From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Date: Mon, 17 Jul 2023 04:20:58 +0000 (+1200)
Subject: lib/fuzzing: adapt fuzz_security_token_vs_descriptor for AD variant
X-Git-Tag: talloc-2.4.1~10
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=89b02bad3e2db7a9a3aceed7122c1d680cef728d;p=thirdparty%2Fsamba.git

lib/fuzzing: adapt fuzz_security_token_vs_descriptor for AD variant

This of course doesn't exercise the object tree or default SID code,
but it still covers a lot to the *_ds access_check functions.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
---

diff --git a/lib/fuzzing/fuzz_security_token_vs_descriptor.c b/lib/fuzzing/fuzz_security_token_vs_descriptor.c
index 4f96590de92..925c54672d5 100644
--- a/lib/fuzzing/fuzz_security_token_vs_descriptor.c
+++ b/lib/fuzzing/fuzz_security_token_vs_descriptor.c
@@ -49,10 +49,28 @@ int LLVMFuzzerTestOneInput(uint8_t *input, size_t len)
 	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 		goto end;
 	}
+
+#ifdef FUZZ_SEC_ACCESS_CHECK_DS
+	/*
+	 * The sec_access_check_ds() function has two arguments not found in
+	 * se_access_check, and also not found in our fuzzing examples.
+	 *
+	 * One is a struct object_tree, which is used for object ACE types.
+	 * The other is a SID, which is used as a default if an ACE lacks a
+	 * SID.
+	 */
+	sec_access_check_ds(&p.sd,
+			    &p.token,
+			    p.access_desired,
+			    &access_granted,
+			    NULL,
+			    NULL);
+#else
 	se_access_check(&p.sd,
 			&p.token,
 			p.access_desired,
 			&access_granted);
+#endif
 
 end:
 	talloc_free(mem_ctx);
diff --git a/lib/fuzzing/wscript_build b/lib/fuzzing/wscript_build
index 52607455b06..7a138a47468 100644
--- a/lib/fuzzing/wscript_build
+++ b/lib/fuzzing/wscript_build
@@ -137,6 +137,12 @@ bld.SAMBA_BINARY('fuzz_security_token_vs_descriptor',
                  deps='fuzzing samba-security afl-fuzz-main',
                  fuzzer=True)
 
+bld.SAMBA_BINARY('fuzz_security_token_vs_descriptor_ds',
+                 cflags='-DFUZZ_SEC_ACCESS_CHECK_DS=1',
+                 source='fuzz_security_token_vs_descriptor.c',
+                 deps='fuzzing samba-security afl-fuzz-main',
+                 fuzzer=True)
+
 
 # The fuzz_type and fuzz_function parameters make the built
 # fuzzer take the same input as ndrdump and so the same that