Explorar o código

Fuzz: Check for successful memory allocation

Credit to oss-fuzz

Fixes issues:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11431
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11433
Stefan Profanter %!s(int64=6) %!d(string=hai) anos
pai
achega
33f185b41a
Modificáronse 1 ficheiros con 7 adicións e 0 borrados
  1. 7 0
      tests/fuzz/fuzz_binary_decode.cc

+ 7 - 0
tests/fuzz/fuzz_binary_decode.cc

@@ -25,6 +25,9 @@ static UA_Boolean tortureEncoding(const uint8_t *data, size_t size, size_t *newO
 
     void *dst = UA_new(&UA_TYPES[typeIndex]);
 
+    if (!dst)
+        return UA_FALSE;
+
     const UA_ByteString binary = {
             size, //length
             (UA_Byte *) (void *) data
@@ -35,6 +38,8 @@ static UA_Boolean tortureEncoding(const uint8_t *data, size_t size, size_t *newO
     if (ret == UA_STATUSCODE_GOOD) {
         // copy the datatype to test
         void *dstCopy = UA_new(&UA_TYPES[typeIndex]);
+        if (!dstCopy)
+            return UA_FALSE;
         UA_copy(dst, dstCopy, &UA_TYPES[typeIndex]);
         UA_delete(dstCopy, &UA_TYPES[typeIndex]);
 
@@ -79,6 +84,8 @@ static UA_Boolean tortureExtensionObject(const uint8_t *data, size_t size, size_
     UA_StatusCode ret = UA_STATUSCODE_GOOD;
     if (type) {
         void *dstCopy = UA_new(type);
+        if (!dstCopy)
+            return UA_FALSE;
         ret = UA_decodeBinary(&obj.content.encoded.body, newOffset, dstCopy, type, NULL);
 
         if (ret == UA_STATUSCODE_GOOD) {