| 57 | } |
| 58 | |
| 59 | extern "C" int LLVMFuzzerTestOneInput(uint8_t const* data, size_t size) |
| 60 | { |
| 61 | if (size < 1 || size > kMaxInputSize) { |
| 62 | return 0; |
| 63 | } |
| 64 | |
| 65 | // Use first byte for flags |
| 66 | uint8_t flags = data[0]; |
| 67 | |
| 68 | // Create a test file with known content |
| 69 | std::string testFile = g_testDir + "/lock_target.txt"; |
| 70 | std::string lockFile = g_testDir + "/test.lock"; |
| 71 | char const* testContent = "IMPORTANT DATA - MUST NOT BE TRUNCATED"; |
| 72 | |
| 73 | { |
| 74 | FILE* fp = fopen(testFile.c_str(), "w"); |
| 75 | if (!fp) |
| 76 | return 0; |
| 77 | fputs(testContent, fp); |
| 78 | fclose(fp); |
| 79 | } |
| 80 | |
| 81 | // Test different scenarios based on fuzz input |
| 82 | cmFileLock lock; |
| 83 | |
| 84 | // Vary the lock file path based on remaining input |
| 85 | std::string lockPath = lockFile; |
| 86 | if (size > 1 && (flags & 0x01)) { |
| 87 | // Use part of input as filename suffix (sanitized) |
| 88 | size_t nameLen = std::min(size - 1, size_t(32)); |
| 89 | std::string suffix; |
| 90 | for (size_t i = 0; i < nameLen; ++i) { |
| 91 | char c = static_cast<char>(data[1 + i]); |
| 92 | // Only allow safe filename characters |
| 93 | if ((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || |
| 94 | (c >= '0' && c <= '9') || c == '_' || c == '-') { |
| 95 | suffix += c; |
| 96 | } |
| 97 | } |
| 98 | if (!suffix.empty()) { |
| 99 | lockPath = g_testDir + "/" + suffix + ".lock"; |
| 100 | } |
| 101 | } |
| 102 | |
| 103 | // Test symlink scenario (security-critical) |
| 104 | if (flags & 0x02) { |
| 105 | // Create a symlink to the test file |
| 106 | std::string symlinkPath = g_testDir + "/symlink.lock"; |
| 107 | unlink(symlinkPath.c_str()); |
| 108 | if (symlink(testFile.c_str(), symlinkPath.c_str()) == 0) { |
| 109 | lockPath = symlinkPath; |
| 110 | } |
| 111 | } |
| 112 | |
| 113 | // Determine timeout - use 0 for fuzzing to avoid blocking |
| 114 | // (non-zero timeouts would stall the fuzzer) |
| 115 | unsigned long timeout = 0; |
| 116 | |