Mercurial > dropbear
annotate fuzzer-verify.c @ 1631:292f79307600
fix some gcc warnings (#73)
* tweak string size
fix gcc8 warnings
```
svr-agentfwd.c: In function 'bindagent':
svr-agentfwd.c:254:53: warning: '%s' directive output may be truncated writing up to 107 bytes into a region of size between 0 and 107 [-Wformat-truncation=]
snprintf(addr.sun_path, sizeof(addr.sun_path), "%s/%s", path, sockfile);
^~ ~~~~~~~~
svr-agentfwd.c:254:2: note: 'snprintf' output between 2 and 216 bytes into a destination of size 108
snprintf(addr.sun_path, sizeof(addr.sun_path), "%s/%s", path, sockfile);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
* cleanup signed/unsigned comparison
fix gcc8 warnings
```
scp.c: In function 'do_local_cmd':
scp.c:132:17: warning: comparison of integer expressions of different signedness: 'u_int' {aka 'unsigned int'} and 'int' [-Wsign-compare]
for (i = 0; i < a->num; i++)
^
scpmisc.c: In function 'addargs':
scpmisc.c:161:25: warning: comparison of integer expressions of different signedness: 'int' and 'u_int' {aka 'unsigned int'} [-Wsign-compare]
} else if (args->num+2 >= nalloc)
^~
scpmisc.c: In function 'replacearg':
scpmisc.c:183:12: warning: comparison of integer expressions of different signedness: 'u_int' {aka 'unsigned int'} and 'int' [-Wsign-compare]
if (which >= args->num)
^~
scpmisc.c: In function 'freeargs':
scpmisc.c:196:17: warning: comparison of integer expressions of different signedness: 'u_int' {aka 'unsigned int'} and 'int' [-Wsign-compare]
for (i = 0; i < args->num; i++)
^
```
see https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/misc.h.diff?r1=1.16&r2=1.17
author | François Perrad <francois.perrad@gadz.org> |
---|---|
date | Wed, 20 Mar 2019 15:25:15 +0100 |
parents | 92c93b4a3646 |
children | f52919ffd3b1 |
rev | line source |
---|---|
1380 | 1 #include "fuzz.h" |
2 #include "session.h" | |
3 #include "fuzz-wrapfd.h" | |
4 #include "debug.h" | |
5 | |
6 static void setup_fuzzer(void) { | |
1456
a90fdd2d2ed8
add fuzzer-preauth_nomaths
Matt Johnston <matt@ucc.asn.au>
parents:
1380
diff
changeset
|
7 fuzz_common_setup(); |
1380 | 8 } |
9 | |
10 static buffer *verifydata; | |
11 | |
12 /* Tests reading a public key and verifying a signature */ | |
13 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { | |
14 static int once = 0; | |
15 if (!once) { | |
16 setup_fuzzer(); | |
17 verifydata = buf_new(30); | |
18 buf_putstring(verifydata, "x", 1); | |
19 once = 1; | |
20 } | |
21 | |
1456
a90fdd2d2ed8
add fuzzer-preauth_nomaths
Matt Johnston <matt@ucc.asn.au>
parents:
1380
diff
changeset
|
22 if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) { |
1380 | 23 return 0; |
24 } | |
25 | |
26 m_malloc_set_epoch(1); | |
27 | |
28 if (setjmp(fuzz.jmp) == 0) { | |
29 sign_key *key = new_sign_key(); | |
30 enum signkey_type type = DROPBEAR_SIGNKEY_ANY; | |
31 if (buf_get_pub_key(fuzz.input, key, &type) == DROPBEAR_SUCCESS) { | |
1529
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
32 if (buf_verify(fuzz.input, key, verifydata) == DROPBEAR_SUCCESS) { |
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
33 /* The fuzzer is capable of generating keys with a signature to match. |
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
34 We don't want false positives if the key is bogus, since a client/server |
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
35 wouldn't be trusting a bogus key anyway */ |
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
36 int boguskey = 0; |
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
37 |
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
38 if (type == DROPBEAR_SIGNKEY_DSS) { |
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
39 /* So far have seen dss keys with bad p/q/g domain parameters */ |
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
40 int pprime, qprime; |
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
41 assert(mp_prime_is_prime(key->dsskey->p, 5, &pprime) == MP_OKAY); |
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
42 assert(mp_prime_is_prime(key->dsskey->q, 18, &qprime) == MP_OKAY); |
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
43 boguskey = !(pprime && qprime); |
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
44 /* Could also check g**q mod p == 1 */ |
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
45 } |
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
46 |
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
47 if (!boguskey) { |
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
48 printf("Random key/signature managed to verify!\n"); |
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
49 abort(); |
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
50 } |
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
51 |
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
52 |
66a1a2547133
The fuzzer has managed to generated DSS key/signature pairs that
Matt Johnston <matt@ucc.asn.au>
parents:
1456
diff
changeset
|
53 } |
1380 | 54 } |
55 sign_key_free(key); | |
56 m_malloc_free_epoch(1, 0); | |
57 } else { | |
58 m_malloc_free_epoch(1, 1); | |
59 TRACE(("dropbear_exit longjmped")) | |
1559
92c93b4a3646
Fix to be able to compile normal(ish) binaries with --enable-fuzz
Matt Johnston <matt@ucc.asn.au>
parents:
1529
diff
changeset
|
60 /* dropbear_exit jumped here */ |
1380 | 61 } |
62 | |
63 return 0; | |
64 } |