etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
fuzz_import.c (2054B)
      1 /*
      2  * fuzz_import.c — USB/IP device import reply parsing harness.
      3  *
      4  * Exercises op_import_reply parsing: struct op_import_reply contains a
      5  * usbip_usb_device (busid, speed, descriptor fields).
      6  *
      7  * Also exercises the request-builder path: sends op_import_request with
      8  * a fuzzer-supplied busid, exercising the busid field copy and send path.
      9  *
     10  * Bug classes: busid not NUL-terminated, busid with path-traversal chars,
     11  * busid with format-string tokens, malformed usbip_usb_device struct fields.
     12  *
     13  * Input format:
     14  *   [32-byte busid, possibly without NUL][op_import_reply bytes...]
     15  */
     16 
     17 #include "fuzz-include/usbip_fuzz.h"
     18 #include "usbip-src/libsrc/usbip_common.h"
     19 #include "usbip-src/src/usbip_network.h"
     20 
     21 #include <stdint.h>
     22 #include <stdlib.h>
     23 #include <string.h>
     24 
     25 #define FAKE_FD   42
     26 #define MIN_INPUT (SYSFS_BUS_ID_SIZE + sizeof(struct op_import_reply))
     27 
     28 static int fuzz_one(const uint8_t *data, size_t size)
     29 {
     30     if (size < MIN_INPUT)
     31         return 0;
     32 
     33     /* Path A: parse import reply (server → client direction) */
     34     fuzz_reset(data + SYSFS_BUS_ID_SIZE, size - SYSFS_BUS_ID_SIZE);
     35 
     36     struct op_import_reply reply;
     37     memset(&reply, 0, sizeof(reply));
     38     if (usbip_net_recv(FAKE_FD, &reply, sizeof(reply)) == 0)
     39         PACK_OP_IMPORT_REPLY(0, &reply);
     40 
     41     /* Path B: build and send import request with fuzz-supplied busid */
     42     struct op_import_request request;
     43     memset(&request, 0, sizeof(request));
     44     memcpy(request.busid, data, SYSFS_BUS_ID_SIZE);
     45     /* Intentionally don't force NUL-termination — that's the test */
     46     PACK_OP_IMPORT_REQUEST(1, &request);
     47 
     48     fuzz_reset(data, size);
     49     usbip_net_send(FAKE_FD, &request, sizeof(request));
     50 
     51     return 0;
     52 }
     53 
     54 #ifdef __AFL_FUZZ_TESTCASE_LEN
     55 __AFL_FUZZ_INIT();
     56 
     57 int main(void)
     58 {
     59     __AFL_INIT();
     60     uint8_t *buf = __AFL_FUZZ_TESTCASE_BUF;
     61     while (__AFL_LOOP(10000)) {
     62         fuzz_one(buf, __AFL_FUZZ_TESTCASE_LEN);
     63     }
     64     return 0;
     65 }
     66 
     67 #else
     68 
     69 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
     70 {
     71     return fuzz_one(data, size);
     72 }
     73 
     74 #endif