - ${GOINSTR_COVERAGE} -i sydr/parser/parsefile/main.go -a insert -l info go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/parser_parsefile_coverage sydr/parser/parsefile/main.go ${GOINSTR_COVERAGE} -i sydr/parser/parsefile/main.go -a remove -l info @@ -119,6 +111,14 @@ ${GOINSTR_COVERAGE} -i sydr/thinking/state/main.go -a remove -l info ${GOINSTR_COVERAGE} -i sydr/thinking/eat/main.go -a insert -l info go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/thinking_eat_coverage sydr/thinking/eat/main.go ${GOINSTR_COVERAGE} -i sydr/thinking/eat/main.go -a remove -l info + +${GOINSTR_COVERAGE} -i sydr/harmony/parser/main.go -a insert -l info +go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/harmony_parser_coverage sydr/harmony/parser/main.go +${GOINSTR_COVERAGE} -i sydr/harmony/parser/main.go -a remove -l info + +${GOINSTR_COVERAGE} -i sydr/wordpiece/encode/main.go -a insert -l info +go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/wordpiece_coverage sydr/wordpiece/encode/main.go +${GOINSTR_COVERAGE} -i sydr/wordpiece/encode/main.go -a remove -l info ''' [tasks.difuzz] @@ -131,14 +131,14 @@ script_runner = "@shell" script = ''' ${DIFUZZ_DIR_ABS}/difuzz-go -r tokenizer.main -c ${PROJECT_DIR}/config_convert_tokenizer.toml -p ${EXAMPLE_DIR}/sydr/convert/tokenizer/main.go -e ${OUT_DIR_ABS}/ets_convert_tokenizer.toml ${DIFUZZ_ARGS} ${DIFUZZ_DIR_ABS}/difuzz-go -r vocabulary.main -c ${PROJECT_DIR}/config_convert_vocabulary.toml -p ${EXAMPLE_DIR}/sydr/convert/vocabulary/main.go -e ${OUT_DIR_ABS}/ets_convert_vocabulary.toml ${DIFUZZ_ARGS} -${DIFUZZ_DIR_ABS}/difuzz-go -r decode.main -c ${PROJECT_DIR}/config_model_decode.toml -p ${EXAMPLE_DIR}/sydr/model/decode/main.go -e ${OUT_DIR_ABS}/ets_model_decode.toml ${DIFUZZ_ARGS} -${DIFUZZ_DIR_ABS}/difuzz-go -r encode.main -c ${PROJECT_DIR}/config_model_encode.toml -p ${EXAMPLE_DIR}/sydr/model/encode/main.go -e ${OUT_DIR_ABS}/ets_model_encode.toml ${DIFUZZ_ARGS} ${DIFUZZ_DIR_ABS}/difuzz-go -r parsefile.main -c ${PROJECT_DIR}/config_parser_parsefile.toml -p ${EXAMPLE_DIR}/sydr/parser/parsefile/main.go -e ${OUT_DIR_ABS}/ets_parser_parsefile.toml ${DIFUZZ_ARGS} ${DIFUZZ_DIR_ABS}/difuzz-go -r manifest.main -c ${PROJECT_DIR}/config_server_manifest.toml -p ${EXAMPLE_DIR}/sydr/server/manifest/main.go -e ${OUT_DIR_ABS}/ets_server_manifest.toml ${DIFUZZ_ARGS} ${DIFUZZ_DIR_ABS}/difuzz-go -r newlayer.main -c ${PROJECT_DIR}/config_server_newlayer.toml -p ${EXAMPLE_DIR}/sydr/server/newlayer/main.go -e ${OUT_DIR_ABS}/ets_server_newlayer.toml ${DIFUZZ_ARGS} ${DIFUZZ_DIR_ABS}/difuzz-go -r content.main -c ${PROJECT_DIR}/config_thinking_content.toml -p ${EXAMPLE_DIR}/sydr/thinking/content/main.go -e ${OUT_DIR_ABS}/ets_thinking_content.toml ${DIFUZZ_ARGS} ${DIFUZZ_DIR_ABS}/difuzz-go -r state.main -c ${PROJECT_DIR}/config_thinking_state.toml -p ${EXAMPLE_DIR}/sydr/thinking/state/main.go -e ${OUT_DIR_ABS}/ets_thinking_state.toml ${DIFUZZ_ARGS} ${DIFUZZ_DIR_ABS}/difuzz-go -r eat.main -c ${PROJECT_DIR}/config_thinking_eat.toml -p ${EXAMPLE_DIR}/sydr/thinking/eat/main.go -e ${OUT_DIR_ABS}/ets_thinking_eat.toml ${DIFUZZ_ARGS} +${DIFUZZ_DIR_ABS}/difuzz-go -r parser.main -c ${PROJECT_DIR}/config_harmony_parser.toml -p ${EXAMPLE_DIR}/sydr/harmony/parser/main.go -e ${OUT_DIR_ABS}/ets_harmony_parser.toml ${DIFUZZ_ARGS} +${DIFUZZ_DIR_ABS}/difuzz-go -r encode.main -c ${PROJECT_DIR}/config_wordpiece.toml -p ${EXAMPLE_DIR}/sydr/wordpiece/encode/main.go -e ${OUT_DIR_ABS}/ets_wordpiece.toml ${DIFUZZ_ARGS} ''' [tasks.target] @@ -161,18 +161,6 @@ cd ${EXAMPLE_DIR_INSTR}/sydr/convert/vocabulary CGO_LDFLAGS="-L${LIBFORKSERVER_DIR_ABS}" go build -o ${OUT_DIR_ABS}/difuzz_target_convert_vocabulary ${GOINSTR_DIFUZZ} -a remove -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_convert_vocabulary.toml -keep-ets -l info -${GOINSTR_DIFUZZ} -a insert -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_model_decode.toml -l info -j 8 -${GOINSTR_SANCOV} -a insert -i ${EXAMPLE_DIR} -o / -l info -j 8 -cd ${EXAMPLE_DIR_INSTR}/sydr/model/decode -CGO_LDFLAGS="-L${LIBFORKSERVER_DIR_ABS}" go build -o ${OUT_DIR_ABS}/difuzz_target_model_decode -${GOINSTR_DIFUZZ} -a remove -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_model_decode.toml -keep-ets -l info - -${GOINSTR_DIFUZZ} -a insert -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_model_encode.toml -l info -j 8 -${GOINSTR_SANCOV} -a insert -i ${EXAMPLE_DIR} -o / -l info -j 8 -cd ${EXAMPLE_DIR_INSTR}/sydr/model/encode -CGO_LDFLAGS="-L${LIBFORKSERVER_DIR_ABS}" go build -o ${OUT_DIR_ABS}/difuzz_target_model_encode -${GOINSTR_DIFUZZ} -a remove -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_model_encode.toml -keep-ets -l info - ${GOINSTR_DIFUZZ} -a insert -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_parser_parsefile.toml -l info -j 8 ${GOINSTR_SANCOV} -a insert -i ${EXAMPLE_DIR} -o / -l info -j 8 cd ${EXAMPLE_DIR_INSTR}/sydr/parser/parsefile @@ -208,6 +196,18 @@ ${GOINSTR_SANCOV} -a insert -i ${EXAMPLE_DIR} -o / -l info -j 8 cd ${EXAMPLE_DIR_INSTR}/sydr/thinking/eat CGO_LDFLAGS="-L${LIBFORKSERVER_DIR_ABS}" go build -o ${OUT_DIR_ABS}/difuzz_target_thinking_eat ${GOINSTR_DIFUZZ} -a remove -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_thinking_eat.toml -keep-ets -l info + +${GOINSTR_DIFUZZ} -a insert -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_harmony_parser.toml -l info -j 8 +${GOINSTR_SANCOV} -a insert -i ${EXAMPLE_DIR} -o / -l info -j 8 +cd ${EXAMPLE_DIR_INSTR}/sydr/harmony/parser +CGO_LDFLAGS="-L${LIBFORKSERVER_DIR_ABS}" go build -o ${OUT_DIR_ABS}/difuzz_target_harmony_parser +${GOINSTR_DIFUZZ} -a remove -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_harmony_parser.toml -keep-ets -l info + +${GOINSTR_DIFUZZ} -a insert -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_wordpiece.toml -l info -j 8 +${GOINSTR_SANCOV} -a insert -i ${EXAMPLE_DIR} -o / -l info -j 8 +cd ${EXAMPLE_DIR_INSTR}/sydr/wordpiece/encode +CGO_LDFLAGS="-L${LIBFORKSERVER_DIR_ABS}" go build -o ${OUT_DIR_ABS}/difuzz_target_wordpiece +${GOINSTR_DIFUZZ} -a remove -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_wordpiece.toml -keep-ets -l info ''' dependencies = ["difuzz"] diff --git a/projects/ollama/directed_target/config_model_decode.toml b/projects/ollama/directed_target/config_harmony_parser.toml similarity index 93% rename from projects/ollama/directed_target/config_model_decode.toml rename to projects/ollama/directed_target/config_harmony_parser.toml index b174c4f80..9bf32e032 100644 --- a/projects/ollama/directed_target/config_model_decode.toml +++ b/projects/ollama/directed_target/config_harmony_parser.toml @@ -15,5 +15,5 @@ ################################################################################ [[target]] -file = "/ollama/sydr/model/decode/main.go" +file = "/ollama/sydr/harmony/parser/main.go" line = 10 diff --git a/projects/ollama/directed_target/config_model_encode.toml b/projects/ollama/directed_target/config_wordpiece.toml similarity index 93% rename from projects/ollama/directed_target/config_model_encode.toml rename to projects/ollama/directed_target/config_wordpiece.toml index 42484b648..4415c4c6a 100644 --- a/projects/ollama/directed_target/config_model_encode.toml +++ b/projects/ollama/directed_target/config_wordpiece.toml @@ -15,5 +15,5 @@ ################################################################################ [[target]] -file = "/ollama/sydr/model/encode/main.go" +file = "/ollama/sydr/wordpiece/encode/main.go" line = 10 diff --git a/projects/ollama/fuzz.go b/projects/ollama/fuzz.go index 7cf624d6b..7037d09bc 100644 --- a/projects/ollama/fuzz.go +++ b/projects/ollama/fuzz.go @@ -6,13 +6,13 @@ import ( "os" "path/filepath" "strings" - "unicode/utf8" "github.com/ollama/ollama/convert" model "github.com/ollama/ollama/model" "github.com/ollama/ollama/parser" "github.com/ollama/ollama/server" "github.com/ollama/ollama/thinking" + "github.com/ollama/ollama/harmony" typesmodel "github.com/ollama/ollama/types/model" ) @@ -62,72 +62,6 @@ func FuzzParseVocabulary(data []byte) int { return 1 } -func FuzzEncode(data []byte) int { - var ( - testVocab *model.Vocabulary - testSpm *model.SentencePieceModel - ) - if testVocab == nil || testSpm == nil { - return -1 - } - - if !utf8.Valid(data) { - return -1 - } - - // Test both with and without special tokens - for _, addSpecial := range []bool{true, false} { - ids, err := testSpm.Encode(string(data), addSpecial) - if err != nil { - return 0 - } - - // Verify we can round-trip the data - decoded, err := testSpm.Decode(ids) - if err != nil { - return 0 - } - - if !utf8.ValidString(decoded) { - panic("decoded string is not valid UTF-8") - } - } - - return 1 -} - -func FuzzDecode(data []byte) int { - var ( - testVocab *model.Vocabulary - testSpm *model.SentencePieceModel - ) - if testVocab == nil || testSpm == nil { - return -1 - } - - // Convert bytes to int32 IDs (simple approach) - var ids []int32 - for i := 0; i < len(data); i += 4 { - if i+4 > len(data) { - break - } - id := int32(data[i])<<24 | int32(data[i+1])<<16 | - int32(data[i+2])<<8 | int32(data[i+3]) - ids = append(ids, id) - } - - decoded, err := testSpm.Decode(ids) - if err != nil { - return 0 - } - - if !utf8.ValidString(decoded) { - panic("decoded string is not valid UTF-8") - } - - return 1 -} - func FuzzParseFile(data []byte) int { _, err := parser.ParseFile(bytes.NewReader(data)) if err != nil { @@ -297,3 +231,40 @@ func FuzzEat(data []byte) int { return 1 } + +func FuzzHarmonyParser(data []byte) int { + if len(data) == 0 { + return -1 + } + + parser := harmony.HarmonyParser{ + MessageStartTag: "<|start|>", + MessageEndTag: "<|end|>", + HeaderEndTag: "<|message|>", + } + parser.ParseHeader(string(data)) + + gotEvents := parser.AddContent(string(data)) + if len(gotEvents) == 0 { + return 1 + } + + return 0 +} + +func FuzzWordPiece(data []byte) int { + wpm := model.NewWordPiece( + &model.Vocabulary{ + Values: []string{"[UNK]", "[CLS]", "[SEP]", "▁hello", "▁world", "s", "▁!", "▁@", "▁#", "▁abc", "▁a", "▁b", "▁c", "▁s", "a", "b", "c", "d", "z"}, + AddBOS: true, + AddEOS: true, + BOS: []int32{1}, + EOS: []int32{2}, + }) + + _, err := wpm.Encode(string(data), true) + if err != nil { + return 1 + } + return 0 +} diff --git a/projects/ollama/model_decode-lf.toml b/projects/ollama/harmony_parser-lf.toml similarity index 81% rename from projects/ollama/model_decode-lf.toml rename to projects/ollama/harmony_parser-lf.toml index b622b7edf..a2639eada 100644 --- a/projects/ollama/model_decode-lf.toml +++ b/projects/ollama/harmony_parser-lf.toml @@ -15,14 +15,14 @@ ################################################################################ [sydr] -target = "/model_decode_sydr @@" +target = "/harmony_parser_sydr @@" args = "-s 90 --wait-jobs -j2" jobs = 2 [libfuzzer] -path = "/model_decode_fuzz" -args = "-jobs=1000 -workers=4 -rss_limit_mb=8192 /corpus/model/corpus_decode" +path = "/harmony_parser_fuzz" +args = "-jobs=1000 -workers=4 -rss_limit_mb=8192 /corpus/harmony" [cov] -target = "/model_decode_sydr @@" +target = "/harmony_parser_sydr @@" source = "/ollama" diff --git a/projects/ollama/model_encode-libafl.toml b/projects/ollama/harmony_parser-libafl.toml similarity index 80% rename from projects/ollama/model_encode-libafl.toml rename to projects/ollama/harmony_parser-libafl.toml index 74a48766d..26a368caf 100644 --- a/projects/ollama/model_encode-libafl.toml +++ b/projects/ollama/harmony_parser-libafl.toml @@ -15,16 +15,16 @@ ################################################################################ [sydr] -target = "/model_encode_sydr @@" +target = "/harmony_parser_sydr @@" args = "-s 90 --wait-jobs -j2" jobs = 2 [difuzz] path = "/directed_target/sydr/difuzz/libafl_difuzz" -target = "/difuzz_target_model_encode @@" -args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /corpus/model/corpus_encode -e /ets_model_encode.toml" -casr_bin = "/model_encode_sydr" +target = "/difuzz_target_harmony_parser @@" +args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /corpus/harmony -e /ets_harmony_parser.toml" +casr_bin = "/harmony_parser_sydr" [cov] -target = "/model_encode_coverage @@" +target = "/harmony_parser_coverage @@" source = "/ollama" diff --git a/projects/ollama/model_encode_sydr.go b/projects/ollama/harmony_parser_sydr.go similarity index 79% rename from projects/ollama/model_encode_sydr.go rename to projects/ollama/harmony_parser_sydr.go index a5949ca52..f3c92ebdc 100644 --- a/projects/ollama/model_encode_sydr.go +++ b/projects/ollama/harmony_parser_sydr.go @@ -8,5 +8,5 @@ import ( func main() { data, _ := os.ReadFile(os.Args[1]) - fuzz.FuzzEncode(data) + fuzz.FuzzHarmonyParser(data) } diff --git a/projects/ollama/ollama.patch b/projects/ollama/ollama.patch index ca1e66b5b..4a3de8ae7 100644 --- a/projects/ollama/ollama.patch +++ b/projects/ollama/ollama.patch @@ -1,8 +1,8 @@ diff --git a/convert/tokenizer.go b/convert/tokenizer.go -index bedcd4f8..ab9c67a3 100644 +index 41d0310a..72d495c8 100644 --- a/convert/tokenizer.go +++ b/convert/tokenizer.go -@@ -329,3 +329,15 @@ func (sv SpecialVocabulary) Key() string { +@@ -325,3 +325,15 @@ func (sv SpecialVocabulary) Key() string { panic("unknown special vocabulary type") } @@ -18,3 +18,18 @@ index bedcd4f8..ab9c67a3 100644 +func ParseVocabulary(fsys fs.FS) (*Vocabulary, error) { + return parseVocabulary(fsys) +} +diff --git a/harmony/harmonyparser.go b/harmony/harmonyparser.go +index 3ec2c21f..868c8c8e 100644 +--- a/harmony/harmonyparser.go ++++ b/harmony/harmonyparser.go +@@ -263,6 +263,10 @@ func (s *HarmonyParser) parseHeader(raw string) HarmonyHeader { + return harmonyHeader + } + ++func (s *HarmonyParser) ParseHeader(raw string) HarmonyHeader { ++ return s.parseHeader(raw) ++} ++ + // longest overlap between suffix of s and prefix of delim + func overlap(s, delim string) int { + max := min(len(delim), len(s)) diff --git a/projects/ollama/model_encode-lf.toml b/projects/ollama/wordpiece-lf.toml similarity index 81% rename from projects/ollama/model_encode-lf.toml rename to projects/ollama/wordpiece-lf.toml index 3cd01ea65..2326d94e8 100644 --- a/projects/ollama/model_encode-lf.toml +++ b/projects/ollama/wordpiece-lf.toml @@ -15,14 +15,14 @@ ################################################################################ [sydr] -target = "/model_encode_sydr @@" +target = "/wordpiece_sydr @@" args = "-s 90 --wait-jobs -j2" jobs = 2 [libfuzzer] -path = "/model_encode_fuzz" -args = "-jobs=1000 -workers=4 -rss_limit_mb=8192 /corpus/model/corpus_encode" +path = "/wordpiece_fuzz" +args = "-jobs=1000 -workers=4 -rss_limit_mb=8192 /corpus/wordpiece" [cov] -target = "/model_encode_sydr @@" +target = "/wordpiece_sydr @@" source = "/ollama" diff --git a/projects/ollama/model_decode-libafl.toml b/projects/ollama/wordpiece-libafl.toml similarity index 80% rename from projects/ollama/model_decode-libafl.toml rename to projects/ollama/wordpiece-libafl.toml index 20bc615eb..3d0691c4a 100644 --- a/projects/ollama/model_decode-libafl.toml +++ b/projects/ollama/wordpiece-libafl.toml @@ -15,16 +15,16 @@ ################################################################################ [sydr] -target = "/model_decode_sydr @@" +target = "/wordpiece_sydr @@" args = "-s 90 --wait-jobs -j2" jobs = 2 [difuzz] path = "/directed_target/sydr/difuzz/libafl_difuzz" -target = "/difuzz_target_model_decode @@" -args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /corpus/model/corpus_decode -e /ets_model_decode.toml" -casr_bin = "/model_decode_sydr" +target = "/difuzz_target_wordpiece @@" +args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /corpus/wordpiece -e /ets_wordpiece.toml" +casr_bin = "/wordpiece_sydr" [cov] -target = "/model_decode_coverage @@" +target = "/wordpiece_coverage @@" source = "/ollama" diff --git a/projects/ollama/model_decode_sydr.go b/projects/ollama/wordpiece_sydr.go similarity index 81% rename from projects/ollama/model_decode_sydr.go rename to projects/ollama/wordpiece_sydr.go index 868c3fb99..4ea3e9d5d 100644 --- a/projects/ollama/model_decode_sydr.go +++ b/projects/ollama/wordpiece_sydr.go @@ -8,5 +8,5 @@ import ( func main() { data, _ := os.ReadFile(os.Args[1]) - fuzz.FuzzDecode(data) + fuzz.FuzzWordPiece(data) } From b76d38b6f49a0c31f3feb450e30ea7aa6e9042e2 Mon Sep 17 00:00:00 2001 From: headshog Date: Thu, 2 Oct 2025 17:16:29 +0300 Subject: [PATCH 3/5] Remove useless targets again --- projects/ollama/Dockerfile | 6 +- projects/ollama/Dockerfile_libafl | 7 +- projects/ollama/README.md | 40 ------- projects/ollama/build.sh | 8 -- projects/ollama/directed_target/Makefile.toml | 52 --------- .../config_server_newlayer.toml | 19 --- .../config_thinking_content.toml | 19 --- .../directed_target/config_thinking_eat.toml | 19 --- .../config_thinking_state.toml | 19 --- projects/ollama/fuzz.go | 110 ------------------ projects/ollama/server_newlayer-lf.toml | 28 ----- projects/ollama/server_newlayer-libafl.toml | 30 ----- projects/ollama/server_newlayer_sydr.go | 12 -- projects/ollama/thinking_content-lf.toml | 28 ----- projects/ollama/thinking_content-libafl.toml | 30 ----- projects/ollama/thinking_content_sydr.go | 12 -- projects/ollama/thinking_eat-lf.toml | 28 ----- projects/ollama/thinking_eat-libafl.toml | 30 ----- projects/ollama/thinking_eat_sydr.go | 12 -- projects/ollama/thinking_state-lf.toml | 28 ----- projects/ollama/thinking_state-libafl.toml | 29 ----- projects/ollama/thinking_state_sydr.go | 12 -- 22 files changed, 2 insertions(+), 576 deletions(-) delete mode 100644 projects/ollama/directed_target/config_server_newlayer.toml delete mode 100644 projects/ollama/directed_target/config_thinking_content.toml delete mode 100644 projects/ollama/directed_target/config_thinking_eat.toml delete mode 100644 projects/ollama/directed_target/config_thinking_state.toml delete mode 100644 projects/ollama/server_newlayer-lf.toml delete mode 100644 projects/ollama/server_newlayer-libafl.toml delete mode 100644 