/src/ntp-dev/tests/fuzz/fuzz_ntpd_receive.c
Line | Count | Source |
1 | | #include <stddef.h> |
2 | | #include <stdint.h> |
3 | | #include <sys/types.h> |
4 | | #include <sys/stat.h> |
5 | | #include <fcntl.h> |
6 | | |
7 | | #include "config.h" |
8 | | #include "recvbuff.h" |
9 | | #include "ntpd.h" |
10 | | |
11 | | const char *Version = "libntpq 0.3beta"; |
12 | | int listen_to_virtual_ips = TRUE; |
13 | | int mdnstries = 5; |
14 | | char const *progname = "fuzz_ntpd_receive"; |
15 | | #ifdef HAVE_WORKING_FORK |
16 | | int waitsync_fd_to_close = -1; /* -w/--wait-sync */ |
17 | | int daemon_pipe[2] = { -1, -1 }; |
18 | | #endif |
19 | | |
20 | | static int initialized = 0; |
21 | | int sockfd; |
22 | | uint8_t itf_index; |
23 | | |
24 | 8.16k | void fuzz_itf_selecter(void * data, interface_info_t * itf) { |
25 | 8.16k | endpt **ep = (endpt **)data; |
26 | 8.16k | if (itf_index == 0) { |
27 | 2.03k | *ep = itf->ep; |
28 | 2.03k | } |
29 | 8.16k | itf_index--; |
30 | 8.16k | } |
31 | | |
32 | 2.04k | int LLVMFuzzerTestOneInput(const uint8_t* Data, size_t Size) { |
33 | 2.04k | struct recvbuf rbufp; |
34 | 2.04k | struct sockaddr_in addr; |
35 | | |
36 | | // Initialize the address to prevent an assertion failure in restrictions() |
37 | 2.04k | addr.sin_family = AF_INET; |
38 | 2.04k | addr.sin_port = htons(123); |
39 | 2.04k | addr.sin_addr.s_addr = htonl(0x7f000001); |
40 | 2.04k | rbufp.recv_srcadr.sa4 = addr; |
41 | | //memcpy(&rbufp.recv_srcadr, &addr, sizeof(struct sockaddr_in)); |
42 | | |
43 | 2.04k | if (initialized == 0) { |
44 | 1 | sockfd = open("/dev/null", O_RDWR ); |
45 | | //adds interfaces |
46 | 1 | init_io(); |
47 | 1 | init_auth(); |
48 | 1 | init_util(); |
49 | 1 | init_restrict(); |
50 | 1 | init_mon(); |
51 | 1 | init_timer(); |
52 | 1 | init_lib(); |
53 | 1 | init_request(); |
54 | 1 | init_control(); |
55 | 1 | init_peer(); |
56 | 1 | init_proto(); |
57 | 1 | init_loopfilter(); |
58 | 1 | io_open_sockets(); |
59 | 1 | initialized = 1; |
60 | 1 | } |
61 | | |
62 | 2.04k | if (Size < sizeof(l_fp)) { |
63 | 5 | return 0; |
64 | 5 | } |
65 | 2.04k | memcpy(&rbufp.recv_time, Data, sizeof(l_fp)); |
66 | 2.04k | Data += sizeof(l_fp); |
67 | 2.04k | Size -= sizeof(l_fp); |
68 | | |
69 | 2.04k | if (Size < 1) { |
70 | 1 | return 0; |
71 | 1 | } |
72 | 2.04k | itf_index = Data[0]; |
73 | 2.04k | rbufp.dstadr = NULL; |
74 | 2.04k | interface_enumerate(fuzz_itf_selecter, &rbufp.dstadr); |
75 | 2.04k | if (rbufp.dstadr == NULL) { |
76 | 7 | return 0; |
77 | 7 | } |
78 | 2.03k | Data++; |
79 | 2.03k | Size--; |
80 | | |
81 | 2.03k | if (Size > RX_BUFF_SIZE) { |
82 | 29 | Size = RX_BUFF_SIZE; |
83 | 29 | } |
84 | 2.03k | rbufp.recv_length = Size; |
85 | 2.03k | memcpy(rbufp.recv_buffer, Data, Size); |
86 | | |
87 | 2.03k | rbufp.msg_flags = 0; |
88 | 2.03k | rbufp.used = 0; |
89 | 2.03k | rbufp.link = NULL; |
90 | 2.03k | rbufp.fd = sockfd; |
91 | | |
92 | 2.03k | receive(&rbufp); |
93 | 2.03k | return 0; |
94 | 2.04k | } |