/src/wolfmqtt-fuzzers/fuzzer.cpp

Source (jump to first uncovered line)
#include <fuzzing/datasource/datasource.hpp>
#include <wolfmqtt/mqtt_client.h>
#include <wolfmqtt/mqtt_packet.h>
#include <optional>

#define CHECK_EQ(expr, res) if ( (expr) != (res) ) { goto end; }
#define CHECK_NE(expr, res) if ( (expr) == (res) ) { goto end; }

#define BADPTR ((void*)0x12)
#define MAX_TOPICS 50

#define DEBUG 0

class Base {
    protected:
        fuzzing::datasource::Datasource& ds;
        MqttQoS GetQoS(void) const;
    public:
        Base(fuzzing::datasource::Datasource& ds);
        ~Base();
};

Base::Base(fuzzing::datasource::Datasource& ds) :
    ds(ds)
{ }

Base::~Base() { }

MqttQoS Base::GetQoS(void) const {
    switch ( ds.Get<uint8_t>() % 3 ) {
        case    0:
            return MQTT_QOS_0;
        case    1:
            return MQTT_QOS_1;
        case    2:
            return MQTT_QOS_2;
        default:
            /* Silence compiler warning */
            abort();
    }
}

class Topic : public Base {
    private:
        MqttTopic* topic;
        std::vector<std::string> strings;
    public:
        Topic(fuzzing::datasource::Datasource& ds);
        ~Topic();
        bool Generate(void);
        MqttTopic Get(void);
};

Topic::Topic(fuzzing::datasource::Datasource& ds) :
    Base(ds) {
    topic = new MqttTopic;
}

Topic::~Topic() {
    delete topic;
}

bool Topic::Generate(void) {
    bool ret;

    memset(topic, 0, sizeof(*topic));

    strings.push_back( ds.Get<std::string>() );
    topic->topic_filter = strings.back().c_str();

    topic->qos = GetQoS();

    ret = true;
end:
    return ret;
}

MqttTopic Topic::Get(void) {
    return *topic;
}

class Topics : public Base {
    private:
        std::vector<Topic*> topics;
    public:
        Topics(fuzzing::datasource::Datasource& ds);
        ~Topics();
        bool Generate(void);
        MqttTopic* ToArray(void);
        size_t Size(void) const;
};

Topics::Topics(fuzzing::datasource::Datasource& ds) :
    Base(ds)
{ }

Topics::~Topics() {
    for (auto& t : topics) {
        delete t;
    }
}
        
bool Topics::Generate(void) {
    bool ret = false;

    try {
        const auto numTopics = ds.Get<uint16_t>() % (MAX_TOPICS+1);

        for (size_t i = 0; i < numTopics; i++) {
            topics.push_back(new Topic(ds));
            CHECK_EQ(topics.back()->Generate(), true);
        }

        ret = true;
    } catch ( ... ) { }

end:
    return ret;
}

MqttTopic* Topics::ToArray(void) {
    auto ret = new MqttTopic[topics.size()];

    for (size_t i = 0; i < Size(); i++) {
        ret[i] = topics[i]->Get();
    }
    return ret;
}
        
size_t Topics::Size(void) const {
    return topics.size();
}

class wolfMQTTFuzzer : public Base {
        MqttClient* client;
        MqttNet* net;
        MqttConnect* connect;

        uint8_t* tx_buf = nullptr, *rx_buf = nullptr;
        size_t tx_size = 0, rx_size = 0;

        std::string client_id;

        void* malloc(const size_t n);
        void free(void* ptr);

        word16 GetPacketId(void) const;
        std::optional<Topic> GetTopic(void) const;

        bool subscribe(void);
        bool unsubscribe(void);
        bool publish(void);
        bool ping(void);
        bool wait(void);
    public:
        wolfMQTTFuzzer(fuzzing::datasource::Datasource& ds);
        ~wolfMQTTFuzzer();
        bool Initialize(void);
        void Run(void);
        int recv(byte* buf, const int buf_len);
        int write(const int buf_len);

