Coverage Report

Created: 2026-02-27 06:59

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/mosquitto/fuzzing/broker/broker_fuzz_proxy_v1.cpp
Line
Count
Source
1
/*
2
Copyright (c) 2025 Roger Light <roger@atchoo.org>
3
4
All rights reserved. This program and the accompanying materials
5
are made available under the terms of the Eclipse Public License 2.0
6
and Eclipse Distribution License v1.0 which accompany this distribution.
7
8
The Eclipse Public License is available at
9
   https://www.eclipse.org/legal/epl-2.0/
10
and the Eclipse Distribution License is available at
11
  http://www.eclipse.org/org/documents/edl-v10.php.
12
13
SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause
14
15
Contributors:
16
   Roger Light - initial implementation and documentation.
17
*/
18
19
#include <cstdio>
20
#include <cstdint>
21
#include <cstdlib>
22
#include <cstring>
23
#include <sys/stat.h>
24
#include <unistd.h>
25
26
static const uint8_t *packet_data = NULL;
27
static int packet_data_pos = 0;
28
static int packet_data_remaining = 0;
29
30
extern "C" {
31
#include "mosquitto_broker_internal.h"
32
33
34
ssize_t net__read(struct mosquitto *mosq, void *buf, size_t count)
35
5.01k
{
36
5.01k
  int res = count < packet_data_remaining?count:packet_data_remaining;
37
5.01k
  memcpy(buf, &packet_data[packet_data_pos], res);
38
5.01k
  packet_data_remaining -= res;
39
5.01k
  return res;
40
5.01k
}
41
42
43
int net__socket_get_address(mosq_sock_t sock, char *buf, size_t len, uint16_t *remote_port)
44
0
{
45
0
  snprintf(buf, len, "localhost");
46
0
  *remote_port = 1883;
47
0
  return MOSQ_ERR_SUCCESS;
48
0
}
49
50
51
int http__context_init(struct mosquitto *context)
52
0
{
53
0
  context->transport = mosq_t_http;
54
55
0
  return MOSQ_ERR_SUCCESS;
56
0
}
57
58
59
int log__printf(struct mosquitto *mosq, unsigned int priority, const char *fmt, ...)
60
11.7M
{
61
11.7M
  return MOSQ_ERR_SUCCESS;
62
11.7M
}
63
64
}
65
66
67
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
68
611
{
69
611
  struct mosquitto context {};
70
611
  struct mosquitto__listener listener {};
71
72
611
  packet_data = data;
73
611
  packet_data_pos = 0;
74
611
  packet_data_remaining = size;
75
76
611
  context.listener = &listener;
77
611
  context.proxy.cmd = -1;
78
611
  context.transport = mosq_t_proxy_v1;
79
80
765
  while(packet_data_remaining > 0 && context.transport != mosq_t_tcp){
81
611
    int rc = proxy_v1__read(&context);
82
611
    if(rc){
83
457
      break;
84
457
    }
85
611
  }
86
611
  free(context.address);
87
611
  free(context.proxy.buf);
88
611
  free(context.proxy.tls_version);
89
611
  free(context.proxy.cipher);
90
91
611
  return 0;
92
611
}