/src/wolfmqtt-fuzzers/fuzzer.cpp

Source (jump to first uncovered line)
#include <fuzzing/datasource/datasource.hpp>
#include <wolfmqtt/mqtt_client.h>
#include <wolfmqtt/mqtt_packet.h>
#include <optional>

#define CHECK_EQ(expr, res) if ( (expr) != (res) ) { goto end; }
#define CHECK_NE(expr, res) if ( (expr) == (res) ) { goto end; }

#define BADPTR ((void*)0x12)
#define MAX_TOPICS 50

#define DEBUG 0

class Base {
    protected:
        fuzzing::datasource::Datasource& ds;
        MqttQoS GetQoS(void) const;
    public:
        Base(fuzzing::datasource::Datasource& ds);
        ~Base();
};

Base::Base(fuzzing::datasource::Datasource& ds) :
    ds(ds)
{ }

Base::~Base() { }

MqttQoS Base::GetQoS(void) const {
    switch ( ds.Get<uint8_t>() % 3 ) {
        case    0:
            return MQTT_QOS_0;
        case    1:
            return MQTT_QOS_1;
        case    2:
            return MQTT_QOS_2;
        default:
            /* Silence compiler warning */
            abort();
    }
}

class Topic : public Base {
    private:
        MqttTopic* topic;
        std::vector<std::string> strings;
    public:
        Topic(fuzzing::datasource::Datasource& ds);
        ~Topic();
        bool Generate(void);
        MqttTopic Get(void);
};

Topic::Topic(fuzzing::datasource::Datasource& ds) :
    Base(ds) {
    topic = new MqttTopic;
}

Topic::~Topic() {
    delete topic;
}

bool Topic::Generate(void) {
    bool ret;

    memset(topic, 0, sizeof(*topic));

    strings.push_back( ds.Get<std::string>() );
    topic->topic_filter = strings.back().c_str();

    topic->qos = GetQoS();

    ret = true;
end:
    return ret;
}

MqttTopic Topic::Get(void) {
    return *topic;
}

class Topics : public Base {
    private:
        std::vector<Topic*> topics;
    public:
        Topics(fuzzing::datasource::Datasource& ds);
        ~Topics();
        bool Generate(void);
        MqttTopic* ToArray(void);
        size_t Size(void) const;
};

Topics::Topics(fuzzing::datasource::Datasource& ds) :
    Base(ds)
{ }

Topics::~Topics() {
    for (auto& t : topics) {
        delete t;
    }
}
        
bool Topics::Generate(void) {
    bool ret = false;

    try {
        const auto numTopics = ds.Get<uint16_t>() % (MAX_TOPICS+1);

        for (size_t i = 0; i < numTopics; i++) {
            topics.push_back(new Topic(ds));
            CHECK_EQ(topics.back()->Generate(), true);
        }

        ret = true;
    } catch ( ... ) { }

end:
    return ret;
}

MqttTopic* Topics::ToArray(void) {
    auto ret = new MqttTopic[topics.size()];

    for (size_t i = 0; i < Size(); i++) {
        ret[i] = topics[i]->Get();
    }
    return ret;
}
        
size_t Topics::Size(void) const {
    return topics.size();
}

class wolfMQTTFuzzer : public Base {
        MqttClient* client;
        MqttNet* net;
        MqttConnect* connect;

        uint8_t* tx_buf = nullptr, *rx_buf = nullptr;
        size_t tx_size = 0, rx_size = 0;

        std::string client_id;

        void* malloc(const size_t n);
        void free(void* ptr);

        word16 GetPacketId(void) const;
        std::optional<Topic> GetTopic(void) const;

        bool subscribe(void);
        bool unsubscribe(void);
        bool publish(void);
        bool ping(void);
        bool wait(void);
    public:
        wolfMQTTFuzzer(fuzzing::datasource::Datasource& ds);
        ~wolfMQTTFuzzer();
        bool Initialize(void);
        void Run(void);
        int recv(byte* buf, const int buf_len);
        int write(const int buf_len);

