diff --git a/dbutil.c b/dbutil.c index d04afb68d..aadc20e5c 100644 --- a/dbutil.c +++ b/dbutil.c @@ -122,7 +122,7 @@ static void generic_dropbear_exit(int exitcode, const char* format, #ifdef DROPBEAR_FUZZ // longjmp before cleaning up svr_opts - if (fuzz.fuzzing) { + if (fuzz.do_jmp) { longjmp(fuzz.jmp, 1); } #endif diff --git a/fuzz-common.c b/fuzz-common.c index 2d9044c87..5c365d2ab 100644 --- a/fuzz-common.c +++ b/fuzz-common.c @@ -17,6 +17,7 @@ static void load_fixed_hostkeys(void); void common_setup_fuzzer(void) { fuzz.fuzzing = 1; fuzz.wrapfds = 1; + fuzz.do_jmp = 1; fuzz.input = m_malloc(sizeof(buffer)); _dropbear_log = fuzz_dropbear_log; crypto_init(); diff --git a/fuzz.h b/fuzz.h index 92344400d..e3bcb7f29 100644 --- a/fuzz.h +++ b/fuzz.h @@ -49,6 +49,7 @@ struct dropbear_fuzz_options { int wrapfds; // dropbear_exit() jumps back + int do_jmp; sigjmp_buf jmp; uid_t pw_uid; diff --git a/fuzzer-preauth.c b/fuzzer-preauth.c index 12b7fc278..e65a3bc37 100644 --- a/fuzzer-preauth.c +++ b/fuzzer-preauth.c @@ -12,6 +12,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { static int once = 0; if (!once) { setup_fuzzer(); + // XXX temporarily disable setjmp to debug asan segv + fuzz.do_jmp = 0; once = 1; } @@ -40,7 +42,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { wrapfd_add(fakesock, fuzz.input, PLAIN); m_malloc_set_epoch(1); - // temporarily disable setjmp to debug asan segv + // XXX temporarily disable setjmp to debug asan segv svr_session(fakesock, fakesock); #if 0 if (setjmp(fuzz.jmp) == 0) { diff --git a/svr-session.c b/svr-session.c index a1466fe01..543a830ec 100644 --- a/svr-session.c +++ b/svr-session.c @@ -185,7 +185,7 @@ void svr_dropbear_exit(int exitcode, const char* format, va_list param) { #ifdef DROPBEAR_FUZZ // longjmp before cleaning up svr_opts - if (fuzz.fuzzing) { + if (fuzz.do_jmp) { longjmp(fuzz.jmp, 1); } #endif