summaryrefslogtreecommitdiffhomepage
path: root/fuzz
diff options
context:
space:
mode:
Diffstat (limited to 'fuzz')
-rw-r--r--fuzz/fuzzer-kexcurve25519.c41
-rw-r--r--fuzz/fuzzer-kexdh.c40
-rw-r--r--fuzz/fuzzer-kexecdh.c62
3 files changed, 68 insertions, 75 deletions
diff --git a/fuzz/fuzzer-kexcurve25519.c b/fuzz/fuzzer-kexcurve25519.c
index f2eab14..78aaaea 100644
--- a/fuzz/fuzzer-kexcurve25519.c
+++ b/fuzz/fuzzer-kexcurve25519.c
@@ -6,33 +6,30 @@
#include "algo.h"
#include "bignum.h"
-int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
- static int once = 0;
- static struct key_context* keep_newkeys = NULL;
- /* number of generated parameters is limited by the timeout for the first run.
- TODO move this to the libfuzzer initialiser function instead if the timeout
- doesn't apply there */
- #define NUM_PARAMS 20
- static struct kex_curve25519_param *curve25519_params[NUM_PARAMS];
-
- if (!once) {
- fuzz_common_setup();
- fuzz_svr_setup();
+static struct key_context* keep_newkeys = NULL;
+/* An arbitrary limit */
+#define NUM_PARAMS 80
+static struct kex_curve25519_param *curve25519_params[NUM_PARAMS];
- keep_newkeys = (struct key_context*)m_malloc(sizeof(struct key_context));
- keep_newkeys->algo_kex = fuzz_get_algo(sshkex, "curve25519-sha256");
- keep_newkeys->algo_hostkey = DROPBEAR_SIGNKEY_ED25519;
- ses.newkeys = keep_newkeys;
+static void setup() __attribute__((constructor));
+// Perform initial setup here to avoid hitting timeouts on first run
+static void setup() {
+ fuzz_common_setup();
+ fuzz_svr_setup();
- /* Pre-generate parameters */
- int i;
- for (i = 0; i < NUM_PARAMS; i++) {
- curve25519_params[i] = gen_kexcurve25519_param();
- }
+ keep_newkeys = (struct key_context*)m_malloc(sizeof(struct key_context));
+ keep_newkeys->algo_kex = fuzz_get_algo(sshkex, "curve25519-sha256");
+ keep_newkeys->algo_hostkey = DROPBEAR_SIGNKEY_ED25519;
+ ses.newkeys = keep_newkeys;
- once = 1;
+ /* Pre-generate parameters */
+ int i;
+ for (i = 0; i < NUM_PARAMS; i++) {
+ curve25519_params[i] = gen_kexcurve25519_param();
}
+}
+int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) {
return 0;
}
diff --git a/fuzz/fuzzer-kexdh.c b/fuzz/fuzzer-kexdh.c
index 224ff58..1c44455 100644
--- a/fuzz/fuzzer-kexdh.c
+++ b/fuzz/fuzzer-kexdh.c
@@ -6,33 +6,29 @@
#include "algo.h"
#include "bignum.h"
-int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
- static int once = 0;
- static struct key_context* keep_newkeys = NULL;
- /* number of generated parameters is limited by the timeout for the first run.
