Coverage Report

Created: 2023-06-07 06:14

/src/wolfmqtt-fuzzers/fuzzer.cpp
Line
Count
Source (jump to first uncovered line)
1
#include <fuzzing/datasource/datasource.hpp>
2
#include <wolfmqtt/mqtt_client.h>
3
#include <wolfmqtt/mqtt_packet.h>
4
#include <optional>
5
6
5.99k
#define CHECK_EQ(expr, res) if ( (expr) != (res) ) { goto end; }
7
#define CHECK_NE(expr, res) if ( (expr) == (res) ) { goto end; }
8
9
1.62k
#define BADPTR ((void*)0x12)
10
445
#define MAX_TOPICS 50
11
12
14.2k
#define DEBUG 0
13
14
class Base {
15
    protected:
16
        fuzzing::datasource::Datasource& ds;
17
        MqttQoS GetQoS(void) const;
18
    public:
19
        Base(fuzzing::datasource::Datasource& ds);
20
        ~Base();
21
};
22
23
Base::Base(fuzzing::datasource::Datasource& ds) :
24
    ds(ds)
25
2.32k
{ }
26
27
2.32k
Base::~Base() { }
28
29
1.44k
MqttQoS Base::GetQoS(void) const {
30
1.44k
    switch ( ds.Get<uint8_t>() % 3 ) {
31
1.18k
        case    0:
32
1.18k
            return MQTT_QOS_0;
33
177
        case    1:
34
177
            return MQTT_QOS_1;
35
87
        case    2:
36
87
            return MQTT_QOS_2;
37
0
        default:
38
            /* Silence compiler warning */
39
0
            abort();
40
1.44k
    }
41
1.44k
}
42
43
class Topic : public Base {
44
    private:
45
        MqttTopic* topic;
46
        std::vector<std::string> strings;
47
    public:
48
        Topic(fuzzing::datasource::Datasource& ds);
49
        ~Topic();
50
        bool Generate(void);
51
        MqttTopic Get(void);
52
};
53
54
Topic::Topic(fuzzing::datasource::Datasource& ds) :
55
1.06k
    Base(ds) {
56
1.06k
    topic = new MqttTopic;
57
1.06k
}
58
59
1.06k
Topic::~Topic() {
60
1.06k
    delete topic;
61
1.06k
}
62
63
1.06k
bool Topic::Generate(void) {
64
1.06k
    bool ret;
65
66
1.06k
    memset(topic, 0, sizeof(*topic));
67
68
1.06k
    strings.push_back( ds.Get<std::string>() );
69
1.06k
    topic->topic_filter = strings.back().c_str();
70
71
1.06k
    topic->qos = GetQoS();
72
73
1.06k
    ret = true;
74
1.06k
end:
75
939
    return ret;
76
1.06k
}
77
78
175
MqttTopic Topic::Get(void) {
79
175
    return *topic;
80
175
}
81
82
class Topics : public Base {
83
    private:
84
        std::vector<Topic*> topics;
85
    public:
86
        Topics(fuzzing::datasource::Datasource& ds);
87
        ~Topics();
88
        bool Generate(void);
89
        MqttTopic* ToArray(void);
90
        size_t Size(void) const;
91
};
92
93
Topics::Topics(fuzzing::datasource::Datasource& ds) :
94
    Base(ds)
95
445
{ }
96
97
445
Topics::~Topics() {
98
1.06k
    for (auto& t : topics) {
99
1.06k
        delete t;
100
1.06k
    }
101
445
}
102
        
103
445
bool Topics::Generate(void) {
104
445
    bool ret = false;
105
106
445
    try {
107
445
        const auto numTopics = ds.Get<uint16_t>() % (MAX_TOPICS+1);
108
109
1.51k
        for (size_t i = 0; i < numTopics; i++) {
110
1.06k
            topics.push_back(new Topic(ds));
111
1.06k
            CHECK_EQ(topics.back()->Generate(), true);
112
1.06k
        }
113
114
445
        ret = true;
115
445
    } catch ( ... ) { }
116
117
445
end:
118
445
    return ret;
119
445
}
120
121
310
MqttTopic* Topics::ToArray(void) {
122
310
