From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Mon, 24 Jan 2022 10:35:14 +0000 (+0900)
Subject: fuzz-dhcp-server: duplicate input data
X-Git-Tag: v251-rc1~462^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0590f1b58c3e78be23a366403ba2c571e4521d0a;p=thirdparty%2Fsystemd.git

fuzz-dhcp-server: duplicate input data

As `dhcp_server_handle_message()` -> `ensure_sane_request()` may modify
the input data, and that causes error in some fuzzing engine.
---

diff --git a/src/libsystemd-network/fuzz-dhcp-server.c b/src/libsystemd-network/fuzz-dhcp-server.c
index 87add43270b..15edec3efbe 100644
--- a/src/libsystemd-network/fuzz-dhcp-server.c
+++ b/src/libsystemd-network/fuzz-dhcp-server.c
@@ -21,12 +21,15 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         _cleanup_(sd_dhcp_server_unrefp) sd_dhcp_server *server = NULL;
         struct in_addr address = {.s_addr = htobe32(UINT32_C(10) << 24 | UINT32_C(1))};
         static const uint8_t chaddr[] = {3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3};
+        _cleanup_free_ uint8_t *duped = NULL;
         uint8_t *client_id;
         DHCPLease *lease;
 
         if (size < sizeof(DHCPMessage))
                 return 0;
 
+        assert_se(duped = memdup(data, size));
+
         assert_se(sd_dhcp_server_new(&server, 1) >= 0);
         server->fd = open("/dev/null", O_RDWR|O_CLOEXEC|O_NOCTTY);
         assert_se(server->fd >= 0);
@@ -51,7 +54,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         assert_se(hashmap_ensure_put(&server->bound_leases_by_address, NULL, UINT32_TO_PTR(lease->address), lease) >= 0);
         lease->server = server;
 
-        (void) dhcp_server_handle_message(server, (DHCPMessage*)data, size);
+        (void) dhcp_server_handle_message(server, (DHCPMessage*) duped, size);
 
         return 0;
 }
diff --git a/test/fuzz/fuzz-dhcp-server/clusterfuzz-testcase-minimized-fuzz-dhcp-server-4916534286352384 b/test/fuzz/fuzz-dhcp-server/clusterfuzz-testcase-minimized-fuzz-dhcp-server-4916534286352384
new file mode 100644
index 00000000000..3d137059969
Binary files /dev/null and b/test/fuzz/fuzz-dhcp-server/clusterfuzz-testcase-minimized-fuzz-dhcp-server-4916534286352384 differ