fuzz_src_ua_util.cc 1.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263
  1. /* This Source Code Form is subject to the terms of the Mozilla Public
  2. * License, v. 2.0. If a copy of the MPL was not distributed with this
  3. * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
  4. #include <ua_util.h>
  5. #include "custom_memory_manager.h"
  6. static int tortureParseEndpointUrl(const uint8_t *data, size_t size) {
  7. const UA_String endpointUrl = {
  8. size, (UA_Byte* )(void*)data
  9. };
  10. UA_String hostname;
  11. UA_UInt16 port;
  12. UA_String path;
  13. UA_parseEndpointUrl(&endpointUrl, &hostname, &port, &path);
  14. return 0;
  15. }
  16. static int tortureParseEndpointUrlEthernet(const uint8_t *data, size_t size) {
  17. const UA_String endpointUrl = {
  18. size, (UA_Byte* )(void*)data
  19. };
  20. UA_String target;
  21. UA_UInt16 vid;
  22. UA_Byte prid;
  23. UA_parseEndpointUrlEthernet(&endpointUrl, &target, &vid, &prid);
  24. return 0;
  25. }
  26. /*
  27. ** Main entry point. The fuzzer invokes this function with each
  28. ** fuzzed input.
  29. */
  30. extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  31. if (!UA_memoryManager_setLimitFromLast4Bytes(data, size))
  32. return 0;
  33. size -= 4;
  34. if (size == 0)
  35. return 0;
  36. // use first byte to decide which function should be fuzzed
  37. const uint8_t select = data[0];
  38. const uint8_t *newData = &data[1];
  39. size_t newSize = size-1;
  40. switch(select) {
  41. case 0:
  42. return tortureParseEndpointUrl(newData, newSize);
  43. case 1:
  44. return tortureParseEndpointUrlEthernet(newData, newSize);
  45. default:
  46. return 0;
  47. }
  48. }