2
2
// Distributed under the MIT software license, see the accompanying
3
3
// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4
4
5
+ #include < compat/endian.h>
5
6
#include < crypto/chacha_poly_aead.h>
6
7
#include < key.h>
7
8
#include < net.h>
8
9
#include < netmessagemaker.h>
10
+ #include < test/fuzz/FuzzedDataProvider.h>
9
11
#include < test/fuzz/fuzz.h>
10
12
11
13
#include < cassert>
@@ -18,9 +20,21 @@ FUZZ_TARGET(p2p_v2_transport_serialization)
18
20
// Construct deserializer, with a dummy NodeId
19
21
V2TransportDeserializer deserializer{(NodeId)0 , k1, k2};
20
22
V2TransportSerializer serializer{k1, k2};
23
+ FuzzedDataProvider fuzzed_data_provider{buffer.data (), buffer.size ()};
21
24
22
- while (buffer.size () > 0 ) {
23
- const int handled = deserializer.Read (buffer);
25
+ bool length_assist = fuzzed_data_provider.ConsumeBool ();
26
+ auto payload_bytes = fuzzed_data_provider.ConsumeRemainingBytes <uint8_t >();
27
+
28
+ if (length_assist && payload_bytes.size () >= CHACHA20_POLY1305_AEAD_AAD_LEN + CHACHA20_POLY1305_AEAD_TAG_LEN) {
29
+ uint32_t packet_length = payload_bytes.size () - CHACHA20_POLY1305_AEAD_AAD_LEN - CHACHA20_POLY1305_AEAD_TAG_LEN;
30
+ payload_bytes[0 ] = packet_length & 0xff ;
31
+ payload_bytes[1 ] = (packet_length >> 8 ) & 0xff ;
32
+ payload_bytes[2 ] = (packet_length >> 16 ) & 0xff ;
33
+ }
34
+
35
+ Span<const uint8_t > msg_bytes{payload_bytes};
36
+ while (msg_bytes.size () > 0 ) {
37
+ const int handled = deserializer.Read (msg_bytes);
24
38
if (handled < 0 ) {
25
39
break ;
26
40
}
0 commit comments