Coverage Report

Created: 2024-09-19 07:08

/src/fluent-bit/tests/internal/fuzzers/utils_fuzzer.c
Line
Count
Source
1
/*  Fluent Bit
2
 *  ==========
3
 *  Copyright (C) 2019-2021 The Fluent Bit Authors
4
 *  Copyright (C) 2015-2018 Treasure Data Inc.
5
 *
6
 *  Licensed under the Apache License, Version 2.0 (the "License");
7
 *  you may not use this file except in compliance with the License.
8
 *  You may obtain a copy of the License at
9
 *
10
 *      http://www.apache.org/licenses/LICENSE-2.0
11
 *
12
 *  Unless required by applicable law or agreed to in writing, software
13
 *  distributed under the License is distributed on an "AS IS" BASIS,
14
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15
 *  See the License for the specific language governing permissions and
16
 *  limitations under the License.
17
 */
18
19
#include <stdint.h>
20
#include <string.h>
21
#include <stdlib.h>
22
#include <msgpack.h>
23
#include <fluent-bit/flb_mem.h>
24
#include <fluent-bit/flb_utils.h>
25
#include <fluent-bit/flb_slist.h>
26
#include <fluent-bit/flb_gzip.h>
27
#include <fluent-bit/flb_hash_table.h>
28
#include <fluent-bit/flb_uri.h>
29
#include <fluent-bit/flb_hash.h>
30
#include <fluent-bit/flb_regex.h>
31
#include "flb_fuzz_header.h"
32
33
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
34
1.91k
{
35
1.91k
    TIMEOUT_GUARD
36
37
1.89k
    if (size < 750) {
38
42
        return 0;
39
42
    }
40
41
    /* Set fuzzer-malloc chance of failure */
42
1.85k
    flb_malloc_mod = 25000;
43
1.85k
    flb_malloc_p = 0;
44
45
1.85k
    uint64_t ran_hash = *(uint64_t *)data;
46
1.85k
    char *null_terminated1 = get_null_terminated(25, &data, &size);
47
1.85k
    char *null_terminated2 = get_null_terminated(25, &data, &size);
48
1.85k
    char *null_terminated3 = get_null_terminated(25, &data, &size);
49
50
    /* Prepare a general null-terminated string */
51
1.85k
    char *null_terminated = (char*)malloc(size+1);
52
1.85k
    null_terminated[size] = '\0';
53
1.85k
    memcpy(null_terminated, data, size);
54
55
    /* Fuzzing of flb_utils.c */
56
1.85k
    int sec;
57
1.85k
    long nsec;
58
1.85k
    size_t new_size;
59
1.85k
    char *prot    = NULL;
60
1.85k
    char *host    = NULL;
61
1.85k
    char *port    = NULL;
62
1.85k
    char *uri     = NULL;
63
1.85k
    char *new_dst = NULL;
64
65
1.85k
    if (flb_utils_write_str_buf(null_terminated, size, &new_dst, &new_size) == 0) {
66
1.85k
        flb_free(new_dst);
67
1.85k
    }
68
69
1.85k
    struct mk_list *list = flb_utils_split(null_terminated, 'A', 3);
70
1.85k
    if (list != NULL) {
71
1.85k
        flb_utils_split_free(list);
72
1.85k
    }
73
1.85k
    struct mk_list *list2 = flb_utils_split_quoted(null_terminated, 'A', 3);
74
1.85k
    if (list2 != NULL) {
75
1.77k
        flb_utils_split_free(list2);
76
1.77k
    }
77
78
1.85k
    if (flb_utils_url_split(null_terminated, &prot, &host, &port, &uri) == 0) {
79
413
        flb_free(prot);
80
413
        flb_free(port);
81
413
        flb_free(host);
82
413
        flb_free(uri);
83
413
    }
84
85
1.85k
    char *split_protocol = NULL;
86
1.85k