};

static int mqtt_connect(void *context, const char* host, word16 port, int timeout_ms)
{
    (void)context;
    (void)host;
    (void)port;
    (void)timeout_ms;

    return MQTT_CODE_SUCCESS;
}

static int mqtt_recv(void *context, byte* buf, int buf_len, int timeout_ms)
{
    (void)context;
    (void)timeout_ms;

    auto fuzzer = static_cast<wolfMQTTFuzzer*>(context);
    return fuzzer->recv(buf, buf_len);
}

static int mqtt_write(void *context, const byte* buf, int buf_len, int timeout_ms)
{
    (void)context;
    (void)timeout_ms;
    (void)buf;

    auto fuzzer = static_cast<wolfMQTTFuzzer*>(context);
    return fuzzer->write(buf_len);
}

static int mqtt_disconnect(void *context)
{
    (void)context;

    return MQTT_CODE_SUCCESS;
}

static int mqtt_message_cb(MqttClient *client, MqttMessage *msg, byte msg_new, byte msg_done)
{
    return MQTT_CODE_SUCCESS;
}

void* wolfMQTTFuzzer::malloc(const size_t n) {
    return n == 0 ? BADPTR : ::malloc(n);
}

void wolfMQTTFuzzer::free(void* ptr) {
    if ( ptr == BADPTR ) {
        return;
    }

    ::free(ptr);
}

std::optional<Topic> wolfMQTTFuzzer::GetTopic(void) const {
    Topic topic(ds);

    if ( topic.Generate() == false ) {
        return std::nullopt;
    }

    return topic;
}

word16 wolfMQTTFuzzer::GetPacketId(void) const {
    return ds.Get<word16>();
}

bool wolfMQTTFuzzer::subscribe(void) {
    MqttTopic* topicsArray = nullptr;
    MqttSubscribe* subscribe = nullptr;

    bool ret = false;

    try {
        Topics topics(ds);
        CHECK_EQ(topics.Generate(), true);

        subscribe = new MqttSubscribe;
        memset(subscribe, 0, sizeof(*subscribe));

        subscribe->packet_id = GetPacketId();
        topicsArray = topics.ToArray();
        subscribe->topic_count = topics.Size();
        subscribe->topics = topicsArray;

        CHECK_EQ(MqttClient_Subscribe(client, subscribe), MQTT_CODE_SUCCESS);

        ret = true;
    } catch ( ... ) { }

end:
    if ( topicsArray ) {
        delete[] topicsArray;
    }

    if ( subscribe ) {
        delete subscribe;
    }
    return ret;
}

bool wolfMQTTFuzzer::unsubscribe(void) {
    MqttTopic* topicsArray = nullptr;
    MqttUnsubscribe* unsubscribe = nullptr;

    bool ret = false;

    try {
        Topics topics(ds);
        CHECK_EQ(topics.Generate(), true);

        unsubscribe = new MqttUnsubscribe;
        memset(unsubscribe, 0, sizeof(*unsubscribe));

        unsubscribe->packet_id = GetPacketId();
        topicsArray = topics.ToArray();
        unsubscribe->topic_count = topics.Size();
        unsubscribe->topics = topicsArray;

        CHECK_EQ(MqttClient_Unsubscribe(client, unsubscribe), MQTT_CODE_SUCCESS);

        ret = true;
    } catch ( ... ) { }

end:
    if ( topicsArray ) {
        delete[] topicsArray;
    }

    if ( unsubscribe ) {
        delete unsubscribe;
    }

    return ret;
}

bool wolfMQTTFuzzer::publish(void) {
    bool ret = false;
    MqttPublish* publish = nullptr;

    try {
        publish = new MqttPublish;
        memset(publish, 0, sizeof(*publish));

        publish->retain = ds.Get<bool>() ? 1 : 0;
        publish->qos = GetQoS();
        publish->duplicate = ds.Get<bool>() ? 1 : 0;

        const auto topic_str = ds.Get<std::string>();
        publish->topic_name = topic_str.c_str();

        publish->packet_id = GetPacketId();

        auto buffer = ds.GetData(0);
        publish->buffer = buffer.data();
        publish->total_len = buffer.size();

        if ( DEBUG ) {
            printf("publish: topic name size: %zu\n", strlen(topic_str.c_str()));
        }

        CHECK_EQ(MqttClient_Publish(client, publish), MQTT_CODE_SUCCESS);

        ret = true;
    } catch ( ... ) { }

end:
    if ( publish ) {
        delete publish;
    }

    return ret;
}

bool wolfMQTTFuzzer::ping(void) {
    bool ret = false;

