|
 |
4bff0a |
From 9a6a36b44ad131036fef5c91edc86c842c9821ba Mon Sep 17 00:00:00 2001
|
|
|
4bff0a |
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
|
|
|
4bff0a |
Date: Sat, 7 Jul 2018 19:30:25 +0200
|
|
|
4bff0a |
Subject: [PATCH] fuzz-bus-message: add fuzzer for message parsing
|
|
|
4bff0a |
|
|
|
4bff0a |
As with other fuzzers, SYSTEMD_FUZZ_OUTPUT=1 and SYSTEMD_LOG_LEVEL=debug can be
|
|
|
4bff0a |
used for debugging.
|
|
|
4bff0a |
|
|
|
4bff0a |
(cherry picked from commit 56b560c26339c4b282c06038316a91509eae75fd)
|
|
|
4bff0a |
|
|
|
4bff0a |
Resolves: #1696224
|
|
|
4bff0a |
---
|
|
|
4bff0a |
src/fuzz/fuzz-bus-message.c | 47 ++++++++++++++++++++++++++++
|
|
|
4bff0a |
src/fuzz/meson.build | 4 +++
|
|
|
4bff0a |
test/fuzz/fuzz-bus-message/message1 | Bin 0 -> 534 bytes
|
|
|
4bff0a |
3 files changed, 51 insertions(+)
|
|
|
4bff0a |
create mode 100644 src/fuzz/fuzz-bus-message.c
|
|
|
4bff0a |
create mode 100644 test/fuzz/fuzz-bus-message/message1
|
|
|
4bff0a |
|
|
|
4bff0a |
diff --git a/src/fuzz/fuzz-bus-message.c b/src/fuzz/fuzz-bus-message.c
|
|
|
4bff0a |
new file mode 100644
|
|
|
4bff0a |
index 0000000000..9842c62a6f
|
|
|
4bff0a |
--- /dev/null
|
|
|
4bff0a |
+++ b/src/fuzz/fuzz-bus-message.c
|
|
|
4bff0a |
@@ -0,0 +1,47 @@
|
|
|
4bff0a |
+/* SPDX-License-Identifier: LGPL-2.1+ */
|
|
|
4bff0a |
+
|
|
|
4bff0a |
+#include <errno.h>
|
|
|
4bff0a |
+#include <stdio.h>
|
|
|
4bff0a |
+
|
|
|
4bff0a |
+#include "alloc-util.h"
|
|
|
4bff0a |
+#include "bus-dump.h"
|
|
|
4bff0a |
+#include "bus-message.h"
|
|
|
4bff0a |
+#include "env-util.h"
|
|
|
4bff0a |
+#include "fd-util.h"
|
|
|
4bff0a |
+#include "fuzz.h"
|
|
|
4bff0a |
+
|
|
|
4bff0a |
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
|
|
4bff0a |
+ _cleanup_free_ char *out = NULL; /* out should be freed after g */
|
|
|
4bff0a |
+ size_t out_size;
|
|
|
4bff0a |
+ _cleanup_fclose_ FILE *g = NULL;
|
|
|
4bff0a |
+ _cleanup_(sd_bus_unrefp) sd_bus *bus = NULL;
|
|
|
4bff0a |
+ _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = NULL;
|
|
|
4bff0a |
+ _cleanup_free_ void *buffer = NULL;
|
|
|
4bff0a |
+ int r;
|
|
|
4bff0a |
+
|
|
|
4bff0a |
+ /* We don't want to fill the logs with messages about parse errors.
