Mercurial > dropbear
changeset 1380:d201105df2ed fuzz
add fuzzer-verify
| author | Matt Johnston <matt@ucc.asn.au> |
|---|---|
| date | Fri, 26 May 2017 00:20:01 +0800 |
| parents | 616417b27f55 |
| children | c98e242dc505 |
| files | Makefile.in fuzzer-verify.c |
| diffstat | 2 files changed, 48 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/Makefile.in Fri May 26 00:19:53 2017 +0800 +++ b/Makefile.in Fri May 26 00:20:01 2017 +0800 @@ -245,7 +245,7 @@ ## Fuzzing targets # list of fuzz targets -FUZZ_TARGETS=fuzzer-preauth fuzzer-pubkey +FUZZ_TARGETS=fuzzer-preauth fuzzer-pubkey fuzzer-verify FUZZER_OPTIONS = $(addsuffix .options, $(FUZZ_TARGETS)) @@ -270,6 +270,9 @@ fuzzer-pubkey: fuzzer-pubkey.o $(HEADERS) $(LIBTOM_DEPS) Makefile $(svrfuzzobjs) $(CXX) $(CXXFLAGS) [email protected] $(LDFLAGS) $(svrfuzzobjs) -o $@$(EXEEXT) $(LIBTOM_LIBS) $(LIBS) $(FUZZLIB) @CRYPTLIB@ +fuzzer-verify: fuzzer-verify.o $(HEADERS) $(LIBTOM_DEPS) Makefile $(svrfuzzobjs) + $(CXX) $(CXXFLAGS) [email protected] $(LDFLAGS) $(svrfuzzobjs) -o $@$(EXEEXT) $(LIBTOM_LIBS) $(LIBS) $(FUZZLIB) @CRYPTLIB@ + fuzzer-%.options: Makefile echo "[libfuzzer]" > $@ echo "max_len = 50000" >> $@
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/fuzzer-verify.c Fri May 26 00:20:01 2017 +0800 @@ -0,0 +1,44 @@ +#include "fuzz.h" +#include "session.h" +#include "fuzz-wrapfd.h" +#include "debug.h" + +static void setup_fuzzer(void) { + common_setup_fuzzer(); +} + +static buffer *verifydata; + +/* Tests reading a public key and verifying a signature */ +int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + static int once = 0; + if (!once) { + setup_fuzzer(); + verifydata = buf_new(30); + buf_putstring(verifydata, "x", 1); + once = 1; + } + + if (fuzzer_set_input(Data, Size) == DROPBEAR_FAILURE) { + return 0; + } + + m_malloc_set_epoch(1); + + if (setjmp(fuzz.jmp) == 0) { + sign_key *key = new_sign_key(); + enum signkey_type type = DROPBEAR_SIGNKEY_ANY; + if (buf_get_pub_key(fuzz.input, key, &type) == DROPBEAR_SUCCESS) { + /* Don't expect random fuzz input to verify */ + assert(buf_verify(fuzz.input, key, verifydata) == DROPBEAR_FAILURE); + } + sign_key_free(key); + m_malloc_free_epoch(1, 0); + } else { + m_malloc_free_epoch(1, 1); + TRACE(("dropbear_exit longjmped")) + // dropbear_exit jumped here + } + + return 0; +}