Coverage Report

Created: 2026-05-16 07:29

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/fluent-bit/tests/internal/fuzzers/http_fuzzer.c
Line
Count
Source
1
#include <stdlib.h>
2
#include <fluent-bit/flb_time.h>
3
#include <fluent-bit/flb_parser.h>
4
#include <fluent-bit/flb_info.h>
5
#include <fluent-bit/flb_mem.h>
6
#include <fluent-bit/flb_error.h>
7
#include <fluent-bit/flb_socket.h>
8
#include <fluent-bit/flb_stream.h>
9
#include <fluent-bit/flb_connection.h>
10
#include <fluent-bit/flb_http_client.h>
11
12
#include "flb_fuzz_header.h"
13
14
extern int fuzz_process_data(struct flb_http_client *c);
15
extern int fuzz_check_connection(struct flb_http_client *c);
16
17
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
18
609
{
19
    /* Set fuzzer-malloc chance of failure */
20
609
    flb_malloc_p = 0;
21
609
    flb_malloc_mod = 25000;
22
23
609
    struct flb_upstream *u;
24
609
    struct flb_connection *u_conn = NULL;
25
609
    struct flb_http_client *c;
26
609
    struct flb_config *config;
27
609
    char *uri = NULL;
28
29
609
    if (size < 160) {
30
17
        return 0;
31
17
    }
32
33
592
    config = flb_config_init();
34
592
    if (config == NULL) {
35
0
        return 0;
36
0
    }
37
38
592
    u = flb_upstream_create(config, "127.0.0.1", 8001, 0, NULL);
39
40
592
    u_conn = flb_connection_create(-1,
41
592
                                   FLB_TRANSPORT_TCP,
42
592
                                   (void *) u,
43
592
                                   NULL,
44
592
                                   NULL);
45
46
592
    if (u_conn == NULL) {
47
0
        return 0;
48
0
    }
49
50
592
    char *proxy = NULL;
51
592
    if (GET_MOD_EQ(2,1)) {
52
11
        proxy = get_null_terminated(50, &data, &size);
53
11
    }
54
55
592
    uri = get_null_terminated(20, &data, &size);
56
57
592
    int method = (int)data[0];
58
592
    c = flb_http_client(u_conn, method, uri, NULL, 0,
59
592
                    "127.0.0.1", 8001, proxy, 0);
60
592
    if (c != NULL) {
61
581
        char *null_terminated = get_null_terminated(30, &data, &size);
62
63
        /* Perform a set of operations on the http_client */
64
581
        flb_http_basic_auth(c, null_terminated, null_terminated);
65
581
        flb_http_set_content_encoding_gzip(c);
66
581
        flb_http_set_keepalive(c);
67
581
        flb_http_strip_port_from_host(c);
68
581
        flb_http_allow_duplicated_headers(c, 0);
69
70
581
        flb_http_buffer_size(c, (*(size_t *)data) & 0xfff);
71
581
        MOVE_INPUT(4)
72
581
        flb_http_add_header(c, "User-Agent", 10, "Fluent-Bit", 10);
73
581
        flb_http_add_header(c, (char*)data, size, "Fluent-Bit", 10);
74
581
        flb_http_buffer_size(c, (int)data[0]);
75
581
        MOVE_INPUT(1)
76
581
        flb_http_buffer_available(c);
77
78
581
        size_t b_sent;
79
581
        flb_http_do(c, &b_sent);
80
81
581
        size_t out_size = 0;
82
581
        flb_http_buffer_increase(c, (*(size_t *)data) & 0xfff, &out_size);
83
581
        MOVE_INPUT(4)
84
85
        /* Now we need to simulate the reading of data */
86
581
        c->resp.status = 200;
87
88
581
        if (c->resp.data != NULL) {
89
581
           flb_free(c->resp.data);
90
581
        }
91
92
581
        char *new_nulltm = get_null_terminated(30, &data, &size);
93
581
        c->resp.data_len = 30;
94
581
        c->resp.data = new_nulltm;
95
581
        fuzz_process_data(c);
96
581
        fuzz_check_connection(c);
97
98
581
        flb_http_client_destroy(c);
99
581
        flb_free(null_terminated);
100
581
    }
101
102
    /* Now try the http_client_proxy_connect function. */
103
592
    flb_http_client_proxy_connect(u_conn);
104
105
592
    flb_connection_destroy(u_conn);
106
592
    flb_upstream_destroy(u);
107
592
    flb_config_exit(config);
108
592
    if (uri != NULL) {
109
592
        flb_free(uri);
110
592
    }
111
592
    if (proxy != NULL) {
112
11
        flb_free(proxy);
113
11
    }
114
115
592
    return 0;
116
592
}