Mercurial > dropbear
annotate fuzzer-kexdh.c @ 1650:009d52ae26d3 DROPBEAR_2019.78
Bump to 2019.78
author | Matt Johnston <matt@ucc.asn.au> |
---|---|
date | Wed, 27 Mar 2019 21:47:34 +0800 |
parents | a57822db3eac |
children |
rev | line source |
---|---|
1589 | 1 #include "fuzz.h" |
2 #include "session.h" | |
3 #include "fuzz-wrapfd.h" | |
4 #include "debug.h" | |
5 #include "runopts.h" | |
6 #include "algo.h" | |
7 #include "bignum.h" | |
8 | |
9 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { | |
10 static int once = 0; | |
11 static struct key_context* keep_newkeys = NULL; | |
1601
b711a8256919
reduce fuzzer-kexdh params count again, still hitting timeout
Matt Johnston <matt@ucc.asn.au>
parents:
1595
diff
changeset
|
12 /* number of generated parameters is limited by the timeout for the first run. |
b711a8256919
reduce fuzzer-kexdh params count again, still hitting timeout
Matt Johnston <matt@ucc.asn.au>
parents:
1595
diff
changeset
|
13 TODO move this to the libfuzzer initialiser function instead if the timeout |
b711a8256919
reduce fuzzer-kexdh params count again, still hitting timeout
Matt Johnston <matt@ucc.asn.au>
parents:
1595
diff
changeset
|
14 doesn't apply there */ |
b711a8256919
reduce fuzzer-kexdh params count again, still hitting timeout
Matt Johnston <matt@ucc.asn.au>
parents:
1595
diff
changeset
|
15 #define NUM_PARAMS 20 |
1589 | 16 static struct kex_dh_param *dh_params[NUM_PARAMS]; |
17 | |
18 if (!once) { | |
19 fuzz_common_setup(); | |
20 fuzz_svr_setup(); | |
21 | |
22 keep_newkeys = (struct key_context*)m_malloc(sizeof(struct key_context)); | |
23 keep_newkeys->algo_kex = fuzz_get_algo(sshkex, "diffie-hellman-group14-sha256"); | |
24 keep_newkeys->algo_hostkey = DROPBEAR_SIGNKEY_ECDSA_NISTP256; | |
25 ses.newkeys = keep_newkeys; | |
26 | |
27 /* Pre-generate parameters */ | |
28 int i; | |
29 for (i = 0; i < NUM_PARAMS; i++) { | |
30 dh_params[i] = gen_kexdh_param(); | |
31 } | |
32 | |
33 once = 1; | |
34 } | |
35 | |
36 if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) { | |
37 return 0; | |
38 } | |
39 | |
40 m_malloc_set_epoch(1); | |
41 | |
42 if (setjmp(fuzz.jmp) == 0) { | |
43 /* Based on recv_msg_kexdh_init()/send_msg_kexdh_reply() | |
44 with DROPBEAR_KEX_NORMAL_DH */ | |
45 ses.newkeys = keep_newkeys; | |
46 | |
47 /* Choose from the collection of ecdh params */ | |
48 unsigned int e = buf_getint(fuzz.input); | |
49 struct kex_dh_param * dh_param = dh_params[e % NUM_PARAMS]; | |
50 | |
51 DEF_MP_INT(dh_e); | |
52 m_mp_init(&dh_e); | |
53 if (buf_getmpint(fuzz.input, &dh_e) != DROPBEAR_SUCCESS) { | |
54 dropbear_exit("Bad kex value"); | |
55 } | |
56 | |
1606
98d2b125eb89
kexhashbuf was much to small in kex fuzzers
Matt Johnston <matt@ucc.asn.au>
parents:
1601
diff
changeset
|
57 ses.kexhashbuf = buf_new(KEXHASHBUF_MAX_INTS); |
1589 | 58 kexdh_comb_key(dh_param, &dh_e, svr_opts.hostkey); |
59 | |
1609 | 60 mp_clear(ses.dh_K); |
1589 | 61 m_free(ses.dh_K); |
62 mp_clear(&dh_e); | |
63 | |
1609 | 64 buf_free(ses.hash); |
65 buf_free(ses.session_id); | |
66 /* kexhashbuf is freed in kexdh_comb_key */ | |
67 | |
1589 | 68 m_malloc_free_epoch(1, 0); |
69 } else { | |
70 m_malloc_free_epoch(1, 1); | |
71 TRACE(("dropbear_exit longjmped")) | |
72 /* dropbear_exit jumped here */ | |
73 } | |
74 | |
75 return 0; | |
76 } |