Coverage Report

Created: 2026-04-12 07:09

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/open62541/tests/fuzz/fuzz_binary_message.cc
Line
Count
Source
1
/* This Source Code Form is subject to the terms of the Mozilla Public
2
 * License, v. 2.0. If a copy of the MPL was not distributed with this
3
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
4
 *
5
 *    Copyright 2019 (c) fortiss (Author: Stefan Profanter)
6
 */
7
8
#include <open62541/plugin/log_stdout.h>
9
#include <open62541/server_config_default.h>
10
#include <open62541/types.h>
11
12
#include "ua_server_internal.h"
13
#include "testing_networklayers.h"
14
15
#define RECEIVE_BUFFER_SIZE 65535
16
17
/*
18
** Main entry point.  The fuzzer invokes this function with each
19
** fuzzed input.
20
*/
21
extern "C" int
22
274
LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
23
274
    if(size <= 4)
24
4
        return 0;
25
26
    /* less debug output */
27
270
    UA_ServerConfig initialConfig;
28
270
    memset(&initialConfig, 0, sizeof(UA_ServerConfig));
29
270
    UA_StatusCode retval = UA_ServerConfig_setDefault(&initialConfig);
30
270
    initialConfig.allowEmptyVariables = UA_RULEHANDLING_ACCEPT;
31
270
    if(retval != UA_STATUSCODE_GOOD) {
32
0
        UA_ServerConfig_clean(&initialConfig);
33
0
        UA_LOG_ERROR(UA_Log_Stdout, UA_LOGCATEGORY_SERVER,
34
0
                     "Could not generate the server config");
35
0
        return 0;
36
0
    }
37
38
270
    UA_Server *server = UA_Server_newWithConfig(&initialConfig);
39
270
    if(!server) {
40
0
        UA_LOG_ERROR(UA_Log_Stdout, UA_LOGCATEGORY_SERVER,
41
0
                     "Could not create server instance using UA_Server_new");
42
0
        return 0;
43
0
    }
44
45
    // we need to copy the message because it will be freed in the processing function
46
270
    UA_ByteString msg = UA_BYTESTRING_NULL;
47
270
    retval = UA_ByteString_allocBuffer(&msg, size);
48
270
    if(retval != UA_STATUSCODE_GOOD) {
49
0
        UA_Server_delete(server);
50
0
        UA_LOG_ERROR(UA_Log_Stdout, UA_LOGCATEGORY_SERVER,
51
0
                     "Could not allocate message buffer");
52
0
        return 0;
53
0
    }
54
270
    memcpy(msg.data, data, size);
55
56
    /* Get the binary server components */
57
270
    UA_String binStr = UA_STRING((char*)(uintptr_t)"binary");
58
270
    UA_ServerComponent *bpm = NULL;
59
1.08k
    for(UA_ServerComponent *sc = server->components; sc; sc = sc->next) {
60
810
        if(UA_String_equal(&binStr, &sc->name))
61
270
            bpm = sc;
62
810
    }
63
270
    UA_assert(bpm != NULL);
64
65
270
    void *ctx = NULL;
66
270
    serverNetworkCallback(&testConnectionManagerTCP, 0, bpm,
67
270
                          &ctx, UA_CONNECTIONSTATE_ESTABLISHED,
68
270
                          &UA_KEYVALUEMAP_NULL, msg);
69
70
    // if we got an invalid chunk, the message is not deleted, so delete it here
71
270
    UA_ByteString_clear(&msg);
72
270
    UA_Server_delete(server);
73
270
    return 0;
74
270
}