Coverage Report

Created: 2026-06-16 07:08

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/ndpi/fuzz/fuzz_ds_tree.cpp
Line
Count
Source
1
#include "ndpi_api.h"
2
#include "fuzz_common_code.h"
3
4
#include <stdint.h>
5
#include <stdio.h>
6
#include <assert.h>
7
#include "fuzzer/FuzzedDataProvider.h"
8
9
static int __compare(const void *a, const void *b)
10
510k
{
11
510k
  u_int32_t *entry_a, *entry_b;
12
13
510k
  entry_a = (u_int32_t *)a;
14
510k
  entry_b = (u_int32_t *)b;
15
16
510k
  return *entry_a == *entry_b ? 0 : (*entry_a < *entry_b ? -1 : +1);
17
510k
}
18
static void __free(void * const node)
19
11.4k
{
20
11.4k
  u_int32_t *entry = (u_int32_t *)node;
21
11.4k
  ndpi_free(entry);
22
11.4k
}
23
static void __walk(const void *a, ndpi_VISIT which, int depth, void *user_data)
24
57.3k
{
25
57.3k
  (void)which;
26
57.3k
  (void)depth;
27
28
57.3k
  assert(user_data == NULL && a);
29
57.3k
}
30
31
248
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
32
248
  FuzzedDataProvider fuzzed_data(data, size);
33
248
  u_int16_t i, num_iteration, is_added = 0;
34
248
  void *root = NULL;
35
248
  u_int32_t *entry, value_added, e, *e2;
36
37
  /* Just to have some data */
38
248
  if (fuzzed_data.remaining_bytes() < 1024)
39
18
    return -1;
40
41
  /* To allow memory allocation failures */
42
230
  fuzz_set_alloc_callbacks_and_seed(size);
43
44
230
  num_iteration = fuzzed_data.ConsumeIntegral<u_int8_t>();
45
26.3k
  for (i = 0; i < num_iteration; i++) {
46
26.1k
    entry = (u_int32_t *)ndpi_malloc(sizeof(u_int32_t));
47
26.1k
    if (!entry)
48
1.92k
      continue;
49
24.2k
    *entry = fuzzed_data.ConsumeIntegral<u_int32_t>();
50
    
51
24.2k
    if(ndpi_tfind(entry, &root, __compare) == NULL) {
52
21.2k
      if(ndpi_tsearch(entry, fuzzed_data.ConsumeBool() ? &root : NULL, __compare) == NULL) {
53
8.79k
        ndpi_free(entry);
54
12.4k
      } else {
55
        /* Keep one random entry really added */
56
12.4k
        if (is_added == 0 && fuzzed_data.ConsumeBool()) {
57
157
          value_added = *entry;
58
157
          is_added = 1;
59
157
        }
60
12.4k
      }
61
21.2k
    } else {
62
3.03k
      ndpi_free(entry);
63
3.03k
    }
64
24.2k
  }
65
66
  /* "Random" search */
67
230
  num_iteration = fuzzed_data.ConsumeIntegral<u_int8_t>();
68
8.24k
  for (i = 0; i < num_iteration; i++) {
69
8.01k
    e = fuzzed_data.ConsumeIntegral<u_int32_t>();
70
71
8.01k
    ndpi_tfind(&e, fuzzed_data.ConsumeBool() ? &root : NULL, __compare);
72
8.01k
  }
73
  /* Search of an added node */
74
230
  if (is_added) {
75
157
    ndpi_tfind(&value_added, &root, __compare);
76
157
  }
77
78
230
  ndpi_twalk(root, __walk, NULL);
79
80
  /* "Random" delete */
81
230
  num_iteration = fuzzed_data.ConsumeIntegral<u_int8_t>();
82
13.4k
  for (i = 0; i < num_iteration; i++) {
83
13.1k
    e = fuzzed_data.ConsumeIntegral<u_int32_t>();
84
85
13.1k
    e2 = (u_int32_t *)ndpi_tdelete(&e, &root, __compare);
86
13.1k
    ndpi_free(e2);
87
13.1k
  }
88
  /* Delete of an added node */
89
230
  if (is_added) {
90
157
    e2 = (u_int32_t *)ndpi_tdelete(&value_added, &root, __compare);
91
157
    ndpi_free(e2);
92
157
  }
93
94
230
  ndpi_twalk(root, __walk, NULL);
95
96
230
  ndpi_tdestroy(root, __free);
97
98
230
  return 0;
99
248
}