mirror of
https://github.com/warmcat/libwebsockets.git
synced 2025-03-09 00:00:04 +01:00
fuzxy add test parser and some tests
Signed-off-by: Andy Green <andy.green@linaro.org>
This commit is contained in:
Andy Green
parent
cb17ad8740
commit
7d83bf93e4
1 changed files with 291 additions and 28 deletions
|
|
@ -61,6 +61,7 @@
|
|||
#include <unistd.h>
|
||||
#endif
|
||||
|
||||
#define MAX_FUZZ_BUF (1024 * 1024)
|
||||
|
||||
enum types {
|
||||
FZY_S_DEAD = 0,
|
||||
|
|
@ -80,8 +81,9 @@ enum proxy_parser_states {
|
|||
enum fuzzer_parser_states {
|
||||
FZY_FP_SEARCH = 0,
|
||||
FZY_FP_SEARCH2 = 1,
|
||||
FZY_FP_INJECT = 2,
|
||||
FZY_FP_PENDING = 3,
|
||||
FZY_FP_INJECT_PREPARE = 2,
|
||||
FZY_FP_INJECT = 3,
|
||||
FZY_FP_PENDING = 4,
|
||||
};
|
||||
|
||||
struct ring {
|
||||
|
|
@ -106,10 +108,151 @@ struct state {
|
|||
|
||||
int twin; /* must be fixed up when arrays lose guys */
|
||||
unsigned int outbound:1; /* from local -> remote */
|
||||
unsigned int is_pending:1;
|
||||
|
||||
unsigned char buf[MAX_FUZZ_BUF];
|
||||
unsigned int inject_len;
|
||||
};
|
||||
|
||||
struct test {
|
||||
const char *s[3];
|
||||
int len[2];
|
||||
unsigned int swallow:1;
|
||||
};
|
||||
|
||||
int force_exit = 0;
|
||||
int which = 5;
|
||||
|
||||
static const struct test tests[] = {
|
||||
{ { NULL, "\x0d\x0a\x0d\x0a",
|
||||
"{ 0xd9, 0x87, 0xd2, 0x88, 0xd2, (248){ 0x89, 0xd2 }, 0x0d, 0x0a },"
|
||||
}, { 0, 4 }, 1 },
|
||||
{ { NULL, "\x0d\x0a\x0d\x0a",
|
||||
"{ 0xd9, 0x87, 0xd2, 0x88, 0xd2, (1373){ 0x89, 0xd2 }, 0x0d, 0x0a },"
|
||||
}, { 0, 4 }, 1 },
|
||||
{ { NULL, "\x0d\x0a\x0d\x0a",
|
||||
"{ 0xd9, 0x87, 0xd2, 0x88, 0xd2, (16967){ 0x89, 0xd2 }, (87){ 0xe2, 0x82, 0xac }, 0x0d, 0x0a },"
|
||||
}, { 0, 4 }, 1 },
|
||||
{ { NULL, "\x0d\x0a\x0d\x0a",
|
||||
"0x47, 0x45, 0x54, 0x20, 0x2f, 0x65, 0x63, 0x68, 0x6f, 0x20, 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, "
|
||||
"0x2e, 0x31, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, 0x31, 0x32, 0x37, 0x2e, 0x30, 0x2e, "
|
||||
"0x30, 0x2e, 0x31, 0x0d, 0x0a, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x3a, 0x20, 0x77, 0x65, "
|
||||
"0x62, 0x73, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, "
|
||||
"0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x0d, 0x0a, 0x53, 0x65, "
|
||||
"0x63, 0x2d, 0x57, 0x65, 0x62, 0x53, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x2d, 0x4b, 0x65, 0x79, 0x3a, "
|
||||
"0x20, 0x64, 0x47, 0x68, 0x6c, 0x49, 0x48, 0x4e, 0x68, 0x62, 0x58, 0x42, 0x73, 0x5a, 0x53, 0x42, "
|
||||
"0x75, 0x62, 0x32, 0x35, 0x6a, 0x5a, 0x51, 0x3d, 0x3d, 0x0d, 0x0a, 0x4f, 0x72, 0x69, 0x67, 0x69, "
|
||||
"0x6e, 0x3a, 0x20, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x31, 0x32, 0x37, 0x2e, 0x30, 0x2e, "
|
||||
"0x30, 0x2e, 0x31, 0x0d, 0x0a, 0x53, 0x65, 0x63, 0x2d, 0x57, 0x65, 0x62, 0x53, 0x6f, 0x63, 0x6b, "
