From 88ef5e1774d2977d98799b722a39b0d3e05f15bb Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Tue, 6 Jan 2026 23:46:01 +0000 Subject: [PATCH] Add fuzzer for proxy v1 --- .gitignore | 1 + fuzzing/broker/Makefile | 6 ++ fuzzing/broker/broker_fuzz_proxy_v1.cpp | 88 ++++++++++++++++++ .../broker_fuzz_proxy_v1_seed_corpus.zip | Bin 0 -> 9345 bytes 4 files changed, 95 insertions(+) create mode 100644 fuzzing/broker/broker_fuzz_proxy_v1.cpp create mode 100644 fuzzing/corpora/broker_fuzz_proxy_v1_seed_corpus.zip diff --git a/.gitignore b/.gitignore index a201821bc..07b5a60fa 100644 --- a/.gitignore +++ b/.gitignore @@ -61,6 +61,7 @@ fuzzing/broker/broker_fuzz_handle_unsubscribe fuzzing/broker/broker_fuzz_initial_packet fuzzing/broker/broker_fuzz_initial_packet_with_init fuzzing/broker/broker_fuzz_password_file +fuzzing/broker/broker_fuzz_proxy_v1 fuzzing/broker/broker_fuzz_proxy_v2 fuzzing/broker/broker_fuzz_psk_file fuzzing/broker/broker_fuzz_queue_msg diff --git a/fuzzing/broker/Makefile b/fuzzing/broker/Makefile index a3a150c36..7ef25b4b8 100644 --- a/fuzzing/broker/Makefile +++ b/fuzzing/broker/Makefile @@ -6,6 +6,7 @@ include ${R}/fuzzing/config.mk FUZZERS:= \ broker_fuzz_acl_file \ broker_fuzz_password_file \ + broker_fuzz_proxy_v1 \ broker_fuzz_proxy_v2 \ broker_fuzz_psk_file \ broker_fuzz_queue_msg \ @@ -49,6 +50,11 @@ broker_fuzz_password_file : broker_fuzz_password_file.cpp ${R}/src/mosquitto_bro install $@ ${OUT}/$@ cp ${R}/fuzzing/corpora/broker_password_file_seed_corpus.zip ${OUT}/$@_seed_corpus.zip +broker_fuzz_proxy_v1 : broker_fuzz_proxy_v1.cpp ${R}/src/proxy_v1.o + $(CXX) $(LOCAL_CXXFLAGS) $(LOCAL_CPPFLAGS) $(LOCAL_LDFLAGS) -o $@ $< ${R}/src/proxy_v1.o $(LOCAL_LIBADD) + cp ${R}/fuzzing/corpora/broker_fuzz_proxy_v1_seed_corpus.zip ${OUT}/$@_seed_corpus.zip + install $@ ${OUT}/$@ + broker_fuzz_proxy_v2 : broker_fuzz_proxy_v2.cpp ${R}/src/proxy_v2.o $(CXX) $(LOCAL_CXXFLAGS) $(LOCAL_CPPFLAGS) $(LOCAL_LDFLAGS) -o $@ $< ${R}/src/proxy_v2.o $(LOCAL_LIBADD) cp ${R}/fuzzing/corpora/broker_fuzz_proxy_v2_seed_corpus.zip ${OUT}/$@_seed_corpus.zip diff --git a/fuzzing/broker/broker_fuzz_proxy_v1.cpp b/fuzzing/broker/broker_fuzz_proxy_v1.cpp new file mode 100644 index 000000000..5a0bd212f --- /dev/null +++ b/fuzzing/broker/broker_fuzz_proxy_v1.cpp @@ -0,0 +1,88 @@ +/* +Copyright (c) 2025 