    auto ret = new MqttTopic[topics.size()];
123
124
485
    for (size_t i = 0; i < Size(); i++) {
125
175
        ret[i] = topics[i]->Get();
126
175
    }
127
310
    return ret;
128
310
}
129
        
130
795
size_t Topics::Size(void) const {
131
795
    return topics.size();
132
795
}
133
134
class wolfMQTTFuzzer : public Base {
135
        MqttClient* client;
136
        MqttNet* net;
137
        MqttConnect* connect;
138
139
        uint8_t* tx_buf = nullptr, *rx_buf = nullptr;
140
        size_t tx_size = 0, rx_size = 0;
141
142
        std::string client_id;
143
144
        void* malloc(const size_t n);
145
        void free(void* ptr);
146
147
        word16 GetPacketId(void) const;
148
        std::optional<Topic> GetTopic(void) const;
149
150
        bool subscribe(void);
151
        bool unsubscribe(void);
152
        bool publish(void);
153
        bool ping(void);
154
        bool wait(void);
155
    public:
156
        wolfMQTTFuzzer(fuzzing::datasource::Datasource& ds);
157
        ~wolfMQTTFuzzer();
158
        bool Initialize(void);
159
        void Run(void);
160
        int recv(byte* buf, const int buf_len);
161
        int write(const int buf_len);
162
163
};
164
165
static int mqtt_connect(void *context, const char* host, word16 port, int timeout_ms)
166
786
{
167
786
    (void)context;
168
786
    (void)host;
169
786
    (void)port;
170
786
    (void)timeout_ms;
171
172
786
    return MQTT_CODE_SUCCESS;
173
786
}
174
175
static int mqtt_recv(void *context, byte* buf, int buf_len, int timeout_ms)
176
10.1k
{
177
10.1k
    (void)context;
178
10.1k
    (void)timeout_ms;
179
180
10.1k
    auto fuzzer = static_cast<wolfMQTTFuzzer*>(context);
181
10.1k
    return fuzzer->recv(buf, buf_len);
182
10.1k
}
183
184
static int mqtt_write(void *context, const byte* buf, int buf_len, int timeout_ms)
185
3.06k
{
186
3.06k
    (void)context;
187
3.06k
    (void)timeout_ms;
188
3.06k
    (void)buf;
189
190
3.06k
    auto fuzzer = static_cast<wolfMQTTFuzzer*>(context);
191
3.06k
    return fuzzer->write(buf_len);
192
3.06k
}
193
194
static int mqtt_disconnect(void *context)
195
30
{
196
30
    (void)context;
197
198
30
    return MQTT_CODE_SUCCESS;
199
30
}
200
201
static int mqtt_message_cb(MqttClient *client, MqttMessage *msg, byte msg_new, byte msg_done)
202
1.38k
{
203
1.38k
    return MQTT_CODE_SUCCESS;
204
1.38k
}
205
206
1.62k
void* wolfMQTTFuzzer::malloc(const size_t n) {
207
1.62k
    return n == 0 ? BADPTR : ::malloc(n);
208
1.62k
}
209
210
1.62k
void wolfMQTTFuzzer::free(void* ptr) {
211
1.62k
    if ( ptr == BADPTR ) {
212
0
        return;
213
0
    }
214
215
1.62k
    ::free(ptr);
216
1.62k
}
217
218
0
std::optional<Topic> wolfMQTTFuzzer::GetTopic(void) const {
219
0
    Topic topic(ds);
220
221
0
    if ( topic.Generate() == false ) {
222
0
        return std::nullopt;
223
0
    }
224
225
0
    return topic;
226
0
}
227
228
785
word16 wolfMQTTFuzzer::GetPacketId(void) const {
229
785
    return ds.Get<word16>();
230
785
}
231
232
339
bool wolfMQTTFuzzer::subscribe(void) {
233
339
    MqttTopic* topicsArray = nullptr;
234
339
    MqttSubscribe* subscribe = nullptr;
235
236
339
    bool ret = false;
237
238
339
    try {
239
339
