diff options
author | Matt Johnston <matt@ucc.asn.au> | 2020-10-23 23:10:20 +0800 |
---|---|---|
committer | Matt Johnston <matt@ucc.asn.au> | 2020-10-23 23:10:20 +0800 |
commit | 12b5f209126c7a347d7ae79bd0b8802477cb08f1 (patch) | |
tree | 4459d295f1cebe483bab2873d109dd11b656d4bb /fuzz/fuzzer-pubkey.c | |
parent | 9a5ad3c8a5f5af02370ab920d3fbb7dd7b097b98 (diff) | |
download | dropbear-12b5f209126c7a347d7ae79bd0b8802477cb08f1.tar.gz |
Move fuzzing code to fuzz/ subdirectory, improve Makefile.in
Diffstat (limited to 'fuzz/fuzzer-pubkey.c')
-rw-r--r-- | fuzz/fuzzer-pubkey.c | 54 |
1 files changed, 54 insertions, 0 deletions
diff --git a/fuzz/fuzzer-pubkey.c b/fuzz/fuzzer-pubkey.c new file mode 100644 index 0000000..7c12cdc --- /dev/null +++ b/fuzz/fuzzer-pubkey.c @@ -0,0 +1,54 @@ +#include "fuzz.h" +#include "session.h" +#include "fuzz-wrapfd.h" +#include "debug.h" + +static void setup_fuzzer(void) { + fuzz_common_setup(); +} + +int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + static int once = 0; + if (!once) { + setup_fuzzer(); + once = 1; + } + + if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) { + return 0; + } + + m_malloc_set_epoch(1); + + if (setjmp(fuzz.jmp) == 0) { + buffer *line = buf_getstringbuf(fuzz.input); + buffer *keyblob = buf_getstringbuf(fuzz.input); + + unsigned int algolen; + char* algoname = buf_getstring(keyblob, &algolen); + + if (signature_type_from_name(algoname, algolen) == DROPBEAR_SIGNKEY_NONE) { + dropbear_exit("fuzzer imagined a bogus algorithm"); + } + + int ret = fuzz_checkpubkey_line(line, 5, "/home/me/authorized_keys", + algoname, algolen, + keyblob->data, keyblob->len); + + if (ret == DROPBEAR_SUCCESS) { + /* fuzz_checkpubkey_line() should have cleaned up for failure */ + svr_pubkey_options_cleanup(); + } + + buf_free(line); + buf_free(keyblob); + m_free(algoname); + m_malloc_free_epoch(1, 0); + } else { + m_malloc_free_epoch(1, 1); + TRACE(("dropbear_exit longjmped")) + /* dropbear_exit jumped here */ + } + + return 0; +} |