Roger Light + +All rights reserved. This program and the accompanying materials +are made available under the terms of the Eclipse Public License 2.0 +and Eclipse Distribution License v1.0 which accompany this distribution. + +The Eclipse Public License is available at + https://www.eclipse.org/legal/epl-2.0/ +and the Eclipse Distribution License is available at + http://www.eclipse.org/org/documents/edl-v10.php. + +SPDX-License-Identifier: EPL-2.0 OR BSD-3-Clause + +Contributors: + Roger Light - initial implementation and documentation. +*/ + +#include +#include +#include +#include +#include +#include + +static const uint8_t *packet_data = NULL; +static int packet_data_pos = 0; +static int packet_data_remaining = 0; + +extern "C" { +#include "mosquitto_broker_internal.h" + +ssize_t net__read(struct mosquitto *mosq, void *buf, size_t count) +{ + int res = count < packet_data_remaining?count:packet_data_remaining; + memcpy(buf, &packet_data[packet_data_pos], res); + packet_data_remaining -= res; + return res; +} + +int net__socket_get_address(mosq_sock_t sock, char *buf, size_t len, uint16_t *remote_port) +{ + snprintf(buf, len, "localhost"); + *remote_port = 1883; + return MOSQ_ERR_SUCCESS; +} + +int http__context_init(struct mosquitto *context) +{ + context->transport = mosq_t_http; + + return MOSQ_ERR_SUCCESS; +} + +int log__printf(struct mosquitto *mosq, unsigned int priority, const char *fmt, ...) +{ + return MOSQ_ERR_SUCCESS; +} + +} + + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + struct mosquitto context{}; + struct mosquitto__listener listener{}; + + packet_data = data; + packet_data_pos = 0; + packet_data_remaining = size; + + context.listener = &listener; + context.proxy.cmd = -1; + context.transport = mosq_t_proxy_v1; + + while(packet_data_remaining > 0 && context.transport != mosq_t_tcp){ + int rc = proxy_v1__read(&context); + if(rc){ + break; + } + } + free(context.address); + free(context.proxy.buf); + free(context.proxy.tls_version); + free(context.proxy.cipher); + + return 0; +} diff --git a/fuzzing/corpora/broker_fuzz_proxy_v1_seed_corpus.zip b/fuzzing/corpora/broker_fuzz_proxy_v1_seed_corpus.zip new file mode 100644 index 0000000000000000000000000000000000000000..807d9aa26441e916d43736f45cd0048603be3d48 GIT binary patch literal 9345 