talksik/uWebSockets
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

"Increase" fuzzing coverage

Browse Source
This commit is contained in:
Alex Hultman
2021-03-03 12:10:49 +01:00
parent 0e932517fd
commit 5dba45afed
2 changed files with 8 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fuzzing/Extensions.cpp
+6 -17
View File
@@ -17,21 +17,12 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
if (negCompression) {
/* If we want dedicated compression, we must not end up here! */
if (negCompressionWindow == 0) {
free((void *) -1);
}
free((void *) (negCompressionWindow == 0));
if (negCompressionWindow > 13) {
free((void *) -1);
}
if (negInflationWindow != 0) {
free((void *) -1);
}
if (negInflationWindow < 0 || negInflationWindow > 15 || negCompressionWindow < 0 || negCompressionWindow > 15) {
free((void *) -1);
}
/* Some more checks (freeing 0 does nothing) */
free((void *) (negCompressionWindow > 13));
free((void *) (negInflationWindow != 0));
free((void *) (negInflationWindow < 0 || negInflationWindow > 15 || negCompressionWindow < 0 || negCompressionWindow > 15));
}
}
@@ -41,9 +32,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
if (negCompression) {
/* If we want shared compression, we must not end up here! */
if (negCompressionWindow != 0) {
free((void *) -1);
}
free((void *) (negCompressionWindow != 0));
}
}
fuzzing/Http.cpp
+2 -1
View File
@@ -108,6 +108,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
readBytes(httpRequest->getMethod());
readBytes(httpRequest->getQuery());
readBytes(httpRequest->getQuery("hello"));
readBytes(httpRequest->getQuery(""));
//readBytes(httpRequest->getParameter(0));
#ifdef UWS_WITH_PROXY
@@ -143,7 +144,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
if (!returnedUser) {
/* It is of uttermost importance that if and when we return nullptr from the httpParser we must not
* ever use the httpParser ever again. It is in a broken state as returning nullptr is only used
* for signalling early closure. You must absolutely must throw it away. Here we just mark user as
* for signalling early closure. You must absolutely must throw it away. Here we just mark user as
* null so that we can ignore further chunks of data */
user = nullptr;
}