Coverage Report

Created: 2026-10-17 06:39

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/libcoap/tests/oss-fuzz/async_target.c
Line
Count
Source
1
#include "coap3/coap_internal.h"
2
#include "coap_fuzz_helper.h"
3
#include <stdint.h>
4
#include <string.h>
5
#include <stdlib.h>
6
7
static int
8
22
fuzz_event_handler(coap_session_t *session, const coap_event_t event) {
9
22
  (void)session;
10
22
  (void)event;
11
22
  return 0;
12
22
}
13
14
static void
15
async_handler(coap_resource_t *resource, coap_session_t *session,
16
              const coap_pdu_t *request, const coap_string_t *query,
17
13
              coap_pdu_t *response) {
18
13
  (void)resource;
19
13
  (void)query;
20
21
13
  size_t len;
22
13
  const uint8_t *databuf;
23
13
  coap_bin_const_t token = coap_pdu_get_token(request);
24
13
  coap_async_t *async = coap_find_async(session, token);
25
26
13
  if (async) {
27
0
    response->code = COAP_RESPONSE_CODE(205);
28
0
    if (coap_get_data(request, &len, &databuf) && len > 0) {
29
0
      coap_add_data(response, len, databuf);
30
0
    }
31
0
    coap_free_async(session, async);
32
13
  } else {
33
13
    response->code = COAP_RESPONSE_CODE(400);
34
13
    if (coap_get_data(request, &len, &databuf) && len > 0) {
35
12
      async = coap_register_async(session, request,
36
12
                                  (coap_tick_t)len * COAP_TICKS_PER_SECOND / 100);
37
12
      if (async && len > 1) {
38
10
        uint8_t *app_data = malloc(len);
39
10
        if (app_data) {
40
10
          memcpy(app_data, databuf, len);
41
10
          coap_async_set_app_data2(async, app_data, free);
42
10
          response->code = COAP_RESPONSE_CODE(0);
43
10
        }
44
10
      }
45
12
    }
46
13
  }
47
13
}
48
49
int
50
35
LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
51
35
  coap_context_t *ctx = NULL;
52
35
  coap_session_t *session = NULL;
53
35
  coap_resource_t *resource = NULL;
54
35
  coap_address_t addr;
55
35
  coap_pdu_t *pdu = NULL;
56
57
35
  if (size < 16)
58
6
    return 0;
59
60
29
  coap_startup();
61
29
  coap_set_log_level(COAP_LOG_EMERG);
62
29
  coap_debug_set_packet_loss("50%");
63
29
  coap_debug_set_packet_fail("100%");
64
65
29
  ctx = coap_new_context(NULL);
66
29
  if (!ctx)
67
0
    goto cleanup;
68
29
  coap_register_event_handler(ctx, fuzz_event_handler);
69
70
29
  resource = coap_resource_init(coap_make_str_const("async"), 0);
71
29
  if (resource) {
72
29
    coap_register_request_handler(resource, COAP_REQUEST_GET, async_handler);
73
29
    coap_register_request_handler(resource, COAP_REQUEST_POST, async_handler);
74
29
    coap_add_resource(ctx, resource);
75
29
  }
76
77
29
  coap_address_init(&addr);
78
29
  addr.addr.sin.sin_family = AF_INET;
79
29
  addr.addr.sin.sin_port = htons(5683);
80
29
  addr.addr.sin.sin_addr.s_addr = htonl(0x7F000001);
81
82
29
  session = coap_new_client_session(ctx, NULL, &addr, COAP_PROTO_UDP);
83
29
  if (!session)
84
0
    goto cleanup;
85
29
  session->state = COAP_SESSION_STATE_ESTABLISHED;
86
87
  /* Direct async API testing */
88
29
  size_t token_len = (size > 8) ? 8 : size;
89
29
  pdu = coap_pdu_init(COAP_MESSAGE_CON, COAP_REQUEST_CODE_GET,
90
29
                      coap_new_message_id(session), 128);
91
29
  if (pdu) {
92
29
    coap_add_token(pdu, token_len, data);
93
29
    coap_add_option(pdu, COAP_OPTION_URI_PATH, 5, (const uint8_t *)"async");
94
95
29
    coap_async_t *async = coap_register_async(session, pdu,
96
29
                                              COAP_TICKS_PER_SECOND);
97
29
    if (async) {
98
29
      coap_bin_const_t token = {.length = token_len, .s = data};
99
29
      coap_async_t *found = coap_find_async(session, token);
100
101
29
      if (found && size > token_len) {
102
29
        coap_async_set_delay(async, COAP_TICKS_PER_SECOND / 10);
103
29
        coap_async_trigger(async);
104
105
        /* Test app data operations */
106
29
        coap_async_get_app_data(async);
107
29
      }
108
109
29
      coap_free_async(session, async);
110
29
    }
111
29
    coap_delete_pdu(pdu);
112
113
    /* Test registration failure path */
114
29
    if (size > 32) {
115
19
      pdu = coap_pdu_init(COAP_MESSAGE_CON, COAP_REQUEST_CODE_POST,
116
19
                          coap_new_message_id(session), 64);
117
19
      if (pdu) {
118
19
        coap_add_token(pdu, 4, &data[16]);
119
19
        coap_async_t *async2 = coap_register_async(session, pdu, 0);
120
19
        if (async2) {
121
19
          coap_async_set_delay(async2, COAP_TICKS_PER_SECOND * 2);
122
19
          coap_free_async(session, async2);
123
19
        }
124
19
        coap_delete_pdu(pdu);
125
19
      }
126
19
    }
127
29
  }
128
129
  /* Dispatch with programmatic PDU and raw wire format */
130
29
  coap_fuzz_dispatch(ctx, session, data, size, (const uint8_t *)"async", 5);
131
132
29
cleanup:
133
29
  if (session)
134
29
    coap_session_release(session);
135
29
  if (ctx)
136
29
    coap_free_context(ctx);
137
29
  coap_cleanup();
138
29
  return 0;
139
29
}