};

static int mqtt_connect(void *context, const char* host, word16 port, int timeout_ms)
{
    (void)context;
    (void)host;
    (void)port;
    (void)timeout_ms;

    return MQTT_CODE_SUCCESS;
}

static int mqtt_recv(void *context, byte* buf, int buf_len, int timeout_ms)
{
    (void)context;
    (void)timeout_ms;

    auto fuzzer = static_cast<wolfMQTTFuzzer*>(context);
    return fuzzer->recv(buf, buf_len);
}

static int mqtt_write(void *context, const byte* buf, int buf_len, int timeout_ms)
{
    (void)context;
    (void)timeout_ms;
    (void)buf;

    auto fuzzer = static_cast<wolfMQTTFuzzer*>(context);
    return fuzzer->write(buf_len);
}

static int mqtt_disconnect(void *context)
{
    (void)context;

    return MQTT_CODE_SUCCESS;
}

static int mqtt_message_cb(MqttClient *client, MqttMessage *msg, byte msg_new, byte msg_done)
{
    return MQTT_CODE_SUCCESS;
}

void* wolfMQTTFuzzer::malloc(const size_t n) {
    return n == 0 ? BADPTR : ::malloc(n);
}

void wolfMQTTFuzzer::free(void* ptr) {
    if ( ptr == BADPTR ) {
        return;
    }

    ::free(ptr);
}

std::optional<Topic> wolfMQTTFuzzer::GetTopic(void) const {
    Topic topic(ds);

    if ( topic.Generate() == false ) {
        return std::nullopt;
    }

    return topic;
}

word16 wolfMQTTFuzzer::GetPacketId(void) const {
    return ds.Get<word16>();
}

bool wolfMQTTFuzzer::subscribe(void) {
    MqttTopic* topicsArray = nullptr;
    MqttSubscribe* subscribe = nullptr;

    bool ret = false;

    try {
        Topics topics(ds);
        CHECK_EQ(topics.Generate(), true);

        subscribe = new MqttSubscribe;
        memset(subscribe, 0, sizeof(*subscribe));

        subscribe->packet_id = GetPacketId();
        topicsArray = topics.ToArray();
        subscribe->topic_count = topics.Size();
        subscribe->topics = topicsArray;

        CHECK_EQ(MqttClient_Subscribe(client, subscribe), MQTT_CODE_SUCCESS);

        ret = true;
    } catch ( ... ) { }

end:
    if ( topicsArray ) {
        delete[] topicsArray;
    }

    if ( subscribe ) {
        delete subscribe;
    }
    return ret;
}

bool wolfMQTTFuzzer::unsubscribe(void) {
    MqttTopic* topicsArray = nullptr;
    MqttUnsubscribe* unsubscribe = nullptr;

    bool ret = false;

    try {
        Topics topics(ds);
        CHECK_EQ(topics.Generate(), true);

        unsubscribe = new MqttUnsubscribe;
        memset(unsubscribe, 0, sizeof(*unsubscribe));

        unsubscribe->packet_id = GetPacketId();
        topicsArray = topics.ToArray();
        unsubscribe->topic_count = topics.Size();
        unsubscribe->topics = topicsArray;

        CHECK_EQ(MqttClient_Unsubscribe(client, unsubscribe), MQTT_CODE_SUCCESS);

        ret = true;
    } catch ( ... ) { }

end:
    if ( topicsArray ) {
        delete[] topicsArray;
    }

    if ( unsubscribe ) {
        delete unsubscribe;
    }

    return ret;
}

bool wolfMQTTFuzzer::publish(void) {
    bool ret = false;
    MqttPublish* publish = nullptr;

    try {
        publish = new MqttPublish;
        memset(publish, 0, sizeof(*publish));

        publish->retain = ds.Get<bool>() ? 1 : 0;
        publish->qos = GetQoS();
        publish->duplicate = ds.Get<bool>() ? 1 : 0;

        const auto topic_str = ds.Get<std::string>();
        publish->topic_name = topic_str.c_str();

        publish->packet_id = GetPacketId();

        auto buffer = ds.GetData(0);
        publish->buffer = buffer.data();
        publish->total_len = buffer.size();

        if ( DEBUG ) {
            printf("publish: topic name size: %zu\n", strlen(topic_str.c_str()));
        }

        CHECK_EQ(MqttClient_Publish(client, publish), MQTT_CODE_SUCCESS);

        ret = true;
    } catch ( ... ) { }

end:
    if ( publish ) {
        delete publish;
    }

    return ret;
}

bool wolfMQTTFuzzer::ping(void) {
    bool ret = false;

