Coverage Report

Created: 2025-08-28 09:57

/src/node/test/fuzzers/fuzz_ParseNaptrReply.cc
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * A fuzzer focused on the node::LoadEnvironment() function.
3
 *
4
 * Code here has been inspired by the cctest test case.
5
 */
6
7
#include <stdlib.h>
8
#include "node.h"
9
#include "node_platform.h"
10
#include "node_internals.h"
11
#include "crypto/crypto_bio.h"
12
#include "crypto/crypto_context.h"
13
#include "cares_wrap.h"
14
#include "env-inl.h"
15
#include "util-inl.h"
16
#include "v8.h"
17
#include "libplatform/libplatform.h"
18
#include "aliased_buffer.h"
19
#include "fuzz_helper.h"
20
21
22
using node::AliasedBufferBase;
23
using v8::Array;
24
25
/*int ParseSrvReply(
26
    node::Environment* env,
27
    const unsigned char* buf,
28
    int len,
29
    v8::Local<Array> ret,
30
    bool need_type = false);*/
31
32
/* General set up */
33
using ArrayBufferUniquePtr = std::unique_ptr<node::ArrayBufferAllocator,
34
  decltype(&node::FreeArrayBufferAllocator)>;
35
using TracingAgentUniquePtr = std::unique_ptr<node::tracing::Agent>;
36
using NodePlatformUniquePtr = std::unique_ptr<node::NodePlatform>;
37
38
static TracingAgentUniquePtr tracing_agent;
39
static NodePlatformUniquePtr platform;
40
static uv_loop_t current_loop;
41
42
122k
extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv) {
43
122k
  uv_os_unsetenv("NODE_OPTIONS");
44
122k
  std::vector<std::string> node_argv{ "fuzz_env" };
45
122k
  std::vector<std::string> exec_argv;
46
122k
  std::vector<std::string> errors;
47
48
122k
  node::InitializeNodeWithArgs(&node_argv, &exec_argv, &errors);
49
50
122k
  tracing_agent = std::make_unique<node::tracing::Agent>();
51
122k
  node::tracing::TraceEventHelper::SetAgent(tracing_agent.get());
52
122k
  node::tracing::TracingController* tracing_controller =
53
122k
    tracing_agent->GetTracingController();  
54
122k
  CHECK_EQ(0, uv_loop_init(&current_loop));
55
122k
  static constexpr int kV8ThreadPoolSize = 4;
56
122k
  platform.reset(
57
122k
    new node::NodePlatform(kV8ThreadPoolSize, tracing_controller));
58
122k
  v8::V8::InitializePlatform(platform.get());
59
122k
  cppgc::InitializeProcess(platform->GetPageAllocator());
60
122k
  v8::V8::Initialize();
61
122k
  return 0;
62
122k
}
63
64
class FuzzerFixtureHelper {
65
public:
66
  v8::Isolate* isolate_;
67
  ArrayBufferUniquePtr allocator;
68
69
  FuzzerFixtureHelper()
70
122k
    : allocator(ArrayBufferUniquePtr(node::CreateArrayBufferAllocator(),
71
122k
                                     &node::FreeArrayBufferAllocator)) {
72
122k
    isolate_ = NewIsolate(allocator.get(), &current_loop, platform.get());
73
122k
    CHECK_NOT_NULL(isolate_);
74
122k
    isolate_->Enter();
75
122k
  };
76
77
122k
  void Teardown() {
78
122k
    platform->DrainTasks(isolate_);
79
122k
    isolate_->Exit();
80
122k
    platform->UnregisterIsolate(isolate_);
81
122k
    isolate_->Dispose();
82
122k
    isolate_ = nullptr;
83
122k
  }
84
};
85
86
9.14k
void EnvTest(v8::Isolate* isolate_, char* env_string, size_t len) {
87
9.14k
  const v8::HandleScope handle_scope(isolate_);
88
9.14k
  Argv argv;
89
90
9.14k
  node::EnvironmentFlags::Flags flags = node::EnvironmentFlags::kDefaultFlags;
91
9.14k
  auto isolate = handle_scope.GetIsolate();
92
9.14k
  v8::Local<v8::Context> context_ = node::NewContext(isolate);
93
9.14k
  context_->Enter();
94
95
9.14k
  node::IsolateData* isolate_data_ = node::CreateIsolateData(isolate, &current_loop,
96
9.14k
                                                             platform.get());
97
9.14k
  std::vector<std::string> args(*argv, *argv + 1);
98
9.14k
  std::vector<std::string> exec_args(*argv, *argv + 1);
99
9.14k
  node::Environment* environment_ = node::CreateEnvironment(isolate_data_,
100
9.14k
                                          context_, args, exec_args, flags);
101
9.14k
  node::Environment* envi = environment_;
102
9.14k
  SetProcessExitHandler(envi, [&](node::Environment* env_, int exit_code) {
103
0
    node::Stop(envi);
104
0
  });
105
9.14k
  node::LoadEnvironment(envi, "");
106
9.14k
  const unsigned char* p = reinterpret_cast<const unsigned char*>(env_string);
107
108
9.14k
  v8::Local<v8::Array> srv_records = Array::New(envi->isolate());
109
9.14k
  int status = node::cares_wrap::FuzzParseNaptrReply(envi, p, (int)len, srv_records);
110
  
111
  // Cleanup!
112
9.14k
  node::FreeEnvironment(environment_);
113
9.14k
  node::FreeIsolateData(isolate_data_);
114
9.14k
  context_->Exit();
115
9.14k
}
116
117
33.0k
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data2, size_t size) {
118
33.0k
  FuzzerFixtureHelper ffh;
119
33.0k
  std::string s(reinterpret_cast<const char*>(data2), size);
120
33.0k
  EnvTest(ffh.isolate_, (char*)s.c_str(), size);
121
33.0k
  ffh.Teardown();
122
33.0k
  return 0;
123
33.0k
}
124