Coverage Report

Created: 2026-08-14 06:46

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/strongswan/fuzz/fuzz_pb_tnc.c
Line
Count
Source
1
/*
2
 * Copyright (C) 2018 Andreas Steffen
3
 *
4
 * Copyright (C) secunet Security Networks AG
5
 *
6
 * This program is free software; you can redistribute it and/or modify it
7
 * under the terms of the GNU General Public License as published by the
8
 * Free Software Foundation; either version 2 of the License, or (at your
9
 * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
10
 *
11
 * This program is distributed in the hope that it will be useful, but
12
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
14
 * for more details.
15
 */
16
17
#include <library.h>
18
#include <batch/pb_tnc_batch.h>
19
#include <messages/ietf/pb_error_msg.h>
20
#include <state_machine/pb_tnc_state_machine.h>
21
#include <utils/debug.h>
22
23
int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
24
1.70k
{
25
1.70k
  pb_tnc_batch_t *batch;
26
1.70k
  pb_tnc_state_machine_t *state;
27
1.70k
  pb_tnc_msg_t *msg;
28
1.70k
  pb_error_msg_t *error;
29
1.70k
  enumerator_t *enumerator;
30
1.70k
  bool from_server;
31
1.70k
  chunk_t chunk;
32
33
1.70k
  dbg_default_set_level(-1);
34
1.70k
  library_init(NULL, "fuzz_pb_tnc");
35
36
1.70k
  chunk = chunk_create((u_char*)buf, len);
37
38
1.70k
  INIT(state,
39
1.70k
    .receive_batch = (void*)return_true,
40
1.70k
    .set_empty_cdata = (void*)nop,
41
1.70k
  );
42
43
  /* parse incoming PB-TNC batch */
44
1.70k
  batch = pb_tnc_batch_create_from_data(chunk);
45
1.70k
  if (batch->process_header(batch, TRUE, FALSE, &from_server) == SUCCESS ||
46
1.15k
    batch->process_header(batch, TRUE, TRUE, &from_server) == SUCCESS)
47
1.59k
  {
48
1.59k
    batch->process(batch, state);
49
1.59k
  }
50
51
  /* enumerate correctly decoded PB-TNC messages */
52
1.70k
  enumerator = batch->create_msg_enumerator(batch);
53
85.9k
  while (enumerator->enumerate(enumerator, &msg))
54
84.2k
  {
55
84.2k
    msg->get_type(msg);
56
84.2k
  }
57
1.70k
  enumerator->destroy(enumerator);
58
59
  /* enumerate errors detected while parsing PB-TNC batch and messages */
60
1.70k
  enumerator = batch->create_error_enumerator(batch);
61
4.08k
  while (enumerator->enumerate(enumerator, &msg))
62
2.37k
  {
63
2.37k
    error = (pb_error_msg_t*)msg;
64
2.37k
    error->get_error_code(error);
65
2.37k
  }
66
1.70k
  enumerator->destroy(enumerator);
67
68
1.70k
  batch->destroy(batch);
69
70
1.70k
  free(state);
71
1.70k
  library_deinit();
72
1.70k
  return 0;
73
1.70k
}