/src/wolfmqtt-fuzzers/fuzzer.cpp

Source
#include <fuzzing/datasource/datasource.hpp>
#include <wolfmqtt/mqtt_client.h>
#include <wolfmqtt/mqtt_packet.h>
#include <optional>

#define CHECK_EQ(expr, res) if ( (expr) != (res) ) { goto end; }
#define CHECK_NE(expr, res) if ( (expr) == (res) ) { goto end; }

#define BADPTR ((void*)0x12)
#define MAX_TOPICS 50

#define DEBUG 0

class Base {
    protected:
        fuzzing::datasource::Datasource& ds;
        MqttQoS GetQoS(void) const;
    public:
        Base(fuzzing::datasource::Datasource& ds);
        ~Base();
};

Base::Base(fuzzing::datasource::Datasource& ds) :
    ds(ds)
{ }

Base::~Base() { }

MqttQoS Base::GetQoS(void) const {
    switch ( ds.Get<uint8_t>() % 3 ) {
        case    0:
            return MQTT_QOS_0;
        case    1:
            return MQTT_QOS_1;
        case    2:
            return MQTT_QOS_2;
        default:
            /* Silence compiler warning */
            abort();
    }
}

class Topic : public Base {
    private:
        MqttTopic* topic;
        std::vector<std::string> strings;
    public:
        Topic(fuzzing::datasource::Datasource& ds);
        ~Topic();
        bool Generate(void);
        MqttTopic Get(void);
};

Topic::Topic(fuzzing::datasource::Datasource& ds) :
    Base(ds) {
    topic = new MqttTopic;
}

Topic::~Topic() {
    delete topic;
}

bool Topic::Generate(void) {
    bool ret;

    memset(topic, 0, sizeof(*topic));

    strings.push_back( ds.Get<std::string>() );
    topic->topic_filter = strings.back().c_str();

    topic->qos = GetQoS();

    ret = true;
end:
    return ret;
}

MqttTopic Topic::Get(void) {
    return *topic;
}

class Topics : public Base {
    private:
        std::vector<Topic*> topics;
    public:
        Topics(fuzzing::datasource::Datasource& ds);
        ~Topics();
        bool Generate(void);
        MqttTopic* ToArray(void);
        size_t Size(void) const;
};

Topics::Topics(fuzzing::datasource::Datasource& ds) :
    Base(ds)
{ }

Topics::~Topics() {
    for (auto& t : topics) {
        delete t;
    }
}
        
bool Topics::Generate(void) {
    bool ret = false;

    try {
        const auto numTopics = ds.Get<uint16_t>() % (MAX_TOPICS+1);

        for (size_t i = 0; i < numTopics; i++) {
            topics.push_back(new Topic(ds));
            CHECK_EQ(topics.back()->Generate(), true);
        }

        ret = true;
    } catch ( ... ) { }

end:
    return ret;
}

MqttTopic* Topics::ToArray(void) {
    auto ret = new MqttTopic[topics.size()];

    for (size_t i = 0; i < Size(); i++) {
        ret[i] = topics[i]->Get();
    }
    return ret;
}
        
size_t Topics::Size(void) const {
    return topics.size();
}

class wolfMQTTFuzzer : public Base {
        MqttClient* client;
        MqttNet* net;
        MqttConnect* connect;

        uint8_t* tx_buf = nullptr, *rx_buf = nullptr;
        size_t tx_size = 0, rx_size = 0;

        std::string client_id;

        void* malloc(const size_t n);
        void free(void* ptr);

        word16 GetPacketId(void) const;
        std::optional<Topic> GetTopic(void) const;

        bool subscribe(void);
        bool unsubscribe(void);
        bool publish(void);
        bool ping(void);
        bool wait(void);
    public:
        wolfMQTTFuzzer(fuzzing::datasource::Datasource& ds);
        ~wolfMQTTFuzzer();
        bool Initialize(void);
        void Run(void);
        int recv(byte* buf, const int buf_len);
        int write(const int buf_len);

