1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
#include <stdio.h>
#include <stdint.h>
#include <stddef.h>
#include "blob.h"
#include "blobmsg.h"
static void fuzz_blobmsg_parse(const uint8_t *data, size_t size)
{
enum {
FOO_MESSAGE,
FOO_LIST,
FOO_TESTDATA,
__FOO_MAX
};
static const struct blobmsg_policy foo_policy[] = {
[FOO_MESSAGE] = {
.name = "message",
.type = BLOBMSG_TYPE_STRING,
},
[FOO_LIST] = {
.name = "list",
.type = BLOBMSG_TYPE_ARRAY,
},
[FOO_TESTDATA] = {
.name = "testdata",
.type = BLOBMSG_TYPE_TABLE,
},
};
struct blob_attr *tb[__FOO_MAX];
blobmsg_parse(foo_policy, __FOO_MAX, tb, (uint8_t *)data, size);
blobmsg_parse_array(foo_policy, __FOO_MAX, tb, (uint8_t *)data, size);
}
static void fuzz_blob_parse(const uint8_t *data, size_t size)
{
enum {
FOO_ATTR_NESTED,
FOO_ATTR_BINARY,
FOO_ATTR_STRING,
FOO_ATTR_INT8,
FOO_ATTR_INT16,
FOO_ATTR_INT32,
FOO_ATTR_INT64,
FOO_ATTR_DOUBLE,
__FOO_ATTR_MAX
};
static const struct blob_attr_info foo_policy[__FOO_ATTR_MAX] = {
[FOO_ATTR_NESTED] = { .type = BLOB_ATTR_NESTED },
[FOO_ATTR_BINARY] = { .type = BLOB_ATTR_BINARY },
[FOO_ATTR_STRING] = { .type = BLOB_ATTR_STRING },
[FOO_ATTR_INT8] = { .type = BLOB_ATTR_INT8 },
[FOO_ATTR_INT16] = { .type = BLOB_ATTR_INT16 },
[FOO_ATTR_INT32] = { .type = BLOB_ATTR_INT32 },
[FOO_ATTR_INT64] = { .type = BLOB_ATTR_INT64 },
[FOO_ATTR_DOUBLE] = { .type = BLOB_ATTR_DOUBLE },
};
struct blob_attr *foo[__FOO_ATTR_MAX];
struct blob_attr *buf = (struct blob_attr *)data;
blob_parse_untrusted(buf, size, foo, foo_policy, __FOO_ATTR_MAX);
}
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
fuzz_blob_parse(data, size);
fuzz_blobmsg_parse(data, size);
return 0;
}
|