|
|
|
4bff0a |
+ * Disable most logging if not running standalone */
|
|
|
4bff0a |
+ if (!getenv("SYSTEMD_LOG_LEVEL"))
|
|
|
4bff0a |
+ log_set_max_level(LOG_CRIT);
|
|
|
4bff0a |
+
|
|
|
4bff0a |
+ r = sd_bus_new(&bus;;
|
|
|
4bff0a |
+ assert_se(r >= 0);
|
|
|
4bff0a |
+
|
|
|
4bff0a |
+ assert_se(buffer = memdup(data, size));
|
|
|
4bff0a |
+
|
|
|
4bff0a |
+ r = bus_message_from_malloc(bus, buffer, size, NULL, 0, NULL, &m);
|
|
|
4bff0a |
+ if (r == -EBADMSG)
|
|
|
4bff0a |
+ return 0;
|
|
|
4bff0a |
+ assert_se(r >= 0);
|
|
|
4bff0a |
+ TAKE_PTR(buffer);
|
|
|
4bff0a |
+
|
|
|
4bff0a |
+ if (getenv_bool("SYSTEMD_FUZZ_OUTPUT") <= 0)
|
|
|
4bff0a |
+ assert_se(g = open_memstream(&out, &out_size));
|
|
|
4bff0a |
+
|
|
|
4bff0a |
+ bus_message_dump(m, g ?: stdout, BUS_MESSAGE_DUMP_WITH_HEADER);
|
|
|
4bff0a |
+
|
|
|
4bff0a |
+ r = sd_bus_message_rewind(m, true);
|
|
|
4bff0a |
+ assert_se(r >= 0);
|
|
|
4bff0a |
+
|
|
|
4bff0a |
+ return 0;
|
|
|
4bff0a |
+}
|
|
|
4bff0a |
diff --git a/src/fuzz/meson.build b/src/fuzz/meson.build
|
|
|
4bff0a |
index 5c81ac0c5b..1dbe28e57e 100644
|
|
|
4bff0a |
--- a/src/fuzz/meson.build
|
|
|
4bff0a |
+++ b/src/fuzz/meson.build
|
|
|
4bff0a |
@@ -1,6 +1,10 @@
|
|
|
4bff0a |
# SPDX-License-Identifier: LGPL-2.1+
|
|
|
4bff0a |
|
|
|
4bff0a |
fuzzers += [
|
|
|
4bff0a |
+ [['src/fuzz/fuzz-bus-message.c'],
|
|
|
4bff0a |
+ [libshared],
|
|
|
4bff0a |
+ []],
|
|
|
4bff0a |
+
|
|
|
4bff0a |
[['src/fuzz/fuzz-dns-packet.c',
|
|
|
4bff0a |
dns_type_headers],
|
|
|
4bff0a |
[libsystemd_resolve_core,
|
|
|
4bff0a |
diff --git a/test/fuzz/fuzz-bus-message/message1 b/test/fuzz/fuzz-bus-message/message1
|
|
|
4bff0a |
new file mode 100644
|
|
|
4bff0a |
index 0000000000000000000000000000000000000000..2df70fd7cb6f0e632c4d5c2358091309a5cd3edc
|
|
|
4bff0a |
GIT binary patch
|
|
|
4bff0a |
literal 534
|
|
|
4bff0a |
zcmZ{h!A`?442GSJjTUi2h$EV`OM6*iyZ|>&NW6m6ZC#~`RCNGV2*icg27V{4hLEuI
|
|
|
4bff0a |
z*Z%6nv6IG-c{fDW8PO*Z8RG~@1*A4LLPziq^|n=>fKTCf&ROnOFWhXL{-6KzKQR>*
|
|
|
4bff0a |
zA}kdo{MtXi^_lPUKI=U`x#dhG*Hq0
|
|
|
4bff0a |
zruVss?wLceSE4J#)5yVN0GffvA#~1mm{Zra+=e{w{I&z@*?J#i4Is_HhZ+f`nuHx|
|
|
|
4bff0a |
zld${fh;=jUB)V|NE5y2-nFH%A%GTPz>w(L%415E=fPT+(I2*knx96tO2RVnnVP6o!
|
|
|
4bff0a |
Yuz#WfEX)Cqd!b_JHzYppZsXhk08nC8%>V!Z
|
|
|
4bff0a |
|
|
|
4bff0a |
literal 0
|
|
|
4bff0a |
HcmV?d00001
|
|
|
4bff0a |
|