TestFuzzWinPRClipboard.c

 
#include <stddef.h>
#include <stdint.h>
 
#include <winpr/crt.h>
#include <winpr/clipboard.h>
#include <winpr/wlog.h>
 
static const char* kSourceFormats[] = { "CF_DIB",
                                      "CF_DIBV5",
                                      "HTML Format",
                                      "text/html",
                                      "image/bmp",
                                      "image/png",
                                      "FileGroupDescriptorW",
                                      "text/uri-list",
                                      "CF_UNICODETEXT",
                                      "CF_TEXT",
                                      "CF_OEMTEXT" };
 
int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
{
  static BOOL loggingInitialized = FALSE;
 
  if (!loggingInitialized)
  {
    (void)WLog_SetLogLevel(WLog_GetRoot(), WLOG_TRACE);
    (void)WLog_SetLogAppenderType(WLog_GetRoot(), WLOG_APPENDER_CALLBACK);
    loggingInitialized = TRUE;
  }
 
  if (size < 2)
    return 0;
  if (size > (1u << 20))
    return 0;
 
  wClipboard* clipboard = ClipboardCreate();
  if (!clipboard)
    return 0;
 
  const size_t count = sizeof(kSourceFormats) / sizeof(kSourceFormats[0]);
  const char* srcName = kSourceFormats[data[0] % count];
 
  UINT32 srcId = ClipboardRegisterFormat(clipboard, srcName);
  if (srcId != 0)
  {
    /* Store the remaining bytes as the (attacker) payload for srcName. */
    (void)ClipboardSetData(clipboard, srcId, data + 1, (UINT32)(size - 1));
 
    UINT32* formatIds = nullptr;
    UINT32 numFormats = ClipboardGetFormatIds(clipboard, &formatIds);
 
    for (UINT32 i = 0; i < numFormats; i++)
    {
      UINT32 outSize = 0;
      void* out = ClipboardGetData(clipboard, formatIds[i], &outSize);
      free(out);
    }
    free(formatIds);
  }
 
  ClipboardDestroy(clipboard);
  return 0;
}