Coverage Report

Created: 2026-05-16 07:13

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/kea-fuzzer/fuzz_eval6.cc
Line
Count
Source
1
// Copyright (C) 2025 Ada Logcis Ltd.
2
//
3
// This Source Code Form is subject to the terms of the Mozilla Public
4
// License, v. 2.0. If a copy of the MPL was not distributed with this
5
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
6
////////////////////////////////////////////////////////////////////////////////
7
#include "config.h"
8
#include <fuzzer/FuzzedDataProvider.h>
9
10
#include <eval/eval_context.h>
11
#include <eval/evaluate.h>
12
#include <eval/dependency.h>
13
14
#include <dhcp/pkt6.h>
15
#include <dhcp/dhcp6.h>
16
17
#include <cstdlib>
18
#include <string>
19
20
using namespace isc;
21
using namespace isc::eval;
22
using namespace isc::dhcp;
23
24
10.2k
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* Data, size_t Size) {
25
10.2k
    FuzzedDataProvider fdp(Data, Size);
26
10.2k
    EvalContext ctx(Option::V6);
27
28
10.2k
    auto idx =  fdp.ConsumeIntegralInRange<uint8_t>(1, 18);
29
10.2k
    const std::string payload = fdp.ConsumeRemainingBytesAsString();
30
    // Fuzz boolean parsing
31
10.2k
    try {
32
10.2k
        Pkt6 pkt(idx, 0);
33
10.2k
        if (ctx.parseString(payload, EvalContext::PARSER_BOOL)) {
34
701
            ValueStack vs;
35
701
            Expression& exp_bool = ctx.expression_;
36
701
            ExpressionPtr exp_bool_ptr(new Expression(exp_bool));
37
38
701
            evaluateRaw(exp_bool, pkt, vs);
39
701
            evaluateBool(exp_bool, pkt);
40
701
            evaluateString(exp_bool, pkt);
41
701
            dependOnClass(exp_bool_ptr, payload);
42
701
        }
43
10.2k
    } catch(const isc::Exception&) {}
44
45
10.2k
    try {
46
        // Fuzz string parsing
47
10.2k
        Pkt6 pkt(idx, 0);
48
10.2k
        if (ctx.parseString(payload, EvalContext::PARSER_STRING)) {
49
1.63k
            ValueStack vs;
50
1.63k
            Expression& exp_str = ctx.expression_;
51
1.63k
            ExpressionPtr exp_str_ptr(new Expression(exp_str));
52
53
1.63k
            evaluateRaw(exp_str, pkt, vs);
54
1.63k
            evaluateBool(exp_str, pkt);
55
1.63k
            evaluateString(exp_str, pkt);
56
1.63k
            dependOnClass(exp_str_ptr, payload);
57
1.63k
        }
58
10.2k
    } catch(const isc::Exception&) {}
59
60
10.2k
    location loc;
61
10.2k
    try {
62
        // Fuzz converter
63
10.2k
        ctx.convertOptionCode(payload, loc);
64
10.2k
    } catch(const isc::Exception&) {}
65
66
10.2k
    try {
67
10.2k
        ctx.convertOptionName(payload, loc);
68
10.2k
    } catch(const isc::Exception&) {}
69
70
10.2k
    try {
71
10.2k
        ctx.convertNestLevelNumber(payload, loc);
72
10.2k
    } catch(const isc::Exception&) {
73
        // Slient exceptions
74
10.2k
    }
75
76
10.2k
    return 0;
77
10.2k
}