|
||||
"0x65, 0x74, 0x2d, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x31, 0x33, 0x0d, 0x0a, "
|
||||
"0xef, 0xbb, 0xbf, 0xc2, 0x47, 0x45, 0x54, 0x20, 0x2f, 0x65, 0x63, 0x68, 0x6f, 0x20, 0x48, 0x54, "
|
||||
"0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, 0x31, 0x32, "
|
||||
"0x37, 0x2e, 0x30, 0x2e, 0x30, 0x2e, 0x31, 0x0d, 0x0a, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, "
|
||||
"0x3a, 0x20, 0x77, 0x65, 0x62, 0x73, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, "
|
||||
"0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x0d, 0x0a, "
|
||||
}, { 0, 4 }, 1 },
|
||||
{ { NULL, "\x0d\x0a\x0d\x0a",
|
||||
"(20){0x47, 0x45, 0x54, 0x20, 0x2f, 0x65, 0x63, 0x68, 0x6f, 0x20, 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, "
|
||||
"0x2e, 0x31, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, 0x31, 0x32, 0x37, 0x2e, 0x30, 0x2e, "
|
||||
"0x30, 0x2e, 0x31, 0x0d, 0x0a, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x3a, 0x20, 0x77, 0x65, "
|
||||
"0x62, 0x73, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, "
|
||||
"0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x0d, 0x0a, 0x53, 0x65, "
|
||||
"0x63, 0x2d, 0x57, 0x65, 0x62, 0x53, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x2d, 0x4b, 0x65, 0x79, 0x3a, "
|
||||
"0x20, 0x64, 0x47, 0x68, 0x6c, 0x49, 0x48, 0x4e, 0x68, 0x62, 0x58, 0x42, 0x73, 0x5a, 0x53, 0x42, "
|
||||
"0x75, 0x62, 0x32, 0x35, 0x6a, 0x5a, 0x51, 0x3d, 0x3d, 0x0d, 0x0a, 0x4f, 0x72, 0x69, 0x67, 0x69, "
|
||||
"0x6e, 0x3a, 0x20, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x31, 0x32, 0x37, 0x2e, 0x30, 0x2e, "
|
||||
"0x30, 0x2e, 0x31, 0x0d, 0x0a, 0x53, 0x65, 0x63, 0x2d, 0x57, 0x65, 0x62, 0x53, 0x6f, 0x63, 0x6b, "
|
||||
"0x65, 0x74, 0x2d, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x31, 0x33, 0x0d, 0x0a, "
|
||||
"0x47, 0x45, 0x54, 0x20, 0x2f, 0x65, 0x63, 0x68, 0x6f, 0x20, 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, "
|
||||
"0x2e, 0x31, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, 0x31, 0x32, 0x37, 0x2e, 0x30, 0x2e, "
|
||||
"0x30, 0x2e, 0x31, 0x0d, 0x0a, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x3a, 0x20, 0x77, 0x65, "
|
||||
"0x62, 0x73, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, "
|
||||
"0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x0d, 0x0a, 0x53, 0x65, "
|
||||
"0x63, 0x2d, 0x57, 0x65, 0x62, 0x53, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x2d, 0x4b, 0x65, 0x79, 0x3a, "
|
||||
"0x20, 0x64, 0x47, 0x68, 0x6c, 0x49, 0x48, 0x4e, 0x68, 0x62, 0x58, 0x42, 0x73, 0x5a, 0x53, 0x42, "
|
||||
"0x75, 0x62, 0x32, 0x35, 0x6a, 0x5a, 0x51, 0x3d, 0x3d, 0x0d, 0x0a, 0x4f, 0x72, 0x69, 0x67, 0x69, "
|
||||
"0x6e, 0x3a, 0x20, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x31, 0x32, 0x37, 0x2e, 0x30, 0x2e, "
|
||||
