Coverage Report

Created: 2026-06-09 06:15

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/open62541_15/tests/fuzz/fuzz_server_services.cc
Line
Count
Source
1
/* This Source Code Form is subject to the terms of the Mozilla Public
2
 * License, v. 2.0. If a copy of the MPL was not distributed with this
3
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
4
 *
5
 */
6
7
#include <open62541/plugin/log_stdout.h>
8
#include <open62541/server_config_default.h>
9
#include <open62541/types.h>
10
11
#include "ua_server_internal.h"
12
#include "ua_services.h"
13
14
typedef enum {
15
    SERVICE_FINDSERVERS = 0,
16
    SERVICE_GETENDPOINTS,
17
    SERVICE_REGISTERSERVER,
18
    SERVICE_REGISTERSERVER2,
19
    SERVICE_FINDSERVERSONNETWORK,
20
    SERVICE_CREATESESSION,
21
    SERVICE_ACTIVATESESSION,
22
    SERVICE_CLOSESESSION,
23
    SERVICE_CANCEL,
24
    SERVICE_CREATESUBSCRIPTION,
25
    SERVICE_MODIFYSUBSCRIPTION,
26
    SERVICE_SETPUBLISHINGMODE,
27
    SERVICE_DELETESUBSCRIPTIONS,
28
    SERVICE_CREATEMONITOREDITEMS,
29
    SERVICE_MODIFYMONITOREDITEMS,
30
    SERVICE_SETMONITORINGMODE,
31
    SERVICE_DELETEMONITOREDITEMS,
32
    SERVICE_COUNT
33
} ServiceType;
34
35
3.71k
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
36
3.71k
    if(size < 2)
37
2
        return 0;
38
39
3.71k
    UA_ServerConfig config;
40
3.71k
    memset(&config, 0, sizeof(UA_ServerConfig));
41
3.71k
    UA_StatusCode retval = UA_ServerConfig_setDefault(&config);
42
3.71k
    if(retval != UA_STATUSCODE_GOOD) {
43
0
        UA_ServerConfig_clean(&config);
44
0
        return 0;
45
0
    }
46
47
3.71k
    UA_Server *server = UA_Server_newWithConfig(&config);
48
3.71k
    if(!server) {
49
0
        UA_ServerConfig_clean(&config);
50
0
        return 0;
51
0
    }
52
53
3.71k
    UA_SecureChannel channel;
54
3.71k
    UA_SecureChannel_init(&channel);
55
3.71k
    channel.state = UA_SECURECHANNELSTATE_OPEN;
56
57
3.71k
    UA_Session session;
58
3.71k
    UA_Session_init(&session);
59
3.71k
    session.activated = true;
60
3.71k
    UA_NodeId_init(&session.sessionId);
61
3.71k
    session.sessionId.identifierType = UA_NODEIDTYPE_NUMERIC;
62
3.71k
    session.sessionId.identifier.numeric = 1;
63
64
    // Use the first byte to decide which service to call
65
3.71k
    uint8_t serviceChoice = data[0] % SERVICE_COUNT;
66
3.71k
    data++;
67
3.71k
    size--;
68
69
3.71k
    UA_ByteString msg = {size, (UA_Byte *) (void *) data};
70
71
3.71k
    switch((ServiceType)serviceChoice) {
72
171
        case SERVICE_FINDSERVERS: {
73
171
            UA_FindServersRequest request;
74
171
            UA_FindServersResponse response;
75
171
            UA_FindServersResponse_init(&response);
76
171
            if(UA_decodeBinary(&msg, &request, &UA_TYPES[UA_TYPES_FINDSERVERSREQUEST], NULL) == UA_STATUSCODE_GOOD) {
77
64
                UA_LOCK(&server->serviceMutex);
78
64
                Service_FindServers(server, &session, &request, &response);
79
64
                UA_UNLOCK(&server->serviceMutex);
80
64
                UA_FindServersRequest_clear(&request);
81
64
            }
82
171
            UA_FindServersResponse_clear(&response);
83
171
            break;
84
0
        }
85
102
        case SERVICE_GETENDPOINTS: {
86
102
            UA_GetEndpointsRequest request;
87
102
            UA_GetEndpointsResponse response;
88
102
            UA_GetEndpointsResponse_init(&response);
89
102
            if(UA_decodeBinary(&msg, &request, &UA_TYPES[UA_TYPES_GETENDPOINTSREQUEST], NULL) == UA_STATUSCODE_GOOD) {
90
33
                UA_LOCK(&server->serviceMutex);
91
33
                Service_GetEndpoints(server, &session, &request, &response);
92
33
                UA_UNLOCK(&server->serviceMutex);
93
33
                UA_GetEndpointsRequest_clear(&request);
94
33
            }
95
102
            UA_GetEndpointsResponse_clear(&response);
96
102
            break;
97
0
        }
98
0
#ifdef UA_ENABLE_DISCOVERY
99
92
        case SERVICE_REGISTERSERVER: {
100
92
            UA_RegisterServerRequest request;
101
92
            UA_RegisterServerResponse response;
102
92
            UA_RegisterServerResponse_init(&response);
103
92
            if(UA_decodeBinary(&msg, &request, &UA_TYPES[UA_TYPES_REGISTERSERVERREQUEST], NULL) == UA_STATUSCODE_GOOD) {
104
3
                UA_LOCK(&server->serviceMutex);
105
3
                Service_RegisterServer(server, &session, &request, &response);
106
3
                UA_UNLOCK(&server->serviceMutex);
107
3
                UA_RegisterServerRequest_clear(&request);
108
3
            }
109
92
            UA_RegisterServerResponse_clear(&response);
110
92
            break;
111
0
        }
112
100
        case SERVICE_REGISTERSERVER2: {
113
100
            UA_RegisterServer2Request request;
114
100
            UA_RegisterServer2Response response;
115
100
            UA_RegisterServer2Response_init(&response);
116
100
            if(UA_decodeBinary(&msg, &request, &UA_TYPES[UA_TYPES_REGISTERSERVER2REQUEST], NULL) == UA_STATUSCODE_GOOD) {
117
6
                UA_LOCK(&server->serviceMutex);
118
6
                Service_RegisterServer2(server, &session, &request, &response);
119
6
                UA_UNLOCK(&server->serviceMutex);
120
6
                UA_RegisterServer2Request_clear(&request);
121
6
            }
122
100
            UA_RegisterServer2Response_clear(&response);
123
100
            break;
124
0
        }
125
0
# ifdef UA_ENABLE_DISCOVERY_MULTICAST
126
54
        case SERVICE_FINDSERVERSONNETWORK: {
127
54
            UA_FindServersOnNetworkRequest request;
128
54
            UA_FindServersOnNetworkResponse response;
129
54
            UA_FindServersOnNetworkResponse_init(&response);
130
54
            if(UA_decodeBinary(&msg, &request, &UA_TYPES[UA_TYPES_FINDSERVERSONNETWORKREQUEST], NULL) == UA_STATUSCODE_GOOD) {
131
2
                UA_LOCK(&server->serviceMutex);
132
2
                Service_FindServersOnNetwork(server, &session, &request, &response);
133
2
                UA_UNLOCK(&server->serviceMutex);
134
2
                UA_FindServersOnNetworkRequest_clear(&request);
135
2
            }
136
54
            UA_FindServersOnNetworkResponse_clear(&response);
137
54
            break;
138
0
        }
139
0
# endif
140
0
#endif
141
51
        case SERVICE_CREATESESSION: {
142
51
            UA_CreateSessionRequest request;
143
51
            UA_CreateSessionResponse response;
144
51
            UA_CreateSessionResponse_init(&response);
145
51
            if(UA_decodeBinary(&msg, &request, &UA_TYPES[UA_TYPES_CREATESESSIONREQUEST], NULL) == UA_STATUSCODE_GOOD) {
146
0
                UA_LOCK(&server->serviceMutex);
147
0
                Service_CreateSession(server, &channel, &request, &response);
148
0
                UA_UNLOCK(&server->serviceMutex);
149
0
                UA_CreateSessionRequest_clear(&request);
150
0
            }
151
51
            UA_CreateSessionResponse_clear(&response);
152
51
            break;
153
0
        }
154
79
        case SERVICE_ACTIVATESESSION: {
155
79
            UA_ActivateSessionRequest request;
156
79
            UA_ActivateSessionResponse response;
157
79
            UA_ActivateSessionResponse_init(&response);
158
79
            if(UA_decodeBinary(&msg, &request, &UA_TYPES[UA_TYPES_ACTIVATESESSIONREQUEST], NULL) == UA_STATUSCODE_GOOD) {
159
4
                UA_LOCK(&server->serviceMutex);
160
4
                Service_ActivateSession(server, &channel, &request, &response);
161
4
                UA_UNLOCK(&server->serviceMutex);
162
4
                UA_ActivateSessionRequest_clear(&request);
163
4
            }
164
79
            UA_ActivateSessionResponse_clear(&response);
165
79
            break;
166
0
        }
167
41
        case SERVICE_CLOSESESSION: {
168
41
            UA_CloseSessionRequest request;
169
41
