Coverage Report

Created: 2023-05-19 06:16

/src/ntp-dev/tests/fuzz/fuzz_ntpd_receive.c
Line
Count
Source
1
#include <stddef.h>
2
#include <stdint.h>
3
#include <sys/types.h>
4
#include <sys/stat.h>
5
#include <fcntl.h>
6
7
#include "config.h"
8
#include "recvbuff.h"
9
#include "ntpd.h"
10
11
const char *Version = "libntpq 0.3beta";
12
int listen_to_virtual_ips = TRUE;
13
int mdnstries = 5;
14
char const *progname = "fuzz_ntpd_receive";
15
#ifdef HAVE_WORKING_FORK
16
int    waitsync_fd_to_close = -1;    /* -w/--wait-sync */
17
#endif
18
int yydebug=0;
19
20
static int initialized = 0;
21
int sockfd;
22
uint8_t itf_index;
23
24
7.03k
void fuzz_itf_selecter(void * data, interface_info_t * itf) {
25
7.03k
    endpt **ep = (endpt **)data;
26
7.03k
    if (itf_index == 0) {
27
1.74k
        *ep = itf->ep;
28
1.74k
    }
29
7.03k
    itf_index--;
30
7.03k
}
31
32
1.77k
int LLVMFuzzerTestOneInput(const uint8_t* Data, size_t Size) {
33
1.77k
    struct recvbuf rbufp;
34
35
1.77k
    if (initialized == 0) {
36
1
        sockfd = open("/dev/null", O_RDWR );
37
        //adds interfaces
38
1
        init_io();
39
1
        init_auth();
40
1
        init_util();
41
1
        init_restrict();
42
1
        init_mon();
43
1
        init_timer();
44
1
        init_lib();
45
1
        init_request();
46
1
        init_control();
47
1
        init_peer();
48
1
        init_proto();
49
1
        init_loopfilter();
50
1
        io_open_sockets();
51
1
        initialized = 1;
52
1
    }
53
54
1.77k
    if (Size < sizeof(l_fp)) {
55
5
        return 0;
56
5
    }
57
1.76k
    memcpy(&rbufp.recv_time, Data, sizeof(l_fp));
58
1.76k
    Data += sizeof(l_fp);
59
1.76k
    Size -= sizeof(l_fp);
60
61
1.76k
    if (Size < sizeof(sockaddr_u)) {
62
8
        return 0;
63
8
    }
64
1.76k
    memcpy(&rbufp.srcadr, Data, sizeof(sockaddr_u));
65
1.76k
    memcpy(&rbufp.recv_srcadr, &rbufp.srcadr, sizeof(sockaddr_u));
66
1.76k
    Data += sizeof(sockaddr_u);
67
1.76k
    Size -= sizeof(sockaddr_u);
68
69
1.76k
    if (Size < 1) {
70
1
        return 0;
71
1
    }
72
1.75k
    itf_index = Data[0];
73
1.75k
    rbufp.dstadr = NULL;
74
1.75k
    interface_enumerate(fuzz_itf_selecter, &rbufp.dstadr);
75
1.75k
    if (rbufp.dstadr == NULL) {
76
10
        return 0;
77
10
    }
78
1.74k
    Data++;
79
1.74k
    Size--;
80
81
1.74k
    if (Size > RX_BUFF_SIZE) {
82
99
        Size = RX_BUFF_SIZE;
83
99
    }
84
1.74k
    rbufp.recv_length = Size;
85
1.74k
    memcpy(rbufp.recv_buffer, Data, Size);
86
87
1.74k
    rbufp.msg_flags = 0;
88
1.74k
    rbufp.used = 0;
89
1.74k
    rbufp.link = NULL;
90
1.74k
    rbufp.fd = sockfd;
91
92
1.74k
    receive(&rbufp);
93
1.74k
    return 0;
94
1.75k
}