/src/mosquitto/fuzzing/broker/broker_fuzz_handle_subscribe.cpp
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | Copyright (c) 2023 Cedalo GmbH |
3 | | |
4 | | All rights reserved. This program and the accompanying materials |
5 | | are made available under the terms of the Eclipse Public License 2.0 |
6 | | and Eclipse Distribution License v1.0 which accompany this distribution. |
7 | | |
8 | | The Eclipse Public License is available at |
9 | | https://www.eclipse.org/legal/epl-2.0/ |
10 | | and the Eclipse Distribution License is available at |
11 | | http://www.eclipse.org/org/documents/edl-v10.php. |
12 | | |
13 | | SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause |
14 | | |
15 | | Contributors: |
16 | | Roger Light - initial implementation and documentation. |
17 | | */ |
18 | | |
19 | | #define kMaxInputLength 100000 |
20 | | #include "fuzz_packet_read_base.h" |
21 | | |
22 | | extern "C" int fuzz_acl_check(int event, void *event_data, void *userdata) |
23 | 0 | { |
24 | 0 | struct mosquitto_evt_acl_check *ed = (struct mosquitto_evt_acl_check *)event_data; |
25 | | |
26 | | /* This is a check that is ultimately determined by the fuzz input data, so |
27 | | * the fuzzer can discover how to access both the fail/success cases. |
28 | | */ |
29 | 0 | if(ed->topic && (ed->topic[0]%2 == 0)){ |
30 | 0 | return MOSQ_ERR_SUCCESS; |
31 | 0 | }else{ |
32 | 0 | return MOSQ_ERR_AUTH; |
33 | 0 | } |
34 | 0 | } |
35 | | |
36 | | extern "C" int fuzz_packet_read_init(struct mosquitto *context) |
37 | 5.76k | { |
38 | 5.76k | context->listener->security_options->pid = (mosquitto_plugin_id_t *)calloc(1, sizeof(mosquitto_plugin_id_t)); |
39 | 5.76k | if(!context->listener->security_options->pid){ |
40 | 0 | return 1; |
41 | 0 | } |
42 | 5.76k | mosquitto_callback_register(context->listener->security_options->pid, |
43 | 5.76k | MOSQ_EVT_ACL_CHECK, fuzz_acl_check, NULL, NULL); |
44 | | |
45 | 5.76k | return 0; |
46 | 5.76k | } |
47 | | |
48 | | extern "C" void fuzz_packet_read_cleanup(struct mosquitto *context) |
49 | 10.1k | { |
50 | 10.1k | mosquitto_callback_unregister(context->listener->security_options->pid, |
51 | 10.1k | MOSQ_EVT_ACL_CHECK, fuzz_acl_check, NULL); |
52 | | |
53 | 10.1k | free(context->listener->security_options->pid); |
54 | 10.1k | context->listener->security_options->pid = NULL; |
55 | 10.1k | } |
56 | | |
57 | | extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) |
58 | 10.7k | { |
59 | 10.7k | return fuzz_packet_read_base(data, size, handle__subscribe); |
60 | 10.7k | } |