lib/fuzzing: LLVMFuzzerTestOneInput() takes const uint8_t*

We have been using `uint8_t *`, which works fine as far as
linking goes, but leads fuzz target developers to sometimes
forget why they can't just modify the passed in string instead of
copying it for modification (e.g. to NUL-terminate).

REF: https://llvm.org/docs/LibFuzzer.html#fuzz-target

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/lib/fuzzing/fuzz_cli_credentials_parse_string.c b/lib/fuzzing/fuzz_cli_credentials_parse_string.c
index b71ef357309bd6ed119c67c4b989781934abb4d7..0b0f97af261a466cd0903c3b72a2a7875cfd256b 100644 (file)
--- a/lib/fuzzing/fuzz_cli_credentials_parse_string.c
+++ b/lib/fuzzing/fuzz_cli_credentials_parse_string.c
@@ -25,7 +25,7 @@ char buf[MAX_LENGTH + 1];
 const enum credentials_obtained obtained = CRED_UNINITIALISED;
 
 
-int LLVMFuzzerTestOneInput(uint8_t *input, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len)
 {
        TALLOC_CTX *mem_ctx = NULL;
        struct cli_credentials *credentials = NULL;

diff --git a/lib/fuzzing/fuzz_dcerpc_parse_binding.c b/lib/fuzzing/fuzz_dcerpc_parse_binding.c
index 6eb3c15454dfc0f6a320fae27c8fc37f817de582..dcbf4404b1097cbcc3078972caa99160da0d7c00 100644 (file)
--- a/lib/fuzzing/fuzz_dcerpc_parse_binding.c
+++ b/lib/fuzzing/fuzz_dcerpc_parse_binding.c
@@ -24,7 +24,7 @@
 char buf[MAX_LENGTH + 1];
 
 
-int LLVMFuzzerTestOneInput(uint8_t *input, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len)
 {
        TALLOC_CTX *mem_ctx = NULL;
        struct dcerpc_binding *binding = NULL;

diff --git a/lib/fuzzing/fuzz_ldap_decode.c b/lib/fuzzing/fuzz_ldap_decode.c
index e3bcf7b9d0ab809959f8bb53f05a544af1108a4a..be286ea0cfec3c6c7eb7dfb83cd80dbcb6b92279 100644 (file)
--- a/lib/fuzzing/fuzz_ldap_decode.c
+++ b/lib/fuzzing/fuzz_ldap_decode.c
@@ -27,7 +27,7 @@ int LLVMFuzzerInitialize(int *argc, char ***argv)
        return 0;
 }
 
-int LLVMFuzzerTestOneInput(uint8_t *buf, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
 {
        TALLOC_CTX *mem_ctx = talloc_init(__FUNCTION__);
        struct asn1_data *asn1;

diff --git a/lib/fuzzing/fuzz_ldb_dn_explode.c b/lib/fuzzing/fuzz_ldb_dn_explode.c
index e024212301bef101b7d8931af6606aed10757366..0e1560e345eafe54164680091c245dc6597949c8 100644 (file)
--- a/lib/fuzzing/fuzz_ldb_dn_explode.c
+++ b/lib/fuzzing/fuzz_ldb_dn_explode.c
@@ -23,7 +23,7 @@
 #define MAX_LENGTH (2 * 1024 * 1024 - 1)
 char buf[MAX_LENGTH + 1] = {0};
 
-int LLVMFuzzerTestOneInput(uint8_t *input, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len)
 {
        struct ldb_dn *dn = NULL;
        struct ldb_context *ldb = ldb_init(NULL, NULL);

diff --git a/lib/fuzzing/fuzz_ldb_ldif_read.c b/lib/fuzzing/fuzz_ldb_ldif_read.c
index f44e1ea5c43e1b7de83d1239ace215a6904e9458..3c48b6a28784d2a0a405e2cba78cbf94d7ad0dfc 100644 (file)
--- a/lib/fuzzing/fuzz_ldb_ldif_read.c
+++ b/lib/fuzzing/fuzz_ldb_ldif_read.c
@@ -23,7 +23,7 @@
 #define MAX_LENGTH (2 * 1024 * 1024 - 1)
 char buf[MAX_LENGTH + 1] = {0};
 
