test: fuzz manifest/protocol/xattr, hardlink unit, fault injection

tests/fuzz/fuzz_manifest.c

@@ -0,0 +1,126 @@
+/*
+ * Fuzz the delete-manifest parser: receive_manifest_entries(int fd).
+ *
+ * The parser reads three length-delimited sections (keeps, protected prefixes,
+ * missing-args paths) from the connection.  Feeding raw bytes alone exercises
+ * the "reject the first malformed count/string" fast paths, but because each
+ * section is self-delimiting a single bad value hides every later section.
+ *
+ * To reach the protected-prefix and missing-args parsers (the paths that drive
+ * actual destination deletion) we build one canonical, fully-valid manifest
+ * with hand-written wire framing and then feed the receiver several shapes:
+ *
+ *   1. raw    : the raw fuzz bytes as the whole manifest.
+ *   2. keeps  : the valid keep count only + the fuzz bytes, so the fuzzer
+ *               drives the keep count and entries directly.
+ *   3. prot   : the valid keeps section + the fuzz bytes, so the fuzzer drives
+ *               the protected count and prefixes.
+ *   4. missing: the valid keeps+protected sections + the fuzz bytes, so the
+ *               fuzzer drives the trailing missing-args section, including the
+ *               aggregate MAX_MANIFEST_BYTES budget.
+ *
+ * The wire encoding matches receive_int (native int) and receive_wire_str
+ * (native size_t length prefix + body); no charset conversion is configured in
+ * the fuzz process, so receive_wire_str is receive_str.
+ */
+#include "file_receive.h"
+#include "protocol.h"
+#include <errno.h>
+#include <fcntl.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <unistd.h>
+
+static unsigned char g_manifest[512];
+static size_t g_len_after_count;     /* offset of the first keep entry */
+static size_t g_len_after_keeps;     /* offset of the protected count */
+static size_t g_len_after_protected; /* offset of the missing count */
+static int g_manifest_ready;
+
+static void append_int32(unsigned char* buf, size_t* off, int32_t value) {
+  memcpy(buf + *off, &value, sizeof(value));
+  *off += sizeof(value);
+}
+
+static void append_wire_str(unsigned char* buf, size_t* off, const char* s) {
+  size_t n = strlen(s);
+  memcpy(buf + *off, &n, sizeof(n));
+  *off += sizeof(n);
+  memcpy(buf + *off, s, n);
+  *off += n;
+}
+
+static void build_canonical_manifest(void) {
+  g_manifest_ready = 1;
+  size_t off = 0;
+  append_int32(g_manifest, &off, 2);
+  g_len_after_count = off;
+  append_wire_str(g_manifest, &off, "keep/a");
+  append_wire_str(g_manifest, &off, "keep/b");
+  g_len_after_keeps = off;
+  append_int32(g_manifest, &off, 1);
+  append_wire_str(g_manifest, &off, "excluded/prefix");
+  g_len_after_protected = off;
+  append_int32(g_manifest, &off, 1);
+  append_wire_str(g_manifest, &off, "missing/path");
+}
+
+/* Best-effort non-blocking write: an oversized fuzz input is truncated rather
+ * than stalling the harness. */
+static void write_best_effort(int fd, const void* data, size_t size) {
+  const unsigned char* p = data;
+  size_t off = 0;
+  while (off < size) {
+    ssize_t n = write(fd, p + off, size - off);
+    if (n > 0) {
+      off += (size_t)n;
+      continue;
+    }
+    if (n < 0 && errno == EINTR)
+      continue;
+    break;
+  }
+}
+
+/* Build prefix ++ data as a stream and drive receive_manifest_entries over it.
+ * The write half is shut down first so the parser always sees EOF instead of
+ * blocking on a missing frame tail. */
+static void receive_stream(const unsigned char* prefix, size_t prefix_len, const uint8_t* data,
+                           size_t size) {
+  int sv[2];
+  if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) != 0)
+    return;
+
+  int flags = fcntl(sv[0], F_GETFL, 0);
+  if (flags != -1)
+    (void)fcntl(sv[0], F_SETFL, flags | O_NONBLOCK);
+
+  if (prefix_len > 0)
+    write_best_effort(sv[0], prefix, prefix_len);
+  if (size > 0)
+    write_best_effort(sv[0], data, size);
+  shutdown(sv[0], SHUT_WR);
+
+  DeleteManifest* manifest = receive_manifest_entries(sv[1]);
+  delete_manifest_free(manifest);
+
+  close(sv[0]);
+  close(sv[1]);
+}
+
+int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  if (!g_manifest_ready)
+    build_canonical_manifest();
+
+  /* Raw bytes as the whole manifest. */
+  receive_stream(NULL, 0, data, size);
+
+  /* Keep the valid framing so the fuzzer reaches each later section. */
+  receive_stream(g_manifest, g_len_after_protected, data, size);
+  receive_stream(g_manifest, g_len_after_keeps, data, size);
+  receive_stream(g_manifest, g_len_after_count, data, size);
+
+  return 0;
+}