#include "fuzz_common.h"
#include "internal.h"

Include dependency graph for fuzz_postprocessor.c:

Macros
#define	FUZZ_HARNESS_NAME "fuzz_postprocessor"

#define	ADD(s)

#define	PSEED(t)

Functions
static enum MHD_Result	dummy_ahc (void cls, struct MHD_Connection connection, const char url, const char method, const char version, const char upload_data, size_t upload_data_size, void *req_cls)

static void	stop_shared_daemon (void)

static void	print_stats (void)

static struct MHD_Daemon *	get_shared_daemon (void)

static enum MHD_Result	post_iter (void cls, enum MHD_ValueKind kind, const char key, const char filename, const char content_type, const char transfer_encoding, const char data, uint64_t off, size_t size)

int	LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)

static size_t	fuzz_generate (struct fuzz_rng rng, uint8_t buf, size_t cap)

static size_t	fuzz_seed_count (void)

static const uint8_t *	fuzz_seed_get (size_t idx, size_t *len)

Variables
static const size_t	pp_buf_sizes []

static const size_t	chunk_patterns []

static struct MHD_Daemon *	shared_daemon

static unsigned long	stat_pp_created

static unsigned long	stat_pp_failed

static unsigned long	stat_values

static const char *const	gen_disp []

static const char *const	gen_kv []

static const struct pp_seed	pp_seeds []

Detailed Description

Fuzzer for MHD_post_process()

Author: Christian Grothoff

MHD_create_post_processor() only ever looks at the "Content-Type" header of the connection it is given, so this harness fabricates the minimal connection object instead of pushing a whole request through a socket. That keeps the harness fast and lets the fuzzer control three dimensions that matter for the post processor and that a real request would not expose directly:

the raw Content-Type (encoding and multipart boundary),
the post processor buffer size,
how the POST data is split across MHD_post_process() calls.

Input format: byte 0 content type selector byte 1 post processor buffer size selector byte 2 chunking pattern selector byte 3 length of the boundary taken from the payload byte 4.. the POST data

Definition in file fuzz_postprocessor.c.

Macro Definition Documentation

◆ ADD

#define ADD ( s )

Value:

  do { \
    const char *s_ = (s); \
    size_t l_ = strlen (s_); \
    if (len + l_ >= cap) \
    return len; \
    memcpy (buf + len, s_, l_); \
    len += l_; \
  } while (0)

Referenced by fuzz_generate().

◆ FUZZ_HARNESS_NAME

#define FUZZ_HARNESS_NAME "fuzz_postprocessor"

Definition at line 44 of file fuzz_postprocessor.c.

Referenced by print_stats().

◆ PSEED

#define PSEED ( t )

Value:

{ t, sizeof (t) - 1 }

Definition at line 443 of file fuzz_postprocessor.c.

Function Documentation

◆ dummy_ahc()

static enum MHD_Result dummy_ahc	(	void *	cls,
		struct MHD_Connection *	connection,
		const char *	url,
		const char *	method,
		const char *	version,
		const char *	upload_data,
		size_t *	upload_data_size,
		void **	req_cls )

static

Definition at line 68 of file fuzz_postprocessor.c.

References MHD_NO.

Referenced by get_shared_daemon().

Here is the caller graph for this function:

◆ fuzz_generate()

static size_t fuzz_generate	(	struct fuzz_rng *	rng,
		uint8_t *	buf,
		size_t	cap )

static

Definition at line 349 of file fuzz_postprocessor.c.

References ADD, fuzz_below(), fuzz_byte(), fuzz_chance(), gen_disp, and gen_kv.

Here is the call graph for this function:

◆ fuzz_seed_count()

static size_t fuzz_seed_count ( void )

static

Definition at line 465 of file fuzz_postprocessor.c.

References pp_seeds.

◆ fuzz_seed_get()

static const uint8_t * fuzz_seed_get	(	size_t	idx,
		size_t *	len )

static

Definition at line 472 of file fuzz_postprocessor.c.

