Coverage Report

Created: 2026-02-14 07:20

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/openssl33/fuzz/quic-lcidm.c
Line
Count
Source
1
/*
2
 * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
3
 *
4
 * Licensed under the Apache License 2.0 (the "License");
5
 * you may not use this file except in compliance with the License.
6
 * You may obtain a copy of the License at
7
 * https://www.openssl.org/source/license.html
8
 * or in the file LICENSE in the source distribution.
9
 */
10
11
#include <openssl/ssl.h>
12
#include <openssl/err.h>
13
#include <openssl/bio.h>
14
#include "fuzzer.h"
15
#include "internal/quic_lcidm.h"
16
#include "internal/packet.h"
17
18
int FuzzerInitialize(int *argc, char ***argv)
19
216
{
20
216
    FuzzerSetRand();
21
216
    OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS | OPENSSL_INIT_ASYNC, NULL);
22
216
    OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
23
216
    ERR_clear_error();
24
216
    return 1;
25
216
}
26
27
/*
28
 * Fuzzer input "protocol":
29
 *   Big endian
30
 *   u8(LCID length)
31
 *   Zero or more of:
32
 *     ENROL_ODCID          u0(0x00) u64(opaque) u8(cidl):cid
33
 *     RETIRE_ODCID         u8(0x01) u64(opaque)
34
 *     GENERATE_INITIAL     u8(0x02) u64(opaque)
35
 *     GENERATE             u8(0x03) u64(opaque)
36
 *     RETIRE               u8(0x04) u64(opaque) u64(retire_prior_to)
37
 *     CULL                 u8(0x05) u64(opaque)
38
 *     LOOKUP               u8(0x06) u8(cidl):cid
39
 */
40
41
enum {
42
    CMD_ENROL_ODCID,
43
    CMD_RETIRE_ODCID,
44
    CMD_GENERATE_INITIAL,
45
    CMD_GENERATE,
46
    CMD_RETIRE,
47
    CMD_CULL,
48
    CMD_LOOKUP
49
};
50
51
static int get_cid(PACKET *pkt, QUIC_CONN_ID *cid)
52
1.06M
{
53
1.06M
    unsigned int cidl;
54
55
1.06M
    if (!PACKET_get_1(pkt, &cidl)
56
1.06M
        || cidl > QUIC_MAX_CONN_ID_LEN
57
1.06M
        || !PACKET_copy_bytes(pkt, cid->id, cidl))
58
340
        return 0;
59
60
1.06M
    cid->id_len = (unsigned char)cidl;
61
1.06M
    return 1;
62
1.06M
}
63
64
int FuzzerTestOneInput(const uint8_t *buf, size_t len)
65
1.27k
{
66
1.27k
    int rc = 0;
67
1.27k
    QUIC_LCIDM *lcidm = NULL;
68
1.27k
    PACKET pkt;
69
1.27k
    uint64_t arg_opaque, arg_retire_prior_to, seq_num_out;
70
1.27k
    unsigned int cmd, lcidl;
71
1.27k
    QUIC_CONN_ID arg_cid, cid_out;
72
1.27k
    OSSL_QUIC_FRAME_NEW_CONN_ID ncid_frame;
73
1.27k
    int did_retire;
74
1.27k
    void *opaque_out;
75
76
1.27k
    if (!PACKET_buf_init(&pkt, buf, len))
77
0
        goto err;
78
79
1.27k
    if (!PACKET_get_1(&pkt, &lcidl)
80
1.27k
        || lcidl > QUIC_MAX_CONN_ID_LEN) {
81
3
        rc = -1;
82
3
        goto err;
83
3
    }
84
85
1.26k
    if ((lcidm = ossl_quic_lcidm_new(NULL, lcidl)) == NULL) {
86
0
        rc = -1;
87
0
        goto err;
88
0
    }
89
90
2.09M
    while (PACKET_remaining(&pkt) > 0) {
91
2.09M
        if (!PACKET_get_1(&pkt, &cmd))
92
0
            goto err;
93
94
2.09M
        switch (cmd) {
95
173k
        case CMD_ENROL_ODCID:
96
173k
            if (!PACKET_get_net_8(&pkt, &arg_opaque)
97
173k
                || !get_cid(&pkt, &arg_cid)) {
98
57
                rc = -1;
99
57
                goto err;
100
57
            }
101
102
173k
            ossl_quic_lcidm_enrol_odcid(lcidm, (void *)(uintptr_t)arg_opaque,
103
173k
                &arg_cid);
104
173k
            break;
105
106
10.8k
        case CMD_RETIRE_ODCID:
107
10.8k
            if (!PACKET_get_net_8(&pkt, &arg_opaque)) {
108
2
                rc = -1;
109
2
                goto err;
110
2
            }
111
112
10.8k
            ossl_quic_lcidm_retire_odcid(lcidm, (void *)(uintptr_t)arg_opaque);
113
10.8k
            break;
114
115
51.4k
        case CMD_GENERATE_INITIAL:
116
51.4k
            if (!PACKET_get_net_8(&pkt, &arg_opaque)) {
117
11
                rc = -1;
118
11
                goto err;
119
11
            }
120
121
51.4k
            ossl_quic_lcidm_generate_initial(lcidm, (void *)(uintptr_t)arg_opaque,
122
51.4k
                &cid_out);
123
51.4k
            break;
124
125
1.79M
        case CMD_GENERATE:
126
1.79M
            if (!PACKET_get_net_8(&pkt, &arg_opaque)) {
127
48
                rc = -1;
128
48
                goto err;
129
48
            }
130
131
1.79M
            ossl_quic_lcidm_generate(lcidm, (void *)(uintptr_t)arg_opaque,
132
1.79M
                &ncid_frame);
133
1.79M
            break;
134
135
24.2k
        case CMD_RETIRE:
136
24.2k
            if (!PACKET_get_net_8(&pkt, &arg_opaque)
137
24.2k
                || !PACKET_get_net_8(&pkt, &arg_retire_prior_to)) {
138
21
                rc = -1;
139
21
                goto err;
140
21
            }
141
142
24.1k
            ossl_quic_lcidm_retire(lcidm, (void *)(uintptr_t)arg_opaque,
143
24.1k
                arg_retire_prior_to,
144
24.1k
                NULL, &cid_out,
145
24.1k
                &seq_num_out, &did_retire);
146
24.1k
            break;
147
148
26.8k
        case CMD_CULL:
149
26.8k
            if (!PACKET_get_net_8(&pkt, &arg_opaque)) {
150
9
                rc = -1;
151
9
                goto err;
152
9
            }
153
154
26.8k
            ossl_quic_lcidm_cull(lcidm, (void *)(uintptr_t)arg_opaque);
155
26.8k
            break;
156
157
7.53k
        case CMD_LOOKUP:
158
7.53k
            if (!get_cid(&pkt, &arg_cid)) {
159
20
                rc = -1;
160
20
                goto err;
161
20
            }
162
163
7.51k
            ossl_quic_lcidm_lookup(lcidm, &arg_cid, &seq_num_out, &opaque_out);
164
7.51k
            break;
165
166
108
        default:
167
108
            rc = -1;
168
108
            goto err;
169
2.09M
        }
170
2.09M
    }
171
172
1.27k
err:
173
1.27k
    ossl_quic_lcidm_free(lcidm);
174
1.27k
    return rc;
175
1.26k
}
176
177
void FuzzerCleanup(void)
178
0
{
179
0
    FuzzerClearRand();
180
0
}