    MqttPing* ping = new MqttPing;
    memset(ping, 0, sizeof(*ping));

    CHECK_EQ(MqttClient_Ping_ex(client, ping), true);

    ret = true;

end:
    delete ping;

    return ret;
}

bool wolfMQTTFuzzer::wait(void) {
    bool ret = false;

    CHECK_EQ(MqttClient_WaitMessage(client, 1000), MQTT_CODE_SUCCESS);

    ret = true;

end:
    return ret;
}

wolfMQTTFuzzer::wolfMQTTFuzzer(fuzzing::datasource::Datasource& ds) :
    Base(ds) {
        client = new MqttClient;
        net = new MqttNet;
        connect = new MqttConnect;
}

wolfMQTTFuzzer::~wolfMQTTFuzzer() {
    this->free(tx_buf);
    this->free(rx_buf);
    delete client;
    delete net;
    delete connect;
}

bool wolfMQTTFuzzer::Initialize(void) {
    bool ret = false;
    MqttMessage* lwt_msg = nullptr;

    try {
        /* net */
        {
            memset(net, 0, sizeof(*net));

            net->connect = mqtt_connect;
            net->read = mqtt_recv;
            net->write = mqtt_write;
            net->disconnect = mqtt_disconnect;
            net->context = this;
        }

        /* client */
        {
            memset(client, 0, sizeof(*client));

            tx_size = ds.Get<uint16_t>();
            tx_size = 4096;
            tx_buf = (uint8_t*)this->malloc(tx_size);
            rx_size = ds.Get<uint16_t>();
            rx_size = 4096;
            rx_buf = (uint8_t*)this->malloc(rx_size);
            memset(tx_buf, 0, tx_size);
            memset(rx_buf, 0, rx_size);

            client->msg_cb = mqtt_message_cb;
            client->tx_buf = tx_buf;
            client->tx_buf_len = tx_size;
            client->rx_buf = rx_buf;
            client->rx_buf_len = rx_size;
            client->cmd_timeout_ms = 1000;
        }

        /* connect */
        {
            memset(connect, 0, sizeof(*connect));

            connect->keep_alive_sec = 1;
            connect->clean_session = ds.Get<bool>() ? 1 : 0;
            client_id = ds.Get<std::string>();
            connect->client_id = client_id.c_str();
            connect->enable_lwt = ds.Get<bool>() ? 1 : 0;
        }
            
        std::string lwt_topic_name;
        std::vector<uint8_t> lwt_buffer;

        if ( connect->enable_lwt ) {
            lwt_topic_name = ds.Get<std::string>();
            lwt_buffer = ds.GetData(0);

            lwt_msg = new MqttMessage;
            memset(lwt_msg, 0, sizeof(*lwt_msg));

            connect->lwt_msg = lwt_msg;
            lwt_msg->qos = GetQoS();
            lwt_msg->retain = ds.Get<bool>() ? 1 : 0;
            lwt_msg->topic_name = lwt_topic_name.c_str();
            lwt_msg->buffer = lwt_buffer.data();
            lwt_msg->total_len = lwt_buffer.size();
        }

        CHECK_EQ(MqttSocket_Init(client, net), MQTT_CODE_SUCCESS);

#if 0
        if ( ds.Get<bool>() ) {
            //CHECK_EQ(MqttClient_SetPropertyCallback(&client, mqtt_property_cb, NULL);
        }
#endif

        CHECK_EQ(MqttClient_NetConnect(client, "dummy", 12345, 1000, 0, NULL), MQTT_CODE_SUCCESS);
        CHECK_EQ(MqttClient_Connect(client, connect), MQTT_CODE_SUCCESS);

        ret = true;
    } catch ( ... ) {
        ret = false;
    }

end:
    if ( lwt_msg ) {
        delete lwt_msg;
    }
    return ret;
}

void wolfMQTTFuzzer::Run(void) {
    try {
        const auto numActions = ds.Get<uint8_t>() % 20;

        for (size_t i = 0; i < numActions; i++) {
            switch ( ds.Get<uint8_t>() ) {
                case    0:
                    subscribe();
                    break;
                case    1:
                    unsubscribe();
                    break;
                case    2:
                    publish();
                    break;
                case    3:
                    ping();
                    break;
                case    4:
                    wait();
                    break;
            }
        }