zcmbW6dyEy;9mnrwcVXGR$Rbc^@v%asAZD5KoEcNANJGm*paK=cZe`A#8AZ1#mTe>T z!ES5_RbDNztp-i25>g|UZb?fiHB?KZhy|?;HfTT|hV(^Jq1%Gt_IK{t>pgSla&~0N zA@~0C{mk!oe!t(D^S$$D*VQ-W)Zeb%6WjM3Zv1r}d{%2x?us0u5p$(*kmn&nu!jQ_ zBkqS0#)x_@$AWnTzAjogG*@?UbH}nbVSVfV=3Ku16lj$GYnnD?K0ro+WMc_J9)83d z2j9k*Aprw%K?s+z=Xn$p5;_cpf>TC9${pr7+{4HQIe%aed*a@2{$o`m`(JU@(C-zC z#aB)hi&tM5l1svOtrjm83^>NI%V`*SG{Uh&IG~7le&oASk`Nw1AQwwctq~p^0eA{YNni{0_dU}( zR7@4hH8YR)H2^`a5+#bGhzC?k-}eH-C?~FmT_+YkCNXjZ7CtP`M#(qjbL~mYvmbpB z4+n%=3PT)+^1x*f4u`A-B47@uaTo`_E5ab8K^U?qa%`AluBl@aY?fNZ;(N)x>KgsZ z1D65p@-mP+E)QeMJj!K6UEg()N2H*F$p~}ecrK3oAhZFGpDUj3D;CEsJz88fxN5iV z9eI4oAYiGb0t9s^K#qJjfH-5=FKC4rzIve>3QQn{u8PpcYig>*6#s5w`<2a)j=2i- zuP!qJ>PRPK)c0i&IZoup+=~U}F=0{&7GnfuNi?J7>5gS1U{!TkbK}1^tXbH2-(}7M zX9vXx$y;^7?1t$RR@_+kwYIAIAG_g$LnDA)&Z$Qbcc_m;5z$C`uE(4pa4DuTbOTCc z5C@JQdejzUcmfZ~&v@~*0xA^HrcaA}vTinLm-tmK%mp8`OnY1B4vHphjI1x~@mCeLQZ;B_>w^ zPM)((KbboTl6D=eIw*v$F8xMz*HazK)WLGmL*=V*sJunsR3VETiih+T&J;%PU%P)= zdpI(2yi5Ve=&9T9Qh+J2>NQ07=raRRzEX=a=hk&^bU#?dX;Z=6^ZLIg1LOJ%M@O^u zlXAK{7mx-rVa3MoUksf(#waugFc1E88dISd7+e|!FJ#AHwxE=@VLENM_Ehqwi+})V z@7=WhS^%llpEunVy|qE}Z=1LHj@E_K=kr$N<2I)ax3N})UHIg*p;nGvHq4mn91tIl zIC6h0$g9ve83uZ4^=tBy z<{t*sG^M72RD1ogCqD-=YV}L$3HRE7QWwi_t7AgG2#|;Vw&8@T7Nhv}C^&HG5Y8Ck z8l+FLF9B%t>6Ud9lhNpL@R!=4v^W&vmAx*cuFiGlURI6M$Yz3f)UvL7Z!51#SIiM!j4R-OZ#&rV`fQ z=lcIX^r!MP*9G1G{`H@MIF|iMjPoTxxoP;S=?J31u=*)_W?UGEvcSQPvt!oG-tCw< zzr^nL?Y-35-isIJ0u>Y7PCl+VJq4En?lbFGUe^LBwfb>-h}6OPRO5`&Q*hDT*>mUJ zKDX6u$I+lx{K1`fmS?K2U_Da5Q~TLJ9;r0bNFA%5_vM+7x5Bfkr3pGa-IqczAAcN( zH?Qg(SDvU^T<2nSc5zd(6(r*W%kL=0<**no8qAY0k?Nj+N)BR?_2io@XrHa>Wo`a!MXOwMk`|k$Db9|bNYOGIZrNx_PtBwq16p>6 z%|@$aGU=(AnVg>oT4skW8!hRrnX&y!(K0)2*=R|N&7@rkrc`#r%|@$KNzz|4Y3mg& zv)g8)RrW3Eu9^FG0chF1HXBXHmiF09nt&S}SX&ugH=xxzc&hp>>8hETJO;Gv9-A$; zN+y$rnn_y(23U4`EgLQAtC_Ujik8`Bv(YLwne^98+V}>bWp>+av`QwEW}2o!Tf>}u z7HHY6wQRJcuV%(J7z}{yE?YKQ(o!>ND-|uX!DgdX_AP0wnY8y6Ewjy*jh1xPOxkVW zJ!SXUY_v+1BrP;e(^c|kpk+7IY_v)ylO~!;yQwjk%WkP3vK4Yv#Va3$&8k213ehv%I{eJv38j8e|fL z;C>8B%2Bf@rCl;p>1SFAJTp*Io|#1{ZG@RhEzPB8f=ezaDO;?jk}iR?(`72H)Jkwk z1105qS(MU-mZ|ivR)WhIC@Fi(qLenTOr;wNrRd=11xm`wvM8l3D^qE`R)Px`C@BNW zqLg;5Or^hSCAe^blJc)CN@-ilRQdv32BDtdS_MkVq^hZ;OFZp6nMzx=5?q`>Nx4uK zrL?>7(u+J`ZProwNSU0pgh<;qxu(w>Vcw6-LqLsJfnMJVmGm_kQN zLV64+-^C)7Hd;)f$?y|?SC^gw%672`rQH-$XkAH24*}(^)D+S~AZ?eJLT5`tdIl)- WBqh`UuY$Rp1OG-s78Z|G-~JEmYe0ek literal 0 HcmV?d00001