From 0e0d796cfd28d4db3be586c64ef16a09eb1cbdcd Mon Sep 17 00:00:00 2001
From: Alex Hultman <alexhultman@gmail.com>
Date: Wed, 13 Mar 2019 16:59:04 +0100
Subject: [PATCH] Also fuzz the extensions negotiator

---
 fuzzing/Extensions.cpp    | 39 +++++++++++++++++++++++++++++++++++++++
 fuzzing/Makefile          |  1 +
 src/WebSocketExtensions.h |  4 ++--
 3 files changed, 42 insertions(+), 2 deletions(-)
 create mode 100644 fuzzing/Extensions.cpp

diff --git a/fuzzing/Extensions.cpp b/fuzzing/Extensions.cpp
new file mode 100644
index 0000000..c8a0859
--- /dev/null
+++ b/fuzzing/Extensions.cpp
@@ -0,0 +1,39 @@
+/* This is a fuzz test of the websocket extensions parser */
+
+#define WIN32_EXPORT
+
+#include <cstdio>
+#include <string>
+
+/* We test the websocket extensions parser */
+#include "../src/WebSocketExtensions.h"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+
+    {
+        uWS::ExtensionsNegotiator<true> extensionsNegotiator(uWS::Options::PERMESSAGE_DEFLATE);
+        extensionsNegotiator.readOffer({(char *) data, size});
+
+        extensionsNegotiator.generateOffer();
+        extensionsNegotiator.getNegotiatedOptions();
+    }
+
+    {
+        uWS::ExtensionsNegotiator<true> extensionsNegotiator(uWS::Options::NO_OPTIONS);
+        extensionsNegotiator.readOffer({(char *) data, size});
+
+        extensionsNegotiator.generateOffer();
+        extensionsNegotiator.getNegotiatedOptions();
+    }
+
+    {
+        uWS::ExtensionsNegotiator<true> extensionsNegotiator(uWS::Options::CLIENT_NO_CONTEXT_TAKEOVER);
+        extensionsNegotiator.readOffer({(char *) data, size});
+
+        extensionsNegotiator.generateOffer();
+        extensionsNegotiator.getNegotiatedOptions();
+    }
+
+    return 0;
+}
+
diff --git a/fuzzing/Makefile b/fuzzing/Makefile
index f0c1be3..817cbed 100644
--- a/fuzzing/Makefile
+++ b/fuzzing/Makefile
@@ -1,3 +1,4 @@
 default:
 	clang++ -std=c++17 -fsanitize=address,fuzzer -O3 WebSocket.cpp -o WebSocket
 	clang++ -std=c++17 -fsanitize=address,fuzzer -O3 Http.cpp -o Http
+	clang++ -std=c++17 -fsanitize=address,fuzzer -O3 Extensions.cpp -o Extensions
diff --git a/src/WebSocketExtensions.h b/src/WebSocketExtensions.h
index 7be66dc..ae027dc 100644
--- a/src/WebSocketExtensions.h
+++ b/src/WebSocketExtensions.h
@@ -51,12 +51,12 @@ public:
     int clientMaxWindowBits = 0;
 
     int getToken(const char *&in, const char *stop) {
-        while (!isalnum(*in) && in != stop) {
+        while (in != stop && !isalnum(*in)) {
             in++;
         }
 
         int hashedToken = 0;
-        while (isalnum(*in) || *in == '-' || *in == '_') {
+        while (in != stop && (isalnum(*in) || *in == '-' || *in == '_')) {
             if (isdigit(*in)) {
                 hashedToken = hashedToken * 10 - (*in - '0');
             } else {