Coverage Report

Created: 2025-08-31 07:02

/src/fuzz_packet_id.c
Line
Count
Source (jump to first uncovered line)
1
/* Copyright 2021 Google LLC
2
Licensed under the Apache License, Version 2.0 (the "License");
3
you may not use this file except in compliance with the License.
4
You may obtain a copy of the License at
5
      http://www.apache.org/licenses/LICENSE-2.0
6
Unless required by applicable law or agreed to in writing, software
7
distributed under the License is distributed on an "AS IS" BASIS,
8
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
9
See the License for the specific language governing permissions and
10
limitations under the License.
11
*/
12
13
#include "config.h"
14
#include "syshead.h"
15
#include "init.h"
16
#include "packet_id.h"
17
18
#include "fuzz_randomizer.h"
19
20
793
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
21
793
  fuzz_random_init(data, size);
22
23
793
  struct packet_id pid;
24
793
  struct packet_id_net pin;
25
793
  const int seq_backtrack = 10;
26
793
  const int time_backtrack = 10;
27
28
793
  packet_id_init(&pid, seq_backtrack, time_backtrack, "name", 0);
29
30
793
  int total_sends = fuzz_randomizer_get_int(0, 10);
31
3.68k
  for (int i = 0; i < total_sends; i++) {
32
2.89k
    update_time();
33
2.89k
    pin.time = fuzz_randomizer_get_int(0, 0xfffffff);
34
2.89k
    pin.id = fuzz_randomizer_get_int(0, 0xfffffff);
35
36
2.89k
    packet_id_reap_test(&pid.rec);
37
2.89k
    bool test = packet_id_test(&pid.rec, &pin);
38
2.89k
    if (test) {
39
713
      packet_id_add(&pid.rec, &pin);
40
713
    }
41
2.89k
  }
42
793
  packet_id_free(&pid);
43
44
  // packet id send
45
793
  char *tmp2 = get_random_string();
46
793
  if (strlen(tmp2) > sizeof(struct packet_id_send)) {
47
165
    struct packet_id_send pidsend;
48
165
    memcmp(&pidsend, tmp2, sizeof(struct packet_id_send));
49
50
165
    struct timeval tv;
51
165
    tv.tv_sec = pidsend.time;
52
165
    tv.tv_usec = 0;
53
165
    if (localtime(&tv)) {
54
165
      struct buffer iv_buffer;
55
165
      buf_set_write(&iv_buffer, tmp2, strlen(tmp2));
56
165
      packet_id_write(&pidsend, &iv_buffer, false, false);
57
165
      packet_id_write(&pidsend, &iv_buffer, false, true);
58
165
      packet_id_write(&pidsend, &iv_buffer, true, true);
59
165
      packet_id_write(&pidsend, &iv_buffer, true, false);
60
165
    }
61
165
  }
62
793
  free(tmp2);
63
64
793
  struct gc_arena gc;
65
793
  gc = gc_new();
66
793
  struct buffer buf;
67
793
  char *tmp = get_random_string();
68
793
  buf = string_alloc_buf(tmp, &gc);
69
793
  free(tmp);
70
793
  packet_id_read(&pid, &buf, false);
71
793
  packet_id_read(&pid, &buf, true);
72
793
  gc_free(&gc);
73
74
793
  char filename[256];
75
793
  sprintf(filename, "/tmp/libfuzzer.%d", getpid());
76
77
793
  FILE *fp = fopen(filename, "wb");
78
793
  if (!fp) {
79
0
    return 0;
80
0
  }
81
793
  fwrite(data, size, 1, fp);
82
793
  fclose(fp);
83
 
84
793
  struct packet_id_persist p;
85
793
  memset(&p, 0, sizeof(struct packet_id_persist));
86
793
  packet_id_persist_init(&p);
87
793
  packet_id_persist_load(&p, filename);
88
  //p.time = NULL;
89
793
  struct timeval tv;
90
793
  tv.tv_sec = p.time;
91
793
  tv.tv_usec = 0;
92
793
  if (localtime(&tv) != NULL) {
93
594
    gc = gc_new();
94
594
    p.id_last_written = fuzz_randomizer_get_int(0, 0xfffffff);
95
    //packet_id_persist_print(&p, &gc);
96
594
    packet_id_persist_save(&p);
97
594
    gc_free(&gc);
98
594
  }
99
100
793
  packet_id_persist_close(&p); 
101
102
793
  fuzz_random_destroy();
103
793
  return 0;
104
793
}