[openssh-commits] [openssh] 10/15: OSS-Fuzz: Add fuzzer targets hostfile handling

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

dtucker pushed a commit to branch master
in repository openssh.

commit 9f0005b3bb78924fd67937213e02a79a880e388b
Author: Arthur Chan <arthur.chan at adalogics.com>
AuthorDate: Fri May 29 15:44:45 2026 +0100

    OSS-Fuzz: Add fuzzer targets hostfile handling
    
    Signed-off-by: Arthur Chan <arthur.chan at adalogics.com>
---
 regress/misc/fuzz-harness/Makefile         |  5 +-
 regress/misc/fuzz-harness/hostfile_fuzz.cc | 91 ++++++++++++++++++++++++++++++
 2 files changed, 95 insertions(+), 1 deletion(-)

diff --git a/regress/misc/fuzz-harness/Makefile b/regress/misc/fuzz-harness/Makefile
index 7be40a493..2f28a6ae4 100644
--- a/regress/misc/fuzz-harness/Makefile
+++ b/regress/misc/fuzz-harness/Makefile
@@ -17,7 +17,7 @@ TARGETS=pubkey_fuzz sig_fuzz authopt_fuzz authkeys_fuzz sshsig_fuzz \
 	mkcorpus_sntrup761 sntrup761_enc_fuzz sntrup761_dec_fuzz \
 	ssh_client_session_fuzz sftp_server_msg_fuzz authfd_reply_fuzz \
 	sftp_client_fuzz misc_parse_fuzz ssh_channels_fuzz \
-	session_channel_req_fuzz sshd_auth_session_fuzz
+	session_channel_req_fuzz sshd_auth_session_fuzz hostfile_fuzz
 
 all: $(TARGETS)
 
@@ -96,6 +96,9 @@ session_channel_req_fuzz: session_channel_req_fuzz.o session_channel_req_fuzz_he
 sshd_auth_session_fuzz: sshd_auth_session_fuzz.o sshd_auth_session_fuzz_helper.o $(SK_NULL_OBJS) $(COMMON_DEPS)
 	$(CXX) -o $@ sshd_auth_session_fuzz.o sshd_auth_session_fuzz_helper.o $(SK_NULL_OBJS) ../../../auth.o ../../../auth2-none.o ../../../auth2-passwd.o ../../../auth2-pubkey.o ../../../auth2-kbdint.o ../../../auth2-hostbased.o ../../../auth2-chall.o ../../../auth2-methods.o ../../../auth2-pubkeyfile.o ../../../auth-options.o ../../../servconf.o ../../../groupaccess.o ../../../srclimit.o -Wl,--wrap=ssh_packet_write_wait $(LDFLAGS) $(FUZZ_FLAGS) $(LIBS) -lz
 
+hostfile_fuzz: hostfile_fuzz.o $(SK_NULL_OBJS) $(COMMON_DEPS)
+	$(CXX) -o $@ hostfile_fuzz.o $(SK_NULL_OBJS) $(LDFLAGS) $(FUZZ_FLAGS) $(LIBS)
+
 clean:
 	-rm -f *.o $(TARGETS)
 
diff --git a/regress/misc/fuzz-harness/hostfile_fuzz.cc b/regress/misc/fuzz-harness/hostfile_fuzz.cc
new file mode 100644
index 000000000..2087d4c67
--- /dev/null
+++ b/regress/misc/fuzz-harness/hostfile_fuzz.cc
@@ -0,0 +1,91 @@
+/* Copyright 2026 Google LLC
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+     http://www.apache.org/licenses/LICENSE-2.0
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#include <stdio.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+extern "C" {
+
+#include "hostfile.h"
+#include "sshkey.h"
+#include "log.h"
+
+static int log_initialized = 0;
+
+static int
+noop_cb(struct hostkey_foreach_line *l, void *ctx)
+{
+	(void)l; (void)ctx;
+	return 0;
+}
+
+int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+	if (!log_initialized) {
+		log_init("hostfile_fuzz", SYSLOG_LEVEL_QUIET,
+		    SYSLOG_FACILITY_AUTH, 0);
+		log_initialized = 1;
+	}
+
+	/* Drive every HKF_WANT_* combination on each input. */
+	static const u_int flag_combos[] = {
+		0,
+		HKF_WANT_MATCH,
+		HKF_WANT_PARSE_KEY,
+		HKF_WANT_MATCH | HKF_WANT_PARSE_KEY,
+	};
+	for (size_t i = 0; i < sizeof(flag_combos)/sizeof(flag_combos[0]); i++) {
+		FILE *f = fmemopen((void *)data, size, "r");
+		if (f == NULL)
+			continue;
+		const char *host = (flag_combos[i] & HKF_WANT_MATCH) ?
+		    "example.com" : NULL;
+		(void)hostkeys_foreach_file("/fuzz", f, noop_cb, NULL,
+		    host, "127.0.0.1", flag_combos[i], 0);
+		fclose(f);
+	}
+
+	/* Higher-level wrapper that adds record_hostkey on top of foreach. */
+	{
+		FILE *f = fmemopen((void *)data, size, "r");
+		if (f != NULL) {
+			struct hostkeys *hk = init_hostkeys();
+			if (hk != NULL) {
+				load_hostkeys_file(hk, "example.com",
+				    "/fuzz", f, 0);
+				free_hostkeys(hk);
+			}
+			fclose(f);
+		}
+	}
+
+	/* Drive host_hash + extract_salt on a bounded hostname-shaped slice. */
+	if (size > 0) {
+		size_t n = size < 256 ? size : 256;
+		char *hb = (char *)malloc(n + 1);
+		if (hb != NULL) {
+			memcpy(hb, data, n);
+			hb[n] = '\0';
+			char *h = host_hash("example.com", hb, 0);
+			free(h);
+			free(hb);
+		}
+	}
+
+	return 0;
+}
+
+} // extern "C"

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.