From 4ec9e3d286b6d3e982cb0fc3564dee0bf8d87ede Mon Sep 17 00:00:00 2001
From: Patrick Griffis <pgriffis@igalia.com>
Date: Tue, 27 Aug 2024 12:18:58 -0500
Subject: [PATCH] fuzzing: Cover soup_header_parse_param_list

CVE: CVE-2024-52531
Upstream-Status: Backport
[https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407/diffs?commit_id=4ec9e3d286b6d3e982cb0fc3564dee0bf8d87ede]

Signed-off-by: Changqing Li <changqing.li@windriver.com>

---
 fuzzing/fuzz.h                   |  9 +++++++--
 fuzzing/fuzz_header_parsing.c    | 19 +++++++++++++++++++
 fuzzing/fuzz_header_parsing.dict |  8 ++++++++
 fuzzing/meson.build              |  2 ++
 4 files changed, 36 insertions(+), 2 deletions(-)
 create mode 100644 fuzzing/fuzz_header_parsing.c
 create mode 100644 fuzzing/fuzz_header_parsing.dict

diff --git a/fuzzing/fuzz.h b/fuzzing/fuzz.h
index 0d380285..f3bd28ee 100644
--- a/fuzzing/fuzz.h
+++ b/fuzzing/fuzz.h
@@ -1,13 +1,14 @@
 #include "libsoup/soup.h"
 
 int LLVMFuzzerTestOneInput (const unsigned char *data, size_t size);
+static int set_logger = 0;
 
 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
 static GLogWriterOutput
 empty_logging_func (GLogLevelFlags log_level, const GLogField *fields,
                     gsize n_fields, gpointer user_data)
 {
-  return G_LOG_WRITER_HANDLED;
+        return G_LOG_WRITER_HANDLED;
 }
 #endif
 
@@ -16,6 +17,10 @@ static void
 fuzz_set_logging_func (void)
 {
 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
-  g_log_set_writer_func (empty_logging_func, NULL, NULL);
+        if (!set_logger)
+        {
+                set_logger = 1;
+                g_log_set_writer_func (empty_logging_func, NULL, NULL);
+        }
 #endif
 }
diff --git a/fuzzing/fuzz_header_parsing.c b/fuzzing/fuzz_header_parsing.c
new file mode 100644
index 00000000..a8e5c1f9
--- /dev/null
+++ b/fuzzing/fuzz_header_parsing.c
@@ -0,0 +1,19 @@
+#include "fuzz.h"
+
+int
+LLVMFuzzerTestOneInput (const unsigned char *data, size_t size)
+{
+        GHashTable *elements;
+
+        // We only accept NUL terminated strings
+        if (!size || data[size - 1] != '\0')
+                return 0;
+
+        fuzz_set_logging_func ();
+
+        elements = soup_header_parse_param_list((char*)data);
+
+        g_hash_table_unref(elements);
+
+        return 0;
+}
\ No newline at end of file
diff --git a/fuzzing/fuzz_header_parsing.dict b/fuzzing/fuzz_header_parsing.dict
new file mode 100644
index 00000000..1562ca3a
--- /dev/null
+++ b/fuzzing/fuzz_header_parsing.dict
@@ -0,0 +1,8 @@
+"*=UTF-8''"
+"*=iso-8859-1''"
+"'"
+"''"
+"="
+"*="
+"""
+";"
\ No newline at end of file
diff --git a/fuzzing/meson.build b/fuzzing/meson.build
index b14cbb50..5dd0f417 100644
--- a/fuzzing/meson.build
+++ b/fuzzing/meson.build
@@ -5,6 +5,7 @@ fuzz_targets = [
   'fuzz_cookie_parse',
   'fuzz_content_sniffer',
   'fuzz_date_time',
+  'fuzz_header_parsing',
 ]
 
 fuzzing_args = '-fsanitize=fuzzer,address,undefined'
@@ -34,6 +35,7 @@ if have_fuzzing and (fuzzing_feature.enabled() or fuzzing_feature.auto())
         '-runs=200000',
         '-artifact_prefix=meson-logs/' + target + '-',
         '-print_final_stats=1',
+        '-max_len=4096',
       ] + extra_args,
       env: [
         'ASAN_OPTIONS=fast_unwind_on_malloc=0',
-- 
2.25.1

