dfuzzer
Functions | Variables
fuzz.c File Reference
#include <gio/gio.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <fcntl.h>
#include <ctype.h>
#include <errno.h>
#include <ffi.h>
#include "fuzz.h"
#include "dfuzzer.h"
#include "rand.h"

Functions

static long df_fuzz_get_proc_mem_size (const int statfd)
 
static int df_fuzz_write_log (void)
 
static int df_exec_cmd_check (const char *cmd)
 
static GVariant * df_fuzz_create_variant (void)
 
static int df_fuzz_create_list_variants (void)
 
static int df_fuzz_create_fmt_string (char **fmt, const int n)
 
static int df_fuzz_call_method (const GVariant *value, const int void_method)
 
int df_ewrite (int fd, const void *buf, size_t count)
 
int df_fuzz_init (GDBusProxy *dproxy, const int statfd, const int pid, const long mem_limit)
 
int df_fuzz_add_method (const char *name)
 
int df_fuzz_add_method_arg (const char *signature)
 
int df_list_args_count (void)
 
int df_fuzz_test_method (const int statfd, long buf_size, const char *name, const char *obj, const char *intf, const int pid, const int void_method, const char *execute_cmd)
 
void df_fuzz_clean_method (void)
 

Variables

static GDBusProxy * df_dproxy
 
static struct df_sig_list df_list
 
static struct df_signaturedf_last
 
static long df_initial_mem = -2
 
static long df_mem_limit = -1
 
static int df_mlflg
 
static int df_unsupported_sig
 
static char * df_unsupported_sig_str
 
static char df_except_counter = 0
 

Function Documentation

◆ df_ewrite()

int df_ewrite ( int  fd,
const void *  buf,
size_t  count 
)
inline

Error checked write function with short write correction (when write is interrupted by a signal).

Parameters
fdFile descriptor where to write
bufBuffer from which to write to file descriptor fd
countNumber of bytes to be written
Returns
0 on success, -1 on error

◆ df_exec_cmd_check()

static int df_exec_cmd_check ( const char *  cmd)
static

Executes command/script cmd.

Parameters
cmdCommand/Script to execute
Returns
0 on successful completition of cmd or when cmd is NULL, value higher than 0 on unsuccessful completition of cmd or -1 on error

◆ df_fuzz_add_method()

int df_fuzz_add_method ( const char *  name)

Initializes the global variable df_list (struct df_sig_list) including allocationg memory for method name inside df_list.

Parameters
nameName of method which will be tested
Returns
0 on success, -1 on error

◆ df_fuzz_add_method_arg()

int df_fuzz_add_method_arg ( const char *  signature)

Adds item (struct df_signature) at the end of the linked list in the global variable df_list (struct df_sig_list). This includes allocating memory for item and for signature string.

Parameters
signatureD-Bus signature of the argument
Returns
0 on success, -1 on error

◆ df_fuzz_call_method()

static int df_fuzz_call_method ( const GVariant *  value,
const int  void_method 
)
static

Calls method from df_list (using its name) with its arguments.

Parameters
valueGVariant tuple containing all method arguments signatures and their values
void_methodIf method has out args 1, 0 otherwise
Returns
0 on success, -1 on error, 1 if void method returned non-void value or 2 when tested method raised exception (so it should be skipped)

◆ df_fuzz_clean_method()

void df_fuzz_clean_method ( void  )

Releases memory used by this module. This function must be called after df_fuzz_add_method() and df_fuzz_add_method_arg() functions calls after the end of fuzz testing of each method.

◆ df_fuzz_create_fmt_string()

static int df_fuzz_create_fmt_string ( char **  fmt,
const int  n 
)
static

Creates format string (tuple) from method arguments signatures with maximum length of n-1. The final string is saved in parameter fmt.

