LLVMFuzzerInitialize: 46| 2|int LLVMFuzzerInitialize(int *argc, char ***argv) { 47| 2| (void)argc; 48| 2| (void)argv; 49| | 50| 2|#if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && !defined(LIBRESSL_VERSION_NUMBER) 51| | /* 52| | * Keep fuzzing deterministic and avoid MSan reports from OpenSSL's 53| | * environment-dependent config file loading in unsanitized libcrypto. 54| | */ 55| 2| OPENSSL_init_crypto(OPENSSL_INIT_NO_LOAD_CONFIG, NULL); 56| 2|#endif 57| | 58| 2| seed_addr_mappings(); 59| | 60| 2| return 0; 61| 2|} FuzzOpenSSLInit.c:seed_addr_mappings: 29| 2|static void seed_addr_mappings(void) { 30| 2| ioa_addr pub4 = {0}; 31| 2| ioa_addr priv4 = {0}; 32| 2| ioa_addr pub6 = {0}; 33| 2| ioa_addr priv6 = {0}; 34| | 35| 2| if (make_ioa_addr((const uint8_t *)"192.0.2.1", 0, &pub4) == 0 && ------------------ | Branch (35:7): [True: 2, False: 0] ------------------ 36| 2| make_ioa_addr((const uint8_t *)"10.0.0.1", 0, &priv4) == 0) { ------------------ | Branch (36:7): [True: 2, False: 0] ------------------ 37| 2| ioa_addr_add_mapping(&pub4, &priv4); 38| 2| } 39| | 40| 2| if (make_ioa_addr((const uint8_t *)"2001:db8::1", 0, &pub6) == 0 && ------------------ | Branch (40:7): [True: 2, False: 0] ------------------ 41| 2| make_ioa_addr((const uint8_t *)"fd00::1", 0, &priv6) == 0) { ------------------ | Branch (41:7): [True: 2, False: 0] ------------------ 42| 2| ioa_addr_add_mapping(&pub6, &priv6); 43| 2| } 44| 2|} LLVMFuzzerTestOneInput: 816| 1.78k|extern int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { 817| 1.78k| harness_stun_client(Data, Size); 818| 1.78k| harness_channel_data(Data, Size); 819| 1.78k| harness_addr_codec(Data, Size); 820| 1.78k| harness_message_builders(Data, Size); 821| 1.78k| harness_attr_get_first_addr(Data, Size); 822| 1.78k| harness_response_matrix(Data, Size); 823| 1.78k| harness_stun_buffer_api(Data, Size); 824| 1.78k| return 0; 825| 1.78k|} FuzzStunClient.c:harness_stun_client: 212| 1.78k|static void harness_stun_client(const uint8_t *Data, size_t Size) { 213| 1.78k| if (Size < 10 || Size > 5120) { ------------------ | Branch (213:7): [True: 482, False: 1.30k] | Branch (213:20): [True: 87, False: 1.21k] ------------------ 214| 569| return; 215| 569| } 216| | 217| 1.21k| stun_buffer buf; 218| 1.21k| buf.len = Size; 219| 1.21k| memcpy(buf.buf, Data, buf.len); 220| | 221| 1.21k| if (!stun_is_command_message(&buf)) { ------------------ | Branch (221:7): [True: 1.05k, False: 157] ------------------ 222| 1.05k| return; 223| 1.05k| } 224| | 225| 157| (void)stun_get_method_str(buf.buf, buf.len); 226| 157| (void)stun_get_msg_type_str(buf.buf, buf.len); 227| | 228| 157| if (stun_is_response(&buf) && stun_is_success_response(&buf) && stun_is_binding_response(&buf)) { ------------------ | Branch (228:7): [True: 139, False: 18] | Branch (228:33): [True: 61, False: 78] | Branch (228:67): [True: 11, False: 50] ------------------ 229| 11| return; 230| 11| } 231| | 232| 146| stun_is_indication_str(buf.buf, buf.len); 233| | 234| 146| int err_code = 0; 235| 146| uint8_t err_msg[256] = {0}; 236| 146| stun_is_error_response_str(buf.buf, buf.len, &err_code, err_msg, sizeof(err_msg)); 237| 146|} FuzzStunClient.c:harness_channel_data: 242| 1.78k|static void