Coverage Report

Created: 2026-11-12 06:28

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/open5gs/tests/fuzzing/sbi-openapi-model-fuzz.c
Line
Count
Source
1
/*
2
 * Copyright (C) 2019-2026 by Arthur SC Chan <arthur.chan@adalogics.com>
3
 *
4
 * This file is part of Open5GS.
5
 *
6
 * This program is free software: you can redistribute it and/or modify
7
 * it under the terms of the GNU Affero General Public License as published by
8
 * the Free Software Foundation, either version 3 of the License, or
9
 * (at your option) any later version.
10
 *
11
 * This program is distributed in the hope that it will be useful,
12
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14
 * GNU General Public License for more details.
15
 *
16
 * You should have received a copy of the GNU General Public License
17
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
18
 */
19
20
#include <stdio.h>
21
#include <stdint.h>
22
#include <string.h>
23
24
#include "fuzzing.h"
25
#include "ogs-sbi.h"
26
27
#include "model/access_and_mobility_subscription_data.h"
28
#include "model/authentication_info.h"
29
#include "model/authentication_info_request.h"
30
#include "model/authentication_info_result.h"
31
#include "model/dnn_configuration.h"
32
#include "model/event_notification.h"
33
#include "model/event_subscription.h"
34
#include "model/events_notification.h"
35
#include "model/hsmf_update_data.h"
36
#include "model/mdt_configuration.h"
37
#include "model/media_component.h"
38
#include "model/media_component_rm.h"
39
#include "model/n1_n2_message_transfer_req_data.h"
40
#include "model/n1_n2_message_transfer_rsp_data.h"
41
#include "model/pcc_rule.h"
42
#include "model/pdu_session_create_data.h"
43
#include "model/pdu_session_created_data.h"
44
#include "model/policy_association_request.h"
45
#include "model/sm_context_update_data.h"
46
#include "model/sm_policy_context_data.h"
47
#include "model/sm_policy_decision.h"
48
#include "model/subscr_cond.h"
49
#include "model/ue_authentication_ctx.h"
50
#include "model/ue_context.h"
51
#include "model/ue_context_transfer_req_data.h"
52
#include "model/ue_context_transfer_rsp_data.h"
53
#include "model/vsmf_update_data.h"
54
55
48.5k
#define kMinInputLength 2
56
24.2k
#define kMaxInputLength 16384
57
58
#define TRY_MODEL(name)                                                     \
59
635k
    do {                                                                    \
60
635k
        OpenAPI_##name##_t *model =                                         \
61
635k
            OpenAPI_##name##_parseFromJSON(json);                           \
62
635k
        if (model) {                                                        \
63
145k
            OpenAPI_##name##_free(model);                                   \
64
145k
        }                                                                   \
65
635k
    } while (0)
66
67
extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
68
24.2k
{
69
24.2k
    char *text;
70
24.2k
    cJSON *json;
71
72
24.2k
    if (Size < kMinInputLength || Size > kMaxInputLength) {
73
9
        return 0;
74
9
    }
75
76
24.2k
    if (!initialized) {
77
1
        initialize();
78
1
        ogs_log_install_domain(&__ogs_sbi_domain, "sbi", OGS_LOG_NONE);
79
1
    }
80
81
    /* cJSON_Parse needs a NUL-terminated string, as the HTTP layer provides. */
82
24.2k
    text = ogs_malloc(Size + 1);
83
24.2k
    if (text == NULL) {
84
0
        return 0;
85
0
    }
86
24.2k
    memcpy(text, Data, Size);
87
24.2k
    text[Size] = '\0';
88
89
24.2k
    json = cJSON_Parse(text);
90
24.2k
    ogs_free(text);
91
24.2k
    if (json == NULL) {
92
697
        return 0;
93
697
    }
94
95
23.5k
    TRY_MODEL(authentication_info);
96
23.5k
    TRY_MODEL(authentication_info_request);
97
23.5k
    TRY_MODEL(authentication_info_result);
98
23.5k
    TRY_MODEL(ue_authentication_ctx);
99
100
    /* AMF and SMF context transfer */
101
23.5k
    TRY_MODEL(ue_context_transfer_req_data);
102
23.5k
    TRY_MODEL(ue_context_transfer_rsp_data);
103
23.5k
    TRY_MODEL(n1_n2_message_transfer_req_data);
104
23.5k
    TRY_MODEL(n1_n2_message_transfer_rsp_data);
105
23.5k
    TRY_MODEL(ue_context);
106
23.5k
    TRY_MODEL(sm_context_update_data);
107
23.5k
    TRY_MODEL(pdu_session_create_data);
108
23.5k
    TRY_MODEL(pdu_session_created_data);
109
23.5k
    TRY_MODEL(hsmf_update_data);
110
23.5k
    TRY_MODEL(vsmf_update_data);
111
112
    /* Subscription and event exposure */
113
23.5k
    TRY_MODEL(event_subscription);
114
23.5k
    TRY_MODEL(events_notification);
115
23.5k
    TRY_MODEL(event_notification);
116
23.5k
    TRY_MODEL(subscr_cond);
117
118
    /* Subscriber data from UDM/UDR */
119
23.5k
    TRY_MODEL(access_and_mobility_subscription_data);
120
23.5k
    TRY_MODEL(dnn_configuration);
121
23.5k
    TRY_MODEL(mdt_configuration);
122
123
    /* Policy control */
124
23.5k
    TRY_MODEL(sm_policy_context_data);
125
23.5k
    TRY_MODEL(sm_policy_decision);
126
23.5k
    TRY_MODEL(policy_association_request);
127
23.5k
    TRY_MODEL(pcc_rule);
128
23.5k
    TRY_MODEL(media_component);
129
23.5k
    TRY_MODEL(media_component_rm);
130
131
23.5k
    cJSON_Delete(json);
132
133
23.5k
    return 0;
134
24.2k
}