Mercurial > dropbear

changeset 1584:cdfab509c392

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
use random keyblob from the fuzzer instead
author Matt Johnston <matt@ucc.asn.au>
date Sun, 04 Mar 2018 19:19:45 +0800
parents d17a6bab2179
children 4192f8831858
files fuzzer-pubkey.c
diffstat 1 files changed, 15 insertions(+), 12 deletions(-) [+]
line wrap: on
line diff
--- a/fuzzer-pubkey.c	Sun Mar 04 17:17:37 2018 +0800
+++ b/fuzzer-pubkey.c	Sun Mar 04 19:19:45 2018 +0800
@@ -20,19 +20,22 @@
 
 	m_malloc_set_epoch(1);
 
-	/* choose a keytype based on input */
-	uint8_t b = 0;
-	size_t i;
-	for (i = 0; i < Size; i++) {
-		b ^= Data[i];
-	}
-	const char* algoname = fuzz_signkey_names[b%DROPBEAR_SIGNKEY_NUM_NAMED];
-	const char* keyblob = "blob"; /* keep short */
+	if (setjmp(fuzz.jmp) == 0) {
+		buffer *line = buf_getstringbuf(fuzz.input);
+		buffer *keyblob = buf_getstringbuf(fuzz.input);
+
+		unsigned int algolen;
+		const char* algoname = buf_getstring(keyblob, &algolen);
 
-	if (setjmp(fuzz.jmp) == 0) {
-		fuzz_checkpubkey_line(fuzz.input, 5, "/home/me/authorized_keys", 
-			algoname, strlen(algoname),
-			(unsigned char*)keyblob, strlen(keyblob));
+		if (have_algo(algo, algolen, sshhostkey) == DROPBEAR_FAILURE) {
+			dropbear_exit("fuzzer imagined a bogus algorithm");
+		}
+		fuzz_checkpubkey_line(line, 5, "/home/me/authorized_keys",
+			algoname, algolen,
+			keyblob->data, keyblob->len);
+
+		buf_free(line);
+		buf_free(keyblob);
 		m_malloc_free_epoch(1, 0);
 	} else {
 		m_malloc_free_epoch(1, 1);