diff --git a/fuzzing/Makefile b/fuzzing/Makefile index 21b0b79..e39916b 100644 --- a/fuzzing/Makefile +++ b/fuzzing/Makefile @@ -3,4 +3,5 @@ default: clang++ -std=c++17 -fsanitize=address,fuzzer -O3 WebSocket.cpp -o WebSocket clang++ -std=c++17 -fsanitize=address,fuzzer -O3 Http.cpp -o Http clang++ -std=c++17 -fsanitize=address,fuzzer -O3 Extensions.cpp -o Extensions - clang++ -std=c++17 -fsanitize=address,fuzzer -O3 Handshake.cpp -o Handshake \ No newline at end of file + clang++ -std=c++17 -fsanitize=address,fuzzer -O3 Handshake.cpp -o Handshake + clang++ -std=c++17 -fsanitize=address,fuzzer -O3 PerMessageDeflate.cpp -o PerMessageDeflate -lz \ No newline at end of file diff --git a/fuzzing/PerMessageDeflate.cpp b/fuzzing/PerMessageDeflate.cpp new file mode 100644 index 0000000..1867994 --- /dev/null +++ b/fuzzing/PerMessageDeflate.cpp @@ -0,0 +1,38 @@ +/* This is a fuzz test of the permessage-deflate module */ + +#define WIN32_EXPORT + +#include +#include + +/* We test the permessage deflate module */ +#include "../src/PerMessageDeflate.h" + +#include "helpers.h" + +struct StaticData { + uWS::ZlibContext zlibContext; + + uWS::InflationStream inflationStream; + uWS::DeflationStream deflationStream; +} staticData; + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { + + /* Why is this padded? */ + makeChunked(makePadded(data, size), size, [](const uint8_t *data, size_t size) { + std::string_view inflation = staticData.inflationStream.inflate(&staticData.zlibContext, std::string_view((char *) data, size), 256); + if (inflation.length() > 256) { + /* Cause ASAN to freak out */ + //delete (int *) (void *) 1; + } + }); + + makeChunked(makePadded(data, size), size, [](const uint8_t *data, size_t size) { + /* Always reset */ + staticData.deflationStream.deflate(&staticData.zlibContext, std::string_view((char *) data, size), true); + }); + + return 0; +} + diff --git a/fuzzing/README.md b/fuzzing/README.md index 4660ade..fd96240 100644 --- a/fuzzing/README.md +++ b/fuzzing/README.md @@ -9,6 +9,7 @@ Currently the following parts are individually tested: * WebSocket handshake generator * WebSocket message parser * WebSocket extensions parser & negotiator +* WebSocket permessage-deflate compression/inflation helper * Http parser * Http method/url router