Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
A
asn1c
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Analytics
Analytics
CI / CD
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Libraries
asn1c
Commits
07a50d8e
Commit
07a50d8e
authored
Sep 15, 2017
by
Lev Walkin
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
introduce fuzzer and removed fuzzer-guided warning
parent
387a8f01
Changes
3
Hide whitespace changes
Inline
Side-by-side
Showing
3 changed files
with
21 additions
and
17 deletions
+21
-17
skeletons/ber_tlv_length.c
skeletons/ber_tlv_length.c
+7
-17
tests/tests-c-compiler/Makefile.am
tests/tests-c-compiler/Makefile.am
+1
-0
tests/tests-c-compiler/check-src/check-42.c
tests/tests-c-compiler/check-src/check-42.c
+13
-0
No files found.
skeletons/ber_tlv_length.c
View file @
07a50d8e
...
...
@@ -40,28 +40,18 @@ ber_fetch_length(int _is_constructed, const void *bufptr, size_t size,
for
(
len
=
0
,
buf
++
,
skipped
=
1
;
oct
&&
(
++
skipped
<=
size
);
buf
++
,
oct
--
)
{
len
=
(
len
<<
8
)
|
*
buf
;
if
(
len
<
0
||
(
len
>>
((
8
*
sizeof
(
len
))
-
8
)
&&
oct
>
1
))
{
/*
* Too large length value.
*/
/* Verify that we won't overflow. */
if
(
!
(
len
>>
((
8
*
sizeof
(
len
))
-
(
8
+
1
))))
{
len
=
(
len
<<
8
)
|
*
buf
;
}
else
{
/* Too large length value. */
return
-
1
;
}
}
if
(
oct
==
0
)
{
ber_tlv_len_t
lenplusepsilon
=
(
size_t
)
len
+
1024
;
/*
* Here length may be very close or equal to 2G.
* However, the arithmetics used in some decoders
* may add some (small) quantities to the length,
* to check the resulting value against some limits.
* This may result in integer wrap-around, which
* we try to avoid by checking it earlier here.
*/
if
(
lenplusepsilon
<
0
)
{
/* Too large length value */
if
(
len
<
0
||
len
>
RSIZE_MAX
)
{
/* Length value out of sane range. */
return
-
1
;
}
...
...
tests/tests-c-compiler/Makefile.am
View file @
07a50d8e
...
...
@@ -14,6 +14,7 @@ TESTS_ENVIRONMENT= \
CFLAGS
=
"
${TESTSUITE_CFLAGS}
${CFLAGS}
"
\
CXXFLAGS
=
"
${CXXFLAGS}
"
\
LDFLAGS
=
"
${LDFLAGS}
"
\
LIBFUZZER_CFLAGS
=
"
${LIBFUZZER_CFLAGS}
"
\
srcdir
=
${srcdir}
\
abs_top_srcdir
=
${abs_top_srcdir}
\
abs_top_builddir
=
${abs_top_builddir}
\
...
...
tests/tests-c-compiler/check-src/check-42.c
View file @
07a50d8e
...
...
@@ -126,6 +126,17 @@ check_serialize() {
assert
(
memcmp
(
buf0
,
buf
,
sizeof
(
buf0
))
==
0
);
}
#ifdef ENABLE_LIBFUZZER
int
LLVMFuzzerTestOneInput
(
const
uint8_t
*
Data
,
size_t
Size
)
{
LogLine_t
*
lp
=
0
;
(
void
)
ber_decode
(
0
,
&
asn_DEF_LogLine
,
(
void
**
)
&
lp
,
Data
,
Size
);
ASN_STRUCT_FREE
(
asn_DEF_LogLine
,
lp
);
return
0
;
}
#else
int
main
(
int
ac
,
char
**
av
)
{
LogLine_t
t
;
...
...
@@ -140,3 +151,5 @@ main(int ac, char **av) {
return
0
;
}
#endif
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment