fuzz_binary_message.cc 2.1 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364
  1. /* This Source Code Form is subject to the terms of the Mozilla Public
  2. * License, v. 2.0. If a copy of the MPL was not distributed with this
  3. * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
  4. #include "custom_memory_manager.h"
  5. #include <open62541/plugin/log_stdout.h>
  6. #include <open62541/server_config_default.h>
  7. #include <open62541/types.h>
  8. #include "ua_server_internal.h"
  9. #include "testing_networklayers.h"
  10. #define RECEIVE_BUFFER_SIZE 65535
  11. /*
  12. ** Main entry point. The fuzzer invokes this function with each
  13. ** fuzzed input.
  14. */
  15. extern "C" int
  16. LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  17. if (!UA_memoryManager_setLimitFromLast4Bytes(data, size))
  18. return 0;
  19. size -= 4;
  20. UA_Connection c = createDummyConnection(RECEIVE_BUFFER_SIZE, NULL);
  21. UA_ServerConfig *config = UA_ServerConfig_new_default();
  22. if (!config) {
  23. UA_LOG_ERROR(UA_Log_Stdout, UA_LOGCATEGORY_SERVER,
  24. "Could not create server config using UA_ServerConfig_new_default");
  25. return 0;
  26. }
  27. UA_Server *server = UA_Server_new(config);
  28. if (server == NULL) {
  29. UA_ServerConfig_delete(config);
  30. UA_LOG_ERROR(UA_Log_Stdout, UA_LOGCATEGORY_SERVER,
  31. "Could not create server instance using UA_Server_new");
  32. return 0;
  33. }
  34. // we need to copy the message because it will be freed in the processing function
  35. UA_ByteString msg = UA_ByteString();
  36. UA_StatusCode retval = UA_ByteString_allocBuffer(&msg, size);
  37. if(retval != UA_STATUSCODE_GOOD) {
  38. UA_ServerConfig_delete(config);
  39. UA_LOG_ERROR(UA_Log_Stdout, UA_LOGCATEGORY_SERVER,
  40. "Could not allocate message buffer");
  41. return 0;
  42. }
  43. memcpy(msg.data, data, size);
  44. UA_Server_processBinaryMessage(server, &c, &msg);
  45. // if we got an invalid chunk, the message is not deleted, so delete it here
  46. UA_ByteString_deleteMembers(&msg);
  47. UA_Server_run_shutdown(server);
  48. UA_Server_delete(server);
  49. UA_ServerConfig_delete(config);
  50. c.close(&c);
  51. UA_Connection_deleteMembers(&c);
  52. return 0;
  53. }