Coverage Report

Created: 2024-09-19 07:08

/src/fluent-bit/tests/internal/fuzzers/aws_credentials_fuzzer.c
Line
Count
Source
1
/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
2
3
/*  Fluent Bit
4
 *  ==========
5
 *  Copyright (C) 2023 The Fluent Bit Authors
6
 *
7
 *  Licensed under the Apache License, Version 2.0 (the "License");
8
 *  you may not use this file except in compliance with the License.
9
 *  You may obtain a copy of the License at
10
 *
11
 *      http://www.apache.org/licenses/LICENSE-2.0
12
 *
13
 *  Unless required by applicable law or agreed to in writing, software
14
 *  distributed under the License is distributed on an "AS IS" BASIS,
15
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16
 *  See the License for the specific language governing permissions and
17
 *  limitations under the License.
18
 */
19
20
#include <stdint.h>
21
#include <fluent-bit.h>
22
#include <fluent-bit/flb_sds.h>
23
#include <fluent-bit/flb_aws_credentials.h>
24
#include <fluent-bit/flb_mem.h>
25
#include "flb_fuzz_header.h"
26
27
int initialization_crutch()
28
950
{
29
950
    struct flb_config *config;
30
950
    config = flb_config_init();
31
950
    if (config == NULL) {
32
280
        return -1;
33
280
    }
34
670
    flb_config_exit(config);
35
670
    return 0;
36
950
}
37
38
39
364
void fuzz_sts(const uint8_t *data, size_t size) {
40
364
    char *sks_response = get_null_terminated(150, &data, &size);
41
42
364
    struct flb_aws_credentials *creds;
43
364
    time_t expiration;
44
45
364
    creds = flb_parse_sts_resp(sks_response, &expiration);
46
364
    if (creds != NULL) {
47
2
        flb_aws_credentials_destroy(creds);
48
2
    }
49
50
364
    if (size > 300) {
51
54
        char *action = get_null_terminated(50, &data, &size);
52
54
        char *role_arn = get_null_terminated(50, &data, &size);
53
54
        char *session_name = get_null_terminated(50, &data, &size);
54
54
        char *external_id = get_null_terminated(50, &data, &size);
55
54
        char *identity_token = get_null_terminated(50, &data, &size);
56
57
54
        flb_sds_t s1 = flb_sts_uri(action, role_arn, session_name,
58
54
                                   external_id, identity_token);
59
54
        if (s1 != NULL) {
60
53
            flb_sds_destroy(s1);                
61
53
        }
62
63
54
        flb_free(action);
64
54
        flb_free(role_arn);
65
54
        flb_free(session_name);
66
54
        flb_free(external_id);
67
54
        flb_free(identity_token);
68
54
    }
69
70
364
    if (sks_response != NULL) {
71
364
        flb_free(sks_response);
72
364
    }
73
364
}
74
75
76
364
void fuzz_http(const uint8_t *data, size_t size) {
77
364
    time_t expiration;
78
364
    struct flb_aws_credentials *creds = NULL;
79
80
364
    char *response = get_null_terminated(250, &data, &size);
81
364
    creds = flb_parse_http_credentials(response, 250, &expiration);
82
364
    if (creds != NULL) {
83
3
        flb_aws_credentials_destroy(creds);
84
3
    }
85
364
    flb_free(response);
86
364
}
87
88
89
364
void fuzz_process(const uint8_t *data, size_t size) {
90
364
    char** tokens = NULL;
91
364
    char *input = get_null_terminated(250, &data, &size);
92
364
    tokens = parse_credential_process(input);
93
364
    if (tokens != NULL) {
94
98
        flb_free(tokens);
95
98
    }
96
364
    flb_free(input);
97
364
}
98
99
100
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
101
517
{
102
    /* Set flb_malloc_mod to be fuzzer-data dependent */
103
517
    if (size < 304) {
104
17
        return 0;
105
17
    }
106
500
    flb_malloc_p = 0;
107
500
    flb_malloc_mod = *(int*)data;
108
500
    data += 4;
109
500
    size -= 4;
110
111
    /* Avoid division by zero for modulo operations */
112
500
    if (flb_malloc_mod == 0) {
113
2
        flb_malloc_mod = 1;
114
2
    }
115
500
    if (initialization_crutch() == -1) {
116
136
        return 0;
117
136
    }
118
119
364
    const uint8_t *data_copy = data;
120
364
    size_t size_copy = size;
121
364
    fuzz_sts(data_copy, size_copy);
122
123
364
    data_copy = data;
124
364
    size_copy = size;
125
364
    fuzz_http(data_copy, size_copy);
126
127
364
    data_copy = data;
128
364
    size_copy = size;
129
364
    fuzz_process(data_copy, size_copy);
130
131
364
    return 0;
132
500
}