dropbear: fuzz-common.c annotate

annotate fuzz-common.c @ 1528:b9e4fd5a0e72 fuzz

compile fixes

author	Matt Johnston <matt@ucc.asn.au>
date	Wed, 21 Feb 2018 21:03:42 +0800
parents	32f990cc96b1
children	66a1a2547133

rev	line source
1348 5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	1 #include "includes.h"
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	2
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	3 #include "includes.h"
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	4 #include "fuzz.h"
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	5 #include "dbutil.h"
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	6 #include "runopts.h"
1353 f3c8975de38e setup svr_dropbear_exit Matt Johnston <matt@ucc.asn.au> parents: 1350 diff changeset	7 #include "crypto_desc.h"
f3c8975de38e setup svr_dropbear_exit Matt Johnston <matt@ucc.asn.au> parents: 1350 diff changeset	8 #include "session.h"
1356 3677a510f545 add wrapfd. improve fuzzer in makefile Matt Johnston <matt@ucc.asn.au> parents: 1353 diff changeset	9 #include "dbrandom.h"
1457 32f990cc96b1 fix bad assertion Matt Johnston <matt@ucc.asn.au> parents: 1456 diff changeset	10 #include "bignum.h"
1356 3677a510f545 add wrapfd. improve fuzzer in makefile Matt Johnston <matt@ucc.asn.au> parents: 1353 diff changeset	11 #include "fuzz-wrapfd.h"
1348 5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	12
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	13 struct dropbear_fuzz_options fuzz;
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	14
1373 9891bc31a1b3 fuzzers disable logging by default Matt Johnston <matt@ucc.asn.au> parents: 1369 diff changeset	15 static void fuzz_dropbear_log(int UNUSED(priority), const char* format, va_list param);
1348 5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	16 static void load_fixed_hostkeys(void);
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	17
1456 a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	18 void fuzz_common_setup(void) {
1348 5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	19 fuzz.fuzzing = 1;
1357 08f4fa4dc6a0 closer to working Matt Johnston <matt@ucc.asn.au> parents: 1356 diff changeset	20 fuzz.wrapfds = 1;
1385 6c92e97553f1 Add a flag whether to longjmp, missed that last commit Matt Johnston <matt@ucc.asn.au> parents: 1383 diff changeset	21 fuzz.do_jmp = 1;
1356 3677a510f545 add wrapfd. improve fuzzer in makefile Matt Johnston <matt@ucc.asn.au> parents: 1353 diff changeset	22 fuzz.input = m_malloc(sizeof(buffer));
1373 9891bc31a1b3 fuzzers disable logging by default Matt Johnston <matt@ucc.asn.au> parents: 1369 diff changeset	23 _dropbear_log = fuzz_dropbear_log;
1350 2722f2347a48 crypto_init() Matt Johnston <matt@ucc.asn.au> parents: 1348 diff changeset	24 crypto_init();
1348 5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	25 }
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	26
1456 a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	27 int fuzz_set_input(const uint8_t *Data, size_t Size) {
1356 3677a510f545 add wrapfd. improve fuzzer in makefile Matt Johnston <matt@ucc.asn.au> parents: 1353 diff changeset	28
3677a510f545 add wrapfd. improve fuzzer in makefile Matt Johnston <matt@ucc.asn.au> parents: 1353 diff changeset	29 fuzz.input->data = (unsigned char*)Data;
3677a510f545 add wrapfd. improve fuzzer in makefile Matt Johnston <matt@ucc.asn.au> parents: 1353 diff changeset	30 fuzz.input->size = Size;
3677a510f545 add wrapfd. improve fuzzer in makefile Matt Johnston <matt@ucc.asn.au> parents: 1353 diff changeset	31 fuzz.input->len = Size;
3677a510f545 add wrapfd. improve fuzzer in makefile Matt Johnston <matt@ucc.asn.au> parents: 1353 diff changeset	32 fuzz.input->pos = 0;
3677a510f545 add wrapfd. improve fuzzer in makefile Matt Johnston <matt@ucc.asn.au> parents: 1353 diff changeset	33
1358 6b89eb92f872 glaring wrapfd problems fixed Matt Johnston <matt@ucc.asn.au> parents: 1357 diff changeset	34 memset(&ses, 0x0, sizeof(ses));
6b89eb92f872 glaring wrapfd problems fixed Matt Johnston <matt@ucc.asn.au> parents: 1357 diff changeset	35 memset(&svr_ses, 0x0, sizeof(svr_ses));
1377 d4cc85e6c569 rearrange, all fuzzers now call fuzzer_set_input() Matt Johnston <matt@ucc.asn.au> parents: 1373 diff changeset	36 wrapfd_setup();
1356 3677a510f545 add wrapfd. improve fuzzer in makefile Matt Johnston <matt@ucc.asn.au> parents: 1353 diff changeset	37
1369 ddfcadca3c4c fuzzer-pubkey Matt Johnston <matt@ucc.asn.au> parents: 1358 diff changeset	38 fuzz_seed();
1356 3677a510f545 add wrapfd. improve fuzzer in makefile Matt Johnston <matt@ucc.asn.au> parents: 1353 diff changeset	39
3677a510f545 add wrapfd. improve fuzzer in makefile Matt Johnston <matt@ucc.asn.au> parents: 1353 diff changeset	40 return DROPBEAR_SUCCESS;
