fuzz: some improvements and add two new fuzzers (#1881)

Remove `FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION` define from
`fuzz/Makefile.am`; it is already included by the main configure script
(when fuzzing).

Add a knob to force disabling of AESNI optimizations: this way we can
fuzz also no-aesni crypto code.

Move CRC32 algorithm into the library.

Add some fake traces to extend fuzzing coverage. Note that these traces
are hand-made (via scapy/curl) and must not be used as "proof" that the
dissectors are really able to identify this kind of traffic.

Some small updates to some dissectors:

CSGO: remove a wrong rule (never triggered, BTW). Any UDP packet starting
with "VS01" will be classified as STEAM (see steam.c around line 111).
Googling it, it seems right so.

XBOX: XBOX only analyses UDP flows while HTTP only TCP ones; therefore
that condition is false.

RTP, STUN: removed useless "break"s

Zattoo: `flow->zattoo_stage` is never set to any values greater or equal
to 5, so these checks are never true.

PPStream: `flow->l4.udp.ppstream_stage` is never read. Delete it.

TeamSpeak: we check for `flow->packet_counter == 3` just above, so the
following check `flow->packet_counter >= 3` is always false.

1 files changed, 24 insertions, 13 deletions

diff --git a/fuzz/fuzz_alg_bins.cpp b/fuzz/fuzz_alg_bins.cpp
index cce530940..7bda2778b 100644
--- a/fuzz/fuzz_alg_bins.cpp
+++ b/fuzz/fuzz_alg_bins.cpp
@@ -8,7 +8,7 @@
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
   FuzzedDataProvider fuzzed_data(data, size);
   u_int16_t j, i, num_iteration;
-  struct ndpi_bin b, *b_cloned, *bins;
+  struct ndpi_bin *b, *b_cloned, *bins, b2;
   u_int16_t num_bins, num_cluster_ids, num_element, num_allocated_bins, rc;
   enum ndpi_bin_family family;
   u_int16_t *cluster_ids;
@@ -21,42 +21,53 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
   /* To allow memory allocation failures */
   fuzz_set_alloc_callbacks_and_seed(size);
 
+  b = (struct ndpi_bin *)ndpi_malloc(sizeof(struct ndpi_bin));
+
   num_bins = fuzzed_data.ConsumeIntegral<u_int16_t>();
   family = fuzzed_data.ConsumeEnum<enum ndpi_bin_family>();
 
-  ndpi_init_bin(&b, family, num_bins);
+  ndpi_init_bin(b, family, num_bins);
+  ndpi_init_bin(&b2, family, num_bins * 2);
 
   num_iteration = fuzzed_data.ConsumeIntegral<u_int8_t>();
-  for (i = 0; i < num_iteration; i++)
-    ndpi_inc_bin(&b, fuzzed_data.ConsumeIntegral<u_int16_t>(),
+  for (i = 0; i < num_iteration; i++) {
+    ndpi_inc_bin(b, fuzzed_data.ConsumeIntegral<u_int16_t>(),
+                 fuzzed_data.ConsumeIntegral<u_int64_t>());
+    ndpi_inc_bin(&b2, fuzzed_data.ConsumeIntegral<u_int16_t>(),
                  fuzzed_data.ConsumeIntegral<u_int64_t>());
+  }
+
+  ndpi_bin_similarity(b, &b2, fuzzed_data.ConsumeBool(),
+                      fuzzed_data.ConsumeFloatingPointInRange<float>(0, 1));
 
-  b_cloned = ndpi_clone_bin(&b);
+  b_cloned = ndpi_clone_bin(b);
 
-  ndpi_bin_similarity(&b, b_cloned, fuzzed_data.ConsumeBool(),
+  ndpi_bin_similarity(b, b_cloned, fuzzed_data.ConsumeBool(),
                       fuzzed_data.ConsumeFloatingPointInRange<float>(0, 1));
 
   for (i = 0; i < num_iteration; i++)
-    ndpi_get_bin_value(&b, fuzzed_data.ConsumeIntegral<u_int16_t>());
+    ndpi_get_bin_value(b, fuzzed_data.ConsumeIntegral<u_int16_t>());
 
-  ndpi_reset_bin(&b);
+  ndpi_reset_bin(b);
 
   for (i = 0; i < num_iteration; i++)
-    ndpi_get_bin_value(&b, fuzzed_data.ConsumeIntegral<u_int16_t>());
+    ndpi_get_bin_value(b, fuzzed_data.ConsumeIntegral<u_int16_t>());
 
   for (i = 0; i < num_iteration; i++)
     ndpi_set_bin(b_cloned, fuzzed_data.ConsumeIntegral<u_int16_t>(),
                  fuzzed_data.ConsumeIntegral<u_int64_t>());
 
-  ndpi_bin_similarity(&b, b_cloned, fuzzed_data.ConsumeBool(),
+  ndpi_bin_similarity(b, b_cloned, fuzzed_data.ConsumeBool(),
                       fuzzed_data.ConsumeFloatingPointInRange<float>(0, 1));
 
-  ndpi_normalize_bin(&b);
+  ndpi_normalize_bin(b);
   ndpi_normalize_bin(b_cloned);
 
-  ndpi_print_bin(&b, fuzzed_data.ConsumeBool(), buf, sizeof(buf));
+  ndpi_print_bin(b, fuzzed_data.ConsumeBool(), buf, sizeof(buf));
 
-  ndpi_free_bin(&b);
+  ndpi_free_bin(b);
+  ndpi_free(b);
+  ndpi_free_bin(&b2);
   ndpi_free_bin(b_cloned);
   ndpi_free(b_cloned);