talksik/uWebSockets
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add extensions negotiation fuzzing

Browse Source
This commit is contained in:
Alex Hultman
2021-01-23 19:08:14 +01:00
parent bd74b6c83b
commit e973bb41be
2 changed files with 37 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fuzzing/Extensions.cpp
+36 -13
View File
@@ -4,34 +4,57 @@
#include <cstdio>
#include <string>
#include <cstdlib>
/* We test the websocket extensions parser */
#include "../src/WebSocketExtensions.h"
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
/* This one must not return shared compressor, or above 13 */
{
uWS::ExtensionsNegotiator<true> extensionsNegotiator(uWS::Options::PERMESSAGE_DEFLATE);
extensionsNegotiator.readOffer({(char *) data, size});
auto [negCompression, negCompressionWindow, negInflationWindow, response] = uWS::negotiateCompression(true, 13, 0, std::string_view((char *) data, size));
extensionsNegotiator.generateOffer();
extensionsNegotiator.getNegotiatedOptions();
if (negCompression) {
/* If we want dedicated compression, we must not end up here! */
if (negCompressionWindow == 0) {
free((void *) -1);
}
if (negCompressionWindow > 13) {
free((void *) -1);
}
if (negInflationWindow != 0) {
free((void *) -1);
}
if (negInflationWindow < 0 || negInflationWindow > 15 || negCompressionWindow < 0 || negCompressionWindow > 15) {
free((void *) -1);
}
}
}
/* This one must not return anything over 0 (only shared) */
{
uWS::ExtensionsNegotiator<true> extensionsNegotiator(uWS::Options::NO_OPTIONS);
extensionsNegotiator.readOffer({(char *) data, size});
auto [negCompression, negCompressionWindow, negInflationWindow, response] = uWS::negotiateCompression(true, 0, 0, std::string_view((char *) data, size));
extensionsNegotiator.generateOffer();
extensionsNegotiator.getNegotiatedOptions();
if (negCompression) {
/* If we want shared compression, we must not end up here! */
if (negCompressionWindow != 0) {
free((void *) -1);
}
}
}
{
uWS::ExtensionsNegotiator<true> extensionsNegotiator(uWS::Options::CLIENT_NO_CONTEXT_TAKEOVER);
extensionsNegotiator.readOffer({(char *) data, size});
extensionsNegotiator.generateOffer();
extensionsNegotiator.getNegotiatedOptions();
/* Whatever, this one must not negotiate anything */
{
auto [negCompression, negCompressionWindow, negInflationWindow, response] = uWS::negotiateCompression(false, 13, 15, std::string_view((char *) data, size));
if (negCompression) {
free((void *) -1);
}
}
return 0;
fuzzing/Makefile
+1 -1
View File
@@ -22,6 +22,7 @@ oss-fuzz:
# Link against object files
$(CXX) $(CXXFLAGS) $(WRAPPED_SYSCALLS) -std=c++17 -O2 -DUWS_NO_ZLIB -I../src -I../uSockets/src EpollHelloWorld.cpp -o $(OUT)/EpollHelloWorld $(LIB_FUZZING_ENGINE) *.o
# "Unit tests"
$(CXX) $(CXXFLAGS) -std=c++17 -O3 Extensions.cpp -o $(OUT)/Extensions $(LIB_FUZZING_ENGINE)
$(CXX) $(CXXFLAGS) -std=c++17 -O3 QueryParser.cpp -o $(OUT)/QueryParser $(LIB_FUZZING_ENGINE)
$(CXX) $(CXXFLAGS) -std=c++17 -O3 WebSocket.cpp -o $(OUT)/WebSocket $(LIB_FUZZING_ENGINE)
$(CXX) $(CXXFLAGS) -std=c++17 -O3 Http.cpp -o $(OUT)/Http $(LIB_FUZZING_ENGINE)
@@ -37,5 +38,4 @@ oss-fuzz:
broken:
# Too small tests, failing coverage test
$(CXX) $(CXXFLAGS) -std=c++17 -O3 Extensions.cpp -o $(OUT)/Extensions $(LIB_FUZZING_ENGINE)
$(CXX) $(CXXFLAGS) -std=c++17 -O3 Handshake.cpp -o $(OUT)/Handshake $(LIB_FUZZING_ENGINE)