3677a510f545 add wrapfd. improve fuzzer in makefile Matt Johnston <matt@ucc.asn.au> parents: 1353 diff changeset	41 }
3677a510f545 add wrapfd. improve fuzzer in makefile Matt Johnston <matt@ucc.asn.au> parents: 1353 diff changeset	42
1373 9891bc31a1b3 fuzzers disable logging by default Matt Johnston <matt@ucc.asn.au> parents: 1369 diff changeset	43 static void fuzz_dropbear_log(int UNUSED(priority), const char* format, va_list param) {
9891bc31a1b3 fuzzers disable logging by default Matt Johnston <matt@ucc.asn.au> parents: 1369 diff changeset	44
9891bc31a1b3 fuzzers disable logging by default Matt Johnston <matt@ucc.asn.au> parents: 1369 diff changeset	45 char printbuf[1024];
9891bc31a1b3 fuzzers disable logging by default Matt Johnston <matt@ucc.asn.au> parents: 1369 diff changeset	46
9891bc31a1b3 fuzzers disable logging by default Matt Johnston <matt@ucc.asn.au> parents: 1369 diff changeset	47 #if DEBUG_TRACE
9891bc31a1b3 fuzzers disable logging by default Matt Johnston <matt@ucc.asn.au> parents: 1369 diff changeset	48 if (debug_trace) {
9891bc31a1b3 fuzzers disable logging by default Matt Johnston <matt@ucc.asn.au> parents: 1369 diff changeset	49 vsnprintf(printbuf, sizeof(printbuf), format, param);
9891bc31a1b3 fuzzers disable logging by default Matt Johnston <matt@ucc.asn.au> parents: 1369 diff changeset	50 fprintf(stderr, "%s\n", printbuf);
9891bc31a1b3 fuzzers disable logging by default Matt Johnston <matt@ucc.asn.au> parents: 1369 diff changeset	51 }
9891bc31a1b3 fuzzers disable logging by default Matt Johnston <matt@ucc.asn.au> parents: 1369 diff changeset	52 #endif
9891bc31a1b3 fuzzers disable logging by default Matt Johnston <matt@ucc.asn.au> parents: 1369 diff changeset	53 }
1356 3677a510f545 add wrapfd. improve fuzzer in makefile Matt Johnston <matt@ucc.asn.au> parents: 1353 diff changeset	54
1456 a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	55 void fuzz_svr_setup(void) {
1348 5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	56 struct passwd *pw;
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	57
1456 a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	58 fuzz_common_setup();
1353 f3c8975de38e setup svr_dropbear_exit Matt Johnston <matt@ucc.asn.au> parents: 1350 diff changeset	59
f3c8975de38e setup svr_dropbear_exit Matt Johnston <matt@ucc.asn.au> parents: 1350 diff changeset	60 _dropbear_exit = svr_dropbear_exit;
1348 5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	61
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	62 char *argv[] = {
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	63 "-E",
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	64 };
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	65
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	66 int argc = sizeof(argv) / sizeof(*argv);
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	67 svr_getopts(argc, argv);
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	68
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	69 /* user lookups might be slow, cache it */
1386 f0990c284663 fuzzer-preauth don't call getpwnam(), bring back longjmp Matt Johnston <matt@ucc.asn.au> parents: 1385 diff changeset	70 fuzz.pw_name = m_strdup("person");
f0990c284663 fuzzer-preauth don't call getpwnam(), bring back longjmp Matt Johnston <matt@ucc.asn.au> parents: 1385 diff changeset	71 fuzz.pw_dir = m_strdup("/tmp");
f0990c284663 fuzzer-preauth don't call getpwnam(), bring back longjmp Matt Johnston <matt@ucc.asn.au> parents: 1385 diff changeset	72 fuzz.pw_shell = m_strdup("/bin/zsh");
1348 5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	73 fuzz.pw_passwd = m_strdup("!!zzznope");
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	74
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	75 load_fixed_hostkeys();
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	76 }
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	77
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	78 static void load_fixed_hostkeys(void) {
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	79 #include "fuzz-hostkeys.c"
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	80
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	81 buffer *b = buf_new(3000);
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	82 enum signkey_type type;
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	83
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	84 TRACE(("load fixed hostkeys"))
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	85
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	86 svr_opts.hostkey = new_sign_key();
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	87
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	88 buf_setlen(b, 0);
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	89 buf_putbytes(b, keyr, keyr_len);
