From ed51987e3a4838dd9aef27dfab2c0651f2f52836 Mon Sep 17 00:00:00 2001 From: Toni Date: Mon, 18 Oct 2021 23:16:32 +0200 Subject: Fix broken fuzz_process_packet fuzzer by adding a call to ndpi_finalize_initialization(). (#1334) * fixed several memory errors (heap-overflow, unitialized memory, etc) * ability to build fuzz_process_packet with a main() allowing to replay crash data generated with fuzz_process_packet by LLVMs libfuzzer * temporarily disable fuzzing if `tests/do.sh` executed with env FUZZY_TESTING_ENABLED=1 Signed-off-by: Toni Uhlig --- fuzz/fuzz_process_packet.c | 62 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 62 insertions(+) (limited to 'fuzz/fuzz_process_packet.c') diff --git a/fuzz/fuzz_process_packet.c b/fuzz/fuzz_process_packet.c index 5af15afba..9efd80799 100644 --- a/fuzz/fuzz_process_packet.c +++ b/fuzz/fuzz_process_packet.c @@ -15,6 +15,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ndpi_set_protocol_detection_bitmask2(ndpi_info_mod, &all); src = ndpi_malloc(SIZEOF_ID_STRUCT); dst = ndpi_malloc(SIZEOF_ID_STRUCT); + ndpi_finalize_initialization(ndpi_info_mod); } struct ndpi_flow_struct *ndpi_flow = ndpi_flow_malloc(SIZEOF_FLOW_STRUCT); @@ -26,3 +27,64 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { return 0; } + +#ifdef BUILD_MAIN +int main(int argc, char ** argv) +{ + FILE * data_file; + long data_file_size; + uint8_t * data_buffer; + int test_retval; + + if (argc != 2) { + fprintf(stderr, "usage: %s: [data-file]\n", + (argc > 0 ? argv[0] : "fuzz_process_packet_with_main")); + return 1; + } + + data_file = fopen(argv[1], "r"); + if (data_file == NULL) { + perror("fopen failed"); + return 1; + } + + if (fseek(data_file, 0, SEEK_END) != 0) { + perror("fseek(SEEK_END) failed"); + fclose(data_file); + return 1; + } + + data_file_size = ftell(data_file); + if (data_file_size < 0) { + perror("ftell failed"); + fclose(data_file); + return 1; + } + + if (fseek(data_file, 0, SEEK_SET) != 0) { + perror("fseek(0, SEEK_SET) failed"); + fclose(data_file); + return 1; + } + + data_buffer = malloc(data_file_size); + if (data_buffer == NULL) { + perror("malloc failed"); + fclose(data_file); + return 1; + } + + if (fread(data_buffer, sizeof(*data_buffer), data_file_size, data_file) != (size_t)data_file_size) { + perror("fread failed"); + fclose(data_file); + free(data_buffer); + return 1; + } + + test_retval = LLVMFuzzerTestOneInput(data_buffer, data_file_size); + fclose(data_file); + free(data_buffer); + + return test_retval; +} +#endif -- cgit v1.2.3