/src/open62541/tests/fuzz/fuzz_binary_message.cc
Line | Count | Source |
1 | | /* This Source Code Form is subject to the terms of the Mozilla Public |
2 | | * License, v. 2.0. If a copy of the MPL was not distributed with this |
3 | | * file, You can obtain one at http://mozilla.org/MPL/2.0/. |
4 | | * |
5 | | * Copyright 2019 (c) fortiss (Author: Stefan Profanter) |
6 | | */ |
7 | | |
8 | | #include <open62541/plugin/log_stdout.h> |
9 | | #include <open62541/server_config_default.h> |
10 | | #include <open62541/types.h> |
11 | | |
12 | | #include "ua_server_internal.h" |
13 | | #include "testing_networklayers.h" |
14 | | |
15 | | #define RECEIVE_BUFFER_SIZE 65535 |
16 | | |
17 | | /* |
18 | | ** Main entry point. The fuzzer invokes this function with each |
19 | | ** fuzzed input. |
20 | | */ |
21 | | extern "C" int |
22 | 274 | LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { |
23 | 274 | if(size <= 4) |
24 | 4 | return 0; |
25 | | |
26 | | /* less debug output */ |
27 | 270 | UA_ServerConfig initialConfig; |
28 | 270 | memset(&initialConfig, 0, sizeof(UA_ServerConfig)); |
29 | 270 | UA_StatusCode retval = UA_ServerConfig_setDefault(&initialConfig); |
30 | 270 | initialConfig.allowEmptyVariables = UA_RULEHANDLING_ACCEPT; |
31 | 270 | if(retval != UA_STATUSCODE_GOOD) { |
32 | 0 | UA_ServerConfig_clean(&initialConfig); |
33 | 0 | UA_LOG_ERROR(UA_Log_Stdout, UA_LOGCATEGORY_SERVER, |
34 | 0 | "Could not generate the server config"); |
35 | 0 | return 0; |
36 | 0 | } |
37 | | |
38 | 270 | UA_Server *server = UA_Server_newWithConfig(&initialConfig); |
39 | 270 | if(!server) { |
40 | 0 | UA_LOG_ERROR(UA_Log_Stdout, UA_LOGCATEGORY_SERVER, |
41 | 0 | "Could not create server instance using UA_Server_new"); |
42 | 0 | return 0; |
43 | 0 | } |
44 | | |
45 | | // we need to copy the message because it will be freed in the processing function |
46 | 270 | UA_ByteString msg = UA_BYTESTRING_NULL; |
47 | 270 | retval = UA_ByteString_allocBuffer(&msg, size); |
48 | 270 | if(retval != UA_STATUSCODE_GOOD) { |
49 | 0 | UA_Server_delete(server); |
50 | 0 | UA_LOG_ERROR(UA_Log_Stdout, UA_LOGCATEGORY_SERVER, |
51 | 0 | "Could not allocate message buffer"); |
52 | 0 | return 0; |
53 | 0 | } |
54 | 270 | memcpy(msg.data, data, size); |
55 | | |
56 | | /* Get the binary server components */ |
57 | 270 | UA_String binStr = UA_STRING((char*)(uintptr_t)"binary"); |
58 | 270 | UA_ServerComponent *bpm = NULL; |
59 | 1.08k | for(UA_ServerComponent *sc = server->components; sc; sc = sc->next) { |
60 | 810 | if(UA_String_equal(&binStr, &sc->name)) |
61 | 270 | bpm = sc; |
62 | 810 | } |
63 | 270 | UA_assert(bpm != NULL); |
64 | | |
65 | 270 | void *ctx = NULL; |
66 | 270 | serverNetworkCallback(&testConnectionManagerTCP, 0, bpm, |
67 | 270 | &ctx, UA_CONNECTIONSTATE_ESTABLISHED, |
68 | 270 | &UA_KEYVALUEMAP_NULL, msg); |
69 | | |
70 | | // if we got an invalid chunk, the message is not deleted, so delete it here |
71 | 270 | UA_ByteString_clear(&msg); |
72 | 270 | UA_Server_delete(server); |
73 | 270 | return 0; |
74 | 270 | } |