Coverage Report

Created: 2025-08-29 06:24

/src/mosquitto/fuzzing/broker/broker_fuzz_handle_publish.cpp
Line
Count
Source (jump to first uncovered line)
1
/*
2
Copyright (c) 2023 Cedalo GmbH
3
4
All rights reserved. This program and the accompanying materials
5
are made available under the terms of the Eclipse Public License 2.0
6
and Eclipse Distribution License v1.0 which accompany this distribution.
7
8
The Eclipse Public License is available at
9
   https://www.eclipse.org/legal/epl-2.0/
10
and the Eclipse Distribution License is available at
11
  http://www.eclipse.org/org/documents/edl-v10.php.
12
13
SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
14
15
Contributors:
16
   Roger Light - initial implementation and documentation.
17
*/
18
19
#include "fuzz_packet_read_base.h"
20
21
extern "C" int fuzz_acl_check(int event, void *event_data, void *userdata)
22
0
{
23
0
  struct mosquitto_evt_acl_check *ed = (struct mosquitto_evt_acl_check *)event_data;
24
25
  /* This is a check that is ultimately determined by the fuzz input data, so
26
   * the fuzzer can discover how to access both the fail/success cases.
27
   */
28
0
  if(ed->topic && (ed->topic[0]%2 == 0)){
29
0
    return MOSQ_ERR_SUCCESS;
30
0
  }else{
31
0
    return MOSQ_ERR_AUTH;
32
0
  }
33
0
}
34
35
extern "C" int fuzz_packet_read_init(struct mosquitto *context)
36
5.66k
{
37
5.66k
  context->listener->security_options->pid = (mosquitto_plugin_id_t *)calloc(1, sizeof(mosquitto_plugin_id_t));
38
5.66k
  if(!context->listener->security_options->pid){
39
0
    return 1;
40
0
  }
41
5.66k
  mosquitto_callback_register(context->listener->security_options->pid,
42
5.66k
      MOSQ_EVT_ACL_CHECK, fuzz_acl_check, NULL, NULL);
43
44
5.66k
  return 0;
45
5.66k
}
46
47
extern "C" void fuzz_packet_read_cleanup(struct mosquitto *context)
48
10.0k
{
49
10.0k
  mosquitto_callback_unregister(context->listener->security_options->pid,
50
10.0k
      MOSQ_EVT_ACL_CHECK, fuzz_acl_check, NULL);
51
52
10.0k
  free(context->listener->security_options->pid);
53
10.0k
  context->listener->security_options->pid = NULL;
54
10.0k
}
55
56
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
57
10.6k
{
58
10.6k
  return fuzz_packet_read_base(data, size, handle__publish);
59
10.6k
}