etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
fuzz_nfs4.c (855B)
      1 /*
      2  * NFSv4 COMPOUND reply parsing. Largest and most stateful decoder in libnfs:
      3  * a single COMPOUND4res contains a variable-length array of operation
      4  * results, each tagged with an opcode that selects a different sub-decoder
      5  * (nfs_resop4 = tagged union). Prime target for length-confusion and tag
      6  * mismatch bugs.
      7  *
      8  * Reachable client-side via any NFSv4 mount; reachable through VLC/Kodi when
      9  * the user is tricked into opening an nfs:// URL pointing at attacker's
     10  * server.
     11  */
     12 #include "harness.h"
     13 #include "libnfs-raw-nfs4.h"
     14 
     15 static int fuzz_one(const uint8_t *data, size_t size)
     16 {
     17     ZDR zdr;
     18     COMPOUND4res res;
     19 
     20     nfs_zdrmem_decode(&zdr, data, size);
     21     memset(&res, 0, sizeof(res));
     22 
     23     if (zdr_COMPOUND4res(&zdr, &res)) {
     24         zdr_free((zdrproc_t)zdr_COMPOUND4res, (caddr_t)&res);
     25     }
     26     zdr_destroy(&zdr);
     27     return 0;
     28 }