sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-22 13:34:15 +03:00
Code

Add fuzzing binary for tiniparser

Browse Source 
The "tiniparser_load" function is made into a wrapper for the newly
added "tiniparser_load_stream" function which accepts a FILE pointer.
This way no actual files have to be opened for fuzzing (memfd_create(2)
isn't readily available on all systems yet).

Signed-off-by: Michael Hanselmann <public@hansmi.ch>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
This commit is contained in:
Michael Hanselmann 2019-04-04 01:03:58 +02:00 committed by Andrew Bartlett
parent dd5f8732d8
commit 404278d947
4 changed files with 63 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
lib/fuzzing/fuzz_tiniparser.c Normal file
View File

@ -0,0 +1,39 @@
/*
Fuzzing for trivial smb.conf parsing code.
Copyright (C) Michael Hanselmann 2019
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "fuzzing.h"
#include "lib/util/tiniparser.h"
int LLVMFuzzerInitialize(int *argc, char ***argv)
{
return 0;
}
int LLVMFuzzerTestOneInput(uint8_t *buf, size_t len)
{
FILE *fp;
fp = fmemopen(buf, len, "r");
tiniparser_load_stream(fp);
fclose(fp);
return 0;
}

6
lib/fuzzing/wscript_build
View File

@ -5,3 +5,9 @@ bld.SAMBA_SUBSYSTEM('fuzzing',
deps='talloc',
enabled=bld.env.enable_libfuzzer,
)
bld.SAMBA_BINARY('fuzz_tiniparser',
source='fuzz_tiniparser.c',
deps='fuzzing tiniparser talloc',
install=False,
enabled=bld.env.enable_libfuzzer)

24
lib/util/tiniparser.c
View File

@ -321,15 +321,10 @@ static bool section_parser(const char *section_name,
return true;
}
struct tiniparser_dictionary *tiniparser_load(const char *filename)
struct tiniparser_dictionary *tiniparser_load_stream(FILE *fp)
{
bool ret;
struct tiniparser_dictionary *d = NULL;
FILE *fp = fopen(filename, "r");
if (fp == NULL) {
return NULL;
}
d = malloc(sizeof(struct tiniparser_dictionary));
if (d == NULL) {
@ -343,7 +338,6 @@ struct tiniparser_dictionary *tiniparser_load(const char *filename)
section_parser,
value_parser,
d);
fclose(fp);
if (ret == false) {
tiniparser_freedict(d);
d = NULL;
@ -351,6 +345,22 @@ struct tiniparser_dictionary *tiniparser_load(const char *filename)
return d;
}
struct tiniparser_dictionary *tiniparser_load(const char *filename)
{
struct tiniparser_dictionary *d;
FILE *fp = fopen(filename, "r");
if (fp == NULL) {
return NULL;
}
d = tiniparser_load_stream(fp);
fclose(fp);
return d;
}
void tiniparser_freedict(struct tiniparser_dictionary *d)
{
struct tiniparser_section *curr_section, *next_section;

1
lib/util/tiniparser.h
View File

@ -49,6 +49,7 @@ const char *tiniparser_getstring(struct tiniparser_dictionary *d,
int tiniparser_getint(struct tiniparser_dictionary *d,
const char *key,
int default_value);
struct tiniparser_dictionary *tiniparser_load_stream(FILE *fp);
struct tiniparser_dictionary *tiniparser_load(const char *filename);
void tiniparser_freedict(struct tiniparser_dictionary *d);