    MqttPing* ping = new MqttPing;
    memset(ping, 0, sizeof(*ping));

    CHECK_EQ(MqttClient_Ping_ex(client, ping), true);

    ret = true;

end:
    delete ping;

    return ret;
}

bool wolfMQTTFuzzer::wait(void) {
    bool ret = false;

    CHECK_EQ(MqttClient_WaitMessage(client, 1000), MQTT_CODE_SUCCESS);

    ret = true;

end:
    return ret;
}

wolfMQTTFuzzer::wolfMQTTFuzzer(fuzzing::datasource::Datasource& ds) :
    Base(ds) {
        client = new MqttClient;
        net = new MqttNet;
        connect = new MqttConnect;
}

wolfMQTTFuzzer::~wolfMQTTFuzzer() {
    this->free(tx_buf);
    this->free(rx_buf);
    delete client;
    delete net;
    delete connect;
}

bool wolfMQTTFuzzer::Initialize(void) {
    bool ret = false;
    MqttMessage* lwt_msg = nullptr;

    try {
        /* net */
        {
            memset(net, 0, sizeof(*net));

            net->connect = mqtt_connect;
            net->read = mqtt_recv;
            net->write = mqtt_write;
            net->disconnect = mqtt_disconnect;
            net->context = this;
        }

        /* client */
        {
            memset(client, 0, sizeof(*client));

            tx_size = ds.Get<uint16_t>();
            tx_size = 4096;
            tx_buf = (uint8_t*)this->malloc(tx_size);
            rx_size = ds.Get<uint16_t>();
            rx_size = 4096;
            rx_buf = (uint8_t*)this->malloc(rx_size);
            memset(tx_buf, 0, tx_size);
            memset(rx_buf, 0, rx_size);

            client->msg_cb = mqtt_message_cb;
            client->tx_buf = tx_buf;
            client->tx_buf_len = tx_size;
            client->rx_buf = rx_buf;
            client->rx_buf_len = rx_size;
            client->cmd_timeout_ms = 1000;
        }

        /* connect */
        {
            memset(connect, 0, sizeof(*connect));

            connect->keep_alive_sec = 1;
            connect->clean_session = ds.Get<bool>() ? 1 : 0;
            client_id = ds.Get<std::string>();
            connect->client_id = client_id.c_str();
            connect->enable_lwt = ds.Get<bool>() ? 1 : 0;
        }
            
        std::string lwt_topic_name;
        std::vector<uint8_t> lwt_buffer;

        if ( connect->enable_lwt ) {
            lwt_topic_name = ds.Get<std::string>();
            lwt_buffer = ds.GetData(0);

            lwt_msg = new MqttMessage;
            memset(lwt_msg, 0, sizeof(*lwt_msg));

            connect->lwt_msg = lwt_msg;
            lwt_msg->qos = GetQoS();
            lwt_msg->retain = ds.Get<bool>() ? 1 : 0;
            lwt_msg->topic_name = lwt_topic_name.c_str();
            lwt_msg->buffer = lwt_buffer.data();
            lwt_msg->total_len = lwt_buffer.size();
        }

        CHECK_EQ(MqttSocket_Init(client, net), MQTT_CODE_SUCCESS);

#if 0
        if ( ds.Get<bool>() ) {
            //CHECK_EQ(MqttClient_SetPropertyCallback(&client, mqtt_property_cb, NULL);
        }
#endif

        CHECK_EQ(MqttClient_NetConnect(client, "dummy", 12345, 1000, 0, NULL), MQTT_CODE_SUCCESS);
        CHECK_EQ(MqttClient_Connect(client, connect), MQTT_CODE_SUCCESS);

        ret = true;
    } catch ( ... ) {
        ret = false;
    }

end:
    if ( lwt_msg ) {
        delete lwt_msg;
    }
    return ret;
}

void wolfMQTTFuzzer::Run(void) {
    try {
        const auto numActions = ds.Get<uint8_t>() % 20;

        for (size_t i = 0; i < numActions; i++) {
            switch ( ds.Get<uint8_t>() ) {
                case    0:
                    subscribe();
                    break;
                case    1:
                    unsubscribe();
                    break;
                case    2:
                    publish();
                    break;
                case    3:
                    ping();
                    break;
                case    4:
                    wait();
                    break;
            }
        }

