etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
fuzz_extra.c (1910B)
      1 /*
      2  * Harness: endpoint extra chain walking via libusb_get_ss_endpoint_companion_descriptor().
      3  *
      4  * fuzz_descriptor.c parses configs and immediately frees them — it never calls
      5  * the public API that walks endpoint->extra. This harness does both: parse the
      6  * config, then call the SS endpoint companion extractor on every endpoint's
      7  * extra data. That walking loop is completely unexercised by any other harness.
      8  */
      9 
     10 #include "fuzz-include/libusb_fuzz.h"
     11 #include "libusb-src/libusb/descriptor.c"
     12 
     13 static int fuzz_one(const uint8_t *data, size_t size)
     14 {
     15     if (size < 1)
     16         return 0;
     17 
     18     struct libusb_config_descriptor *config = NULL;
     19     int r = raw_desc_to_config(NULL, data,
     20         (int)(size > (size_t)INT_MAX ? INT_MAX : size), &config);
     21     if (r != LIBUSB_SUCCESS || !config)
     22         return 0;
     23 
     24     for (uint8_t i = 0; i < config->bNumInterfaces; i++) {
     25         const struct libusb_interface *iface = &config->interface[i];
     26         for (int a = 0; a < iface->num_altsetting; a++) {
     27             const struct libusb_interface_descriptor *alt = &iface->altsetting[a];
     28             for (uint8_t e = 0; e < alt->bNumEndpoints; e++) {
     29                 const struct libusb_endpoint_descriptor *ep = &alt->endpoint[e];
     30 
     31                 struct libusb_ss_endpoint_companion_descriptor *comp = NULL;
     32                 libusb_get_ss_endpoint_companion_descriptor(NULL, ep, &comp);
     33                 if (comp)
     34                     libusb_free_ss_endpoint_companion_descriptor(comp);
     35             }
     36         }
     37     }
     38 
     39     libusb_free_config_descriptor(config);
     40     return 0;
     41 }
     42 
     43 #ifdef __AFL_FUZZ_TESTCASE_LEN
     44 __AFL_FUZZ_INIT();
     45 int main(void)
     46 {
     47     __AFL_INIT();
     48     uint8_t *buf = __AFL_FUZZ_TESTCASE_BUF;
     49     while (__AFL_LOOP(10000))
     50         fuzz_one(buf, __AFL_FUZZ_TESTCASE_LEN);
     51     return 0;
     52 }
     53 #else
     54 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
     55 {
     56     return fuzz_one(data, size);
     57 }
     58 #endif