"0x30, 0x2e, 0x31, 0x0d, 0x0a, 0x53, 0x65, 0x63, 0x2d, 0x57, 0x65, 0x62, 0x53, 0x6f, 0x63, 0x6b, "
|
||||
"0x65, 0x74, 0x2d, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x31, 0x33, 0x0d, 0x0a, "
|
||||
"0xc2, 0x47, 0x45, 0x54, 0x20, 0x2f, 0x65, 0x63, 0x68, 0x6f, 0x20, 0x48, 0x54, 0x54, 0x50, 0x2f, "
|
||||
"0x31, 0x2e, 0x31, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, 0x31, 0x32, 0x37, 0x2e, 0x30, "
|
||||
"0x2e, 0x30, 0x2e, 0x31, 0x0d, 0x0a, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x3a, 0x20, 0x77, "
|
||||
"0x65, 0x62, 0x73, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, "
|
||||
"0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x0d, 0x0a, 0x53, "
|
||||
"0x65, 0x63, 0x2d, 0x57, 0x65, 0x62, 0x53, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x2d, 0x4b, 0x65, 0x79, "
|
||||
"0x3a, 0x20, 0x64, 0x47, 0x68, 0x6c, 0x49, 0x48, 0x4e, 0x68, 0x62, 0x58, 0x42, 0x73, 0x5a, 0x53, "
|
||||
"0x42, 0x75, 0x62, 0x32, 0x35, 0x6a, 0x5a, 0x51, 0x3d, 0x3d, 0x0d, 0x0a, 0x4f, 0x72, 0x69, 0x67, "
|
||||
"0x69, 0x6e, 0x3a, 0x20, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x31, 0x32, 0x37, 0x2e, 0x30, "
|
||||
"0x2e, 0x30, 0x2e, 0x31, 0x0d, 0x0a, 0x53, 0x65, 0x63, 0x2d, 0x57, 0x65, 0x62, 0x53, 0x6f, 0x63, "
|
||||
"0x6b, 0x65, 0x74, 0x2d, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x31, 0x33, 0x0d, "
|
||||
"0x0a, 0x47, 0x45, 0x54, 0x20, 0x2f, 0x65, 0x63, 0x68, 0x6f, 0x20, 0x48, 0x54, 0x54, 0x50, 0x2f, "
|
||||
"0x31, 0x2e, 0x31, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, 0x31, 0x32, 0x37, 0x2e, 0x30, "
|
||||
"0x2e, 0x30, 0x2e, 0x31, 0x0d, 0x0a, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x3a, 0x20, 0x77, "
|
||||
"0x65, 0x62, 0x73, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, "
|
||||
"0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x0d, 0x0a, 0x53, "
|
||||
"0x65, 0x63, 0x2d, 0x57, 0x65, 0x62, 0x53, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x2d, 0x4b, 0x65, 0x79, "
|
||||
"0x3a, 0x20, 0x64, 0x47, 0x68, 0x6c, 0x49, 0x48, 0x4e, 0x68, 0x62, 0x58, 0x42, 0x73, 0x5a, 0x53, "
|
||||
"0x42, 0x75, 0x62, 0x32, 0x35, 0x6a, 0x5a, 0x51, 0x3d, 0x3d, 0x0d, 0x0a, 0x4f, 0x72, 0x69, 0x67, "
|
||||
"0x69, 0x6e, 0x3a, 0x20, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x31, 0x32, 0x37, 0x2e, 0x30, "
|
||||
"0x2e, 0x30, 0x2e, 0x31, 0x0d, 0x0a, 0x53, 0x65, 0x63, 0x2d, 0x57, 0x65, 0x62, 0x53, 0x6f, 0x63, "
|
||||
"0x6b, 0x65, 0x74, 0x2d, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x31, 0x33, 0x0d, "
|
||||
"0x0a, 0x47, 0x45, 0x54, 0x20, 0x2f, 0x65, 0x63, 0x68, 0x6f, 0x20, 0x48, 0x54, 0x54, 0x50, 0x2f, "
|
||||
"0x31, 0x2e, 0x31, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, 0x31, 0x32, 0x37, 0x2e, 0x30, "
|
||||
"0x2e, 0x30, 0x2e, 0x31, 0x0d, 0x0a, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x3a, 0x20, 0x77, "
