/src/FreeRDP/channels/drdynvc/client/test/TestFuzzDrdynvc.c

Source
/**
 * FreeRDP: A Remote Desktop Protocol Implementation
 * libFuzzer harness for DVC wire framing
 */

#include <stddef.h>
#include <stdint.h>

#include <winpr/stream.h>
#include <winpr/wtypes.h>

static UINT32 fuzz_var_uint_bytes(UINT8 cbLen)
{
  switch (cbLen)
  {
    case 0:
      return 1;
    case 1:
      return 2;
    default:
      return 4;
  }
}

static UINT32 fuzz_read_variable_uint(wStream* s, UINT8 cbLen)
{
  UINT32 value = 0;

  switch (cbLen)
  {
    case 0:
      value = Stream_Get_UINT8(s);
      break;
    case 1:
      value = Stream_Get_UINT16(s);
      break;
    default:
      value = Stream_Get_UINT32(s);
      break;
  }

  return value;
}

enum
{
  CREATE_REQUEST_PDU = 0x01,
  DATA_FIRST_PDU = 0x02,
  DATA_PDU = 0x03,
  CLOSE_REQUEST_PDU = 0x04,
  CAPABILITY_REQUEST_PDU = 0x05,
  DATA_FIRST_COMPRESSED_PDU = 0x06,
  DATA_COMPRESSED_PDU = 0x07
};

static int fuzz_process_one_pdu(wStream* s)
{
  const size_t required = 1;

  if (!Stream_CheckAndLogRequiredLength("fuzz", s, required))
    return -1;

  UINT8 header = Stream_Get_UINT8(s);
  UINT8 command = (header & 0xf0) >> 4;
  UINT8 spacing = (header & 0x0c) >> 2;
  UINT8 cbChId = (header & 0x03);
  size_t needed = fuzz_var_uint_bytes(cbChId);

  switch (command)
  {
    case DATA_FIRST_PDU:
    case DATA_FIRST_COMPRESSED_PDU:
      if (!Stream_CheckAndLogRequiredLength("fuzz", s, needed + fuzz_var_uint_bytes(spacing)))
        return -1;
      (void)fuzz_read_variable_uint(s, cbChId);
      (void)fuzz_read_variable_uint(s, spacing);
      break;
    case DATA_PDU:
    case DATA_COMPRESSED_PDU:
    case CLOSE_REQUEST_PDU:
    case CREATE_REQUEST_PDU:
      if (!Stream_CheckAndLogRequiredLength("fuzz", s, needed))
        return -1;
      (void)fuzz_read_variable_uint(s, cbChId);
      break;
    case CAPABILITY_REQUEST_PDU:
      if (!Stream_CheckAndLogRequiredLength("fuzz", s, 2))
        return -1;
      Stream_Seek(s, 2);
      break;
    default:
      break;
  }

  if (!Stream_CheckAndLogRequiredLength("fuzz", s, 2))
    return -1;

  {
    size_t bodyLen = Stream_Get_UINT16(s);
    const size_t remaining = Stream_GetRemainingLength(s);
    if (bodyLen > remaining)
      bodyLen = remaining;
    Stream_Seek(s, bodyLen);
  }

  return 0;
}

int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
{
  if ((size == 0) || (size > (1u << 20)))
    return 0;

  wStream buffer = WINPR_C_ARRAY_INIT;
  wStream* s = Stream_StaticConstInit(&buffer, data, size);
  if (!s)
    return 0;

  for (size_t index = 0; index < 64; index++)
  {
    if (Stream_GetRemainingLength(s) == 0)
      break;
    if (fuzz_process_one_pdu(s) != 0)
      break;
  }

