From 76ed615b8a5331188c1387c711f01d768d510fa0 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Tue, 9 Mar 2021 10:52:32 +1300 Subject: [PATCH] add fuzz_talloc_string_sub family --- lib/fuzzing/fuzz_talloc_all_string_sub.c | 71 ++++++++++++++++++++++ lib/fuzzing/fuzz_talloc_string_sub.c | 71 ++++++++++++++++++++++ lib/fuzzing/fuzz_talloc_string_sub2.c | 76 ++++++++++++++++++++++++ lib/fuzzing/wscript_build | 15 +++++ 4 files changed, 233 insertions(+) create mode 100644 lib/fuzzing/fuzz_talloc_all_string_sub.c create mode 100644 lib/fuzzing/fuzz_talloc_string_sub.c create mode 100644 lib/fuzzing/fuzz_talloc_string_sub2.c diff --git a/lib/fuzzing/fuzz_talloc_all_string_sub.c b/lib/fuzzing/fuzz_talloc_all_string_sub.c new file mode 100644 index 00000000000..081c962e1dd --- /dev/null +++ b/lib/fuzzing/fuzz_talloc_all_string_sub.c @@ -0,0 +1,71 @@ +/* + Fuzz NMB parse_packet + Copyright (C) Catalyst IT 2020 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "source3/include/includes.h" +#include "libsmb/libsmb.h" +#include "util/bytearray.h" +#include "fuzzing/fuzzing.h" +//#include "util/substitute.h" + + +int LLVMFuzzerTestOneInput(uint8_t *input, size_t len) +{ + TALLOC_CTX *mem_ctx = NULL; + char *result = NULL; + char s[65536]; + char pattern[65536]; + char insert[65536]; + size_t pattern_len, insert_len; + + if (len < 4) { + return 0; + } + pattern_len = PULL_LE_U16(input, 0); + insert_len = PULL_LE_U16(input, 2); + input += 4; + len -= 4; + if (pattern_len + insert_len > len) { + return 0; + } + + len -= (pattern_len + insert_len); + if (len >= sizeof(s)) { + return 0; + } + memcpy(pattern, input, pattern_len); + pattern[pattern_len] = '\0'; + input += pattern_len; + + memcpy(insert, input, insert_len); + insert[insert_len] = '\0'; + input += insert_len; + + memcpy(s, input, len); + s[len] = '\0'; + mem_ctx = talloc_new(NULL); + result = talloc_all_string_sub(mem_ctx, s, pattern, insert); + talloc_free(mem_ctx); + + return 0; +} + + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} diff --git a/lib/fuzzing/fuzz_talloc_string_sub.c b/lib/fuzzing/fuzz_talloc_string_sub.c new file mode 100644 index 00000000000..0d5dd2a0248 --- /dev/null +++ b/lib/fuzzing/fuzz_talloc_string_sub.c @@ -0,0 +1,71 @@ +/* + Fuzz NMB parse_packet + Copyright (C) Catalyst IT 2020 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "source3/include/includes.h" +#include "libsmb/libsmb.h" +#include "util/bytearray.h" +#include "fuzzing/fuzzing.h" +//#include "util/substitute.h" + + +int LLVMFuzzerTestOneInput(uint8_t *input, size_t len) +{ + TALLOC_CTX *mem_ctx = NULL; + char *result = NULL; + char s[65536]; + char pattern[65536]; + char insert[65536]; + size_t pattern_len, insert_len; + + if (len < 4) { + return 0; + } + pattern_len = PULL_LE_U16(input, 0); + insert_len = PULL_LE_U16(input, 2); + input += 4; + len -= 4; + if (pattern_len + insert_len > len) { + return 0; + } + + len -= (pattern_len + insert_len); + if (len >= sizeof(s)) { + return 0; + } + memcpy(pattern, input, pattern_len); + pattern[pattern_len] = '\0'; + input += pattern_len; + + memcpy(insert, input, insert_len); + insert[insert_len] = '\0'; + input += insert_len; + + memcpy(s, input, len); + s[len] = '\0'; + mem_ctx = talloc_new(NULL); + result = talloc_string_sub(mem_ctx, s, pattern, insert); + talloc_free(mem_ctx); + + return 0; +} + + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} diff --git a/lib/fuzzing/fuzz_talloc_string_sub2.c b/lib/fuzzing/fuzz_talloc_string_sub2.c new file mode 100644 index 00000000000..26451a86783 --- /dev/null +++ b/lib/fuzzing/fuzz_talloc_string_sub2.c @@ -0,0 +1,76 @@ +/* + Fuzz NMB parse_packet + Copyright (C) Catalyst IT 2020 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "source3/include/includes.h" +#include "libsmb/libsmb.h" +#include "util/bytearray.h" +#include "fuzzing/fuzzing.h" +//#include "util/substitute.h" + + +int LLVMFuzzerTestOneInput(uint8_t *input, size_t len) +{ + TALLOC_CTX *mem_ctx = NULL; + char *result = NULL; + char s[65536]; + char pattern[65536]; + char insert[65536]; + size_t pattern_len, insert_len; + uint8_t flags; + + if (len < 5) { + return 0; + } + pattern_len = PULL_LE_U16(input, 0); + insert_len = PULL_LE_U16(input, 2); + flags = input[4]; + input += 5; + len -= 5; + if (pattern_len + insert_len > len) { + return 0; + } + + len -= (pattern_len + insert_len); + if (len >= sizeof(s)) { + return 0; + } + memcpy(pattern, input, pattern_len); + pattern[pattern_len] = '\0'; + input += pattern_len; + + memcpy(insert, input, insert_len); + insert[insert_len] = '\0'; + input += insert_len; + + memcpy(s, input, len); + s[len] = '\0'; + mem_ctx = talloc_new(NULL); + result = talloc_string_sub2(mem_ctx, s, pattern, insert, + flags & 1, + flags & 2, + flags & 4); + talloc_free(mem_ctx); + + return 0; +} + + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} diff --git a/lib/fuzzing/wscript_build b/lib/fuzzing/wscript_build index 7b74d2853f5..c026e9d8395 100644 --- a/lib/fuzzing/wscript_build +++ b/lib/fuzzing/wscript_build @@ -140,6 +140,21 @@ bld.SAMBA_BINARY('fuzz_string_sub_talloc', deps='fuzzing afl-fuzz-main charset samba-util-core', fuzzer=True) +bld.SAMBA_BINARY('fuzz_talloc_string_sub', + source='fuzz_talloc_string_sub.c', + deps='fuzzing afl-fuzz-main samba3-util', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_talloc_all_string_sub', + source='fuzz_talloc_all_string_sub.c', + deps='fuzzing afl-fuzz-main samba3-util', + fuzzer=True) + +bld.SAMBA_BINARY('fuzz_talloc_string_sub2', + source='fuzz_talloc_string_sub2.c', + deps='fuzzing afl-fuzz-main samba3-util', + fuzzer=True) + bld.SAMBA_BINARY('fuzz_string_sub', source='fuzz_string_sub.c', deps='fuzzing afl-fuzz-main charset samba-util-core', -- 2.25.1