-int LLVMFuzzerTestOneInput(uint8_t *input, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len)
 {
        struct ldb_ldif *ldif = NULL;
        const char *s = NULL;

diff --git a/lib/fuzzing/fuzz_ldb_parse_binary_decode.c b/lib/fuzzing/fuzz_ldb_parse_binary_decode.c
index feb26e28c820cdbe8ac4def4c9222475ac20e06c..ac2e436a8433a43faa680f7921b38e81192dce49 100644 (file)
--- a/lib/fuzzing/fuzz_ldb_parse_binary_decode.c
+++ b/lib/fuzzing/fuzz_ldb_parse_binary_decode.c
@@ -34,7 +34,7 @@ static char * possibly_truncate(uint8_t *input, size_t len)
 }
 
 
-int LLVMFuzzerTestOneInput(uint8_t *input, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len)
 {
        TALLOC_CTX *mem_ctx = talloc_init(__FUNCTION__);
        struct ldb_val val = {0};

diff --git a/lib/fuzzing/fuzz_ldb_parse_control.c b/lib/fuzzing/fuzz_ldb_parse_control.c
index c78222c3c851894505e2740af4103aae9e31912a..722d9f9a6dee8266607da29217cd14a8b66e0bc9 100644 (file)
--- a/lib/fuzzing/fuzz_ldb_parse_control.c
+++ b/lib/fuzzing/fuzz_ldb_parse_control.c
@@ -23,7 +23,7 @@
 #define MAX_LENGTH (2 * 1024 * 1024 - 1)
 char buf[MAX_LENGTH + 1] = {0};
 
-int LLVMFuzzerTestOneInput(uint8_t *input, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len)
 {
        struct ldb_control *control = NULL;
        struct ldb_context *ldb = ldb_init(NULL, NULL);

diff --git a/lib/fuzzing/fuzz_ldb_parse_tree.c b/lib/fuzzing/fuzz_ldb_parse_tree.c
index e22dd776110a0b3dfa4a10a09d9c222cadbae8cd..1e649401d53023844dbf4cb85d9d857da10a9832 100644 (file)
--- a/lib/fuzzing/fuzz_ldb_parse_tree.c
+++ b/lib/fuzzing/fuzz_ldb_parse_tree.c
@@ -26,7 +26,7 @@ int LLVMFuzzerInitialize(int *argc, char ***argv)
        return 0;
 }
 
-int LLVMFuzzerTestOneInput(uint8_t *buf, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
 {
        TALLOC_CTX *mem_ctx = talloc_init(__FUNCTION__);
        struct ldb_parse_tree *tree;

diff --git a/lib/fuzzing/fuzz_lzxpress.c b/lib/fuzzing/fuzz_lzxpress.c
index 61ce9e6f9c0f3788f1b0ffd8993913093686b559..ddc7aa0cd68e80d4425e7c74115169db839eaf50 100644 (file)
--- a/lib/fuzzing/fuzz_lzxpress.c
+++ b/lib/fuzzing/fuzz_lzxpress.c
@@ -25,7 +25,7 @@ int LLVMFuzzerInitialize(int *argc, char ***argv)
        return 0;
 }
 
-int LLVMFuzzerTestOneInput(uint8_t *buf, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
 {
        static uint8_t output[1024 * 1024] = {0};
 

diff --git a/lib/fuzzing/fuzz_lzxpress_compress.c b/lib/fuzzing/fuzz_lzxpress_compress.c
index 39e909da8aae27a8b2610bd4cbad105d5de77efd..9e5c6474bc7bc1d6da7e3cc5a15f234586dc80c8 100644 (file)
--- a/lib/fuzzing/fuzz_lzxpress_compress.c
+++ b/lib/fuzzing/fuzz_lzxpress_compress.c
@@ -25,7 +25,7 @@ int LLVMFuzzerInitialize(int *argc, char ***argv)
        return 0;
 }
 
