/src/ntp-dev/tests/fuzz/fuzz_ntpd_receive.c
Line | Count | Source |
1 | | #include <stddef.h> |
2 | | #include <stdint.h> |
3 | | #include <sys/types.h> |
4 | | #include <sys/stat.h> |
5 | | #include <fcntl.h> |
6 | | |
7 | | #include "config.h" |
8 | | #include "recvbuff.h" |
9 | | #include "ntpd.h" |
10 | | |
11 | | const char *Version = "libntpq 0.3beta"; |
12 | | int listen_to_virtual_ips = TRUE; |
13 | | int mdnstries = 5; |
14 | | char const *progname = "fuzz_ntpd_receive"; |
15 | | #ifdef HAVE_WORKING_FORK |
16 | | int waitsync_fd_to_close = -1; /* -w/--wait-sync */ |
17 | | #endif |
18 | | int yydebug=0; |
19 | | |
20 | | static int initialized = 0; |
21 | | int sockfd; |
22 | | uint8_t itf_index; |
23 | | |
24 | 7.03k | void fuzz_itf_selecter(void * data, interface_info_t * itf) { |
25 | 7.03k | endpt **ep = (endpt **)data; |
26 | 7.03k | if (itf_index == 0) { |
27 | 1.74k | *ep = itf->ep; |
28 | 1.74k | } |
29 | 7.03k | itf_index--; |
30 | 7.03k | } |
31 | | |
32 | 1.77k | int LLVMFuzzerTestOneInput(const uint8_t* Data, size_t Size) { |
33 | 1.77k | struct recvbuf rbufp; |
34 | | |
35 | 1.77k | if (initialized == 0) { |
36 | 1 | sockfd = open("/dev/null", O_RDWR ); |
37 | | //adds interfaces |
38 | 1 | init_io(); |
39 | 1 | init_auth(); |
40 | 1 | init_util(); |
41 | 1 | init_restrict(); |
42 | 1 | init_mon(); |
43 | 1 | init_timer(); |
44 | 1 | init_lib(); |
45 | 1 | init_request(); |
46 | 1 | init_control(); |
47 | 1 | init_peer(); |
48 | 1 | init_proto(); |
49 | 1 | init_loopfilter(); |
50 | 1 | io_open_sockets(); |
51 | 1 | initialized = 1; |
52 | 1 | } |
53 | | |
54 | 1.77k | if (Size < sizeof(l_fp)) { |
55 | 5 | return 0; |
56 | 5 | } |
57 | 1.76k | memcpy(&rbufp.recv_time, Data, sizeof(l_fp)); |
58 | 1.76k | Data += sizeof(l_fp); |
59 | 1.76k | Size -= sizeof(l_fp); |
60 | | |
61 | 1.76k | if (Size < sizeof(sockaddr_u)) { |
62 | 8 | return 0; |
63 | 8 | } |
64 | 1.76k | memcpy(&rbufp.srcadr, Data, sizeof(sockaddr_u)); |
65 | 1.76k | memcpy(&rbufp.recv_srcadr, &rbufp.srcadr, sizeof(sockaddr_u)); |
66 | 1.76k | Data += sizeof(sockaddr_u); |
67 | 1.76k | Size -= sizeof(sockaddr_u); |
68 | | |
69 | 1.76k | if (Size < 1) { |
70 | 1 | return 0; |
71 | 1 | } |
72 | 1.75k | itf_index = Data[0]; |
73 | 1.75k | rbufp.dstadr = NULL; |
74 | 1.75k | interface_enumerate(fuzz_itf_selecter, &rbufp.dstadr); |
75 | 1.75k | if (rbufp.dstadr == NULL) { |
76 | 10 | return 0; |
77 | 10 | } |
78 | 1.74k | Data++; |
79 | 1.74k | Size--; |
80 | | |
81 | 1.74k | if (Size > RX_BUFF_SIZE) { |
82 | 99 | Size = RX_BUFF_SIZE; |
83 | 99 | } |
84 | 1.74k | rbufp.recv_length = Size; |
85 | 1.74k | memcpy(rbufp.recv_buffer, Data, Size); |
86 | | |
87 | 1.74k | rbufp.msg_flags = 0; |
88 | 1.74k | rbufp.used = 0; |
89 | 1.74k | rbufp.link = NULL; |
90 | 1.74k | rbufp.fd = sockfd; |
91 | | |
92 | 1.74k | receive(&rbufp); |
93 | 1.74k | return 0; |
94 | 1.75k | } |