dfuzzer
Functions | Variables
fuzz.c File Reference
#include <gio/gio.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <fcntl.h>
#include <ctype.h>
#include <errno.h>
#include <ffi.h>
#include "fuzz.h"
#include "dfuzzer.h"
#include "rand.h"

Functions

static long df_fuzz_get_proc_mem_size (const int statfd)
 
static int df_fuzz_write_log (void)
 
static int df_exec_cmd_check (const char *cmd)
 
static GVariant * df_fuzz_create_variant (void)
 
static int df_fuzz_create_list_variants (void)
 
static int df_fuzz_create_fmt_string (char **fmt, const int n)
 
static int df_fuzz_call_method (const GVariant *value, const int void_method)
 
int df_ewrite (int fd, const void *buf, size_t count)
 
int df_fuzz_init (GDBusProxy *dproxy, const int statfd, const int pid, const long mem_limit)
 
int df_fuzz_add_method (const char *name)
 
int df_fuzz_add_method_arg (const char *signature)
 
int df_list_args_count (void)
 
int df_fuzz_test_method (const int statfd, long buf_size, const char *name, const char *obj, const char *intf, const int pid, const int void_method, const char *execute_cmd)
 
void df_fuzz_clean_method (void)
 

Variables

static GDBusProxy * df_dproxy
 
static struct df_sig_list df_list
 
static struct df_signaturedf_last
 
static long df_initial_mem = -2
 
static long df_mem_limit = -1
 
static int df_mlflg
 
static int df_unsupported_sig
 
static char * df_unsupported_sig_str
 
static char df_except_counter = 0
 

Function Documentation

◆ df_ewrite()

int df_ewrite ( int  fd,
const void *  buf,
size_t  count 
)
inline

@function Error checked write function with short write correction (when write is interrupted by a signal).

Parameters
fdFile descriptor where to write
bufBuffer from which to write to file descriptor fd
countNumber of bytes to be written
Returns
0 on success, -1 on error

◆ df_exec_cmd_check()

static int df_exec_cmd_check ( const char *  cmd)
static

@function Executes command/script cmd.

Parameters
cmdCommand/Script to execute
Returns
0 on successful completition of cmd or when cmd is NULL, value higher than 0 on unsuccessful completition of cmd or -1 on error

◆ df_fuzz_add_method()

int df_fuzz_add_method ( const char *  name)

@function Initializes the global variable df_list (struct df_sig_list) including allocationg memory for method name inside df_list.

Parameters
nameName of method which will be tested
Returns
0 on success, -1 on error

◆ df_fuzz_add_method_arg()

int df_fuzz_add_method_arg ( const char *  signature)

@function Adds item (struct df_signature) at the end of the linked list in the global variable df_list (struct df_sig_list). This includes allocating memory for item and for signature string.

Parameters
signatureD-Bus signature of the argument
Returns
0 on success, -1 on error

◆ df_fuzz_call_method()

static int df_fuzz_call_method ( const GVariant *  value,
const int  void_method 
)
static

@function Calls method from df_list (using its name) with its arguments.

Parameters
valueGVariant tuple containing all method arguments signatures and their values
void_methodIf method has out args 1, 0 otherwise
Returns
0 on success, -1 on error, 1 if void method returned non-void value or 2 when tested method raised exception (so it should be skipped)

◆ df_fuzz_clean_method()

void df_fuzz_clean_method ( void  )

@function Releases memory used by this module. This function must be called after df_fuzz_add_method() and df_fuzz_add_method_arg() functions calls after the end of fuzz testing of each method.

◆ df_fuzz_create_fmt_string()

static int df_fuzz_create_fmt_string ( char **  fmt,
const int  n 
)
static

@function Creates format string (tuple) from method arguments signatures with maximum length of n-1. The final string is saved in parameter fmt.