harness_channel_data(const uint8_t *Data, size_t Size) { 243| 1.78k| if (Size < 4 || Size > 8192) { ------------------ | Branch (243:7): [True: 275, False: 1.51k] | Branch (243:19): [True: 64, False: 1.44k] ------------------ 244| 339| return; 245| 339| } 246| | 247| 1.44k| uint8_t buf[8192] = {0}; 248| 1.44k| memcpy(buf, Data, Size); 249| | 250| 1.44k| size_t app_len_tcp = 0; 251| 1.44k| size_t app_len_udp = 0; 252| | 253| 1.44k| int mlen_tcp = stun_get_message_len_str(buf, Size, 1, &app_len_tcp); 254| 1.44k| int mlen_udp = stun_get_message_len_str(buf, Size, 0, &app_len_udp); 255| | 256| 1.44k| if (mlen_tcp > 0) { ------------------ | Branch (256:7): [True: 563, False: 883] ------------------ 257| 563| if (app_len_tcp > Size) { ------------------ | Branch (257:9): [True: 0, False: 563] ------------------ 258| 0| __builtin_trap(); 259| 0| } 260| 563| if ((size_t)mlen_tcp > Size) { ------------------ | Branch (260:9): [True: 0, False: 563] ------------------ 261| 0| __builtin_trap(); 262| 0| } 263| 563| if ((size_t)mlen_tcp < app_len_tcp) { ------------------ | Branch (263:9): [True: 0, False: 563] ------------------ 264| 0| __builtin_trap(); 265| 0| } 266| 563| } 267| | 268| 1.44k| if (mlen_udp > 0) { ------------------ | Branch (268:7): [True: 578, False: 868] ------------------ 269| 578| if (app_len_udp > Size) { ------------------ | Branch (269:9): [True: 0, False: 578] ------------------ 270| 0| __builtin_trap(); 271| 0| } 272| 578| if ((size_t)mlen_udp > Size) { ------------------ | Branch (272:9): [True: 0, False: 578] ------------------ 273| 0| __builtin_trap(); 274| 0| } 275| 578| } 276| | 277| 1.44k| size_t blen_tcp = Size; 278| 1.44k| uint16_t chn_tcp = 0; 279| 1.44k| bool is_chan_tcp = stun_is_channel_message_str(buf, &blen_tcp, &chn_tcp, true); 280| | 281| 1.44k| size_t blen_udp = Size; 282| 1.44k| uint16_t chn_udp = 0; 283| 1.44k| bool is_chan_udp = stun_is_channel_message_str(buf, &blen_udp, &chn_udp, false); 284| | 285| 1.44k| if (is_chan_tcp && (blen_tcp < 4 || blen_tcp > Size)) { ------------------ | Branch (285:7): [True: 104, False: 1.34k] | Branch (285:23): [True: 0, False: 104] | Branch (285:39): [True: 0, False: 104] ------------------ 286| 0| __builtin_trap(); 287| 0| } 288| 1.44k| if (is_chan_udp && (blen_udp < 4 || blen_udp > Size)) { ------------------ | Branch (288:7): [True: 119, False: 1.32k] | Branch (288:23): [True: 0, False: 119] | Branch (288:39): [True: 0, False: 119] ------------------ 289| 0| __builtin_trap(); 290| 0| } 291| 1.44k|} FuzzStunClient.c:harness_addr_codec: 296| 1.78k|static void harness_addr_codec(const uint8_t *Data, size_t Size) { 297| 1.78k| if (Size < 2 || Size > 64) { ------------------ | Branch (297:7): [True: 74, False: 1.71k] | Branch (297:19): [True: 505, False: 1.20k] ------------------ 298| 579| return; 299| 579| } 300| | 301| 1.20k| uint8_t tid[STUN_TID_SIZE] = {0}; 302| 1.20k| size_t tid_bytes = Size > (STUN_TID_SIZE + 2) ? STUN_TID_SIZE : (Size > 2 ? Size - 2 : 0); ------------------ | | 53| 1.20k|#define STUN_TID_SIZE (12) ------------------ size_t tid_bytes = Size > (STUN_TID_SIZE + 2) ? STUN_TID_SIZE : (Size > 2 ? Size - 2 : 0); ------------------ | | 53| 703|#define STUN_TID_SIZE (12) ------------------ | Branch (302:22): [True: 