/src/libcacard/fuzz/fuzz_options.c
Line | Count | Source |
1 | | /* Copyright (c) 2020, Red Hat, Inc. |
2 | | * |
3 | | * Authors: Jakub Jelen <jjelen@redhat.com> |
4 | | * |
5 | | * This code is licensed under the GNU LGPL, version 2.1 or later. |
6 | | * See the COPYING file in the top-level directory. |
7 | | */ |
8 | | |
9 | | #include <stdlib.h> |
10 | | #include <string.h> |
11 | | #include <libcacard.h> |
12 | | |
13 | | #include "fuzzer.h" |
14 | | #include "vcard_emul_type.h" |
15 | | |
16 | | /* Copied internal structures from vcard_emul_nss.c */ |
17 | | struct VirtualReaderOptionsStruct { |
18 | | char *name; |
19 | | char *vname; |
20 | | VCardEmulType card_type; |
21 | | char *type_params; |
22 | | char **cert_name; |
23 | | int cert_count; |
24 | | }; |
25 | | |
26 | | struct VCardEmulOptionsStruct { |
27 | | char *nss_db; |
28 | | struct VirtualReaderOptionsStruct *vreader; |
29 | | int vreader_count; |
30 | | VCardEmulType hw_card_type; |
31 | | char *hw_type_params; |
32 | | int use_hw; |
33 | | }; |
34 | | |
35 | | /* We do not want to fuzz inputs longer than 1024 bytes to avoid need for |
36 | | * dynamic reallocation inside of the fuzzer. Anything longer should be |
37 | | * possible to express with shorter strings |
38 | | */ |
39 | | size_t kMaxInputLength = 1024; |
40 | | |
41 | | int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) |
42 | 931 | { |
43 | 931 | int i, j; |
44 | 931 | VCardEmulOptions *options = NULL; |
45 | 931 | struct VCardEmulOptionsStruct *my_options = NULL; |
46 | 931 | char args[1025]; |
47 | | |
48 | 931 | if (Size > kMaxInputLength) { |
49 | 33 | g_debug("Too long input option"); |
50 | 33 | return 0; |
51 | 33 | } |
52 | | |
53 | 898 | memcpy(args, Data, Size); |
54 | 898 | args[Size] = '\0'; |
55 | 898 | options = vcard_emul_options(args); |
56 | 898 | if (options == NULL) { |
57 | | /* Invalid input -- the function should have cleaned up for itself */ |
58 | 627 | return 0; |
59 | 627 | } |
60 | | |
61 | | /* There is no sensible way to free options if they were valid */ |
62 | 271 | my_options = (struct VCardEmulOptionsStruct *)options; |
63 | 882 | for (i = 0; i < my_options->vreader_count; i++) { |
64 | 611 | g_free(my_options->vreader[i].name); |
65 | 611 | g_free(my_options->vreader[i].vname); |
66 | 611 | g_free(my_options->vreader[i].type_params); |
67 | 3.07k | for (j = 0; j < my_options->vreader[i].cert_count; j++) { |
68 | 2.46k | g_free(my_options->vreader[i].cert_name[j]); |
69 | 2.46k | } |
70 | 611 | g_free(my_options->vreader[i].cert_name); |
71 | 611 | } |
72 | 271 | g_free(my_options->vreader); |
73 | 271 | g_free(my_options->hw_type_params); |
74 | 271 | g_free(my_options->nss_db); |
75 | | /* The invalid pointers will be overwritten on next call to parse the options */ |
76 | | |
77 | 271 | return 0; |
78 | 898 | } |
79 | | |
80 | | /* vim: set ts=4 sw=4 tw=0 noet expandtab: */ |