mirror of
https://github.com/vel21ripn/nDPI.git
synced 2026-04-28 15:09:47 +00:00
9fc724de5a
Start using a dictionary for fuzzing (see: https://llvm.org/docs/LibFuzzer.html#dictionaries). Remove some dead code. Fuzzing with debug enabled is not usually a great idea (from performance POV). Keep the code since it might be useful while debugging.
58 lines
1.8 KiB
C++
58 lines
1.8 KiB
C++
#include "ndpi_api.h"
|
|
#include "fuzz_common_code.h"
|
|
|
|
#include <stdint.h>
|
|
#include <stdio.h>
|
|
#include <assert.h>
|
|
#include "fuzzer/FuzzedDataProvider.h"
|
|
|
|
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
|
FuzzedDataProvider fuzzed_data(data, size);
|
|
u_int8_t is_ipv6, l4_proto, icmp_type, icmp_code;
|
|
u_int16_t src_port, dst_port;
|
|
u_char *hash_buf;
|
|
u_int8_t hash_buf_len;
|
|
|
|
/* Just to have some data */
|
|
|
|
/* To allow memory allocation failures */
|
|
fuzz_set_alloc_callbacks_and_seed(size);
|
|
|
|
is_ipv6 = fuzzed_data.ConsumeBool();
|
|
l4_proto = fuzzed_data.ConsumeIntegral<u_int8_t>();
|
|
src_port = fuzzed_data.ConsumeIntegral<u_int16_t>();
|
|
dst_port = fuzzed_data.ConsumeIntegral<u_int16_t>();
|
|
icmp_type = fuzzed_data.ConsumeIntegral<u_int8_t>();
|
|
icmp_code = fuzzed_data.ConsumeIntegral<u_int8_t>();
|
|
hash_buf_len = fuzzed_data.ConsumeIntegralInRange(0, 64);
|
|
hash_buf = (u_char *)ndpi_malloc(hash_buf_len);
|
|
if (!hash_buf)
|
|
return 0;
|
|
|
|
if (!is_ipv6) {
|
|
u_int32_t src_ip, dst_ip;
|
|
|
|
src_ip = fuzzed_data.ConsumeIntegral<u_int32_t>();
|
|
dst_ip = fuzzed_data.ConsumeIntegral<u_int32_t>();
|
|
|
|
ndpi_flowv4_flow_hash(l4_proto, src_ip, dst_ip, src_port, dst_port,
|
|
icmp_type, icmp_code, hash_buf, hash_buf_len);
|
|
} else {
|
|
u_char *src_ip, *dst_ip;
|
|
|
|
if(fuzzed_data.remaining_bytes() >= 32) {
|
|
std::vector<u_int8_t>data1 = fuzzed_data.ConsumeBytes<u_int8_t>(16);
|
|
src_ip = data1.data();
|
|
std::vector<u_int8_t>data2 = fuzzed_data.ConsumeBytes<u_int8_t>(16);
|
|
dst_ip = data2.data();
|
|
|
|
ndpi_flowv6_flow_hash(l4_proto, (struct ndpi_in6_addr *)src_ip,
|
|
(struct ndpi_in6_addr *)dst_ip, src_port, dst_port,
|
|
icmp_type, icmp_code, hash_buf, hash_buf_len);
|
|
}
|
|
}
|
|
|
|
ndpi_free(hash_buf);
|
|
|
|
return 0;
|
|
}
|