etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
fuzz_protocol.c (1932B)
      1 /*
      2  * fuzz_protocol.c — USB/IP op_common header parsing harness.
      3  *
      4  * Exercises usbip_net_recv_op_common() which reads the 8-byte op_common
      5  * header and validates protocol version + operation code.
      6  * On success, reads the reply body depending on the opcode.
      7  *
      8  * Input format: [version:2 BE][code:2 BE][status:4 BE][... payload ...]
      9  */
     10 
     11 #include "fuzz-include/usbip_fuzz.h"
     12 #include "usbip-src/libsrc/usbip_common.h"
     13 #include "usbip-src/src/usbip_network.h"
     14 
     15 #include <stdint.h>
     16 #include <stdlib.h>
     17 #include <string.h>
     18 #include <arpa/inet.h>
     19 
     20 #define FAKE_FD 42
     21 
     22 static int fuzz_one(const uint8_t *data, size_t size)
     23 {
     24     if (size < sizeof(struct op_common))
     25         return 0;
     26 
     27     fuzz_reset(data, size);
     28 
     29     /*
     30      * Pass OP_UNSPEC so recv_op_common accepts any opcode.
     31      * The function reads sizeof(struct op_common) bytes via our mock recv.
     32      */
     33     uint16_t code = OP_UNSPEC;
     34     int status = 0;
     35 
     36     if (usbip_net_recv_op_common(FAKE_FD, &code, &status) < 0)
     37         return 0;
     38 
     39     /* Consume the reply body to exercise more of the parsing surface */
     40     switch (code) {
     41     case OP_REP_DEVLIST: {
     42         struct op_devlist_reply dr;
     43         memset(&dr, 0, sizeof(dr));
     44         if (usbip_net_recv(FAKE_FD, &dr, sizeof(dr)) == 0)
     45             PACK_OP_DEVLIST_REPLY(0, &dr);
     46         break;
     47     }
     48     case OP_REP_IMPORT: {
     49         struct op_import_reply ir;
     50         memset(&ir, 0, sizeof(ir));
     51         if (usbip_net_recv(FAKE_FD, &ir, sizeof(ir)) == 0)
     52             PACK_OP_IMPORT_REPLY(0, &ir);
     53         break;
     54     }
     55     default:
     56         break;
     57     }
     58 
     59     return 0;
     60 }
     61 
     62 #ifdef __AFL_FUZZ_TESTCASE_LEN
     63 __AFL_FUZZ_INIT();
     64 
     65 int main(void)
     66 {
     67     __AFL_INIT();
     68     uint8_t *buf = __AFL_FUZZ_TESTCASE_BUF;
     69     while (__AFL_LOOP(10000)) {
     70         fuzz_one(buf, __AFL_FUZZ_TESTCASE_LEN);
     71     }
     72     return 0;
     73 }
     74 
     75 #else
     76 
     77 int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
     78 {
     79     return fuzz_one(data, size);
     80 }
     81 
     82 #endif