Skip to content

Commit 95e993d

Browse files
committed
fuzz: Provide correct length to assist fuzzer for v2 transport
before commit: 131072 pulse cov: 1714 ft: 2476 corp: 35/1337b lim: 1040 exec/s: 956 rss: 481Mb after commit: 131072 pulse cov: 1734 ft: 1993 corp: 19/107b lim: 1260 exec/s: 757 rss: 465Mb
1 parent 93f0e0e commit 95e993d

File tree

1 file changed

+16
-2
lines changed

1 file changed

+16
-2
lines changed

src/test/fuzz/p2p_v2_transport_serialization.cpp

+16-2
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,12 @@
22
// Distributed under the MIT software license, see the accompanying
33
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
44

5+
#include <compat/endian.h>
56
#include <crypto/chacha_poly_aead.h>
67
#include <key.h>
78
#include <net.h>
89
#include <netmessagemaker.h>
10+
#include <test/fuzz/FuzzedDataProvider.h>
911
#include <test/fuzz/fuzz.h>
1012

1113
#include <cassert>
@@ -18,9 +20,21 @@ FUZZ_TARGET(p2p_v2_transport_serialization)
1820
// Construct deserializer, with a dummy NodeId
1921
V2TransportDeserializer deserializer{(NodeId)0, k1, k2};
2022
V2TransportSerializer serializer{k1, k2};
23+
FuzzedDataProvider fuzzed_data_provider{buffer.data(), buffer.size()};
2124

22-
while (buffer.size() > 0) {
23-
const int handled = deserializer.Read(buffer);
25+
bool length_assist = fuzzed_data_provider.ConsumeBool();
26+
auto payload_bytes = fuzzed_data_provider.ConsumeRemainingBytes<uint8_t>();
27+
28+
if (length_assist && payload_bytes.size() >= CHACHA20_POLY1305_AEAD_AAD_LEN + CHACHA20_POLY1305_AEAD_TAG_LEN) {
29+
uint32_t packet_length = payload_bytes.size() - CHACHA20_POLY1305_AEAD_AAD_LEN - CHACHA20_POLY1305_AEAD_TAG_LEN;
30+
payload_bytes[0] = packet_length & 0xff;
31+
payload_bytes[1] = (packet_length >> 8) & 0xff;
32+
payload_bytes[2] = (packet_length >> 16) & 0xff;
33+
}
34+
35+
Span<const uint8_t> msg_bytes{payload_bytes};
36+
while (msg_bytes.size() > 0) {
37+
const int handled = deserializer.Read(msg_bytes);
2438
if (handled < 0) {
2539
break;
2640
}

0 commit comments

Comments
 (0)