            UA_CloseSessionResponse response;
170
41
            UA_CloseSessionResponse_init(&response);
171
41
            if(UA_decodeBinary(&msg, &request, &UA_TYPES[UA_TYPES_CLOSESESSIONREQUEST], NULL) == UA_STATUSCODE_GOOD) {
172
5
                UA_LOCK(&server->serviceMutex);
173
5
                Service_CloseSession(server, &channel, &request, &response);
174
5
                UA_UNLOCK(&server->serviceMutex);
175
5
                UA_CloseSessionRequest_clear(&request);
176
5
            }
177
41
            UA_CloseSessionResponse_clear(&response);
178
41
            break;
179
0
        }
180
34
        case SERVICE_CANCEL: {
181
34
            UA_CancelRequest request;
182
34
            UA_CancelResponse response;
183
34
            UA_CancelResponse_init(&response);
184
34
            if(UA_decodeBinary(&msg, &request, &UA_TYPES[UA_TYPES_CANCELREQUEST], NULL) == UA_STATUSCODE_GOOD) {
185
2
                UA_LOCK(&server->serviceMutex);
186
2
                Service_Cancel(server, &session, &request, &response);
187
2
                UA_UNLOCK(&server->serviceMutex);
188
2
                UA_CancelRequest_clear(&request);
189
2
            }
190
34
            UA_CancelResponse_clear(&response);
191
34
            break;
192
0
        }
193
0
#ifdef UA_ENABLE_SUBSCRIPTIONS
194
2.26k
        case SERVICE_CREATESUBSCRIPTION: {
195
2.26k
            UA_CreateSubscriptionRequest request;
196
2.26k
            UA_CreateSubscriptionResponse response;
197
2.26k
            UA_CreateSubscriptionResponse_init(&response);
198
2.26k
            if(UA_decodeBinary(&msg, &request, &UA_TYPES[UA_TYPES_CREATESUBSCRIPTIONREQUEST], NULL) == UA_STATUSCODE_GOOD) {
199
398
                UA_LOCK(&server->serviceMutex);
200
398
                Service_CreateSubscription(server, &session, &request, &response);
201
398
                UA_UNLOCK(&server->serviceMutex);
202
398
                UA_CreateSubscriptionRequest_clear(&request);
203
398
            }
204
2.26k
            UA_CreateSubscriptionResponse_clear(&response);
205
2.26k
            break;
206
0
        }
207
55
        case SERVICE_MODIFYSUBSCRIPTION: {
208
55
            UA_ModifySubscriptionRequest request;
209
55
            UA_ModifySubscriptionResponse response;
210
55
            UA_ModifySubscriptionResponse_init(&response);
211
55
            if(UA_decodeBinary(&msg, &request, &UA_TYPES[UA_TYPES_MODIFYSUBSCRIPTIONREQUEST], NULL) == UA_STATUSCODE_GOOD) {
212
3
                UA_LOCK(&server->serviceMutex);
213
3
                Service_ModifySubscription(server, &session, &request, &response);
214
3
                UA_UNLOCK(&server->serviceMutex);
215
3
                UA_ModifySubscriptionRequest_clear(&request);
216
3
            }
217
55
            UA_ModifySubscriptionResponse_clear(&response);
218
55
            break;
219
0
        }
220
57
        case SERVICE_SETPUBLISHINGMODE: {
221
57
            UA_SetPublishingModeRequest request;
222
57
            UA_SetPublishingModeResponse response;
223
57
            UA_SetPublishingModeResponse_init(&response);
224
57
            if(UA_decodeBinary(&msg, &request, &UA_TYPES[UA_TYPES_SETPUBLISHINGMODEREQUEST], NULL) == UA_STATUSCODE_GOOD) {
225
24
                UA_LOCK(&server->serviceMutex);
226
24
                Service_SetPublishingMode(server, &session, &request, &response);
227
24
                UA_UNLOCK(&server->serviceMutex);
228
24
                UA_SetPublishingModeRequest_clear(&request);
229
24
            }
230
57
            UA_SetPublishingModeResponse_clear(&response);
231
57
            break;
232
0
        }
233
44
        case SERVICE_DELETESUBSCRIPTIONS: {
234
44
            UA_DeleteSubscriptionsRequest request;
235
44
            UA_DeleteSubscriptionsResponse response;
236
44
            UA_DeleteSubscriptionsResponse_init(&response);
237
44
            if(UA_decodeBinary(&msg, &request, &UA_TYPES[UA_TYPES_DELETESUBSCRIPTIONSREQUEST], NULL) == UA_STATUSCODE_GOOD) {
