From a5bcaa70ed9be8425774ab1e5a1515f9baa9f455 Mon Sep 17 00:00:00 2001
From: Arthur Chan <arthur.chan@adalogics.com>
Date: Wed, 11 Mar 2026 21:54:45 +0000
Subject: [PATCH] fuzz: Add fuzzer targeting VICI messages

Closes strongswan/strongswan#3026

Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
---
 fuzz/.gitignore  |  1 +
 fuzz/Makefile.am |  9 +++++---
 fuzz/fuzz_vici.c | 59 ++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 66 insertions(+), 3 deletions(-)
 create mode 100644 fuzz/fuzz_vici.c

diff --git a/fuzz/.gitignore b/fuzz/.gitignore
index ec4091749..ca184d868 100644
--- a/fuzz/.gitignore
+++ b/fuzz/.gitignore
@@ -10,3 +10,4 @@ fuzz_ocsp_rsp_cus
 fuzz_ocsp_rsp_def
 fuzz_pa_tnc
 fuzz_pb_tnc
+fuzz_vici
diff --git a/fuzz/Makefile.am b/fuzz/Makefile.am
index b2801e0c9..dba75c84a 100644
--- a/fuzz/Makefile.am
+++ b/fuzz/Makefile.am
@@ -38,7 +38,7 @@ pb_tnc_ldflags = \
 	$(top_builddir)/src/libtncif/.libs/libtncif.a \
 	$(fuzz_ldflags)
 
-ike_ldflags = \
+charon_ldflags = \
 	$(top_builddir)/src/libcharon/.libs/libcharon.a \
 	$(top_builddir)/src/libradius/.libs/libradius.a \
 	$(fuzz_ldflags)
@@ -51,7 +51,7 @@ fuzzers_with_def = $(fuzzers_with_plugins:%=%_def)
 fuzzers_with_cus = $(fuzzers_with_plugins:%=%_cus)
 
 fuzzers_no_plugins = \
-	fuzz_ids fuzz_ike fuzz_pa_tnc fuzz_pb_tnc
+	fuzz_ids fuzz_ike fuzz_pa_tnc fuzz_pb_tnc fuzz_vici
 
 ALL_FUZZERS=$(fuzzers_with_def) $(fuzzers_with_cus) $(fuzzers_no_plugins)
 
@@ -93,7 +93,10 @@ fuzz_ids: fuzz_ids.c ${libfuzzer}
 	$(CC) $(AM_CPPFLAGS) $(CFLAGS) -o $@ $< $(fuzz_ldflags)
 
 fuzz_ike: fuzz_ike.c ${libfuzzer}
-	$(CC) $(AM_CPPFLAGS) $(CFLAGS) -o $@ $< $(ike_ldflags)
+	$(CC) $(AM_CPPFLAGS) $(CFLAGS) -o $@ $< $(charon_ldflags)
+
+fuzz_vici: fuzz_vici.c ${libfuzzer}
+	$(CC) $(AM_CPPFLAGS) $(CFLAGS) -o $@ $< $(charon_ldflags)
 
 noinst_LIBRARIES = libFuzzerLocal.a
 libFuzzerLocal_a_SOURCES = libFuzzerLocal.c
diff --git a/fuzz/fuzz_vici.c b/fuzz/fuzz_vici.c
new file mode 100644
index 000000000..b8a9b75d9
--- /dev/null
+++ b/fuzz/fuzz_vici.c
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2026 Arthur SC Chan
+ *
+ * Copyright (C) secunet Security Networks AG
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include <daemon.h>
+#include <library.h>
+#include <plugins/vici/vici_message.h>
+
+int LLVMFuzzerInitialize(int *argc, char ***argv)
+{
+	dbg_default_set_level(-1);
+	library_init(NULL, "fuzz_vici");
+	libcharon_init();
+	return 0;
+}
+
+int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len)
+{
+	enumerator_t *enumerator;
+	vici_message_t *msg;
+	chunk_t data, value;
+	vici_type_t type;
+	char *name;
+	int count;
+
+	if (len < 1)
+	{
+		return 0;
+	}
+
+	data = chunk_create((u_char*)buf, len);
+	msg = vici_message_create_from_data(data, FALSE);
+
+	msg->get_str(msg, NULL, "version");
+	msg->get_int(msg, 0, "timeout");
+	msg->get_bool(msg, FALSE, "enabled");
+	msg->get_value(msg, chunk_empty, "data");
+
+	enumerator = msg->create_enumerator(msg);
+	count = 0;
+	while (count++ < 10000 &&
+		   enumerator->enumerate(enumerator, &type, &name, &value));
+	enumerator->destroy(enumerator);
+
+	msg->destroy(msg);
+	return 0;
+}