1 /*
2    Fuzzing for ldap_decode.
3    Copyright (C) Michael Hanselmann 2019
4 
5    This program is free software; you can redistribute it and/or modify
6    it under the terms of the GNU General Public License as published by
7    the Free Software Foundation; either version 3 of the License, or
8    (at your option) any later version.
9 
10    This program is distributed in the hope that it will be useful,
11    but WITHOUT ANY WARRANTY; without even the implied warranty of
12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13    GNU General Public License for more details.
14 
15    You should have received a copy of the GNU General Public License
16    along with this program.  If not, see <http://www.gnu.org/licenses/>.
17 */
18 
19 #include "includes.h"
20 #include "fuzzing/fuzzing.h"
21 #include "lib/util/asn1.h"
22 #include "libcli/ldap/ldap_message.h"
23 #include "libcli/ldap/ldap_proto.h"
24 
25 int LLVMFuzzerInitialize(int *argc, char ***argv)
26 {
27 	return 0;
28 }
29 
30 int LLVMFuzzerTestOneInput(uint8_t *buf, size_t len)
31 {
32 	TALLOC_CTX *mem_ctx = talloc_init(__FUNCTION__);
33 	struct asn1_data *asn1;
34 	struct ldap_message *ldap_msg;
35 	struct ldap_request_limits limits = {
36 		/*
37 		 * The default size is currently 256000 bytes
38 		 */
39 		.max_search_size = 256000
40 	};
41 	NTSTATUS status;
42 
43 	/*
44 	 * Need to limit the max parse tree depth to 250 to prevent
45 	 * ASAN detecting stack overflows.
46 	 */
47 	asn1 = asn1_init(mem_ctx, 250);
48 	if (!asn1) {
49 		goto out;
50 	}
51 
52 	asn1_load_nocopy(asn1, buf, len);
53 
54 	ldap_msg = talloc(mem_ctx, struct ldap_message);
55 	if (!ldap_msg) {
56 		goto out;
57 	}
58 
59 	status = ldap_decode(
60 		asn1, &limits, samba_ldap_control_handlers(), ldap_msg);
61 
62 out:
63 	talloc_free(mem_ctx);
64 
65 	return 0;
66 }
67