/src/curl_fuzzer/legacy_fuzzer.cc

Source
/***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
 *                             / __| | | | |_) | |
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
 * are also available at https://curl.se/docs/copyright.html.
 *
 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
 * copies of the Software, and permit persons to whom the Software is
 * furnished to do so, under the terms of the COPYING file.
 *
 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
 * KIND, either express or implied.
 *
 ***************************************************************************/

#include <stdlib.h>
#include <signal.h>
#include <string.h>
#include <unistd.h>
#include <curl/curl.h>
#include "curl_fuzzer.h"
#include "legacy_fuzzer.h"
#include "legacy_protocol_allowlist.h"
#include "legacy_tlv_mutator.h"

/**
 * Consume libcurl verbose records without emitting per-input diagnostics.
 * Enabling CURLOPT_VERBOSE is what makes curl evaluate its trace format
 * arguments; the callback keeps that work off stderr during fuzzing.
 */
int fuzz_silent_debug_callback(CURL *handle,
                               curl_infotype type,
                               char *data,
                               size_t size,
                               void *userptr)
{
  (void)handle;
  (void)type;
  (void)data;
  (void)size;
  (void)userptr;
  return 0;
}

/**
 * Open /dev/null once for the no-callback verbose lane. When no debug
 * callback is installed libcurl writes its trace directly to this stream.
 */
static FILE *fuzz_devnull(void)
{
  static FILE *devnull = NULL;

  if(devnull == NULL)
    devnull = fopen("/dev/null", "wb");
  return devnull;
}

/**
 * Run one legacy TLV input independently of the exported libFuzzer symbol.
 * Keeping the implementation behind a normal C++ function lets every
 * protocol binary expose its own same-named source entrypoint, which is how
 * Fuzz Introspector attributes a binary's runtime coverage to its call tree.
 */
int LegacyFuzzerTestOneInput(const uint8_t *data, size_t size)
{
  int rc = 0;
  int tlv_rc;
  FUZZ_DATA fuzz;
  TLV tlv;

  /* Ignore SIGPIPE errors. We'll handle the errors ourselves. */
  signal(SIGPIPE, SIG_IGN);

  /* Have to set all fields to zero before getting to the terminate function */
  memset(&fuzz, 0, sizeof(FUZZ_DATA));
  fuzz_doh_server_init(&fuzz);

  if(size < sizeof(TLV_RAW)) {
    /* Not enough data for a single TLV - don't continue */
    goto EXIT_LABEL;
  }

  /* Try to initialize the fuzz data */
  FTRY(fuzz_initialize_fuzz_data(&fuzz, data, size));

  for(tlv_rc = fuzz_get_first_tlv(&fuzz, &tlv);
      tlv_rc == 0;
      tlv_rc = fuzz_get_next_tlv(&fuzz, &tlv)) {

    /* Have the TLV in hand. Parse the TLV. */
    rc = fuzz_parse_tlv(&fuzz, &tlv);

    if(rc != 0) {
      /* Failed to parse the TLV. Can't continue. */
      goto EXIT_LABEL;
    }
  }

  if(tlv_rc != TLV_RC_NO_MORE_TLVS) {
    /* A TLV call failed. Can't continue. */
    goto EXIT_LABEL;
  }

  /* Set up the standard easy options. */
  FTRY(fuzz_set_easy_options(&fuzz));

  /**
   * Add in more curl options that have been accumulated over possibly
   * multiple TLVs.
   */
  if(fuzz.header_list != NULL) {
    curl_easy_setopt(fuzz.easy, CURLOPT_HTTPHEADER, fuzz.header_list);
  }

  if(fuzz.mail_recipients_list != NULL) {
    curl_easy_setopt(fuzz.easy, CURLOPT_MAIL_RCPT, fuzz.mail_recipients_list);
  }

  if(fuzz.mime != NULL) {
    curl_easy_setopt(fuzz.easy, CURLOPT_MIMEPOST, fuzz.mime);
  }

  if (fuzz.httppost != NULL) {
    curl_easy_setopt(fuzz.easy, CURLOPT_HTTPPOST, fuzz.httppost);
  }