|
||||
"0x65, 0x62, 0x73, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, "
|
||||
"0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x0d, 0x0a, 0x53, "
|
||||
"0x65, 0x63, 0x2d, 0x57, 0x65, 0x62, 0x53, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x2d, 0x4b, 0x65, 0x79, "
|
||||
"0x3a, 0x20, 0x64, 0x47, 0x68, 0x6c, 0x49, 0x48, 0x4e, 0x68, 0x62, 0x58, 0x42, 0x73, 0x5a, 0x53, "
|
||||
"0x42, 0x75, 0x62, 0x32, 0x35, 0x6a, 0x5a, 0x51, 0x3d, 0x3d, 0x0d, 0x0a, 0x4f, 0x72, 0x69, 0x67, "
|
||||
"0x69, 0x6e, 0x3a, 0x20, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x31, 0x32, 0x37, 0x2e, 0x30, "
|
||||
"0x2e, 0x30, 0x2e, 0x31, 0x0d, 0x0a, 0x53, 0x65, 0x63, 0x2d, 0x57, 0x65, 0x62, 0x53, 0x6f, 0x63, "
|
||||
"0x6b, 0x65, 0x74, 0x2d, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x31, 0x33, 0x0d, "
|
||||
"0x0a, 0xc0, 0x80, 0xef, 0xb7, 0x90, 0x47, 0x45, 0x54, 0x20, 0x2f, 0x65, 0x63, 0x68, 0x6f, 0x20, "
|
||||
"0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, "
|
||||
"0x31, 0x32, 0x37, 0x2e, 0x30, 0x2e, 0x30, 0x2e, 0x31, 0x0d, 0x0a, 0x55, 0x70, 0x67, 0x72, 0x61, "
|
||||
"0x64, 0x65, 0x3a, 0x20, 0x77, 0x65, 0x62, 0x73, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x0d, 0x0a, 0x43, "
|
||||
"0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x55, 0x70, 0x67, 0x72, 0x61, "
|
||||
"0x64, 0x65, 0x0d, 0x0a, 0x53, 0x65, 0x63, 0x2d, 0x57, 0x65, 0x62, 0x53, 0x6f, 0x63, 0x6b, 0x65, "
|
||||
"0x74, 0x2d, 0x4b, 0x65, 0x79, 0x3a, 0x20, 0x64, 0x47, 0x68, 0x6c, 0x49, 0x48, 0x4e, 0x68, 0x62, "
|
||||
"0x58, 0x42, 0x73, 0x5a, 0x53, 0x42, 0x75, 0x62, 0x32, 0x35, 0x6a, 0x5a, 0x51, 0x3d, 0x3d, 0x0d, "
|
||||
"0x0a, 0x4f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x3a, 0x20, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, "
|
||||
"0x31, 0x32, 0x37, 0x2e, 0x30, 0x2e, 0x30, 0x2e, 0x31, 0x0d, 0x0a, 0x53, 0x65, 0x63, 0x2d, 0x57, "
|
||||
"0x65, 0x62, 0x53, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x2d, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, "
|
||||
"0x3a, 0x20, 0x31, 0x33, 0x0d, 0x0a, 0x47, 0x45, 0x54, 0x20, 0x2f, 0x65, 0x63, 0x68, 0x6f, 0x20, "
|
||||
"0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, "
|
||||
"0x31, 0x32, 0x37, 0x2e, 0x30, 0x2e, 0x30, 0x2e, 0x31, 0x0d, 0x0a, 0x55, 0x70, 0x67, 0x72, 0x61, "
|
||||
"0x64, 0x65, 0x3a, 0x20, 0x77, 0x65, 0x62, 0x73, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x0d, 0x0a, 0x43, "
|
||||
"0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x55, 0x70, 0x67, 0x72, 0x61, "
|
||||
"0x64, 0x65, 0x0d, 0x0a, 0x53, 0x65, 0x63, 0x2d, 0x57, 0x65, 0x62, 0x53, 0x6f, 0x63, 0x6b, 0x65, "
|
||||
"0x74, 0x2d, 0x4b, 0x65, 0x79, 0x3a, 0x20, 0x64, 0x47, 0x68, 0x6c, 0x49, 0x48, 0x4e, 0x68, 0x62, "
|
||||
"0x58, 0x42, 0x73, 0x5a, 0x53, 0x42, 0x75, 0x62, 0x32, 0x35, 0x6a, 0x5a, 0x51, 0x3d, 0x3d, 0x0d, "