};

static int mqtt_connect(void *context, const char* host, word16 port, int timeout_ms)
{
    (void)context;
    (void)host;
    (void)port;
    (void)timeout_ms;

    return MQTT_CODE_SUCCESS;
}

static int mqtt_recv(void *context, byte* buf, int buf_len, int timeout_ms)
{
    (void)context;
    (void)timeout_ms;

    auto fuzzer = static_cast<wolfMQTTFuzzer*>(context);
    return fuzzer->recv(buf, buf_len);
}

static int mqtt_write(void *context, const byte* buf, int buf_len, int timeout_ms)
{
    (void)context;
    (void)timeout_ms;
    (void)buf;

    auto fuzzer = static_cast<wolfMQTTFuzzer*>(context);
    return fuzzer->write(buf_len);
}

static int mqtt_disconnect(void *context)
{
    (void)context;

    return MQTT_CODE_SUCCESS;
}

static int mqtt_message_cb(MqttClient *client, MqttMessage *msg, byte msg_new, byte msg_done)
{
    return MQTT_CODE_SUCCESS;
}

void* wolfMQTTFuzzer::malloc(const size_t n) {
    return n == 0 ? BADPTR : ::malloc(n);
}

void wolfMQTTFuzzer::free(void* ptr) {
    if ( ptr == BADPTR ) {
        return;
    }

    ::free(ptr);
}

std::optional<Topic> wolfMQTTFuzzer::GetTopic(void) const {
    Topic topic(ds);

    if ( topic.Generate() == false ) {
        return std::nullopt;
    }

    return topic;
}

word16 wolfMQTTFuzzer::GetPacketId(void) const {
    return ds.Get<word16>();
}

bool wolfMQTTFuzzer::subscribe(void) {
    MqttTopic* topicsArray = nullptr;
    MqttSubscribe* subscribe = nullptr;

    bool ret = false;

    try {
        Topics topics(ds);
        CHECK_EQ(topics.Generate(), true);

        subscribe = new MqttSubscribe;
        memset(subscribe, 0, sizeof(*subscribe));

        subscribe->packet_id = GetPacketId();
        topicsArray = topics.ToArray();
        subscribe->topic_count = topics.Size();
        subscribe->topics = topicsArray;

        CHECK_EQ(MqttClient_Subscribe(client, subscribe), MQTT_CODE_SUCCESS);

        ret = true;
    } catch ( ... ) { }

end:
    if ( topicsArray ) {
        delete[] topicsArray;
    }

    if ( subscribe ) {
        delete subscribe;
    }
    return ret;
}

bool wolfMQTTFuzzer::unsubscribe(void) {
    MqttTopic* topicsArray = nullptr;
    MqttUnsubscribe* unsubscribe = nullptr;

    bool ret = false;

    try {
        Topics topics(ds);
        CHECK_EQ(topics.Generate(), true);

        unsubscribe = new MqttUnsubscribe;
        memset(unsubscribe, 0, sizeof(*unsubscribe));

        unsubscribe->packet_id = GetPacketId();
        topicsArray = topics.ToArray();
        unsubscribe->topic_count = topics.Size();
        unsubscribe->topics = topicsArray;

        CHECK_EQ(MqttClient_Unsubscribe(client, unsubscribe), MQTT_CODE_SUCCESS);

        ret = true;
    } catch ( ... ) { }

end:
    if ( topicsArray ) {
        delete[] topicsArray;
    }

    if ( unsubscribe ) {
        delete unsubscribe;
    }

    return ret;
}

bool wolfMQTTFuzzer::publish(void) {
    bool ret = false;
    MqttPublish* publish = nullptr;

    try {
        publish = new MqttPublish;
        memset(publish, 0, sizeof(*publish));

        publish->retain = ds.Get<bool>() ? 1 : 0;
        publish->qos = GetQoS();
        publish->duplicate = ds.Get<bool>() ? 1 : 0;

        const auto topic_str = ds.Get<std::string>();
        publish->topic_name = topic_str.c_str();

        publish->packet_id = GetPacketId();

        auto buffer = ds.GetData(0);
        publish->buffer = buffer.data();
        publish->total_len = buffer.size();

        if ( DEBUG ) {
            printf("publish: topic name size: %zu\n", strlen(topic_str.c_str()));
        }

        CHECK_EQ(MqttClient_Publish(client, publish), MQTT_CODE_SUCCESS);

        ret = true;
    } catch ( ... ) { }

end:
    if ( publish ) {
        delete publish;
    }

    return ret;
}

bool wolfMQTTFuzzer::ping(void) {
    bool ret = false;

