Coverage Report

Created: 2026-08-17 06:12

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/open5gs/tests/fuzzing/s1ap-message-fuzz.c
Line
Count
Source
1
/*
2
 * Copyright (C) 2019-2026 by Arthur SC Chan <arthur.chan@adalogics.com>
3
 *
4
 * This file is part of Open5GS.
5
 *
6
 * This program is free software: you can redistribute it and/or modify
7
 * it under the terms of the GNU Affero General Public License as published by
8
 * the Free Software Foundation, either version 3 of the License, or
9
 * (at your option) any later version.
10
 *
11
 * This program is distributed in the hope that it will be useful,
12
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14
 * GNU General Public License for more details.
15
 *
16
 * You should have received a copy of the GNU General Public License
17
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
18
 */
19
20
#include <stdio.h>
21
#include <stdint.h>
22
23
#include "fuzzing.h"
24
#include "ogs-s1ap.h"
25
26
8.59k
#define kMinInputLength 5
27
4.29k
#define kMaxInputLength 2048
28
29
extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
30
4.29k
{
31
32
4.29k
    if (Size < kMinInputLength || Size > kMaxInputLength) {
33
24
        return 1;
34
24
    }
35
36
4.27k
    if (!initialized) {
37
1
        initialize();
38
1
        ogs_log_install_domain(&__ogs_s1ap_domain, "s1ap", OGS_LOG_NONE);
39
1
    }
40
41
4.27k
    int result;
42
4.27k
    ogs_pkbuf_t *pkbuf;
43
4.27k
    ogs_s1ap_message_t message;
44
45
4.27k
    pkbuf = ogs_pkbuf_alloc(NULL, OGS_MAX_SDU_LEN);
46
4.27k
    if (pkbuf == NULL) {
47
0
        return 1;
48
0
    }
49
50
4.27k
    ogs_pkbuf_put_data(pkbuf, Data, Size);
51
52
4.27k
    result = ogs_s1ap_decode(&message, pkbuf);
53
4.27k
    if (result == OGS_OK) {
54
70
        ogs_s1ap_free(&message);
55
70
    }
56
57
4.27k
    ogs_pkbuf_free(pkbuf);
58
59
4.27k
    return 0;
60
4.27k
}