1 /* Copyright 2021 Google LLC
2 Licensed under the Apache License, Version 2.0 (the "License");
3 you may not use this file except in compliance with the License.
4 You may obtain a copy of the License at
5 http://www.apache.org/licenses/LICENSE-2.0
6 Unless required by applicable law or agreed to in writing, software
7 distributed under the License is distributed on an "AS IS" BASIS,
8 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
9 See the License for the specific language governing permissions and
10 limitations under the License.
11 */
12
13 #include "fuzz_header.h"
14
15 /*
16 * Targets answer_auth
17 */
FuzzDhcp(const uint8_t ** data2,size_t * size2)18 void FuzzDhcp(const uint8_t **data2, size_t *size2) {
19 const uint8_t *data = *data2;
20 size_t size = *size2;
21 time_t now;
22 int pxe_fd = 0;
23
24 struct iovec *dhpa = malloc(sizeof(struct iovec));
25 if (dhpa == NULL) return;
26
27 char *content = malloc(300);
28 if (content == NULL) {
29 free(dhpa);
30 return;
31 }
32
33 dhpa->iov_base = content;
34 dhpa->iov_len = 300;
35
36 daemon->dhcp_packet = *dhpa;
37
38 syscall_data = data;
39 syscall_size = size;
40
41 dhcp_packet(now, pxe_fd);
42
43 // dnsmasq may change the iov_base if the buffer needs expansion.
44 // Do not free in that case, only free if the buffer stays that same.
45 if (daemon->dhcp_packet.iov_base == content) {
46 free(content);
47 }
48 else{
49 free(daemon->dhcp_packet.iov_base);
50 }
51
52 free(dhpa);
53 }
54
55 /*
56 * Fuzzer entrypoint.
57 */
LLVMFuzzerTestOneInput(const uint8_t * data,size_t size)58 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
59 daemon = NULL;
60 if (size < 1) {
61 return 0;
62 }
63
64 // Initialize mini garbage collector
65 gb_init();
66
67 // Get a value we can use to decide which target to hit.
68 int i = (int)data[0];
69 data += 1;
70 size -= 1;
71
72 int succ = init_daemon(&data, &size);
73
74 if (succ == 0) {
75 cache_init();
76 blockdata_init();
77
78 FuzzDhcp(&data, &size);
79
80 cache_start_insert();
81 fuzz_blockdata_cleanup();
82 }
83
84 // Free data in mini garbage collector.
85 gb_cleanup();
86 return 0;
87 }
88