From: Stephan Bosch <stephan.bosch@open-xchange.com>
Date: Sat, 5 Oct 2024 12:49:25 +0000 (+0200)
Subject: lib-test: fuzzer - Make random number generator deterministic when fuzzer is active
X-Git-Tag: 2.4.2~151
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=244f517976ce02ec364830706bb136869baa81f5;p=thirdparty%2Fdovecot%2Fcore.git

lib-test: fuzzer - Make random number generator deterministic when fuzzer is active
---

diff --git a/m4/dovecot.m4 b/m4/dovecot.m4
index 6567e4646a..f828c93b48 100644
--- a/m4/dovecot.m4
+++ b/m4/dovecot.m4
@@ -310,6 +310,7 @@ AC_DEFUN([DC_DOVECOT_FUZZER],[
                 with_fuzzer=no)
 	AS_IF([test x$with_fuzzer = xclang], [
 		AM_CFLAGS="$AM_CFLAGS -fsanitize=fuzzer-no-link"
+		AM_CFLAGS="$AM_CFLAGS -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION"
 		# use $LIB_FUZZING_ENGINE for linking if it exists
 		FUZZER_LDFLAGS=${LIB_FUZZING_ENGINE--fsanitize=fuzzer}
 		# May need to use CXXLINK for linking, which wants sources to
diff --git a/src/lib/rand.c b/src/lib/rand.c
index 12c9686b60..ffbdd33e7d 100644
--- a/src/lib/rand.c
+++ b/src/lib/rand.c
@@ -3,7 +3,7 @@
 #include "lib.h"
 #include "randgen.h"
 
-#ifdef HAVE_ARC4RANDOM
+#if defined(HAVE_ARC4RANDOM) && !defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
 #ifdef HAVE_LIBBSD
 #include <bsd/stdlib.h>
 #endif
diff --git a/src/lib/randgen.c b/src/lib/randgen.c
index 59dc617568..2a0fd7fddd 100644
--- a/src/lib/randgen.c
+++ b/src/lib/randgen.c
@@ -5,7 +5,7 @@
 #include <unistd.h>
 #include <fcntl.h>
 
-#ifdef DEBUG
+#if defined(DEBUG) || defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
 /* For reproducing tests, fall back onto using a simple deterministic PRNG */
 /* Marsaglia's 1999 KISS, de-macro-ified, and with the fixed KISS11 SHR3,
    which is clearly what was intended given the "cycle length 2^123" claim. */
@@ -121,7 +121,7 @@ void random_fill(void *buf, size_t size)
 	i_assert(init_refcount > 0);
 	i_assert(size < SSIZE_T_MAX);
 
-#ifdef DEBUG
+#if defined(DEBUG) || defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
 	if (kiss_in_use) {
 		for (size_t pos = 0; pos < size; pos++)
 			((unsigned char*)buf)[pos] = kiss_rand();
@@ -167,13 +167,17 @@ void random_fill(void *buf, size_t size)
 
 void random_init(void)
 {
+	if (init_refcount++ > 0)
+		return;
+
+#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+	kiss_init(0);
+	srand(0);
+#else
 	/* static analyzer seems to require this */
 	unsigned int seed = 0;
 	const char *env_seed;
 
-	if (init_refcount++ > 0)
-		return;
-
 	env_seed = getenv("DOVECOT_SRAND");
 #ifdef DEBUG
 	if (env_seed != NULL && str_to_uint(env_seed, &seed) >= 0) {
@@ -204,6 +208,7 @@ void random_init(void)
 normal_exit:
 #endif
 	srand(seed);
+#endif
 }
 
 void random_deinit(void)
diff --git a/src/lib/randgen.h b/src/lib/randgen.h
index cab234d984..f5062c7325 100644
--- a/src/lib/randgen.h
+++ b/src/lib/randgen.h
@@ -9,7 +9,7 @@ void random_fill(void *buf, size_t size);
 void random_init(void);
 void random_deinit(void);
 
-#ifdef DEBUG
+#if defined(DEBUG) || defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
 /* Debug helper to make random tests reproduceable. 0=got seed, -1=failure. */
 int rand_get_last_seed(unsigned int *seed_r);
 #endif