fuzz: add fuzzer for parsing .link files

This also renames load_link() to link_load_one()

4 files changed, 40 insertions, 4 deletions

diff --git a/src/udev/meson.build b/src/udev/meson.build
index 9d3f6d1c56..2de88c0d93 100644
--- a/src/udev/meson.build
+++ b/src/udev/meson.build
@@ -197,3 +197,14 @@ configure_file(
 
 meson.add_install_script('sh', '-c',
                          mkdir_p.format(join_paths(sysconfdir, 'udev/rules.d')))
+
+fuzzers += [
+        [['src/udev/net/fuzz-link-parser.c',
+          'src/fuzz/fuzz.h'],
+         [libudev_core,
+          libudev_static,
+          libsystemd_network,
+          libshared],
+         [threads,
+          libacl]]
+        ]
diff --git a/src/udev/net/fuzz-link-parser.c b/src/udev/net/fuzz-link-parser.c
new file mode 100644
index 0000000000..397fa2c16e
--- /dev/null
+++ b/src/udev/net/fuzz-link-parser.c
@@ -0,0 +1,25 @@
+/* SPDX-License-Identifier: LGPL-2.1+ */
+
+#include "fd-util.h"
+#include "fs-util.h"
+#include "fuzz.h"
+#include "link-config.h"
+#include "tmpfile-util.h"
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+        _cleanup_(link_config_ctx_freep) link_config_ctx *ctx = NULL;
+        _cleanup_(unlink_tempfilep) char filename[] = "/tmp/fuzz-link-config.XXXXXX";
+        _cleanup_fclose_ FILE *f = NULL;
+
+        if (!getenv("SYSTEMD_LOG_LEVEL"))
+                log_set_max_level(LOG_CRIT);
+
+        assert_se(fmkostemp_safe(filename, "r+", &f) == 0);
+        if (size != 0)
+                assert_se(fwrite(data, size, 1, f) == 1);
+
+        fflush(f);
+        assert_se(link_config_ctx_new(&ctx) >= 0);
+        (void) link_load_one(ctx, filename);
+        return 0;
+}
diff --git a/src/udev/net/link-config.c b/src/udev/net/link-config.c
index aa3e7eeae3..f1d36ccac0 100644
--- a/src/udev/net/link-config.c
+++ b/src/udev/net/link-config.c
@@ -94,8 +94,6 @@ void link_config_ctx_free(link_config_ctx *ctx) {
         return;
 }
 
-DEFINE_TRIVIAL_CLEANUP_FUNC(link_config_ctx*, link_config_ctx_free);
-
 int link_config_ctx_new(link_config_ctx **ret) {
         _cleanup_(link_config_ctx_freep) link_config_ctx *ctx = NULL;
 
@@ -117,7 +115,7 @@ int link_config_ctx_new(link_config_ctx **ret) {
         return 0;
 }
 
-static int load_link(link_config_ctx *ctx, const char *filename) {
+int link_load_one(link_config_ctx *ctx, const char *filename) {
         _cleanup_(link_config_freep) link_config *link = NULL;
         _cleanup_fclose_ FILE *file = NULL;
         _cleanup_free_ char *name = NULL;
@@ -224,7 +222,7 @@ int link_config_load(link_config_ctx *ctx) {
                 return log_error_errno(r, "failed to enumerate link files: %m");
 
         STRV_FOREACH_BACKWARDS(f, files) {
-                r = load_link(ctx, *f);
+                r = link_load_one(ctx, *f);
                 if (r < 0)
                         log_error_errno(r, "Failed to load %s, ignoring: %m", *f);
         }
diff --git a/src/udev/net/link-config.h b/src/udev/net/link-config.h
index 1113b1052e..4335b593d1 100644
--- a/src/udev/net/link-config.h
+++ b/src/udev/net/link-config.h
@@ -67,7 +67,9 @@ struct link_config {
 
 int link_config_ctx_new(link_config_ctx **ret);
 void link_config_ctx_free(link_config_ctx *ctx);
+DEFINE_TRIVIAL_CLEANUP_FUNC(link_config_ctx*, link_config_ctx_free);
 
+int link_load_one(link_config_ctx *ctx, const char *filename);
 int link_config_load(link_config_ctx *ctx);
 bool link_config_should_reload(link_config_ctx *ctx);