/src/net-snmp/testing/fuzzing/snmp_parse_trap_fuzzer.c
Line | Count | Source |
1 | | /* |
2 | | * Copyright (c) 2025, Net-snmp authors |
3 | | * All rights reserved. |
4 | | * |
5 | | * Redistribution and use in source and binary forms, with or without |
6 | | * modification, are permitted provided that the following conditions are met: |
7 | | * |
8 | | * * Redistributions of source code must retain the above copyright notice, this |
9 | | * list of conditions and the following disclaimer. |
10 | | * |
11 | | * * Redistributions in binary form must reproduce the above copyright notice, |
12 | | * this list of conditions and the following disclaimer in the documentation |
13 | | * and/or other materials provided with the distribution. |
14 | | * |
15 | | * * Neither the name of the copyright holder nor the names of its |
16 | | * contributors may be used to endorse or promote products derived from |
17 | | * this software without specific prior written permission. |
18 | | * |
19 | | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" |
20 | | * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
21 | | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE |
22 | | * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE |
23 | | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
24 | | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR |
25 | | * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER |
26 | | * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, |
27 | | * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
28 | | * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
29 | | */ |
30 | | |
31 | | #include <net-snmp/net-snmp-config.h> |
32 | | #include <net-snmp/net-snmp-includes.h> |
33 | | #include "../../apps/snmptrapd_handlers.h" |
34 | | #include "ada_fuzz_header.h" |
35 | | |
36 | 32 | int LLVMFuzzerInitialize(int *argc, char ***argv) { |
37 | 32 | if (getenv("NETSNMP_DEBUGGING") != NULL) { |
38 | | /* |
39 | | * Turn on all debugging, to help understand what |
40 | | * bits of the parser are running. |
41 | | */ |
42 | 0 | snmp_enable_stderrlog(); |
43 | 0 | snmp_set_do_debugging(1); |
44 | 0 | debug_register_tokens(""); |
45 | 0 | } |
46 | | |
47 | 32 | return 0; |
48 | 32 | } |
49 | | |
50 | 471 | int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { |
51 | 471 | oid snmpTrapOid[] = { 1, 3, 6, 1, 6, 3, 1, 1, 4, 1, 0 }; |
52 | 471 | netsnmp_variable_list var2 = { |
53 | 471 | .name = snmpTrapOid, |
54 | 471 | .name_length = sizeof(snmpTrapOid) / sizeof(snmpTrapOid[0]) |
55 | 471 | }; |
56 | 471 | netsnmp_variable_list var1 = { .next_variable = &var2 }; |
57 | 471 | netsnmp_transport transport = { }; |
58 | 471 | netsnmp_session sess = { }; |
59 | 471 | netsnmp_pdu *pdu; |
60 | 471 | int op; |
61 | | |
62 | 471 | af_gb_init(); |
63 | 471 | var2.val_len = af_get_short(&data, &size); |
64 | 471 | var2.val.objid = af_gb_get_random_data(&data, &size, var2.val_len); |
65 | 471 | if (!var2.val.objid) |
66 | 9 | goto cleanup; |
67 | 462 | op = NETSNMP_CALLBACK_OP_RECEIVED_MESSAGE; |
68 | 462 | pdu = af_gb_get_random_data(&data, &size, sizeof(*pdu)); |
69 | 462 | if (!pdu) |
70 | 30 | goto cleanup; |
71 | 432 | pdu->enterprise_length = af_get_short(&data, &size); |
72 | 432 | pdu->enterprise = af_gb_get_random_data(&data, &size, |
73 | 432 | pdu->enterprise_length * |
74 | 432 | sizeof(pdu->enterprise[0])); |
75 | 432 | if (!pdu->enterprise) |
76 | 16 | goto cleanup; |
77 | 416 | pdu->community = NULL; |
78 | 416 | pdu->community_len = 0; |
79 | 416 | pdu->contextEngineID = NULL; |
80 | 416 | pdu->contextEngineIDLen = 0; |
81 | 416 | pdu->securityEngineID = NULL; |
82 | 416 | pdu->securityEngineIDLen = 0; |
83 | 416 | pdu->contextName = NULL; |
84 | 416 | pdu->contextNameLen = 0; |
85 | 416 | pdu->securityName = NULL; |
86 | 416 | pdu->securityNameLen = 0; |
87 | 416 | pdu->transport_data = NULL; |
88 | 416 | pdu->transport_data_length = 0; |
89 | 416 | pdu->variables = &var1; |
90 | 416 | snmp_input(op, &sess, 0/*ignored*/, pdu, &transport); |
91 | | |
92 | 471 | cleanup: |
93 | 471 | af_gb_cleanup(); |
94 | | |
95 | 471 | return 0; |
96 | 416 | } |