        Topics topics(ds);
240
339
        CHECK_EQ(topics.Generate(), true);
241
242
222
        subscribe = new MqttSubscribe;
243
222
        memset(subscribe, 0, sizeof(*subscribe));
244
245
222
        subscribe->packet_id = GetPacketId();
246
222
        topicsArray = topics.ToArray();
247
222
        subscribe->topic_count = topics.Size();
248
222
        subscribe->topics = topicsArray;
249
250
222
        CHECK_EQ(MqttClient_Subscribe(client, subscribe), MQTT_CODE_SUCCESS);
251
252
74
        ret = true;
253
74
    } catch ( ... ) { }
254
255
339
end:
256
339
    if ( topicsArray ) {
257
221
        delete[] topicsArray;
258
221
    }
259
260
339
    if ( subscribe ) {
261
222
        delete subscribe;
262
222
    }
263
339
    return ret;
264
339
}
265
266
106
bool wolfMQTTFuzzer::unsubscribe(void) {
267
106
    MqttTopic* topicsArray = nullptr;
268
106
    MqttUnsubscribe* unsubscribe = nullptr;
269
270
106
    bool ret = false;
271
272
106
    try {
273
106
        Topics topics(ds);
274
106
        CHECK_EQ(topics.Generate(), true);
275
276
89
        unsubscribe = new MqttUnsubscribe;
277
89
        memset(unsubscribe, 0, sizeof(*unsubscribe));
278
279
89
        unsubscribe->packet_id = GetPacketId();
280
89
        topicsArray = topics.ToArray();
281
89
        unsubscribe->topic_count = topics.Size();
282
89
        unsubscribe->topics = topicsArray;
283
284
89
        CHECK_EQ(MqttClient_Unsubscribe(client, unsubscribe), MQTT_CODE_SUCCESS);
285
286
7
        ret = true;
287
7
    } catch ( ... ) { }
288
289
106
end:
290
106
    if ( topicsArray ) {
291
89
        delete[] topicsArray;
292
89
    }
293
294
106
    if ( unsubscribe ) {
295
89
        delete unsubscribe;
296
89
    }
297
298
106
    return ret;
299
106
}
300
301
491
bool wolfMQTTFuzzer::publish(void) {
302
491
    bool ret = false;
303
491
    MqttPublish* publish = nullptr;
304
305
491
    try {
306
491
        publish = new MqttPublish;
307
491
        memset(publish, 0, sizeof(*publish));
308
309
491
        publish->retain = ds.Get<bool>() ? 1 : 0;
310
491
        publish->qos = GetQoS();
311
491
        publish->duplicate = ds.Get<bool>() ? 1 : 0;
312
313
491
        const auto topic_str = ds.Get<std::string>();
314
491
        publish->topic_name = topic_str.c_str();
315
316
491
        publish->packet_id = GetPacketId();
317
318
491
        auto buffer = ds.GetData(0);
319
491
        publish->buffer = buffer.data();
320
491
        publish->total_len = buffer.size();
321
322
491
        if ( DEBUG ) {
323
0
            printf("publish: topic name size: %zu\n", strlen(topic_str.c_str()));
324
0
        }
325
326
491
        CHECK_EQ(MqttClient_Publish(client, publish), MQTT_CODE_SUCCESS);
327
328
88
        ret = true;
329
88
    } catch ( ... ) { }
330
331
491
end:
332
491
    if ( publish ) {
333
491
        delete publish;
334
491
    }
335
336
491
    return ret;
337
491
}
338
339
258
bool wolfMQTTFuzzer::ping(void) {
340
258
    bool ret = false;
341
342
258
    MqttPing* ping = new MqttPing;
343
258
    memset(ping, 0, sizeof(*ping));
344
345
258
    CHECK_EQ(MqttClient_Ping_ex(client, ping), true);
346
347
0
    ret = true;
348
349
258
end:
350
258
