/src/net-snmp/testing/fuzzing/snmp_parse_fuzzer.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright (c) 2021, Net-snmp authors |
3 | | * All rights reserved. |
4 | | * |
5 | | * Redistribution and use in source and binary forms, with or without |
6 | | * modification, are permitted provided that the following conditions are met: |
7 | | * |
8 | | * * Redistributions of source code must retain the above copyright notice, this |
9 | | * list of conditions and the following disclaimer. |
10 | | * |
11 | | * * Redistributions in binary form must reproduce the above copyright notice, |
12 | | * this list of conditions and the following disclaimer in the documentation |
13 | | * and/or other materials provided with the distribution. |
14 | | * |
15 | | * * Neither the name of the copyright holder nor the names of its |
16 | | * contributors may be used to endorse or promote products derived from |
17 | | * this software without specific prior written permission. |
18 | | * |
19 | | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" |
20 | | * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
21 | | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE |
22 | | * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE |
23 | | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
24 | | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR |
25 | | * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER |
26 | | * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, |
27 | | * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
28 | | * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
29 | | */ |
30 | | #include <net-snmp/net-snmp-config.h> |
31 | | #include <net-snmp/net-snmp-includes.h> |
32 | | #include <stddef.h> |
33 | | #include <stdint.h> |
34 | | #include <stdlib.h> |
35 | | |
36 | 0 | int SecmodInMsg_CB (struct snmp_secmod_incoming_params *sp1) { |
37 | 0 | return SNMPERR_SUCCESS; |
38 | 0 | } |
39 | | |
40 | 28 | int LLVMFuzzerInitialize(int *argc, char ***argv) { |
41 | 28 | if (getenv("NETSNMP_DEBUGGING") != NULL) { |
42 | | /* |
43 | | * Turn on all debugging, to help understand what |
44 | | * bits of the parser are running. |
45 | | */ |
46 | 0 | snmp_enable_stderrlog(); |
47 | 0 | snmp_set_do_debugging(1); |
48 | 0 | debug_register_tokens(""); |
49 | 0 | } |
50 | | |
51 | 28 | struct snmp_secmod_def *sndef = SNMP_MALLOC_STRUCT(snmp_secmod_def); |
52 | 28 | sndef->decode = SecmodInMsg_CB; |
53 | 28 | register_sec_mod(-1, "modname", sndef); |
54 | 28 | return 0; |
55 | 28 | } |
56 | | |
57 | 7.51k | int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { |
58 | 7.51k | size_t bytes_remaining = size; |
59 | 7.51k | netsnmp_pdu *pdu = SNMP_MALLOC_TYPEDEF(netsnmp_pdu); |
60 | | |
61 | 7.51k | netsnmp_session sess = { }; |
62 | 7.51k | snmpv3_parse(pdu, NETSNMP_REMOVE_CONST(uint8_t *, data), &bytes_remaining, |
63 | 7.51k | NULL, &sess); |
64 | 7.51k | snmp_free_pdu(pdu); |
65 | | |
66 | 7.51k | pdu = SNMP_MALLOC_TYPEDEF(netsnmp_pdu); |
67 | 7.51k | memset(&sess, 0, sizeof(sess)); |
68 | 7.51k | snmp_parse(NULL, &sess, pdu, NETSNMP_REMOVE_CONST(uint8_t *, data), size); |
69 | 7.51k | snmp_free_pdu(pdu); |
70 | | |
71 | 7.51k | return 0; |
72 | 7.51k | } |