|
||||
"0x0a, 0x4f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x3a, 0x20, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, "
|
||||
"0x31, 0x32, 0x37, 0x2e, 0x30, 0x2e, 0x30, 0x2e, 0x31, 0x0d, 0x0a, 0x53, 0x65, 0x63, 0x2d, 0x57, "
|
||||
"0x65, 0x62, 0x53, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x2d, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, "
|
||||
"0x3a, 0x20, 0x31, 0x33, 0x0d, 0x0a, 0xc2, 0x47, 0x45, 0x54, 0x20, 0x2f, 0x65, 0x63, 0x68, 0x6f, "
|
||||
"0x20, 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, "
|
||||
"0x20, 0x31, 0x32, 0x37, 0x2e, 0x30, 0x2e, 0x30, 0x2e, 0x31, 0x0d, 0x0a, 0x55, 0x70, 0x67, 0x72, "
|
||||
"0x61, 0x64, 0x0d, 0x0a, }"
|
||||
}, { 0, 4 }, 1 },
|
||||
{ { NULL, "\x0d\x0a\x0d\x0a",
|
||||
"0x47, 0x45, 0x54, 0x20, 0x2f, 0x65, 0x63, 0x68, 0x6f, 0x20, 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, "
|
||||
"0x2e, 0x31, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, 0x31, 0x32, 0x37, 0x2e, 0x30, 0x2e, "
|
||||
"0x30, 0x2e, 0x31, 0x0d, 0x0a, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x3a, 0x20, 0x77, 0x65, "
|
||||
"0x62, 0x73, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, "
|
||||
"0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x0d, 0x0a, 0x53, 0x65, "
|
||||
"0x63, 0x2d, 0x57, 0x65, 0x62, 0x53, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x2d, 0x4b, 0x65, 0x79, 0x3a, "
|
||||
"0x20, 0x64, 0x47, 0x68, 0x6c, 0x49, 0x48, 0x4e, 0x68, 0x62, 0x58, 0x42, 0x73, 0x5a, 0x53, 0x42, "
|
||||
"0x75, 0x62, 0x32, 0x35, 0x6a, 0x5a, 0x51, 0x3d, 0x3d, 0x0d, 0x0a, 0x4f, 0x72, 0x69, 0x67, 0x69, "
|
||||
"0x6e, 0x3a, 0x20, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x31, 0x32, 0x37, 0x2e, 0x30, 0x2e, "
|
||||
"0x30, 0x2e, 0x31, 0x0d, 0x0a, 0x53, 0x65, 0x63, 0x2d, 0x57, 0x65, 0x62, 0x53, 0x6f, 0x63, 0x6b, "
|
||||
"0x65, 0x74, 0x2d, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x31, 0x33, 0x0d, 0x0a, "
|
||||
"0xef, 0xbb, 0xbf, 0xc2, 0x47, 0x45, 0x54, 0x20, 0x2f, 0x65, 0x63, 0x68, 0x6f, 0x20, 0x48, 0x54, "
|
||||
"0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x0d, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x3a, 0x20, 0x31, 0x32, "
|
||||
"0x37, 0x2e, 0x30, 0x2e, 0x30, 0x2e, 0x31, 0x0d, 0x0a, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, "
|
||||
"0x3a, 0x20, 0x77, 0x65, 0x62, 0x73, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, "
|
||||
"0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x0d, 0x0a, (2048){ 0x0d, 0x0a}"
|
||||
}, { 0, 4 }, 1 },
|
||||
};
|
||||
|
||||
static const int ring_size(struct ring *r)
|
||||
{
|
||||
|
|
@ -137,6 +280,104 @@ static const int ring_get_one(struct ring *r)
|
|||
return n;
|
||||
}
|
||||
|
||||
static int hex(char c)
|
||||
{
|
||||
if (c >= '0' && c <= '9')
|
||||
return c -'0';
