/src/dropbear/fuzz/fuzzer-pubkey.c
Line | Count | Source |
1 | | #include "fuzz.h" |
2 | | #include "session.h" |
3 | | #include "fuzz-wrapfd.h" |
4 | | #include "debug.h" |
5 | | |
6 | 0 | static void setup_fuzzer(void) { |
7 | 0 | fuzz_common_setup(); |
8 | 0 | } |
9 | | |
10 | 0 | int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { |
11 | 0 | static int once = 0; |
12 | 0 | if (!once) { |
13 | 0 | setup_fuzzer(); |
14 | 0 | once = 1; |
15 | 0 | } |
16 | |
|
17 | 0 | if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) { |
18 | 0 | return 0; |
19 | 0 | } |
20 | | |
21 | 0 | m_malloc_set_epoch(1); |
22 | |
|
23 | 0 | if (setjmp(fuzz.jmp) == 0) { |
24 | 0 | buffer *line = buf_getstringbuf(fuzz.input); |
25 | 0 | buffer *keyblob = buf_getstringbuf(fuzz.input); |
26 | |
|
27 | 0 | unsigned int algolen; |
28 | 0 | char* algoname = buf_getstring(keyblob, &algolen); |
29 | |
|
30 | 0 | if (signature_type_from_name(algoname, algolen) == DROPBEAR_SIGNATURE_NONE) { |
31 | 0 | dropbear_exit("fuzzer imagined a bogus algorithm"); |
32 | 0 | } |
33 | | |
34 | 0 | fuzz_checkpubkey_line(line, 5, "/home/me/authorized_keys", |
35 | 0 | algoname, algolen, |
36 | 0 | keyblob->data, keyblob->len); |
37 | |
|
38 | 0 | buf_free(line); |
39 | 0 | buf_free(keyblob); |
40 | 0 | m_free(algoname); |
41 | 0 | m_malloc_free_epoch(1, 0); |
42 | 0 | } else { |
43 | 0 | m_malloc_free_epoch(1, 1); |
44 | 0 | TRACE(("dropbear_exit longjmped")) |
45 | | /* dropbear_exit jumped here */ |
46 | 0 | } |
47 | | |
48 | 0 | return 0; |
49 | 0 | } |