    MqttPing* ping = new MqttPing;
    memset(ping, 0, sizeof(*ping));

    CHECK_EQ(MqttClient_Ping_ex(client, ping), true);

    ret = true;

end:
    delete ping;

    return ret;
}

bool wolfMQTTFuzzer::wait(void) {
    bool ret = false;

    CHECK_EQ(MqttClient_WaitMessage(client, 1000), MQTT_CODE_SUCCESS);

    ret = true;

end:
    return ret;
}

wolfMQTTFuzzer::wolfMQTTFuzzer(fuzzing::datasource::Datasource& ds) :
    Base(ds) {
        client = new MqttClient;
        net = new MqttNet;
        connect = new MqttConnect;
}

wolfMQTTFuzzer::~wolfMQTTFuzzer() {
    this->free(tx_buf);
    this->free(rx_buf);
    delete client;
    delete net;
    delete connect;
}

bool wolfMQTTFuzzer::Initialize(void) {
    bool ret = false;
    MqttMessage* lwt_msg = nullptr;

    try {
        /* net */
        {
            memset(net, 0, sizeof(*net));

            net->connect = mqtt_connect;
            net->read = mqtt_recv;
            net->write = mqtt_write;
            net->disconnect = mqtt_disconnect;
            net->context = this;
        }

        /* client */
        {
            memset(client, 0, sizeof(*client));

            tx_size = ds.Get<uint16_t>();
            tx_size = 4096;
            tx_buf = (uint8_t*)this->malloc(tx_size);
            rx_size = ds.Get<uint16_t>();
            rx_size = 4096;
            rx_buf = (uint8_t*)this->malloc(rx_size);
            memset(tx_buf, 0, tx_size);
            memset(rx_buf, 0, rx_size);

            client->msg_cb = mqtt_message_cb;
            client->tx_buf = tx_buf;
            client->tx_buf_len = tx_size;
            client->rx_buf = rx_buf;
            client->rx_buf_len = rx_size;
            client->cmd_timeout_ms = 1000;
        }

        /* connect */
        {
            memset(connect, 0, sizeof(*connect));

            connect->keep_alive_sec = 1;
            connect->clean_session = ds.Get<bool>() ? 1 : 0;
            client_id = ds.Get<std::string>();
            connect->client_id = client_id.c_str();
            connect->enable_lwt = ds.Get<bool>() ? 1 : 0;
        }
            
        std::string lwt_topic_name;
        std::vector<uint8_t> lwt_buffer;

        if ( connect->enable_lwt ) {
            lwt_topic_name = ds.Get<std::string>();
            lwt_buffer = ds.GetData(0);

            lwt_msg = new MqttMessage;
            memset(lwt_msg, 0, sizeof(*lwt_msg));

            connect->lwt_msg = lwt_msg;
            lwt_msg->qos = GetQoS();
            lwt_msg->retain = ds.Get<bool>() ? 1 : 0;
            lwt_msg->topic_name = lwt_topic_name.c_str();
            lwt_msg->buffer = lwt_buffer.data();
            lwt_msg->total_len = lwt_buffer.size();
        }

        CHECK_EQ(MqttSocket_Init(client, net), MQTT_CODE_SUCCESS);

#if 0
        if ( ds.Get<bool>() ) {
            //CHECK_EQ(MqttClient_SetPropertyCallback(&client, mqtt_property_cb, NULL);
        }
#endif

        CHECK_EQ(MqttClient_NetConnect(client, "dummy", 12345, 1000, 0, NULL), MQTT_CODE_SUCCESS);
        CHECK_EQ(MqttClient_Connect(client, connect), MQTT_CODE_SUCCESS);

        ret = true;
    } catch ( ... ) {
        ret = false;
    }

end:
    if ( lwt_msg ) {
        delete lwt_msg;
    }
    return ret;
}

void wolfMQTTFuzzer::Run(void) {
    try {
        const auto numActions = ds.Get<uint8_t>() % 20;

        for (size_t i = 0; i < numActions; i++) {
            switch ( ds.Get<uint8_t>() ) {
                case    0:
                    subscribe();
                    break;
                case    1:
                    unsubscribe();
                    break;
                case    2:
                    publish();
                    break;
                case    3:
                    ping();
                    break;
                case    4:
                    wait();
                    break;
            }
        }

