Coverage Report

Created: 2025-10-10 06:23

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/dropbear/fuzz/fuzzer-kexsntrup-srv.c
Line
Count
Source
1
#include "fuzz.h"
2
#include "session.h"
3
#include "fuzz-wrapfd.h"
4
#include "debug.h"
5
#include "runopts.h"
6
#include "algo.h"
7
8
static struct key_context* keep_newkeys = NULL;
9
10
static void setup() __attribute__((constructor));
11
2
static void setup() {
12
2
  fuzz_common_setup();
13
2
  fuzz_svr_setup();
14
15
2
  keep_newkeys = (struct key_context*)m_malloc(sizeof(struct key_context));
16
2
  keep_newkeys->algo_kex = fuzz_get_algo(sshkex, "sntrup761x25519-sha512");
17
2
  keep_newkeys->algo_hostkey = DROPBEAR_SIGNKEY_ED25519;
18
2
}
19
20
773
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
21
773
  if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) {
22
0
    return 0;
23
0
  }
24
25
773
  m_malloc_set_epoch(1);
26
27
773
  if (setjmp(fuzz.jmp) == 0) {
28
773
    ses.newkeys = keep_newkeys;
29
30
773
    struct kex_pqhybrid_param *param = gen_kexpqhybrid_param();
31
32
773
    buffer * q_c = buf_getstringbuf(fuzz.input);
33
34
773
    ses.kexhashbuf = buf_new(KEXHASHBUF_MAX_INTS);
35
773
    kexpqhybrid_comb_key(param, q_c, svr_opts.hostkey);
36
37
773
    free_kexpqhybrid_param(param);
38
39
773
    buf_free(ses.dh_K_bytes);
40
773
    buf_free(q_c);
41
42
773
    buf_free(ses.hash);
43
773
    buf_free(ses.session_id);
44
    /* kexhashbuf is freed in kexpqhybrid_comb_key */
45
46
773
    m_malloc_free_epoch(1, 0);
47
773
  } else {
48
0
    m_malloc_free_epoch(1, 1);
49
0
    TRACE(("dropbear_exit longjmped"))
50
    /* dropbear_exit jumped here */
51
0
  }
52
53
773
  return 0;
54
773
}