    char *split_username = NULL;
87
1.85k
    char *split_password = NULL;
88
1.85k
    char *split_host     = NULL;
89
1.85k
    char *split_port     = NULL;
90
1.85k
    if (flb_utils_proxy_url_split(null_terminated, &split_protocol,
91
1.85k
            &split_username, &split_password, &split_host, &split_port) == 0) {
92
62
        if (split_protocol) {
93
62
            flb_free(split_protocol);
94
62
        }
95
62
        if (split_username) {
96
30
            flb_free(split_username);
97
30
        }
98
62
        if (split_password) {
99
8
            flb_free(split_password);
100
8
        }
101
62
        if (split_host) {
102
36
            flb_free(split_host);
103
36
        }
104
62
        if (split_port) {
105
62
            flb_free(split_port);
106
62
        }
107
62
    }
108
109
110
1.85k
    flb_utils_size_to_bytes(null_terminated);
111
1.85k
    flb_utils_time_split(null_terminated, &sec, &nsec);
112
1.85k
    flb_utils_time_to_seconds(null_terminated);
113
1.85k
    flb_utils_bool(null_terminated);
114
1.85k
    flb_utils_hex2int(null_terminated, size);
115
116
    /* Fuzzong of flb_uri.c */
117
1.85k
    struct flb_uri *uri2 = NULL;
118
1.85k
    uri2 = flb_uri_create(null_terminated);
119
1.85k
    if (uri2 != NULL) {
120
1.85k
        flb_uri_get(uri2, (int)data[0]);
121
1.85k
        flb_uri_dump(uri2);
122
1.85k
        flb_uri_destroy(uri2);
123
1.85k
    }
124
1.85k
    flb_sds_t encoded = flb_uri_encode((char*)data, size);
125
1.85k
    if (encoded != NULL) {
126
1.85k
        flb_sds_destroy(encoded);
127
1.85k
    }
128
129
    /* Fuzzing of flb_hash.c */
130
1.85k
    struct flb_hash_table *ht = NULL;
131
1.85k
    ht = flb_hash_table_create((int)(data[2] % 0x04),
132
1.85k
                               (size_t)data[0],
133
1.85k
                               (int)data[1]);
134
1.85k
    if (ht != NULL) {
135
1.80k
        flb_hash_table_add(ht, null_terminated, size, null_terminated, size);
136
137
1.80k
        char *out_buf = NULL;
138
1.80k
        size_t out_size;
139
1.80k
        flb_hash_table_get(ht, null_terminated, size, (void **)&out_buf, &out_size);
140
141
        /* now let's create some more instances */
142
1.80k
        char *instances1[128] = { NULL };
143
1.80k
        char *instances2[128] = { NULL };
144
232k
        for (int i = 0; i < 128; i++) {
145
230k
            char *in1 = malloc(3);
146
230k
            char *in2 = malloc(3);
147
230k
            memcpy(in1, data+(i*4), 2);
148
230k
            memcpy(in2, data+(i*4)+2, 2);
149
230k
            in1[2] = '\0';
150
230k
            in2[2] = '\0';
151
230k
            flb_hash_table_add(ht, in1, 2, in2, 2);
152
230k
            instances1[i] = in1;
153
230k
            instances2[i] = in2;
154
230k
        }
155
156
37.8k
        for(int i = 0; i < 20; i++) {
157
36.0k
            char *hash_out_buf;
158
36.0k
            size_t hash_out_size;
159
36.0k
            flb_hash_table_get_by_id(ht, (int)data[i], null_terminated,
160
36.0k
                                    (const char **)&hash_out_buf, &hash_out_size);
161
36.0k
        }
162
163
1.80k
        flb_hash_table_del(ht, null_terminated1);
164
1.80k
        flb_hash_table_exists(ht, ran_hash);
165
1.80k
        flb_hash_table_del_ptr(ht, null_terminated2, strlen(null_terminated2), NULL);
166
1.80k
        flb_hash_table_get_ptr(ht, null_terminated3, strlen(null_terminated3));
167
168
1.80k
        flb_hash_table_destroy(ht);
169
232k
        for (int i =0; i<128; i++) {
170
230k
            flb_free(instances1[i]);
171
230k
            flb_free(instances2[i]);
172
230k
        }
173
1.80k
    }
174
175
    /* sds */
176
1.85k
    flb_sds_t fs = flb_sds_create_len((const char*)data, size);
177
1.85k
    if (fs != NULL) {
178
1.85k
        fs = flb_sds_cat_esc(fs, "AAABBBCCC", 9, "ABC", 3);
179
1.85k
        if (fs != NULL) {
180
1.85k
            flb_sds_destroy(fs);
181
1.85k
        }
182
1.85k
    }
183
184
    /* Fuzzing of flb_gzip.c */
185
1.85k
    void *str = NULL;
186
1.85k
    size_t len;
187
1.85k
    void *out_data = NULL;
188
1.85k
    size_t out_len;
189
1.85k
    if (flb_gzip_compress((char*)data, size, &str, &len) != -1) {
190
1.85k
        flb_gzip_uncompress(str, len, &out_data, &out_len);
191
1.85k
    }
192
1.85k
    if (str != NULL) {
193
1.85k
        free(str);
194
1.85k
    }
195
1.85k
    if (out_data != NULL) {
196
1.85k
        free(out_data);
197
1.85k
    }
198
1.85k
    void *out_data2 = NULL;
199
1.85k
    size_t out2_len;
200
1.85k
    int uncompress_ret = flb_gzip_uncompress((char*)data, size, &out_data2, &out2_len);
201
1.85k
    if (uncompress_ret != -1 && out_data2 != NULL) {
202
1
        flb_free(out_data2);
203
1
    }
204
205
    /* Fuzzing the sha routines */
206
1.85k
    struct flb_hash sha512;
207
1.85k
    uint8_t buf[64];
208
209
1.85k
    flb_hash_init(&sha512, FLB_HASH_SHA512);
210
1.85k
    flb_hash_update(&sha512, (unsigned char *) null_terminated, 32);
211
1.85k
    flb_hash_update(&sha512, (unsigned char *) null_terminated+32, 32);
212
1.85k
    flb_hash_update(&sha512, (unsigned char *) null_terminated+64, 32);
213
1.85k
    flb_hash_finalize(&sha512, buf, sizeof(buf));
214
1.85k
    flb_hash_cleanup(&sha512);
215
216
    /* regex */
217
1.85k
    char *pregex = "^(?<INT>[^ ]+) (?<FLOAT>[^ ]+) (?<BOOL>[^ ]+) (?<STRING>.+)$";
218
1.85k
    flb_regex_init();
219
1.85k
    struct flb_regex *freg = flb_regex_create(pregex);
220
1.85k
    if (freg != NULL) {
221
1.85k
        flb_regex_match(freg, (unsigned char*)null_terminated, size);
222
1.85k
        flb_regex_destroy(freg);
223
1.85k
    }
224
1.85k
    flb_regex_exit();
225
226
    /* slist */
227
1.85k
    struct mk_list list3;
228
1.85k
    flb_slist_create(&list3);
229
1.85k
    flb_sds_t slist_str = flb_sds_create_len((const char*)data, size);
230
1.85k
    flb_slist_add_sds(&list3, slist_str);
231
1.85k
    flb_slist_entry_get(&list3, 100);
232
1.85k
    flb_slist_dump(&list3);
233
1.85k
    flb_slist_destroy(&list3);
234
235
236
    /* General cleanup */
237
1.85k
    flb_free(null_terminated);
238
1.85k
    flb_free(null_terminated1);
239
1.85k
    flb_free(null_terminated2);
240
1.85k
    flb_free(null_terminated3);
241
1.85k
    return 0;
242
1.89k
}