From 5dba45afedb233fcaaa418b4e2b3fcfd16afda0d Mon Sep 17 00:00:00 2001 From: Alex Hultman Date: Wed, 3 Mar 2021 12:10:49 +0100 Subject: [PATCH] "Increase" fuzzing coverage --- fuzzing/Extensions.cpp | 23 ++++++----------------- fuzzing/Http.cpp | 3 ++- 2 files changed, 8 insertions(+), 18 deletions(-) diff --git a/fuzzing/Extensions.cpp b/fuzzing/Extensions.cpp index db30431..1a5a2f7 100644 --- a/fuzzing/Extensions.cpp +++ b/fuzzing/Extensions.cpp @@ -17,21 +17,12 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { if (negCompression) { /* If we want dedicated compression, we must not end up here! */ - if (negCompressionWindow == 0) { - free((void *) -1); - } + free((void *) (negCompressionWindow == 0)); - if (negCompressionWindow > 13) { - free((void *) -1); - } - - if (negInflationWindow != 0) { - free((void *) -1); - } - - if (negInflationWindow < 0 || negInflationWindow > 15 || negCompressionWindow < 0 || negCompressionWindow > 15) { - free((void *) -1); - } + /* Some more checks (freeing 0 does nothing) */ + free((void *) (negCompressionWindow > 13)); + free((void *) (negInflationWindow != 0)); + free((void *) (negInflationWindow < 0 || negInflationWindow > 15 || negCompressionWindow < 0 || negCompressionWindow > 15)); } } @@ -41,9 +32,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { if (negCompression) { /* If we want shared compression, we must not end up here! */ - if (negCompressionWindow != 0) { - free((void *) -1); - } + free((void *) (negCompressionWindow != 0)); } } diff --git a/fuzzing/Http.cpp b/fuzzing/Http.cpp index dd7817a..68c5c5d 100644 --- a/fuzzing/Http.cpp +++ b/fuzzing/Http.cpp @@ -108,6 +108,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { readBytes(httpRequest->getMethod()); readBytes(httpRequest->getQuery()); readBytes(httpRequest->getQuery("hello")); + readBytes(httpRequest->getQuery("")); //readBytes(httpRequest->getParameter(0)); #ifdef UWS_WITH_PROXY @@ -143,7 +144,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { if (!returnedUser) { /* It is of uttermost importance that if and when we return nullptr from the httpParser we must not * ever use the httpParser ever again. It is in a broken state as returning nullptr is only used - * for signalling early closure. You must absolutely must throw it away. Here we just mark user as + * for signalling early closure. You must absolutely must throw it away. Here we just mark user as * null so that we can ignore further chunks of data */ user = nullptr; }