3 files changed, 76 insertions, 4 deletions

diff --git a/regress/misc/fuzz-harness/Makefile b/regress/misc/fuzz-harness/Makefile
index a2aa4441f..85179ac4e 100644
--- a/regress/misc/fuzz-harness/Makefile
+++ b/regress/misc/fuzz-harness/Makefile
@@ -1,13 +1,15 @@
 # NB. libssh and libopenbsd-compat should be built with the same sanitizer opts.
-CXX=clang++-3.9
-FUZZ_FLAGS=-fsanitize=address,undefined -fsanitize-coverage=edge
+CXX=clang++-6.0
+FUZZ_FLAGS=-fsanitize=address,undefined -fsanitize-coverage=edge,trace-pc
 FUZZ_LIBS=-lFuzzer
 
 CXXFLAGS=-O2 -g -Wall -Wextra -I ../../.. $(FUZZ_FLAGS)
 LDFLAGS=-L ../../.. -L ../../../openbsd-compat -g $(FUZZ_FLAGS)
 LIBS=-lssh -lopenbsd-compat -lcrypto $(FUZZ_LIBS)
 
-all: pubkey_fuzz sig_fuzz authopt_fuzz
+TARGETS=pubkey_fuzz sig_fuzz authopt_fuzz sshsig_fuzz sshsigopt_fuzz
+
+all: $(TARGETS)
 
 .cc.o:
         $(CXX) $(CXXFLAGS) -c $< -o $@
@@ -21,5 +23,11 @@ sig_fuzz: sig_fuzz.o
 authopt_fuzz: authopt_fuzz.o
         $(CXX) -o $@ authopt_fuzz.o ../../../auth-options.o $(LDFLAGS) $(LIBS)
 
+sshsig_fuzz: sshsig_fuzz.o
+        $(CXX) -o $@ sshsig_fuzz.o ../../../sshsig.o $(LDFLAGS) $(LIBS)
+
+sshsigopt_fuzz: sshsigopt_fuzz.o
+        $(CXX) -o $@ sshsigopt_fuzz.o ../../../sshsig.o $(LDFLAGS) $(LIBS)
+
 clean:
-        -rm -f *.o pubkey_fuzz sig_fuzz authopt_fuzz
+        -rm -f *.o $(TARGETS)
diff --git a/regress/misc/fuzz-harness/sshsig_fuzz.cc b/regress/misc/fuzz-harness/sshsig_fuzz.cc
new file mode 100644
index 000000000..fe09ccb87
--- /dev/null
+++ b/regress/misc/fuzz-harness/sshsig_fuzz.cc
@@ -0,0 +1,35 @@
+// cc_fuzz_target test for sshsig verification.
+
+#include <stddef.h>
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+extern "C" {
+
+#include "includes.h"
+#include "sshkey.h"
+#include "ssherr.h"
+#include "sshbuf.h"
+#include "sshsig.h"
+#include "log.h"
+
+int LLVMFuzzerTestOneInput(const uint8_t* sig, size_t slen)
+{
+  static const char *data = "If everyone started announcing his nose had "
+      "run away, I don’t know how it would all end";
+  struct sshbuf *signature = sshbuf_from(sig, slen);
+  struct sshbuf *message = sshbuf_from(data, strlen(data));
+  struct sshkey *k = NULL;
+  extern char *__progname;
+
+  log_init(__progname, SYSLOG_LEVEL_QUIET, SYSLOG_FACILITY_USER, 1);
+  sshsig_verifyb(signature, message, "castle", &k);
+  sshkey_free(k);
+  sshbuf_free(signature);
+  sshbuf_free(message);
+  return 0;
+}
+
+} // extern
diff --git a/regress/misc/fuzz-harness/sshsigopt_fuzz.cc b/regress/misc/fuzz-harness/sshsigopt_fuzz.cc
new file mode 100644
index 000000000..7424fcbe3
--- /dev/null
+++ b/regress/misc/fuzz-harness/sshsigopt_fuzz.cc
@@ -0,0 +1,29 @@
+#include <stddef.h>
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <stdlib.h>
+
+extern "C" {
+
+#include "sshsig.h"
+
+int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+        char *cp = (char *)malloc(size + 1);
+        struct sshsigopt *opts = NULL;
+
+        if (cp == NULL)
+                goto out;
+        memcpy(cp, data, size);
+        cp[size] = '\0';
+        if ((opts = sshsigopt_parse(cp, "libfuzzer", 0, NULL)) == NULL)
+                goto out;
+
+ out:
+        free(cp);
+        sshsigopt_free(opts);
+        return 0;
+}
+
+} // extern "C"