dfuzzer
|
#include <gio/gio.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <fcntl.h>
#include <ctype.h>
#include <errno.h>
#include <ffi.h>
#include "fuzz.h"
#include "dfuzzer.h"
#include "rand.h"
Functions | |
static long | df_fuzz_get_proc_mem_size (const int statfd) |
static int | df_fuzz_write_log (void) |
static int | df_exec_cmd_check (const char *cmd) |
static GVariant * | df_fuzz_create_variant (void) |
static int | df_fuzz_create_list_variants (void) |
static int | df_fuzz_create_fmt_string (char **fmt, const int n) |
static int | df_fuzz_call_method (const GVariant *value, const int void_method) |
int | df_ewrite (int fd, const void *buf, size_t count) |
int | df_fuzz_init (GDBusProxy *dproxy, const int statfd, const int pid, const long mem_limit) |
int | df_fuzz_add_method (const char *name) |
int | df_fuzz_add_method_arg (const char *signature) |
int | df_list_args_count (void) |
int | df_fuzz_test_method (const int statfd, long buf_size, const char *name, const char *obj, const char *intf, const int pid, const int void_method, const char *execute_cmd) |
void | df_fuzz_clean_method (void) |
Variables | |
static GDBusProxy * | df_dproxy |
static struct df_sig_list | df_list |
static struct df_signature * | df_last |
static long | df_initial_mem = -2 |
static long | df_mem_limit = -1 |
static int | df_mlflg |
static int | df_unsupported_sig |
static char * | df_unsupported_sig_str |
static char | df_except_counter = 0 |
|
inline |
Error checked write function with short write correction (when write is interrupted by a signal).
fd | File descriptor where to write |
buf | Buffer from which to write to file descriptor fd |
count | Number of bytes to be written |
|
static |
Executes command/script cmd.
cmd | Command/Script to execute |
int df_fuzz_add_method | ( | const char * | name | ) |
Initializes the global variable df_list (struct df_sig_list) including allocationg memory for method name inside df_list.
name | Name of method which will be tested |
int df_fuzz_add_method_arg | ( | const char * | signature | ) |
Adds item (struct df_signature) at the end of the linked list in the global variable df_list (struct df_sig_list). This includes allocating memory for item and for signature string.
signature | D-Bus signature of the argument |
|
static |
Calls method from df_list (using its name) with its arguments.
value | GVariant tuple containing all method arguments signatures and their values |
void_method | If method has out args 1, 0 otherwise |
void df_fuzz_clean_method | ( | void | ) |
Releases memory used by this module. This function must be called after df_fuzz_add_method() and df_fuzz_add_method_arg() functions calls after the end of fuzz testing of each method.
|
static |
Creates format string (tuple) from method arguments signatures with maximum length of n-1. The final string is saved in parameter fmt.
fmt | Pointer on buffer where format string should be stored |
n | Size of buffer |
|
static |
Generates data for each method argument according to argument signature and stores it into Gvariant variable in items of linked list.
|
static |
Creates GVariant tuple variable which contains all the signatures of method arguments including their values. This tuple is constructed from each signature of method argument by one call of g_variant_new() function. This call is constructed dynamically (using libffi) as we don't know number of function parameters on compile time.
|
static |
Parses VmRSS (Resident Set Size) value from statfd and returns it as process memory size.
statfd | FD of process status file |
int df_fuzz_init | ( | GDBusProxy * | dproxy, |
const int | statfd, | ||
const int | pid, | ||
const long | mem_limit | ||
) |
Saves pointer on D-Bus interface proxy for this module to be able to call methods through this proxy during fuzz testing. Also saves process initial memory size to global var. df_initial_mem from file described by statfd.
dproxy | Pointer on D-Bus interface proxy |
statfd | FD of process status file |
pid | PID of tested process |
mem_limit | Memory limit in kB - if tested process exceeds this limit it will be noted into log file |
int df_fuzz_test_method | ( | const int | statfd, |
long | buf_size, | ||
const char * | name, | ||
const char * | obj, | ||
const char * | intf, | ||
const int | pid, | ||
const int | void_method, | ||
const char * | execute_cmd | ||
) |
Function is testing a method in a cycle, each cycle generates data for function arguments, calls method and waits for result.
statfd | FD of process status file |
buf_size | Maximum buffer size for generated strings by rand module (in Bytes) |
name | D-Bus name |
obj | D-Bus object path |
intf | D-Bus interface |
pid | PID of tested process |
void_method | If method has out args 1, 0 otherwise |
execute_cmd | Command/Script to execute after each method call. |
|
static |
Prints all method signatures and their values on the output.
int df_list_args_count | ( | void | ) |
|
static |
Pointer on D-Bus interface proxy for calling methods.
|
static |
Exceptions counter; if MAX_EXCEPTIONS is reached testing continues with a next method
|
static |
Initial memory size of process is saved into this variable; value -2 indicates that initial memory was not loaded so far
|
static |
Pointer on the last item of the linked list in the global var. df_list.
|
static |
Structure containing information about the linked list.
|
static |
Memory limit for tested process in kB - if tested process exceeds this limit it will be noted into log file; if set to -1 memory limit will be reloaded in df_fuzz_init()
|
static |
If memory limit passed to function df_fuzz_init() is non-zero, this flag is set to 1
|
static |
Flag for unsupported method signature, 1 means signature is unsupported
|
static |
Pointer on unsupported signature string (do not free it)