diff options
| author | Toni <matzeton@googlemail.com> | 2021-10-18 23:16:32 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-10-18 23:16:32 +0200 |
| commit | ed51987e3a4838dd9aef27dfab2c0651f2f52836 (patch) | |
| tree | fde07d774b7ef89b3d4b400f0c2af3f07f4f70ce /example | |
| parent | 7d3c3b23f8b9749690b8c5f345b7bc489b3666ac (diff) | |
Fix broken fuzz_process_packet fuzzer by adding a call to ndpi_finalize_initialization(). (#1334)
* fixed several memory errors (heap-overflow, unitialized memory, etc)
* ability to build fuzz_process_packet with a main()
allowing to replay crash data generated with fuzz_process_packet
by LLVMs libfuzzer
* temporarily disable fuzzing if `tests/do.sh`
executed with env FUZZY_TESTING_ENABLED=1
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
Diffstat (limited to 'example')
| -rw-r--r-- | example/reader_util.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/example/reader_util.c b/example/reader_util.c index 453660ce7..35632920e 100644 --- a/example/reader_util.c +++ b/example/reader_util.c @@ -980,7 +980,7 @@ static struct ndpi_flow_info *get_ndpi_flow_info6(struct ndpi_workflow * workflo u_int8_t l4proto = iph6->ip6_hdr.ip6_un1_nxt; u_int16_t ip_len = ntohs(iph6->ip6_hdr.ip6_un1_plen); const u_int8_t *l4ptr = (((const u_int8_t *) iph6) + sizeof(struct ndpi_ipv6hdr)); - if(ndpi_handle_ipv6_extension_headers(NULL, &l4ptr, &ip_len, &l4proto) != 0) { + if(ndpi_handle_ipv6_extension_headers(ipsize - sizeof(struct ndpi_ipv6hdr), &l4ptr, &ip_len, &l4proto) != 0) { return(NULL); } iph.protocol = l4proto; @@ -1908,8 +1908,9 @@ struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow, return(nproto); /* Too short for IPv6 payload*/ const u_int8_t *l4ptr = (((const u_int8_t *) iph6) + sizeof(struct ndpi_ipv6hdr)); + u_int16_t ipsize = header->caplen - ip_offset; - if(ndpi_handle_ipv6_extension_headers(NULL, &l4ptr, &ip_len, &proto) != 0) { + if(ndpi_handle_ipv6_extension_headers(ipsize - sizeof(struct ndpi_ipv6hdr), &l4ptr, &ip_len, &proto) != 0) { return(nproto); } |