        MqttClient_NetDisconnect(client);
    } catch ( ... ) { }
}

int wolfMQTTFuzzer::recv(byte* buf, const int buf_len) {
    try {
        const auto data = ds.GetData(0);
        const size_t copySize = buf_len > data.size() ? data.size() : buf_len;
        if ( copySize ) {
            memcpy(buf, data.data(), copySize);
        }
        if ( DEBUG )
        {
            printf("Recv: %zu bytes (%d requested)\n", copySize, buf_len);
            for (size_t i = 0; i < copySize; i++) {
                printf("%02X ", data[i]);
            }
            printf("\n");
        }
        return copySize;
    } catch ( ... ) {
        if ( DEBUG ) printf("Recv: -1\n");
        return -1;
    }
}

int wolfMQTTFuzzer::write(const int buf_len) {
    try {
        if ( ds.Get<bool>() == true ) {
            if ( DEBUG ) printf("write: -1\n");
            return -1;
        }

        const auto ret = (int)(ds.Get<uint32_t>() % (buf_len+1));
        if ( DEBUG ) printf("write: %d bytes (%d requested)\n", ret, buf_len);
        return ret;
    } catch ( ... ) {
        return -1;
    }
}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    fuzzing::datasource::Datasource ds(data, size);
    wolfMQTTFuzzer fuzzer(ds);

    CHECK_EQ(fuzzer.Initialize(), true);

    fuzzer.Run();

