ClearML/dropbear
1
0
Fork 0
mirror of https://github.com/clearml/dropbear synced 2025-03-09 21:41:07 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add a flag whether to longjmp, missed that last commit

Browse Source 
--HG--
branch : fuzz
This commit is contained in:
Matt Johnston 2017-06-01 21:30:26 +08:00
parent ea0e23c172
commit 81b64ea0b5
5 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
dbutil.c
View File

@ -122,7 +122,7 @@ static void generic_dropbear_exit(int exitcode, const char* format,
#ifdef DROPBEAR_FUZZ #ifdef DROPBEAR_FUZZ
// longjmp before cleaning up svr_opts // longjmp before cleaning up svr_opts
if (fuzz.fuzzing) { if (fuzz.do_jmp) {
longjmp(fuzz.jmp, 1); longjmp(fuzz.jmp, 1);
} }
#endif #endif

1
fuzz-common.c
View File

@ -17,6 +17,7 @@ static void load_fixed_hostkeys(void);
void common_setup_fuzzer(void) { void common_setup_fuzzer(void) {
fuzz.fuzzing = 1; fuzz.fuzzing = 1;
fuzz.wrapfds = 1; fuzz.wrapfds = 1;
fuzz.do_jmp = 1;
fuzz.input = m_malloc(sizeof(buffer)); fuzz.input = m_malloc(sizeof(buffer));
_dropbear_log = fuzz_dropbear_log; _dropbear_log = fuzz_dropbear_log;
crypto_init(); crypto_init();

1
fuzz.h
View File

@ -49,6 +49,7 @@ struct dropbear_fuzz_options {
int wrapfds; int wrapfds;
// dropbear_exit() jumps back // dropbear_exit() jumps back
int do_jmp;
sigjmp_buf jmp; sigjmp_buf jmp;
uid_t pw_uid; uid_t pw_uid;

4
fuzzer-preauth.c
View File

@ -12,6 +12,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
static int once = 0; static int once = 0;
if (!once) { if (!once) {
setup_fuzzer(); setup_fuzzer();
// XXX temporarily disable setjmp to debug asan segv
fuzz.do_jmp = 0;
once = 1; once = 1;
} }
@ -40,7 +42,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
wrapfd_add(fakesock, fuzz.input, PLAIN); wrapfd_add(fakesock, fuzz.input, PLAIN);
m_malloc_set_epoch(1); m_malloc_set_epoch(1);
// temporarily disable setjmp to debug asan segv // XXX temporarily disable setjmp to debug asan segv
svr_session(fakesock, fakesock); svr_session(fakesock, fakesock);
#if 0 #if 0
if (setjmp(fuzz.jmp) == 0) { if (setjmp(fuzz.jmp) == 0) {

2
svr-session.c
View File

@ -185,7 +185,7 @@ void svr_dropbear_exit(int exitcode, const char* format, va_list param) {
#ifdef DROPBEAR_FUZZ #ifdef DROPBEAR_FUZZ
// longjmp before cleaning up svr_opts // longjmp before cleaning up svr_opts
if (fuzz.fuzzing) { if (fuzz.do_jmp) {
longjmp(fuzz.jmp, 1); longjmp(fuzz.jmp, 1);
} }
#endif #endif