talksik/uWebSockets
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Simplify PerMessageDeflate fuzzing regions

Browse Source
This commit is contained in:
Alex Hultman
2020-08-14 16:34:14 +02:00
parent 301b7ffe45
commit 959ac9ef80
1 changed files with 43 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fuzzing/PerMessageDeflate.cpp
+11 -8
View File
@@ -4,6 +4,7 @@
#include <cstdio> #include <cstdio>
#include <string> #include <string>
#include <bitset>
/* We test the permessage deflate module */ /* We test the permessage deflate module */
#include "../src/PerMessageDeflate.h" #include "../src/PerMessageDeflate.h"
@@ -13,9 +14,7 @@
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
/* First byte determines what compressor to use */ /* First byte determines what compressor to use */
if (size < 1) { if (size >= 1) {
return 0;
}
int compressors[] = { int compressors[] = {
uWS::DEDICATED_COMPRESSOR_3KB, uWS::DEDICATED_COMPRESSOR_3KB,
@@ -32,6 +31,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
data++; data++;
size--; size--;
/* Bits 0 - 256 are okay */
std::bitset<257> b;
/* If we could specify LARGE_BUFFER_SIZE small here we could force it to inflate in chunks, /* If we could specify LARGE_BUFFER_SIZE small here we could force it to inflate in chunks,
* triggering more line coverage. Currently it is set to 16kb which is always too much */ * triggering more line coverage. Currently it is set to 16kb which is always too much */
struct StaticData { struct StaticData {
@@ -42,12 +44,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
} staticData = {compressor}; } staticData = {compressor};
/* Why is this padded? */ /* Why is this padded? */
makeChunked(makePadded(data, size), size, [&staticData](const uint8_t *data, size_t size) { makeChunked(makePadded(data, size), size, [&staticData, &b](const uint8_t *data, size_t size) {
auto [inflation, valid] = staticData.inflationStream.inflate(&staticData.zlibContext, std::string_view((char *) data, size), 256); auto [inflation, valid] = staticData.inflationStream.inflate(&staticData.zlibContext, std::string_view((char *) data, size), 256);
if (inflation.length() > 256) {
/* Cause ASAN to freak out */ /* Trigger ASAN flaws if length is more than 256 */
delete (int *) (void *) 1; b.set(inflation.length());
}
}); });
makeChunked(makePadded(data, size), size, [&staticData](const uint8_t *data, size_t size) { makeChunked(makePadded(data, size), size, [&staticData](const uint8_t *data, size_t size) {
@@ -55,6 +56,8 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
staticData.deflationStream.deflate(&staticData.zlibContext, std::string_view((char *) data, size), true); staticData.deflationStream.deflate(&staticData.zlibContext, std::string_view((char *) data, size), true);
}); });
}
return 0; return 0;
} }