projects/ollama/server_newlayer_sydr.go delete mode 100644 projects/ollama/thinking_content-lf.toml delete mode 100644 projects/ollama/thinking_content-libafl.toml delete mode 100644 projects/ollama/thinking_content_sydr.go delete mode 100644 projects/ollama/thinking_eat-lf.toml delete mode 100644 projects/ollama/thinking_eat-libafl.toml delete mode 100644 projects/ollama/thinking_eat_sydr.go delete mode 100644 projects/ollama/thinking_state-lf.toml delete mode 100644 projects/ollama/thinking_state-libafl.toml delete mode 100644 projects/ollama/thinking_state_sydr.go diff --git a/projects/ollama/Dockerfile b/projects/ollama/Dockerfile index b7315985d..28ae32894 100644 --- a/projects/ollama/Dockerfile +++ b/projects/ollama/Dockerfile @@ -17,16 +17,12 @@ COPY corpus.zip / RUN unzip /corpus.zip -d / # Create directories for fuzz targets. -RUN mkdir sydr && cd sydr && mkdir -p convert parser server thinking harmony wordpiece +RUN mkdir sydr && cd sydr && mkdir -p convert parser server harmony wordpiece # Move fuzz targets. RUN mkdir fuzz COPY fuzz.go fuzz -COPY thinking_state_sydr.go sydr/thinking -COPY thinking_eat_sydr.go sydr/thinking -COPY thinking_content_sydr.go sydr/thinking -COPY server_newlayer_sydr.go sydr/server COPY server_manifest_sydr.go sydr/server COPY parser_parsefile_sydr.go sydr/parser COPY convert_tokenizer_sydr.go sydr/convert diff --git a/projects/ollama/Dockerfile_libafl b/projects/ollama/Dockerfile_libafl index 11add74b9..dbe401275 100644 --- a/projects/ollama/Dockerfile_libafl +++ b/projects/ollama/Dockerfile_libafl @@ -38,17 +38,12 @@ RUN unzip /corpus.zip -d / # Create directories for fuzz targets. RUN mkdir sydr && cd sydr && mkdir -p convert/tokenizer convert/vocabulary \ - parser/parsefile server/newlayer server/manifest thinking/state thinking/eat \ - thinking/content harmony/parser wordpiece/encode + parser/parsefile server/manifest harmony/parser wordpiece/encode # Move fuzz targets. RUN mkdir fuzz COPY fuzz.go fuzz -COPY thinking_state_sydr.go sydr/thinking/state/main.go -COPY thinking_eat_sydr.go sydr/thinking/eat/main.go -COPY thinking_content_sydr.go sydr/thinking/content/main.go -COPY server_newlayer_sydr.go sydr/server/newlayer/main.go COPY server_manifest_sydr.go sydr/server/manifest/main.go COPY parser_parsefile_sydr.go sydr/parser/parsefile/main.go COPY convert_tokenizer_sydr.go sydr/convert/tokenizer/main.go diff --git a/projects/ollama/README.md b/projects/ollama/README.md index fbea686fd..9e8faed05 100644 --- a/projects/ollama/README.md +++ b/projects/ollama/README.md @@ -71,46 +71,6 @@ Ollama project has 10 fuzz targets. # cd /fuzz # sydr-fuzz -c server_manifest-libafl.toml run -### server_newlayer (libfuzzer) - - # cd /fuzz - # sydr-fuzz -c server_newlayer-lf.toml run - -### server_newlayer (LibAFL-DiFuzz) - - # cd /fuzz - # sydr-fuzz -c server_newlayer-libafl.toml run - -### thinking_content (libfuzzer) - - # cd /fuzz - # sydr-fuzz -c thinking_content-lf.toml run - -### thinking_content (LibAFL-DiFuzz) - - # cd /fuzz - # sydr-fuzz -c thinking_content-libafl.toml run - -### thinking_state (libfuzzer) - - # cd /fuzz - # sydr-fuzz -c thinking_state-lf.toml run - -### thinking_state (LibAFL-DiFuzz) - - # cd /fuzz - # sydr-fuzz -c thinking_state-libafl.toml run - -### thinking_eat (libfuzzer) - - # cd /fuzz - # sydr-fuzz -c thinking_eat-lf.toml run - -### thinking_eat (LibAFL-DiFuzz) - - # cd /fuzz - # sydr-fuzz -c thinking_eat-libafl.toml run - ### parser_parsefile (libfuzzer) # cd /fuzz diff --git a/projects/ollama/build.sh b/projects/ollama/build.sh index 44a620a95..7b817b5e3 100755 --- a/projects/ollama/build.sh +++ b/projects/ollama/build.sh @@ -13,13 +13,9 @@ export CGO_LDFLAGS="-ldl" # LibFuzzer targets LIBFUZZER_TARGETS=( "parser_parsefile_fuzz:/ollama/fuzz:FuzzParseFile" - "thinking_content_fuzz:/ollama/fuzz:FuzzAddContent" - "thinking_state_fuzz:/ollama/fuzz:FuzzParserState" - "thinking_eat_fuzz:/ollama/fuzz:FuzzEat" "convert_tokenizer_fuzz:/ollama/fuzz:FuzzParseVocabularyFromTokenizer" "convert_vocabulary_fuzz:/ollama/fuzz:FuzzParseVocabulary" "server_manifest_fuzz:/ollama/fuzz:FuzzParseNamedManifest" - "server_newlayer_fuzz:/ollama/fuzz:FuzzNewLayer" "harmony_parser_fuzz:/ollama/fuzz:FuzzHarmonyParser" "wordpiece_fuzz:/ollama/fuzz:FuzzWordPiece" ) @@ -27,13 +23,9 @@ LIBFUZZER_TARGETS=( # Sydr targets SYDR_TARGETS=( "parser_parsefile_sydr:/ollama/sydr/parser" - "thinking_content_sydr:/ollama/sydr/thinking" - "thinking_state_sydr:/ollama/sydr/thinking" - "thinking_eat_sydr:/ollama/sydr/thinking" "convert_tokenizer_sydr:/ollama/sydr/convert" "convert_vocabulary_sydr:/ollama/sydr/convert" "server_manifest_sydr:/ollama/sydr/server" - "server_newlayer_sydr:/ollama/sydr/server" "harmony_parser_sydr:/ollama/sydr/harmony" "wordpiece_sydr:/ollama/sydr/wordpiece" ) diff --git a/projects/ollama/directed_target/Makefile.toml b/projects/ollama/directed_target/Makefile.toml index b754954b2..e18f789ef 100644 --- a/projects/ollama/directed_target/Makefile.toml +++ b/projects/ollama/directed_target/Makefile.toml @@ -57,14 +57,6 @@ cd ${EXAMPLE_DIR}/sydr/parser/parsefile go build -o ${OUT_DIR_ABS}/parser_parsefile_sydr cd ${EXAMPLE_DIR}/sydr/server/manifest go build -o ${OUT_DIR_ABS}/server_manifest_sydr -cd ${EXAMPLE_DIR}/sydr/server/newlayer -go build -o ${OUT_DIR_ABS}/server_newlayer_sydr -cd ${EXAMPLE_DIR}/sydr/thinking/content -go build -o ${OUT_DIR_ABS}/thinking_content_sydr -cd ${EXAMPLE_DIR}/sydr/thinking/state -go build -o ${OUT_DIR_ABS}/thinking_state_sydr -cd ${EXAMPLE_DIR}/sydr/thinking/eat -go build -o ${OUT_DIR_ABS}/thinking_eat_sydr cd ${EXAMPLE_DIR}/sydr/harmony/parser go build -o ${OUT_DIR_ABS}/harmony_parser_sydr cd ${EXAMPLE_DIR}/sydr/wordpiece/encode @@ -96,22 +88,6 @@ ${GOINSTR_COVERAGE} -i sydr/server/manifest/main.go -a insert -l info go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/server_manifest_coverage sydr/server/manifest/main.go ${GOINSTR_COVERAGE} -i sydr/server/manifest/main.go -a remove -l info -${GOINSTR_COVERAGE} -i sydr/server/newlayer/main.go -a insert -l info -go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/server_newlayer_coverage sydr/server/newlayer/main.go -${GOINSTR_COVERAGE} -i sydr/server/newlayer/main.go -a remove -l info - -${GOINSTR_COVERAGE} -i sydr/thinking/content/main.go -a insert -l info -go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/thinking_content_coverage sydr/thinking/content/main.go -${GOINSTR_COVERAGE} -i sydr/thinking/content/main.go -a remove -l info - -${GOINSTR_COVERAGE} -i sydr/thinking/state/main.go -a insert -l info -go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/thinking_state_coverage sydr/thinking/state/main.go -${GOINSTR_COVERAGE} -i sydr/thinking/state/main.go -a remove -l info - -${GOINSTR_COVERAGE} -i sydr/thinking/eat/main.go -a insert -l info -go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/thinking_eat_coverage sydr/thinking/eat/main.go -${GOINSTR_COVERAGE} -i sydr/thinking/eat/main.go -a remove -l info - ${GOINSTR_COVERAGE} -i sydr/harmony/parser/main.go -a insert -l info go build -cover -covermode=atomic -coverpkg=./... -o ${OUT_DIR_ABS}/harmony_parser_coverage sydr/harmony/parser/main.go ${GOINSTR_COVERAGE} -i sydr/harmony/parser/main.go -a remove -l info @@ -133,10 +109,6 @@ ${DIFUZZ_DIR_ABS}/difuzz-go -r tokenizer.main -c ${PROJECT_DIR}/config_convert_ ${DIFUZZ_DIR_ABS}/difuzz-go -r vocabulary.main -c ${PROJECT_DIR}/config_convert_vocabulary.toml -p ${EXAMPLE_DIR}/sydr/convert/vocabulary/main.go -e ${OUT_DIR_ABS}/ets_convert_vocabulary.toml ${DIFUZZ_ARGS} ${DIFUZZ_DIR_ABS}/difuzz-go -r parsefile.main -c ${PROJECT_DIR}/config_parser_parsefile.toml -p ${EXAMPLE_DIR}/sydr/parser/parsefile/main.go -e ${OUT_DIR_ABS}/ets_parser_parsefile.toml ${DIFUZZ_ARGS} ${DIFUZZ_DIR_ABS}/difuzz-go -r manifest.main -c ${PROJECT_DIR}/config_server_manifest.toml -p ${EXAMPLE_DIR}/sydr/server/manifest/main.go -e ${OUT_DIR_ABS}/ets_server_manifest.toml ${DIFUZZ_ARGS} -${DIFUZZ_DIR_ABS}/difuzz-go -r newlayer.main -c ${PROJECT_DIR}/config_server_newlayer.toml -p ${EXAMPLE_DIR}/sydr/server/newlayer/main.go -e ${OUT_DIR_ABS}/ets_server_newlayer.toml ${DIFUZZ_ARGS} -${DIFUZZ_DIR_ABS}/difuzz-go -r content.main -c ${PROJECT_DIR}/config_thinking_content.toml -p ${EXAMPLE_DIR}/sydr/thinking/content/main.go -e ${OUT_DIR_ABS}/ets_thinking_content.toml ${DIFUZZ_ARGS} -${DIFUZZ_DIR_ABS}/difuzz-go -r state.main -c ${PROJECT_DIR}/config_thinking_state.toml -p ${EXAMPLE_DIR}/sydr/thinking/state/main.go -e ${OUT_DIR_ABS}/ets_thinking_state.toml ${DIFUZZ_ARGS} -${DIFUZZ_DIR_ABS}/difuzz-go -r eat.main -c ${PROJECT_DIR}/config_thinking_eat.toml -p ${EXAMPLE_DIR}/sydr/thinking/eat/main.go -e ${OUT_DIR_ABS}/ets_thinking_eat.toml ${DIFUZZ_ARGS} ${DIFUZZ_DIR_ABS}/difuzz-go -r parser.main -c ${PROJECT_DIR}/config_harmony_parser.toml -p ${EXAMPLE_DIR}/sydr/harmony/parser/main.go -e ${OUT_DIR_ABS}/ets_harmony_parser.toml ${DIFUZZ_ARGS} ${DIFUZZ_DIR_ABS}/difuzz-go -r encode.main -c ${PROJECT_DIR}/config_wordpiece.toml -p ${EXAMPLE_DIR}/sydr/wordpiece/encode/main.go -e ${OUT_DIR_ABS}/ets_wordpiece.toml ${DIFUZZ_ARGS} ''' @@ -173,30 +145,6 @@ cd ${EXAMPLE_DIR_INSTR}/sydr/server/manifest CGO_LDFLAGS="-L${LIBFORKSERVER_DIR_ABS}" go build -o ${OUT_DIR_ABS}/difuzz_target_server_manifest ${GOINSTR_DIFUZZ} -a remove -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_server_manifest.toml -keep-ets -l info -${GOINSTR_DIFUZZ} -a insert -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_server_newlayer.toml -l info -j 8 -${GOINSTR_SANCOV} -a insert -i ${EXAMPLE_DIR} -o / -l info -j 8 -cd ${EXAMPLE_DIR_INSTR}/sydr/server/newlayer -CGO_LDFLAGS="-L${LIBFORKSERVER_DIR_ABS}" go build -o ${OUT_DIR_ABS}/difuzz_target_server_newlayer -${GOINSTR_DIFUZZ} -a remove -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_server_newlayer.toml -keep-ets -l info - -${GOINSTR_DIFUZZ} -a insert -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_thinking_content.toml -l info -j 8 -${GOINSTR_SANCOV} -a insert -i ${EXAMPLE_DIR} -o / -l info -j 8 -cd ${EXAMPLE_DIR_INSTR}/sydr/thinking/content -CGO_LDFLAGS="-L${LIBFORKSERVER_DIR_ABS}" go build -o ${OUT_DIR_ABS}/difuzz_target_thinking_content -${GOINSTR_DIFUZZ} -a remove -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_thinking_content.toml -keep-ets -l info - -${GOINSTR_DIFUZZ} -a insert -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_thinking_state.toml -l info -j 8 -${GOINSTR_SANCOV} -a insert -i ${EXAMPLE_DIR} -o / -l info -j 8 -cd ${EXAMPLE_DIR_INSTR}/sydr/thinking/state -CGO_LDFLAGS="-L${LIBFORKSERVER_DIR_ABS}" go build -o ${OUT_DIR_ABS}/difuzz_target_thinking_state -${GOINSTR_DIFUZZ} -a remove -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_thinking_state.toml -keep-ets -l info - -${GOINSTR_DIFUZZ} -a insert -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_thinking_eat.toml -l info -j 8 -${GOINSTR_SANCOV} -a insert -i ${EXAMPLE_DIR} -o / -l info -j 8 -cd ${EXAMPLE_DIR_INSTR}/sydr/thinking/eat -CGO_LDFLAGS="-L${LIBFORKSERVER_DIR_ABS}" go build -o ${OUT_DIR_ABS}/difuzz_target_thinking_eat -${GOINSTR_DIFUZZ} -a remove -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_thinking_eat.toml -keep-ets -l info - ${GOINSTR_DIFUZZ} -a insert -i ${EXAMPLE_DIR} -o / -e ${OUT_DIR_ABS}/ets_harmony_parser.toml -l info -j 8 ${GOINSTR_SANCOV} -a insert -i ${EXAMPLE_DIR} -o / -l info -j 8 cd ${EXAMPLE_DIR_INSTR}/sydr/harmony/parser diff --git a/projects/ollama/directed_target/config_server_newlayer.toml b/projects/ollama/directed_target/config_server_newlayer.toml deleted file mode 100644 index ed82f1a3e..000000000 --- a/projects/ollama/directed_target/config_server_newlayer.toml +++ /dev/null @@ -1,19 +0,0 @@ -# Copyright 2025 ISP RAS -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -################################################################################ - -[[target]] -file = "/ollama/sydr/server/newlayer/main.go" -line = 10 diff --git