Coverage Report

Created: 2025-08-26 06:48

/src/mosquitto/fuzzing/broker/broker_fuzz_handle_subscribe.cpp
Line
Count
Source (jump to first uncovered line)
1
/*
2
Copyright (c) 2023 Cedalo GmbH
3
4
All rights reserved. This program and the accompanying materials
5
are made available under the terms of the Eclipse Public License 2.0
6
and Eclipse Distribution License v1.0 which accompany this distribution.
7
8
The Eclipse Public License is available at
9
   https://www.eclipse.org/legal/epl-2.0/
10
and the Eclipse Distribution License is available at
11
  http://www.eclipse.org/org/documents/edl-v10.php.
12
13
SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
14
15
Contributors:
16
   Roger Light - initial implementation and documentation.
17
*/
18
19
#define kMaxInputLength 100000
20
#include "fuzz_packet_read_base.h"
21
22
extern "C" int fuzz_acl_check(int event, void *event_data, void *userdata)
23
0
{
24
0
  struct mosquitto_evt_acl_check *ed = (struct mosquitto_evt_acl_check *)event_data;
25
26
  /* This is a check that is ultimately determined by the fuzz input data, so
27
   * the fuzzer can discover how to access both the fail/success cases.
28
   */
29
0
  if(ed->topic && (ed->topic[0]%2 == 0)){
30
0
    return MOSQ_ERR_SUCCESS;
31
0
  }else{
32
0
    return MOSQ_ERR_AUTH;
33
0
  }
34
0
}
35
36
extern "C" int fuzz_packet_read_init(struct mosquitto *context)
37
5.76k
{
38
5.76k
  context->listener->security_options->pid = (mosquitto_plugin_id_t *)calloc(1, sizeof(mosquitto_plugin_id_t));
39
5.76k
  if(!context->listener->security_options->pid){
40
0
    return 1;
41
0
  }
42
5.76k
  mosquitto_callback_register(context->listener->security_options->pid,
43
5.76k
      MOSQ_EVT_ACL_CHECK, fuzz_acl_check, NULL, NULL);
44
45
5.76k
  return 0;
46
5.76k
}
47
48
extern "C" void fuzz_packet_read_cleanup(struct mosquitto *context)
49
10.1k
{
50
10.1k
  mosquitto_callback_unregister(context->listener->security_options->pid,
51
10.1k
      MOSQ_EVT_ACL_CHECK, fuzz_acl_check, NULL);
52
53
10.1k
  free(context->listener->security_options->pid);
54
10.1k
  context->listener->security_options->pid = NULL;
55
10.1k
}
56
57
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
58
10.7k
{
59
10.7k
  return fuzz_packet_read_base(data, size, handle__subscribe);
60
10.7k
}