# HG changeset patch
# User Matt Johnston <matt@ucc.asn.au>
# Date 1495729201 -28800
# Node ID d201105df2ed9a2a58a43e07c518e48465dfc0a7
# Parent  616417b27f5578a2c1353e0e416b782034175e50
add fuzzer-verify

diff -r 616417b27f55 -r d201105df2ed Makefile.in
--- a/Makefile.in	Fri May 26 00:19:53 2017 +0800
+++ b/Makefile.in	Fri May 26 00:20:01 2017 +0800
@@ -245,7 +245,7 @@
 ## Fuzzing targets
 
 # list of fuzz targets
-FUZZ_TARGETS=fuzzer-preauth fuzzer-pubkey
+FUZZ_TARGETS=fuzzer-preauth fuzzer-pubkey fuzzer-verify
 
 FUZZER_OPTIONS = $(addsuffix .options, $(FUZZ_TARGETS))
 
@@ -270,6 +270,9 @@
 fuzzer-pubkey: fuzzer-pubkey.o $(HEADERS) $(LIBTOM_DEPS) Makefile $(svrfuzzobjs)
 	$(CXX) $(CXXFLAGS) $@.o $(LDFLAGS) $(svrfuzzobjs) -o $@$(EXEEXT) $(LIBTOM_LIBS) $(LIBS) $(FUZZLIB) @CRYPTLIB@
 
+fuzzer-verify: fuzzer-verify.o $(HEADERS) $(LIBTOM_DEPS) Makefile $(svrfuzzobjs)
+	$(CXX) $(CXXFLAGS) $@.o $(LDFLAGS) $(svrfuzzobjs) -o $@$(EXEEXT) $(LIBTOM_LIBS) $(LIBS) $(FUZZLIB) @CRYPTLIB@
+
 fuzzer-%.options: Makefile
 	echo "[libfuzzer]"               > $@
 	echo "max_len = 50000"          >> $@
diff -r 616417b27f55 -r d201105df2ed fuzzer-verify.c
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/fuzzer-verify.c	Fri May 26 00:20:01 2017 +0800
@@ -0,0 +1,44 @@
+#include "fuzz.h"
+#include "session.h"
+#include "fuzz-wrapfd.h"
+#include "debug.h"
+
+static void setup_fuzzer(void) {
+	common_setup_fuzzer();
+}
+
+static buffer *verifydata;
+
+/* Tests reading a public key and verifying a signature */
+int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+	static int once = 0;
+	if (!once) {
+		setup_fuzzer();
+		verifydata = buf_new(30);
+		buf_putstring(verifydata, "x", 1);
+		once = 1;
+	}
+
+	if (fuzzer_set_input(Data, Size) == DROPBEAR_FAILURE) {
+		return 0;
+	}
+
+	m_malloc_set_epoch(1);
+
+	if (setjmp(fuzz.jmp) == 0) {
+		sign_key *key = new_sign_key();
+		enum signkey_type type = DROPBEAR_SIGNKEY_ANY;
+		if (buf_get_pub_key(fuzz.input, key, &type) == DROPBEAR_SUCCESS) {
+			/* Don't expect random fuzz input to verify */
+			assert(buf_verify(fuzz.input, key, verifydata) == DROPBEAR_FAILURE);
+		}
+		sign_key_free(key);
+		m_malloc_free_epoch(1, 0);
+	} else {
+		m_malloc_free_epoch(1, 1);
+		TRACE(("dropbear_exit longjmped"))
+		// dropbear_exit jumped here
+	}
+
+	return 0;
+}