/src/librabbitmq/fuzz/fuzz_server.c
Line  | Count  | Source (jump to first uncovered line)  | 
1  |  | // Copyright 2007 - 2022, Alan Antonuk and the rabbitmq-c contributors.  | 
2  |  | // SPDX-License-Identifier: mit  | 
3  |  |  | 
4  |  | #include <arpa/inet.h>  | 
5  |  | #include <netinet/in.h>  | 
6  |  | #include <pthread.h>  | 
7  |  | #include <stdint.h>  | 
8  |  | #include <stdio.h>  | 
9  |  | #include <stdlib.h>  | 
10  |  | #include <string.h>  | 
11  |  | #include <sys/socket.h>  | 
12  |  | #include <unistd.h>  | 
13  |  |  | 
14  |  | #include <rabbitmq-c/amqp.h>  | 
15  |  | #include <rabbitmq-c/tcp_socket.h>  | 
16  |  |  | 
17  |  | struct Fuzzer { | 
18  |  |   int socket;  | 
19  |  |   uint16_t port;  | 
20  |  |   pthread_t thread;  | 
21  |  |  | 
22  |  |   uint64_t size;  | 
23  |  |   uint8_t *buffer;  | 
24  |  | };  | 
25  |  | typedef struct Fuzzer Fuzzer;  | 
26  |  |  | 
27  | 0  | #define PORT 8080  | 
28  | 88  | #define kMinInputLength 9  | 
29  | 39  | #define kMaxInputLength 1024  | 
30  |  |  | 
31  |  | void client(Fuzzer *fuzzer);  | 
32  |  |  | 
33  | 0  | void fuzzinit(Fuzzer *fuzzer) { | 
34  | 0  |   struct sockaddr_in server_addr;  | 
35  | 0  |   fuzzer->socket = socket(AF_INET, SOCK_STREAM, 0);  | 
36  | 0  |   server_addr.sin_family = AF_INET;  | 
37  | 0  |   server_addr.sin_port = htons(fuzzer->port);  | 
38  | 0  |   server_addr.sin_addr.s_addr = inet_addr("127.0.0.1"); | 
39  | 0  |   setsockopt(fuzzer->socket, SOL_SOCKET, SO_REUSEADDR, &(int){1}, sizeof(int)); | 
40  | 0  |   bind(fuzzer->socket, (struct sockaddr *)&server_addr, sizeof(server_addr));  | 
41  | 0  |   listen(fuzzer->socket, 1);  | 
42  | 0  | }  | 
43  |  |  | 
44  | 0  | void *Server(void *args) { | 
45  | 0  |   Fuzzer *fuzzer = (Fuzzer *)args;  | 
46  |  | 
  | 
47  | 0  |   int client;  | 
48  | 0  |   char clientData[10240];  | 
49  | 0  |   struct sockaddr_in clientAddr;  | 
50  | 0  |   uint32_t clientSZ = sizeof(clientAddr);  | 
51  |  | 
  | 
52  | 0  |   client = accept(fuzzer->socket, (struct sockaddr *)&clientAddr, &clientSZ);  | 
53  |  | 
  | 
54  | 0  |   recv(client, clientData, sizeof(clientData), 0);  | 
55  | 0  |   send(client, fuzzer->buffer, fuzzer->size, 0);  | 
56  |  | 
  | 
57  | 0  |   shutdown(client, SHUT_RDWR);  | 
58  | 0  |   close(client);  | 
59  |  | 
  | 
60  | 0  |   pthread_exit(NULL);  | 
61  | 0  | }  | 
62  |  |  | 
63  | 0  | void clean(Fuzzer *fuzzer) { | 
64  | 0  |   shutdown(fuzzer->socket, SHUT_RDWR);  | 
65  | 0  |   close(fuzzer->socket);  | 
66  | 0  |   free(fuzzer);  | 
67  | 0  | }  | 
68  |  |  | 
69  | 44  | extern int LLVMFuzzerTestOneInput(const char *data, size_t size) { | 
70  |  |  | 
71  | 44  |   if (size < kMinInputLength || size > kMaxInputLength) { | 
72  | 44  |     return 0;  | 
73  | 44  |   }  | 
74  |  |  | 
75  | 0  |   Fuzzer *fuzzer = (Fuzzer *)malloc(sizeof(Fuzzer));  | 
76  | 0  |   fuzzer->port = PORT;  | 
77  |  | 
  | 
78  | 0  |   fuzzinit(fuzzer);  | 
79  |  | 
  | 
80  | 0  |   pthread_create(&fuzzer->thread, NULL, Server, fuzzer);  | 
81  |  | 
  | 
82  | 0  |   client(fuzzer);  | 
83  |  | 
  | 
84  | 0  |   pthread_join(fuzzer->thread, NULL);  | 
85  |  | 
  | 
86  | 0  |   clean(fuzzer);  | 
87  |  | 
  | 
88  | 0  |   return 0;  | 
89  | 44  | }  | 
90  |  |  | 
91  | 0  | void client(Fuzzer *fuzzer) { | 
92  | 0  |   char const *hostname;  | 
93  | 0  |   int status;  | 
94  | 0  |   amqp_socket_t *socket = NULL;  | 
95  | 0  |   amqp_connection_state_t conn;  | 
96  |  | 
  | 
97  | 0  |   hostname = "localhost";  | 
98  |  | 
  | 
99  | 0  |   conn = amqp_new_connection();  | 
100  |  | 
  | 
101  | 0  |   socket = amqp_tcp_socket_new(conn);  | 
102  | 0  |   if (!socket) { | 
103  | 0  |     exit(1);  | 
104  | 0  |   }  | 
105  |  |  | 
106  | 0  |   status = amqp_socket_open(socket, hostname, fuzzer->port);  | 
107  | 0  |   if (status) { | 
108  | 0  |     exit(1);  | 
109  | 0  |   }  | 
110  |  |  | 
111  | 0  |   amqp_login(conn, "/", 0, 131072, 0, AMQP_SASL_METHOD_PLAIN, "guest", "guest");  | 
112  |  | 
  | 
113  | 0  |   amqp_destroy_connection(conn);  | 
114  | 0  | }  | 
115  |  |  |