703, False: 503] | Branch (302:68): [True: 418, False: 85] ------------------ 303| 1.20k| memcpy(tid, Data, tid_bytes); 304| 1.20k| const uint8_t *payload = Data + tid_bytes; 305| 1.20k| int payload_len = (int)(Size - tid_bytes); 306| | 307| 1.20k| ioa_addr addr = {0}; 308| | 309| | /* XOR decode + round-trip */ 310| 1.20k| if (stun_addr_decode(&addr, payload, payload_len, 1, STUN_MAGIC_COOKIE, tid) == 0) { ------------------ | | 60| 1.20k|#define STUN_MAGIC_COOKIE (0x2112A442) ------------------ | Branch (310:7): [True: 4, False: 1.20k] ------------------ 311| 4| uint8_t enc_buf[32] = {0}; 312| 4| int enc_len = 0; 313| 4| if (stun_addr_encode(&addr, enc_buf, &enc_len, 1, STUN_MAGIC_COOKIE, tid) == 0) { ------------------ | | 60| 4|#define STUN_MAGIC_COOKIE (0x2112A442) ------------------ | Branch (313:9): [True: 4, False: 0] ------------------ 314| 4| ioa_addr addr2 = {0}; 315| 4| stun_addr_decode(&addr2, enc_buf, enc_len, 1, STUN_MAGIC_COOKIE, tid); ------------------ | | 60| 4|#define STUN_MAGIC_COOKIE (0x2112A442) ------------------ 316| 4| } 317| 4| } 318| | 319| | /* Plain decode + round-trip */ 320| 1.20k| memset(&addr, 0, sizeof(addr)); 321| 1.20k| if (stun_addr_decode(&addr, payload, payload_len, 0, 0, tid) == 0) { ------------------ | Branch (321:7): [True: 4, False: 1.20k] ------------------ 322| 4| uint8_t enc_buf[32] = {0}; 323| 4| int enc_len = 0; 324| 4| if (stun_addr_encode(&addr, enc_buf, &enc_len, 0, 0, tid) == 0) { ------------------ | Branch (324:9): [True: 4, False: 0] ------------------ 325| 4| ioa_addr addr2 = {0}; 326| 4| stun_addr_decode(&addr2, enc_buf, enc_len, 0, 0, tid); 327| 4| } 328| 4| } 329| | 330| | /* Alternate magic cookie (old STUN) */ 331| 1.20k| memset(&addr, 0, sizeof(addr)); 332| 1.20k| uint32_t alt_cookie = 0; 333| 1.20k| if (Size >= 4) { ------------------ | Branch (333:7): [True: 1.00k, False: 201] ------------------ 334| 1.00k| memcpy(&alt_cookie, Data, 4); 335| 1.00k| } 336| 1.20k| (void)stun_addr_decode(&addr, payload, payload_len, 1, alt_cookie, tid); 337| 1.20k|} FuzzStunClient.c:harness_message_builders: 342| 1.78k|static void harness_message_builders(const uint8_t *Data, size_t Size) { 343| 1.78k| if (!Size || Size > 4096) { ------------------ | Branch (343:7): [True: 0, False: 1.78k] | Branch (343:16): [True: 137, False: 1.64k] ------------------ 344| 137| return; 345| 137| } 346| | 347| 1.64k| static const uint16_t kMethods[] = { 348| 1.64k| STUN_METHOD_ALLOCATE, STUN_METHOD_BINDING, STUN_METHOD_CHANNEL_BIND, STUN_METHOD_REFRESH, STUN_METHOD_CONNECT, ------------------ | | 82| 1.64k|#define STUN_METHOD_ALLOCATE (0x0003) ------------------ STUN_METHOD_ALLOCATE, STUN_METHOD_BINDING, STUN_METHOD_CHANNEL_BIND, STUN_METHOD_REFRESH, STUN_METHOD_CONNECT, ------------------ | | 81| 1.64k|#define STUN_METHOD_BINDING (0x0001) ------------------ STUN_METHOD_ALLOCATE, STUN_METHOD_BINDING, STUN_METHOD_CHANNEL_BIND, STUN_METHOD_REFRESH, STUN_METHOD_CONNECT, ------------------ | | 87| 1.64k|#define STUN_METHOD_CHANNEL_BIND (0x0009) ------------------ STUN_METHOD_ALLOCATE, STUN_METHOD_BINDING, STUN_METHOD_CHANNEL_BIND, STUN_METHOD_REFRESH, STUN_METHOD_CONNECT, ------------------ | | 83| 1.64k|#define STUN_METHOD_REFRESH (0x0004) ------------------ STUN_METHOD_ALLOCATE, STUN_METHOD_BINDING, STUN_METHOD_CHANNEL_BIND, STUN_METHOD_REFRESH, STUN_METHOD_CONNECT, ------------------ | | 90| 1.64k|#define STUN_METHOD_CONNECT (0x000a) ------------------ 349| 1.64k| }; 350| 1.64k| static const uint16_t kErrorCodes[] = { 351| 1.64k| 300, 400, 401, 403, 420, 437, 438, 440, 441, 442, 443, 446, 447, 486, 487, 500, 508, 699, 352| 1.64k| }; 353| | 354| 1.64k| stun_tid tid = {0}; 355| 1.64k| ioa_addr relay1 = {0}; 356| 1.64k| ioa_addr relay2 = {0}; 357| 1.64k| ioa_addr reflexive = {0}; 358| 1.64k| ioa_addr peer = {0}; 359| 1.64k| ioa_addr default_addr = {0}; 360| 1.64k| char reason[96] = {0}; 361| 1.64k| char mobile_id[96] = {0}; 362| 1.64k| uint8_t raw[MAX_STUN_MESSAGE_SIZE] = {0}; 363| | 364| 1.64k| fuzz_tid(Data, Size, 0, &tid); 365| 1.64k| fuzz_addr(Data, Size, 16, &relay1); 366| 1.64k| fuzz_addr(Data, Size, 40, &relay2); 367| 1.64k| fuzz_addr(Data, Size, 64, &reflexive); 368| 1.64k| fuzz_addr(Data, Size, 88, &peer); 369| 1.64k| fuzz_addr(Data, Size, 112, &default_addr); 370| 1.64k| fuzz_string(Data, Size, 136, reason, sizeof(reason)); 371| 1.64k| fuzz_string(Data, Size, 232, mobile_id, sizeof(mobile_id)); 372| | 373| 1.64k| const uint16_t method = kMethods[fuzz_byte(Data, Size, 328) % (sizeof(kMethods) / sizeof(kMethods[0]))]; 374| 1.64k| const uint16_t error_code = kErrorCodes[fuzz_byte(Data, Size, 329) % (sizeof(kErrorCodes) / sizeof(kErrorCodes[0]))]; 375| 1.64k| const uint32_t lifetime = fuzz_u32(Data, Size, 330); 376| 1.64k| const uint32_t max_lifetime = fuzz_u32(Data, Size, 334); 377| 1.64k| const uint64_t reservation_token = fuzz_u64(Data, Size, 338); 378| 1.64k| const uint16_t channel_number = fuzz_u16(Data, Size, 346); 379| 1.64k| const bool include_reason = fuzz_flag(Data, Size, 348); 380| 1.64k| const bool old_stun = fuzz_flag(Data, Size, 349); 381| 1.64k| const bool stun_backward_compatibility = fuzz_flag(Data, Size, 350); 382| 1.64k| const uint32_t old_cookie = fuzz_u32(Data, Size, 351); 383| | 384| | /* Direct wrapper coverage for stun_init_error_response(). */ 385| 1.64k| { 386| 1.64k| stun_buffer msg; 387| 1.64k| stun_init_buffer(&msg); 388| 1.64k| stun_init_error_response(method, &msg, error_code, reason[0] ? (const uint8_t *)reason : NULL, &tid, ------------------ | Branch (388:56): [True: 1.12k, False: 524] ------------------ 389| 1.64k| include_reason); 390| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_MAPPED_ADDRESS, &default_addr); ------------------ | | 95| 1.64k|#define STUN_ATTRIBUTE_MAPPED_ADDRESS (0x0001) ------------------ 391| 1.64k| } 392| | 393| | /* Success allocate response covers addr extraction; error allocate response 394| | * forces the shared error builder path. */ 395| 1.64k| { 396| 1.64k| stun_buffer msg; 397| 1.64k| stun_init_buffer(&msg); 398| 1.64k| (void)stun_set_allocate_response(&msg, &tid, &relay1, fuzz_flag(Data, Size, 355) ? &relay2 : NULL, &reflexive, ------------------ | Branch (398:59): [True: 598, False: 1.05k] ------------------ 399| 1.64k| lifetime, max_lifetime, 0, (const uint8_t *)reason, reservation_token, mobile_id, 400| 1.64k| include_reason); 401| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS, &default_addr); ------------------ | | 122| 