    delete ping;
351
352
258
    return ret;
353
0
}
354
355
181
bool wolfMQTTFuzzer::wait(void) {
356
181
    bool ret = false;
357
358
181
    CHECK_EQ(MqttClient_WaitMessage(client, 1000), MQTT_CODE_SUCCESS);
359
360
23
    ret = true;
361
362
181
end:
363
181
    return ret;
364
23
}
365
366
wolfMQTTFuzzer::wolfMQTTFuzzer(fuzzing::datasource::Datasource& ds) :
367
811
    Base(ds) {
368
811
        client = new MqttClient;
369
811
        net = new MqttNet;
370
811
        connect = new MqttConnect;
371
811
}
372
373
811
wolfMQTTFuzzer::~wolfMQTTFuzzer() {
374
811
    this->free(tx_buf);
375
811
    this->free(rx_buf);
376
811
    delete client;
377
811
    delete net;
378
811
    delete connect;
379
811
}
380
381
811
bool wolfMQTTFuzzer::Initialize(void) {
382
811
    bool ret = false;
383
811
    MqttMessage* lwt_msg = nullptr;
384
385
811
    try {
386
        /* net */
387
811
        {
388
811
            memset(net, 0, sizeof(*net));
389
390
811
            net->connect = mqtt_connect;
391
811
            net->read = mqtt_recv;
392
811
            net->write = mqtt_write;
393
811
            net->disconnect = mqtt_disconnect;
394
811
            net->context = this;
395
811
        }
396
397
        /* client */
398
811
        {
399
811
            memset(client, 0, sizeof(*client));
400
401
811
            tx_size = ds.Get<uint16_t>();
402
811
            tx_size = 4096;
403
811
            tx_buf = (uint8_t*)this->malloc(tx_size);
404
811
            rx_size = ds.Get<uint16_t>();
405
811
            rx_size = 4096;
406
811
            rx_buf = (uint8_t*)this->malloc(rx_size);
407
811
            memset(tx_buf, 0, tx_size);
408
811
            memset(rx_buf, 0, rx_size);
409
410
811
            client->msg_cb = mqtt_message_cb;
411
811
            client->tx_buf = tx_buf;
412
811
            client->tx_buf_len = tx_size;
413
811
            client->rx_buf = rx_buf;
414
811
            client->rx_buf_len = rx_size;
415
811
            client->cmd_timeout_ms = 1000;
416
811
        }
417
418
        /* connect */
419
811
        {
420
811
            memset(connect, 0, sizeof(*connect));
421
422
811
            connect->keep_alive_sec = 1;
423
811
            connect->clean_session = ds.Get<bool>() ? 1 : 0;
424
811
            client_id = ds.Get<std::string>();
425
811
            connect->client_id = client_id.c_str();
426
811
            connect->enable_lwt = ds.Get<bool>() ? 1 : 0;
427
811
        }
428
            
429
811
        std::string lwt_topic_name;
430
811
        std::vector<uint8_t> lwt_buffer;
431
432
811
        if ( connect->enable_lwt ) {
433
15
            lwt_topic_name = ds.Get<std::string>();
434
15
            lwt_buffer = ds.GetData(0);
435
436
15
            lwt_msg = new MqttMessage;
437
15
            memset(lwt_msg, 0, sizeof(*lwt_msg));
438
439
15
            connect->lwt_msg = lwt_msg;
440
15
            lwt_msg->qos = GetQoS();
441
15
            lwt_msg->retain = ds.Get<bool>() ? 1 : 0;
442
15
            lwt_msg->topic_name = lwt_topic_name.c_str();
443
15
            lwt_msg->buffer = lwt_buffer.data();
444
15
            lwt_msg->total_len = lwt_buffer.size();
445
15
        }
446
447
811
