Mercurial > dropbear
annotate fuzzer-kexdh.c @ 1728:01fb08c43b85
merge
| author | Matt Johnston <matt@ucc.asn.au> |
|---|---|
| date | Tue, 23 Jun 2020 22:25:57 +0800 |
| parents | a57822db3eac |
| children |
| rev | line source |
|---|---|
| 1589 | 1 #include "fuzz.h" |
| 2 #include "session.h" | |
| 3 #include "fuzz-wrapfd.h" | |
| 4 #include "debug.h" | |
| 5 #include "runopts.h" | |
| 6 #include "algo.h" | |
| 7 #include "bignum.h" | |
| 8 | |
| 9 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { | |
| 10 static int once = 0; | |
| 11 static struct key_context* keep_newkeys = NULL; | |
|
1601
b711a8256919
reduce fuzzer-kexdh params count again, still hitting timeout
Matt Johnston <matt@ucc.asn.au>
parents:
1595
diff
changeset
|
12 /* number of generated parameters is limited by the timeout for the first run. |
|
b711a8256919
reduce fuzzer-kexdh params count again, still hitting timeout
Matt Johnston <matt@ucc.asn.au>
parents:
1595
diff
changeset
|
13 TODO move this to the libfuzzer initialiser function instead if the timeout |
|
b711a8256919
reduce fuzzer-kexdh params count again, still hitting timeout
Matt Johnston <matt@ucc.asn.au>
parents:
1595
diff
changeset
|
14 doesn't apply there */ |
|
b711a8256919
reduce fuzzer-kexdh params count again, still hitting timeout
Matt Johnston <matt@ucc.asn.au>
parents:
1595
diff
changeset
|
15 #define NUM_PARAMS 20 |
| 1589 | 16 static struct kex_dh_param *dh_params[NUM_PARAMS]; |
| 17 | |
| 18 if (!once) { | |
| 19 fuzz_common_setup(); | |
| 20 fuzz_svr_setup(); | |
| 21 | |
| 22 keep_newkeys = (struct key_context*)m_malloc(sizeof(struct key_context)); | |
| 23 keep_newkeys->algo_kex = fuzz_get_algo(sshkex, "diffie-hellman-group14-sha256"); | |
| 24 keep_newkeys->algo_hostkey = DROPBEAR_SIGNKEY_ECDSA_NISTP256; | |
| 25 ses.newkeys = keep_newkeys; | |
| 26 | |
| 27 /* Pre-generate parameters */ | |
| 28 int i; | |
| 29 for (i = 0; i < NUM_PARAMS; i++) { | |
| 30 dh_params[i] = gen_kexdh_param(); | |
| 31 } | |
| 32 | |
| 33 once = 1; | |
| 34 } | |
| 35 | |
| 36 if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) { | |
| 37 return 0; | |
| 38 } | |
| 39 | |
| 40 m_malloc_set_epoch(1); | |
| 41 | |
| 42 if (setjmp(fuzz.jmp) == 0) { | |
| 43 /* Based on recv_msg_kexdh_init()/send_msg_kexdh_reply() | |
| 44 with DROPBEAR_KEX_NORMAL_DH */ | |
| 45 ses.newkeys = keep_newkeys; | |
| 46 | |
| 47 /* Choose from the collection of ecdh params */ | |
| 48 unsigned int e = buf_getint(fuzz.input); | |
| 49 struct kex_dh_param * dh_param = dh_params[e % NUM_PARAMS]; | |
| 50 | |
| 51 DEF_MP_INT(dh_e); | |
| 52 m_mp_init(&dh_e); | |
| 53 if (buf_getmpint(fuzz.input, &dh_e) != DROPBEAR_SUCCESS) { | |
| 54 dropbear_exit("Bad kex value"); | |
| 55 } | |
| 56 | |
|
1606
98d2b125eb89
kexhashbuf was much to small in kex fuzzers
Matt Johnston <matt@ucc.asn.au>
parents:
1601
diff
changeset
|
57 ses.kexhashbuf = buf_new(KEXHASHBUF_MAX_INTS); |
| 1589 | 58 kexdh_comb_key(dh_param, &dh_e, svr_opts.hostkey); |
| 59 | |
| 1609 | 60 mp_clear(ses.dh_K); |
| 1589 | 61 m_free(ses.dh_K); |
| 62 mp_clear(&dh_e); | |
| 63 | |
| 1609 | 64 buf_free(ses.hash); |
| 65 buf_free(ses.session_id); | |
| 66 /* kexhashbuf is freed in kexdh_comb_key */ | |
| 67 | |
| 1589 | 68 m_malloc_free_epoch(1, 0); |
| 69 } else { | |
| 70 m_malloc_free_epoch(1, 1); | |
| 71 TRACE(("dropbear_exit longjmped")) | |
| 72 /* dropbear_exit jumped here */ | |
| 73 } | |
| 74 | |
| 75 return 0; | |
| 76 } |