  /* Run the transfer. */
  fuzz_handle_transfer(&fuzz);
  FV_PRINTF(&fuzz, "FUZZ: transfer done, wrote %zu bytes\n",
            fuzz.written_data);

EXIT_LABEL:

  fuzz_terminate_fuzz_data(&fuzz);

  /* This function must always return 0. Non-zero codes are reserved. */
  return 0;
}

/**
 * Utility function to convert 4 bytes to a u32 predictably.
 */
uint32_t to_u32(const uint8_t b[4])
{
  uint32_t u;
  /* Promote into the unsigned result type before shifting. uint8_t otherwise
     promotes to signed int, and values with the high bit set make the
     left-shift undefined before curl ever observes the fuzzed boundary. */
  u = (static_cast<uint32_t>(b[0]) << 24) |
      (static_cast<uint32_t>(b[1]) << 16) |
      (static_cast<uint32_t>(b[2]) << 8) |
      static_cast<uint32_t>(b[3]);
  return u;
}

/**
 * Utility function to convert 2 bytes to a u16 predictably.
 */
uint16_t to_u16(const uint8_t b[2])
{
  uint16_t u;
  u = (b[0] << 8) + b[1];
  return u;
}

/**
 * Initialize the local fuzz data structure.
 */
int fuzz_initialize_fuzz_data(FUZZ_DATA *fuzz,
                              const uint8_t *data,
                              size_t data_len)
{
  int rc = 0;
  int ii;

  /* Initialize the fuzz data. */
  memset(fuzz, 0, sizeof(FUZZ_DATA));
  fuzz_doh_server_init(fuzz);

  /* Create an easy handle. This will have all of the settings configured on
     it. */
  fuzz->easy = curl_easy_init();
  FCHECK(fuzz->easy != NULL);

  /* Set up the state parser */
  fuzz->state.data = data;
  fuzz->state.data_len = data_len;

  /* Set up the state of the server sockets. */
  for(ii = 0; ii < FUZZ_NUM_CONNECTIONS; ii++) {
    fuzz->sockman[ii].index = ii;
    fuzz->sockman[ii].fd_state = FUZZ_SOCK_CLOSED;
  }

  /* Check for verbose mode. */
  fuzz->verbose = (getenv("FUZZ_VERBOSE") != NULL);

  FCHECK(setenv("CURL_HSTS_HTTP", "1", 0) == 0);
  FCHECK(setenv("CURL_ALTSVC_HTTP", "1", 0) == 0);
  /* Current curl permits plaintext DoH under DEBUGBUILD directly. Set the
     analogous override as well so a future curl that gates it on an
     environment check keeps the loopback lane reachable. */
  FCHECK(setenv("CURL_DOH_HTTP", "1", 0) == 0);

EXIT_LABEL:

  return rc;
}

/**
 * Reapply resolver-sensitive string options with their canonical loopback
 * values before starting a transfer.
 *
 * Custom mutation and crossover already finalize generated buffers, but an
 * initial corpus entry or standalone reproducer is executed without passing
 * through either callback. The option tracker identifies only values that the
 * TLV parser successfully applied, so this does not enable routing options that
 * were absent from the input. DNS_INTERFACE is deliberately excluded: with
 * c-ares it is a device name passed to ares_set_local_dev(), not a hostname.
 */
static int fuzz_finalize_routing_options(FUZZ_DATA *fuzz)
{
  int rc = 0;

#define FFINALIZE_ROUTING_OPTION(TLVTYPE, CURLOPTNAME)                         \
  if(fuzz->options[(CURLOPTNAME) % 1000]) {                                   \
    const char *canonical =                                                   \
      legacy_tlv_mutator::CanonicalRoutingValue((TLVTYPE));                   \
    FCHECK(canonical != NULL);                                                 \
    FTRY(curl_easy_setopt(fuzz->easy, (CURLOPTNAME), canonical));              \
  }

