Coverage Report

Created: 2025-12-31 06:58

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/openssl33/fuzz/quic-lcidm.c
Line
Count
Source
1
/*
2
 * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
3
 *
4
 * Licensed under the Apache License 2.0 (the "License");
5
 * you may not use this file except in compliance with the License.
6
 * You may obtain a copy of the License at
7
 * https://www.openssl.org/source/license.html
8
 * or in the file LICENSE in the source distribution.
9
 */
10
11
#include <openssl/ssl.h>
12
#include <openssl/err.h>
13
#include <openssl/bio.h>
14
#include "fuzzer.h"
15
#include "internal/quic_lcidm.h"
16
#include "internal/packet.h"
17
18
int FuzzerInitialize(int *argc, char ***argv)
19
214
{
20
214
    FuzzerSetRand();
21
214
    OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS | OPENSSL_INIT_ASYNC, NULL);
22
214
    OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
23
214
    ERR_clear_error();
24
214
    return 1;
25
214
}
26
27
/*
28
 * Fuzzer input "protocol":
29
 *   Big endian
30
 *   u8(LCID length)
31
 *   Zero or more of:
32
 *     ENROL_ODCID          u0(0x00) u64(opaque) u8(cidl):cid
33
 *     RETIRE_ODCID         u8(0x01) u64(opaque)
34
 *     GENERATE_INITIAL     u8(0x02) u64(opaque)
35
 *     GENERATE             u8(0x03) u64(opaque)
36
 *     RETIRE               u8(0x04) u64(opaque) u64(retire_prior_to)
37
 *     CULL                 u8(0x05) u64(opaque)
38
 *     LOOKUP               u8(0x06) u8(cidl):cid
39
 */
40
41
enum {
42
    CMD_ENROL_ODCID,
43
    CMD_RETIRE_ODCID,
44
    CMD_GENERATE_INITIAL,
45
    CMD_GENERATE,
46
    CMD_RETIRE,
47
    CMD_CULL,
48
    CMD_LOOKUP
49
};
50
51
static int get_cid(PACKET *pkt, QUIC_CONN_ID *cid)
52
1.07M
{
53
1.07M
    unsigned int cidl;
54
55
1.07M
    if (!PACKET_get_1(pkt, &cidl)
56
1.07M
        || cidl > QUIC_MAX_CONN_ID_LEN
57
1.07M
        || !PACKET_copy_bytes(pkt, cid->id, cidl))
58
305
        return 0;
59
60
1.07M
    cid->id_len = (unsigned char)cidl;
61
1.07M
    return 1;
62
1.07M
}
63
64
int FuzzerTestOneInput(const uint8_t *buf, size_t len)
65
1.29k
{
66
1.29k
    int rc = 0;
67
1.29k
    QUIC_LCIDM *lcidm = NULL;
68
1.29k
    PACKET pkt;
69
1.29k
    uint64_t arg_opaque, arg_retire_prior_to, seq_num_out;
70
1.29k
    unsigned int cmd, lcidl;
71
1.29k
    QUIC_CONN_ID arg_cid, cid_out;
72
1.29k
    OSSL_QUIC_FRAME_NEW_CONN_ID ncid_frame;
73
1.29k
    int did_retire;
74
1.29k
    void *opaque_out;
75
76
1.29k
    if (!PACKET_buf_init(&pkt, buf, len))
77
0
        goto err;
78
79
1.29k
    if (!PACKET_get_1(&pkt, &lcidl)
80
1.29k
        || lcidl > QUIC_MAX_CONN_ID_LEN) {
81
4
        rc = -1;
82
4
        goto err;
83
4
    }
84
85
1.29k
    if ((lcidm = ossl_quic_lcidm_new(NULL, lcidl)) == NULL) {
86
0
        rc = -1;
87
0
        goto err;
88
0
    }
89
90
2.14M
    while (PACKET_remaining(&pkt) > 0) {
91
2.14M
        if (!PACKET_get_1(&pkt, &cmd))
92
0
            goto err;
93
94
2.14M
        switch (cmd) {
95
172k
        case CMD_ENROL_ODCID:
96
172k
            if (!PACKET_get_net_8(&pkt, &arg_opaque)
97
172k
                || !get_cid(&pkt, &arg_cid)) {
98
59
                rc = -1;
99
59
                goto err;
100
59
            }
101
102
172k
            ossl_quic_lcidm_enrol_odcid(lcidm, (void *)(uintptr_t)arg_opaque,
103
172k
                &arg_cid);
104
172k
            break;
105
106
12.0k
        case CMD_RETIRE_ODCID:
107
12.0k
            if (!PACKET_get_net_8(&pkt, &arg_opaque)) {
108
1
                rc = -1;
109
1
                goto err;
110
1
            }
111
112
12.0k
            ossl_quic_lcidm_retire_odcid(lcidm, (void *)(uintptr_t)arg_opaque);
113
12.0k
            break;
114
115
56.4k
        case CMD_GENERATE_INITIAL:
116
56.4k
            if (!PACKET_get_net_8(&pkt, &arg_opaque)) {
117
10
                rc = -1;
118
10
                goto err;
119
10
            }
120
121
56.4k
            ossl_quic_lcidm_generate_initial(lcidm, (void *)(uintptr_t)arg_opaque,
122
56.4k
                &cid_out);
123
56.4k
            break;
124
125
1.84M
        case CMD_GENERATE:
126
1.84M
            if (!PACKET_get_net_8(&pkt, &arg_opaque)) {
127
52
                rc = -1;
128
52
                goto err;
129
52
            }
130
131
1.84M
            ossl_quic_lcidm_generate(lcidm, (void *)(uintptr_t)arg_opaque,
132
1.84M
                &ncid_frame);
133
1.84M
            break;
134
135
23.8k
        case CMD_RETIRE:
136
23.8k
            if (!PACKET_get_net_8(&pkt, &arg_opaque)
137
23.8k
                || !PACKET_get_net_8(&pkt, &arg_retire_prior_to)) {
138
21
                rc = -1;
139
21
                goto err;
140
21
            }
141
142
23.8k
            ossl_quic_lcidm_retire(lcidm, (void *)(uintptr_t)arg_opaque,
143
23.8k
                arg_retire_prior_to,
144
23.8k
                NULL, &cid_out,
145
23.8k
                &seq_num_out, &did_retire);
146
23.8k
            break;
147
148
31.1k
        case CMD_CULL:
149
31.1k
            if (!PACKET_get_net_8(&pkt, &arg_opaque)) {
150
7
                rc = -1;
151
7
                goto err;
152
7
            }
153
154
31.1k
            ossl_quic_lcidm_cull(lcidm, (void *)(uintptr_t)arg_opaque);
155
31.1k
            break;
156
157
8.00k
        case CMD_LOOKUP:
158
8.00k
            if (!get_cid(&pkt, &arg_cid)) {
159
19
                rc = -1;
160
19
                goto err;
161
19
            }
162
163
7.99k
            ossl_quic_lcidm_lookup(lcidm, &arg_cid, &seq_num_out, &opaque_out);
164
7.99k
            break;
165
166
124
        default:
167
124
            rc = -1;
168
124
            goto err;
169
2.14M
        }
170
2.14M
    }
171
172
1.29k
err:
173
1.29k
    ossl_quic_lcidm_free(lcidm);
174
1.29k
    return rc;
175
1.29k
}
176
177
void FuzzerCleanup(void)
178
0
{
179
0
    FuzzerClearRand();
180
0
}