diff --git a/src/fuzz/fuzz-bus-label.c b/src/fuzz/fuzz-bus-label.c new file mode 100644 index 00000000000..46a3d23dc4a --- /dev/null +++ b/src/fuzz/fuzz-bus-label.c @@ -0,0 +1,18 @@ +/* SPDX-License-Identifier: LGPL-2.1+ */ + +#include + +#include "alloc-util.h" +#include "bus-label.h" +#include "fuzz.h" + +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + _cleanup_free_ char *unescaped = NULL, *escaped = NULL; + + unescaped = bus_label_unescape_n((const char*)data, size); + assert_se(unescaped != NULL); + escaped = bus_label_escape(unescaped); + assert_se(escaped != NULL); + + return 0; +} diff --git a/src/fuzz/fuzz-env-file.c b/src/fuzz/fuzz-env-file.c new file mode 100644 index 00000000000..51df1aab557 --- /dev/null +++ b/src/fuzz/fuzz-env-file.c @@ -0,0 +1,31 @@ +/* SPDX-License-Identifier: LGPL-2.1+ */ + +#include + +#include "alloc-util.h" +#include "env-file.h" +#include "fd-util.h" +#include "fuzz.h" +#include "strv.h" + +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + _cleanup_fclose_ FILE *f = NULL; + _cleanup_strv_free_ char **rl = NULL, **rlp = NULL; + + if (size == 0) + return 0; + + f = fmemopen((char*) data, size, "re"); + assert_se(f); + + /* We don't want to fill the logs with messages about parse errors. + * Disable most logging if not running standalone */ + if (!getenv("SYSTEMD_LOG_LEVEL")) + log_set_max_level(LOG_CRIT); + + (void) load_env_file(f, NULL, &rl); + assert_se(fseek(f, 0, SEEK_SET) == 0); + (void) load_env_file_pairs(f, NULL, &rlp); + + return 0; +} diff --git a/src/fuzz/fuzz-hostname-util.c b/src/fuzz/fuzz-hostname-util.c new file mode 100644 index 00000000000..deaf8112ba2 --- /dev/null +++ b/src/fuzz/fuzz-hostname-util.c @@ -0,0 +1,28 @@ +/* SPDX-License-Identifier: LGPL-2.1+ */ + +#include + +#include "alloc-util.h" +#include "fd-util.h" +#include "fuzz.h" +#include "hostname-util.h" + +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + _cleanup_fclose_ FILE *f = NULL; + _cleanup_free_ char *ret = NULL; + + if (size == 0) + return 0; + + f = fmemopen((char*) data, size, "re"); + assert_se(f); + + /* We don't want to fill the logs with messages about parse errors. + * Disable most logging if not running standalone */ + if (!getenv("SYSTEMD_LOG_LEVEL")) + log_set_max_level(LOG_CRIT); + + (void) read_etc_hostname_stream(f, &ret); + + return 0; +} diff --git a/src/fuzz/fuzz-nspawn-settings.c b/src/fuzz/fuzz-nspawn-settings.c new file mode 100644 index 00000000000..6c81eb773a7 --- /dev/null +++ b/src/fuzz/fuzz-nspawn-settings.c @@ -0,0 +1,28 @@ +/* SPDX-License-Identifier: LGPL-2.1+ */ + +#include + +#include "alloc-util.h" +#include "fd-util.h" +#include "fuzz.h" +#include "nspawn-settings.h" + +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + _cleanup_fclose_ FILE *f = NULL; + _cleanup_(settings_freep) Settings *s = NULL; + + if (size == 0) + return 0; + + f = fmemopen((char*) data, size, "re"); + assert_se(f); + + /* We don't want to fill the logs with messages about parse errors. + * Disable most logging