Coverage Report

Created: 2026-07-16 06:54

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/openssh/regress/misc/fuzz-harness/authkeys_fuzz.cc
Line
Count
Source
1
#include <stddef.h>
2
#include <stdio.h>
3
#include <stdint.h>
4
#include <string.h>
5
#include <stdlib.h>
6
#include <pwd.h>
7
#include <unistd.h>
8
9
extern "C" {
10
11
#include "hostfile.h"
12
#include "auth.h"
13
#include "auth-options.h"
14
#include "sshkey.h"
15
16
// testdata/id_ed25519.pub and testdata/id_ed25519-cert.pub
17
const char *pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDPQXmEVMVLmeFRyafKMVWgPDkv8/uRBTwmcEDatZzMD"; 
18
const char *certtext = "ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIMDQjYH6XRzH3j3MW1DdjCoAfvrHfgjnVGF+sLK0pBfqAAAAIDPQXmEVMVLmeFRyafKMVWgPDkv8/uRBTwmcEDatZzMDAAAAAAAAA+sAAAABAAAAB3VseXNzZXMAAAAXAAAAB3VseXNzZXMAAAAIb2R5c3NldXMAAAAAAAAAAP//////////AAAAAAAAAIIAAAAVcGVybWl0LVgxMS1mb3J3YXJkaW5nAAAAAAAAABdwZXJtaXQtYWdlbnQtZm9yd2FyZGluZwAAAAAAAAAWcGVybWl0LXBvcnQtZm9yd2FyZGluZwAAAAAAAAAKcGVybWl0LXB0eQAAAAAAAAAOcGVybWl0LXVzZXItcmMAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgM9BeYRUxUuZ4VHJp8oxVaA8OS/z+5EFPCZwQNq1nMwMAAABTAAAAC3NzaC1lZDI1NTE5AAAAQBj0og+s09/HpwdHZbzN0twooKPDWWrxGfnP1Joy6cDnY2BCSQ7zg9vbq11kLF8H/sKOTZWAQrUZ7LlChOu9Ogw= id_ed25519.pub";
19
20
// stubs
21
void auth_debug_add(const char *fmt,...)
22
4.32k
{
23
4.32k
}
24
25
void
26
auth_log_authopts(const char *loc, const struct sshauthopt *opts, int do_remote)
27
1.24k
{
28
1.24k
}
29
30
int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
31
3.24k
{
32
3.24k
  char *tmp, *o, *cp = (char *)malloc(size + 1 + strlen(pubkey) + 1);
33
3.24k
  struct sshauthopt *opts = NULL;
34
3.24k
  struct passwd *pw = getpwuid(getuid());
35
3.24k
  static struct sshkey *key, *cert;
36
37
3.24k
  if (key == NULL) {
38
1
    if ((key = sshkey_new(KEY_UNSPEC)) == NULL ||
39
1
        (cert = sshkey_new(KEY_UNSPEC)) == NULL)
40
0
      abort();
41
1
    if ((o = tmp = strdup(pubkey)) == NULL ||
42
1
        sshkey_read(key, &tmp) != 0)
43
0
      abort();
44
1
    free(o);
45
1
    if ((o = tmp = strdup(certtext)) == NULL ||
46
1
        sshkey_read(cert, &tmp) != 0)
47
0
      abort();
48
1
    free(o);
49
1
  }
50
3.24k
  if (cp == NULL || pw == NULL || key == NULL || cert == NULL)
51
0
    abort();
52
53
  // Cleanup whitespace at input EOL.
54
1.70M
  for (; size > 0 && strchr(" \t\r\n", data[size - 1]) != NULL; size--) ;
55
56
  // Append a pubkey that will match.
57
3.24k
  memcpy(cp, data, size);
58
3.24k
  cp[size] = ' ';
59
3.24k
  memcpy(cp + size + 1, pubkey, strlen(pubkey) + 1);
60
61
  // Try key.
62
3.24k
  if ((tmp = strdup(cp)) == NULL)
63
0
    abort();
64
3.24k
  (void) auth_check_authkey_line(pw, key, tmp, "127.0.0.1", "localhost",
65
3.24k
      "fuzz", &opts);
66
3.24k
  free(tmp);
67
3.24k
  sshauthopt_free(opts);
68
69
  // Try cert.
70
3.24k
  if ((tmp = strdup(cp)) == NULL)
71
0
    abort();
72
3.24k
  (void) auth_check_authkey_line(pw, cert, tmp, "127.0.0.1", "localhost",
73
3.24k
      "fuzz", &opts);
74
3.24k
  free(tmp);
75
3.24k
  sshauthopt_free(opts);
76
77
3.24k
  free(cp);
78
3.24k
  return 0;
79
3.24k
}
80
81
} // extern "C"