lib/fuzzing/fuzz_sddl_parse.c

   1 /*
   2   Fuzz sddl decoding and encoding
   3   Copyright (C) Catalyst IT 2023
   4
   5   This program is free software; you can redistribute it and/or modify
   6   it under the terms of the GNU General Public License as published by
   7   the Free Software Foundation; either version 3 of the License, or
   8   (at your option) any later version.
   9
  10   This program is distributed in the hope that it will be useful,
  11   but WITHOUT ANY WARRANTY; without even the implied warranty of
  12   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13   GNU General Public License for more details.
  14
  15   You should have received a copy of the GNU General Public License
  16   along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17 */
  18
  19 #include "includes.h"
  20 #include "libcli/security/security.h"
  21 #include "fuzzing/fuzzing.h"
  22
  23 #define MAX_LENGTH (100 * 1024 - 1)
  24 static char sddl_string[MAX_LENGTH + 1] = {0};
  25 static struct dom_sid dom_sid = {0};
  26
  27 int LLVMFuzzerInitialize(int *argc, char ***argv)
  28 {
  29         string_to_sid(&dom_sid,
  30                       "S-1-5-21-2470180966-3899876309-2637894779");
  31         return 0;
  32 }
  33
  34
  35 int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len)
  36 {
  37         TALLOC_CTX *mem_ctx = NULL;
  38         struct security_descriptor *sd1 = NULL;
  39         struct security_descriptor *sd2 = NULL;
  40         char *result = NULL;
  41         bool ok;
  42
  43         if (len > MAX_LENGTH) {
  44                 return 0;
  45         }
  46
  47         memcpy(sddl_string, input, len);
  48         sddl_string[len] = '\0';
  49
  50         mem_ctx = talloc_new(NULL);
  51
  52         sd1 = sddl_decode(mem_ctx, sddl_string, &dom_sid);
  53         if (sd1 == NULL) {
  54                 goto end;
  55         }
  56         result = sddl_encode(mem_ctx, sd1, &dom_sid);
  57         sd2 = sddl_decode(mem_ctx, result, &dom_sid);
  58         ok = security_descriptor_equal(sd1, sd2);
  59         if (!ok) {
  60                 abort();
  61         }
  62 end:
  63         talloc_free(mem_ctx);
  64         return 0;
  65 }