/src/fluent-bit/tests/internal/fuzzers/config_map_fuzzer.c

Source
/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
#include <fluent-bit/flb_info.h>
#include <fluent-bit/flb_kv.h>
#include <fluent-bit/flb_slist.h>
#include <fluent-bit/flb_mem.h>
#include <fluent-bit/flb_config.h>
#include <fluent-bit/flb_config_map.h>

#include "flb_fuzz_header.h"

struct context {
    /* Single values */
    int num_int;
    size_t size;
    time_t time;
    int boolean;
    double num_double;
    flb_sds_t string;
    struct mk_list *list1;
    struct mk_list *list2;

    /* Multiple entries */
    struct mk_list *mult_num_int;
    struct mk_list *mult_boolean;
    struct mk_list *mult_num_double;
    struct mk_list *mult_string;
    struct mk_list *mult_list1;
    struct mk_list *mult_list2;
};

struct flb_config_map config_map[] = {
    {
     FLB_CONFIG_MAP_BOOL,
     "boolean",
     "true",
     0, FLB_TRUE, offsetof(struct context, boolean),
     NULL
    },
    {
     FLB_CONFIG_MAP_INT,
     "num_int",
     "123",
     0, FLB_TRUE, offsetof(struct context, num_int),
     NULL
    },
    {
     FLB_CONFIG_MAP_DOUBLE,
     "num_double", "0.12345",
     0, FLB_TRUE, offsetof(struct context, num_double),
     NULL
    },
    {
     FLB_CONFIG_MAP_STR,
     "string",
     "test",
     0, FLB_TRUE, offsetof(struct context, string),
     NULL
    },

    /* SIZE */
    {
     FLB_CONFIG_MAP_SIZE,
     "test_size",
     "2M",
     0, FLB_TRUE, offsetof(struct context, size),
     NULL
    },

    /* TIME */
    {
     FLB_CONFIG_MAP_TIME,
     "test_time",
     "2H",
     0, FLB_TRUE, offsetof(struct context, time),
     NULL
    },

    /* CSLIST */
    {
     FLB_CONFIG_MAP_CLIST,
     "test_clist",
     "a,  b, c      ,d,e   ,    f,   g,h,i,jk   , lm  , n  o,pqr,,   , ,stuv,xyz",
     0, FLB_TRUE, offsetof(struct context, list1),
     NULL
    },

    /* SLIST */
    {
     FLB_CONFIG_MAP_SLIST_4,
     "test_slist",
     "a  b c      de       f   ghi jk l m n  o pqr   stuv xyz",
     0, FLB_TRUE, offsetof(struct context, list2),
     NULL
    },

     /* EOF */
    {0}
};

struct flb_config_map config_map_mult[] = {
    {
     FLB_CONFIG_MAP_BOOL,
     "no_mult",
     "true",
     0, FLB_TRUE, 1,
     NULL
     },
    {
     FLB_CONFIG_MAP_BOOL,
     "mult_boolean",
     NULL,
     FLB_CONFIG_MAP_MULT, FLB_TRUE, offsetof(struct context, mult_boolean),
     NULL
    },
    {
     FLB_CONFIG_MAP_INT,
     "mult_num_int",
     "123",
     FLB_CONFIG_MAP_MULT, FLB_TRUE, offsetof(struct context, mult_num_int),
     NULL
    },
    {
     FLB_CONFIG_MAP_DOUBLE,
     "mult_num_double", "0.12345",
     FLB_CONFIG_MAP_MULT, FLB_TRUE, offsetof(struct context, mult_num_double),
     NULL
    },
    {
     FLB_CONFIG_MAP_STR,
     "mult_string",
     "test",
     FLB_CONFIG_MAP_MULT, FLB_TRUE, offsetof(struct context, mult_string),
     NULL
    },
    {
     FLB_CONFIG_MAP_CLIST,
     "mult_clist",
     "a,  b, c      ,d,e   ,    f,   g,h,i,jk   , lm  , n  o,pqr,,   , ,stuv,xyz",
     FLB_CONFIG_MAP_MULT, FLB_TRUE, offsetof(struct context, mult_list1),
     NULL
    },
    {
     FLB_CONFIG_MAP_SLIST_4,
     "mult_slist",
     "a  b c      de       f   ghi jk l m n  o pqr   stuv xyz",
     FLB_CONFIG_MAP_MULT, FLB_TRUE, offsetof(struct context, mult_list2),
     NULL
    },

