lib/fuzzing/fuzz_ldap_decode.c

   1 /*
   2    Fuzzing for ldap_decode.
   3    Copyright (C) Michael Hanselmann 2019
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License as published by
   7    the Free Software Foundation; either version 3 of the License, or
   8    (at your option) any later version.
   9
  10    This program is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13    GNU General Public License for more details.
  14
  15    You should have received a copy of the GNU General Public License
  16    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 */
  18
  19 #include "includes.h"
  20 #include "fuzzing/fuzzing.h"
  21 #include "lib/util/asn1.h"
  22 #include "libcli/ldap/ldap_message.h"
  23 #include "libcli/ldap/ldap_proto.h"
  24
  25 int LLVMFuzzerInitialize(int *argc, char ***argv)
  26 {
  27         return 0;
  28 }
  29
  30 int LLVMFuzzerTestOneInput(uint8_t *buf, size_t len)
  31 {
  32         TALLOC_CTX *mem_ctx = talloc_init(__FUNCTION__);
  33         struct asn1_data *asn1;
  34         struct ldap_message *ldap_msg;
  35         struct ldap_request_limits limits = {
  36                 /*
  37                  * The default size is currently 256000 bytes
  38                  */
  39                 .max_search_size = 256000
  40         };
  41         NTSTATUS status;
  42
  43         /*
  44          * Need to limit the max parse tree depth to 250 to prevent
  45          * ASAN detecting stack overflows.
  46          */
  47         asn1 = asn1_init(mem_ctx, 250);
  48         if (!asn1) {
  49                 goto out;
  50         }
  51
  52         asn1_load_nocopy(asn1, buf, len);
  53
  54         ldap_msg = talloc(mem_ctx, struct ldap_message);
  55         if (!ldap_msg) {
  56                 goto out;
  57         }
  58
  59         status = ldap_decode(
  60                 asn1, &limits, samba_ldap_control_handlers(), ldap_msg);
  61
  62 out:
  63         talloc_free(mem_ctx);
  64
  65         return 0;
  66 }