        CHECK_EQ(MqttSocket_Init(client, net), MQTT_CODE_SUCCESS);
448
449
#if 0
450
        if ( ds.Get<bool>() ) {
451
            //CHECK_EQ(MqttClient_SetPropertyCallback(&client, mqtt_property_cb, NULL);
452
        }
453
#endif
454
455
811
        CHECK_EQ(MqttClient_NetConnect(client, "dummy", 12345, 1000, 0, NULL), MQTT_CODE_SUCCESS);
456
811
        CHECK_EQ(MqttClient_Connect(client, connect), MQTT_CODE_SUCCESS);
457
458
542
        ret = true;
459
542
    } catch ( ... ) {
460
25
        ret = false;
461
25
    }
462
463
811
end:
464
811
    if ( lwt_msg ) {
465
15
        delete lwt_msg;
466
15
    }
467
811
    return ret;
468
811
}
469
470
517
void wolfMQTTFuzzer::Run(void) {
471
517
    try {
472
517
        const auto numActions = ds.Get<uint8_t>() % 20;
473
474
2.14k
        for (size_t i = 0; i < numActions; i++) {
475
2.10k
            switch ( ds.Get<uint8_t>() ) {
476
339
                case    0:
477
339
                    subscribe();
478
339
                    break;
479
106
                case    1:
480
106
                    unsubscribe();
481
106
                    break;
482
491
                case    2:
483
491
                    publish();
484
491
                    break;
485
258
                case    3:
486
258
                    ping();
487
258
                    break;
488
181
                case    4:
489
181
                    wait();
490
181
                    break;
491
2.10k
            }
492
2.10k
        }
493
494
49
        MqttClient_NetDisconnect(client);
495
487
    } catch ( ... ) { }
496
517
}
497
498
10.1k
int wolfMQTTFuzzer::recv(byte* buf, const int buf_len) {
499
10.1k
    try {
500
10.1k
        const auto data = ds.GetData(0);
501
10.1k
        const size_t copySize = buf_len > data.size() ? data.size() : buf_len;
502
10.1k
        if ( copySize ) {
503
8.53k
            memcpy(buf, data.data(), copySize);
504
8.53k
        }
505
10.1k
        if ( DEBUG )
506
0
        {
507
0
            printf("Recv: %zu bytes (%d requested)\n", copySize, buf_len);
508
0
            for (size_t i = 0; i < copySize; i++) {
509
0
                printf("%02X ", data[i]);
510
0
            }
511
0
            printf("\n");
512
0
        }
513
10.1k
        return copySize;
514
10.1k
    } catch ( ... ) {
515
547
        if ( DEBUG ) printf("Recv: -1\n");
516
547
        return -1;
517
547
    }
518
10.1k
}
519
520
3.06k
int wolfMQTTFuzzer::write(const int buf_len) {
521
3.06k
    try {
522
3.06k
        if ( ds.Get<bool>() == true ) {
523
172
            if ( DEBUG ) printf("write: -1\n");
524
172
            return -1;
525
172
        }
526
527
2.88k
        const auto ret = (int)(ds.Get<uint32_t>() % (buf_len+1));
528
2.88k
        if ( DEBUG ) printf("write: %d bytes (%d requested)\n", ret, buf_len);
529
2.88k
        return ret;
530
3.06k
    } catch ( ... ) {
531
300
        return -1;
532
300
    }
533
3.06k
}
534
535
811
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
536
811
    fuzzing::datasource::Datasource ds(data, size);
537
811
    wolfMQTTFuzzer fuzzer(ds);
538
539
811
    CHECK_EQ(fuzzer.Initialize(), true);
540
541
517
    fuzzer.Run();
542
543
811
end:
544
811
    return 0;
545
517
}