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	90 buf_setpos(b, 0);
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	91 type = DROPBEAR_SIGNKEY_RSA;
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	92 if (buf_get_priv_key(b, svr_opts.hostkey, &type) == DROPBEAR_FAILURE) {
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	93 dropbear_exit("failed fixed rsa hostkey");
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	94 }
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	95
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	96 buf_setlen(b, 0);
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	97 buf_putbytes(b, keyd, keyd_len);
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	98 buf_setpos(b, 0);
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	99 type = DROPBEAR_SIGNKEY_DSS;
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	100 if (buf_get_priv_key(b, svr_opts.hostkey, &type) == DROPBEAR_FAILURE) {
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	101 dropbear_exit("failed fixed dss hostkey");
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	102 }
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	103
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	104 buf_setlen(b, 0);
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	105 buf_putbytes(b, keye, keye_len);
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	106 buf_setpos(b, 0);
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	107 type = DROPBEAR_SIGNKEY_ECDSA_NISTP256;
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	108 if (buf_get_priv_key(b, svr_opts.hostkey, &type) == DROPBEAR_FAILURE) {
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	109 dropbear_exit("failed fixed ecdsa hostkey");
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	110 }
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	111
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	112 buf_free(b);
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	113 }
5c2899e35b63 fuzz harness Matt Johnston <matt@ucc.asn.au> parents: diff changeset	114
1357 08f4fa4dc6a0 closer to working Matt Johnston <matt@ucc.asn.au> parents: 1356 diff changeset	115 void fuzz_kex_fakealgos(void) {
08f4fa4dc6a0 closer to working Matt Johnston <matt@ucc.asn.au> parents: 1356 diff changeset	116 ses.newkeys->recv.crypt_mode = &dropbear_mode_none;
08f4fa4dc6a0 closer to working Matt Johnston <matt@ucc.asn.au> parents: 1356 diff changeset	117 }
1383 f03cfe9c76ac Disable setnonblocking(), get_socket_address(), set_sock_priority() Matt Johnston <matt@ucc.asn.au> parents: 1377 diff changeset	118
f03cfe9c76ac Disable setnonblocking(), get_socket_address(), set_sock_priority() Matt Johnston <matt@ucc.asn.au> parents: 1377 diff changeset	119 void fuzz_get_socket_address(int UNUSED(fd), char local_host, char local_port,
f03cfe9c76ac Disable setnonblocking(), get_socket_address(), set_sock_priority() Matt Johnston <matt@ucc.asn.au> parents: 1377 diff changeset	120 char remote_host, char remote_port, int UNUSED(host_lookup)) {
f03cfe9c76ac Disable setnonblocking(), get_socket_address(), set_sock_priority() Matt Johnston <matt@ucc.asn.au> parents: 1377 diff changeset	121 if (local_host) {
f03cfe9c76ac Disable setnonblocking(), get_socket_address(), set_sock_priority() Matt Johnston <matt@ucc.asn.au> parents: 1377 diff changeset	122 *local_host = m_strdup("fuzzlocalhost");
f03cfe9c76ac Disable setnonblocking(), get_socket_address(), set_sock_priority() Matt Johnston <matt@ucc.asn.au> parents: 1377 diff changeset	123 }
f03cfe9c76ac Disable setnonblocking(), get_socket_address(), set_sock_priority() Matt Johnston <matt@ucc.asn.au> parents: 1377 diff changeset	124 if (local_port) {
f03cfe9c76ac Disable setnonblocking(), get_socket_address(), set_sock_priority() Matt Johnston <matt@ucc.asn.au> parents: 1377 diff changeset	125 *local_port = m_strdup("1234");
f03cfe9c76ac Disable setnonblocking(), get_socket_address(), set_sock_priority() Matt Johnston <matt@ucc.asn.au> parents: 1377 diff changeset	126 }
f03cfe9c76ac Disable setnonblocking(), get_socket_address(), set_sock_priority() Matt Johnston <matt@ucc.asn.au> parents: 1377 diff changeset	127 if (remote_host) {
f03cfe9c76ac Disable setnonblocking(), get_socket_address(), set_sock_priority() Matt Johnston <matt@ucc.asn.au> parents: 1377 diff changeset	128 *remote_host = m_strdup("fuzzremotehost");
f03cfe9c76ac Disable setnonblocking(), get_socket_address(), set_sock_priority() Matt Johnston <matt@ucc.asn.au> parents: 1377 diff changeset	129 }
f03cfe9c76ac Disable setnonblocking(), get_socket_address(), set_sock_priority() Matt Johnston <matt@ucc.asn.au> parents: 1377 diff changeset	130 if (remote_port) {
