etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
fuzz_bos.c (2072B)
      1 /*
      2  * Harness: BOS descriptor parsing + all 5 device-capability extractors.
      3  * Key bugs: platform bLength underflow (line 1268), SSPlus OOB (line 1115).
      4  */
      5 
      6 #include "fuzz-include/libusb_fuzz.h"
      7 #include "libusb-src/libusb/descriptor.c"
      8 
      9 static int fuzz_one(const uint8_t *data, size_t size)
     10 {
     11     if (size < 1)
     12         return 0;
     13 
     14     struct libusb_bos_descriptor *bos = NULL;
     15     int r = parse_bos(NULL, &bos,
     16         data, (int)(size > (size_t)INT_MAX ? INT_MAX : size));
     17     if (r != LIBUSB_SUCCESS || !bos)
     18         return 0;
     19 
     20     for (uint8_t i = 0; i < bos->bNumDeviceCaps; i++) {
     21         struct libusb_bos_dev_capability_descriptor *cap = bos->dev_capability[i];
     22 
     23         struct libusb_usb_2_0_extension_descriptor *usb20 = NULL;
     24         libusb_get_usb_2_0_extension_descriptor(NULL, cap, &usb20);
     25         if (usb20) libusb_free_usb_2_0_extension_descriptor(usb20);
     26 
     27         struct libusb_ss_usb_device_capability_descriptor *ss = NULL;
     28         libusb_get_ss_usb_device_capability_descriptor(NULL, cap, &ss);
     29         if (ss) libusb_free_ss_usb_device_capability_descriptor(ss);
     30 
     31         struct libusb_ssplus_usb_device_capability_descriptor *ssplus = NULL;
     32         libusb_get_ssplus_usb_device_capability_descriptor(NULL, cap, &ssplus);
     33         if (ssplus) libusb_free_ssplus_usb_device_capability_descriptor(ssplus);
     34 
     35         struct libusb_container_id_descriptor *cid = NULL;
     36         libusb_get_container_id_descriptor(NULL, cap, &cid);
     37         if (cid) libusb_free_container_id_descriptor(cid);
     38 
     39         struct libusb_platform_descriptor *plat = NULL;
     40         libusb_get_platform_descriptor(NULL, cap, &plat);
     41         if (plat) libusb_free_platform_descriptor(plat);
     42     }
     43 
     44     libusb_free_bos_descriptor(bos);
     45     return 0;
     46 }
     47 
     48 #ifdef __AFL_FUZZ_TESTCASE_LEN
     49 __AFL_FUZZ_INIT();
     50 int main(void)
     51 {
     52     __AFL_INIT();
     53     uint8_t *buf = __AFL_FUZZ_TESTCASE_BUF;
     54     while (__AFL_LOOP(10000))
     55         fuzz_one(buf, __AFL_FUZZ_TESTCASE_LEN);
     56     return 0;
     57 }
     58 #else
     59 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
     60 {
     61     return fuzz_one(data, size);
     62 }
     63 #endif