1.64k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ 402| | 403| 1.64k| size_t raw_len = sizeof(raw); 404| 1.64k| (void)stun_set_allocate_response_str(raw, &raw_len, &tid, &relay1, &relay2, &reflexive, lifetime, max_lifetime, 0, 405| 1.64k| (const uint8_t *)reason, reservation_token, mobile_id, include_reason); 406| 1.64k| inspect_raw_message(raw, raw_len, STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS, &default_addr); ------------------ | | 122| 1.64k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ 407| | 408| 1.64k| stun_init_buffer(&msg); 409| 1.64k| (void)stun_set_allocate_response(&msg, &tid, NULL, NULL, NULL, lifetime, max_lifetime, error_code, 410| 1.64k| reason[0] ? (const uint8_t *)reason : NULL, reservation_token, mobile_id, ------------------ | Branch (410:38): [True: 1.12k, False: 524] ------------------ 411| 1.64k| include_reason); 412| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS, &default_addr); ------------------ | | 122| 1.64k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ 413| | 414| 1.64k| raw_len = sizeof(raw); 415| 1.64k| (void)stun_set_allocate_response_str(raw, &raw_len, &tid, NULL, NULL, NULL, lifetime, max_lifetime, error_code, 416| 1.64k| reason[0] ? (const uint8_t *)reason : NULL, reservation_token, mobile_id, ------------------ | Branch (416:42): [True: 1.12k, False: 524] ------------------ 417| 1.64k| include_reason); 418| 1.64k| inspect_raw_message(raw, raw_len, STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS, &default_addr); ------------------ | | 122| 1.64k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ 419| 1.64k| } 420| | 421| 1.64k| { 422| 1.64k| stun_buffer msg; 423| 1.64k| stun_init_buffer(&msg); 424| 1.64k| (void)stun_set_binding_response(&msg, &tid, &reflexive, 0, (const uint8_t *)reason, include_reason); 425| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS, &default_addr); ------------------ | | 109| 1.64k|#define STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS (0x0020) ------------------ 426| | 427| 1.64k| size_t raw_len = sizeof(raw); 428| 1.64k| (void)stun_set_binding_response_str(raw, &raw_len, &tid, &reflexive, 0, (const uint8_t *)reason, old_cookie, 429| 1.64k| old_stun, stun_backward_compatibility, include_reason); 430| 1.64k| inspect_raw_message(raw, raw_len, old_stun ? STUN_ATTRIBUTE_MAPPED_ADDRESS : STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS, ------------------ | | 95| 675|#define STUN_ATTRIBUTE_MAPPED_ADDRESS (0x0001) ------------------ inspect_raw_message(raw, raw_len, old_stun ? STUN_ATTRIBUTE_MAPPED_ADDRESS : STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS, ------------------ | | 109| 2.62k|#define STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS (0x0020) ------------------ | Branch (430:39): [True: 675, False: 973] ------------------ 431| 1.64k| &default_addr); 432| | 433| 1.64k| stun_init_buffer(&msg); 434| 1.64k| (void)stun_set_binding_response(&msg, &tid, NULL, error_code, reason[0] ? (const uint8_t *)reason : NULL, ------------------ | Branch (434:67): [True: 1.12k, False: 524] ------------------ 435| 1.64k| include_reason); 436| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_MAPPED_ADDRESS, &default_addr); ------------------ | | 95| 1.64k|#define