Coverage Report

Created: 2026-09-04 09:22

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/net-snmp/testing/fuzzing/snmp_transport_fuzzer.c
Line
Count
Source
1
 /*
2
  * Copyright (c) 2021, Net-snmp authors
3
  * All rights reserved.
4
  *
5
  * Redistribution and use in source and binary forms, with or without
6
  * modification, are permitted provided that the following conditions are met:
7
  *
8
  * * Redistributions of source code must retain the above copyright notice, this
9
  *   list of conditions and the following disclaimer.
10
  *
11
  * * Redistributions in binary form must reproduce the above copyright notice,
12
  *   this list of conditions and the following disclaimer in the documentation
13
  *   and/or other materials provided with the distribution.
14
  *
15
  * * Neither the name of the copyright holder nor the names of its
16
  *   contributors may be used to endorse or promote products derived from
17
  *   this software without specific prior written permission.
18
  *
19
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
20
  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
22
  * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
23
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
25
  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
26
  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
27
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
28
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29
  */
30
#include <net-snmp/net-snmp-config.h>
31
#include <net-snmp/net-snmp-includes.h>
32
#include "../../snmplib/transports/snmpIPBaseDomain.h"
33
#include <net-snmp/library/snmpIPXDomain.h>
34
#include <net-snmp/library/snmpUDPDomain.h>
35
#include <net-snmp/library/snmpUDPIPv6Domain.h>
36
#include <net-snmp/library/snmpUnixDomain.h>
37
#include <stddef.h>
38
#include <stdint.h>
39
#include <stdlib.h>
40
#include "ada_fuzz_header.h"
41
42
int
43
LLVMFuzzerInitialize(int *argc, char ***argv)
44
31
{
45
31
    if (getenv("NETSNMP_DEBUGGING") != NULL) {
46
        /*
47
         * Turn on all debugging, to help understand what
48
         * bits of the parser are running.
49
         */
50
0
        snmp_enable_stderrlog();
51
0
        snmp_set_do_debugging(1);
52
0
        debug_register_tokens("");
53
0
    }
54
31
    return 0;
55
31
}
56
57
int
58
LLVMFuzzerTestOneInput(const uint8_t * data, size_t size)
59
816
{
60
    /*
61
     * Force the fuzzer to create larger strings as we use
62
     * a lot of the data.
63
     */
64
816
    if (size < 550) {
65
19
        return 0;
66
19
    }
67
797
    af_gb_init();
68
69
797
    const uint8_t  *data2 = data;
70
797
    size_t          size2 = size;
71
72
797
    netsnmp_ds_set_string(NETSNMP_DS_LIBRARY_ID, NETSNMP_DS_LIB_APPTYPE,
73
797
                          "testprog");
74
75
797
    init_snmp_transport();
76
797
    netsnmp_tdomain_init();
77
78
    /*
79
     * Main fuzzing logic
80
     */
81
797
    char           *prefix = af_gb_get_null_terminated(&data2, &size2);
82
797
    char           *fmt_data = af_gb_get_null_terminated(&data2, &size2);
83
797
    netsnmp_transport *t2 = NULL;
84
797
    if (prefix && fmt_data) {
85
797
        free(netsnmp_ipv6_fmtaddr(prefix, t2, fmt_data, strlen(fmt_data)));
86
87
797
        struct sockaddr_in6 addr;
88
797
        if (!netsnmp_sockaddr_in6(&addr, prefix, 5123))
89
24
            goto cleanup;
90
797
    }
91
92
    /*
93
     * Security parsing routines.
94
     */
95
773
    char           *udp6_token = af_gb_get_null_terminated(&data2, &size2);
96
773
    char           *udp6_param = af_gb_get_null_terminated(&data2, &size2);
97
773
    if (udp6_token && udp6_param) {
98
773
        netsnmp_udp6_parse_security(udp6_token, udp6_param);
99
773
    }
100
101
773
    char           *udp_token = af_gb_get_null_terminated(&data2, &size2);
102
773
    char           *udp_param = af_gb_get_null_terminated(&data2, &size2);
103
773
    if (udp_token && udp_param) {
104
773
        netsnmp_udp_parse_security(udp_token, udp_param);
105
773
    }
106
107
773
    struct netsnmp_ep_str ep_str = { };
108
773
    char           *endpoint = af_gb_get_null_terminated(&data2, &size2);
109
773
    if (endpoint && !netsnmp_parse_ep_str(&ep_str, endpoint))
110
90
        goto cleanup;
111
112
683
    char           *unix_token = af_gb_get_null_terminated(&data2, &size2);
113
683
    char           *unix_param = af_gb_get_null_terminated(&data2, &size2);
114
683
    if (unix_token && unix_param) {
115
213
        netsnmp_unix_parse_security(unix_token, unix_param);
116
213
    }
117
118
    /*
119
     * Cleanup
120
     */
121
683
    free(ep_str.addr);
122
797
cleanup:
123
797
    netsnmp_clear_tdomain_list();
124
797
    shutdown_snmp_transport();
125
126
797
    af_gb_cleanup();
127
797
    return 0;
128
683
}