     /* EOF */
    {0}
};

struct flb_config_map *configs[] = {config_map_mult, config_map};

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
    /* Set flb_malloc_mod to be fuzzer-data dependent */
    if (size < 4) {
        return 0;
    }
    flb_malloc_p = 0;
    flb_malloc_mod = *(int*)data;
    data += 4;
    size -= 4;

    /* Avoid division by zero for modulo operations */
    if (flb_malloc_mod == 0) {
        flb_malloc_mod = 1;
    }

    if (size < 40) {
        return 0;
    }

    struct mk_list *map = NULL;
    struct flb_config *config = NULL;
    struct context ctx;
    bzero(&ctx, sizeof(struct context));
    struct mk_list prop;
    bzero(&prop, sizeof(struct mk_list));

    char *fuzz_str1 = get_null_terminated(15, &data, &size);
    char *fuzz_str2 = get_null_terminated(15, &data, &size);
    char *fuzz_str3 = get_null_terminated(size, &data, &size);

    for (int i = 0; i < 2; i++) {
        config = flb_config_init();
        if (config) {
            memset(&ctx, '\0', sizeof(struct context));

            flb_kv_init(&prop);
            if (flb_kv_item_create(&prop, fuzz_str1, fuzz_str2) != NULL) {
                /* Assign one of the config maps */
                map = flb_config_map_create(config, configs[i]);
                if (map) {
                    if (flb_config_map_set(&prop, map, &ctx) != -1) {
                        flb_config_map_properties_check(fuzz_str3, &prop, map);
                    }
                    flb_config_map_destroy(map);
                }
            }
            flb_kv_release(&prop);
            flb_config_exit(config);
        }
    }

    flb_free(fuzz_str1);
    flb_free(fuzz_str2);
    flb_free(fuzz_str3);
    return 0;
}