        MqttClient_NetDisconnect(client);
    } catch ( ... ) { }
}

int wolfMQTTFuzzer::recv(byte* buf, const int buf_len) {
    try {
        const auto data = ds.GetData(0);
        const size_t copySize = buf_len > data.size() ? data.size() : buf_len;
        if ( copySize ) {
            memcpy(buf, data.data(), copySize);
        }
        if ( DEBUG )
        {
            printf("Recv: %zu bytes (%d requested)\n", copySize, buf_len);
            for (size_t i = 0; i < copySize; i++) {
                printf("%02X ", data[i]);
            }
            printf("\n");
        }
        return copySize;
    } catch ( ... ) {
        if ( DEBUG ) printf("Recv: -1\n");
        return -1;
    }
}

int wolfMQTTFuzzer::write(const int buf_len) {
    try {
        if ( ds.Get<bool>() == true ) {
            if ( DEBUG ) printf("write: -1\n");
            return -1;
        }

        const auto ret = (int)(ds.Get<uint32_t>() % (buf_len+1));
        if ( DEBUG ) printf("write: %d bytes (%d requested)\n", ret, buf_len);
        return ret;
    } catch ( ... ) {
        return -1;
    }
}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    fuzzing::datasource::Datasource ds(data, size);
    wolfMQTTFuzzer fuzzer(ds);

    CHECK_EQ(fuzzer.Initialize(), true);

    fuzzer.Run();