  FFINALIZE_ROUTING_OPTION(TLV_TYPE_PROXY, CURLOPT_PROXY);
  FFINALIZE_ROUTING_OPTION(TLV_TYPE_FTPPORT, CURLOPT_FTPPORT);
  FFINALIZE_ROUTING_OPTION(TLV_TYPE_INTERFACE, CURLOPT_INTERFACE);
  FFINALIZE_ROUTING_OPTION(TLV_TYPE_PRE_PROXY, CURLOPT_PRE_PROXY);

#undef FFINALIZE_ROUTING_OPTION

EXIT_LABEL:
  return rc;
}

/**
 * Set standard options on the curl easy.
 */
int fuzz_set_easy_options(FUZZ_DATA *fuzz)
{
  int rc = 0;

  /* Reset curl's global trace configuration so every input starts from a known
     off baseline. curl_global_trace() only changes the components it names, so
     without this a prior input's "all" leaks into later inputs that request a
     subset, making coverage depend on corpus order. */
  (void)curl_global_trace("-all");

  /* Existing seeds and direct reproducers bypass the custom mutator. Close
     that path before any transfer can resolve a corpus-provided endpoint. */
  FTRY(fuzz_finalize_routing_options(fuzz));

  /* Set some standard options on the CURL easy handle. We need to override the
     socket function so that we create our own sockets to present to CURL. */
  FTRY(curl_easy_setopt(fuzz->easy,
                        CURLOPT_OPENSOCKETFUNCTION,
                        fuzz_open_socket));
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_OPENSOCKETDATA, fuzz));

  /* In case something tries to set a socket option, intercept this. */
  FTRY(curl_easy_setopt(fuzz->easy,
                        CURLOPT_SOCKOPTFUNCTION,
                        fuzz_sockopt_callback));

  /* Set the standard read function callback. */
  FTRY(curl_easy_setopt(fuzz->easy,
                        CURLOPT_READFUNCTION,
                        fuzz_read_callback));
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_READDATA, fuzz));

  /* Set the standard write function callback. */
  FTRY(curl_easy_setopt(fuzz->easy,
                        CURLOPT_WRITEFUNCTION,
                        fuzz_write_callback));
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_WRITEDATA, fuzz));

  /* Set the writable cookie jar path so cookies are tested. */
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_COOKIEJAR, FUZZ_COOKIE_JAR_PATH));

  /* Set the RO cookie file path so cookies are tested. */
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_COOKIEFILE, FUZZ_RO_COOKIE_FILE_PATH));

  /* Set altsvc header cache filepath so that it can be fuzzed. */
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_ALTSVC, FUZZ_ALT_SVC_HEADER_CACHE_PATH));

  /* Set the hsts header cache filepath so that it can be fuzzed. */
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_HSTS, FUZZ_HSTS_HEADER_CACHE_PATH));

  /* Set the Certificate Revocation List file path so it can be fuzzed */
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_CRLFILE, FUZZ_CRL_FILE_PATH));

  /* Set the .netrc file path so it can be fuzzed */
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_NETRC_FILE, FUZZ_NETRC_FILE_PATH));

  /* Time out requests quickly. A loopback DoH probe needs a little more room
     for the harness listener to run, but the transfer loop's stall detection
     still bounds inputs that make no progress. */
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_TIMEOUT_MS,
                        fuzz->doh.enabled ? 2000L : 200L));
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_SERVER_RESPONSE_TIMEOUT, 1L));

  /* Can enable verbose mode by having the environment variable FUZZ_VERBOSE. */
  if(fuzz->verbose) {
    FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_VERBOSE, 1L));
  }

  /* The verbose DoH lane enables curl's DoH feature tracing globally and
     installs a no-op debug callback. That makes infof() evaluate its
     arguments, exercising doh_type2name()/doh_strerror(), while keeping the
     trace off stderr. The callback and debug data are inherited by the
     internal DoH handle. */
  if(fuzz->doh_verbose) {
    (void)curl_global_trace("doh");
    FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_VERBOSE, 1L));
    FTRY(curl_easy_setopt(fuzz->easy,
                          CURLOPT_DEBUGFUNCTION,
                          fuzz_doh_debug_callback));
    FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_DEBUGDATA, fuzz));
  }

  /* Fuzzer-controlled trace configuration. curl_global_trace() selects the
     per-feature trace formatters and the silent callback keeps them off
     stderr. The no-callback lane below deliberately takes precedence if both
     flags appear in one input. */
  if(fuzz->trace_verbose && !fuzz->trace_stderr_verbose) {
    const char *trace_config =
      fuzz->trace_config[0] ? fuzz->trace_config : "all";

    (void)curl_global_trace(trace_config);
    FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_VERBOSE, 1L));
    FTRY(curl_easy_setopt(fuzz->easy,
                          CURLOPT_DEBUGFUNCTION,
                          fuzz_silent_debug_callback));
    FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_DEBUGDATA, fuzz));
    FTRY(curl_easy_setopt(fuzz->easy,
                          CURLOPT_ERRORBUFFER,
                          fuzz->error_buffer));
  }

  /* With no debug callback libcurl's trace helpers write to CURLOPT_STDERR
     directly. Point that at /dev/null so the fwrite() paths run without
     flooding the coverage log. */
  if(fuzz->trace_stderr_verbose) {
    FILE *devnull = fuzz_devnull();
    const char *trace_config =
      fuzz->trace_config[0] ? fuzz->trace_config : "all";

    (void)curl_global_trace(trace_config);
    FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_VERBOSE, 1L));
    /* This lane must reach the direct-write path, so drop any debug callback a
       DoH (TLV 165) or trace (TLV 166) record may have installed earlier. */
    FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_DEBUGFUNCTION, NULL));
    FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_DEBUGDATA, NULL));
    if(devnull != NULL) {
      FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_STDERR, devnull));
    }
    FTRY(curl_easy_setopt(fuzz->easy,
                          CURLOPT_ERRORBUFFER,
                          fuzz->error_buffer));
  }

  /* Force resolution of all addresses to a specific IP address. DoH loopback
     inputs must leave the hostname unresolved so the probe actually runs;
     the resolver answer then supplies the loopback address. */
  if(!fuzz->doh.enabled) {
    fuzz->connect_to_list = curl_slist_append(NULL, "::127.0.1.127:");
    FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_CONNECT_TO, fuzz->connect_to_list));
  }

  /* Point CURLOPT_DOH_URL at the harness-owned loopback responder. The
     internal DoH easy handle opens a real socket, so this is the only way to
     let a probe complete without changing curl. */
  if(fuzz->doh.enabled) {
    if(fuzz_doh_server_start(fuzz) == 0) {
      FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_DOH_URL, fuzz->doh.url));
      fuzz_doh_proxy_bypass_begin(fuzz);
    }
    else {
      /* Loopback is unavailable in this environment; run without DoH rather
         than failing an input for an infrastructure limitation. Restore the
         CONNECT_TO guard so a hostname cannot fall through to system DNS. */
      fuzz->doh.enabled = 0;
      fuzz->connect_to_list = curl_slist_append(NULL, "::127.0.1.127:");
      if(fuzz->connect_to_list)
        FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_CONNECT_TO,
                              fuzz->connect_to_list));
    }
  }

  /* Limit the protocols in use by this fuzzer. */
  FTRY(fuzz_set_allowed_protocols(fuzz));

EXIT_LABEL:

  return rc;
}

/**
 * Terminate the fuzz data structure, including freeing any allocated memory.
 */
void fuzz_terminate_fuzz_data(FUZZ_DATA *fuzz)
{
  int ii;

  fuzz_doh_server_stop(fuzz);

  fuzz_free((void **)&fuzz->postfields);

  for(ii = 0; ii < FUZZ_NUM_CONNECTIONS; ii++) {
    if(fuzz->sockman[ii].fd_state != FUZZ_SOCK_CLOSED) {
      close(fuzz->sockman[ii].fd);
      fuzz->sockman[ii].fd_state = FUZZ_SOCK_CLOSED;
    }
  }

  if(fuzz->connect_to_list != NULL) {
    curl_slist_free_all(fuzz->connect_to_list);
    fuzz->connect_to_list = NULL;
  }

  if(fuzz->header_list != NULL) {
    curl_slist_free_all(fuzz->header_list);
    fuzz->header_list = NULL;
  }

  if(fuzz->mail_recipients_list != NULL) {
    curl_slist_free_all(fuzz->mail_recipients_list);
    fuzz->mail_recipients_list = NULL;
  }

  if(fuzz->mime != NULL) {
    curl_mime_free(fuzz->mime);
    fuzz->mime = NULL;
  }

  if(fuzz->easy != NULL) {
    curl_easy_cleanup(fuzz->easy);
    fuzz->easy = NULL;
  }

  /* When you have passed the struct curl_httppost pointer to curl_easy_setopt
   * (using the CURLOPT_HTTPPOST option), you must not free the list until after
   *  you have called curl_easy_cleanup for the curl handle.
   *  https://curl.se/libcurl/c/curl_formadd.html */
  if (fuzz->httppost != NULL) {
    curl_formfree(fuzz->httppost);
    fuzz->httppost = NULL;
  }

  // free after httppost and last_post_part.
  if (fuzz->post_body != NULL) {
    fuzz_free((void **)&fuzz->post_body);
  }
}

/**
 * If a pointer has been allocated, free that pointer.
 */
void fuzz_free(void **ptr)
{
  if(*ptr != NULL) {
    free(*ptr);
    *ptr = NULL;
  }
}

/**
 * Function for handling the fuzz transfer, including sending responses to
 * requests.
 */
int fuzz_handle_transfer(FUZZ_DATA *fuzz)
{
  int rc = 0;
  CURLM *multi_handle;
  int still_running; /* keep number of running handles */
  CURLMsg *msg; /* for picking up messages with the transfer status */
  int msgs_left; /* how many messages are left */
  int double_timeout = 0;
  fd_set fdread;
  fd_set fdwrite;
  fd_set fdexcep;
  struct timeval timeout;
  int select_rc;
  CURLMcode mc;
  int maxfd = -1;
  long curl_timeo = -1;
  int ii;
  FUZZ_SOCKET_MANAGER *sman[FUZZ_NUM_CONNECTIONS];

  for(ii = 0; ii < FUZZ_NUM_CONNECTIONS; ii++) {
    sman[ii] = &fuzz->sockman[ii];

    /* Set up the starting index for responses. */
    sman[ii]->response_index = 1;
  }

  /* init a multi stack */
  multi_handle = curl_multi_init();

  /* add the individual transfers */
  curl_multi_add_handle(multi_handle, fuzz->easy);

  /* Do an initial process. This might end the transfer immediately. */
  curl_multi_perform(multi_handle, &still_running);
  FV_PRINTF(fuzz,
            "FUZZ: Initial perform; still running? %d \n",
            still_running);

  while(still_running) {
    /* Reset the sets of file descriptors. */
    FD_ZERO(&fdread);
    FD_ZERO(&fdwrite);
    FD_ZERO(&fdexcep);

    /* Set a timeout of 10ms. This is lower than recommended by the multi guide
       but we're not going to any remote servers, so everything should complete
       very quickly. */
    timeout.tv_sec = 0;
    timeout.tv_usec = 10000;

    /* get file descriptors from the transfers */
    mc = curl_multi_fdset(multi_handle, &fdread, &fdwrite, &fdexcep, &maxfd);
    if(mc != CURLM_OK) {
      fprintf(stderr, "curl_multi_fdset() failed, code %d.\n", mc);
      rc = -1;
      break;
    }

    for(ii = 0; ii < FUZZ_NUM_CONNECTIONS; ii++) {
      /* Add the socket FD into the readable set if connected. */
      if(sman[ii]->fd_state == FUZZ_SOCK_OPEN) {
        FD_SET(sman[ii]->fd, &fdread);

        /* Work out the maximum FD between the cURL file descriptors and the
           server FD. */
        maxfd = FUZZ_MAX(sman[ii]->fd, maxfd);
      }
    }

    fuzz_doh_server_add_fds(fuzz, &fdread, &fdwrite, &maxfd);

    /* Work out what file descriptors need work. */
    rc = fuzz_select(maxfd + 1, &fdread, &fdwrite, &fdexcep, &timeout);

    if(rc == -1) {
      /* Had an issue while selecting a file descriptor. Let's just exit. */
      FV_PRINTF(fuzz, "FUZZ: select failed, exiting \n");
      break;
    }

    int server_data_sent = 0;
    if(rc > 0 && fuzz_doh_server_service(fuzz, &fdread, &fdwrite))
      server_data_sent = 1;

    /* Check to see if a server file descriptor is readable. If it is,
       then send the next response from the fuzzing data. */
    for(ii = 0; ii < FUZZ_NUM_CONNECTIONS; ii++) {
      if(sman[ii]->fd_state == FUZZ_SOCK_OPEN &&
         FD_ISSET(sman[ii]->fd, &fdread)) {
        rc = fuzz_send_next_response(fuzz, sman[ii]);
        if(rc != 0) {
          /* Failed to send a response. Break out here. */
          break;
        }
        server_data_sent = 1;
      }
    }

    /* Stall detection: exit after two consecutive iterations where no new
       data was provided to curl. This handles both select() timeouts and
       cases where curl registers a writable fd but cannot make progress
       (e.g. HTTP/2 egress stuck with no real peer to drain to). */
    if(!server_data_sent) {
      FV_PRINTF(fuzz, "FUZZ: No data sent; stall count %d \n", double_timeout);
      if(double_timeout == 1) {
        break;
      }
      double_timeout = 1;
    }
    else {
      double_timeout = 0;
    }

    curl_multi_perform(multi_handle, &still_running);
  }

  /* Remove the easy handle from the multi stack. */
  curl_multi_remove_handle(multi_handle, fuzz->easy);

  /* Clean up the multi handle - the top level function will handle the easy
     handle. */
  curl_multi_cleanup(multi_handle);

  return rc;
}

/**
 * Sends the next fuzzing response to the server file descriptor.
 */
int fuzz_send_next_response(FUZZ_DATA *fuzz, FUZZ_SOCKET_MANAGER *sman)
{
  int rc = 0;
  ssize_t ret_in;
  ssize_t ret_out;
  char buffer[8192];
  const uint8_t *data;
  size_t data_len;

  /* Need to read all data sent by the client so the file descriptor becomes
     unreadable. Because the file descriptor is non-blocking we won't just
     hang here. */
  do {
    ret_in = read(sman->fd, buffer, sizeof(buffer));
    if(fuzz->verbose && ret_in > 0) {
      printf("FUZZ[%d]: Received %zu bytes \n==>\n", sman->index, ret_in);
      fwrite(buffer, ret_in, 1, stdout);
      printf("\n<==\n");
    }
  } while (ret_in > 0);

  /* Now send a response to the request that the client just made. */
  FV_PRINTF(fuzz,
            "FUZZ[%d]: Sending next response: %d \n",
            sman->index,
            sman->response_index);
  data = sman->responses[sman->response_index].data;
  data_len = sman->responses[sman->response_index].data_len;

  if(data != NULL) {
    if(write(sman->fd, data, data_len) != (ssize_t)data_len) {
      /* Failed to write the data back to the client. Prevent any further
         testing. */
      rc = -1;
    }
  }

  /* Work out if there are any more responses. If not, then shut down the
     server. */
  sman->response_index++;

  if(sman->response_index >= TLV_MAX_NUM_RESPONSES ||
     sman->responses[sman->response_index].data == NULL) {
    FV_PRINTF(fuzz,
              "FUZZ[%d]: Shutting down server socket: %d \n",
              sman->index,
              sman->fd);
    shutdown(sman->fd, SHUT_WR);
    sman->fd_state = FUZZ_SOCK_SHUTDOWN;
  }

  return rc;
}

/**
 * Wrapper for select() so profiling can track it.
 */
int fuzz_select(int nfds,
                fd_set *readfds,
                fd_set *writefds,
                fd_set *exceptfds,
                struct timeval *timeout) {
  return select(nfds, readfds, writefds, exceptfds, timeout);
}

/**
 * Set allowed protocols based on the compile options.
 *
 * Note that it can only use ONE of the FUZZ_PROTOCOLS_* defines.
 */
int fuzz_set_allowed_protocols(FUZZ_DATA *fuzz)
{
  int rc = 0;
  const char *allowed_protocols = "";

#ifdef FUZZ_PROTOCOLS_ALL
  /* CURLOPT_PROTOCOLS_STR rejects the complete value if even one requested
     protocol was compiled out. Derive the generic target's stable safety
     policy from this libcurl build so optional RTMP and SSH backends cannot
     prevent every transfer from starting. */
  allowed_protocols = legacy_protocol_allowlist::ForCurrentCurl().c_str();
#endif
#ifdef FUZZ_PROTOCOLS_FILE
  allowed_protocols = "file";
#endif
#ifdef FUZZ_PROTOCOLS_FTP
  allowed_protocols = "ftp,ftps";
#endif
#ifdef FUZZ_PROTOCOLS_GOPHER
  allowed_protocols = "gopher,gophers";
#endif
#ifdef FUZZ_PROTOCOLS_HTTP
  allowed_protocols = "http";
#endif
#ifdef FUZZ_PROTOCOLS_HTTPS
  allowed_protocols = "https";
#endif
#ifdef FUZZ_PROTOCOLS_IMAP
  allowed_protocols = "imap,imaps";
#endif
#ifdef FUZZ_PROTOCOLS_LDAP
  allowed_protocols = "ldap,ldaps";
#endif
#ifdef FUZZ_PROTOCOLS_MQTT
  allowed_protocols = "mqtt";
#endif
#ifdef FUZZ_PROTOCOLS_POP3
  allowed_protocols = "pop3,pop3s";
#endif
#ifdef FUZZ_PROTOCOLS_RTMP
  allowed_protocols = "rtmp,rtmpe,rtmps,rtmpt,rtmpte,rtmpts";
#endif
#ifdef FUZZ_PROTOCOLS_RTSP
  allowed_protocols = "rtsp";
#endif
#ifdef FUZZ_PROTOCOLS_SCP
  allowed_protocols = "scp";
#endif
#ifdef FUZZ_PROTOCOLS_SFTP
  allowed_protocols = "sftp";
#endif
#ifdef FUZZ_PROTOCOLS_SMTP
  allowed_protocols = "smtp,smtps";
#endif
#ifdef FUZZ_PROTOCOLS_TFTP
  allowed_protocols = "tftp";
#endif
  FTRY(curl_easy_setopt(fuzz->easy, CURLOPT_PROTOCOLS_STR, allowed_protocols));

EXIT_LABEL:

  return rc;
}

Coverage Report

Created: 2026-10-28 07:17