a/projects/ollama/directed_target/config_thinking_content.toml b/projects/ollama/directed_target/config_thinking_content.toml deleted file mode 100644 index 682288203..000000000 --- a/projects/ollama/directed_target/config_thinking_content.toml +++ /dev/null @@ -1,19 +0,0 @@ -# Copyright 2025 ISP RAS -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -################################################################################ - -[[target]] -file = "/ollama/sydr/thinking/content/main.go" -line = 10 diff --git a/projects/ollama/directed_target/config_thinking_eat.toml b/projects/ollama/directed_target/config_thinking_eat.toml deleted file mode 100644 index 6be5a7e25..000000000 --- a/projects/ollama/directed_target/config_thinking_eat.toml +++ /dev/null @@ -1,19 +0,0 @@ -# Copyright 2025 ISP RAS -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -################################################################################ - -[[target]] -file = "/ollama/sydr/thinking/eat/main.go" -line = 10 diff --git a/projects/ollama/directed_target/config_thinking_state.toml b/projects/ollama/directed_target/config_thinking_state.toml deleted file mode 100644 index ae23ccfce..000000000 --- a/projects/ollama/directed_target/config_thinking_state.toml +++ /dev/null @@ -1,19 +0,0 @@ -# Copyright 2025 ISP RAS -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -################################################################################ - -[[target]] -file = "/ollama/sydr/thinking/state/main.go" -line = 10 diff --git a/projects/ollama/fuzz.go b/projects/ollama/fuzz.go index 7037d09bc..e813c1018 100644 --- a/projects/ollama/fuzz.go +++ b/projects/ollama/fuzz.go @@ -5,13 +5,11 @@ import ( "encoding/json" "os" "path/filepath" - "strings" "github.com/ollama/ollama/convert" model "github.com/ollama/ollama/model" "github.com/ollama/ollama/parser" "github.com/ollama/ollama/server" - "github.com/ollama/ollama/thinking" "github.com/ollama/ollama/harmony" typesmodel "github.com/ollama/ollama/types/model" ) @@ -70,36 +68,6 @@ func FuzzParseFile(data []byte) int { return 1 } -func FuzzNewLayer(data []byte) int { - const maxSize = 10 * 1024 * 1024 - if len(data) > maxSize { - return 0 - } - - r := bytes.NewReader(data) - layer, err := server.NewLayer(r, "application/vnd.docker.image.rootfs.diff.tar.gzip") - if err != nil { - return 0 - } - - var getBlobsPath = func(digest string) (string, error) { - dir, err := os.MkdirTemp("", "ollama-blobs-fuzz") - if err != nil { - return "", err - } - if digest != "" { - return filepath.Join(dir, digest), nil - } - return dir, nil - } - if layer.Digest != "" { - blobPath, _ := getBlobsPath(layer.Digest) - os.Remove(blobPath) - } - - return 1 -} - func FuzzParseNamedManifest(data []byte) int { const maxSize = 100 * 1024 if len(data) > maxSize { @@ -154,84 +122,6 @@ func FuzzParseNamedManifest(data []byte) int { return 1 } -func FuzzAddContent(data []byte) int { - if len(data) == 0 { - return -1 - } - - p := &thinking.Parser{ - OpeningTag: "", - ClosingTag: "", - } - - const maxSize = 10 * 1024 - if len(data) > maxSize { - data = data[:maxSize] - } - - content := string(data) - thinkingContent, remaining := p.AddContent(content) - - if !strings.Contains(thinkingContent, content) || !strings.Contains(remaining, content) { - return 0 - } - - return 1 -} - -func FuzzParserState(data []byte) int { - if len(data) == 0 { - return -1 - } - - p := &thinking.Parser{ - OpeningTag: "", - ClosingTag: "", - } - - content := string(data) - p.AddContent(content) - - // We can't check internal state directly, so we'll verify behavior instead - // by checking if the parser correctly handles valid/invalid content - if strings.Contains(content, "") && strings.Contains(content, "") { - // Valid thinking tags - should return some thinking content - thinkingContent, _ := p.AddContent("") - if thinkingContent == "" { - return 0 - } - } else { - // No thinking tags - should return empty thinking content - thinkingContent, _ := p.AddContent("") - if thinkingContent != "" { - return 0 - } - } - - return 1 -} - -func FuzzEat(data []byte) int { - if len(data) == 0 { - return -1 - } - - p := &thinking.Parser{ - OpeningTag: "", - ClosingTag: "", - } - - // Test AddContent which internally uses eat() - thinkingContent, remaining := p.AddContent(string(data)) - - content := string(data) - if !strings.Contains(thinkingContent, content) || !strings.Contains(remaining, content) { - return 0 - } - - return 1 -} - func FuzzHarmonyParser(data []byte) int { if len(data) == 0 { return -1 diff --git a/projects/ollama/server_newlayer-lf.toml b/projects/ollama/server_newlayer-lf.toml deleted file mode 100644 index 0d76a047f..000000000 --- a/projects/ollama/server_newlayer-lf.toml +++ /dev/null @@ -1,28 +0,0 @@ -# Copyright 2025 ISP RAS -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -################################################################################ - -[sydr] -target = "/server_newlayer_sydr @@" -args = "-s 90 --wait-jobs -j2" -jobs = 2 - -[libfuzzer] -path = "/server_newlayer_fuzz" -args = "-jobs=1000 -workers=4 -rss_limit_mb=8192 /corpus/server/corpus_newlayer" - -[cov] -target = "/server_newlayer_sydr @@" -source = "/ollama" diff --git a/projects/ollama/server_newlayer-libafl.toml b/projects/ollama/server_newlayer-libafl.toml deleted file mode 100644 index 99d60af30..000000000 --- a/projects/ollama/server_newlayer-libafl.toml +++ /dev/null @@ -1,30 +0,0 @@ -# Copyright 2025 ISP RAS -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -################################################################################ - -[sydr] -target = "/server_newlayer_sydr @@" -args = "-s 90 --wait-jobs -j2" -jobs = 2 - -[difuzz] -path = "/directed_target/sydr/difuzz/libafl_difuzz" -target = "/difuzz_target_server_newlayer @@" -args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /corpus/server/corpus_newlayer -e /ets_server_newlayer.toml" -casr_bin = "/server_newlayer_sydr" - -[cov] -target = "/server_newlayer_coverage @@" -source = "/ollama" diff --git a/projects/ollama/server_newlayer_sydr.go b/projects/ollama/server_newlayer_sydr.go deleted file mode 100644 index 76ad7f116..000000000 --- a/projects/ollama/server_newlayer_sydr.go +++ /dev/null @@ -1,12 +0,0 @@ -package main - -import ( - "os" - - "github.com/ollama/ollama/fuzz" -) - -func main() { - data, _ := os.ReadFile(os.Args[1]) - fuzz.FuzzNewLayer(data) -} diff --git a/projects/ollama/thinking_content-lf.toml b/projects/ollama/thinking_content-lf.toml deleted file mode 100644 index fd9a190b8..000000000 --- a/projects/ollama/thinking_content-lf.toml +++ /dev/null @@ -1,28 +0,0 @@ -# Copyright 2025 ISP RAS -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -################################################################################ - -[sydr] -target = "/thinking_content_sydr @@" -args = "-s 90 --wait-jobs -j2" -jobs = 2 - -[libfuzzer] -path = "/thinking_content_fuzz" -args = "-jobs=1000 -workers=4 -rss_limit_mb=8192 /corpus/thinking/corpus_content" - -[cov] -target = "/thinking_content_sydr @@" -source = "/ollama" diff --git a/projects/ollama/thinking_content-libafl.toml b/projects/ollama/thinking_content-libafl.toml deleted file mode 100644 index 689fdb595..000000000 --- a/projects/ollama/thinking_content-libafl.toml +++ /dev/null @@ -1,30 +0,0 @@ -# Copyright 2025 ISP RAS -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -################################################################################ - -[sydr] -target = "/thinking_content_sydr @@" -args = "-s 90 --wait-jobs -j2" -jobs = 2 - -[difuzz] -path = "/directed_target/sydr/difuzz/libafl_difuzz" -target = "/difuzz_target_thinking_content @@" -args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /corpus/thinking/corpus_content -e /ets_thinking_content.toml" -casr_bin = "/thinking_content_sydr" - -[cov] -target = "/thinking_content_coverage @@" -source = "/ollama" diff --git a/projects/ollama/thinking_content_sydr.go b/projects/ollama/thinking_content_sydr.go deleted file mode 100644 index 48c507d26..000000000 --- a/projects/ollama/thinking_content_sydr.go +++ /dev/null @@ -1,12 +0,0 @@ -package main - -import ( - "os" - - "github.com/ollama/ollama/fuzz" -) - -func main() { - data, _ := os.ReadFile(os.Args[1]) - fuzz.FuzzAddContent(data) -} diff --git a/projects/ollama/thinking_eat-lf.toml b/projects/ollama/thinking_eat-lf.toml deleted file mode 100644 index 0c1e56a13..000000000 --- a/projects/ollama/thinking_eat-lf.toml +++ /dev/null @@ -1,28 +0,0 @@ -# Copyright 2025 ISP RAS -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -################################################################################ - -[sydr] -target = "/thinking_eat_sydr @@" -args = "-s 90 --wait-jobs -j2" -jobs = 2 - -[libfuzzer] -path = "/thinking_eat_fuzz" -args = "-jobs=1000 -workers=4 -rss_limit_mb=8192 /corpus/thinking/corpus_eat" - -[cov] -target = "/thinking_eat_sydr @@" -source = "/ollama" diff --git a/projects/ollama/thinking_eat-libafl.toml b/projects/ollama/thinking_eat-libafl.toml deleted file mode 100644 index a09d54766..000000000 --- a/projects/ollama/thinking_eat-libafl.toml +++ /dev/null @@ -1,30 +0,0 @@ -# Copyright 2025 ISP RAS -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -################################################################################ - -[sydr] -target = "/thinking_eat_sydr @@" -args = "-s 90 --wait-jobs -j2" -jobs = 2 - -[difuzz] -path = "/directed_target/sydr/difuzz/libafl_difuzz" -target = "/difuzz_target_thinking_eat @@" -args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /corpus/thinking/corpus_eat -e /ets_thinking_eat.toml" -casr_bin = "/thinking_eat_sydr" - -[cov] -target = "/thinking_eat_coverage @@" -source = "/ollama" diff --git a/projects/ollama/thinking_eat_sydr.go b/projects/ollama/thinking_eat_sydr.go deleted file mode 100644 index 48fb05d10..000000000 --- a/projects/ollama/thinking_eat_sydr.go +++ /dev/null @@ -1,12 +0,0 @@ -package main - -import ( - "os" - - "github.com/ollama/ollama/fuzz" -) - -func main() { - data, _ := os.ReadFile(os.Args[1]) - fuzz.FuzzEat(data) -} diff --git a/projects/ollama/thinking_state-lf.toml b/projects/ollama/thinking_state-lf.toml deleted file mode 100644 index 2ad5238d9..000000000 --- a/projects/ollama/thinking_state-lf.toml +++ /dev/null @@ -1,28 +0,0 @@ -# Copyright 2025 ISP RAS -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -################################################################################ - -[sydr] -target = "/thinking_state_sydr @@" -args = "-s 90 --wait-jobs -j2" -jobs = 2 - -[libfuzzer] -path = "/thinking_state_fuzz" -args = "-jobs=1000 -workers=4 -rss_limit_mb=8192 /corpus/thinking/corpus_state" - -[cov] -target = "/thinking_state_sydr @@" -source = "/ollama" diff --git a/projects/ollama/thinking_state-libafl.toml b/projects/ollama/thinking_state-libafl.toml deleted file mode 100644 index 67abc5b25..000000000 --- a/projects/ollama/thinking_state-libafl.toml +++ /dev/null @@ -1,29 +0,0 @@ -# Copyright 2025 ISP RAS -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# -################################################################################ - -[sydr] -target = "/thinking_state_sydr @@" -args = "-s 90 --wait-jobs -j2" -jobs = 2 - -[difuzz] -path = "/directed_target/sydr/difuzz/libafl_difuzz" -target = "/difuzz_target_thinking_state @@" -args = "-j4 --panic-analysis go --sync-limit 200 --sync-jobs 2 -l64 -i /corpus/thinking/corpus_state -e /ets_thinking_state.toml" -casr_bin = "/thinking_state_sydr" -[cov] -target = "/thinking_state_coverage @@" -source = "/ollama" diff --git a/projects/ollama/thinking_state_sydr.go b/projects/ollama/thinking_state_sydr.go deleted file mode 100644 index 0fb0e6595..000000000 --- a/projects/ollama/thinking_state_sydr.go +++ /dev/null @@ -1,12 +0,0 @@ -package main - -import ( - "os" - - "github.com/ollama/ollama/fuzz" -) - -func main() { - data, _ := os.ReadFile(os.Args[1]) - fuzz.FuzzParserState(data) -} From