end:
    return 0;
}

Coverage Report

Created: 2025-09-01 06:47

Line	Count	Source (jump to first uncovered line)
1		#include <fuzzing/datasource/datasource.hpp>
2		#include <wolfmqtt/mqtt_client.h>
3		#include <wolfmqtt/mqtt_packet.h>
4		#include <optional>
5
6	24.2k	#define CHECK_EQ(expr, res) if ( (expr) != (res) ) { goto end; }
7		#define CHECK_NE(expr, res) if ( (expr) == (res) ) { goto end; }
8
9	6.10k	#define BADPTR ((void*)0x12)
10	1.69k	#define MAX_TOPICS 50
11
12	31.4k	#define DEBUG 0
13
14		class Base {
15		protected:
16		fuzzing::datasource::Datasource& ds;
17		MqttQoS GetQoS(void) const;
18		public:
19		Base(fuzzing::datasource::Datasource& ds);
20		~Base();
21		};
22
23		Base::Base(fuzzing::datasource::Datasource& ds) :
24	8.38k	ds(ds)
25	8.38k	{ }
26
27	8.38k	Base::~Base() { }
28
29	4.22k	MqttQoS Base::GetQoS(void) const {
30	4.22k	switch ( ds.Get<uint8_t>() % 3 ) {
31	3.18k	case 0:
32	3.18k	return MQTT_QOS_0;
33	397	case 1:
34	397	return MQTT_QOS_1;
35	593	case 2:
36	593	return MQTT_QOS_2;
37	0	default:
38		/* Silence compiler warning */
39	0	abort();
40	4.22k	}
41	4.22k	}
42
43		class Topic : public Base {
44		private:
45		MqttTopic* topic;
46		std::vector<std::string> strings;
47		public:
48		Topic(fuzzing::datasource::Datasource& ds);
49		~Topic();
50		bool Generate(void);
51		MqttTopic Get(void);
52		};
53
54		Topic::Topic(fuzzing::datasource::Datasource& ds) :
55	3.62k	Base(ds) {
56	3.62k	topic = new MqttTopic;
57	3.62k	}
58
59	3.62k	Topic::~Topic() {
60	3.62k	delete topic;
61	3.62k	}
62
63	3.62k	bool Topic::Generate(void) {
64	3.62k	bool ret;
65
66	3.62k	memset(topic, 0, sizeof(*topic));
67
68	3.62k	strings.push_back( ds.Get<std::string>() );
69	3.62k	topic->topic_filter = strings.back().c_str();
70
71	3.62k	topic->qos = GetQoS();
72
73	3.62k	ret = true;
74	3.62k	end:
75	3.16k	return ret;
76	3.62k	}
77
78	1.36k	MqttTopic Topic::Get(void) {
79	1.36k	return *topic;
80	1.36k	}
81
82		class Topics : public Base {
83		private:
84		std::vector<Topic*> topics;
85		public:
86		Topics(fuzzing::datasource::Datasource& ds);
87		~Topics();
88		bool Generate(void);
89		MqttTopic* ToArray(void);
90		size_t Size(void) const;
91		};
92
93		Topics::Topics(fuzzing::datasource::Datasource& ds) :
94	1.69k	Base(ds)
95	1.69k	{ }
96
97	1.69k	Topics::~Topics() {
98	3.62k	for (auto& t : topics) {
99	3.62k	delete t;
100	3.62k	}
101	1.69k	}
102
103	1.69k	bool Topics::Generate(void) {
104	1.69k	bool ret = false;
105
106	1.69k	try {
107	1.69k	const auto numTopics = ds.Get<uint16_t>() % (MAX_TOPICS+1);
108
109	5.32k	for (size_t i = 0; i < numTopics; i++) {
110	3.62k	topics.push_back(new Topic(ds));
111	3.62k	CHECK_EQ(topics.back()->Generate(), true);
112	3.62k	}
113
114	1.69k	ret = true;
115	1.69k	} catch ( ... ) { }
116
117	1.69k	end:
118	1.69k	return ret;
119	1.69k	}
120
121	1.16k	MqttTopic* Topics::ToArray(void) {
122	1.16k	auto ret = new MqttTopic[topics.size()];
123
124	2.53k	for (size_t i = 0; i < Size(); i++) {
125	1.36k	ret[i] = topics[i]->Get();
126	1.36k	}
127	1.16k	return ret;
128	1.16k	}
129
130	3.70k	size_t Topics::Size(void) const {
131	3.70k	return topics.size();
132	3.70k	}
133
134		class wolfMQTTFuzzer : public Base {
135		MqttClient* client;
136		MqttNet* net;
137		MqttConnect* connect;
138
139		uint8_t* tx_buf = nullptr, *rx_buf = nullptr;
140		size_t tx_size = 0, rx_size = 0;
141
142		std::string client_id;
143
144		void* malloc(const size_t n);
145		void free(void* ptr);
146
