/src/open5gs/tests/fuzzing/sbi-openapi-model-fuzz.c
Line | Count | Source |
1 | | /* |
2 | | * Copyright (C) 2019-2026 by Arthur SC Chan <arthur.chan@adalogics.com> |
3 | | * |
4 | | * This file is part of Open5GS. |
5 | | * |
6 | | * This program is free software: you can redistribute it and/or modify |
7 | | * it under the terms of the GNU Affero General Public License as published by |
8 | | * the Free Software Foundation, either version 3 of the License, or |
9 | | * (at your option) any later version. |
10 | | * |
11 | | * This program is distributed in the hope that it will be useful, |
12 | | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
13 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
14 | | * GNU General Public License for more details. |
15 | | * |
16 | | * You should have received a copy of the GNU General Public License |
17 | | * along with this program. If not, see <https://www.gnu.org/licenses/>. |
18 | | */ |
19 | | |
20 | | #include <stdio.h> |
21 | | #include <stdint.h> |
22 | | #include <string.h> |
23 | | |
24 | | #include "fuzzing.h" |
25 | | #include "ogs-sbi.h" |
26 | | |
27 | | #include "model/access_and_mobility_subscription_data.h" |
28 | | #include "model/authentication_info.h" |
29 | | #include "model/authentication_info_request.h" |
30 | | #include "model/authentication_info_result.h" |
31 | | #include "model/dnn_configuration.h" |
32 | | #include "model/event_notification.h" |
33 | | #include "model/event_subscription.h" |
34 | | #include "model/events_notification.h" |
35 | | #include "model/hsmf_update_data.h" |
36 | | #include "model/mdt_configuration.h" |
37 | | #include "model/media_component.h" |
38 | | #include "model/media_component_rm.h" |
39 | | #include "model/n1_n2_message_transfer_req_data.h" |
40 | | #include "model/n1_n2_message_transfer_rsp_data.h" |
41 | | #include "model/pcc_rule.h" |
42 | | #include "model/pdu_session_create_data.h" |
43 | | #include "model/pdu_session_created_data.h" |
44 | | #include "model/policy_association_request.h" |
45 | | #include "model/sm_context_update_data.h" |
46 | | #include "model/sm_policy_context_data.h" |
47 | | #include "model/sm_policy_decision.h" |
48 | | #include "model/subscr_cond.h" |
49 | | #include "model/ue_authentication_ctx.h" |
50 | | #include "model/ue_context.h" |
51 | | #include "model/ue_context_transfer_req_data.h" |
52 | | #include "model/ue_context_transfer_rsp_data.h" |
53 | | #include "model/vsmf_update_data.h" |
54 | | |
55 | 48.5k | #define kMinInputLength 2 |
56 | 24.2k | #define kMaxInputLength 16384 |
57 | | |
58 | | #define TRY_MODEL(name) \ |
59 | 635k | do { \ |
60 | 635k | OpenAPI_##name##_t *model = \ |
61 | 635k | OpenAPI_##name##_parseFromJSON(json); \ |
62 | 635k | if (model) { \ |
63 | 145k | OpenAPI_##name##_free(model); \ |
64 | 145k | } \ |
65 | 635k | } while (0) |
66 | | |
67 | | extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) |
68 | 24.2k | { |
69 | 24.2k | char *text; |
70 | 24.2k | cJSON *json; |
71 | | |
72 | 24.2k | if (Size < kMinInputLength || Size > kMaxInputLength) { |
73 | 9 | return 0; |
74 | 9 | } |
75 | | |
76 | 24.2k | if (!initialized) { |
77 | 1 | initialize(); |
78 | 1 | ogs_log_install_domain(&__ogs_sbi_domain, "sbi", OGS_LOG_NONE); |
79 | 1 | } |
80 | | |
81 | | /* cJSON_Parse needs a NUL-terminated string, as the HTTP layer provides. */ |
82 | 24.2k | text = ogs_malloc(Size + 1); |
83 | 24.2k | if (text == NULL) { |
84 | 0 | return 0; |
85 | 0 | } |
86 | 24.2k | memcpy(text, Data, Size); |
87 | 24.2k | text[Size] = '\0'; |
88 | | |
89 | 24.2k | json = cJSON_Parse(text); |
90 | 24.2k | ogs_free(text); |
91 | 24.2k | if (json == NULL) { |
92 | 697 | return 0; |
93 | 697 | } |
94 | | |
95 | 23.5k | TRY_MODEL(authentication_info); |
96 | 23.5k | TRY_MODEL(authentication_info_request); |
97 | 23.5k | TRY_MODEL(authentication_info_result); |
98 | 23.5k | TRY_MODEL(ue_authentication_ctx); |
99 | | |
100 | | /* AMF and SMF context transfer */ |
101 | 23.5k | TRY_MODEL(ue_context_transfer_req_data); |
102 | 23.5k | TRY_MODEL(ue_context_transfer_rsp_data); |
103 | 23.5k | TRY_MODEL(n1_n2_message_transfer_req_data); |
104 | 23.5k | TRY_MODEL(n1_n2_message_transfer_rsp_data); |
105 | 23.5k | TRY_MODEL(ue_context); |
106 | 23.5k | TRY_MODEL(sm_context_update_data); |
107 | 23.5k | TRY_MODEL(pdu_session_create_data); |
108 | 23.5k | TRY_MODEL(pdu_session_created_data); |
109 | 23.5k | TRY_MODEL(hsmf_update_data); |
110 | 23.5k | TRY_MODEL(vsmf_update_data); |
111 | | |
112 | | /* Subscription and event exposure */ |
113 | 23.5k | TRY_MODEL(event_subscription); |
114 | 23.5k | TRY_MODEL(events_notification); |
115 | 23.5k | TRY_MODEL(event_notification); |
116 | 23.5k | TRY_MODEL(subscr_cond); |
117 | | |
118 | | /* Subscriber data from UDM/UDR */ |
119 | 23.5k | TRY_MODEL(access_and_mobility_subscription_data); |
120 | 23.5k | TRY_MODEL(dnn_configuration); |
121 | 23.5k | TRY_MODEL(mdt_configuration); |
122 | | |
123 | | /* Policy control */ |
124 | 23.5k | TRY_MODEL(sm_policy_context_data); |
125 | 23.5k | TRY_MODEL(sm_policy_decision); |
126 | 23.5k | TRY_MODEL(policy_association_request); |
127 | 23.5k | TRY_MODEL(pcc_rule); |
128 | 23.5k | TRY_MODEL(media_component); |
129 | 23.5k | TRY_MODEL(media_component_rm); |
130 | | |
131 | 23.5k | cJSON_Delete(json); |
132 | | |
133 | 23.5k | return 0; |
134 | 24.2k | } |