Browse Source

Fuzz: Always return zero code on OOM

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11443

Credit to oss-fuzz
Stefan Profanter 6 years ago
parent
commit
94d61b6c13
1 changed files with 6 additions and 2 deletions
  1. 6 2
      tests/fuzz/fuzz_binary_message.cc

+ 6 - 2
tests/fuzz/fuzz_binary_message.cc

@@ -40,8 +40,12 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     // we need to copy the message because it will be freed in the processing function
     UA_ByteString msg = UA_ByteString();
     UA_StatusCode retval = UA_ByteString_allocBuffer(&msg, size);
-    if(retval != UA_STATUSCODE_GOOD)
-        return (int)retval;
+    if(retval != UA_STATUSCODE_GOOD) {
+        UA_ServerConfig_delete(config);
+        UA_LOG_ERROR(UA_Log_Stdout, UA_LOGCATEGORY_SERVER,
+                     "Could not allocate message buffer");
+        return 0;
+    }
     memcpy(msg.data, data, size);
 
     UA_Server_processBinaryMessage(server, &c, &msg);