Coverage Report

Created: 2026-08-14 06:20

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/libcacard/fuzz/fuzz_options.c
Line
Count
Source
1
/* Copyright (c) 2020, Red Hat, Inc.
2
 *
3
 * Authors:  Jakub Jelen <jjelen@redhat.com>
4
 *
5
 * This code is licensed under the GNU LGPL, version 2.1 or later.
6
 * See the COPYING file in the top-level directory.
7
 */
8
9
#include <stdlib.h>
10
#include <string.h>
11
#include <libcacard.h>
12
13
#include "fuzzer.h"
14
#include "vcard_emul_type.h"
15
16
/* Copied internal structures from vcard_emul_nss.c */
17
struct VirtualReaderOptionsStruct {
18
    char *name;
19
    char *vname;
20
    VCardEmulType card_type;
21
    char *type_params;
22
    char **cert_name;
23
    int cert_count;
24
};
25
26
struct VCardEmulOptionsStruct {
27
    char *nss_db;
28
    struct VirtualReaderOptionsStruct *vreader;
29
    int vreader_count;
30
    VCardEmulType hw_card_type;
31
    char *hw_type_params;
32
    int use_hw;
33
};
34
35
/* We do not want to fuzz inputs longer than 1024 bytes to avoid need for
36
 * dynamic reallocation inside of the fuzzer. Anything longer should be
37
 * possible to express with shorter strings
38
 */
39
size_t kMaxInputLength = 1024;
40
41
int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
42
931
{
43
931
    int i, j;
44
931
    VCardEmulOptions *options = NULL;
45
931
    struct VCardEmulOptionsStruct *my_options = NULL;
46
931
    char args[1025];
47
48
931
    if (Size > kMaxInputLength) {
49
33
        g_debug("Too long input option");
50
33
        return 0;
51
33
    }
52
53
898
    memcpy(args, Data, Size);
54
898
    args[Size] = '\0';
55
898
    options = vcard_emul_options(args);
56
898
    if (options == NULL) {
57
        /* Invalid input -- the function should have cleaned up for itself */
58
627
        return 0;
59
627
    }
60
61
    /* There is no sensible way to free options if they were valid */
62
271
    my_options = (struct VCardEmulOptionsStruct *)options;
63
882
    for (i = 0; i < my_options->vreader_count; i++) {
64
611
        g_free(my_options->vreader[i].name);
65
611
        g_free(my_options->vreader[i].vname);
66
611
        g_free(my_options->vreader[i].type_params);
67
3.07k
        for (j = 0; j < my_options->vreader[i].cert_count; j++) {
68
2.46k
            g_free(my_options->vreader[i].cert_name[j]);
69
2.46k
        }
70
611
        g_free(my_options->vreader[i].cert_name);
71
611
    }
72
271
    g_free(my_options->vreader);
73
271
    g_free(my_options->hw_type_params);
74
271
    g_free(my_options->nss_db);
75
    /* The invalid pointers will be overwritten on next call to parse the options */
76
77
271
    return 0;
78
898
}
79
80
/* vim: set ts=4 sw=4 tw=0 noet expandtab: */