You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
systemd/SOURCES/0262-tests-add-a-fuzzer-for...

149 lines
4.8 KiB

From e7077e3a551a3faedfcc3d007de6a72fb5e1df62 Mon Sep 17 00:00:00 2001
From: Evgeny Vereshchagin <evvers@ya.ru>
Date: Tue, 20 Nov 2018 01:20:32 +0100
Subject: [PATCH] tests: add a fuzzer for journald streams
(cherry picked from commit 9541f5ff5c637bb1b3e3c69706cb73e68ff06813)
Resolves: #1764560
---
src/fuzz/fuzz-journald-stream.c | 35 ++++++++++++++++++++++++++++
src/fuzz/fuzz-journald.c | 10 +++++---
src/fuzz/meson.build | 6 +++++
src/journal/journald-stream.c | 4 ++--
src/journal/journald-stream.h | 2 ++
test/fuzz/fuzz-journald-stream/basic | 8 +++++++
6 files changed, 60 insertions(+), 5 deletions(-)
create mode 100644 src/fuzz/fuzz-journald-stream.c
create mode 100644 test/fuzz/fuzz-journald-stream/basic
diff --git a/src/fuzz/fuzz-journald-stream.c b/src/fuzz/fuzz-journald-stream.c
new file mode 100644
index 0000000000..247c0889bc
--- /dev/null
+++ b/src/fuzz/fuzz-journald-stream.c
@@ -0,0 +1,35 @@
+/* SPDX-License-Identifier: LGPL-2.1+ */
+
+#include <linux/sockios.h>
+
+#include "fd-util.h"
+#include "fuzz.h"
+#include "fuzz-journald.h"
+#include "journald-stream.h"
+
+static int stream_fds[2] = { -1, -1 };
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+ Server s;
+ StdoutStream *stream;
+ int v;
+
+ if (size == 0)
+ return 0;
+
+ if (!getenv("SYSTEMD_LOG_LEVEL"))
+ log_set_max_level(LOG_CRIT);
+
+ assert_se(socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0, stream_fds) >= 0);
+ dummy_server_init(&s, NULL, 0);
+ assert_se(stdout_stream_install(&s, stream_fds[0], &stream) >= 0);
+ assert_se(write(stream_fds[1], data, size) == (ssize_t) size);
+ while (ioctl(stream_fds[0], SIOCINQ, &v) == 0 && v)
+ sd_event_run(s.event, (uint64_t) -1);
+ if (s.n_stdout_streams)
+ stdout_stream_destroy(stream);
+ server_done(&s);
+ stream_fds[1] = safe_close(stream_fds[1]);
+
+ return 0;
+}
diff --git a/src/fuzz/fuzz-journald.c b/src/fuzz/fuzz-journald.c
index 0659b92ba3..950e885cae 100644
--- a/src/fuzz/fuzz-journald.c
+++ b/src/fuzz/fuzz-journald.c
@@ -15,11 +15,15 @@ void dummy_server_init(Server *s, const uint8_t *buffer, size_t size) {
.hostname_fd = -1,
.notify_fd = -1,
.storage = STORAGE_NONE,
+ .line_max = 64,
};
assert_se(sd_event_default(&s->event) >= 0);
- s->buffer = memdup_suffix0(buffer, size);
- assert_se(s->buffer);
- s->buffer_size = size + 1;
+
+ if (buffer) {
+ s->buffer = memdup_suffix0(buffer, size);
+ assert_se(s->buffer);
+ s->buffer_size = size + 1;
+ }
}
void fuzz_journald_processing_function(
diff --git a/src/fuzz/meson.build b/src/fuzz/meson.build
index 897c02e4ae..eea9117360 100644
--- a/src/fuzz/meson.build
+++ b/src/fuzz/meson.build
@@ -51,6 +51,12 @@ fuzzers += [
libshared],
[libselinux]],
+ [['src/fuzz/fuzz-journald-stream.c',
+ 'src/fuzz/fuzz-journald.c'],
+ [libjournal_core,
+ libshared],
+ [libselinux]],
+
[['src/fuzz/fuzz-journald-syslog.c',
'src/fuzz/fuzz-journald.c'],
[libjournal_core,
diff --git a/src/journal/journald-stream.c b/src/journal/journald-stream.c
index dbf3503a82..6f8a4011ff 100644
--- a/src/journal/journald-stream.c
+++ b/src/journal/journald-stream.c
@@ -125,7 +125,7 @@ void stdout_stream_free(StdoutStream *s) {
DEFINE_TRIVIAL_CLEANUP_FUNC(StdoutStream*, stdout_stream_free);
-static void stdout_stream_destroy(StdoutStream *s) {
+void stdout_stream_destroy(StdoutStream *s) {
if (!s)
return;
@@ -534,7 +534,7 @@ terminate:
return 0;
}
-static int stdout_stream_install(Server *s, int fd, StdoutStream **ret) {
+int stdout_stream_install(Server *s, int fd, StdoutStream **ret) {
_cleanup_(stdout_stream_freep) StdoutStream *stream = NULL;
sd_id128_t id;
int r;
diff --git a/src/journal/journald-stream.h b/src/journal/journald-stream.h
index bc5622ab3b..487376e763 100644
--- a/src/journal/journald-stream.h
+++ b/src/journal/journald-stream.h
@@ -10,4 +10,6 @@ int server_open_stdout_socket(Server *s);
int server_restore_streams(Server *s, FDSet *fds);
void stdout_stream_free(StdoutStream *s);
+int stdout_stream_install(Server *s, int fd, StdoutStream **ret);
+void stdout_stream_destroy(StdoutStream *s);
void stdout_stream_send_notify(StdoutStream *s);
diff --git a/test/fuzz/fuzz-journald-stream/basic b/test/fuzz/fuzz-journald-stream/basic
new file mode 100644
index 0000000000..a088f1a539
--- /dev/null
+++ b/test/fuzz/fuzz-journald-stream/basic
@@ -0,0 +1,8 @@
+
+
+6
+1
+0
+0
+0
+hey
\ No newline at end of file