daandemeyer / rpms / systemd

Forked from rpms/systemd 2 years ago
Clone
Brian Stinson 2593d8
From e7077e3a551a3faedfcc3d007de6a72fb5e1df62 Mon Sep 17 00:00:00 2001
Brian Stinson 2593d8
From: Evgeny Vereshchagin <evvers@ya.ru>
Brian Stinson 2593d8
Date: Tue, 20 Nov 2018 01:20:32 +0100
Brian Stinson 2593d8
Subject: [PATCH] tests: add a fuzzer for journald streams
Brian Stinson 2593d8
Brian Stinson 2593d8
(cherry picked from commit 9541f5ff5c637bb1b3e3c69706cb73e68ff06813)
Brian Stinson 2593d8
Brian Stinson 2593d8
Resolves: #1764560
Brian Stinson 2593d8
---
Brian Stinson 2593d8
 src/fuzz/fuzz-journald-stream.c      | 35 ++++++++++++++++++++++++++++
Brian Stinson 2593d8
 src/fuzz/fuzz-journald.c             | 10 +++++---
Brian Stinson 2593d8
 src/fuzz/meson.build                 |  6 +++++
Brian Stinson 2593d8
 src/journal/journald-stream.c        |  4 ++--
Brian Stinson 2593d8
 src/journal/journald-stream.h        |  2 ++
Brian Stinson 2593d8
 test/fuzz/fuzz-journald-stream/basic |  8 +++++++
Brian Stinson 2593d8
 6 files changed, 60 insertions(+), 5 deletions(-)
Brian Stinson 2593d8
 create mode 100644 src/fuzz/fuzz-journald-stream.c
Brian Stinson 2593d8
 create mode 100644 test/fuzz/fuzz-journald-stream/basic
Brian Stinson 2593d8
Brian Stinson 2593d8
diff --git a/src/fuzz/fuzz-journald-stream.c b/src/fuzz/fuzz-journald-stream.c
Brian Stinson 2593d8
new file mode 100644
Brian Stinson 2593d8
index 0000000000..247c0889bc
Brian Stinson 2593d8
--- /dev/null
Brian Stinson 2593d8
+++ b/src/fuzz/fuzz-journald-stream.c
Brian Stinson 2593d8
@@ -0,0 +1,35 @@
Brian Stinson 2593d8
+/* SPDX-License-Identifier: LGPL-2.1+ */
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+#include <linux/sockios.h>
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+#include "fd-util.h"
Brian Stinson 2593d8
+#include "fuzz.h"
Brian Stinson 2593d8
+#include "fuzz-journald.h"
Brian Stinson 2593d8
+#include "journald-stream.h"
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+static int stream_fds[2] = { -1, -1 };
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
Brian Stinson 2593d8
+        Server s;
Brian Stinson 2593d8
+        StdoutStream *stream;
Brian Stinson 2593d8
+        int v;
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+        if (size == 0)
Brian Stinson 2593d8
+                return 0;
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+        if (!getenv("SYSTEMD_LOG_LEVEL"))
Brian Stinson 2593d8
+                log_set_max_level(LOG_CRIT);
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+        assert_se(socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0, stream_fds) >= 0);
Brian Stinson 2593d8
+        dummy_server_init(&s, NULL, 0);
Brian Stinson 2593d8
+        assert_se(stdout_stream_install(&s, stream_fds[0], &stream) >= 0);
Brian Stinson 2593d8
+        assert_se(write(stream_fds[1], data, size) == (ssize_t) size);
Brian Stinson 2593d8
+        while (ioctl(stream_fds[0], SIOCINQ, &v) == 0 && v)
Brian Stinson 2593d8
+                sd_event_run(s.event, (uint64_t) -1);
Brian Stinson 2593d8
+        if (s.n_stdout_streams)
Brian Stinson 2593d8
+                stdout_stream_destroy(stream);
Brian Stinson 2593d8
+        server_done(&s);
Brian Stinson 2593d8
+        stream_fds[1] = safe_close(stream_fds[1]);
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+        return 0;
Brian Stinson 2593d8
+}
Brian Stinson 2593d8
diff --git a/src/fuzz/fuzz-journald.c b/src/fuzz/fuzz-journald.c
Brian Stinson 2593d8
index 0659b92ba3..950e885cae 100644
Brian Stinson 2593d8
--- a/src/fuzz/fuzz-journald.c
Brian Stinson 2593d8
+++ b/src/fuzz/fuzz-journald.c
Brian Stinson 2593d8
@@ -15,11 +15,15 @@ void dummy_server_init(Server *s, const uint8_t *buffer, size_t size) {
Brian Stinson 2593d8
                 .hostname_fd = -1,
Brian Stinson 2593d8
                 .notify_fd = -1,
Brian Stinson 2593d8
                 .storage = STORAGE_NONE,
Brian Stinson 2593d8
+                .line_max = 64,
Brian Stinson 2593d8
         };
Brian Stinson 2593d8
         assert_se(sd_event_default(&s->event) >= 0);
Brian Stinson 2593d8
-        s->buffer = memdup_suffix0(buffer, size);
Brian Stinson 2593d8
-        assert_se(s->buffer);
Brian Stinson 2593d8
-        s->buffer_size = size + 1;
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+        if (buffer) {
Brian Stinson 2593d8
+                s->buffer = memdup_suffix0(buffer, size);
Brian Stinson 2593d8
+                assert_se(s->buffer);
Brian Stinson 2593d8
+                s->buffer_size = size + 1;
Brian Stinson 2593d8
+        }
Brian Stinson 2593d8
 }
Brian Stinson 2593d8
 
