From: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Date: Tue, 26 Feb 2019 12:00:35 +0000 (+0100)
Subject: fuzz-journal-stream: avoid assertion failure on samples which don't fit in pipe
X-Git-Tag: v242-rc1~240^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=eafadd069c4e30ed62173123326a7237448615d1;p=thirdparty%2Fsystemd.git

fuzz-journal-stream: avoid assertion failure on samples which don't fit in pipe

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11587.
We had a sample which was large enough that write(2) failed to push all the
data into the pipe, and an assert failed. The code could be changed to use
a loop, but then we'd need to interleave writes and sd_event_run (to process
the journal). I don't think the complexity is worth it — fuzzing works best
if the sample is not too huge anyway. So let's just reject samples above 64k,
and tell oss-fuzz about this limit.
---

diff --git a/src/fuzz/fuzz-journald-stream.c b/src/fuzz/fuzz-journald-stream.c
index 5d6c8eb8ca0..bc539641392 100644
--- a/src/fuzz/fuzz-journald-stream.c
+++ b/src/fuzz/fuzz-journald-stream.c
@@ -15,7 +15,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
         StdoutStream *stream;
         int v;
 
-        if (size == 0)
+        if (size == 0 || size > 65536)
                 return 0;
 
         if (!getenv("SYSTEMD_LOG_LEVEL"))
diff --git a/src/fuzz/fuzz-journald-stream.options b/src/fuzz/fuzz-journald-stream.options
new file mode 100644
index 00000000000..678d526b1ea
--- /dev/null
+++ b/src/fuzz/fuzz-journald-stream.options
@@ -0,0 +1,2 @@
+[libfuzzer]
+max_len = 65536