Parameters
fmtPointer on buffer where format string should be stored
nSize of buffer
Returns
0 on success, -1 on error

◆ df_fuzz_create_list_variants()

static int df_fuzz_create_list_variants ( void  )
static

Generates data for each method argument according to argument signature and stores it into Gvariant variable in items of linked list.

Returns
0 on success, 1 on unsupported method signature, -1 on error

◆ df_fuzz_create_variant()

static GVariant * df_fuzz_create_variant ( void  )
static

Creates GVariant tuple variable which contains all the signatures of method arguments including their values. This tuple is constructed from each signature of method argument by one call of g_variant_new() function. This call is constructed dynamically (using libffi) as we don't know number of function parameters on compile time.

Returns
Pointer on a new GVariant variable containing tuple with method arguments

◆ df_fuzz_get_proc_mem_size()

static long df_fuzz_get_proc_mem_size ( const int  statfd)
static

Parses VmRSS (Resident Set Size) value from statfd and returns it as process memory size.

Parameters
statfdFD of process status file
Returns
Process memory size on success, 0 when statfd is not readable (that means process exited: errno set to ESRCH - no such process) or -1 on error

◆ df_fuzz_init()

int df_fuzz_init ( GDBusProxy *  dproxy,
const int  statfd,
const int  pid,
const long  mem_limit 
)

Saves pointer on D-Bus interface proxy for this module to be able to call methods through this proxy during fuzz testing. Also saves process initial memory size to global var. df_initial_mem from file described by statfd.

Parameters
dproxyPointer on D-Bus interface proxy
statfdFD of process status file
pidPID of tested process
mem_limitMemory limit in kB - if tested process exceeds this limit it will be noted into log file
Returns
0 on success, -1 on error

◆ df_fuzz_test_method()

int df_fuzz_test_method ( const int  statfd,
long  buf_size,
const char *  name,
const char *  obj,
const char *  intf,
const int  pid,
const int  void_method,
const char *  execute_cmd 
)

Function is testing a method in a cycle, each cycle generates data for function arguments, calls method and waits for result.

Parameters
statfdFD of process status file
buf_sizeMaximum buffer size for generated strings by rand module (in Bytes)
nameD-Bus name
objD-Bus object path
intfD-Bus interface
pidPID of tested process
void_methodIf method has out args 1, 0 otherwise
execute_cmdCommand/Script to execute after each method call.
Returns
0 on success, -1 on error, 1 on tested process crash, 2 on void function returning non-void value, 3 on warnings and 4 when executed command finished unsuccessfuly

◆ df_fuzz_write_log()

static int df_fuzz_write_log ( void  )
static

Prints all method signatures and their values on the output.

Returns
0 on success, -1 on error

◆ df_list_args_count()

int df_list_args_count ( void  )
Returns
Number of arguments of tested method

Variable Documentation

◆ df_dproxy

GDBusProxy* df_dproxy
static

Pointer on D-Bus interface proxy for calling methods.

◆ df_except_counter

char df_except_counter = 0
static

Exceptions counter; if MAX_EXCEPTIONS is reached testing continues with a next method

◆ df_initial_mem

long df_initial_mem = -2
static

Initial memory size of process is saved into this variable; value -2 indicates that initial memory was not loaded so far

◆ df_last

struct df_signature* df_last
static

Pointer on the last item of the linked list in the global var. df_list.

◆ df_list

struct df_sig_list df_list
static

Structure containing information about the linked list.

◆ df_mem_limit

long df_mem_limit = -1
static

Memory limit for tested process in kB - if tested process exceeds this limit it will be noted into log file; if set to -1 memory limit will be reloaded in df_fuzz_init()

◆ df_mlflg

int df_mlflg
static

If memory limit passed to function df_fuzz_init() is non-zero, this flag is set to 1

◆ df_unsupported_sig

int df_unsupported_sig
static

Flag for unsupported method signature, 1 means signature is unsupported

◆ df_unsupported_sig_str

char* df_unsupported_sig_str
static

Pointer on unsupported signature string (do not free it)