147		word16 GetPacketId(void) const;
148		std::optional<Topic> GetTopic(void) const;
149
150		bool subscribe(void);
151		bool unsubscribe(void);
152		bool publish(void);
153		bool ping(void);
154		bool wait(void);
155		public:
156		wolfMQTTFuzzer(fuzzing::datasource::Datasource& ds);
157		~wolfMQTTFuzzer();
158		bool Initialize(void);
159		void Run(void);
160		int recv(byte* buf, const int buf_len);
161		int write(const int buf_len);
162
163		};
164
165		static int mqtt_connect(void context, const char host, word16 port, int timeout_ms)
166	2.87k	{
167	2.87k	(void)context;
168	2.87k	(void)host;
169	2.87k	(void)port;
170	2.87k	(void)timeout_ms;
171
172	2.87k	return MQTT_CODE_SUCCESS;
173	2.87k	}
174
175		static int mqtt_recv(void context, byte buf, int buf_len, int timeout_ms)
176	19.3k	{
177	19.3k	(void)context;
178	19.3k	(void)timeout_ms;
179
180	19.3k	auto fuzzer = static_cast<wolfMQTTFuzzer*>(context);
181	19.3k	return fuzzer->recv(buf, buf_len);
182	19.3k	}
183
184		static int mqtt_write(void context, const byte buf, int buf_len, int timeout_ms)
185	9.32k	{
186	9.32k	(void)context;
187	9.32k	(void)timeout_ms;
188	9.32k	(void)buf;
189
190	9.32k	auto fuzzer = static_cast<wolfMQTTFuzzer*>(context);
191	9.32k	return fuzzer->write(buf_len);
192	9.32k	}
193
194		static int mqtt_disconnect(void *context)
195	127	{
196	127	(void)context;
197
198	127	return MQTT_CODE_SUCCESS;
199	127	}
200
201		static int mqtt_message_cb(MqttClient client, MqttMessage msg, byte msg_new, byte msg_done)
202	4.36k	{
203	4.36k	return MQTT_CODE_SUCCESS;
204	4.36k	}
205
206	5.98k	void* wolfMQTTFuzzer::malloc(const size_t n) {
207	5.98k	return n == 0 ? BADPTR : ::malloc(n);
208	5.98k	}
209
210	6.10k	void wolfMQTTFuzzer::free(void* ptr) {
211	6.10k	if ( ptr == BADPTR ) {
212	0	return;
213	0	}
214
215	6.10k	::free(ptr);
216	6.10k	}
217
218	0	std::optional<Topic> wolfMQTTFuzzer::GetTopic(void) const {
219	0	Topic topic(ds);
220
221	0	if ( topic.Generate() == false ) {
222	0	return std::nullopt;
223	0	}
224
225	0	return topic;
226	0	}
227
228	2.02k	word16 wolfMQTTFuzzer::GetPacketId(void) const {
229	2.02k	return ds.Get<word16>();
230	2.02k	}
231
232	1.16k	bool wolfMQTTFuzzer::subscribe(void) {
233	1.16k	MqttTopic* topicsArray = nullptr;
234	1.16k	MqttSubscribe* subscribe = nullptr;
235
236	1.16k	bool ret = false;
237
238	1.16k	try {
239	1.16k	Topics topics(ds);
240	1.16k	CHECK_EQ(topics.Generate(), true);
241
242	772	subscribe = new MqttSubscribe;
243	772	memset(subscribe, 0, sizeof(*subscribe));
244
245	772	subscribe->packet_id = GetPacketId();
246	772	topicsArray = topics.ToArray();
247	772	subscribe->topic_count = topics.Size();
248	772	subscribe->topics = topicsArray;
249
250	772	CHECK_EQ(MqttClient_Subscribe(client, subscribe), MQTT_CODE_SUCCESS);
251
252	290	ret = true;
253	290	} catch ( ... ) { }
254
255	1.16k	end:
256	1.16k	if ( topicsArray ) {
257	759	delete[] topicsArray;
258	759	}
259
260	1.16k	if ( subscribe ) {
261	772	delete subscribe;
262	772	}
263	1.16k	return ret;
264	1.16k	}
265
266	535	bool wolfMQTTFuzzer::unsubscribe(void) {
267	535	MqttTopic* topicsArray = nullptr;
268	535	MqttUnsubscribe* unsubscribe = nullptr;
269
270	535	bool ret = false;
271
272	535	try {
273	535	Topics topics(ds);
274	535	CHECK_EQ(topics.Generate(), true);
275
276	419	unsubscribe = new MqttUnsubscribe;
277	419	memset(unsubscribe, 0, sizeof(*unsubscribe));
278
279	419	unsubscribe->packet_id = GetPacketId();
280	419	topicsArray = topics.ToArray();
