Coverage Report

Created: 2026-07-30 07:03

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/pjsip/tests/fuzz/fuzz-dns.c
Line
Count
Source
1
/* 
2
 * Copyright (C) 2023 Teluu Inc. (http://www.teluu.com)
3
 *
4
 * This program is free software; you can redistribute it and/or modify
5
 * it under the terms of the GNU General Public License as published by
6
 * the Free Software Foundation; either version 2 of the License, or
7
 * (at your option) any later version.
8
 *
9
 * This program is distributed in the hope that it will be useful,
10
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12
 * GNU General Public License for more details.
13
 *
14
 * You should have received a copy of the GNU General Public License
15
 * along with this program; if not, write to the Free Software
16
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA 
17
 */
18
#include <stdio.h>
19
#include <stdint.h>
20
#include <stdlib.h>
21
22
#include <pjlib.h>
23
24
#include <pjlib-util/dns.h>
25
26
27.3k
#define kMinInputLength 10
27
13.5k
#define kMaxInputLength 5120
28
29
pj_pool_factory *mem;
30
31
/* Exercise pj_dns_make_query */
32
static void dns_make_query_fuzz(const char *data, size_t size)
33
517
{
34
517
    static const pj_uint16_t qtypes[] = {
35
517
        PJ_DNS_TYPE_A, PJ_DNS_TYPE_CNAME, PJ_DNS_TYPE_NS,
36
517
        PJ_DNS_TYPE_PTR, PJ_DNS_TYPE_SRV, PJ_DNS_TYPE_AAAA
37
517
    };
38
517
    pj_pool_t *pool;
39
517
    pj_dns_parsed_packet *pkt;
40
517
    pj_str_t name;
41
517
    char qbuf[512];
42
517
    unsigned qbuf_size;
43
517
    int qtype;
44
45
517
    pool = pj_pool_create(mem, "dns_mkq", 2000, 2000, NULL);
46
517
    if (!pool) {
47
0
        return;
48
0
    }
49
50
517
    name.ptr = (char *)data;
51
517
    name.slen = (pj_ssize_t)(size > 63 ? 63 : size);
52
517
    qtype = (int)qtypes[(unsigned char)data[0] % 6];
53
517
    qbuf_size = sizeof(qbuf);
54
55
517
    if (pj_dns_make_query(qbuf, &qbuf_size, 0x1234, qtype, &name) == PJ_SUCCESS) {
56
517
        pkt = NULL;
57
517
        pj_dns_parse_packet(pool, qbuf, qbuf_size, &pkt);
58
517
    }
59
60
517
    pj_pool_release(pool);
61
517
}
62
63
int dns_parser(char *data, size_t size)
64
517
{
65
66
517
    int ret = 0;
67
517
  pj_pool_t *pool;
68
517
  pj_status_t status;
69
517
    pj_dns_parsed_packet *dns;
70
71
517
    pool = pj_pool_create(mem, "dns_test", 4000, 4000, NULL);
72
73
517
    status = pj_dns_parse_packet(pool, data, size, &dns);
74
517
    if (status != PJ_SUCCESS)
75
354
        ret = 1;
76
77
517
    pj_pool_release(pool);
78
79
517
    return ret;
80
517
}
81
82
extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
83
13.6k
{
84
13.6k
    int ret = 0;
85
13.6k
    char *data;
86
13.6k
    pj_caching_pool caching_pool;
87
88
13.6k
    if (Size < kMinInputLength || Size > kMaxInputLength) {
89
162
        return 1;
90
162
    }
91
92
    /* Add null termination for the data */
93
13.4k
    data = (char *)calloc((Size+1), sizeof(char));
94
13.4k
    memcpy((void *)data, (void *)Data, Size);
95
96
    /* Init */
97
13.4k
    pj_init();
98
13.4k
    pj_caching_pool_init(&caching_pool, &pj_pool_factory_default_policy, 0);
99
13.4k
    pj_log_set_level(0);
100
101
13.4k
    mem = &caching_pool.factory;
102
103
    /* Fuzz */
104
13.4k
    ret = dns_parser(data, Size);
105
13.4k
    dns_make_query_fuzz(data, Size);
106
107
13.4k
    free(data);
108
13.4k
    pj_caching_pool_destroy(&caching_pool);
109
110
13.4k
    return ret;
111
13.6k
}