-int LLVMFuzzerTestOneInput(uint8_t *buf, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
 {
        static uint8_t output[1024 * 1024] = {0};
 

diff --git a/lib/fuzzing/fuzz_lzxpress_huffman_compress.c b/lib/fuzzing/fuzz_lzxpress_huffman_compress.c
index d92131d3a8b2ee99ae3dfb9ee066fd9f59ae9c03..165244ca8bfd6d1e9ae3f073a4291cc38ece57cd 100644 (file)
--- a/lib/fuzzing/fuzz_lzxpress_huffman_compress.c
+++ b/lib/fuzzing/fuzz_lzxpress_huffman_compress.c
@@ -29,7 +29,7 @@ int LLVMFuzzerInitialize(int *argc, char ***argv)
 
 #define MAX_SIZE (1024 * 1024)
 
-int LLVMFuzzerTestOneInput(uint8_t *buf, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
 {
        static uint8_t *output;
        size_t output_len;

diff --git a/lib/fuzzing/fuzz_lzxpress_huffman_decompress.c b/lib/fuzzing/fuzz_lzxpress_huffman_decompress.c
index da3a101ca1ae7deed2afa34202e178bca3a65894..d475ff63cf2f74e627b918384463d1109acb0dea 100644 (file)
--- a/lib/fuzzing/fuzz_lzxpress_huffman_decompress.c
+++ b/lib/fuzzing/fuzz_lzxpress_huffman_decompress.c
@@ -28,7 +28,7 @@ int LLVMFuzzerInitialize(int *argc, char ***argv)
 
 static uint8_t output[1024 * 1024] = {0};
 
-int LLVMFuzzerTestOneInput(uint8_t *buf, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
 {
        size_t target_len;
        if (len < 4) {

diff --git a/lib/fuzzing/fuzz_lzxpress_huffman_round_trip.c b/lib/fuzzing/fuzz_lzxpress_huffman_round_trip.c
index b59be438ee9365ef5736a70ad609a9a45b299089..adb8fbfd88da855b6d8770eb395d6bafb884f950 100644 (file)
--- a/lib/fuzzing/fuzz_lzxpress_huffman_round_trip.c
+++ b/lib/fuzzing/fuzz_lzxpress_huffman_round_trip.c
@@ -28,7 +28,7 @@ int LLVMFuzzerInitialize(int *argc, char ***argv)
 }
 
 
-int LLVMFuzzerTestOneInput(uint8_t *buf, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
 {
         /*
         * we allow compressed to be 25% bigger than decompressed.

diff --git a/lib/fuzzing/fuzz_lzxpress_round_trip.c b/lib/fuzzing/fuzz_lzxpress_round_trip.c
index ac38368527ebfbe29ac4fc4c27c78b1e7e4fd658..a4043c258b9bd876457cae5dad82b96ee95dc494 100644 (file)
--- a/lib/fuzzing/fuzz_lzxpress_round_trip.c
+++ b/lib/fuzzing/fuzz_lzxpress_round_trip.c
@@ -25,7 +25,7 @@ int LLVMFuzzerInitialize(int *argc, char ***argv)
        return 0;
 }
 
-int LLVMFuzzerTestOneInput(uint8_t *buf, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
 {
        static uint8_t compressed[1024 * 1280] = {0};
        static uint8_t decompressed[1024 * 1024] = {0};

diff --git a/lib/fuzzing/fuzz_ndr_X.c b/lib/fuzzing/fuzz_ndr_X.c
index 3c0fe062d965a69f365ca828bb07f940b9765548..a3d7199edc91d9adf51db90d6bb509b2b80bb033 100644 (file)
--- a/lib/fuzzing/fuzz_ndr_X.c
+++ b/lib/fuzzing/fuzz_ndr_X.c
@@ -150,7 +150,7 @@ static void ndr_print_nothing(struct ndr_print *ndr, const char *format, ...)
 }
 
 
-int LLVMFuzzerTestOneInput(uint8_t *data, size_t size) {
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
        uint8_t type;
        int pull_push_print_flags;
        uint16_t fuzz_packet_flags, function;

diff --git a/lib/fuzzing/fuzz_nmblib_parse_packet.c b/lib/fuzzing/fuzz_nmblib_parse_packet.c
index 85dd823e51caf08751c17e9e53c88687bb609be2..c8a2d035ef73308ce6f3223aa0e4652396240fd5 100644 (file)
--- a/lib/fuzzing/fuzz_nmblib_parse_packet.c
+++ b/lib/fuzzing/fuzz_nmblib_parse_packet.c
@@ -26,7 +26,7 @@
 char buf[MAX_LENGTH + 1];
 