|
||||
if (c >= 'a' && c <= 'f')
|
||||
return c - 'a' + 10;
|
||||
if (c >='A' && c <= 'F')
|
||||
return c - 'A' + 10;
|
||||
|
||||
return -1;
|
||||
}
|
||||
|
||||
static int
|
||||
fuzxy_tok(const char **src, unsigned char **buf, int *len)
|
||||
{
|
||||
unsigned char *start;
|
||||
unsigned int count, rlen;
|
||||
|
||||
while (**src) {
|
||||
|
||||
if (**src == ' ' || **src == ',' || **src == '\n') {
|
||||
(*src)++;
|
||||
continue;
|
||||
}
|
||||
|
||||
if ((*src)[0] == '}') {
|
||||
(*src)++;
|
||||
return 0;
|
||||
}
|
||||
|
||||
if ((*src)[0] == '0' && (*src)[1] == 'x') {
|
||||
if (!len) {
|
||||
lwsl_err("out of space\n");
|
||||
return -1;
|
||||
}
|
||||
|
||||
((*buf)++)[0] = (hex((*src)[2]) << 4) | hex((*src)[3]);
|
||||
*src += 4;
|
||||
(*len)--;
|
||||
}
|
||||
|
||||
if (*src[0] == '(') {
|
||||
start = *buf;
|
||||
(*src)++;
|
||||
count = atoi(*src) - 1;
|
||||
lwsl_err("count %d\n", count);
|
||||
while (**src && **src != ')')
|
||||
(*src)++;
|
||||
if (!(*src)[0]) {
|
||||
lwsl_err("unexpected end in (\n");
|
||||
return -1;
|
||||
}
|
||||
(*src)++;
|
||||
while (**src == ' ')
|
||||
(*src)++;
|
||||
if (**src != '{') {
|
||||
lwsl_err("missing {\n");
|
||||
|
||||
return -1;
|
||||
}
|
||||
(*src)++;
|
||||
if (fuzxy_tok(src, buf, len))
|
||||
return -1;
|
||||
rlen = *buf - start;
|
||||
while (count--) {
|
||||
if (*len < rlen) {
|
||||
lwsl_err("out of space\n");
|
||||
return -1;
|
||||
}
|
||||
memcpy(*buf, start, rlen);
|
||||
*buf += rlen;
|
||||
*len -= rlen;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int
|
||||
fuzxy_create_pattern(const char *src, unsigned char *buf, int len)
|
||||
{
|
||||
unsigned char *old = buf;
|
||||
int n;
|
||||
|
||||
while (*src && (*src == '{' || *src == ' '))
|
||||
src++;
|
||||
|
||||
if (!*src)
|
||||
return -1;
|
||||
|
||||
n = fuzxy_tok(&src, &buf, &len);
|
||||
if (n)
|
||||
return -1;
|
||||
|
||||
return buf - old;
|
||||
}
|
||||
|
||||
void sighandler(int sig)
|
||||
{
|
||||
force_exit = 1;
|
||||
|
|
@ -270,32 +511,28 @@ bail1:
|
|||
return -1;
|
||||
}
|
||||
|
||||
struct fuzxy_rule {
|
||||
const char *s[3];
|
||||
int len[3];
|
||||
int inject_len;
|
||||
};
|
||||
|
||||
struct fuzxy_rule r = {
|
||||
{ "G", "E", "\xe0\x41\x42" },
|
||||
{ 1, 1, 3 },
|
||||
65536
|
||||
};
|
||||
|
||||
static int fuzz(int n, char *out, int len)
|
||||
{
|
||||
struct state *s = &state[n];
|
||||
const struct test *t = &tests[which];
|
||||
int m = 0;
|
||||
int c;
|
||||
|
||||
while (m < len) {
|
||||
switch (s->fp) {
|
||||
case FZY_FP_SEARCH:
|
||||
if (t->s[0] == NULL) {
|
||||
s->fuzc = 0;
|
||||
s->is_pending = 0;
|
||||
s->fp = FZY_FP_SEARCH2;
|
||||
goto search2;
|
||||
}
|
||||
c = ring_get_one(&state[s->twin].in);
|
||||
if (c < 0)
|
||||
return m;
|
||||
if (c == r.s[0][s->fuzc++]) {