238
19
                UA_LOCK(&server->serviceMutex);
239
19
                Service_DeleteSubscriptions(server, &session, &request, &response);
240
19
                UA_UNLOCK(&server->serviceMutex);
241
19
                UA_DeleteSubscriptionsRequest_clear(&request);
242
19
            }
243
44
            UA_DeleteSubscriptionsResponse_clear(&response);
244
44
            break;
245
0
        }
246
221
        case SERVICE_CREATEMONITOREDITEMS: {
247
221
            UA_CreateMonitoredItemsRequest request;
248
221
            UA_CreateMonitoredItemsResponse response;
249
221
            UA_CreateMonitoredItemsResponse_init(&response);
250
221
            if(UA_decodeBinary(&msg, &request, &UA_TYPES[UA_TYPES_CREATEMONITOREDITEMSREQUEST], NULL) == UA_STATUSCODE_GOOD) {
251
100
                UA_LOCK(&server->serviceMutex);
252
100
                Service_CreateMonitoredItems(server, &session, &request, &response);
253
100
                UA_UNLOCK(&server->serviceMutex);
254
100
                UA_CreateMonitoredItemsRequest_clear(&request);
255
100
            }
256
221
            UA_CreateMonitoredItemsResponse_clear(&response);
257
221
            break;
258
0
        }
259
244
        case SERVICE_MODIFYMONITOREDITEMS: {
260
244
            UA_ModifyMonitoredItemsRequest request;
261
244
            UA_ModifyMonitoredItemsResponse response;
262
244
            UA_ModifyMonitoredItemsResponse_init(&response);
263
244
            if(UA_decodeBinary(&msg, &request, &UA_TYPES[UA_TYPES_MODIFYMONITOREDITEMSREQUEST], NULL) == UA_STATUSCODE_GOOD) {
264
99
                UA_LOCK(&server->serviceMutex);
265
99
                Service_ModifyMonitoredItems(server, &session, &request, &response);
266
99
                UA_UNLOCK(&server->serviceMutex);
267
99
                UA_ModifyMonitoredItemsRequest_clear(&request);
268
99
            }
269
244
            UA_ModifyMonitoredItemsResponse_clear(&response);
270
244
            break;
271
0
        }
272
52
        case SERVICE_SETMONITORINGMODE: {
273
52
            UA_SetMonitoringModeRequest request;
274
52
            UA_SetMonitoringModeResponse response;
275
52
            UA_SetMonitoringModeResponse_init(&response);
276
52
            if(UA_decodeBinary(&msg, &request, &UA_TYPES[UA_TYPES_SETMONITORINGMODEREQUEST], NULL) == UA_STATUSCODE_GOOD) {
277
2
                UA_LOCK(&server->serviceMutex);
278
2
                Service_SetMonitoringMode(server, &session, &request, &response);
279
2
                UA_UNLOCK(&server->serviceMutex);
280
2
                UA_SetMonitoringModeRequest_clear(&request);
281
2
            }
282
52
            UA_SetMonitoringModeResponse_clear(&response);
283
52
            break;
284
0
        }
285
46
        case SERVICE_DELETEMONITOREDITEMS: {
286
46
            UA_DeleteMonitoredItemsRequest request;
287
46
            UA_DeleteMonitoredItemsResponse response;
288
46
            UA_DeleteMonitoredItemsResponse_init(&response);
289
46
            if(UA_decodeBinary(&msg, &request, &UA_TYPES[UA_TYPES_DELETEMONITOREDITEMSREQUEST], NULL) == UA_STATUSCODE_GOOD) {
290
2
                UA_LOCK(&server->serviceMutex);
291
2
                Service_DeleteMonitoredItems(server, &session, &request, &response);
292
2
                UA_UNLOCK(&server->serviceMutex);
293
2
                UA_DeleteMonitoredItemsRequest_clear(&request);
294
2
            }
295
46
            UA_DeleteMonitoredItemsResponse_clear(&response);
296
46
            break;
297
0
        }
298
0
#endif
299
0
        default:
300
0
            break;
301
3.71k
    }
302
303
3.71k
    UA_LOCK(&server->serviceMutex);
304
3.71k
    UA_SecureChannel_clear(&channel);
305
3.71k
    UA_Session_clear(&session, server);
306
3.71k
    UA_UNLOCK(&server->serviceMutex);
307
3.71k
    UA_Server_delete(server);
308
3.71k
    return 0;
309
3.71k
}