Coverage Report

Created: 2026-10-13 06:23

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/nss/fuzz/targets/tls_client.cc
Line
Count
Source
1
/* This Source Code Form is subject to the terms of the Mozilla Public
2
 * License, v. 2.0. If a copy of the MPL was not distributed with this
3
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
4
5
#include <cassert>
6
#include <cstddef>
7
#include <cstdint>
8
#include <iostream>
9
10
#include "blapi.h"
11
#include "seccomon.h"
12
#include "ssl.h"
13
#include "sslimpl.h"
14
15
#include "base/database.h"
16
#include "tls/config.h"
17
#include "tls/common.h"
18
#include "tls/mutators.h"
19
#include "tls/socket.h"
20
21
#ifdef IS_DTLS_FUZZ
22
31.2k
#define ImportFD DTLS_ImportFD
23
#else
24
#define ImportFD SSL_ImportFD
25
#endif  // IS_DTLS_FUZZ
26
27
31.2k
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
28
31.2k
  static NSSDatabase db = NSSDatabase();
29
31.2k
  static PRDescIdentity id = PR_GetUniqueIdentity("fuzz-client");
30
31
  // Create and import dummy socket.
32
31.2k
  TlsSocket::DummyPrSocket socket = TlsSocket::DummyPrSocket(data, size);
33
31.2k
  ScopedPRFileDesc prFd(DummyIOLayerMethods::CreateFD(id, &socket));
34
31.2k
  PRFileDesc* sslFd = ImportFD(nullptr, prFd.get());
35
31.2k
  assert(sslFd == prFd.get());
36
37
  // Derive client config from input data.
38
31.2k
  TlsConfig::Client config = TlsConfig::Client(data, size);
39
40
31.2k
  if (ssl_trace >= 90) {
41
0
    std::cerr << config << "\n";
42
0
  }
43
44
  // Reset the RNG state.
45
31.2k
  assert(RNG_RandomUpdate(NULL, 0) == SECSuccess);
46
31.2k
  assert(SSL_SetURL(sslFd, "fuzz.client") == SECSuccess);
47
48
31.2k
  TlsCommon::EnableAllProtocolVersions();
49
31.2k
  TlsCommon::EnableAllCipherSuites(sslFd);
50
31.2k
  TlsCommon::FixTime(sslFd);
51
52
  // Set socket callbacks & options from client config.
53
31.2k
  config.SetCallbacks(sslFd);
54
31.2k
  config.SetSocketOptions(sslFd);
55
56
  // Perform the acutal handshake.
57
31.2k
  TlsCommon::DoHandshake(sslFd, false);
58
59
  // Release all SIDs.
60
31.2k
  SSL_ClearSessionCache();
61
62
31.2k
  return 0;
63
31.2k
}
64
65
extern "C" size_t LLVMFuzzerCustomMutator(uint8_t* data, size_t size,
66
0
                                          size_t maxSize, unsigned int seed) {
67
0
  return TlsMutators::CustomMutator(data, size, maxSize, seed);
68
0
}
69
70
extern "C" size_t LLVMFuzzerCustomCrossOver(const uint8_t* data1, size_t size1,
71
                                            const uint8_t* data2, size_t size2,
72
                                            uint8_t* out, size_t maxOutSize,
73
0
                                            unsigned int seed) {
74
0
  return TlsMutators::CustomCrossOver(data1, size1, data2, size2, out,
75
0
                                      maxOutSize, seed);
76
0
}