|
| 1 | +#define _GNU_SOURCE |
| 2 | + |
| 3 | +#include <stdio.h> |
| 4 | +#include <stdlib.h> |
| 5 | +#include <stdbool.h> |
| 6 | +#include <string.h> |
| 7 | +#include <unistd.h> |
| 8 | + |
| 9 | +#include "libyang.h" |
| 10 | + |
| 11 | +static const char mounted_module[] = |
| 12 | + "module fuzz-sm-leaf {" |
| 13 | + "namespace \"urn:tests:fuzz-sm-leaf\";" |
| 14 | + "prefix fsl;" |
| 15 | + "leaf lfl {type uint16;}" |
| 16 | + "leaf txt {type string;}" |
| 17 | + "}"; |
| 18 | + |
| 19 | +static const char mount_module[] = |
| 20 | + "module fuzz-sm {" |
| 21 | + "yang-version 1.1;" |
| 22 | + "namespace \"urn:tests:fuzz-sm\";" |
| 23 | + "prefix fsm;" |
| 24 | + "import ietf-yang-schema-mount {prefix sm;}" |
| 25 | + "container root {sm:mount-point \"root\";}" |
| 26 | + "}"; |
| 27 | + |
| 28 | +static const char ext_data_xml[] = |
| 29 | + "<yang-library xmlns=\"urn:ietf:params:xml:ns:yang:ietf-yang-library\">" |
| 30 | + "<module-set><name>fuzz-set</name><module><name>fuzz-sm-leaf</name>" |
| 31 | + "<namespace>urn:tests:fuzz-sm-leaf</namespace></module></module-set>" |
| 32 | + "<content-id>1</content-id></yang-library>" |
| 33 | + "<modules-state xmlns=\"urn:ietf:params:xml:ns:yang:ietf-yang-library\">" |
| 34 | + "<module-set-id>1</module-set-id></modules-state>" |
| 35 | + "<schema-mounts xmlns=\"urn:ietf:params:xml:ns:yang:ietf-yang-schema-mount\">" |
| 36 | + "<mount-point><module>fuzz-sm</module><label>root</label><inline/></mount-point>" |
| 37 | + "</schema-mounts>"; |
| 38 | + |
| 39 | +static const char mount_module_dir_template[] = "/tmp/libyang-sm-fuzz.XXXXXX"; |
| 40 | +static char mount_module_dir[sizeof mount_module_dir_template]; |
| 41 | +static ly_bool mount_module_dir_ready; |
| 42 | + |
| 43 | +static void |
| 44 | +remove_mount_module_dir(void) |
| 45 | +{ |
| 46 | + char path[sizeof mount_module_dir + sizeof "/fuzz-sm-leaf.yang"]; |
| 47 | + |
| 48 | + if (!mount_module_dir_ready) { |
| 49 | + return; |
| 50 | + } |
| 51 | + |
| 52 | + snprintf(path, sizeof path, "%s/fuzz-sm-leaf.yang", mount_module_dir); |
| 53 | + unlink(path); |
| 54 | + rmdir(mount_module_dir); |
| 55 | + mount_module_dir[0] = 0; |
| 56 | + mount_module_dir_ready = 0; |
| 57 | +} |
| 58 | + |
| 59 | +static LY_ERR |
| 60 | +prepare_mount_module_dir(void) |
| 61 | +{ |
| 62 | + char path[sizeof mount_module_dir + sizeof "/fuzz-sm-leaf.yang"]; |
| 63 | + FILE *f; |
| 64 | + |
| 65 | + if (mount_module_dir_ready) { |
| 66 | + return LY_SUCCESS; |
| 67 | + } |
| 68 | + |
| 69 | + memcpy(mount_module_dir, mount_module_dir_template, sizeof mount_module_dir); |
| 70 | + if (!mkdtemp(mount_module_dir)) { |
| 71 | + mount_module_dir[0] = 0; |
| 72 | + return LY_ESYS; |
| 73 | + } |
| 74 | + mount_module_dir_ready = 1; |
| 75 | + atexit(remove_mount_module_dir); |
| 76 | + |
