Coverage Report

Created: 2025-08-26 06:44

/src/dropbear/fuzz/fuzzer-kexsntrup-srv.c
Line
Count
Source (jump to first uncovered line)
1
#include "fuzz.h"
2
#include "session.h"
3
#include "fuzz-wrapfd.h"
4
#include "debug.h"
5
#include "runopts.h"
6
#include "algo.h"
7
8
static struct key_context* keep_newkeys = NULL;
9
10
static void setup() __attribute__((constructor));
11
2
static void setup() {
12
2
  fuzz_common_setup();
13
2
  fuzz_svr_setup();
14
15
2
  keep_newkeys = (struct key_context*)m_malloc(sizeof(struct key_context));
16
2
  keep_newkeys->algo_kex = fuzz_get_algo(sshkex, "sntrup761x25519-sha512");
17
2
  keep_newkeys->algo_hostkey = DROPBEAR_SIGNKEY_ED25519;
18
2
}
19
20
788
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
21
788
  if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) {
22
0
    return 0;
23
0
  }
24
25
788
  m_malloc_set_epoch(1);
26
27
788
  if (setjmp(fuzz.jmp) == 0) {
28
788
    ses.newkeys = keep_newkeys;
29
30
788
    struct kex_pqhybrid_param *param = gen_kexpqhybrid_param();
31
32
788
    buffer * q_c = buf_getstringbuf(fuzz.input);
33
34
788
    ses.kexhashbuf = buf_new(KEXHASHBUF_MAX_INTS);
35
788
    kexpqhybrid_comb_key(param, q_c, svr_opts.hostkey);
36
37
788
    free_kexpqhybrid_param(param);
38
39
788
    buf_free(ses.dh_K_bytes);
40
788
    buf_free(q_c);
41
42
788
    buf_free(ses.hash);
43
788
    buf_free(ses.session_id);
44
    /* kexhashbuf is freed in kexpqhybrid_comb_key */
45
46
788
    m_malloc_free_epoch(1, 0);
47
788
  } else {
48
0
    m_malloc_free_epoch(1, 1);
49
0
    TRACE(("dropbear_exit longjmped"))
50
    /* dropbear_exit jumped here */
51
0
  }
52
53
788
  return 0;
54
788
}