Coverage Report

Created: 2025-07-04 07:08

Line	Count	Source
1		/* -- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -- */
2		#include <fluent-bit/flb_info.h>
3		#include <fluent-bit/flb_kv.h>
4		#include <fluent-bit/flb_slist.h>
5		#include <fluent-bit/flb_mem.h>
6		#include <fluent-bit/flb_config.h>
7		#include <fluent-bit/flb_config_map.h>
8
9		#include "flb_fuzz_header.h"
10
11		struct context {
12		/* Single values */
13		int num_int;
14		size_t size;
15		time_t time;
16		int boolean;
17		double num_double;
18		flb_sds_t string;
19		struct mk_list *list1;
20		struct mk_list *list2;
21
22		/* Multiple entries */
23		struct mk_list *mult_num_int;
24		struct mk_list *mult_boolean;
25		struct mk_list *mult_num_double;
26		struct mk_list *mult_string;
27		struct mk_list *mult_list1;
28		struct mk_list *mult_list2;
29		};
30
31		struct flb_config_map config_map[] = {
32		{
33		FLB_CONFIG_MAP_BOOL,
34		"boolean",
35		"true",
36		0, FLB_TRUE, offsetof(struct context, boolean),
37		NULL
38		},
39		{
40		FLB_CONFIG_MAP_INT,
41		"num_int",
42		"123",
43		0, FLB_TRUE, offsetof(struct context, num_int),
44		NULL
45		},
46		{
47		FLB_CONFIG_MAP_DOUBLE,
48		"num_double", "0.12345",
49		0, FLB_TRUE, offsetof(struct context, num_double),
50		NULL
51		},
52		{
53		FLB_CONFIG_MAP_STR,
54		"string",
55		"test",
56		0, FLB_TRUE, offsetof(struct context, string),
57		NULL
58		},
59
60		/* SIZE */
61		{
62		FLB_CONFIG_MAP_SIZE,
63		"test_size",
64		"2M",
65		0, FLB_TRUE, offsetof(struct context, size),
66		NULL
67		},
68
69		/* TIME */
70		{
71		FLB_CONFIG_MAP_TIME,
72		"test_time",
73		"2H",
74		0, FLB_TRUE, offsetof(struct context, time),
75		NULL
76		},
77
78		/* CSLIST */
79		{
80		FLB_CONFIG_MAP_CLIST,
81		"test_clist",
82		"a, b, c ,d,e , f, g,h,i,jk , lm , n o,pqr,, , ,stuv,xyz",
83		0, FLB_TRUE, offsetof(struct context, list1),
84		NULL
85		},
86
87		/* SLIST */
88		{
89		FLB_CONFIG_MAP_SLIST_4,
90		"test_slist",
91		"a b c de f ghi jk l m n o pqr stuv xyz",
92		0, FLB_TRUE, offsetof(struct context, list2),
93		NULL
94		},
95
96		/* EOF */
97		{0}
98		};
99
100		struct flb_config_map config_map_mult[] = {
101		{
102		FLB_CONFIG_MAP_BOOL,
103		"no_mult",
104		"true",
105		0, FLB_TRUE, 1,
106		NULL
107		},
108		{
109		FLB_CONFIG_MAP_BOOL,
110		"mult_boolean",
111		NULL,
112		FLB_CONFIG_MAP_MULT, FLB_TRUE, offsetof(struct context, mult_boolean),
113		NULL
114		},
115		{
116		FLB_CONFIG_MAP_INT,
117		"mult_num_int",
118		"123",
119		FLB_CONFIG_MAP_MULT, FLB_TRUE, offsetof(struct context, mult_num_int),
120		NULL
121		},
122		{
123		FLB_CONFIG_MAP_DOUBLE,
124		"mult_num_double", "0.12345",
125		FLB_CONFIG_MAP_MULT, FLB_TRUE, offsetof(struct context, mult_num_double),
126		NULL
127		},
128		{
129		FLB_CONFIG_MAP_STR,
130		"mult_string",
131		"test",
132		FLB_CONFIG_MAP_MULT, FLB_TRUE, offsetof(struct context, mult_string),
133		NULL
134		},
135		{
136		FLB_CONFIG_MAP_CLIST,
137		"mult_clist",
138		"a, b, c ,d,e , f, g,h,i,jk , lm , n o,pqr,, , ,stuv,xyz",
139		FLB_CONFIG_MAP_MULT, FLB_TRUE, offsetof(struct context, mult_list1),
140		NULL
141		},
142		{
143		FLB_CONFIG_MAP_SLIST_4,
144		"mult_slist",
145		"a b c de f ghi jk l m n o pqr stuv xyz",
146		FLB_CONFIG_MAP_MULT, FLB_TRUE, offsetof(struct context, mult_list2),
147		NULL
148		},
149
150		/* EOF */
151		{0}
152		};
153
154		struct flb_config_map *configs[] = {config_map_mult, config_map};
155
156		int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
157	899	{
158		/* Set flb_malloc_mod to be fuzzer-data dependent */
159	899	if (size < 4) {
160	2	return 0;
161	2	}
162	897	flb_malloc_p = 0;
163	897	flb_malloc_mod = (int)data;
164	897	data += 4;
165	897	size -= 4;
166
167		/* Avoid division by zero for modulo operations */
168	897	if (flb_malloc_mod == 0) {
169	3	flb_malloc_mod = 1;
170	3	}
171
172	897	if (size < 40) {
173	65	return 0;
174	65	}
175
176	832	struct mk_list *map = NULL;
177	832	struct flb_config *config = NULL;
178	832	struct context ctx;
179	832	bzero(&ctx, sizeof(struct context));
180	832	struct mk_list prop;
181	832	bzero(&prop, sizeof(struct mk_list));
182
183	832	char *fuzz_str1 = get_null_terminated(15, &data, &size);
184	832	char *fuzz_str2 = get_null_terminated(15, &data, &size);
185	832	char *fuzz_str3 = get_null_terminated(size, &data, &size);
186
187	2.49k	for (int i = 0; i < 2; i++) {
188	1.66k	config = flb_config_init();
189	1.66k	if (config) {
190	1.27k	memset(&ctx, '\0', sizeof(struct context));
191
192	1.27k	flb_kv_init(&prop);
193	1.27k	if (flb_kv_item_create(&prop, fuzz_str1, fuzz_str2) != NULL) {
194		/* Assign one of the config maps */
195	1.26k	map = flb_config_map_create(config, configs[i]);
196	1.26k	if (map) {
197	1.20k	if (flb_config_map_set(&prop, map, &ctx) != -1) {
198	1.03k	flb_config_map_properties_check(fuzz_str3, &prop, map);
199	1.03k	}
200	1.20k	flb_config_map_destroy(map);
201	1.20k	}
202	1.26k	}
203	1.27k	flb_kv_release(&prop);
204	1.27k	flb_config_exit(config);
205	1.27k	}
206	1.66k	}
207
208	832	flb_free(fuzz_str1);
209	832	flb_free(fuzz_str2);
210	832	flb_free(fuzz_str3);
211	832	return 0;
212	897	}