add a binary message examples that opens a session; remove all hangs found with afl

src/server/ua_server_binary.c

@@ -20,12 +20,12 @@ static void processHEL(UA_Connection *connection, const UA_ByteString *msg, size
     connection->remoteConf.maxChunkCount = helloMessage.maxChunkCount;
     connection->remoteConf.maxMessageSize = helloMessage.maxMessageSize;
     connection->remoteConf.protocolVersion = helloMessage.protocolVersion;
-    connection->remoteConf.recvBufferSize = helloMessage.receiveBufferSize;
+    if(connection->remoteConf.recvBufferSize > helloMessage.receiveBufferSize)
+        connection->remoteConf.recvBufferSize = helloMessage.receiveBufferSize;
+    if(connection->remoteConf.sendBufferSize > helloMessage.sendBufferSize)
+        connection->remoteConf.sendBufferSize = helloMessage.sendBufferSize;
     if(connection->localConf.sendBufferSize > helloMessage.receiveBufferSize)
         connection->localConf.sendBufferSize = helloMessage.receiveBufferSize;
-    if(connection->localConf.recvBufferSize > helloMessage.sendBufferSize)
-        connection->localConf.recvBufferSize = helloMessage.sendBufferSize;
-    connection->remoteConf.sendBufferSize = helloMessage.sendBufferSize;
     connection->state = UA_CONNECTION_ESTABLISHED;
     UA_TcpHelloMessage_deleteMembers(&helloMessage);
 
@@ -465,14 +465,22 @@ processCLO(UA_Connection *connection, UA_Server *server, const UA_ByteString *ms
 /**
  * process binary message received from Connection
  * dose not modify UA_ByteString you have to free it youself.
- * use of connection->getSendBuffer() and connection->sent() to answer Message
+ * use of connection->getSendBuffer() and connection->send() to answer Message
  */
 void UA_Server_processBinaryMessage(UA_Server *server, UA_Connection *connection, const UA_ByteString *msg) {
     size_t pos = 0;
     UA_TcpMessageHeader tcpMessageHeader;
     do {
         if(UA_TcpMessageHeader_decodeBinary(msg, &pos, &tcpMessageHeader)) {
-            UA_LOG_INFO(server->config.logger, UA_LOGCATEGORY_NETWORK, "Decoding of message header failed");
+            UA_LOG_INFO(server->config.logger, UA_LOGCATEGORY_NETWORK,
+                        "Decoding of message header failed on Connection %i", connection->sockfd);
+            connection->close(connection);
+            break;
+        }
+
+        if(tcpMessageHeader.messageSize < 16) {
+            UA_LOG_INFO(server->config.logger, UA_LOGCATEGORY_NETWORK,
+                        "The message is suspiciously small on Connection %i", connection->sockfd);
             connection->close(connection);
             break;
         }

src/ua_connection.c

@@ -72,7 +72,7 @@ UA_Connection_completeMessages(UA_Connection *connection, UA_ByteString * UA_RES
         UA_UInt32 length = 0;
         size_t length_pos = pos + 4;
         UA_StatusCode retval = UA_UInt32_decodeBinary(current, &length_pos, &length);
-        if(retval != UA_STATUSCODE_GOOD || length < 16 || length > connection->localConf.maxMessageSize) {
+        if(retval != UA_STATUSCODE_GOOD || length < 16 || length > connection->localConf.recvBufferSize) {
             /* the message size is not allowed. throw the remaining bytestring away */
             delete_at = pos;
             break;

tests/CMakeLists.txt

@@ -63,16 +63,25 @@ add_test(session ${CMAKE_CURRENT_BINARY_DIR}/check_session)
 # test with canned interactions from files
 
