fuzz: limit size for fuzz-manager-serialize

Fixes #29357 and oss-fuzz#62756
(https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62756).

diff --git a/src/core/fuzz-manager-serialize.c b/src/core/fuzz-manager-serialize.c
index 2f0c0c302988b6a653d3fcc10fe283f24df2202e..cbc89f5737344899371f0f57164bd6547f2747d9 100644 (file)
--- a/src/core/fuzz-manager-serialize.c
+++ b/src/core/fuzz-manager-serialize.c
@@ -14,6 +14,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         _cleanup_fclose_ FILE *f = NULL, *null = NULL;
         _cleanup_fdset_free_ FDSet *fdset = NULL;
 
+        if (outside_size_range(size, 0, 65536))
+                return 0;
+
         /* We don't want to fill the logs with messages about parse errors.
          * Disable most logging if not running standalone. */
         if (!getenv("SYSTEMD_LOG_LEVEL")) {

diff --git a/src/core/fuzz-manager-serialize.options b/src/core/fuzz-manager-serialize.options
new file mode 100644 (file)
index 0000000..678d526
--- /dev/null
+++ b/src/core/fuzz-manager-serialize.options
@@ -0,0 +1,2 @@
+[libfuzzer]
+max_len = 65536