end:
    return 0;
}

Coverage Report

Created: 2025-10-13 06:29

Line	Count	Source
1		#include <fuzzing/datasource/datasource.hpp>
2		#include <wolfmqtt/mqtt_client.h>
3		#include <wolfmqtt/mqtt_packet.h>
4		#include <optional>
5
6	23.7k	#define CHECK_EQ(expr, res) if ( (expr) != (res) ) { goto end; }
7		#define CHECK_NE(expr, res) if ( (expr) == (res) ) { goto end; }
8
9	5.83k	#define BADPTR ((void*)0x12)
10	1.57k	#define MAX_TOPICS 50
11
12	30.8k	#define DEBUG 0
13
14		class Base {
15		protected:
16		fuzzing::datasource::Datasource& ds;
17		MqttQoS GetQoS(void) const;
18		public:
19		Base(fuzzing::datasource::Datasource& ds);
20		~Base();
21		};
22
23		Base::Base(fuzzing::datasource::Datasource& ds) :
24	8.52k	ds(ds)
25	8.52k	{ }
26
27	8.52k	Base::~Base() { }
28
29	4.55k	MqttQoS Base::GetQoS(void) const {
30	4.55k	switch ( ds.Get<uint8_t>() % 3 ) {
31	3.50k	case 0:
32	3.50k	return MQTT_QOS_0;
33	432	case 1:
34	432	return MQTT_QOS_1;
35	560	case 2:
36	560	return MQTT_QOS_2;
37	0	default:
38		/* Silence compiler warning */
39	0	abort();
40	4.55k	}
41	4.55k	}
42
43		class Topic : public Base {
44		private:
45		MqttTopic* topic;
46		std::vector<std::string> strings;
47		public:
48		Topic(fuzzing::datasource::Datasource& ds);
49		~Topic();
50		bool Generate(void);
51		MqttTopic Get(void);
52		};
53
54		Topic::Topic(fuzzing::datasource::Datasource& ds) :
55	4.03k	Base(ds) {
56	4.03k	topic = new MqttTopic;
57	4.03k	}
58
59	4.03k	Topic::~Topic() {
60	4.03k	delete topic;
61	4.03k	}
62
63	4.03k	bool Topic::Generate(void) {
64	4.03k	bool ret;
65
66	4.03k	memset(topic, 0, sizeof(*topic));
67
68	4.03k	strings.push_back( ds.Get<std::string>() );
69	4.03k	topic->topic_filter = strings.back().c_str();
70
71	4.03k	topic->qos = GetQoS();
72
73	4.03k	ret = true;
74	4.03k	end:
75	3.55k	return ret;
76	4.03k	}
77
78	1.22k	MqttTopic Topic::Get(void) {
79	1.22k	return *topic;
80	1.22k	}
81
82		class Topics : public Base {
83		private:
84		std::vector<Topic*> topics;
85		public:
86		Topics(fuzzing::datasource::Datasource& ds);
87		~Topics();
88		bool Generate(void);
89		MqttTopic* ToArray(void);
90		size_t Size(void) const;
91		};
92
93		Topics::Topics(fuzzing::datasource::Datasource& ds) :
94	1.57k	Base(ds)
95	1.57k	{ }
96
97	1.57k	Topics::~Topics() {
98	4.03k	for (auto& t : topics) {
99	4.03k	delete t;
100	4.03k	}
101	1.57k	}
102
103	1.57k	bool Topics::Generate(void) {
104	1.57k	bool ret = false;
105
106	1.57k	try {
107	1.57k	const auto numTopics = ds.Get<uint16_t>() % (MAX_TOPICS+1);
108
109	5.61k	for (size_t i = 0; i < numTopics; i++) {
110	4.03k	topics.push_back(new Topic(ds));
111	4.03k	CHECK_EQ(topics.back()->Generate(), true);
112	4.03k	}
113
114	1.57k	ret = true;
115	1.57k	} catch ( ... ) { }
116
117	1.57k	end:
118	1.57k	return ret;
119	1.57k	}
120
121	1.01k	MqttTopic* Topics::ToArray(void) {
122	1.01k	auto ret = new MqttTopic[topics.size()];
123
124	2.23k	for (size_t i = 0; i < Size(); i++) {
125	1.22k	ret[i] = topics[i]->Get();
126	1.22k	}
127	1.01k	return ret;
128	1.01k	}
129
130	3.24k	size_t Topics::Size(void) const {
131	3.24k	return topics.size();
132	3.24k	}
133
134		class wolfMQTTFuzzer : public Base {
135		MqttClient* client;
136		MqttNet* net;
137		MqttConnect* connect;
138
139		uint8_t* tx_buf = nullptr, *rx_buf = nullptr;
140		size_t tx_size = 0, rx_size = 0;
141
142		std::string client_id;
143
144		void* malloc(const size_t n);
145		void free(void* ptr);
146
147		word16 GetPacketId(void) const;
