Coverage Report

Created: 2025-07-04 09:33

/src/node/test/fuzzers/fuzz_ParseMxReply.cc
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * A fuzzer focused on the node::LoadEnvironment() function.
3
 *
4
 * Code here has been inspired by the cctest test case.
5
 */
6
7
#include <stdlib.h>
8
#include "node.h"
9
#include "node_platform.h"
10
#include "node_internals.h"
11
#include "crypto/crypto_bio.h"
12
#include "crypto/crypto_context.h"
13
#include "cares_wrap.h"
14
#include "env-inl.h"
15
#include "util-inl.h"
16
#include "v8.h"
17
#include "libplatform/libplatform.h"
18
#include "aliased_buffer.h"
19
#include "fuzz_helper.h"
20
21
22
using node::AliasedBufferBase;
23
using v8::Array;
24
25
/*int ParseSrvReply(
26
    node::Environment* env,
27
    const unsigned char* buf,
28
    int len,
29
    v8::Local<Array> ret,
30
    bool need_type = false);*/
31
32
/* General set up */
33
using ArrayBufferUniquePtr = std::unique_ptr<node::ArrayBufferAllocator,
34
  decltype(&node::FreeArrayBufferAllocator)>;
35
using TracingAgentUniquePtr = std::unique_ptr<node::tracing::Agent>;
36
using NodePlatformUniquePtr = std::unique_ptr<node::NodePlatform>;
37
38
static TracingAgentUniquePtr tracing_agent;
39
static NodePlatformUniquePtr platform;
40
static uv_loop_t current_loop;
41
42
132k
extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv) {
43
132k
  uv_os_unsetenv("NODE_OPTIONS");
44
132k
  std::vector<std::string> node_argv{ "fuzz_env" };
45
132k
  std::vector<std::string> exec_argv;
46
132k
  std::vector<std::string> errors;
47
48
132k
  node::InitializeNodeWithArgs(&node_argv, &exec_argv, &errors);
49
50
132k
  tracing_agent = std::make_unique<node::tracing::Agent>();
51
132k
  node::tracing::TraceEventHelper::SetAgent(tracing_agent.get());
52
132k
  node::tracing::TracingController* tracing_controller =
53
132k
    tracing_agent->GetTracingController();  
54
132k
  CHECK_EQ(0, uv_loop_init(&current_loop));
55
132k
  static constexpr int kV8ThreadPoolSize = 4;
56
132k
  platform.reset(
57
132k
    new node::NodePlatform(kV8ThreadPoolSize, tracing_controller));
58
132k
  v8::V8::InitializePlatform(platform.get());
59
132k
  cppgc::InitializeProcess(platform->GetPageAllocator());
60
132k
  v8::V8::Initialize();
61
132k
  return 0;
62
132k
}
63
64
class FuzzerFixtureHelper {
65
public:
66
  v8::Isolate* isolate_;
67
  ArrayBufferUniquePtr allocator;
68
69
  FuzzerFixtureHelper()
70
134k
    : allocator(ArrayBufferUniquePtr(node::CreateArrayBufferAllocator(),
71
134k
                                     &node::FreeArrayBufferAllocator)) {
72
134k
    isolate_ = NewIsolate(allocator.get(), &current_loop, platform.get());
73
134k
    CHECK_NOT_NULL(isolate_);
74
134k
    isolate_->Enter();
75
134k
  };
76
77
134k
  void Teardown() {
78
134k
    platform->DrainTasks(isolate_);
79
134k
    isolate_->Exit();
80
134k
    platform->UnregisterIsolate(isolate_);
81
134k
    isolate_->Dispose();
82
134k
    isolate_ = nullptr;
83
134k
  }
84
};
85
86
10.2k
void EnvTest(v8::Isolate* isolate_, char* env_string, size_t len) {
87
10.2k
  const v8::HandleScope handle_scope(isolate_);
88
10.2k
  Argv argv;
89
90
10.2k
  node::EnvironmentFlags::Flags flags = node::EnvironmentFlags::kDefaultFlags;
91
10.2k
  auto isolate = handle_scope.GetIsolate();
92
10.2k
  v8::Local<v8::Context> context_ = node::NewContext(isolate);
93
10.2k
  context_->Enter();
94
95
10.2k
  node::IsolateData* isolate_data_ = node::CreateIsolateData(isolate, &current_loop,
96
10.2k
                                                             platform.get());
97
10.2k
  std::vector<std::string> args(*argv, *argv + 1);
98
10.2k
  std::vector<std::string> exec_args(*argv, *argv + 1);
99
10.2k
  node::Environment* environment_ = node::CreateEnvironment(isolate_data_,
100
10.2k
                                          context_, args, exec_args, flags);
101
10.2k
  node::Environment* envi = environment_;
102
10.2k
  SetProcessExitHandler(envi, [&](node::Environment* env_, int exit_code) {
103
0
    node::Stop(envi);
104
0
  });
105
10.2k
  node::LoadEnvironment(envi, "");
106
10.2k
  const unsigned char* p = reinterpret_cast<const unsigned char*>(env_string);
107
108
10.2k
  v8::Local<v8::Array> srv_records = Array::New(envi->isolate());
109
10.2k
  int status = node::cares_wrap::FuzzParseMxReply(envi, p, (int)len, srv_records);
110
  
111
  // Cleanup!
112
10.2k
  node::FreeEnvironment(environment_);
113
10.2k
  node::FreeIsolateData(isolate_data_);
114
10.2k
  context_->Exit();
115
10.2k
}
116
117
36.0k
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data2, size_t size) {
118
36.0k
  FuzzerFixtureHelper ffh;
119
36.0k
  std::string s(reinterpret_cast<const char*>(data2), size);
120
36.0k
  EnvTest(ffh.isolate_, (char*)s.c_str(), size);
121
36.0k
  ffh.Teardown();
122
36.0k
  return 0;
123
36.0k
}
124