 
-int LLVMFuzzerTestOneInput(uint8_t *input, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len)
 {
        struct packet_struct *p = NULL;
        struct in_addr ip = {

diff --git a/lib/fuzzing/fuzz_oLschema2ldif.c b/lib/fuzzing/fuzz_oLschema2ldif.c
index 873e8f1ccc79326f1075560d1b8a4e827f437a61..3bff8cff578d60087ce0d9ce175a0dc252abe895 100644 (file)
--- a/lib/fuzzing/fuzz_oLschema2ldif.c
+++ b/lib/fuzzing/fuzz_oLschema2ldif.c
@@ -29,7 +29,7 @@ int LLVMFuzzerInitialize(int *argc, char ***argv)
        return 0;
 }
 
-int LLVMFuzzerTestOneInput(uint8_t *buf, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
 {
        TALLOC_CTX *mem_ctx;
        struct conv_options opt;

diff --git a/lib/fuzzing/fuzz_parse_lpq_entry.c b/lib/fuzzing/fuzz_parse_lpq_entry.c
index 720cc9b51c013382df455642bf6f66829d6d5239..3537ce5bc0670440b195acf8b7f8cb0408109a20 100644 (file)
--- a/lib/fuzzing/fuzz_parse_lpq_entry.c
+++ b/lib/fuzzing/fuzz_parse_lpq_entry.c
@@ -28,7 +28,7 @@ int LLVMFuzzerInitialize(int *argc, char ***argv)
 #define MAX_LENGTH (1024 * 1024)
 char line[MAX_LENGTH + 1];
 
-int LLVMFuzzerTestOneInput(uint8_t *input, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len)
 {
        enum printing_types printing_type;
        print_queue_struct pq_buf = {0};

diff --git a/lib/fuzzing/fuzz_reg_parse.c b/lib/fuzzing/fuzz_reg_parse.c
index a061cd6294ba9bd5466e46c1e6c0017674eee792..bbc62ead79a72ccdd3a72f76d241e200df7451b5 100644 (file)
--- a/lib/fuzzing/fuzz_reg_parse.c
+++ b/lib/fuzzing/fuzz_reg_parse.c
@@ -31,7 +31,7 @@ int LLVMFuzzerInitialize(int *argc, char ***argv)
        return 0;
 }
 
-int LLVMFuzzerTestOneInput(uint8_t *buf, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
 {
        const reg_parse_callback cb = {0};
 

diff --git a/lib/fuzzing/fuzz_regfio.c b/lib/fuzzing/fuzz_regfio.c
index c4ced88801b09ea9e97cac580fd2c7379e0b6df5..588efb0afdd379b04927fa0150f80e2b3c934a01 100644 (file)
--- a/lib/fuzzing/fuzz_regfio.c
+++ b/lib/fuzzing/fuzz_regfio.c
@@ -36,7 +36,7 @@ int LLVMFuzzerInitialize(int *argc, char ***argv)
        return 0;
 }
 
-int LLVMFuzzerTestOneInput(uint8_t *buf, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
 {
        REGF_FILE* regfile;
        REGF_NK_REC *nk, *subkey;

diff --git a/lib/fuzzing/fuzz_sddl_access_check.c b/lib/fuzzing/fuzz_sddl_access_check.c
index 438ca02665647ea7573741432a04c1b906a5b00d..0c936efdba6520acdddc469f95f4b9f8d0a44138 100644 (file)
--- a/lib/fuzzing/fuzz_sddl_access_check.c
+++ b/lib/fuzzing/fuzz_sddl_access_check.c
@@ -63,7 +63,7 @@ int LLVMFuzzerInitialize(int *argc, char ***argv)
 }
 
 
-int LLVMFuzzerTestOneInput(uint8_t *input, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len)
 {
        TALLOC_CTX *mem_ctx = NULL;
        struct security_descriptor *sd = NULL;

diff --git a/lib/fuzzing/fuzz_sddl_parse.c b/lib/fuzzing/fuzz_sddl_parse.c
index b6c48fb7ca52c259adfa6ecdc05e277e4688caa8..1f8c32c595bce86c992fab042ff3aa0894486841 100644 (file)
--- a/lib/fuzzing/fuzz_sddl_parse.c
+++ b/lib/fuzzing/fuzz_sddl_parse.c
@@ -32,7 +32,7 @@ int LLVMFuzzerInitialize(int *argc, char ***argv)
 }
 
