## Coverage Report

#### Created: 2025-03-01 02:43

next uncovered line (L), next uncovered region (R), next uncovered branch (B)

    /libfido2/fuzz/mutator_aux.h

    Line
    Count
    Source
    1
    /*
    2
     * Copyright (c) 2019-2022 Yubico AB. All rights reserved.
    3
     * Use of this source code is governed by a BSD-style
    4
     * license that can be found in the LICENSE file.
    5
     * SPDX-License-Identifier: BSD-2-Clause
    6
     */
    7
    8
    #ifndef _MUTATOR_AUX_H
    9
    #define _MUTATOR_AUX_H
    10
    11
    #include <sys/types.h>
    12
    13
    #include <stddef.h>
    14
    #include <stdint.h>
    15
    #include <cbor.h>
    16
    17
    #include "../src/fido.h"
    18
    #include "../src/fido/bio.h"
    19
    #include "../src/fido/config.h"
    20
    #include "../src/fido/credman.h"
    21
    #include "../src/fido/eddsa.h"
    22
    #include "../src/fido/es256.h"
    23
    #include "../src/fido/es384.h"
    24
    #include "../src/fido/rs256.h"
    25
    #include "../src/netlink.h"
    26
    27
    /*
    28
     * As of LLVM 10.0.0, MSAN support in libFuzzer was still experimental.
    29
     * We therefore have to be careful when using our custom mutator, or
    30
     * MSAN will flag uninitialised reads on memory populated by libFuzzer.
    31
     * Since there is no way to suppress MSAN without regenerating object
    32
     * code (in which case you might as well rebuild libFuzzer with MSAN),
    33
     * we adjust our mutator to make it less accurate while allowing
    34
     * fuzzing to proceed.
    35
     */
    36
    37
    #if defined(__has_feature)
    38
    # if  __has_feature(memory_sanitizer)
    39
    #  include <sanitizer/msan_interface.h>
    40
    #  define NO_MSAN       __attribute__((no_sanitize("memory")))
    41
    #  define WITH_MSAN     1
    42
    # endif
    43
    #endif
    44
    45
    #if !defined(WITH_MSAN)
    46
    # define NO_MSAN
    47
    #endif
    48
    49
    #define MUTATE_SEED     0x01
    50
    #define MUTATE_PARAM    0x02
    51
    #define MUTATE_WIREDATA 0x04
    52
    #define MUTATE_ALL      (MUTATE_SEED | MUTATE_PARAM | MUTATE_WIREDATA)
    53
    54
    #define MAXSTR          1024
    55
    #define MAXBLOB         3600
    56
    #define MAXCORPUS       8192
    57
    58
    #define HID_DEV_HANDLE  0x68696421
    59
    21.1k
    #define NFC_DEV_HANDLE  0x6e666321
    60
    61
    struct blob {
    62
            uint8_t body[MAXBLOB];
    63
            size_t len;
    64
    };
    65
    66
    struct param;
    67
    68
    struct param *unpack(const uint8_t *, size_t);
    69
    size_t pack(uint8_t *, size_t, const struct param *);
    70
    size_t pack_dummy(uint8_t *, size_t);
    71
    void mutate(struct param *, unsigned int, unsigned int);
    72
    void test(const struct param *);
    73
    74
    void consume(const void *, size_t);
    75
    void consume_str(const char *);
    76
    77
    int unpack_blob(cbor_item_t *, struct blob *);
    78
    int unpack_byte(cbor_item_t *, uint8_t *);
    79
    int unpack_int(cbor_item_t *, int *);
    80
    int unpack_string(cbor_item_t *, char *);
    81
    82
    cbor_item_t *pack_blob(const struct blob *);
    83
    cbor_item_t *pack_byte(uint8_t);
    84
    cbor_item_t *pack_int(int);
    85
    cbor_item_t *pack_string(const char *);
    86
    87
    void mutate_byte(uint8_t *);
    88
    void mutate_int(int *);
    89
    void mutate_blob(struct blob *);
    90
    void mutate_string(char *);
    91
    92
    ssize_t fd_read(int, void *, size_t);
    93
    ssize_t fd_write(int, const void *, size_t);
    94
    95
    int nfc_read(void *, unsigned char *, size_t, int);
    96
    int nfc_write(void *, const unsigned char *, size_t);
    97
    98
    fido_dev_t *open_dev(int);
    99
    void set_wire_data(const uint8_t *, size_t);
    100
    101
    void fuzz_clock_reset(void);
    102
    void prng_init(unsigned long);
    103
    unsigned long prng_uint32(void);
    104
    105
    uint32_t uniform_random(uint32_t);
    106
    107
    void set_pcsc_parameters(const struct blob *);
    108
    void set_pcsc_io_functions(int (*)(void *, u_char *, size_t, int),
    109
        int (*)(void *, const u_char *, size_t), void (*)(const void *, size_t));
    110
    111
    #endif /* !_MUTATOR_AUX_H */