Coverage Report

Created: 2026-05-24 07:14

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/openssl33/fuzz/quic-lcidm.c
Line
Count
Source
1
/*
2
 * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
3
 *
4
 * Licensed under the Apache License 2.0 (the "License");
5
 * you may not use this file except in compliance with the License.
6
 * You may obtain a copy of the License at
7
 * https://www.openssl.org/source/license.html
8
 * or in the file LICENSE in the source distribution.
9
 */
10
11
#include <openssl/ssl.h>
12
#include <openssl/err.h>
13
#include <openssl/bio.h>
14
#include "fuzzer.h"
15
#include "internal/quic_lcidm.h"
16
#include "internal/packet.h"
17
18
int FuzzerInitialize(int *argc, char ***argv)
19
216
{
20
216
    FuzzerSetRand();
21
216
    OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CRYPTO_STRINGS | OPENSSL_INIT_ASYNC, NULL);
22
216
    OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
23
216
    ERR_clear_error();
24
216
    return 1;
25
216
}
26
27
/*
28
 * Fuzzer input "protocol":
29
 *   Big endian
30
 *   u8(LCID length)
31
 *   Zero or more of:
32
 *     ENROL_ODCID          u0(0x00) u64(opaque) u8(cidl):cid
33
 *     RETIRE_ODCID         u8(0x01) u64(opaque)
34
 *     GENERATE_INITIAL     u8(0x02) u64(opaque)
35
 *     GENERATE             u8(0x03) u64(opaque)
36
 *     RETIRE               u8(0x04) u64(opaque) u64(retire_prior_to)
37
 *     CULL                 u8(0x05) u64(opaque)
38
 *     LOOKUP               u8(0x06) u8(cidl):cid
39
 */
40
41
enum {
42
    CMD_ENROL_ODCID,
43
    CMD_RETIRE_ODCID,
44
    CMD_GENERATE_INITIAL,
45
    CMD_GENERATE,
46
    CMD_RETIRE,
47
    CMD_CULL,
48
    CMD_LOOKUP
49
};
50
51
static int get_cid(PACKET *pkt, QUIC_CONN_ID *cid)
52
1.19M
{
53
1.19M
    unsigned int cidl;
54
55
1.19M
    if (!PACKET_get_1(pkt, &cidl)
56
1.19M
        || cidl > QUIC_MAX_CONN_ID_LEN
57
1.19M
        || !PACKET_copy_bytes(pkt, cid->id, cidl))
58
373
        return 0;
59
60
1.19M
    cid->id_len = (unsigned char)cidl;
61
1.19M
    return 1;
62
1.19M
}
63
64
int FuzzerTestOneInput(const uint8_t *buf, size_t len)
65
1.32k
{
66
1.32k
    int rc = 0;
67
1.32k
    QUIC_LCIDM *lcidm = NULL;
68
1.32k
    PACKET pkt;
69
1.32k
    uint64_t arg_opaque, arg_retire_prior_to, seq_num_out;
70
1.32k
    unsigned int cmd, lcidl;
71
1.32k
    QUIC_CONN_ID arg_cid, cid_out;
72
1.32k
    OSSL_QUIC_FRAME_NEW_CONN_ID ncid_frame;
73
1.32k
    int did_retire;
74
1.32k
    void *opaque_out;
75
76
1.32k
    if (!PACKET_buf_init(&pkt, buf, len))
77
0
        goto err;
78
79
1.32k
    if (!PACKET_get_1(&pkt, &lcidl)
80
1.32k
        || lcidl > QUIC_MAX_CONN_ID_LEN) {
81
4
        rc = -1;
82
4
        goto err;
83
4
    }
84
85
1.31k
    if ((lcidm = ossl_quic_lcidm_new(NULL, lcidl)) == NULL) {
86
0
        rc = -1;
87
0
        goto err;
88
0
    }
89
90
2.77M
    while (PACKET_remaining(&pkt) > 0) {
91
2.77M
        if (!PACKET_get_1(&pkt, &cmd))
92
0
            goto err;
93
94
2.77M
        switch (cmd) {
95
204k
        case CMD_ENROL_ODCID:
96
204k
            if (!PACKET_get_net_8(&pkt, &arg_opaque)
97
204k
                || !get_cid(&pkt, &arg_cid)) {
98
73
                rc = -1;
99
73
                goto err;
100
73
            }
101
102
204k
            ossl_quic_lcidm_enrol_odcid(lcidm, (void *)(uintptr_t)arg_opaque,
103
204k
                &arg_cid);
104
204k
            break;
105
106
11.5k
        case CMD_RETIRE_ODCID:
107
11.5k
            if (!PACKET_get_net_8(&pkt, &arg_opaque)) {
108
4
                rc = -1;
109
4
                goto err;
110
4
            }
111
112
11.5k
            ossl_quic_lcidm_retire_odcid(lcidm, (void *)(uintptr_t)arg_opaque);
113
11.5k
            break;
114
115
69.4k
        case CMD_GENERATE_INITIAL:
116
69.4k
            if (!PACKET_get_net_8(&pkt, &arg_opaque)) {
117
6
                rc = -1;
118
6
                goto err;
119
6
            }
120
121
69.4k
            ossl_quic_lcidm_generate_initial(lcidm, (void *)(uintptr_t)arg_opaque,
122
69.4k
                &cid_out);
123
69.4k
            break;
124
125
2.27M
        case CMD_GENERATE:
126
2.27M
            if (!PACKET_get_net_8(&pkt, &arg_opaque)) {
127
49
                rc = -1;
128
49
                goto err;
129
49
            }
130
131
2.27M
            ossl_quic_lcidm_generate(lcidm, (void *)(uintptr_t)arg_opaque,
132
2.27M
                &ncid_frame);
133
2.27M
            break;
134
135
29.6k
        case CMD_RETIRE:
136
29.6k
            if (!PACKET_get_net_8(&pkt, &arg_opaque)
137
29.6k
                || !PACKET_get_net_8(&pkt, &arg_retire_prior_to)) {
138
23
                rc = -1;
139
23
                goto err;
140
23
            }
141
142
29.6k
            ossl_quic_lcidm_retire(lcidm, (void *)(uintptr_t)arg_opaque,
143
29.6k
                arg_retire_prior_to,
144
29.6k
                NULL, &cid_out,
145
29.6k
                &seq_num_out, &did_retire);
146
29.6k
            break;
147
148
155k
        case CMD_CULL:
149
155k
            if (!PACKET_get_net_8(&pkt, &arg_opaque)) {
150
10
                rc = -1;
151
10
                goto err;
152
10
            }
153
154
155k
            ossl_quic_lcidm_cull(lcidm, (void *)(uintptr_t)arg_opaque);
155
155k
            break;
156
157
27.2k
        case CMD_LOOKUP:
158
27.2k
            if (!get_cid(&pkt, &arg_cid)) {
159
26
                rc = -1;
160
26
                goto err;
161
26
            }
162
163
27.2k
            ossl_quic_lcidm_lookup(lcidm, &arg_cid, &seq_num_out, &opaque_out);
164
27.2k
            break;
165
166
93
        default:
167
93
            rc = -1;
168
93
            goto err;
169
2.77M
        }
170
2.77M
    }
171
172
1.32k
err:
173
1.32k
    ossl_quic_lcidm_free(lcidm);
174
1.32k
    return rc;
175
1.31k
}
176
177
void FuzzerCleanup(void)
178
0
{
179
0
    FuzzerClearRand();
180
0
}