"Increase" fuzzing coverage
This commit is contained in:
+6
-17
@@ -17,21 +17,12 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
|||||||
|
|
||||||
if (negCompression) {
|
if (negCompression) {
|
||||||
/* If we want dedicated compression, we must not end up here! */
|
/* If we want dedicated compression, we must not end up here! */
|
||||||
if (negCompressionWindow == 0) {
|
free((void *) (negCompressionWindow == 0));
|
||||||
free((void *) -1);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (negCompressionWindow > 13) {
|
/* Some more checks (freeing 0 does nothing) */
|
||||||
free((void *) -1);
|
free((void *) (negCompressionWindow > 13));
|
||||||
}
|
free((void *) (negInflationWindow != 0));
|
||||||
|
free((void *) (negInflationWindow < 0 || negInflationWindow > 15 || negCompressionWindow < 0 || negCompressionWindow > 15));
|
||||||
if (negInflationWindow != 0) {
|
|
||||||
free((void *) -1);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (negInflationWindow < 0 || negInflationWindow > 15 || negCompressionWindow < 0 || negCompressionWindow > 15) {
|
|
||||||
free((void *) -1);
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -41,9 +32,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
|||||||
|
|
||||||
if (negCompression) {
|
if (negCompression) {
|
||||||
/* If we want shared compression, we must not end up here! */
|
/* If we want shared compression, we must not end up here! */
|
||||||
if (negCompressionWindow != 0) {
|
free((void *) (negCompressionWindow != 0));
|
||||||
free((void *) -1);
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
+2
-1
@@ -108,6 +108,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
|||||||
readBytes(httpRequest->getMethod());
|
readBytes(httpRequest->getMethod());
|
||||||
readBytes(httpRequest->getQuery());
|
readBytes(httpRequest->getQuery());
|
||||||
readBytes(httpRequest->getQuery("hello"));
|
readBytes(httpRequest->getQuery("hello"));
|
||||||
|
readBytes(httpRequest->getQuery(""));
|
||||||
//readBytes(httpRequest->getParameter(0));
|
//readBytes(httpRequest->getParameter(0));
|
||||||
|
|
||||||
#ifdef UWS_WITH_PROXY
|
#ifdef UWS_WITH_PROXY
|
||||||
@@ -143,7 +144,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
|||||||
if (!returnedUser) {
|
if (!returnedUser) {
|
||||||
/* It is of uttermost importance that if and when we return nullptr from the httpParser we must not
|
/* It is of uttermost importance that if and when we return nullptr from the httpParser we must not
|
||||||
* ever use the httpParser ever again. It is in a broken state as returning nullptr is only used
|
* ever use the httpParser ever again. It is in a broken state as returning nullptr is only used
|
||||||
* for signalling early closure. You must absolutely must throw it away. Here we just mark user as
|
* for signalling early closure. You must absolutely must throw it away. Here we just mark user as
|
||||||
* null so that we can ignore further chunks of data */
|
* null so that we can ignore further chunks of data */
|
||||||
user = nullptr;
|
user = nullptr;
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user