/src/unit/fuzzing/nxt_http_h1p_peer_fuzz.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright (C) NGINX, Inc. |
3 | | */ |
4 | | |
5 | | #include <nxt_main.h> |
6 | | |
7 | | /* DO NOT TRY THIS AT HOME! */ |
8 | | #include "nxt_h1proto.c" |
9 | | |
10 | | |
11 | 5.14k | #define KMININPUTLENGTH 2 |
12 | 2.57k | #define KMAXINPUTLENGTH 1024 |
13 | | |
14 | | |
15 | | extern int LLVMFuzzerInitialize(int *argc, char ***argv); |
16 | | extern int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size); |
17 | | |
18 | | |
19 | | extern char **environ; |
20 | | |
21 | | |
22 | | int |
23 | | LLVMFuzzerInitialize(int *argc, char ***argv) |
24 | 6 | { |
25 | 6 | nxt_int_t ret; |
26 | | |
27 | 6 | if (nxt_lib_start("fuzzing", NULL, &environ) != NXT_OK) { |
28 | 0 | return NXT_ERROR; |
29 | 0 | } |
30 | | |
31 | 6 | ret = nxt_http_fields_hash(&nxt_h1p_peer_fields_hash, |
32 | 6 | nxt_h1p_peer_fields, |
33 | 6 | nxt_nitems(nxt_h1p_peer_fields)); |
34 | 6 | if (ret != NXT_OK) { |
35 | 0 | return NXT_ERROR; |
36 | 0 | } |
37 | | |
38 | 6 | return 0; |
39 | 6 | } |
40 | | |
41 | | |
42 | | int |
43 | | LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) |
44 | 2.57k | { |
45 | 2.57k | nxt_mp_t *mp; |
46 | 2.57k | nxt_int_t rc; |
47 | 2.57k | nxt_buf_mem_t buf; |
48 | 2.57k | nxt_http_request_t *req; |
49 | 2.57k | nxt_http_request_parse_t rp; |
50 | | |
51 | 2.57k | if (size < KMININPUTLENGTH || size > KMAXINPUTLENGTH) { |
52 | 22 | return 0; |
53 | 22 | } |
54 | | |
55 | 2.54k | mp = nxt_mp_create(1024, 128, 256, 32); |
56 | 2.54k | if (mp == NULL) { |
57 | 0 | return 0; |
58 | 0 | } |
59 | | |
60 | 2.54k | req = nxt_mp_zget(mp, sizeof(nxt_http_request_t)); |
61 | 2.54k | if (req == NULL) { |
62 | 0 | goto failed; |
63 | 0 | } |
64 | | |
65 | 2.54k | req->peer = nxt_mp_zalloc(mp, sizeof(nxt_http_peer_t)); |
66 | 2.54k | if (req->peer == NULL) { |
67 | 0 | goto failed; |
68 | 0 | } |
69 | | |
70 | 2.54k | req->peer->proto.h1 = nxt_mp_zalloc(mp, sizeof(nxt_h1proto_t)); |
71 | 2.54k | if (req->peer->proto.h1 == NULL) { |
72 | 0 | goto failed; |
73 | 0 | } |
74 | | |
75 | 2.54k | buf.start = (u_char *)data; |
76 | 2.54k | buf.end = (u_char *)data + size; |
77 | 2.54k | buf.pos = buf.start; |
78 | 2.54k | buf.free = buf.end; |
79 | | |
80 | 2.54k | nxt_memzero(&rp, sizeof(nxt_http_request_parse_t)); |
81 | | |
82 | 2.54k | rc = nxt_http_parse_request_init(&rp, mp); |
83 | 2.54k | if (rc != NXT_OK) { |
84 | 0 | goto failed; |
85 | 0 | } |
86 | | |
87 | 2.54k | rc = nxt_http_parse_request(&rp, &buf); |
88 | 2.54k | if (rc != NXT_DONE) { |
89 | 2.06k | goto failed; |
90 | 2.06k | } |
91 | | |
92 | 482 | nxt_http_fields_process(rp.fields, &nxt_h1p_peer_fields_hash, req); |
93 | | |
94 | 2.54k | failed: |
95 | | |
96 | 2.54k | nxt_mp_destroy(mp); |
97 | | |
98 | 2.54k | return 0; |
99 | 482 | } |