From cd00bfc7790cdfb61f8f59e04a3ed84d98b20e34 Mon Sep 17 00:00:00 2001
From: Alex Hultman <alexhultman@gmail.com>
Date: Wed, 3 Apr 2019 02:59:24 +0200
Subject: [PATCH] Fuzz Http in chunks

---
 fuzzing/Http.cpp | 69 ++++++++++++++++++++++++------------------------
 src/HttpParser.h |  2 +-
 uSockets         |  2 +-
 3 files changed, 36 insertions(+), 37 deletions(-)

diff --git a/fuzzing/Http.cpp b/fuzzing/Http.cpp
index a474f5d..26f0e76 100644
--- a/fuzzing/Http.cpp
+++ b/fuzzing/Http.cpp
@@ -2,15 +2,14 @@
 
 #define WIN32_EXPORT
 
+#include "helpers.h"
+
 /* We test the websocket parser */
 #include "../src/HttpParser.h"
 
 /* And the router */
 #include "../src/HttpRouter.h"
 
-/* We use this to pad the fuzz */
-char *padded = new char[1024  * 500];
-
 struct StaticData {
 
     struct RouterData {
@@ -48,46 +47,46 @@ struct StaticData {
 } staticData;
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
-
-    /* Pad the fuzz */
+    /* Create parser */
     uWS::HttpParser httpParser;
-    memcpy(padded, data, size);
-
     /* User data */
     void *user = (void *) 13;
 
-    /* Parse it */
-    httpParser.consumePostPadded(padded, size, user, [](void *s, uWS::HttpRequest *httpRequest) -> void * {
+    /* Iterate the padded fuzz as chunks */
+    makeChunked(makePadded(data, size), size, [&httpParser, user](const uint8_t *data, size_t size) {
+        /* Parse it */
+        httpParser.consumePostPadded((char *) data, size, user, [](void *s, uWS::HttpRequest *httpRequest) -> void * {
 
-        /* todo: Route this via router */
+            /* todo: Route this via router */
 
-        httpRequest->getHeader(httpRequest->getUrl());
-        httpRequest->getMethod();
-        httpRequest->getQuery();
+            readBytes(httpRequest->getHeader(httpRequest->getUrl()));
+            readBytes(httpRequest->getMethod());
+            readBytes(httpRequest->getQuery());
 
-        /* Route the method and URL in two passes */
-        StaticData::RouterData routerData = {};
-        if (!staticData.router.route(httpRequest->getMethod(), httpRequest->getUrl(), routerData)) {
-            /* It was not handled */
+            /* Route the method and URL in two passes */
+            StaticData::RouterData routerData = {};
+            if (!staticData.router.route(httpRequest->getMethod(), httpRequest->getUrl(), routerData)) {
+                /* It was not handled */
+                return nullptr;
+            }
+
+            for (auto p : *httpRequest) {
+
+            }
+
+            /* Return ok */
+            return s;
+
+        }, [](void *user, std::string_view data, bool fin) -> void * {
+
+            /* Return ok */
+            return user;
+
+        }, [](void *user) {
+
+            /* Return break */
             return nullptr;
-        }
-
-        for (auto p : *httpRequest) {
-
-        }
-
-        /* Return ok */
-        return s;
-
-    }, [](void *user, std::string_view data, bool fin) -> void * {
-
-        /* Return ok */
-        return user;
-
-    }, [](void *user) {
-
-        /* Return break */
-        return nullptr;
+        });
     });
 
     return 0;
diff --git a/src/HttpParser.h b/src/HttpParser.h
index ef8af02..9daa5b0 100644
--- a/src/HttpParser.h
+++ b/src/HttpParser.h
@@ -248,7 +248,7 @@ public:
 
             int maxCopyDistance = std::min(MAX_FALLBACK_SIZE - fallback.length(), (size_t) length);
 
-            fallback.reserve(maxCopyDistance + 32); // todo: padding should be same as libus
+            fallback.reserve(fallback.length() + maxCopyDistance + 32); // todo: padding should be same as libus
             fallback.append(data, maxCopyDistance);
 
             // break here on break
diff --git a/uSockets b/uSockets
index 7574cd2..5a4570e 160000
--- a/uSockets
+++ b/uSockets
@@ -1 +1 @@
-Subproject commit 7574cd2050ae3c410268374ead60ff8244c54669
+Subproject commit 5a4570eac1a699abe8b842972b1a807da8c40abe