281	419	unsubscribe->topic_count = topics.Size();
282	419	unsubscribe->topics = topicsArray;
283
284	419	CHECK_EQ(MqttClient_Unsubscribe(client, unsubscribe), MQTT_CODE_SUCCESS);
285
286	67	ret = true;
287	67	} catch ( ... ) { }
288
289	535	end:
290	535	if ( topicsArray ) {
291	409	delete[] topicsArray;
292	409	}
293
294	535	if ( unsubscribe ) {
295	419	delete unsubscribe;
296	419	}
297
298	535	return ret;
299	535	}
300
301	999	bool wolfMQTTFuzzer::publish(void) {
302	999	bool ret = false;
303	999	MqttPublish* publish = nullptr;
304
305	999	try {
306	999	publish = new MqttPublish;
307	999	memset(publish, 0, sizeof(*publish));
308
309	999	publish->retain = ds.Get<bool>() ? 1 : 0;
310	999	publish->qos = GetQoS();
311	999	publish->duplicate = ds.Get<bool>() ? 1 : 0;
312
313	999	const auto topic_str = ds.Get<std::string>();
314	999	publish->topic_name = topic_str.c_str();
315
316	999	publish->packet_id = GetPacketId();
317
318	999	auto buffer = ds.GetData(0);
319	999	publish->buffer = buffer.data();
320	999	publish->total_len = buffer.size();
321
322	999	if ( DEBUG ) {
323	0	printf("publish: topic name size: %zu\n", strlen(topic_str.c_str()));
324	0	}
325
326	999	CHECK_EQ(MqttClient_Publish(client, publish), MQTT_CODE_SUCCESS);
327
328	409	ret = true;
329	409	} catch ( ... ) { }
330
331	999	end:
332	999	if ( publish ) {
333	999	delete publish;
334	999	}
335
336	999	return ret;
337	999	}
338
339	1.02k	bool wolfMQTTFuzzer::ping(void) {
340	1.02k	bool ret = false;
341
342	1.02k	MqttPing* ping = new MqttPing;
343	1.02k	memset(ping, 0, sizeof(*ping));
344
345	1.02k	CHECK_EQ(MqttClient_Ping_ex(client, ping), true);
346
347	0	ret = true;
348
349	1.02k	end:
350	1.02k	delete ping;
351
352	1.02k	return ret;
353	0	}
354
355	3.48k	bool wolfMQTTFuzzer::wait(void) {
356	3.48k	bool ret = false;
357
358	3.48k	CHECK_EQ(MqttClient_WaitMessage(client, 1000), MQTT_CODE_SUCCESS);
359
360	840	ret = true;
361
362	3.48k	end:
363	3.48k	return ret;
364	840	}
365
366		wolfMQTTFuzzer::wolfMQTTFuzzer(fuzzing::datasource::Datasource& ds) :
367	3.05k	Base(ds) {
368	3.05k	client = new MqttClient;
369	3.05k	net = new MqttNet;
370	3.05k	connect = new MqttConnect;
371	3.05k	}
372
373	3.05k	wolfMQTTFuzzer::~wolfMQTTFuzzer() {
374	3.05k	this->free(tx_buf);
375	3.05k	this->free(rx_buf);
376	3.05k	delete client;
377	3.05k	delete net;
378	3.05k	delete connect;
379	3.05k	}
380
381	3.05k	bool wolfMQTTFuzzer::Initialize(void) {
382	3.05k	bool ret = false;
383	3.05k	MqttMessage* lwt_msg = nullptr;
384
385	3.05k	try {
386		/* net */
387	3.05k	{
388	3.05k	memset(net, 0, sizeof(*net));
389
390	3.05k	net->connect = mqtt_connect;
391	3.05k	net->read = mqtt_recv;
392	3.05k	net->write = mqtt_write;
393	3.05k	net->disconnect = mqtt_disconnect;
394	3.05k	net->context = this;
395	3.05k	}
396
397		/* client */
398	3.05k	{
399	3.05k	memset(client, 0, sizeof(*client));
400
401	3.05k	tx_size = ds.Get<uint16_t>();
402	3.05k	tx_size = 4096;
403	3.05k	tx_buf = (uint8_t*)this->malloc(tx_size);
404	3.05k	rx_size = ds.Get<uint16_t>();
405	3.05k	rx_size = 4096;
406	3.05k	rx_buf = (uint8_t*)this->malloc(rx_size);
407	3.05k	memset(tx_buf, 0, tx_size);
408	3.05k	memset(rx_buf, 0, rx_size);
409
410	3.05k	client->msg_cb = mqtt_message_cb;
411	3.05k	client->tx_buf = tx_buf;
412	3.05k	client->tx_buf_len = tx_size;
413	3.05k	client->rx_buf = rx_buf;
414	3.05k	client->rx_buf_len = rx_size;
415	3.05k	client->cmd_timeout_ms = 1000;
416	3.05k	}
417
418		/* connect */
419	3.05k	{
