tests/lib/fuzz_zlog.c

   1 /*
   2  * zlog fuzzer target.
   3  *
   4  * This program is free software; you can redistribute it and/or modify it
   5  * under the terms of the GNU General Public License as published by the Free
   6  * Software Foundation; either version 2 of the License, or (at your option)
   7  * any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  12  * more details.
  13  *
  14  * You should have received a copy of the GNU General Public License along
  15  * with this program; see the file COPYING; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
  17  */
  18
  19 #include <zebra.h>
  20
  21 #include "log.h"
  22 #include "zlog_5424.h"
  23 #include "command.h"
  24
  25 struct input_opts {
  26         uint16_t out1_debug;
  27         uint16_t out2_debug;
  28         uint16_t out3_warn;
  29         uint8_t fmt;
  30         uint8_t dst;
  31 };
  32
  33 static char buffer[65536];
  34
  35 int main(int argc, char **argv)
  36 {
  37         struct input_opts io;
  38         int fd;
  39         int pair[2] = {-1, -1};
  40
  41         if (read(0, &io, sizeof(io)) != sizeof(io))
  42                 return 1;
  43         if (io.fmt > ZLOG_FMT_LAST)
  44                 return 1;
  45
  46         switch (io.dst) {
  47         case 0:
  48                 fd = 1;
  49                 break;
  50         case 1:
  51                 socketpair(AF_UNIX, SOCK_STREAM, 0, pair);
  52                 fd = pair[0];
  53                 break;
  54         case 2:
  55                 socketpair(AF_UNIX, SOCK_SEQPACKET, 0, pair);
  56                 fd = pair[0];
  57                 break;
  58         case 3:
  59                 socketpair(AF_UNIX, SOCK_DGRAM, 0, pair);
  60                 fd = pair[0];
  61                 break;
  62         default:
  63                 return 1;
  64         }
  65
  66         pid_t child = -1;
  67
  68         if (pair[1] != -1) {
  69                 child = fork();
  70
  71                 if (child == 0) {
  72                         char buf[4096];
  73
  74                         close(pair[0]);
  75
  76                         while (read(pair[1], buf, sizeof(buf)) > 0)
  77                                 ;
  78                         exit(0);
  79                 } else if (child == -1) {
  80                         perror("fork");
  81                         return 1;
  82                 }
  83                 close(pair[1]);
  84         }
  85
  86         for (size_t i = 0; i < sizeof(buffer); i++)
  87                 buffer[i] = (i | 0x20) & 0x7f;
  88
  89         zlog_aux_init("FUZZBALL: ", LOG_DEBUG);
  90         zlog_tls_buffer_init();
  91
  92         struct zlog_cfg_5424 cfg[1] = {};
  93
  94         zlog_5424_init(cfg);
  95
  96         cfg->facility = LOG_DAEMON;
  97         cfg->prio_min = LOG_DEBUG;
  98         cfg->kw_version = true;
  99         cfg->kw_location = true;
 100         cfg->kw_uid = true;
 101         cfg->kw_ec = true;
 102         cfg->kw_args = true;
 103
 104         cfg->ts_flags = 9;
 105         cfg->fmt = io.fmt;
 106         cfg->dst = ZLOG_5424_DST_FD;
 107         cfg->fd = fd;
 108
 109         cmd_hostname_set("TEST");
 110         cfg->master = thread_master_create("TEST");
 111
 112         zlog_5424_apply_dst(cfg);
 113
 114         zlog_debug("test #1 %.*s", (int)io.out1_debug, buffer);
 115         zlog_debug("test #2 %.*s", (int)io.out2_debug, buffer);
 116         zlog_warn("test #1 %.*s", (int)io.out3_warn, buffer);
 117
 118         zlog_tls_buffer_flush();
 119         zlog_tls_buffer_fini();
 120
 121         /* AFL++ seems to do some weird stuff with its fuzzing target, make
 122          * sure the fork() child is zapped here rather than creating hordes
 123          * of it.
 124          */
 125         close(fd);
 126         if (child != -1)
 127                 kill(child, SIGTERM);
 128
 129         return 0;
 130 }