Coverage Report

Created: 2026-01-10 07:04

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/fuzz_verify.c
Line
Count
Source
1
/* Copyright 2020 Google Inc.
2
3
Licensed under the Apache License, Version 2.0 (the "License");
4
you may not use this file except in compliance with the License.
5
You may obtain a copy of the License at
6
7
      http://www.apache.org/licenses/LICENSE-2.0
8
9
Unless required by applicable law or agreed to in writing, software
10
distributed under the License is distributed on an "AS IS" BASIS,
11
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
See the License for the specific language governing permissions and
13
limitations under the License.
14
*/
15
16
#include <stdint.h>
17
#include <stddef.h>
18
#include <stdlib.h>
19
#include <stdio.h>
20
#include <stdbool.h>
21
#include <ftw.h>
22
23
#include "config.h"
24
#include "gpg.h"
25
#include "../common/types.h"
26
#include "../common/iobuf.h"
27
#include "keydb.h"
28
#include "keyedit.h"
29
#include "../common/util.h"
30
#include "main.h"
31
#include "trustdb.h"
32
33
#include <sys/stat.h>
34
#include <fcntl.h>
35
#include <sys/types.h>
36
#include <unistd.h>
37
#include <sys/mount.h>
38
39
static bool initialized = false;
40
ctrl_t ctrlGlobal;
41
int fd;
42
char *filename;
43
44
//hack not to include gpg.c which has main function
45
extern int g10_errors_seen;
46
extern int assert_signer_true;
47
extern int assert_pubkey_algo_false;
48
49
void
50
g10_exit( int rc )
51
0
{
52
0
    gcry_control (GCRYCTL_UPDATE_RANDOM_SEED_FILE);
53
0
    gcry_control (GCRYCTL_TERM_SECMEM );
54
    /* Don't exit in fuzzer - just return to allow fuzzing to continue */
55
0
    (void)rc;
56
0
    return;
57
0
}
58
59
static void
60
gpg_deinit_default_ctrl (ctrl_t ctrl)
61
11.5k
{
62
#ifdef USE_TOFU
63
    tofu_closedbs (ctrl);
64
#endif
65
11.5k
    gpg_dirmngr_deinit_session_data (ctrl);
66
67
11.5k
    keydb_release (ctrl->cached_getkey_kdb);
68
11.5k
}
69
70
static void
71
my_gcry_logger (void *dummy, int level, const char *format, va_list arg_ptr)
72
175k
{
73
175k
    return;
74
175k
}
75
76
static int unlink_cb(const char *fpath, const struct stat *sb, int typeflag)
77
0
{
78
0
    if (typeflag == FTW_F){
79
0
        unlink(fpath);
80
0
    }
81
0
    return 0;
82
0
}
83
84
static void rmrfdir(char *path)
85
1
{
86
1
    ftw(path, unlink_cb, 16);
87
1
    if (rmdir(path) != 0) {
88
1
        printf("failed rmdir, errno=%d\n", errno);
89
1
    }
90
1
}
91
92
5.78k
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
93
94
5.78k
    if (! initialized) {
95
1
        ctrlGlobal = (ctrl_t) malloc(sizeof(*ctrlGlobal));
96
1
        if (!ctrlGlobal) {
97
0
            exit(1);
98
0
        }
99
        //deletes previous tmp dir and (re)create it as a ramfs
100
        //system("umount /tmp/fuzzdirverify");
101
1
        rmrfdir("/tmp/fuzzdirverify");
102
1
        mkdir("/tmp/fuzzdirverify/", 0700);
103
        //system("mount -t tmpfs -o size=64M tmpfs /tmp/fuzzdirverify");
104
1
        filename=strdup("/tmp/fuzzdirverify/fuzz.gpg");
105
1
        if (!filename) {
106
0
            free(ctrlGlobal);
107
0
            return 0;
108
0
        }
109
1
        fd = open("/tmp/fuzzdirverify/fuzz.gpg", O_RDWR | O_CREAT, 0600);
110
1
        if (fd == -1) {
111
0
            free(ctrlGlobal);
112
0
            free(filename);
113
0
            return 0;
114
0
        }
115
1
        gnupg_set_homedir("/tmp/fuzzdirverify/");
116
1
        if (keydb_add_resource ("pubring" EXTSEP_S GPGEXT_GPG,
117
1
                                KEYDB_RESOURCE_FLAG_DEFAULT) != GPG_ERR_NO_ERROR) {
118
0
            free(filename);
119
0
            free(ctrlGlobal);
120
0
            close(fd);
121
0
            return 0;
122
0
        }
123
1
        if (setup_trustdb (1, NULL) != GPG_ERR_NO_ERROR) {
124
0
            free(filename);
125
0
            free(ctrlGlobal);
126
0
            close(fd);
127
0
            return 0;
128
0
        }
129
        //populate /tmp/fuzzdirverify/ as homedir ~/.gnupg
130
1
        strlist_t sl = NULL;
131
1
        public_key_list (ctrlGlobal, sl, 0, 0);
132
1
        free_strlist(sl);
133
        //no output for stderr
134
1
        log_set_file("/dev/null");
135
1
        gcry_set_log_handler (my_gcry_logger, NULL);
136
        //gnupg_initialize_compliance (GNUPG_MODULE_NAME_GPG);
137
1
        initialized = true;
138
1
    }
139
140
5.78k
    memset(ctrlGlobal, 0, sizeof(*ctrlGlobal));
141
5.78k
    ctrlGlobal->magic = SERVER_CONTROL_MAGIC;
142
143
5.78k
    if (ftruncate(fd, Size) == -1) {
144
0
        return 0;
145
0
    }
146
5.78k
    if (lseek (fd, 0, SEEK_SET) < 0) {
147
0
        return 0;
148
0
    }
149
5.78k
    if (write (fd, Data, Size) != Size) {
150
0
        return 0;
151
0
    }
152
153
5.78k
    verify_signatures(ctrlGlobal, 1, &filename);
154
5.78k
    gpg_deinit_default_ctrl (ctrlGlobal);
155
5.78k
    memset(ctrlGlobal, 0, sizeof(*ctrlGlobal));
156
5.78k
    ctrlGlobal->magic = SERVER_CONTROL_MAGIC;
157
5.78k
    verify_files(ctrlGlobal, 1, &filename);
158
5.78k
    gpg_deinit_default_ctrl (ctrlGlobal);
159
160
5.78k
    return 0;
161
5.78k
}
162