|
||||
if (s->fuzc == r.len[0]) {
|
||||
if (c == tests[which].s[0][s->fuzc++]) {
|
||||
if (s->fuzc == t->len[0]) {
|
||||
s->fuzc = 0;
|
||||
s->fp = FZY_FP_SEARCH2;
|
||||
}
|
||||
|
|
@ -305,30 +542,49 @@ static int fuzz(int n, char *out, int len)
|
|||
break;
|
||||
|
||||
case FZY_FP_SEARCH2:
|
||||
search2:
|
||||
if (tests[which].s[1] == NULL) {
|
||||
s->fuzc = 0;
|
||||
s->is_pending = 0;
|
||||
s->fp = FZY_FP_INJECT_PREPARE;
|
||||
goto inject;
|
||||
}
|
||||
c = ring_get_one(&state[s->twin].in);
|
||||
if (c < 0)
|
||||
return m;
|
||||
if (c == r.s[1][s->fuzc++]) {
|
||||
if (s->fuzc == r.len[1]) {
|
||||
if (c == tests[which].s[1][s->fuzc++]) {
|
||||
if (s->fuzc == tests[which].len[1]) {
|
||||
lwsl_notice("+++++++fuzzer hit...\n");
|
||||
s->fuzc = 0;
|
||||
s->fp = FZY_FP_INJECT;
|
||||
s->fp = FZY_FP_INJECT_PREPARE;
|
||||
s->is_pending = !t->swallow;
|
||||
s->pending = c;
|
||||
goto inject;
|
||||
}
|
||||
} else
|
||||
s->fuzc = 0;
|
||||
out[m++] = c;
|
||||
if (!t->swallow)
|
||||
out[m++] = c;
|
||||
break;
|
||||
case FZY_FP_INJECT:
|
||||
|
||||
case FZY_FP_INJECT_PREPARE:
|
||||
inject:
|
||||
out[m++] = r.s[2][s->fuzc++ % r.len[2]];
|
||||
if (s->fuzc == r.inject_len)
|
||||
s->inject_len = fuzxy_create_pattern(t->s[2],
|
||||
s->buf, sizeof(s->buf));
|
||||
if (s->inject_len == (unsigned int) -1)
|
||||
return -1;
|
||||
s->fp = FZY_FP_INJECT;
|
||||
/* fallthru */
|
||||
|
||||
case FZY_FP_INJECT:
|
||||
out[m++] = s->buf[s->fuzc++];
|
||||
if (s->fuzc == s->inject_len)
|
||||
s->fp = FZY_FP_PENDING;
|
||||
break;
|
||||
|
||||
case FZY_FP_PENDING:
|
||||
out[m++] = s->pending;
|
||||
if (s->is_pending)
|
||||
out[m++] = s->pending;
|
||||
s->fp = FZY_FP_SEARCH;
|
||||
s->fuzc = 0;
|
||||
break;
|
||||
|
|
@ -616,8 +872,10 @@ main(int argc, char **argv)
|
|||
m = 1;
|
||||
m = read(pfd[n].fd, s->in.buf + s->in.head, m);
|
||||
// lwsl_notice("read %d\n", m);
|
||||
if (m <= 0)
|
||||
if (m <= 0) {
|
||||
lwsl_err("Error on read\n");
|
||||
goto drop;
|
||||
}
|
||||
s->in.head += m;
|
||||
if (s->in.head == ring_size(&s->in))
|
||||
s->in.head = 0;
|
||||
|
|
@ -653,15 +911,20 @@ main(int argc, char **argv)
|
|||
* or fill an output buffer
|
||||
*/
|
||||
m = fuzz(n, out, sizeof(out));
|
||||
lwsl_notice("got block %d\n", m);
|
||||
if (m) {
|
||||
m = write(pfd[n].fd, out, m);
|
||||
if (m <= 0)
|
||||
if (m <= 0) {
|
||||
lwsl_err("Error on write\n");
|
||||
goto drop;
|
||||
} else
|
||||
} else
|
||||
pfd[s->twin].events &= ~POLLIN;
|
||||
} else {
|
||||
pfd[n].events &= ~POLLOUT;
|
||||
|
||||
if (ring_free(&state[s->twin].in))
|
||||
pfd[s->twin].events |= POLLIN;
|
||||
if (ring_free(&state[s->twin].in))
|
||||
pfd[s->twin].events |= POLLIN;
|
||||
}
|
||||
|
||||
break;
|
||||
default:
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue