Coverage Report

Created: 2025-06-24 08:09

/src/fluent-bit/tests/internal/fuzzers/signv4_fuzzer.c
Line
Count
Source
1
#include <fluent-bit/flb_info.h>
2
#include <fluent-bit/flb_mem.h>
3
#include <fluent-bit/flb_http_client.h>
4
#include <fluent-bit/flb_upstream.h>
5
#include <fluent-bit/flb_signv4.h>
6
#include <fluent-bit/flb_aws_credentials.h>
7
#include <monkey/mk_core.h>
8
#include <unistd.h>
9
#include <fluent-bit/flb_sds.h>
10
#include "flb_fuzz_header.h"
11
12
384
#define AWS_ACCESS_KEY_ID              "AWS_ACCESS_KEY_ID"
13
384
#define AWS_SECRET_ACCESS_KEY          "AWS_SECRET_ACCESS_KEY"
14
#define AWS_SESSION_TOKEN              "AWS_SESSION_TOKEN"
15
16
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
17
555
{
18
555
    if (size < 59) {
19
19
        return 0;
20
19
    }
21
22
    /* Set flb_malloc_mod to be fuzzer-data dependent */
23
536
    flb_malloc_p = 0;
24
536
    flb_malloc_mod = *(int*)data;
25
536
    data += 4;
26
536
    size -= 4;
27
28
    /* Avoid division by zero for modulo operations */
29
536
    if (flb_malloc_mod == 0) {
30
2
        flb_malloc_mod = 1;
31
2
    }
32
33
536
    char s3_mode = data[0];
34
536
    MOVE_INPUT(1)
35
536
    int method = (int)data[0];
36
37
    /* Prepare a general null-terminated string */
38
536
    char *uri             = get_null_terminated(50, &data, &size);
39
536
    char *null_terminated = get_null_terminated(size, &data, &size);
40
41
    /* Now begin the core work of the fuzzer */
42
536
    struct flb_config *config;
43
536
    struct mk_list *tests;
44
536
    struct flb_aws_provider *provider;
45
536
    config = flb_calloc(1, sizeof(struct flb_config));
46
536
    if (!config) {
47
2
        flb_free(uri);
48
2
        flb_free(null_terminated);
49
2
        return 0;
50
2
    }
51
534
    mk_list_init(&config->upstreams);
52
534
    provider = flb_aws_env_provider_create();
53
54
    /* Create the necessary http context */
55
534
    struct flb_upstream *http_u;
56
534
    struct flb_connection *http_u_conn = NULL;
57
534
    struct flb_http_client *http_c;
58
534
    struct flb_config *http_config;
59
60
534
    http_config = flb_config_init();
61
534
    if (http_config == NULL) {
62
144
        flb_aws_provider_destroy(provider);
63
144
        flb_free(uri);
64
144
        flb_free(null_terminated);
65
144
        flb_free(config);
66
144
        return 0;
67
144
    }
68
69
390
    http_u = flb_upstream_create(http_config, "127.0.0.1", 8001, 0, NULL);
70
390
    if (http_u != NULL) {
71
388
        http_u_conn = flb_calloc(1, sizeof(struct flb_connection));
72
388
        if (http_u_conn != NULL) {
73
387
            http_u_conn->upstream = http_u;
74
75
387
            http_c = flb_http_client(http_u_conn, method, uri,
76
387
                         null_terminated, size, "127.0.0.1", 8001, NULL, 0);
77
387
            if (http_c) {
78
                /* Call into the main target flb_signv4_do*/
79
384
                time_t t = 1440938160;
80
384
                char *region = "us-east-1";
81
384
                char *access_key = "AKIDEXAMPLE";
82
384
                char *service = "service";
83
384
                char *secret_key = "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY";
84
384
                int ret = setenv(AWS_ACCESS_KEY_ID, access_key, 1);
85
384
                if (ret >= 0) {
86
384
                    ret = setenv(AWS_SECRET_ACCESS_KEY, secret_key, 1);
87
384
                    if (ret >= 0) {
88
384
                        flb_sds_t signature = flb_signv4_do(http_c, FLB_TRUE, FLB_FALSE,
89
384
                                    t, region, service, s3_mode, NULL, provider);
90
384
                        if (signature) {
91
298
                          flb_sds_destroy(signature);
92
298
                        }
93
384
                    }
94
384
                }
95
384
                flb_http_client_destroy(http_c);
96
384
            }
97
387
        }
98
388
        flb_upstream_destroy(http_u);
99
388
    }
100
101
    /* Cleanup */
102
390
    flb_config_exit(http_config);
103
390
    flb_aws_provider_destroy(provider);
104
390
    flb_free(config);
105
106
390
    flb_free(null_terminated);
107
390
    flb_free(http_u_conn);
108
390
    flb_free(uri);
109
110
390
    return 0;
111
534
}