f03cfe9c76ac Disable setnonblocking(), get_socket_address(), set_sock_priority() Matt Johnston <matt@ucc.asn.au> parents: 1377 diff changeset	131 *remote_port = m_strdup("9876");
f03cfe9c76ac Disable setnonblocking(), get_socket_address(), set_sock_priority() Matt Johnston <matt@ucc.asn.au> parents: 1377 diff changeset	132 }
f03cfe9c76ac Disable setnonblocking(), get_socket_address(), set_sock_priority() Matt Johnston <matt@ucc.asn.au> parents: 1377 diff changeset	133 }
1456 a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	134
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	135 /* cut down version of svr_send_msg_kexdh_reply() that skips slow maths. Still populates structures */
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	136 void fuzz_fake_send_kexdh_reply(void) {
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	137 assert(!ses.dh_K);
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	138 m_mp_alloc_init_multi(&ses.dh_K, NULL);
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	139 mp_set_int(ses.dh_K, 12345678);
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	140 finish_kexhashbuf();
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	141 }
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	142
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	143 int fuzz_run_preauth(const uint8_t *Data, size_t Size, int skip_kexmaths) {
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	144 static int once = 0;
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	145 if (!once) {
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	146 fuzz_svr_setup();
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	147 fuzz.skip_kexmaths = skip_kexmaths;
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	148 once = 1;
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	149 }
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	150
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	151 if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) {
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	152 return 0;
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	153 }
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	154
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	155 // get prefix. input format is
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	156 // string prefix
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	157 // uint32 wrapfd seed
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	158 // ... to be extended later
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	159 // [bytes] ssh input stream
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	160
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	161 // be careful to avoid triggering buffer.c assertions
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	162 if (fuzz.input->len < 8) {
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	163 return 0;
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	164 }
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	165 size_t prefix_size = buf_getint(fuzz.input);
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	166 if (prefix_size != 4) {
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	167 return 0;
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	168 }
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	169 uint32_t wrapseed = buf_getint(fuzz.input);
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	170 wrapfd_setseed(wrapseed);
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	171
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	172 int fakesock = 20;
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	173 wrapfd_add(fakesock, fuzz.input, PLAIN);
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	174
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	175 m_malloc_set_epoch(1);
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	176 if (setjmp(fuzz.jmp) == 0) {
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	177 svr_session(fakesock, fakesock);
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	178 m_malloc_free_epoch(1, 0);
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	179 } else {
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	180 m_malloc_free_epoch(1, 1);
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	181 TRACE(("dropbear_exit longjmped"))
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	182 // dropbear_exit jumped here
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	183 }
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	184
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	185 return 0;
a90fdd2d2ed8 add fuzzer-preauth_nomaths Matt Johnston <matt@ucc.asn.au> parents: 1386 diff changeset	186 }

Mercurial > dropbear

annotate fuzz-common.c @ 1528:b9e4fd5a0e72 fuzz