  return 0;
}

Line	Count	Source
1		/**
2		* FreeRDP: A Remote Desktop Protocol Implementation
3		* libFuzzer harness for DVC wire framing
4		*/
5
6		#include <stddef.h>
7		#include <stdint.h>
8
9		#include <winpr/stream.h>
10		#include <winpr/wtypes.h>
11
12		static UINT32 fuzz_var_uint_bytes(UINT8 cbLen)
13	8.78k	{
14	8.78k	switch (cbLen)
15	8.78k	{
16	4.99k	case 0:
17	4.99k	return 1;
18	1.68k	case 1:
19	1.68k	return 2;
20	2.10k	default:
21	2.10k	return 4;
22	8.78k	}
23	8.78k	}
24
25		static UINT32 fuzz_read_variable_uint(wStream* s, UINT8 cbLen)
26	6.00k	{
27	6.00k	UINT32 value = 0;
28
29	6.00k	switch (cbLen)
30	6.00k	{
31	2.75k	case 0:
32	2.75k	value = Stream_Get_UINT8(s);
33	2.75k	break;
34	1.55k	case 1:
35	1.55k	value = Stream_Get_UINT16(s);
36	1.55k	break;
37	1.69k	default:
38	1.69k	value = Stream_Get_UINT32(s);
39	1.69k	break;
40	6.00k	}
41
42	6.00k	return value;
43	6.00k	}
44
45		enum
46		{
47		CREATE_REQUEST_PDU = 0x01,
48		DATA_FIRST_PDU = 0x02,
49		DATA_PDU = 0x03,
50		CLOSE_REQUEST_PDU = 0x04,
51		CAPABILITY_REQUEST_PDU = 0x05,
52		DATA_FIRST_COMPRESSED_PDU = 0x06,
53		DATA_COMPRESSED_PDU = 0x07
54		};
55
56		static int fuzz_process_one_pdu(wStream* s)
57	7.08k	{
58	7.08k	const size_t required = 1;
59
60	7.08k	if (!Stream_CheckAndLogRequiredLength("fuzz", s, required))
61	0	return -1;
62
63	7.08k	UINT8 header = Stream_Get_UINT8(s);
64	7.08k	UINT8 command = (header & 0xf0) >> 4;
65	7.08k	UINT8 spacing = (header & 0x0c) >> 2;
66	7.08k	UINT8 cbChId = (header & 0x03);
67	7.08k	size_t needed = fuzz_var_uint_bytes(cbChId);
68
69	7.08k	switch (command)
70	7.08k	{
71	634	case DATA_FIRST_PDU:
72	1.69k	case DATA_FIRST_COMPRESSED_PDU:
73	1.69k	if (!Stream_CheckAndLogRequiredLength("fuzz", s, needed + fuzz_var_uint_bytes(spacing)))
74	28	return -1;
75	1.66k	(void)fuzz_read_variable_uint(s, cbChId);
76	1.66k	(void)fuzz_read_variable_uint(s, spacing);
77	1.66k	break;
78	496	case DATA_PDU:
79	1.24k	case DATA_COMPRESSED_PDU:
80	2.15k	case CLOSE_REQUEST_PDU:
81	2.71k	case CREATE_REQUEST_PDU:
82	2.71k	if (!Stream_CheckAndLogRequiredLength("fuzz", s, needed))
83	49	return -1;
84	2.66k	(void)fuzz_read_variable_uint(s, cbChId);
85	2.66k	break;
86	240	case CAPABILITY_REQUEST_PDU:
87	240	if (!Stream_CheckAndLogRequiredLength("fuzz", s, 2))
88	3	return -1;
89	237	Stream_Seek(s, 2);
90	237	break;
91	2.43k	default:
92	2.43k	break;
93	7.08k	}
94
95	7.00k	if (!Stream_CheckAndLogRequiredLength("fuzz", s, 2))
96	84	return -1;
97
98	6.92k	{
99	6.92k	size_t bodyLen = Stream_Get_UINT16(s);
100	6.92k	const size_t remaining = Stream_GetRemainingLength(s);
101	6.92k	if (bodyLen > remaining)
102	175	bodyLen = remaining;
103	6.92k	Stream_Seek(s, bodyLen);
104	6.92k	}
105
106	6.92k	return 0;
107	7.00k	}
108
109		int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
110	389	{
111	389	if ((size == 0) \|\| (size > (1u << 20)))
112	0	return 0;
113
114	389	wStream buffer = WINPR_C_ARRAY_INIT;
115	389	wStream* s = Stream_StaticConstInit(&buffer, data, size);
116	389	if (!s)
117	0	return 0;
118
119	7.31k	for (size_t index = 0; index < 64; index++)
120	7.27k	{
121	7.27k	if (Stream_GetRemainingLength(s) == 0)
122	186	break;
123	7.08k	if (fuzz_process_one_pdu(s) != 0)
124	164	break;
125	7.08k	}
126
127	389	return 0;
128	389	}

Coverage Report

Created: 2026-09-14 06:31