Brian Stinson 2593d8
 void fuzz_journald_processing_function(
Brian Stinson 2593d8
diff --git a/src/fuzz/meson.build b/src/fuzz/meson.build
Brian Stinson 2593d8
index 897c02e4ae..eea9117360 100644
Brian Stinson 2593d8
--- a/src/fuzz/meson.build
Brian Stinson 2593d8
+++ b/src/fuzz/meson.build
Brian Stinson 2593d8
@@ -51,6 +51,12 @@ fuzzers += [
Brian Stinson 2593d8
           libshared],
Brian Stinson 2593d8
          [libselinux]],
Brian Stinson 2593d8
 
Brian Stinson 2593d8
+        [['src/fuzz/fuzz-journald-stream.c',
Brian Stinson 2593d8
+          'src/fuzz/fuzz-journald.c'],
Brian Stinson 2593d8
+         [libjournal_core,
Brian Stinson 2593d8
+          libshared],
Brian Stinson 2593d8
+         [libselinux]],
Brian Stinson 2593d8
+
Brian Stinson 2593d8
         [['src/fuzz/fuzz-journald-syslog.c',
Brian Stinson 2593d8
           'src/fuzz/fuzz-journald.c'],
Brian Stinson 2593d8
          [libjournal_core,
Brian Stinson 2593d8
diff --git a/src/journal/journald-stream.c b/src/journal/journald-stream.c
Brian Stinson 2593d8
index dbf3503a82..6f8a4011ff 100644
Brian Stinson 2593d8
--- a/src/journal/journald-stream.c
Brian Stinson 2593d8
+++ b/src/journal/journald-stream.c
Brian Stinson 2593d8
@@ -125,7 +125,7 @@ void stdout_stream_free(StdoutStream *s) {
Brian Stinson 2593d8
 
Brian Stinson 2593d8
 DEFINE_TRIVIAL_CLEANUP_FUNC(StdoutStream*, stdout_stream_free);
Brian Stinson 2593d8
 
Brian Stinson 2593d8
-static void stdout_stream_destroy(StdoutStream *s) {
Brian Stinson 2593d8
+void stdout_stream_destroy(StdoutStream *s) {
Brian Stinson 2593d8
         if (!s)
Brian Stinson 2593d8
                 return;
Brian Stinson 2593d8
 
Brian Stinson 2593d8
@@ -534,7 +534,7 @@ terminate:
Brian Stinson 2593d8
         return 0;
Brian Stinson 2593d8
 }
Brian Stinson 2593d8
 
Brian Stinson 2593d8
-static int stdout_stream_install(Server *s, int fd, StdoutStream **ret) {
Brian Stinson 2593d8
+int stdout_stream_install(Server *s, int fd, StdoutStream **ret) {
Brian Stinson 2593d8
         _cleanup_(stdout_stream_freep) StdoutStream *stream = NULL;
Brian Stinson 2593d8
         sd_id128_t id;
Brian Stinson 2593d8
         int r;
Brian Stinson 2593d8
diff --git a/src/journal/journald-stream.h b/src/journal/journald-stream.h
Brian Stinson 2593d8
index bc5622ab3b..487376e763 100644
Brian Stinson 2593d8
--- a/src/journal/journald-stream.h
Brian Stinson 2593d8
+++ b/src/journal/journald-stream.h
Brian Stinson 2593d8
@@ -10,4 +10,6 @@ int server_open_stdout_socket(Server *s);
Brian Stinson 2593d8
 int server_restore_streams(Server *s, FDSet *fds);
Brian Stinson 2593d8
 
Brian Stinson 2593d8
 void stdout_stream_free(StdoutStream *s);
Brian Stinson 2593d8
+int stdout_stream_install(Server *s, int fd, StdoutStream **ret);
Brian Stinson 2593d8
+void stdout_stream_destroy(StdoutStream *s);
Brian Stinson 2593d8
 void stdout_stream_send_notify(StdoutStream *s);
Brian Stinson 2593d8
diff --git a/test/fuzz/fuzz-journald-stream/basic b/test/fuzz/fuzz-journald-stream/basic
Brian Stinson 2593d8
new file mode 100644
Brian Stinson 2593d8
index 0000000000..a088f1a539
Brian Stinson 2593d8
--- /dev/null
Brian Stinson 2593d8
+++ b/test/fuzz/fuzz-journald-stream/basic
Brian Stinson 2593d8
@@ -0,0 +1,8 @@
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+
Brian Stinson 2593d8
+6
Brian Stinson 2593d8
+1
Brian Stinson 2593d8
+0
Brian Stinson 2593d8
+0
Brian Stinson 2593d8
+0
Brian Stinson 2593d8
+hey
Brian Stinson 2593d8
\ No newline at end of file