/src/fluent-bit/tests/internal/fuzzers/http_fuzzer.c
Line | Count | Source |
1 | | #include <stdlib.h> |
2 | | #include <fluent-bit/flb_time.h> |
3 | | #include <fluent-bit/flb_parser.h> |
4 | | #include <fluent-bit/flb_info.h> |
5 | | #include <fluent-bit/flb_mem.h> |
6 | | #include <fluent-bit/flb_error.h> |
7 | | #include <fluent-bit/flb_socket.h> |
8 | | #include <fluent-bit/flb_stream.h> |
9 | | #include <fluent-bit/flb_connection.h> |
10 | | #include <fluent-bit/flb_http_client.h> |
11 | | |
12 | | #include "flb_fuzz_header.h" |
13 | | |
14 | | extern int fuzz_process_data(struct flb_http_client *c); |
15 | | extern int fuzz_check_connection(struct flb_http_client *c); |
16 | | |
17 | | int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) |
18 | 609 | { |
19 | | /* Set fuzzer-malloc chance of failure */ |
20 | 609 | flb_malloc_p = 0; |
21 | 609 | flb_malloc_mod = 25000; |
22 | | |
23 | 609 | struct flb_upstream *u; |
24 | 609 | struct flb_connection *u_conn = NULL; |
25 | 609 | struct flb_http_client *c; |
26 | 609 | struct flb_config *config; |
27 | 609 | char *uri = NULL; |
28 | | |
29 | 609 | if (size < 160) { |
30 | 17 | return 0; |
31 | 17 | } |
32 | | |
33 | 592 | config = flb_config_init(); |
34 | 592 | if (config == NULL) { |
35 | 0 | return 0; |
36 | 0 | } |
37 | | |
38 | 592 | u = flb_upstream_create(config, "127.0.0.1", 8001, 0, NULL); |
39 | | |
40 | 592 | u_conn = flb_connection_create(-1, |
41 | 592 | FLB_TRANSPORT_TCP, |
42 | 592 | (void *) u, |
43 | 592 | NULL, |
44 | 592 | NULL); |
45 | | |
46 | 592 | if (u_conn == NULL) { |
47 | 0 | return 0; |
48 | 0 | } |
49 | | |
50 | 592 | char *proxy = NULL; |
51 | 592 | if (GET_MOD_EQ(2,1)) { |
52 | 11 | proxy = get_null_terminated(50, &data, &size); |
53 | 11 | } |
54 | | |
55 | 592 | uri = get_null_terminated(20, &data, &size); |
56 | | |
57 | 592 | int method = (int)data[0]; |
58 | 592 | c = flb_http_client(u_conn, method, uri, NULL, 0, |
59 | 592 | "127.0.0.1", 8001, proxy, 0); |
60 | 592 | if (c != NULL) { |
61 | 581 | char *null_terminated = get_null_terminated(30, &data, &size); |
62 | | |
63 | | /* Perform a set of operations on the http_client */ |
64 | 581 | flb_http_basic_auth(c, null_terminated, null_terminated); |
65 | 581 | flb_http_set_content_encoding_gzip(c); |
66 | 581 | flb_http_set_keepalive(c); |
67 | 581 | flb_http_strip_port_from_host(c); |
68 | 581 | flb_http_allow_duplicated_headers(c, 0); |
69 | | |
70 | 581 | flb_http_buffer_size(c, (*(size_t *)data) & 0xfff); |
71 | 581 | MOVE_INPUT(4) |
72 | 581 | flb_http_add_header(c, "User-Agent", 10, "Fluent-Bit", 10); |
73 | 581 | flb_http_add_header(c, (char*)data, size, "Fluent-Bit", 10); |
74 | 581 | flb_http_buffer_size(c, (int)data[0]); |
75 | 581 | MOVE_INPUT(1) |
76 | 581 | flb_http_buffer_available(c); |
77 | | |
78 | 581 | size_t b_sent; |
79 | 581 | flb_http_do(c, &b_sent); |
80 | | |
81 | 581 | size_t out_size = 0; |
82 | 581 | flb_http_buffer_increase(c, (*(size_t *)data) & 0xfff, &out_size); |
83 | 581 | MOVE_INPUT(4) |
84 | | |
85 | | /* Now we need to simulate the reading of data */ |
86 | 581 | c->resp.status = 200; |
87 | | |
88 | 581 | if (c->resp.data != NULL) { |
89 | 581 | flb_free(c->resp.data); |
90 | 581 | } |
91 | | |
92 | 581 | char *new_nulltm = get_null_terminated(30, &data, &size); |
93 | 581 | c->resp.data_len = 30; |
94 | 581 | c->resp.data = new_nulltm; |
95 | 581 | fuzz_process_data(c); |
96 | 581 | fuzz_check_connection(c); |
97 | | |
98 | 581 | flb_http_client_destroy(c); |
99 | 581 | flb_free(null_terminated); |
100 | 581 | } |
101 | | |
102 | | /* Now try the http_client_proxy_connect function. */ |
103 | 592 | flb_http_client_proxy_connect(u_conn); |
104 | | |
105 | 592 | flb_connection_destroy(u_conn); |
106 | 592 | flb_upstream_destroy(u); |
107 | 592 | flb_config_exit(config); |
108 | 592 | if (uri != NULL) { |
109 | 592 | flb_free(uri); |
110 | 592 | } |
111 | 592 | if (proxy != NULL) { |
112 | 11 | flb_free(proxy); |
113 | 11 | } |
114 | | |
115 | 592 | return 0; |
116 | 592 | } |