 add_custom_command(OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/client_HELOPN.bin
+                          ${CMAKE_CURRENT_BINARY_DIR}/client_CreateActivateSession.bin
                   PRE_BUILD
-                  COMMAND python ${PROJECT_SOURCE_DIR}/tools/hex2bin.py ${CMAKE_CURRENT_SOURCE_DIR}/dumps/client_HELOPN.hex
+                  COMMAND python ${PROJECT_SOURCE_DIR}/tools/hex2bin.py
+                                 ${CMAKE_CURRENT_SOURCE_DIR}/dumps/client_HELOPN.hex
                                  ${CMAKE_CURRENT_SOURCE_DIR}/dumps/client_CreateActivateSession.hex
                   DEPENDS ${PROJECT_SOURCE_DIR}/tools/hex2bin.py
-                          ${CMAKE_CURRENT_SOURCE_DIR}/dumps/client_HELOPN.hex)
+                          ${CMAKE_CURRENT_SOURCE_DIR}/dumps/client_HELOPN.hex
+                          ${CMAKE_CURRENT_SOURCE_DIR}/dumps/client_CreateActivateSession.hex)
 add_custom_target(client_HELOPN.bin DEPENDS "${CMAKE_CURRENT_BINARY_DIR}/client_HELOPN.bin")
+add_custom_target(client_CreateActivateSession.bin DEPENDS "${CMAKE_CURRENT_BINARY_DIR}/client_CreateActivateSession.bin")
 
 add_executable(check_server_binary_messages check_server_binary_messages.c testing_networklayers.c $<TARGET_OBJECTS:open62541-object>)
 target_include_directories(check_server_binary_messages PRIVATE ${PROJECT_SOURCE_DIR}/src/server)
 target_link_libraries(check_server_binary_messages ${LIBS})
 add_dependencies(check_server_binary_messages client_HELOPN.bin)
 
-add_test(check_server_binary_messages_helopn ${CMAKE_CURRENT_BINARY_DIR}/check_server_binary_messages ${CMAKE_CURRENT_BINARY_DIR}/client_HELOPN.bin)
+add_test(check_server_binary_messages_helopn ${CMAKE_CURRENT_BINARY_DIR}/check_server_binary_messages
+                                             ${CMAKE_CURRENT_BINARY_DIR}/client_HELOPN.bin)
+
+add_test(check_server_binary_messages_activate_session ${CMAKE_CURRENT_BINARY_DIR}/check_server_binary_messages
+                                                       ${CMAKE_CURRENT_BINARY_DIR}/client_HELOPN.bin
+                                                       ${CMAKE_CURRENT_BINARY_DIR}/client_CreateActivateSession.bin)

tests/check_server_binary_messages.c

@@ -35,7 +35,10 @@ START_TEST(processMessage) {
     UA_Server *server = UA_Server_new(config);
     for(size_t i = 0; i < files; i++) {
         UA_ByteString msg = readFile(filenames[i]);
-        UA_Server_processBinaryMessage(server, &c, &msg);
+        UA_Boolean reallocated;
+        UA_StatusCode retval = UA_Connection_completeMessages(&c, &msg, &reallocated);
+        if(retval == UA_STATUSCODE_GOOD)
+            UA_Server_processBinaryMessage(server, &c, &msg);
         UA_ByteString_deleteMembers(&msg);
     }
 	UA_Server_delete(server);

tests/testing_networklayers.c

@@ -9,7 +9,7 @@ dummyGetSendBuffer(UA_Connection *connection, size_t length, UA_ByteString *buf)
 }
 
 static void
-releaseSendBuffer(UA_Connection *connection, UA_ByteString *buf) {
+dummyReleaseSendBuffer(UA_Connection *connection, UA_ByteString *buf) {
     free(buf->data);
 }
 
@@ -19,6 +19,11 @@ dummySend(UA_Connection *connection, UA_ByteString *buf) {
     return UA_STATUSCODE_GOOD;
 }
 
+static void
+dummyReleaseRecvBuffer(UA_Connection *connection, UA_ByteString *buf) {
+    return;
+}
+
 static void
 dummyClose(UA_Connection *connection) {
     return;
@@ -34,9 +39,10 @@ UA_Connection createDummyConnection(void) {
     c.handle = NULL;
     c.incompleteMessage = UA_BYTESTRING_NULL;
     c.getSendBuffer = dummyGetSendBuffer;
+    c.releaseSendBuffer = dummyReleaseSendBuffer;
     c.send = dummySend;
     c.recv = NULL;
-    c.releaseRecvBuffer = NULL;
+    c.releaseRecvBuffer = dummyReleaseRecvBuffer;
     c.close = dummyClose;
     return c;
 }