Coverage Report

Created: 2025-11-24 06:34

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/dropbear/fuzz/fuzzer-pubkey.c
Line
Count
Source
1
#include "fuzz.h"
2
#include "session.h"
3
#include "fuzz-wrapfd.h"
4
#include "debug.h"
5
6
1
static void setup_fuzzer(void) {
7
1
  fuzz_common_setup();
8
1
}
9
10
2.27k
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
11
2.27k
  static int once = 0;
12
2.27k
  if (!once) {
13
1
    setup_fuzzer();
14
1
    once = 1;
15
1
  }
16
17
2.27k
  if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) {
18
0
    return 0;
19
0
  }
20
21
2.27k
  m_malloc_set_epoch(1);
22
23
2.27k
  if (setjmp(fuzz.jmp) == 0) {
24
2.27k
    buffer *line = buf_getstringbuf(fuzz.input);
25
2.27k
    buffer *keyblob = buf_getstringbuf(fuzz.input);
26
27
2.27k
    unsigned int algolen;
28
2.27k
    char* algoname = buf_getstring(keyblob, &algolen);
29
30
2.27k
    if (signature_type_from_name(algoname, algolen) == DROPBEAR_SIGNATURE_NONE) {
31
190
      dropbear_exit("fuzzer imagined a bogus algorithm");
32
190
    }
33
34
2.08k
    int ret = fuzz_checkpubkey_line(line, 5, "/home/me/authorized_keys",
35
2.08k
      algoname, algolen,
36
2.08k
      keyblob->data, keyblob->len);
37
38
2.08k
    if (ret == DROPBEAR_SUCCESS) {
39
      /* fuzz_checkpubkey_line() should have cleaned up for failure */
40
156
      svr_pubkey_options_cleanup();
41
156
    }
42
43
2.08k
    buf_free(line);
44
2.08k
    buf_free(keyblob);
45
2.08k
    m_free(algoname);
46
2.08k
    m_malloc_free_epoch(1, 0);
47
2.08k
  } else {
48
0
    m_malloc_free_epoch(1, 1);
49
0
    TRACE(("dropbear_exit longjmped"))
50
    /* dropbear_exit jumped here */
51
0
  }
52
53
2.08k
  return 0;
54
2.27k
}