- TODO move this to the libfuzzer initialiser function instead if the timeout
- doesn't apply there */
- #define NUM_PARAMS 20
- static struct kex_dh_param *dh_params[NUM_PARAMS];
-
- if (!once) {
- fuzz_common_setup();
- fuzz_svr_setup();
+static struct key_context* keep_newkeys = NULL;
+#define NUM_PARAMS 80
+static struct kex_dh_param *dh_params[NUM_PARAMS];
- keep_newkeys = (struct key_context*)m_malloc(sizeof(struct key_context));
- keep_newkeys->algo_kex = fuzz_get_algo(sshkex, "diffie-hellman-group14-sha256");
- keep_newkeys->algo_hostkey = DROPBEAR_SIGNKEY_ECDSA_NISTP256;
- ses.newkeys = keep_newkeys;
+static void setup() __attribute__((constructor));
+// Perform initial setup here to avoid hitting timeouts on first run
+static void setup() {
+ fuzz_common_setup();
+ fuzz_svr_setup();
- /* Pre-generate parameters */
- int i;
- for (i = 0; i < NUM_PARAMS; i++) {
- dh_params[i] = gen_kexdh_param();
- }
+ keep_newkeys = (struct key_context*)m_malloc(sizeof(struct key_context));
+ keep_newkeys->algo_kex = fuzz_get_algo(sshkex, "diffie-hellman-group14-sha256");
+ keep_newkeys->algo_hostkey = DROPBEAR_SIGNKEY_ECDSA_NISTP256;
+ ses.newkeys = keep_newkeys;
- once = 1;
+ /* Pre-generate parameters */
+ int i;
+ for (i = 0; i < NUM_PARAMS; i++) {
+ dh_params[i] = gen_kexdh_param();
}
+}
+int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) {
return 0;
}
diff --git a/fuzz/fuzzer-kexecdh.c b/fuzz/fuzzer-kexecdh.c
index c3a450a..217d730 100644
--- a/fuzz/fuzzer-kexecdh.c
+++ b/fuzz/fuzzer-kexecdh.c
@@ -6,38 +6,38 @@
#include "algo.h"
#include "bignum.h"
-int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
- static int once = 0;
- static const struct dropbear_kex *ecdh[3]; /* 256, 384, 521 */
- static struct key_context* keep_newkeys = NULL;
- /* number of generated parameters is limited by the timeout for the first run */
- #define NUM_PARAMS 80
- static struct kex_ecdh_param *ecdh_params[NUM_PARAMS];
-
- if (!once) {
- fuzz_common_setup();
- fuzz_svr_setup();
-
- /* ses gets zeroed by fuzz_set_input */
- keep_newkeys = (struct key_context*)m_malloc(sizeof(struct key_context));
- ecdh[0] = fuzz_get_algo(sshkex, "ecdh-sha2-nistp256");
- ecdh[1] = fuzz_get_algo(sshkex, "ecdh-sha2-nistp384");
- ecdh[2] = fuzz_get_algo(sshkex, "ecdh-sha2-nistp521");
- assert(ecdh[0]);
- assert(ecdh[1]);
- assert(ecdh[2]);
- keep_newkeys->algo_hostkey = DROPBEAR_SIGNKEY_ECDSA_NISTP256;
- ses.newkeys = keep_newkeys;
-
- /* Pre-generate parameters */
- int i;
- for (i = 0; i < NUM_PARAMS; i++) {
- ses.newkeys->algo_kex = ecdh[i % 3];
- ecdh_params[i] = gen_kexecdh_param();
- }
-
- once = 1;
+static const struct dropbear_kex *ecdh[3]; /* 256, 384, 521 */
+static struct key_context* keep_newkeys = NULL;
+/* number of generated parameters. An arbitrary limit, but will delay startup */
+#define NUM_PARAMS 80
+static struct kex_ecdh_param *ecdh_params[NUM_PARAMS];
+
+static void setup() __attribute__((constructor));
+// Perform initial setup here to avoid hitting timeouts on first run
+static void setup() {
+ fuzz_common_setup();
+ fuzz_svr_setup();
+
+ /* ses gets zeroed by fuzz_set_input */
+ keep_newkeys = (struct key_context*)m_malloc(sizeof(struct key_context));
+ ecdh[0] = fuzz_get_algo(sshkex, "ecdh-sha2-nistp256");
+ ecdh[1] = fuzz_get_algo(sshkex, "ecdh-sha2-nistp384");
+ ecdh[2] = fuzz_get_algo(sshkex, "ecdh-sha2-nistp521");
+ assert(ecdh[0]);
+ assert(ecdh[1]);
+ assert(ecdh[2]);
+ keep_newkeys->algo_hostkey = DROPBEAR_SIGNKEY_ECDSA_NISTP256;
+ ses.newkeys = keep_newkeys;
+
+ /* Pre-generate parameters */
+ int i;
+ for (i = 0; i < NUM_PARAMS; i++) {
+ ses.newkeys->algo_kex = ecdh[i % 3];
+ ecdh_params[i] = gen_kexecdh_param();
}
+}
+
+int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
if (fuzz_set_input(Data, Size) == DROPBEAR_FAILURE) {
return 0;
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-03 18:00:51 +0000