        MqttClient_NetDisconnect(client);
    } catch ( ... ) { }
}

int wolfMQTTFuzzer::recv(byte* buf, const int buf_len) {
    try {
        const auto data = ds.GetData(0);
        const size_t copySize = buf_len > data.size() ? data.size() : buf_len;
        if ( copySize ) {
            memcpy(buf, data.data(), copySize);
        }
        if ( DEBUG )
        {
            printf("Recv: %zu bytes (%d requested)\n", copySize, buf_len);
            for (size_t i = 0; i < copySize; i++) {
                printf("%02X ", data[i]);
            }
            printf("\n");
        }
        return copySize;
    } catch ( ... ) {
        if ( DEBUG ) printf("Recv: -1\n");
        return -1;
    }
}

int wolfMQTTFuzzer::write(const int buf_len) {
    try {
        if ( ds.Get<bool>() == true ) {
            if ( DEBUG ) printf("write: -1\n");
            return -1;
        }

        const auto ret = (int)(ds.Get<uint32_t>() % (buf_len+1));
        if ( DEBUG ) printf("write: %d bytes (%d requested)\n", ret, buf_len);
        return ret;
    } catch ( ... ) {
        return -1;
    }
}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    fuzzing::datasource::Datasource ds(data, size);
    wolfMQTTFuzzer fuzzer(ds);

    CHECK_EQ(fuzzer.Initialize(), true);

    fuzzer.Run();