References pp_seeds.

◆ get_shared_daemon()

static struct MHD_Daemon * get_shared_daemon ( void )

static

Definition at line 108 of file fuzz_postprocessor.c.

References dummy_ahc(), fuzz_verbose, MHD_OPTION_END, MHD_start_daemon(), MHD_USE_ERROR_LOG, MHD_USE_NO_LISTEN_SOCKET, NULL, print_stats(), shared_daemon, and stop_shared_daemon().

Referenced by LLVMFuzzerTestOneInput().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ LLVMFuzzerTestOneInput()

int LLVMFuzzerTestOneInput	(	const uint8_t *	data,
		size_t	size )

The fuzz target. Signature is the libFuzzer one on purpose, so that the very same harness can be linked with libFuzzer or AFL++ later.

< see queue_unprocessed_conn()

Definition at line 188 of file fuzz_postprocessor.c.

References chunk_patterns, MHD_Connection::daemon, data, get_shared_daemon(), MHD_HTTP_Req_Header::header, MHD_HTTP_Req_Header::header_size, MHD_Request::headers_received, MHD_Request::headers_received_tail, MHD_HTTP_Req_Header::kind, MHD_CONNECTION_HEADERS_PROCESSED, MHD_create_post_processor(), MHD_destroy_post_processor(), MHD_HEADER_KIND, MHD_HTTP_HEADER_CONTENT_TYPE, MHD_HTTP_POST_ENCODING_FORM_URLENCODED, MHD_HTTP_POST_ENCODING_MULTIPART_FORMDATA, MHD_post_process(), MHD_STATICSTR_LEN_, NULL, post_iter(), pp_buf_sizes, MHD_Connection::rq, shared_daemon, stat_pp_created, stat_pp_failed, MHD_Connection::state, MHD_HTTP_Req_Header::value, and MHD_HTTP_Req_Header::value_size.

Here is the call graph for this function:

◆ post_iter()

static enum MHD_Result post_iter	(	void *	cls,
		enum MHD_ValueKind	kind,
		const char *	key,
		const char *	filename,
		const char *	content_type,
		const char *	transfer_encoding,
		const char *	data,
		uint64_t	off,
		size_t	size )

static

Definition at line 136 of file fuzz_postprocessor.c.

References data, fuzz_report_finding(), MHD_YES, NULL, and stat_values.

Referenced by LLVMFuzzerTestOneInput().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ print_stats()

static void print_stats ( void )

static

Definition at line 95 of file fuzz_postprocessor.c.

References FUZZ_HARNESS_NAME, fuzz_verbose, stat_pp_created, stat_pp_failed, and stat_values.

Referenced by get_shared_daemon().

Here is the caller graph for this function:

◆ stop_shared_daemon()

static void stop_shared_daemon ( void )

static

Definition at line 84 of file fuzz_postprocessor.c.

References MHD_stop_daemon(), NULL, and shared_daemon.

Referenced by get_shared_daemon().

Here is the call graph for this function:

Here is the caller graph for this function:

Variable Documentation

◆ chunk_patterns

const size_t chunk_patterns[]

static

Initial value:

= {
  1, 2, 3, 5, 7, 13, 32, 64, 1024, 0 
}

Definition at line 55 of file fuzz_postprocessor.c.

Referenced by LLVMFuzzerTestOneInput().

◆ gen_disp

const char* const gen_disp[]

static

Initial value:

= {
  "Content-Disposition: form-data; name=\"a\"",
  "Content-Disposition: form-data; name=\"a\"; filename=\"f.txt\"",
  "Content-Disposition: form-data; name=a",
  "Content-Disposition: form-data",
  "Content-Disposition: attachment; name=\"a\"",
  "Content-Disposition: form-data; name=\"\"",
  "Content-Disposition: form-data; name=\"a",
  "Content-Type: text/plain",
  "Content-Transfer-Encoding: binary",
  "X-Other: value"
}

Definition at line 328 of file fuzz_postprocessor.c.