| 77 | + snprintf(path, sizeof path, "%s/fuzz-sm-leaf.yang", mount_module_dir); |
| 78 | + f = fopen(path, "w"); |
| 79 | + if (!f) { |
| 80 | + remove_mount_module_dir(); |
| 81 | + return LY_ESYS; |
| 82 | + } |
| 83 | + |
| 84 | + if (fputs(mounted_module, f) == EOF) { |
| 85 | + fclose(f); |
| 86 | + remove_mount_module_dir(); |
| 87 | + return LY_ESYS; |
| 88 | + } |
| 89 | + if (fclose(f) == EOF) { |
| 90 | + remove_mount_module_dir(); |
| 91 | + return LY_ESYS; |
| 92 | + } |
| 93 | + |
| 94 | + return LY_SUCCESS; |
| 95 | +} |
| 96 | + |
| 97 | +static LY_ERR |
| 98 | +fuzz_ext_data_clb(const struct lysc_ext_instance *ext, const struct lyd_node *parent, void *user_data, |
| 99 | + void **ext_data, ly_bool *ext_data_free) |
| 100 | +{ |
| 101 | + struct lyd_node *data = NULL; |
| 102 | + static ly_bool recursive_call; |
| 103 | + LY_ERR ret = LY_SUCCESS; |
| 104 | + |
| 105 | + (void)ext; |
| 106 | + (void)parent; |
| 107 | + |
| 108 | + *ext_data = NULL; |
| 109 | + *ext_data_free = 0; |
| 110 | + |
| 111 | + if (recursive_call) { |
| 112 | + return LY_SUCCESS; |
| 113 | + } |
| 114 | + |
| 115 | + recursive_call = 1; |
| 116 | + ret = lyd_parse_data_mem(user_data, ext_data_xml, LYD_XML, LYD_PARSE_STRICT, LYD_VALIDATE_PRESENT, &data); |
| 117 | + recursive_call = 0; |
| 118 | + if (ret) { |
| 119 | + lyd_free_all(data); |
| 120 | + return ret; |
| 121 | + } |
| 122 | + |
| 123 | + *ext_data = data; |
| 124 | + *ext_data_free = 1; |
| 125 | + return LY_SUCCESS; |
| 126 | +} |
| 127 | + |
| 128 | +int LLVMFuzzerTestOneInput(uint8_t const *buf, size_t len) |
| 129 | +{ |
| 130 | + struct ly_ctx *ctx = NULL; |
| 131 | + struct lyd_node *tree = NULL; |
| 132 | + char *data = NULL; |
| 133 | + static bool log = false; |
| 134 | + |
| 135 | + if (!log) { |
| 136 | + ly_log_options(0); |
| 137 | + log = true; |
| 138 | + } |
| 139 | + |
| 140 | + if (prepare_mount_module_dir() != LY_SUCCESS) { |
| 141 | + return 0; |
| 142 | + } |
| 143 | + |
| 144 | + if (ly_ctx_new(LY_SRC_DIR "/modules", 0, &ctx) != LY_SUCCESS) { |
| 145 | + return 0; |
| 146 | + } |
| 147 | + if (ly_ctx_set_searchdir(ctx, mount_module_dir) != LY_SUCCESS) { |
| 148 | + goto cleanup; |
| 149 | + } |
| 150 | + if (lys_parse_mem(ctx, mount_module, LYS_IN_YANG, NULL) != LY_SUCCESS) { |
| 151 | + goto cleanup; |
| 152 | + } |
| 153 | + |
| 154 | + ly_ctx_set_ext_data_clb(ctx, fuzz_ext_data_clb, ctx); |
| 155 | + |
| 156 | + data = malloc(len + 1); |
| 157 | + if (!data) { |
| 158 | + goto cleanup; |
| 159 | + } |
| 160 | + memcpy(data, buf, len); |
| 161 | + data[len] = 0; |
| 162 | + |
| 163 | + lyd_parse_data_mem(ctx, data, LYD_XML, 0, LYD_VALIDATE_PRESENT | LYD_VALIDATE_MULTI_ERROR, &tree); |
| 164 | + |
| 165 | +cleanup: |
| 166 | + lyd_free_all(tree); |
| 167 | + free(data); |
| 168 | + ly_ctx_destroy(ctx); |
| 169 | + return 0; |
| 170 | +} |
0 commit comments