end:
    return 0;
}

Coverage Report

Created: 2025-07-23 06:53

Line	Count	Source (jump to first uncovered line)
1		#include <fuzzing/datasource/datasource.hpp>
2		#include <wolfmqtt/mqtt_client.h>
3		#include <wolfmqtt/mqtt_packet.h>
4		#include <optional>
5
6	23.8k	#define CHECK_EQ(expr, res) if ( (expr) != (res) ) { goto end; }
7		#define CHECK_NE(expr, res) if ( (expr) == (res) ) { goto end; }
8
9	5.94k	#define BADPTR ((void*)0x12)
10	1.68k	#define MAX_TOPICS 50
11
12	30.9k	#define DEBUG 0
13
14		class Base {
15		protected:
16		fuzzing::datasource::Datasource& ds;
17		MqttQoS GetQoS(void) const;
18		public:
19		Base(fuzzing::datasource::Datasource& ds);
20		~Base();
21		};
22
23		Base::Base(fuzzing::datasource::Datasource& ds) :
24	8.31k	ds(ds)
25	8.31k	{ }
26
27	8.31k	Base::~Base() { }
28
29	4.25k	MqttQoS Base::GetQoS(void) const {
30	4.25k	switch ( ds.Get<uint8_t>() % 3 ) {
31	3.26k	case 0:
32	3.26k	return MQTT_QOS_0;
33	495	case 1:
34	495	return MQTT_QOS_1;
35	446	case 2:
36	446	return MQTT_QOS_2;
37	0	default:
38		/* Silence compiler warning */
39	0	abort();
40	4.25k	}
41	4.25k	}
42
43		class Topic : public Base {
44		private:
45		MqttTopic* topic;
46		std::vector<std::string> strings;
47		public:
48		Topic(fuzzing::datasource::Datasource& ds);
49		~Topic();
50		bool Generate(void);
51		MqttTopic Get(void);
52		};
53
54		Topic::Topic(fuzzing::datasource::Datasource& ds) :
55	3.66k	Base(ds) {
56	3.66k	topic = new MqttTopic;
57	3.66k	}
58
59	3.66k	Topic::~Topic() {
60	3.66k	delete topic;
61	3.66k	}
62
63	3.66k	bool Topic::Generate(void) {
64	3.66k	bool ret;
65
66	3.66k	memset(topic, 0, sizeof(*topic));
67
68	3.66k	strings.push_back( ds.Get<std::string>() );
69	3.66k	topic->topic_filter = strings.back().c_str();
70
71	3.66k	topic->qos = GetQoS();
72
73	3.66k	ret = true;
74	3.66k	end:
75	3.18k	return ret;
76	3.66k	}
77
78	1.32k	MqttTopic Topic::Get(void) {
79	1.32k	return *topic;
80	1.32k	}
81
82		class Topics : public Base {
83		private:
84		std::vector<Topic*> topics;
85		public:
86		Topics(fuzzing::datasource::Datasource& ds);
87		~Topics();
88		bool Generate(void);
89		MqttTopic* ToArray(void);
90		size_t Size(void) const;
91		};
92
93		Topics::Topics(fuzzing::datasource::Datasource& ds) :
94	1.68k	Base(ds)
95	1.68k	{ }
96
97	1.68k	Topics::~Topics() {
98	3.66k	for (auto& t : topics) {
99	3.66k	delete t;
100	3.66k	}
101	1.68k	}
102
103	1.68k	bool Topics::Generate(void) {
104	1.68k	bool ret = false;
105
106	1.68k	try {
107	1.68k	const auto numTopics = ds.Get<uint16_t>() % (MAX_TOPICS+1);
108
109	5.34k	for (size_t i = 0; i < numTopics; i++) {
110	3.66k	topics.push_back(new Topic(ds));
111	3.66k	CHECK_EQ(topics.back()->Generate(), true);
112	3.66k	}
113
114	1.68k	ret = true;
115	1.68k	} catch ( ... ) { }
116
117	1.68k	end:
118	1.68k	return ret;
119	1.68k	}
120
121	1.15k	MqttTopic* Topics::ToArray(void) {
122	1.15k	auto ret = new MqttTopic[topics.size()];
123
124	2.48k	for (size_t i = 0; i < Size(); i++) {
125	1.32k	ret[i] = topics[i]->Get();
126	1.32k	}
127	1.15k	return ret;
128	1.15k	}
129
130	3.63k	size_t Topics::Size(void) const {
131	3.63k	return topics.size();
132	3.63k	}
133
134		class wolfMQTTFuzzer : public Base {
135		MqttClient* client;
136		MqttNet* net;
137		MqttConnect* connect;
138
139		uint8_t* tx_buf = nullptr, *rx_buf = nullptr;
140		size_t tx_size = 0, rx_size = 0;
141
142		std::string client_id;
143
144		void* malloc(const size_t n);
145		void free(void* ptr);
146