148		std::optional<Topic> GetTopic(void) const;
149
150		bool subscribe(void);
151		bool unsubscribe(void);
152		bool publish(void);
153		bool ping(void);
154		bool wait(void);
155		public:
156		wolfMQTTFuzzer(fuzzing::datasource::Datasource& ds);
157		~wolfMQTTFuzzer();
158		bool Initialize(void);
159		void Run(void);
160		int recv(byte* buf, const int buf_len);
161		int write(const int buf_len);
162
163		};
164
165		static int mqtt_connect(void context, const char host, word16 port, int timeout_ms)
166	2.76k	{
167	2.76k	(void)context;
168	2.76k	(void)host;
169	2.76k	(void)port;
170	2.76k	(void)timeout_ms;
171
172	2.76k	return MQTT_CODE_SUCCESS;
173	2.76k	}
174
175		static int mqtt_recv(void context, byte buf, int buf_len, int timeout_ms)
176	19.0k	{
177	19.0k	(void)context;
178	19.0k	(void)timeout_ms;
179
180	19.0k	auto fuzzer = static_cast<wolfMQTTFuzzer*>(context);
181	19.0k	return fuzzer->recv(buf, buf_len);
182	19.0k	}
183
184		static int mqtt_write(void context, const byte buf, int buf_len, int timeout_ms)
185	9.11k	{
186	9.11k	(void)context;
187	9.11k	(void)timeout_ms;
188	9.11k	(void)buf;
189
190	9.11k	auto fuzzer = static_cast<wolfMQTTFuzzer*>(context);
191	9.11k	return fuzzer->write(buf_len);
192	9.11k	}
193
194		static int mqtt_disconnect(void *context)
195	113	{
196	113	(void)context;
197
198	113	return MQTT_CODE_SUCCESS;
199	113	}
200
201		static int mqtt_message_cb(MqttClient client, MqttMessage msg, byte msg_new, byte msg_done)
202	4.47k	{
203	4.47k	return MQTT_CODE_SUCCESS;
204	4.47k	}
205
206	5.74k	void* wolfMQTTFuzzer::malloc(const size_t n) {
207	5.74k	return n == 0 ? BADPTR : ::malloc(n);
208	5.74k	}
209
210	5.83k	void wolfMQTTFuzzer::free(void* ptr) {
211	5.83k	if ( ptr == BADPTR ) {
212	0	return;
213	0	}
214
215	5.83k	::free(ptr);
216	5.83k	}
217
218	0	std::optional<Topic> wolfMQTTFuzzer::GetTopic(void) const {
219	0	Topic topic(ds);
220
221	0	if ( topic.Generate() == false ) {
222	0	return std::nullopt;
223	0	}
224
225	0	return topic;
226	0	}
227
228	1.82k	word16 wolfMQTTFuzzer::GetPacketId(void) const {
229	1.82k	return ds.Get<word16>();
230	1.82k	}
231
232	1.01k	bool wolfMQTTFuzzer::subscribe(void) {
233	1.01k	MqttTopic* topicsArray = nullptr;
234	1.01k	MqttSubscribe* subscribe = nullptr;
235
236	1.01k	bool ret = false;
237
238	1.01k	try {
239	1.01k	Topics topics(ds);
240	1.01k	CHECK_EQ(topics.Generate(), true);
241
242	652	subscribe = new MqttSubscribe;
243	652	memset(subscribe, 0, sizeof(*subscribe));
244
245	652	subscribe->packet_id = GetPacketId();
246	652	topicsArray = topics.ToArray();
247	652	subscribe->topic_count = topics.Size();
248	652	subscribe->topics = topicsArray;
249
250	652	CHECK_EQ(MqttClient_Subscribe(client, subscribe), MQTT_CODE_SUCCESS);
251
252	257	ret = true;
253	257	} catch ( ... ) { }
254
255	1.01k	end:
256	1.01k	if ( topicsArray ) {
257	631	delete[] topicsArray;
258	631	}
259
260	1.01k	if ( subscribe ) {
261	652	delete subscribe;
262	652	}
263	1.01k	return ret;
264	1.01k	}
265
266	557	bool wolfMQTTFuzzer::unsubscribe(void) {
267	557	MqttTopic* topicsArray = nullptr;
268	557	MqttUnsubscribe* unsubscribe = nullptr;
269
270	557	bool ret = false;
271
272	557	try {
273	557	Topics topics(ds);
274	557	CHECK_EQ(topics.Generate(), true);
275
276	392	unsubscribe = new MqttUnsubscribe;
277	392	memset(unsubscribe, 0, sizeof(*unsubscribe));
278
279	392	unsubscribe->packet_id = GetPacketId();
280	392	topicsArray = topics.ToArray();
