lib/fuzzing: adapt fuzz_security_token_vs_descriptor for AD variant

This of course doesn't exercise the object tree or default SID code,
but it still covers a lot to the *_ds access_check functions.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/lib/fuzzing/fuzz_security_token_vs_descriptor.c b/lib/fuzzing/fuzz_security_token_vs_descriptor.c
index 4f96590de9287421154e65c0450d513f8a0b7b7e..925c54672d57c77a844de6ad8a552496b76da16e 100644 (file)
--- a/lib/fuzzing/fuzz_security_token_vs_descriptor.c
+++ b/lib/fuzzing/fuzz_security_token_vs_descriptor.c
@@ -49,10 +49,28 @@ int LLVMFuzzerTestOneInput(uint8_t *input, size_t len)
        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                goto end;
        }
+
+#ifdef FUZZ_SEC_ACCESS_CHECK_DS
+       /*
+        * The sec_access_check_ds() function has two arguments not found in
+        * se_access_check, and also not found in our fuzzing examples.
+        *
+        * One is a struct object_tree, which is used for object ACE types.
+        * The other is a SID, which is used as a default if an ACE lacks a
+        * SID.
+        */
+       sec_access_check_ds(&p.sd,
+                           &p.token,
+                           p.access_desired,
+                           &access_granted,
+                           NULL,
+                           NULL);
+#else
        se_access_check(&p.sd,
                        &p.token,
                        p.access_desired,
                        &access_granted);
+#endif
 
 end:
        talloc_free(mem_ctx);

diff --git a/lib/fuzzing/wscript_build b/lib/fuzzing/wscript_build
index 52607455b06df03bc7c7a0e964f680b31a6de838..7a138a474683fa02a16ed905607b8db557fc599b 100644 (file)
--- a/lib/fuzzing/wscript_build
+++ b/lib/fuzzing/wscript_build
@@ -137,6 +137,12 @@ bld.SAMBA_BINARY('fuzz_security_token_vs_descriptor',
                  deps='fuzzing samba-security afl-fuzz-main',
                  fuzzer=True)
 
+bld.SAMBA_BINARY('fuzz_security_token_vs_descriptor_ds',
+                 cflags='-DFUZZ_SEC_ACCESS_CHECK_DS=1',
+                 source='fuzz_security_token_vs_descriptor.c',
+                 deps='fuzzing samba-security afl-fuzz-main',
+                 fuzzer=True)
+
 
 # The fuzz_type and fuzz_function parameters make the built
 # fuzzer take the same input as ndrdump and so the same that