147		word16 GetPacketId(void) const;
148		std::optional<Topic> GetTopic(void) const;
149
150		bool subscribe(void);
151		bool unsubscribe(void);
152		bool publish(void);
153		bool ping(void);
154		bool wait(void);
155		public:
156		wolfMQTTFuzzer(fuzzing::datasource::Datasource& ds);
157		~wolfMQTTFuzzer();
158		bool Initialize(void);
159		void Run(void);
160		int recv(byte* buf, const int buf_len);
161		int write(const int buf_len);
162
163		};
164
165		static int mqtt_connect(void context, const char host, word16 port, int timeout_ms)
166	2.79k	{
167	2.79k	(void)context;
168	2.79k	(void)host;
169	2.79k	(void)port;
170	2.79k	(void)timeout_ms;
171
172	2.79k	return MQTT_CODE_SUCCESS;
173	2.79k	}
174
175		static int mqtt_recv(void context, byte buf, int buf_len, int timeout_ms)
176	19.1k	{
177	19.1k	(void)context;
178	19.1k	(void)timeout_ms;
179
180	19.1k	auto fuzzer = static_cast<wolfMQTTFuzzer*>(context);
181	19.1k	return fuzzer->recv(buf, buf_len);
182	19.1k	}
183
184		static int mqtt_write(void context, const byte buf, int buf_len, int timeout_ms)
185	9.01k	{
186	9.01k	(void)context;
187	9.01k	(void)timeout_ms;
188	9.01k	(void)buf;
189
190	9.01k	auto fuzzer = static_cast<wolfMQTTFuzzer*>(context);
191	9.01k	return fuzzer->write(buf_len);
192	9.01k	}
193
194		static int mqtt_disconnect(void *context)
195	94	{
196	94	(void)context;
197
198	94	return MQTT_CODE_SUCCESS;
199	94	}
200
201		static int mqtt_message_cb(MqttClient client, MqttMessage msg, byte msg_new, byte msg_done)
202	4.08k	{
203	4.08k	return MQTT_CODE_SUCCESS;
204	4.08k	}
205
206	5.82k	void* wolfMQTTFuzzer::malloc(const size_t n) {
207	5.82k	return n == 0 ? BADPTR : ::malloc(n);
208	5.82k	}
209
210	5.94k	void wolfMQTTFuzzer::free(void* ptr) {
211	5.94k	if ( ptr == BADPTR ) {
212	0	return;
213	0	}
214
215	5.94k	::free(ptr);
216	5.94k	}
217
218	0	std::optional<Topic> wolfMQTTFuzzer::GetTopic(void) const {
219	0	Topic topic(ds);
220
221	0	if ( topic.Generate() == false ) {
222	0	return std::nullopt;
223	0	}
224
225	0	return topic;
226	0	}
227
228	2.01k	word16 wolfMQTTFuzzer::GetPacketId(void) const {
229	2.01k	return ds.Get<word16>();
230	2.01k	}
231
232	1.19k	bool wolfMQTTFuzzer::subscribe(void) {
233	1.19k	MqttTopic* topicsArray = nullptr;
234	1.19k	MqttSubscribe* subscribe = nullptr;
235
236	1.19k	bool ret = false;
237
238	1.19k	try {
239	1.19k	Topics topics(ds);
240	1.19k	CHECK_EQ(topics.Generate(), true);
241
242	800	subscribe = new MqttSubscribe;
243	800	memset(subscribe, 0, sizeof(*subscribe));
244
245	800	subscribe->packet_id = GetPacketId();
246	800	topicsArray = topics.ToArray();
247	800	subscribe->topic_count = topics.Size();
248	800	subscribe->topics = topicsArray;
249
250	800	CHECK_EQ(MqttClient_Subscribe(client, subscribe), MQTT_CODE_SUCCESS);
251
252	283	ret = true;
253	283	} catch ( ... ) { }
254
255	1.19k	end:
256	1.19k	if ( topicsArray ) {
257	780	delete[] topicsArray;
258	780	}
259
260	1.19k	if ( subscribe ) {
261	800	delete subscribe;
262	800	}
263	1.19k	return ret;
264	1.19k	}
265
266	489	bool wolfMQTTFuzzer::unsubscribe(void) {
267	489	MqttTopic* topicsArray = nullptr;
268	489	MqttUnsubscribe* unsubscribe = nullptr;
269
270	489	bool ret = false;
271
272	489	try {
273	489	Topics topics(ds);
274	489	CHECK_EQ(topics.Generate(), true);
275
276	380	unsubscribe = new MqttUnsubscribe;
277	380	memset(unsubscribe, 0, sizeof(*unsubscribe));
278
279	380	unsubscribe->packet_id = GetPacketId();
280	380	topicsArray = topics.ToArray();
