From 76e2fa8ed4bbee7c625e3b790f2e38a59fffd93d Mon Sep 17 00:00:00 2001

From: Evgeny Vereshchagin <evvers@ya.ru>

Date: Fri, 23 Nov 2018 00:27:19 +0100

Subject: [PATCH] tests: add a fuzzer for server_process_native_file

(cherry picked from commit a4aa59bae206eebb4703b291147144def5d4bb3e)

Resolves: #1764560

---

 src/fuzz/fuzz-journald-native-fd.c      |  47 ++++++++++++++++++++++++

 src/fuzz/meson.build                    |   6 +++

 test/fuzz/fuzz-journald-native-fd/basic | Bin 0 -> 34 bytes

 3 files changed, 53 insertions(+)

 create mode 100644 src/fuzz/fuzz-journald-native-fd.c

 create mode 100644 test/fuzz/fuzz-journald-native-fd/basic

diff --git a/src/fuzz/fuzz-journald-native-fd.c b/src/fuzz/fuzz-journald-native-fd.c

new file mode 100644

index 0000000000..95415d9f85

--- /dev/null

+++ b/src/fuzz/fuzz-journald-native-fd.c

@@ -0,0 +1,47 @@

+/* SPDX-License-Identifier: LGPL-2.1+ */

+

+#include "fd-util.h"

+#include "fileio.h"

+#include "fs-util.h"

+#include "fuzz.h"

+#include "fuzz-journald.h"

+#include "journald-native.h"

+#include "memfd-util.h"

+#include "process-util.h"

+

+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {

+        Server s;

+        _cleanup_close_ int sealed_fd = -1, unsealed_fd = -1;

+        _cleanup_(unlink_tempfilep) char name[] = "/tmp/fuzz-journald-native-fd.XXXXXX";

+        char *label = NULL;

+        size_t label_len = 0;

+        struct ucred ucred;

+        struct timeval *tv = NULL;

+

+        if (!getenv("SYSTEMD_LOG_LEVEL"))

+                log_set_max_level(LOG_CRIT);

+

+        dummy_server_init(&s, NULL, 0);

+

+        sealed_fd = memfd_new(NULL);

+        assert_se(sealed_fd >= 0);

+        assert_se(write(sealed_fd, data, size) == (ssize_t) size);

+        assert_se(memfd_set_sealed(sealed_fd) >= 0);

+        assert_se(lseek(sealed_fd, 0, SEEK_SET) == 0);

+        ucred = (struct ucred) {

+                .pid = getpid_cached(),

+                .uid = geteuid(),

+                .gid = getegid(),

+        };

+        server_process_native_file(&s, sealed_fd, &ucred, tv, label, label_len);

+

+        unsealed_fd = mkostemp_safe(name);

+        assert_se(unsealed_fd >= 0);

+        assert_se(write(unsealed_fd, data, size) == (ssize_t) size);

+        assert_se(lseek(unsealed_fd, 0, SEEK_SET) == 0);

+        server_process_native_file(&s, unsealed_fd, &ucred, tv, label, label_len);

+

+        server_done(&s);

+

+        return 0;

+}

diff --git a/src/fuzz/meson.build b/src/fuzz/meson.build

index eea9117360..5315d2771c 100644

--- a/src/fuzz/meson.build

+++ b/src/fuzz/meson.build

@@ -51,6 +51,12 @@ fuzzers += [

           libshared],

          [libselinux]],

+        [['src/fuzz/fuzz-journald-native-fd.c',

+          'src/fuzz/fuzz-journald.c'],

+         [libjournal_core,

+          libshared],

+         [libselinux]],

+

         [['src/fuzz/fuzz-journald-stream.c',

           'src/fuzz/fuzz-journald.c'],

          [libjournal_core,

diff --git a/test/fuzz/fuzz-journald-native-fd/basic b/test/fuzz/fuzz-journald-native-fd/basic

new file mode 100644

index 0000000000000000000000000000000000000000..65f89705a655618851c0e446efaa5c633adf425f

GIT binary patch

literal 34

kcmeZu4Gwm6cjaPXfB;7>M@KGyCofm$koW*k7h3}^0B8*cRR910

literal 0

HcmV?d00001