• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 // Copyright 2020 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 //      http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 
15 #include <stddef.h>
16 #include <stdint.h>
17 #include <unistd.h>
18 #include <assert.h>
19 #include <sys/syscall.h>
20 #include <linux/memfd.h>
21 #include <fuzzer/FuzzedDataProvider.h>
22 
23 #include "ext2fs/ext2fs.h"
24 
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)25 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
26 
27   enum FuzzerType {
28     ext2fsReadBlockBitmap,
29     ext2fsReadInodeBitmap,
30     kMaxValue = ext2fsReadInodeBitmap
31   };
32 
33   FuzzedDataProvider stream(data, size);
34   const FuzzerType f = stream.ConsumeEnum<FuzzerType>();
35   static const char* fname = "/tmp/ext2_test_file";
36 
37   // Write our data to a temp file.
38   int fd = syscall(SYS_memfd_create, fname, 0);
39   std::vector<char> buffer = stream.ConsumeRemainingBytes<char>();
40   write(fd, buffer.data(), buffer.size());
41   close(fd);
42 
43   ext2_filsys fs;
44   errcode_t retval = ext2fs_open(
45       fname,
46       0, 0, 0,
47       unix_io_manager,
48       &fs);
49 
50   if (!retval) {
51     switch (f) {
52       case ext2fsReadBlockBitmap: {
53         ext2fs_read_block_bitmap(fs);
54         break;
55       }
56       case ext2fsReadInodeBitmap: {
57         ext2fs_read_inode_bitmap(fs);
58         break;
59       }
60       default: {
61         assert(false);
62       }
63     }
64     ext2fs_close(fs);
65   }
66 
67   return 0;
68 }
69