etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
fuzz_usbfs.c (1673B)
      1 /*
      2  * Harness: linux_usbfs parse_config_descriptors via direct priv injection.
      3  * Input: raw descriptor blob — 18-byte device desc + config descriptors.
      4  */
      5 
      6 #include "fuzz-include/libusb_fuzz.h"
      7 #include "libusb-src/libusb/libusbi.h"
      8 
      9 int fuzz_parse_config_descriptors(struct libusb_device *dev);
     10 
     11 /* Must match layout in fuzz_usbfs_shim.c */
     12 struct linux_device_priv {
     13     char   *sysfs_dir;
     14     void   *descriptors;
     15     size_t  descriptors_len;
     16     void   *config_descriptors;
     17     int     active_config;
     18 };
     19 
     20 static int fuzz_one(const uint8_t *data, size_t size)
     21 {
     22     if (size < LIBUSB_DT_DEVICE_SIZE)
     23         return 0;
     24 
     25     size_t dev_padded = PTR_ALIGN(sizeof(struct libusb_device));
     26     uint8_t *block = calloc(1, dev_padded + sizeof(struct linux_device_priv));
     27     if (!block)
     28         return 0;
     29 
     30     struct libusb_device     *dev  = (struct libusb_device *)block;
     31     struct linux_device_priv *priv = (struct linux_device_priv *)(block + dev_padded);
     32 
     33     memcpy(&dev->device_descriptor, data, LIBUSB_DT_DEVICE_SIZE);
     34 
     35     priv->descriptors = malloc(size);
     36     if (!priv->descriptors) { free(block); return 0; }
     37     memcpy(priv->descriptors, data, size);
     38     priv->descriptors_len = size;
     39 
     40     fuzz_parse_config_descriptors(dev);
     41 
     42     free(priv->config_descriptors);
     43     free(priv->descriptors);
     44     free(block);
     45     return 0;
     46 }
     47 
     48 #ifdef __AFL_FUZZ_TESTCASE_LEN
     49 __AFL_FUZZ_INIT();
     50 int main(void)
     51 {
     52     __AFL_INIT();
     53     uint8_t *buf = __AFL_FUZZ_TESTCASE_BUF;
     54     while (__AFL_LOOP(10000))
     55         fuzz_one(buf, __AFL_FUZZ_TESTCASE_LEN);
     56     return 0;
     57 }
     58 #else
     59 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
     60 {
     61     return fuzz_one(data, size);
     62 }
     63 #endif