281	380	unsubscribe->topic_count = topics.Size();
282	380	unsubscribe->topics = topicsArray;
283
284	380	CHECK_EQ(MqttClient_Unsubscribe(client, unsubscribe), MQTT_CODE_SUCCESS);
285
286	55	ret = true;
287	55	} catch ( ... ) { }
288
289	489	end:
290	489	if ( topicsArray ) {
291	375	delete[] topicsArray;
292	375	}
293
294	489	if ( unsubscribe ) {
295	380	delete unsubscribe;
296	380	}
297
298	489	return ret;
299	489	}
300
301	1.00k	bool wolfMQTTFuzzer::publish(void) {
302	1.00k	bool ret = false;
303	1.00k	MqttPublish* publish = nullptr;
304
305	1.00k	try {
306	1.00k	publish = new MqttPublish;
307	1.00k	memset(publish, 0, sizeof(*publish));
308
309	1.00k	publish->retain = ds.Get<bool>() ? 1 : 0;
310	1.00k	publish->qos = GetQoS();
311	1.00k	publish->duplicate = ds.Get<bool>() ? 1 : 0;
312
313	1.00k	const auto topic_str = ds.Get<std::string>();
314	1.00k	publish->topic_name = topic_str.c_str();
315
316	1.00k	publish->packet_id = GetPacketId();
317
318	1.00k	auto buffer = ds.GetData(0);
319	1.00k	publish->buffer = buffer.data();
320	1.00k	publish->total_len = buffer.size();
321
322	1.00k	if ( DEBUG ) {
323	0	printf("publish: topic name size: %zu\n", strlen(topic_str.c_str()));
324	0	}
325
326	1.00k	CHECK_EQ(MqttClient_Publish(client, publish), MQTT_CODE_SUCCESS);
327
328	420	ret = true;
329	420	} catch ( ... ) { }
330
331	1.00k	end:
332	1.00k	if ( publish ) {
333	1.00k	delete publish;
334	1.00k	}
335
336	1.00k	return ret;
337	1.00k	}
338
339	961	bool wolfMQTTFuzzer::ping(void) {
340	961	bool ret = false;
341
342	961	MqttPing* ping = new MqttPing;
343	961	memset(ping, 0, sizeof(*ping));
344
345	961	CHECK_EQ(MqttClient_Ping_ex(client, ping), true);
346
347	0	ret = true;
348
349	961	end:
350	961	delete ping;
351
352	961	return ret;
353	0	}
354
355	3.42k	bool wolfMQTTFuzzer::wait(void) {
356	3.42k	bool ret = false;
357
358	3.42k	CHECK_EQ(MqttClient_WaitMessage(client, 1000), MQTT_CODE_SUCCESS);
359
360	821	ret = true;
361
362	3.42k	end:
363	3.42k	return ret;
364	821	}
365
366		wolfMQTTFuzzer::wolfMQTTFuzzer(fuzzing::datasource::Datasource& ds) :
367	2.97k	Base(ds) {
368	2.97k	client = new MqttClient;
369	2.97k	net = new MqttNet;
370	2.97k	connect = new MqttConnect;
371	2.97k	}
372
373	2.97k	wolfMQTTFuzzer::~wolfMQTTFuzzer() {
374	2.97k	this->free(tx_buf);
375	2.97k	this->free(rx_buf);
376	2.97k	delete client;
377	2.97k	delete net;
378	2.97k	delete connect;
379	2.97k	}
380
381	2.97k	bool wolfMQTTFuzzer::Initialize(void) {
382	2.97k	bool ret = false;
383	2.97k	MqttMessage* lwt_msg = nullptr;
384
385	2.97k	try {
386		/* net */
387	2.97k	{
388	2.97k	memset(net, 0, sizeof(*net));
389
390	2.97k	net->connect = mqtt_connect;
391	2.97k	net->read = mqtt_recv;
392	2.97k	net->write = mqtt_write;
393	2.97k	net->disconnect = mqtt_disconnect;
394	2.97k	net->context = this;
395	2.97k	}
396
397		/* client */
398	2.97k	{
399	2.97k	memset(client, 0, sizeof(*client));
400
401	2.97k	tx_size = ds.Get<uint16_t>();
402	2.97k	tx_size = 4096;
403	2.97k	tx_buf = (uint8_t*)this->malloc(tx_size);
404	2.97k	rx_size = ds.Get<uint16_t>();
405	2.97k	rx_size = 4096;
406	2.97k	rx_buf = (uint8_t*)this->malloc(rx_size);
407	2.97k	memset(tx_buf, 0, tx_size);
408	2.97k	memset(rx_buf, 0, rx_size);
409
410	2.97k	client->msg_cb = mqtt_message_cb;
411	2.97k	client->tx_buf = tx_buf;
412	2.97k	client->tx_buf_len = tx_size;
413	2.97k	client->rx_buf = rx_buf;
414	2.97k	client->rx_buf_len = rx_size;
415	2.97k	client->cmd_timeout_ms = 1000;
416	2.97k	}
417
418		/* connect */