Parameters
fmtPointer on buffer where format string should be stored
nSize of buffer
Returns
0 on success, -1 on error

◆ df_fuzz_create_list_variants()

static int df_fuzz_create_list_variants ( void  )
static

@function Generates data for each method argument according to argument signature and stores it into Gvariant variable in items of linked list.

Returns
0 on success, 1 on unsupported method signature, -1 on error

◆ df_fuzz_create_variant()

static GVariant * df_fuzz_create_variant ( void  )
static

@function Creates GVariant tuple variable which contains all the signatures of method arguments including their values. This tuple is constructed from each signature of method argument by one call of g_variant_new() function. This call is constructed dynamically (using libffi) as we don't know number of function parameters on compile time.

Returns
Pointer on a new GVariant variable containing tuple with method arguments

◆ df_fuzz_get_proc_mem_size()

static long df_fuzz_get_proc_mem_size ( const int  statfd)
static

@function Parses VmRSS (Resident Set Size) value from statfd and returns it as process memory size.

Parameters
statfdFD of process status file
Returns
Process memory size on success, 0 when statfd is not readable (that means process exited: errno set to ESRCH - no such process) or -1 on error

◆ df_fuzz_init()

int df_fuzz_init ( GDBusProxy *  dproxy,
const int  statfd,
const int  pid,
const long  mem_limit 
)

@function Saves pointer on D-Bus interface proxy for this module to be able to call methods through this proxy during fuzz testing. Also saves process initial memory size to global var. df_initial_mem from file described by statfd.

Parameters
dproxyPointer on D-Bus interface proxy
statfdFD of process status file
pidPID of tested process
mem_limitMemory limit in kB - if tested process exceeds this limit it will be noted into log file
Returns
0 on success, -1 on error

◆ df_fuzz_test_method()

int df_fuzz_test_method ( const int  statfd,
long  buf_size,
const char *  name,
const char *  obj,
const char *  intf,
const int  pid,
const int  void_method,
const char *  execute_cmd 
)

@function Function is testing a method in a cycle, each cycle generates data for function arguments, calls method and waits for result.

Parameters
statfdFD of process status file
buf_sizeMaximum buffer size for generated strings by rand module (in Bytes)
nameD-Bus name
objD-Bus object path
intfD-Bus interface
pidPID of tested process
void_methodIf method has out args 1, 0 otherwise
execute_cmdCommand/Script to execute after each method call.
Returns
0 on success, -1 on error, 1 on tested process crash, 2 on void function returning non-void value, 3 on warnings and 4 when executed command finished unsuccessfuly

◆ df_fuzz_write_log()

static int df_fuzz_write_log ( void  )
static

@function Prints all method signatures and their values on the output.

Returns
0 on success, -1 on error

◆ df_list_args_count()

int df_list_args_count ( void  )
Returns
Number of arguments of tested method

Variable Documentation

◆ df_dproxy

GDBusProxy* df_dproxy
static

Pointer on D-Bus interface proxy for calling methods.

◆ df_except_counter

char df_except_counter = 0
static

Exceptions counter; if MAX_EXCEPTIONS is reached testing continues with a next method

◆ df_initial_mem

long df_initial_mem = -2
static

Initial memory size of process is saved into this variable; value -2 indicates that initial memory was not loaded so far

◆ df_last

struct df_signature* df_last
static

Pointer on the last item of the linked list in the global var. df_list.

◆ df_list

struct df_sig_list df_list
static

Structure containing information about the linked list.

◆ df_mem_limit

long df_mem_limit = -1
static

Memory limit for tested process in kB - if tested process exceeds this limit it will be noted into log file; if set to -1 memory limit will be reloaded in df_fuzz_init()

◆ df_mlflg

int df_mlflg
static

If memory limit passed to function df_fuzz_init() is non-zero, this flag is set to 1

◆ df_unsupported_sig

int df_unsupported_sig
static

Flag for unsupported method signature, 1 means signature is unsupported

◆ df_unsupported_sig_str

char* df_unsupported_sig_str
static

Pointer on unsupported signature string (do not free it)