diff --git a/tests/fuzzing/meson.build b/tests/fuzzing/meson.build index 21b27956a..e0550a98d 100644 --- a/tests/fuzzing/meson.build +++ b/tests/fuzzing/meson.build @@ -26,6 +26,8 @@ ngap_message_source = files('ngap-message-fuzz.c') s1ap_message_source = files('s1ap-message-fuzz.c') pfcp_message_source = files('pfcp-message-fuzz.c') nas_5gs_message_source = files('nas-5gs-message-fuzz.c') +sbi_nf_profile_source = files('sbi-nf-profile-fuzz.c') +sbi_sm_context_source = files('sbi-sm-context-fuzz.c') # Build all executable executable( @@ -75,3 +77,19 @@ executable( dependencies : [libnas_5gs_dep, libcore_dep], link_args: lib_fuzzing_engine ) + +executable( + 'sbi_nf_profile_fuzz', + sources : sbi_nf_profile_source, + c_args : [testunit_core_cc_flags, sbi_cc_flags], + dependencies : [libsbi_dep, libcore_dep], + link_args: lib_fuzzing_engine +) + +executable( + 'sbi_sm_context_fuzz', + sources : sbi_sm_context_source, + c_args : [testunit_core_cc_flags, sbi_cc_flags], + dependencies : [libsbi_dep, libcore_dep], + link_args: lib_fuzzing_engine +) diff --git a/tests/fuzzing/sbi-nf-profile-fuzz.c b/tests/fuzzing/sbi-nf-profile-fuzz.c new file mode 100644 index 000000000..71b51463f --- /dev/null +++ b/tests/fuzzing/sbi-nf-profile-fuzz.c @@ -0,0 +1,75 @@ +/* + * Copyright (C) 2019-2026 by Arthur SC Chan + * + * This file is part of Open5GS. + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . + */ + +#include +#include +#include + +#include "fuzzing.h" +#include "ogs-sbi.h" + +#define kMinInputLength 2 +#define kMaxInputLength 16384 + +extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) +{ + ogs_sbi_message_t message; + ogs_sbi_response_t *response = NULL; + int rv; + + if (Size < kMinInputLength || Size > kMaxInputLength) { + return 1; + } + + if (!initialized) { + initialize(); + ogs_log_install_domain(&__ogs_sbi_domain, "sbi", OGS_LOG_NONE); + ogs_sbi_message_init(8, 8); + } + + response = ogs_sbi_response_new(); + if (response == NULL) { + return 0; + } + + /* Route to the NF-profile deserializer */ + response->h.method = ogs_strdup(OGS_SBI_HTTP_METHOD_PUT); + response->h.uri = ogs_strdup("/nnrf-nfm/v1/nf-instances/fuzz"); + response->status = OGS_SBI_HTTP_STATUS_OK; + + /* The HTTP layer hands open5gs a NUL-terminated body */ + response->http.content = ogs_malloc(Size + 1); + if (response->http.content) { + memcpy(response->http.content, Data, Size); + response->http.content[Size] = '\0'; + response->http.content_length = Size; + } + + ogs_sbi_header_set(response->http.headers, + OGS_SBI_CONTENT_TYPE, OGS_SBI_CONTENT_JSON_TYPE); + + rv = ogs_sbi_parse_response(&message, response); + + ogs_sbi_response_free(response); + if (rv == OGS_OK) { + ogs_sbi_message_free(&message); + } + + return 0; +} diff --git a/tests/fuzzing/sbi-sm-context-fuzz.c b/tests/fuzzing/sbi-sm-context-fuzz.c new file mode 100644 index 000000000..cd0cc5316 --- /dev/null +++ b/tests/fuzzing/sbi-sm-context-fuzz.c @@ -0,0 +1,75 @@ +/* + * Copyright (C) 2019-2026 by Arthur SC Chan + * + * This file is part of Open5GS. + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . + */ + +#include +#include +#include + +#include "fuzzing.h" +#include "ogs-sbi.h" + +#define kMinInputLength 2 +#define kMaxInputLength 16384 + +extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) +{ + ogs_sbi_message_t message; + ogs_sbi_response_t *response = NULL; + int rv; + + if (Size < kMinInputLength || Size > kMaxInputLength) { + return 1; + } + + if (!initialized) { + initialize(); + ogs_log_install_domain(&__ogs_sbi_domain, "sbi", OGS_LOG_NONE); + ogs_sbi_message_init(8, 8); + } + + response = ogs_sbi_response_new(); + if (response == NULL) { + return 0; + } + + /* Route to the SM-context create deserializer */ + response->h.method = ogs_strdup(OGS_SBI_HTTP_METHOD_POST); + response->h.uri = ogs_strdup("/nsmf-pdusession/v1/sm-contexts"); + response->status = 0; + + /* The HTTP layer hands open5gs a NUL-terminated body */ + response->http.content = ogs_malloc(Size + 1); + if (response->http.content) { + memcpy(response->http.content, Data, Size); + response->http.content[Size] = '\0'; + response->http.content_length = Size; + } + + ogs_sbi_header_set(response->http.headers, + OGS_SBI_CONTENT_TYPE, OGS_SBI_CONTENT_JSON_TYPE); + + rv = ogs_sbi_parse_response(&message, response); + + ogs_sbi_response_free(response); + if (rv == OGS_OK) { + ogs_sbi_message_free(&message); + } + + return 0; +} diff --git a/tests/fuzzing/sbi_nf_profile_fuzz_seed_corpus.zip b/tests/fuzzing/sbi_nf_profile_fuzz_seed_corpus.zip new file mode 100644 index 000000000..08a1e3ab8 Binary files /dev/null and b/tests/fuzzing/sbi_nf_profile_fuzz_seed_corpus.zip differ diff --git a/tests/fuzzing/sbi_sm_context_fuzz_seed_corpus.zip b/tests/fuzzing/sbi_sm_context_fuzz_seed_corpus.zip new file mode 100644 index 000000000..6267ab075 Binary files /dev/null and b/tests/fuzzing/sbi_sm_context_fuzz_seed_corpus.zip differ