소스 검색

misc/fuzz: add checks on input size

- test with larger messages than core accepts
Daniel-Constantin Mierla 2 년 전
부모
커밋
1cd2fc1977
2개의 변경된 파일12개의 추가작업 그리고 0개의 파일을 삭제
  1. 6 0
      misc/fuzz/fuzz_parse_msg.c
  2. 6 0
      misc/fuzz/fuzz_uri.c

+ 6 - 0
misc/fuzz/fuzz_parse_msg.c

@@ -1,3 +1,4 @@
+#include "../config.h"
 #include "../parser/sdp/sdp.h"
 #include "../parser/sdp/sdp.h"
 #include "../parser/parse_uri.c"
 #include "../parser/parse_uri.c"
 #include "../parser/parse_hname2.h"
 #include "../parser/parse_hname2.h"
@@ -23,6 +24,11 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     orig_inv.buf = (char*)data;
     orig_inv.buf = (char*)data;
     orig_inv.len = size;
     orig_inv.len = size;
 
 
+    if(size >= 4*BUF_SIZE) {
+        /* test with larger message than core accepts, but not indefinitely large */
+        return 0;
+    }
+
     if (parse_msg(orig_inv.buf, orig_inv.len, &orig_inv) < 0) {
     if (parse_msg(orig_inv.buf, orig_inv.len, &orig_inv) < 0) {
         goto cleanup;
         goto cleanup;
     }
     }

+ 6 - 0
misc/fuzz/fuzz_uri.c

@@ -1,8 +1,14 @@
+
+#include "../config.h"
 #include "../parser/parse_uri.c"
 #include "../parser/parse_uri.c"
 
 
 int
 int
 LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     struct sip_uri uri;
     struct sip_uri uri;
+    if(size >= BUF_SIZE) {
+        /* test with larger message than core accepts, but not indefinitely large */
+        return 0;
+    }
     parse_uri(data, size, &uri);
     parse_uri(data, size, &uri);
     return 0;
     return 0;
 }
 }