tests: add a fuzzer for server_process_native_file

(cherry picked from commit a4aa59bae206eebb4703b291147144def5d4bb3e)

Resolves: #1764560

diff --git a/src/fuzz/fuzz-journald-native-fd.c b/src/fuzz/fuzz-journald-native-fd.c
new file mode 100644 (file)
index 0000000..95415d9
--- /dev/null
+++ b/src/fuzz/fuzz-journald-native-fd.c
@@ -0,0 +1,47 @@
+/* SPDX-License-Identifier: LGPL-2.1+ */
+
+#include "fd-util.h"
+#include "fileio.h"
+#include "fs-util.h"
+#include "fuzz.h"
+#include "fuzz-journald.h"
+#include "journald-native.h"
+#include "memfd-util.h"
+#include "process-util.h"
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+        Server s;
+        _cleanup_close_ int sealed_fd = -1, unsealed_fd = -1;
+        _cleanup_(unlink_tempfilep) char name[] = "/tmp/fuzz-journald-native-fd.XXXXXX";
+        char *label = NULL;
+        size_t label_len = 0;
+        struct ucred ucred;
+        struct timeval *tv = NULL;
+
+        if (!getenv("SYSTEMD_LOG_LEVEL"))
+                log_set_max_level(LOG_CRIT);
+
+        dummy_server_init(&s, NULL, 0);
+
+        sealed_fd = memfd_new(NULL);
+        assert_se(sealed_fd >= 0);
+        assert_se(write(sealed_fd, data, size) == (ssize_t) size);
+        assert_se(memfd_set_sealed(sealed_fd) >= 0);
+        assert_se(lseek(sealed_fd, 0, SEEK_SET) == 0);
+        ucred = (struct ucred) {
+                .pid = getpid_cached(),
+                .uid = geteuid(),
+                .gid = getegid(),
+        };
+        server_process_native_file(&s, sealed_fd, &ucred, tv, label, label_len);
+
+        unsealed_fd = mkostemp_safe(name);
+        assert_se(unsealed_fd >= 0);
+        assert_se(write(unsealed_fd, data, size) == (ssize_t) size);
+        assert_se(lseek(unsealed_fd, 0, SEEK_SET) == 0);
+        server_process_native_file(&s, unsealed_fd, &ucred, tv, label, label_len);
+
+        server_done(&s);
+
+        return 0;
+}

diff --git a/src/fuzz/meson.build b/src/fuzz/meson.build
index eea9117360fa117cfa2945fdc2f1677c6951dfba..5315d2771cca87cac23a1938847ed10749a3c4ab 100644 (file)
--- a/src/fuzz/meson.build
+++ b/src/fuzz/meson.build
@@ -51,6 +51,12 @@ fuzzers += [
           libshared],
          [libselinux]],
 
+        [['src/fuzz/fuzz-journald-native-fd.c',
+          'src/fuzz/fuzz-journald.c'],
+         [libjournal_core,
+          libshared],
+         [libselinux]],
+
         [['src/fuzz/fuzz-journald-stream.c',
           'src/fuzz/fuzz-journald.c'],
          [libjournal_core,

diff --git a/test/fuzz/fuzz-journald-native-fd/basic b/test/fuzz/fuzz-journald-native-fd/basic
new file mode 100644 (file)
index 0000000..65f8970
Binary files /dev/null and b/test/fuzz/fuzz-journald-native-fd/basic differ