420	3.05k	memset(connect, 0, sizeof(*connect));
421
422	3.05k	connect->keep_alive_sec = 1;
423	3.05k	connect->clean_session = ds.Get<bool>() ? 1 : 0;
424	3.05k	client_id = ds.Get<std::string>();
425	3.05k	connect->client_id = client_id.c_str();
426	3.05k	connect->enable_lwt = ds.Get<bool>() ? 1 : 0;
427	3.05k	}
428
429	3.05k	std::string lwt_topic_name;
430	3.05k	std::vector<uint8_t> lwt_buffer;
431
432	3.05k	if ( connect->enable_lwt ) {
433	35	lwt_topic_name = ds.Get<std::string>();
434	35	lwt_buffer = ds.GetData(0);
435
436	35	lwt_msg = new MqttMessage;
437	35	memset(lwt_msg, 0, sizeof(*lwt_msg));
438
439	35	connect->lwt_msg = lwt_msg;
440	35	lwt_msg->qos = GetQoS();
441	35	lwt_msg->retain = ds.Get<bool>() ? 1 : 0;
442	35	lwt_msg->topic_name = lwt_topic_name.c_str();
443	35	lwt_msg->buffer = lwt_buffer.data();
444	35	lwt_msg->total_len = lwt_buffer.size();
445	35	}
446
447	3.05k	CHECK_EQ(MqttSocket_Init(client, net), MQTT_CODE_SUCCESS);
448
449		#if 0
450		if ( ds.Get<bool>() ) {
451		//CHECK_EQ(MqttClient_SetPropertyCallback(&client, mqtt_property_cb, NULL);
452		}
453		#endif
454
455	3.05k	CHECK_EQ(MqttClient_NetConnect(client, "dummy", 12345, 1000, 0, NULL), MQTT_CODE_SUCCESS);
456	3.05k	CHECK_EQ(MqttClient_Connect(client, connect), MQTT_CODE_SUCCESS);
457
458	1.98k	ret = true;
459	1.98k	} catch ( ... ) {
460	181	ret = false;
461	181	}
462
463	3.05k	end:
464	3.05k	if ( lwt_msg ) {
465	28	delete lwt_msg;
466	28	}
467	3.05k	return ret;
468	3.05k	}
469
470	1.80k	void wolfMQTTFuzzer::Run(void) {
471	1.80k	try {
472	1.80k	const auto numActions = ds.Get<uint8_t>() % 20;
473
474	9.74k	for (size_t i = 0; i < numActions; i++) {
475	9.59k	switch ( ds.Get<uint8_t>() ) {
476	1.16k	case 0:
477	1.16k	subscribe();
478	1.16k	break;
479	535	case 1:
480	535	unsubscribe();
481	535	break;
482	999	case 2:
483	999	publish();
484	999	break;
485	1.02k	case 3:
486	1.02k	ping();
487	1.02k	break;
488	3.48k	case 4:
489	3.48k	wait();
490	3.48k	break;
491	9.59k	}
492	9.59k	}
493
494	155	MqttClient_NetDisconnect(client);
495	1.67k	} catch ( ... ) { }
496	1.80k	}
497
498	19.3k	int wolfMQTTFuzzer::recv(byte* buf, const int buf_len) {
499	19.3k	try {
500	19.3k	const auto data = ds.GetData(0);
501	19.3k	const size_t copySize = buf_len > data.size() ? data.size() : buf_len;
502	19.3k	if ( copySize ) {
503	14.6k	memcpy(buf, data.data(), copySize);
504	14.6k	}
505	19.3k	if ( DEBUG )
506	0	{
507	0	printf("Recv: %zu bytes (%d requested)\n", copySize, buf_len);
508	0	for (size_t i = 0; i < copySize; i++) {
509	0	printf("%02X ", data[i]);
510	0	}
511	0	printf("\n");
512	0	}
513	19.3k	return copySize;
514	19.3k	} catch ( ... ) {
515	1.80k	if ( DEBUG ) printf("Recv: -1\n");
516	1.80k	return -1;
517	1.80k	}
518	19.3k	}
519
520	9.32k	int wolfMQTTFuzzer::write(const int buf_len) {
521	9.32k	try {
522	9.32k	if ( ds.Get<bool>() == true ) {
523	866	if ( DEBUG ) printf("write: -1\n");
524	866	return -1;
525	866	}
526
527	8.45k	const auto ret = (int)(ds.Get<uint32_t>() % (buf_len+1));
528	8.45k	if ( DEBUG ) printf("write: %d bytes (%d requested)\n", ret, buf_len);
529	8.45k	return ret;
530	9.32k	} catch ( ... ) {
531	737	return -1;
532	737	}
533	9.32k	}
534
535	3.05k	extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
536	3.05k	fuzzing::datasource::Datasource ds(data, size);
537	3.05k	wolfMQTTFuzzer fuzzer(ds);
538
539	3.05k	CHECK_EQ(fuzzer.Initialize(), true);
540
541	1.80k	fuzzer.Run();
542
543	3.05k	end:
544	3.05k	return 0;
545	1.80k	}