281	392	unsubscribe->topic_count = topics.Size();
282	392	unsubscribe->topics = topicsArray;
283
284	392	CHECK_EQ(MqttClient_Unsubscribe(client, unsubscribe), MQTT_CODE_SUCCESS);
285
286	70	ret = true;
287	70	} catch ( ... ) { }
288
289	557	end:
290	557	if ( topicsArray ) {
291	379	delete[] topicsArray;
292	379	}
293
294	557	if ( unsubscribe ) {
295	392	delete unsubscribe;
296	392	}
297
298	557	return ret;
299	557	}
300
301	948	bool wolfMQTTFuzzer::publish(void) {
302	948	bool ret = false;
303	948	MqttPublish* publish = nullptr;
304
305	948	try {
306	948	publish = new MqttPublish;
307	948	memset(publish, 0, sizeof(*publish));
308
309	948	publish->retain = ds.Get<bool>() ? 1 : 0;
310	948	publish->qos = GetQoS();
311	948	publish->duplicate = ds.Get<bool>() ? 1 : 0;
312
313	948	const auto topic_str = ds.Get<std::string>();
314	948	publish->topic_name = topic_str.c_str();
315
316	948	publish->packet_id = GetPacketId();
317
318	948	auto buffer = ds.GetData(0);
319	948	publish->buffer = buffer.data();
320	948	publish->total_len = buffer.size();
321
322	948	if ( DEBUG ) {
323	0	printf("publish: topic name size: %zu\n", strlen(topic_str.c_str()));
324	0	}
325
326	948	CHECK_EQ(MqttClient_Publish(client, publish), MQTT_CODE_SUCCESS);
327
328	392	ret = true;
329	392	} catch ( ... ) { }
330
331	948	end:
332	948	if ( publish ) {
333	948	delete publish;
334	948	}
335
336	948	return ret;
337	948	}
338
339	941	bool wolfMQTTFuzzer::ping(void) {
340	941	bool ret = false;
341
342	941	MqttPing* ping = new MqttPing;
343	941	memset(ping, 0, sizeof(*ping));
344
345	941	CHECK_EQ(MqttClient_Ping_ex(client, ping), true);
346
347	0	ret = true;
348
349	941	end:
350	941	delete ping;
351
352	941	return ret;
353	0	}
354
355	3.53k	bool wolfMQTTFuzzer::wait(void) {
356	3.53k	bool ret = false;
357
358	3.53k	CHECK_EQ(MqttClient_WaitMessage(client, 1000), MQTT_CODE_SUCCESS);
359
360	847	ret = true;
361
362	3.53k	end:
363	3.53k	return ret;
364	847	}
365
366		wolfMQTTFuzzer::wolfMQTTFuzzer(fuzzing::datasource::Datasource& ds) :
367	2.91k	Base(ds) {
368	2.91k	client = new MqttClient;
369	2.91k	net = new MqttNet;
370	2.91k	connect = new MqttConnect;
371	2.91k	}
372
373	2.91k	wolfMQTTFuzzer::~wolfMQTTFuzzer() {
374	2.91k	this->free(tx_buf);
375	2.91k	this->free(rx_buf);
376	2.91k	delete client;
377	2.91k	delete net;
378	2.91k	delete connect;
379	2.91k	}
380
381	2.91k	bool wolfMQTTFuzzer::Initialize(void) {
382	2.91k	bool ret = false;
383	2.91k	MqttMessage* lwt_msg = nullptr;
384
385	2.91k	try {
386		/* net */
387	2.91k	{
388	2.91k	memset(net, 0, sizeof(*net));
389
390	2.91k	net->connect = mqtt_connect;
391	2.91k	net->read = mqtt_recv;
392	2.91k	net->write = mqtt_write;
393	2.91k	net->disconnect = mqtt_disconnect;
394	2.91k	net->context = this;
395	2.91k	}
396
397		/* client */
398	2.91k	{
399	2.91k	memset(client, 0, sizeof(*client));
400
401	2.91k	tx_size = ds.Get<uint16_t>();
402	2.91k	tx_size = 4096;
403	2.91k	tx_buf = (uint8_t*)this->malloc(tx_size);
404	2.91k	rx_size = ds.Get<uint16_t>();
405	2.91k	rx_size = 4096;
406	2.91k	rx_buf = (uint8_t*)this->malloc(rx_size);
407	2.91k	memset(tx_buf, 0, tx_size);
408	2.91k	memset(rx_buf, 0, rx_size);
409
410	2.91k	client->msg_cb = mqtt_message_cb;
411	2.91k	client->tx_buf = tx_buf;
412	2.91k	client->tx_buf_len = tx_size;
413	2.91k	client->rx_buf = rx_buf;
414	2.91k	client->rx_buf_len = rx_size;
415	2.91k	client->cmd_timeout_ms = 1000;
416	2.91k	}
417
418		/* connect */
419	2.91k	{
