/src/mosquitto/fuzzing/broker/fuzz_packet_read_base.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | Copyright (c) 2023 Cedalo GmbH |
3 | | |
4 | | All rights reserved. This program and the accompanying materials |
5 | | are made available under the terms of the Eclipse Public License 2.0 |
6 | | and Eclipse Distribution License v1.0 which accompany this distribution. |
7 | | |
8 | | The Eclipse Public License is available at |
9 | | https://www.eclipse.org/legal/epl-2.0/ |
10 | | and the Eclipse Distribution License is available at |
11 | | http://www.eclipse.org/org/documents/edl-v10.php. |
12 | | |
13 | | SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause |
14 | | |
15 | | Contributors: |
16 | | Roger Light - initial implementation and documentation. |
17 | | */ |
18 | | |
19 | | #ifdef __cplusplus |
20 | | extern "C" { |
21 | | #endif |
22 | | |
23 | | #include "fuzz_packet_read_base.h" |
24 | | #include "mosquitto_broker_internal.h" |
25 | | #include "mosquitto_internal.h" |
26 | | |
27 | 20.3k | #define kMinInputLength 3 |
28 | 10.1k | #define kMaxInputLength 268435455U |
29 | | |
30 | | int fuzz_packet_read_base(const uint8_t *data, size_t size, int (*packet_func)(struct mosquitto *)) |
31 | 10.1k | { |
32 | 10.1k | struct mosquitto *context = NULL; |
33 | 10.1k | uint8_t *data_heap; |
34 | 10.1k | struct mosquitto__listener listener; |
35 | 10.1k | struct mosquitto__security_options secopts; |
36 | 10.1k | struct mosquitto__bridge bridge; |
37 | | |
38 | 10.1k | if(size < kMinInputLength || size > kMaxInputLength){ |
39 | 12 | return 0; |
40 | 12 | } |
41 | | |
42 | 10.1k | db.config = (struct mosquitto__config *)calloc(1, sizeof(struct mosquitto__config)); |
43 | 10.1k | log__init(db.config); |
44 | | |
45 | 10.1k | memset(&listener, 0, sizeof(listener)); |
46 | 10.1k | memset(&bridge, 0, sizeof(bridge)); |
47 | 10.1k | memset(&secopts, 0, sizeof(secopts)); |
48 | | |
49 | 10.1k | context = context__init(); |
50 | 10.1k | if(!context) return 1; |
51 | 10.1k | listener.security_options = &secopts; |
52 | 10.1k | context->listener = &listener; |
53 | 10.1k | context->bridge = &bridge; |
54 | | |
55 | 10.1k | context->state = (enum mosquitto_client_state )data[0]; |
56 | 10.1k | context->protocol = (enum mosquitto__protocol )data[1]; |
57 | 10.1k | size -= 2; |
58 | | |
59 | 10.1k | data_heap = (uint8_t *)malloc(size); |
60 | 10.1k | if(!data_heap) return 1; |
61 | | |
62 | 10.1k | memcpy(data_heap, &data[2], size); |
63 | | |
64 | 10.1k | context->in_packet.command = data_heap[0]; |
65 | 10.1k | context->in_packet.payload = (uint8_t *)data_heap; |
66 | 10.1k | context->in_packet.packet_length = (uint32_t )size; /* Safe cast, because we've already limited the size */ |
67 | 10.1k | context->in_packet.remaining_length = (uint32_t )(size-1); |
68 | 10.1k | context->in_packet.pos = 1; |
69 | | |
70 | 10.1k | if(fuzz_packet_read_init(context)){ |
71 | 0 | return 1; |
72 | 0 | } |
73 | 10.1k | packet_func(context); |
74 | 10.1k | fuzz_packet_read_cleanup(context); |
75 | | |
76 | 10.1k | context->bridge = NULL; |
77 | 10.1k | context__cleanup(context, true); |
78 | | |
79 | 10.1k | free(db.config); |
80 | | |
81 | 10.1k | return 0; |
82 | 10.1k | } |
83 | | #ifdef __cplusplus |
84 | | } |
85 | | #endif |