[openssh-commits] [openssh] 14/15: oss-fuzz: Add new fuzzer for krl operation

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

dtucker pushed a commit to branch master
in repository openssh.

commit e1b1ded8294a2f9ab646cbcb05e06422b0ce232a
Author: Arthur Chan <arthur.chan at adalogics.com>
AuthorDate: Thu Jan 22 09:46:52 2026 +0000

    oss-fuzz: Add new fuzzer for krl operation
    
    Signed-off-by: Arthur Chan <arthur.chan at adalogics.com>
---
 regress/misc/fuzz-harness/Makefile    |  5 ++-
 regress/misc/fuzz-harness/krl_fuzz.cc | 64 +++++++++++++++++++++++++++++++++++
 2 files changed, 68 insertions(+), 1 deletion(-)

diff --git a/regress/misc/fuzz-harness/Makefile b/regress/misc/fuzz-harness/Makefile
index f86e3c731..afdac6a49 100644
--- a/regress/misc/fuzz-harness/Makefile
+++ b/regress/misc/fuzz-harness/Makefile
@@ -18,7 +18,7 @@ TARGETS=pubkey_fuzz sig_fuzz authopt_fuzz authkeys_fuzz sshsig_fuzz \
 	ssh_client_session_fuzz sftp_server_msg_fuzz authfd_reply_fuzz \
 	sftp_client_fuzz misc_parse_fuzz ssh_channels_fuzz \
 	session_channel_req_fuzz sshd_auth_session_fuzz hostfile_fuzz \
-	mux_fuzz sshconfig_fuzz
+	mux_fuzz sshconfig_fuzz krl_fuzz
 
 all: $(TARGETS)
 
@@ -57,6 +57,9 @@ sshconfig_fuzz: sshconfig_fuzz.o $(SK_NULL_OBJS) $(COMMON_DEPS)
 		../../../addrmatch.o ../../../misc.o ../../../krl.o \
 		$(LDFLAGS) $(FUZZ_FLAGS) $(LIBS) -lz
 
+krl_fuzz: krl_fuzz.o $(SK_NULL_OBJS) $(COMMON_DEPS)
+	$(CXX) -o $@ krl_fuzz.o $(SK_NULL_OBJS) $(LDFLAGS) $(FUZZ_FLAGS) $(LIBS) -lz
+
 agent_fuzz: agent_fuzz.o agent_fuzz_helper.o sk-dummy.o ../../../ssh-sk.o $(COMMON_DEPS)
 	$(CXX) -o $@ agent_fuzz.o agent_fuzz_helper.o sk-dummy.o ../../../ssh-sk.o $(LDFLAGS) $(FUZZ_FLAGS) $(LIBS) -lz
 
diff --git a/regress/misc/fuzz-harness/krl_fuzz.cc b/regress/misc/fuzz-harness/krl_fuzz.cc
new file mode 100644
index 000000000..a765ef565
--- /dev/null
+++ b/regress/misc/fuzz-harness/krl_fuzz.cc
@@ -0,0 +1,64 @@
+// libfuzzer driver for krl parse fuzzing.
+
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+extern "C" {
+#include "includes.h"
+#include "sshkey.h"
+#include "sshbuf.h"
+#include "ssherr.h"
+#include "krl.h"
+#include "log.h"
+#include "authfile.h"
+}
+
+static int initialised = 0;
+static FILE *null_file;
+static struct sshkey *key = NULL;
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    // single initialisation
+    if (!initialised) {
+        log_init("krl_fuzz", SYSLOG_LEVEL_ERROR, SYSLOG_FACILITY_AUTH, 0);
+
+        if ((null_file = fopen("/dev/null", "w")) == NULL) return 0;
+
+        if (sshkey_generate(KEY_ED25519, 0, &key) != 0) return 0;
+
+        initialised = 1;
+    }
+
+    // Reject empty corpus
+    if (size < 4) return 0;
+
+    // Convert fuzzer data to ssh buffer
+    struct sshbuf *buf = sshbuf_from(data, size);
+    if (!buf) return 0;
+
+    // Parse the ssh buffer as krl, early exit if failed
+    struct ssh_krl *krl = NULL;
+    int ret = ssh_krl_from_blob(buf, &krl);
+    sshbuf_free(buf);
+    if (ret != 0) return 0;
+
+    // Fuzz serailisation roundtrip
+    struct sshbuf *output = sshbuf_new();
+    struct ssh_krl *krl2 = NULL;
+    ssh_krl_to_blob(krl, output);
+    ssh_krl_from_blob(output, &krl2);
+    ssh_krl_free(krl2);
+    sshbuf_free(output);
+
+    // Fuzz krl_dump
+    krl_dump(krl, null_file);
+
+    // Fuzz ssh_krl_check_key
+    ssh_krl_check_key(krl, key);
+
+    ssh_krl_free(krl);
+    return 0;
+}

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.