419	2.97k	{
420	2.97k	memset(connect, 0, sizeof(*connect));
421
422	2.97k	connect->keep_alive_sec = 1;
423	2.97k	connect->clean_session = ds.Get<bool>() ? 1 : 0;
424	2.97k	client_id = ds.Get<std::string>();
425	2.97k	connect->client_id = client_id.c_str();
426	2.97k	connect->enable_lwt = ds.Get<bool>() ? 1 : 0;
427	2.97k	}
428
429	2.97k	std::string lwt_topic_name;
430	2.97k	std::vector<uint8_t> lwt_buffer;
431
432	2.97k	if ( connect->enable_lwt ) {
433	31	lwt_topic_name = ds.Get<std::string>();
434	31	lwt_buffer = ds.GetData(0);
435
436	31	lwt_msg = new MqttMessage;
437	31	memset(lwt_msg, 0, sizeof(*lwt_msg));
438
439	31	connect->lwt_msg = lwt_msg;
440	31	lwt_msg->qos = GetQoS();
441	31	lwt_msg->retain = ds.Get<bool>() ? 1 : 0;
442	31	lwt_msg->topic_name = lwt_topic_name.c_str();
443	31	lwt_msg->buffer = lwt_buffer.data();
444	31	lwt_msg->total_len = lwt_buffer.size();
445	31	}
446
447	2.97k	CHECK_EQ(MqttSocket_Init(client, net), MQTT_CODE_SUCCESS);
448
449		#if 0
450		if ( ds.Get<bool>() ) {
451		//CHECK_EQ(MqttClient_SetPropertyCallback(&client, mqtt_property_cb, NULL);
452		}
453		#endif
454
455	2.97k	CHECK_EQ(MqttClient_NetConnect(client, "dummy", 12345, 1000, 0, NULL), MQTT_CODE_SUCCESS);
456	2.97k	CHECK_EQ(MqttClient_Connect(client, connect), MQTT_CODE_SUCCESS);
457
458	1.96k	ret = true;
459	1.96k	} catch ( ... ) {
460	174	ret = false;
461	174	}
462
463	2.97k	end:
464	2.97k	if ( lwt_msg ) {
465	25	delete lwt_msg;
466	25	}
467	2.97k	return ret;
468	2.97k	}
469
470	1.78k	void wolfMQTTFuzzer::Run(void) {
471	1.78k	try {
472	1.78k	const auto numActions = ds.Get<uint8_t>() % 20;
473
474	9.60k	for (size_t i = 0; i < numActions; i++) {
475	9.48k	switch ( ds.Get<uint8_t>() ) {
476	1.19k	case 0:
477	1.19k	subscribe();
478	1.19k	break;
479	489	case 1:
480	489	unsubscribe();
481	489	break;
482	1.00k	case 2:
483	1.00k	publish();
484	1.00k	break;
485	961	case 3:
486	961	ping();
487	961	break;
488	3.42k	case 4:
489	3.42k	wait();
490	3.42k	break;
491	9.48k	}
492	9.48k	}
493
494	123	MqttClient_NetDisconnect(client);
495	1.69k	} catch ( ... ) { }
496	1.78k	}
497
498	19.1k	int wolfMQTTFuzzer::recv(byte* buf, const int buf_len) {
499	19.1k	try {
500	19.1k	const auto data = ds.GetData(0);
501	19.1k	const size_t copySize = buf_len > data.size() ? data.size() : buf_len;
502	19.1k	if ( copySize ) {
503	14.3k	memcpy(buf, data.data(), copySize);
504	14.3k	}
505	19.1k	if ( DEBUG )
506	0	{
507	0	printf("Recv: %zu bytes (%d requested)\n", copySize, buf_len);
508	0	for (size_t i = 0; i < copySize; i++) {
509	0	printf("%02X ", data[i]);
510	0	}
511	0	printf("\n");
512	0	}
513	19.1k	return copySize;
514	19.1k	} catch ( ... ) {
515	1.80k	if ( DEBUG ) printf("Recv: -1\n");
516	1.80k	return -1;
517	1.80k	}
518	19.1k	}
519
520	9.01k	int wolfMQTTFuzzer::write(const int buf_len) {
521	9.01k	try {
522	9.01k	if ( ds.Get<bool>() == true ) {
523	856	if ( DEBUG ) printf("write: -1\n");
524	856	return -1;
525	856	}
526
527	8.15k	const auto ret = (int)(ds.Get<uint32_t>() % (buf_len+1));
528	8.15k	if ( DEBUG ) printf("write: %d bytes (%d requested)\n", ret, buf_len);
529	8.15k	return ret;
530	9.01k	} catch ( ... ) {
531	703	return -1;
532	703	}
533	9.01k	}
534
535	2.97k	extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
536	2.97k	fuzzing::datasource::Datasource ds(data, size);
537	2.97k	wolfMQTTFuzzer fuzzer(ds);
538
539	2.97k	CHECK_EQ(fuzzer.Initialize(), true);
540
541	1.78k	fuzzer.Run();
542
543	2.97k	end:
544	2.97k	return 0;
545	1.78k	}