diff options
| author | Matt Johnston <matt@ucc.asn.au> | 2018-03-04 21:44:09 +0800 |
|---|---|---|
| committer | Matt Johnston <matt@ucc.asn.au> | 2018-03-04 21:44:09 +0800 |
| commit | f7dedab4a7323e0bd5e1fe2b40d17e0d8beefa19 (patch) | |
| tree | c0243645cb5bb215ed65437dbcc7e7b51ad7702e | |
| parent | 129c4403622479e7b3d8363b8bbce16010bf3b5c (diff) | |
- fuzzer-pubkey needs to free algoname, fix build
- improve dictionary with lengths
| -rw-r--r-- | fuzzer-pubkey.c | 5 | ||||
| -rw-r--r-- | fuzzer-pubkey.dict | 10 |
2 files changed, 8 insertions, 7 deletions
diff --git a/fuzzer-pubkey.c b/fuzzer-pubkey.c index cb648e4..a062e1f 100644 --- a/fuzzer-pubkey.c +++ b/fuzzer-pubkey.c @@ -25,9 +25,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { buffer *keyblob = buf_getstringbuf(fuzz.input); unsigned int algolen; - const char* algoname = buf_getstring(keyblob, &algolen); + char* algoname = buf_getstring(keyblob, &algolen); - if (have_algo(algo, algolen, sshhostkey) == DROPBEAR_FAILURE) { + if (have_algo(algoname, algolen, sshhostkey) == DROPBEAR_FAILURE) { dropbear_exit("fuzzer imagined a bogus algorithm"); } fuzz_checkpubkey_line(line, 5, "/home/me/authorized_keys", @@ -36,6 +36,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { buf_free(line); buf_free(keyblob); + m_free(algoname); m_malloc_free_epoch(1, 0); } else { m_malloc_free_epoch(1, 1); diff --git a/fuzzer-pubkey.dict b/fuzzer-pubkey.dict index daf12cf..734629c 100644 --- a/fuzzer-pubkey.dict +++ b/fuzzer-pubkey.dict @@ -1,8 +1,8 @@ -"ssh-rsa" -"ssh-dss" -"ecdsa-sha2-nistp256" -"ecdsa-sha2-nistp384" -"ecdsa-sha2-nistp521" +"\x00\x00\x00\x07ssh-rsa" +"\x00\x00\x00\x07ssh-dss" +"\x00\x00\x00\x13ecdsa-sha2-nistp256" +"\x00\x00\x00\x13ecdsa-sha2-nistp384" +"\x00\x00\x00\x13ecdsa-sha2-nistp521" "no-port-forwarding" "no-port-forwarding" "no-agent-forwarding" |