a556d29990526b2b09def8f11c2e59e57f28a40a Mon Sep 17 00:00:00 2001 From: headshog Date: Fri, 3 Oct 2025 16:19:50 +0300 Subject: [PATCH 4/5] Update target points --- .../config_convert_tokenizer.toml | 16 +++++++++++-- .../config_convert_vocabulary.toml | 24 +++++++++++++++++-- .../config_harmony_parser.toml | 20 ++++++++++++++-- .../config_parser_parsefile.toml | 20 ++++++++++++++-- .../config_server_manifest.toml | 12 ++++++++-- .../directed_target/config_wordpiece.toml | 16 +++++++++++-- 6 files changed, 96 insertions(+), 12 deletions(-) diff --git a/projects/ollama/directed_target/config_convert_tokenizer.toml b/projects/ollama/directed_target/config_convert_tokenizer.toml index c97265e0a..be94f412d 100644 --- a/projects/ollama/directed_target/config_convert_tokenizer.toml +++ b/projects/ollama/directed_target/config_convert_tokenizer.toml @@ -15,5 +15,17 @@ ################################################################################ [[target]] -file = "/ollama/sydr/convert/tokenizer/main.go" -line = 10 +file = "/ollama/convert/tokenizer.go" +line = 257 + +[[target]] +file = "/ollama/convert/tokenizer.go" +line = 270 + +[[target]] +file = "/ollama/convert/tokenizer.go" +line = 272 + +[[target]] +file = "/ollama/convert/tokenizer.go" +line = 274 diff --git a/projects/ollama/directed_target/config_convert_vocabulary.toml b/projects/ollama/directed_target/config_convert_vocabulary.toml index 8c6de9883..25dd98470 100644 --- a/projects/ollama/directed_target/config_convert_vocabulary.toml +++ b/projects/ollama/directed_target/config_convert_vocabulary.toml @@ -15,5 +15,25 @@ ################################################################################ [[target]] -file = "/ollama/sydr/convert/vocabulary/main.go" -line = 10 +file = "/ollama/convert/tokenizer.go" +line = 290 + +[[target]] +file = "/ollama/convert/tokenizer.go" +line = 297 + +[[target]] +file = "/ollama/convert/tokenizer.go" +line = 263 + +[[target]] +file = "/ollama/convert/tokenizer_spm.go" +line = 47 + +[[target]] +file = "/ollama/convert/tokenizer_spm.go" +line = 49 + +[[target]] +file = "/ollama/convert/tokenizer_spm.go" +line = 94 diff --git a/projects/ollama/directed_target/config_harmony_parser.toml b/projects/ollama/directed_target/config_harmony_parser.toml index 9bf32e032..184fc8aad 100644 --- a/projects/ollama/directed_target/config_harmony_parser.toml +++ b/projects/ollama/directed_target/config_harmony_parser.toml @@ -15,5 +15,21 @@ ################################################################################ [[target]] -file = "/ollama/sydr/harmony/parser/main.go" -line = 10 +file = "/ollama/harmony/harmonyparser.go" +line = 106 + +[[target]] +file = "/ollama/harmony/harmonyparser.go" +line = 198 + +[[target]] +file = "/ollama/harmony/harmonyparser.go" +line = 212 + +[[target]] +file = "/ollama/harmony/harmonyparser.go" +line = 221 + +[[target]] +file = "/ollama/harmony/harmonyparser.go" +line = 228 diff --git a/projects/ollama/directed_target/config_parser_parsefile.toml b/projects/ollama/directed_target/config_parser_parsefile.toml index e542fa42c..e10f63dd8 100644 --- a/projects/ollama/directed_target/config_parser_parsefile.toml +++ b/projects/ollama/directed_target/config_parser_parsefile.toml @@ -15,5 +15,21 @@ ################################################################################ [[target]] -file = "/ollama/sydr/parser/parsefile/main.go" -line = 10 +file = "/ollama/parser/parser.go" +line = 396 + +[[target]] +file = "/ollama/parser/parser.go" +line = 406 + +[[target]] +file = "/ollama/parser/parser.go" +line = 430 + +[[target]] +file = "/ollama/parser/parser.go" +line = 441 + +[[target]] +file = "/ollama/parser/parser.go" +line = 475 diff --git a/projects/ollama/directed_target/config_server_manifest.toml b/projects/ollama/directed_target/config_server_manifest.toml index 9c42a045a..3b7ad030a 100644 --- a/projects/ollama/directed_target/config_server_manifest.toml +++ b/projects/ollama/directed_target/config_server_manifest.toml @@ -15,5 +15,13 @@ ################################################################################ [[target]] -file = "/ollama/sydr/server/manifest/main.go" -line = 10 +file = "/ollama/server/manifest.go" +line = 75 + +[[target]] +file = "/ollama/server/manifest.go" +line = 89 + +[[target]] +file = "/ollama/server/manifest.go" +line = 94 diff --git a/projects/ollama/directed_target/config_wordpiece.toml b/projects/ollama/directed_target/config_wordpiece.toml index 4415c4c6a..84dcfb74a 100644 --- a/projects/ollama/directed_target/config_wordpiece.toml +++ b/projects/ollama/directed_target/config_wordpiece.toml @@ -15,5 +15,17 @@ ################################################################################ [[target]] -file = "/ollama/sydr/wordpiece/encode/main.go" -line = 10 +file = "/ollama/model/wordpiece.go" +line = 118 + +[[target]] +file = "/ollama/model/wordpiece.go" +line = 144 + +[[target]] +file = "/ollama/model/vocabulary.go" +line = 72 + +[[target]] +file = "/ollama/model/vocabulary.go" +line = 80 From e0fd6c7028b957617fc623bc2b1352964107adb0 Mon Sep 17 00:00:00 2001 From: headshog Date: Tue, 14 Oct 2025 18:52:19 +0300 Subject: [PATCH 5/5] Upd copyrights --- projects/ollama/Dockerfile | 16 ++++++++++++++++ projects/ollama/build.sh | 15 +++++++++++++++ 2 files changed, 31 insertions(+) diff --git a/projects/ollama/Dockerfile b/projects/ollama/Dockerfile index 28ae32894..9d9b2af8c 100644 --- a/projects/ollama/Dockerfile +++ b/projects/ollama/Dockerfile @@ -1,3 +1,19 @@ +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + ARG BASE_IMAGE="sydr/ubuntu22.04-sydr-fuzz" FROM $BASE_IMAGE diff --git a/projects/ollama/build.sh b/projects/ollama/build.sh index 7b817b5e3..b03e2c1e3 100755 --- a/projects/ollama/build.sh +++ b/projects/ollama/build.sh @@ -1,4 +1,19 @@ #!/bin/bash -ex +# Copyright 2025 ISP RAS +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ # Set compiler and flags export CC=clang-18