 
-int LLVMFuzzerTestOneInput(uint8_t *input, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len)
 {
        TALLOC_CTX *mem_ctx = NULL;
        struct security_descriptor *sd1 = NULL;

diff --git a/lib/fuzzing/fuzz_security_token_vs_descriptor.c b/lib/fuzzing/fuzz_security_token_vs_descriptor.c
index 925c54672d57c77a844de6ad8a552496b76da16e..f9b2552503e47259f57f2b30131b5ab333881ac4 100644 (file)
--- a/lib/fuzzing/fuzz_security_token_vs_descriptor.c
+++ b/lib/fuzzing/fuzz_security_token_vs_descriptor.c
@@ -28,7 +28,7 @@ int LLVMFuzzerInitialize(int *argc, char ***argv)
 }
 
 
-int LLVMFuzzerTestOneInput(uint8_t *input, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len)
 {
        TALLOC_CTX *mem_ctx = NULL;
        struct security_token_descriptor_fuzzing_pair p = {0};

diff --git a/lib/fuzzing/fuzz_stable_sort.c b/lib/fuzzing/fuzz_stable_sort.c
index 032a2a676fe8de3ab86b28bbc1e5349c5ad35945..e2195cb049814a3fb986f9af35f2467e66d752e6 100644 (file)
--- a/lib/fuzzing/fuzz_stable_sort.c
+++ b/lib/fuzzing/fuzz_stable_sort.c
@@ -46,7 +46,7 @@ CMP_FN(uint64_t)
 
 #define MAX_SIZE (1024 * 1024)
 
-int LLVMFuzzerTestOneInput(uint8_t *buf, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
 {
        TALLOC_CTX *mem_ctx = NULL;
        samba_compare_fn_t fn;

diff --git a/lib/fuzzing/fuzz_stable_sort_r.c b/lib/fuzzing/fuzz_stable_sort_r.c
index 0808b8fa43cb68cf99cb363379bbc37fdfddb142..68be73b3f48bdb46a16a346dc5aaa451d01a494a 100644 (file)
--- a/lib/fuzzing/fuzz_stable_sort_r.c
+++ b/lib/fuzzing/fuzz_stable_sort_r.c
@@ -38,7 +38,7 @@ static int cmp_int8(int8_t *a, int8_t *b, int8_t *c)
 
 #define MAX_SIZE (1024 * 1024)
 
-int LLVMFuzzerTestOneInput(uint8_t *buf, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
 {
        size_t i;
        int8_t buf2[MAX_SIZE];

diff --git a/lib/fuzzing/fuzz_tiniparser.c b/lib/fuzzing/fuzz_tiniparser.c
index 6908f1815d7c49f14c0d8ce04f9e23b09fab86de..a5c9310b9e7873fc34e7e3817cd01557830e943f 100644 (file)
--- a/lib/fuzzing/fuzz_tiniparser.c
+++ b/lib/fuzzing/fuzz_tiniparser.c
@@ -25,7 +25,7 @@ int LLVMFuzzerInitialize(int *argc, char ***argv)
        return 0;
 }
 
-int LLVMFuzzerTestOneInput(uint8_t *buf, size_t len)
+int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
 {
        FILE *fp = NULL;
        struct tiniparser_dictionary *d = NULL;

diff --git a/lib/fuzzing/fuzzing.h b/lib/fuzzing/fuzzing.h
index 67e49c3fbe0d5bd289cfa6aeb269010078f0c937..0d3cb7099b9da4d970602b9f751e61a0250506e5 100644 (file)
--- a/lib/fuzzing/fuzzing.h
+++ b/lib/fuzzing/fuzzing.h
@@ -25,6 +25,6 @@
 
 /* Prototypes for fuzzing interface */
 int LLVMFuzzerInitialize(int *argc, char ***argv);
-int LLVMFuzzerTestOneInput(uint8_t * buf, size_t len);
+int LLVMFuzzerTestOneInput(const uint8_t * buf, size_t len);
 
 #endif /* _SAMBA_FUZZING_H */