Referenced by fuzz_generate().

◆ gen_kv

const char* const gen_kv[]

static

Initial value:

= {
  "a=1", "b=%41", "c", "d=", "=e", "&", "&&", "a=%", "a=%4", "a=%zz",
  "verylongkeyname=verylongvaluewithlotsofcharacters", "a+b=c+d",
  "%41%42=%43%44"
}

Definition at line 341 of file fuzz_postprocessor.c.

Referenced by fuzz_generate().

◆ pp_buf_sizes

const size_t pp_buf_sizes[]

static

Initial value:

= {
  256, 257, 300, 512, 1024, 2048, 4096, 65536
}

Definition at line 51 of file fuzz_postprocessor.c.

Referenced by LLVMFuzzerTestOneInput().

◆ pp_seeds

const struct pp_seed pp_seeds[]

static

Initial value:

= {
  PSEED ("\x00\x00\x00\x00" "a=1&b=%41&c"),
  PSEED ("\x00\x00\x04\x00" "a=1&b=%41&c"),
  PSEED ("\x00\x00\x00\x00" "a=%"),
  PSEED ("\x00\x00\x00\x00" "&&&&"),
  PSEED ("\x01\x00\x00\x05" "--abc\r\n----abc\r\n"
         "Content-Disposition: form-data; name=\"k\"\r\n\r\nvalue\r\n"
         "----abc--\r\n"),
  PSEED ("\x01\x00\x01\x05" "--abc\r\n----abc\r\n"
         "Content-Disposition: form-data; name=\"k\"; filename=\"f\"\r\n"
         "Content-Type: text/plain\r\n\r\nvalue\r\n----abc--\r\n"),
  PSEED ("\x01\x07\x02\x02" "XY\r\n--XY\r\n\r\nnoheaders\r\n--XY--\r\n"),
  PSEED ("\x01\x00\x00\x01" "-\r\n---\r\n\r\nx\r\n-----\r\n"),
  PSEED ("\x04\x00\x00\x00" "no boundary at all"),
  PSEED ("\x05\x00\x00\x00" "text/plain body"),
 
}

Definition at line 445 of file fuzz_postprocessor.c.

Referenced by fuzz_seed_count(), and fuzz_seed_get().

◆ shared_daemon

struct MHD_Daemon* shared_daemon

static

Definition at line 59 of file fuzz_postprocessor.c.

Referenced by get_shared_daemon(), LLVMFuzzerTestOneInput(), and stop_shared_daemon().

◆ stat_pp_created

unsigned long stat_pp_created

static

Statistics, printed at exit with –verbose.

Definition at line 62 of file fuzz_postprocessor.c.

Referenced by LLVMFuzzerTestOneInput(), and print_stats().

◆ stat_pp_failed

unsigned long stat_pp_failed

static

Definition at line 63 of file fuzz_postprocessor.c.

Referenced by LLVMFuzzerTestOneInput(), and print_stats().

◆ stat_values

unsigned long stat_values

static

Definition at line 64 of file fuzz_postprocessor.c.

Referenced by post_iter(), and print_stats().

Macros

Functions

Variables

Detailed Description

Macro Definition Documentation

◆ ADD

◆ FUZZ_HARNESS_NAME

◆ PSEED

Function Documentation

◆ dummy_ahc()

◆ fuzz_generate()

◆ fuzz_seed_count()

◆ fuzz_seed_get()

◆ get_shared_daemon()

◆ LLVMFuzzerTestOneInput()

◆ post_iter()

◆ print_stats()

◆ stop_shared_daemon()

Variable Documentation

◆ chunk_patterns

◆ gen_disp

◆ gen_kv

◆ pp_buf_sizes

◆ pp_seeds

◆ shared_daemon

◆ stat_pp_created

◆ stat_pp_failed

◆ stat_values