From 019bee54c6b3521daef72b266b69c9c40a8fd278 Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Fri, 18 Dec 2020 17:56:29 +1300 Subject: [PATCH] fuzz: add fuzzer for sess_crypt_blob Signed-off-by: Douglas Bagnall Reviewed-by: Andrew Bartlett --- lib/fuzzing/fuzz_sess_crypt_blob.c | 55 ++++++++++++++++++++++++++++++ lib/fuzzing/wscript_build | 5 +++ 2 files changed, 60 insertions(+) create mode 100644 lib/fuzzing/fuzz_sess_crypt_blob.c diff --git a/lib/fuzzing/fuzz_sess_crypt_blob.c b/lib/fuzzing/fuzz_sess_crypt_blob.c new file mode 100644 index 00000000000..bed697ef87c --- /dev/null +++ b/lib/fuzzing/fuzz_sess_crypt_blob.c @@ -0,0 +1,55 @@ +/* + Fuzzing sess_*crypt_blob + Copyright (C) Catalyst IT 2020 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ +#include "includes.h" +#include "fuzzing/fuzzing.h" +#include "libcli/auth/libcli_auth.h" +#include "session.h" + +int LLVMFuzzerInitialize(int *argc, char ***argv) +{ + return 0; +} + + +int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len) +{ + TALLOC_CTX *mem_ctx = NULL; + DATA_BLOB blob, session_key, out; + size_t slen; + if (len < 1) { + return 0; + } + + slen = input[0]; + if (len < slen + 1) { + return 0; + } + + session_key.data = input + 1; + session_key.length = slen; + blob.data = input + 1 + slen; + blob.length = len - slen - 1; + + mem_ctx = talloc_new(NULL); + + out = sess_encrypt_blob(mem_ctx, &blob, &session_key); + sess_decrypt_blob(mem_ctx, &blob, &session_key, &out); + + TALLOC_FREE(mem_ctx); + return 0; +} diff --git a/lib/fuzzing/wscript_build b/lib/fuzzing/wscript_build index 05dbc00f267..0f25b0c29cd 100644 --- a/lib/fuzzing/wscript_build +++ b/lib/fuzzing/wscript_build @@ -37,6 +37,11 @@ bld.SAMBA_BINARY('fuzz_sddl_parse', deps='fuzzing samba-security afl-fuzz-main', fuzzer=True) +bld.SAMBA_BINARY('fuzz_sess_crypt_blob', + source='fuzz_sess_crypt_blob.c', + deps='fuzzing samba-security LIBCLI_AUTH NDR_DSSETUP afl-fuzz-main', + fuzzer=True) + bld.SAMBA_BINARY('fuzz_nmblib_parse_packet', source='fuzz_nmblib_parse_packet.c', deps='fuzzing libsmb afl-fuzz-main',