Coverage Report

Created: 2023-03-26 06:28

/src/fuzz_preq.c
Line
Count
Source
1
/* Copyright 2021 Google LLC
2
Licensed under the Apache License, Version 2.0 (the "License");
3
you may not use this file except in compliance with the License.
4
You may obtain a copy of the License at
5
      http://www.apache.org/licenses/LICENSE-2.0
6
Unless required by applicable law or agreed to in writing, software
7
distributed under the License is distributed on an "AS IS" BASIS,
8
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
9
See the License for the specific language governing permissions and
10
limitations under the License.
11
*/
12
#include "apr.h"
13
#include "apr_file_io.h"
14
#include "apr_poll.h"
15
#include "apr_portable.h"
16
#include "apr_proc_mutex.h"
17
#include "apr_signal.h"
18
#include "apr_strings.h"
19
#include "apr_thread_mutex.h"
20
#include "apr_thread_proc.h"
21
22
#define APR_WANT_STRFUNC
23
#include "apr_file_io.h"
24
#include "apr_fnmatch.h"
25
#include "apr_want.h"
26
27
#include "apr_poll.h"
28
#include "apr_want.h"
29
30
#include "ap_config.h"
31
#include "ap_expr.h"
32
#include "ap_listen.h"
33
#include "ap_provider.h"
34
#include "ap_regex.h"
35
36
#include "ada_fuzz_header.h"
37
#include "apreq_parser.h"
38
39
apr_status_t hookfunc(apreq_hook_t *hook, apreq_param_t *param,
40
1.14k
                      apr_bucket_brigade *bb) {
41
1.14k
  return 0;
42
1.14k
}
43
44
1.07k
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
45
1.07k
  af_gb_init();
46
47
1.07k
  const uint8_t *data2 = data;
48
1.07k
  size_t size2 = size;
49
50
  /* get random data for the fuzzer */
51
1.07k
  char *new_str = af_gb_get_null_terminated(&data2, &size2);
52
1.07k
  char *new_str2 = af_gb_get_null_terminated(&data2, &size2);
53
54
1.07k
  if (new_str != NULL && new_str2 != NULL) {
55
1.06k
    apr_pool_initialize();
56
1.06k
    apr_pool_t *v = NULL;
57
1.06k
    apr_pool_create(&v, NULL);
58
59
1.06k
    apr_bucket_alloc_t *bucket = apr_bucket_alloc_create(v);
60
1.06k
    apr_bucket_brigade *brigade = apr_brigade_create(v, bucket);
61
1.06k
    apr_brigade_write(brigade, NULL, NULL, new_str, strlen(new_str));
62
63
1.06k
    apreq_parser_t parser;
64
1.06k
    parser.content_type = new_str2;
65
1.06k
    parser.temp_dir = "/tmp/";
66
1.06k
    parser.brigade_limit = 10;
67
1.06k
    parser.pool = v;
68
1.06k
    parser.ctx = NULL;
69
1.06k
    parser.bucket_alloc = bucket;
70
71
1.06k
    parser.hook = apreq_hook_make(parser.pool, hookfunc, NULL, parser.ctx);
72
73
1.06k
    apr_table_t *table = apr_table_make(parser.pool, 10);
74
1.06k
    if (af_get_short(&data2, &size2) % 2 == 0) {
75
895
      apreq_parse_multipart(&parser, table, brigade);
76
895
    } else {
77
165
      apreq_parse_urlencoded(&parser, table, brigade);
78
165
    }
79
80
1.06k
    apr_pool_terminate();
81
1.06k
  }
82
1.07k
  af_gb_cleanup();
83
1.07k
  return 0;
84
1.07k
}