420	2.91k	memset(connect, 0, sizeof(*connect));
421
422	2.91k	connect->keep_alive_sec = 1;
423	2.91k	connect->clean_session = ds.Get<bool>() ? 1 : 0;
424	2.91k	client_id = ds.Get<std::string>();
425	2.91k	connect->client_id = client_id.c_str();
426	2.91k	connect->enable_lwt = ds.Get<bool>() ? 1 : 0;
427	2.91k	}
428
429	2.91k	std::string lwt_topic_name;
430	2.91k	std::vector<uint8_t> lwt_buffer;
431
432	2.91k	if ( connect->enable_lwt ) {
433	28	lwt_topic_name = ds.Get<std::string>();
434	28	lwt_buffer = ds.GetData(0);
435
436	28	lwt_msg = new MqttMessage;
437	28	memset(lwt_msg, 0, sizeof(*lwt_msg));
438
439	28	connect->lwt_msg = lwt_msg;
440	28	lwt_msg->qos = GetQoS();
441	28	lwt_msg->retain = ds.Get<bool>() ? 1 : 0;
442	28	lwt_msg->topic_name = lwt_topic_name.c_str();
443	28	lwt_msg->buffer = lwt_buffer.data();
444	28	lwt_msg->total_len = lwt_buffer.size();
445	28	}
446
447	2.91k	CHECK_EQ(MqttSocket_Init(client, net), MQTT_CODE_SUCCESS);
448
449		#if 0
450		if ( ds.Get<bool>() ) {
451		//CHECK_EQ(MqttClient_SetPropertyCallback(&client, mqtt_property_cb, NULL);
452		}
453		#endif
454
455	2.91k	CHECK_EQ(MqttClient_NetConnect(client, "dummy", 12345, 1000, 0, NULL), MQTT_CODE_SUCCESS);
456	2.91k	CHECK_EQ(MqttClient_Connect(client, connect), MQTT_CODE_SUCCESS);
457
458	1.91k	ret = true;
459	1.91k	} catch ( ... ) {
460	155	ret = false;
461	155	}
462
463	2.91k	end:
464	2.91k	if ( lwt_msg ) {
465	22	delete lwt_msg;
466	22	}
467	2.91k	return ret;
468	2.91k	}
469
470	1.75k	void wolfMQTTFuzzer::Run(void) {
471	1.75k	try {
472	1.75k	const auto numActions = ds.Get<uint8_t>() % 20;
473
474	9.39k	for (size_t i = 0; i < numActions; i++) {
475	9.24k	switch ( ds.Get<uint8_t>() ) {
476	1.01k	case 0:
477	1.01k	subscribe();
478	1.01k	break;
479	557	case 1:
480	557	unsubscribe();
481	557	break;
482	948	case 2:
483	948	publish();
484	948	break;
485	941	case 3:
486	941	ping();
487	941	break;
488	3.53k	case 4:
489	3.53k	wait();
490	3.53k	break;
491	9.24k	}
492	9.24k	}
493
494	142	MqttClient_NetDisconnect(client);
495	1.64k	} catch ( ... ) { }
496	1.75k	}
497
498	19.0k	int wolfMQTTFuzzer::recv(byte* buf, const int buf_len) {
499	19.0k	try {
500	19.0k	const auto data = ds.GetData(0);
501	19.0k	const size_t copySize = buf_len > data.size() ? data.size() : buf_len;
502	19.0k	if ( copySize ) {
503	14.4k	memcpy(buf, data.data(), copySize);
504	14.4k	}
505	19.0k	if ( DEBUG )
506	0	{
507	0	printf("Recv: %zu bytes (%d requested)\n", copySize, buf_len);
508	0	for (size_t i = 0; i < copySize; i++) {
509	0	printf("%02X ", data[i]);
510	0	}
511	0	printf("\n");
512	0	}
513	19.0k	return copySize;
514	19.0k	} catch ( ... ) {
515	1.76k	if ( DEBUG ) printf("Recv: -1\n");
516	1.76k	return -1;
517	1.76k	}
518	19.0k	}
519
520	9.11k	int wolfMQTTFuzzer::write(const int buf_len) {
521	9.11k	try {
522	9.11k	if ( ds.Get<bool>() == true ) {
523	784	if ( DEBUG ) printf("write: -1\n");
524	784	return -1;
525	784	}
526
527	8.33k	const auto ret = (int)(ds.Get<uint32_t>() % (buf_len+1));
528	8.33k	if ( DEBUG ) printf("write: %d bytes (%d requested)\n", ret, buf_len);
529	8.33k	return ret;
530	9.11k	} catch ( ... ) {
531	714	return -1;
532	714	}
533	9.11k	}
534
535	2.91k	extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
536	2.91k	fuzzing::datasource::Datasource ds(data, size);
537	2.91k	wolfMQTTFuzzer fuzzer(ds);
538
539	2.91k	CHECK_EQ(fuzzer.Initialize(), true);
540
541	1.75k	fuzzer.Run();
542
543	2.91k	end:
544	2.91k	return 0;
545	1.75k	}