if not running standalone */ + if (!getenv("SYSTEMD_LOG_LEVEL")) + log_set_max_level(LOG_CRIT); + + (void) settings_load(f, "/dev/null", &s); + + return 0; +} diff --git a/src/fuzz/meson.build b/src/fuzz/meson.build index 5138a2c4165..4a242f8a6ce 100644 --- a/src/fuzz/meson.build +++ b/src/fuzz/meson.build @@ -112,4 +112,21 @@ fuzzers += [ [['src/fuzz/fuzz-compress.c'], [libshared], []], + + [['src/fuzz/fuzz-bus-label.c'], + [libshared], + []], + + [['src/fuzz/fuzz-env-file.c'], + [libshared], + []], + + [['src/fuzz/fuzz-hostname-util.c'], + [libshared], + []], + + [['src/fuzz/fuzz-nspawn-settings.c'], + [libshared, + libnspawn_core], + []], ] diff --git a/src/nspawn/nspawn-mount.c b/src/nspawn/nspawn-mount.c index eb0a26ef35b..13f50b2d37b 100644 --- a/src/nspawn/nspawn-mount.c +++ b/src/nspawn/nspawn-mount.c @@ -206,7 +206,7 @@ int bind_mount_parse(CustomMount **l, size_t *n, const char *s, bool read_only) } if (isempty(source)) - source = NULL; + source = mfree(source); else if (!source_path_is_valid(source)) return -EINVAL; @@ -219,12 +219,10 @@ int bind_mount_parse(CustomMount **l, size_t *n, const char *s, bool read_only) if (!m) return -ENOMEM; - m->source = source; - m->destination = destination; + m->source = TAKE_PTR(source); + m->destination = TAKE_PTR(destination); m->read_only = read_only; - m->options = opts; - - source = destination = opts = NULL; + m->options = TAKE_PTR(opts); return 0; } diff --git a/test/fuzz/fuzz-env-file/simple-env-file b/test/fuzz/fuzz-env-file/simple-env-file new file mode 100644 index 00000000000..2cad6f7a211 --- /dev/null +++ b/test/fuzz/fuzz-env-file/simple-env-file @@ -0,0 +1,5 @@ +VARIABLE="value" +OPTION="--option=1234" +NUMBER=1 +EMPTY="" +PATH=/var/lib/xxx diff --git a/test/fuzz/fuzz-nspawn-settings/basic-config b/test/fuzz/fuzz-nspawn-settings/basic-config new file mode 100644 index 00000000000..be0d4e7c7bf --- /dev/null +++ b/test/fuzz/fuzz-nspawn-settings/basic-config @@ -0,0 +1,36 @@ +[Exec] +Boot=off +ProcessTwo=off +Parameters=/sbin/init -x=1 +Environment=THIS=that +User=user +WorkingDirectory=/cwd +PivotRoot=/newroot +Capability=CAP_NET +DropCapability=CAP_ADMIN +KillSignal=SIGTERM +Personality=shy +MachineID=edbfea3309ba41ea83e2318c58a8d498 +PrivateUser=1:2 +NotifyReady=no +SystemCallFilters=write + +[Files] +ReadOnly=no +Volatile=no +Bind=/bindthis +BindReadOnly=/bindthisro +TemporaryFileSystem=/thisismytmpfs:rw +Overlay=/thisisanoverlay:/thisisanoverlaytoo +PrivateUsersChown=no + +[Network] +Private=off +VirtualEthernet=yes +VirtualEthernetExtra=veth1:veth2 +Interface=eth1 enp0s1 +MacVLAN=eno1 eno2 +IPVLAN=eno3 enp2s124 +Bridge=bridge123 bridge125 +Zone=myzone +Port=1234 156 -1 diff --git a/test/fuzz/fuzz-nspawn-settings/leak-4ff0e2498f596a77ea68d185c61e9e9ff9bb657f b/test/fuzz/fuzz-nspawn-settings/leak-4ff0e2498f596a77ea68d185c61e9e9ff9bb657f new file mode 100644 index 00000000000..7be2d2c9da3 Binary files /dev/null and b/test/fuzz/fuzz-nspawn-settings/leak-4ff0e2498f596a77ea68d185c61e9e9ff9bb657f differ