fuzz-systemctl-parse-argv: refuse commandlines above 1k entries
oss-fuzz reports timeouts which are created by appending to a very long strv. The code is indeed not very efficient, but it's designed for normal command-line use, where we don't expect more than a dozen of entries. The fact that it is slow with ~100k entries is not particularly interesting. In the future we could rework the code to have better algorithmic complexity. But let's at least stop oss-fuzz from wasting more time on such examples. (My first approach was to set max_len in .options, but apparently this doesn't work for hongfuzz and and AFL.) oss-fuzz-34527: https://oss-fuzz.com/issue/5722283944574976
This commit is contained in:
@@ -31,6 +31,12 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
||||
|
||||
if (!argv[0])
|
||||
return 0; /* argv[0] should always be present, but may be zero-length. */
|
||||
if (strv_length(argv) > 1024)
|
||||
return 0; /* oss-fuzz reports timeouts which are caused by appending to a very long strv.
|
||||
* The code is indeed not very efficient, but it's designed for normal command-line
|
||||
* use, where we don't expect more than a dozen of entries. The fact that it is
|
||||
* slow with ~100k entries is not particularly interesting. Let's just refuse such
|
||||
* long command lines. */
|
||||
|
||||
if (getenv_bool("SYSTEMD_FUZZ_OUTPUT") <= 0) {
|
||||
orig_stdout_fd = fcntl(fileno(stdout), F_DUPFD_CLOEXEC, 3);
|
||||
|
||||
Reference in New Issue
Block a user