STUN_ATTRIBUTE_MAPPED_ADDRESS (0x0001) ------------------ 437| | 438| 1.64k| raw_len = sizeof(raw); 439| 1.64k| (void)stun_set_binding_response_str(raw, &raw_len, &tid, NULL, error_code, 440| 1.64k| reason[0] ? (const uint8_t *)reason : NULL, old_cookie, old_stun, ------------------ | Branch (440:41): [True: 1.12k, False: 524] ------------------ 441| 1.64k| stun_backward_compatibility, include_reason); 442| 1.64k| inspect_raw_message(raw, raw_len, STUN_ATTRIBUTE_MAPPED_ADDRESS, &default_addr); ------------------ | | 95| 1.64k|#define STUN_ATTRIBUTE_MAPPED_ADDRESS (0x0001) ------------------ 443| 1.64k| } 444| | 445| 1.64k| { 446| 1.64k| stun_buffer msg; 447| 1.64k| stun_init_buffer(&msg); 448| 1.64k| (void)stun_set_channel_bind_request(&msg, fuzz_flag(Data, Size, 356) ? &peer : NULL, channel_number); ------------------ | Branch (448:47): [True: 626, False: 1.02k] ------------------ 449| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, &default_addr); ------------------ | | 120| 1.64k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ 450| | 451| 1.64k| size_t raw_len = sizeof(raw); 452| 1.64k| (void)stun_set_channel_bind_request_str(raw, &raw_len, fuzz_flag(Data, Size, 357) ? &peer : NULL, channel_number); ------------------ | Branch (452:60): [True: 598, False: 1.05k] ------------------ 453| 1.64k| inspect_raw_message(raw, raw_len, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, &default_addr); ------------------ | | 120| 1.64k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ 454| | 455| 1.64k| stun_init_buffer(&msg); 456| 1.64k| stun_set_channel_bind_response(&msg, &tid, 0, (const uint8_t *)reason, include_reason); 457| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, &default_addr); ------------------ | | 120| 1.64k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ 458| | 459| 1.64k| raw_len = sizeof(raw); 460| 1.64k| stun_set_channel_bind_response_str(raw, &raw_len, &tid, error_code, reason[0] ? (const uint8_t *)reason : NULL, ------------------ | Branch (460:73): [True: 1.12k, False: 524] ------------------ 461| 1.64k| include_reason); 462| 1.64k| inspect_raw_message(raw, raw_len, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, &default_addr); ------------------ | | 120| 1.64k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ 463| 1.64k| } 464| 1.64k|} FuzzStunClient.c:fuzz_tid: 57| 4.94k|static void fuzz_tid(const uint8_t *Data, size_t Size, size_t idx, stun_tid *tid) { 58| 4.94k| if (!tid) { ------------------ | Branch (58:7): [True: 0, False: 4.94k] ------------------ 59| 0| return; 60| 0| } 61| | 62| 4.94k| memset(tid, 0, sizeof(*tid)); 63| 64.2k| for (size_t i = 0; i < STUN_TID_SIZE; ++i) { ------------------ | | 53| 64.2k|#define STUN_TID_SIZE (12) ------------------ | Branch (63:22): [True: 59.3k, False: 4.94k] ------------------ 64| 59.3k| tid->tsx_id[i] = fuzz_byte(Data, Size, idx + i); 65| 59.3k| } 66| 4.94k|} FuzzStunClient.c:fuzz_addr: 68| 20.8k|static void fuzz_addr(const uint8_t *Data, size_t Size, size_t idx, ioa_addr *addr) { 69| 20.8k| if (!addr) { ------------------ | Branch (69:7): [True: 0, False: 20.8k] ------------------ 70| 0| return; 71| 0| } 72| | 73| 20.8k| memset(addr, 0, sizeof(*addr)); 74| | 75| 20.8k| if (fuzz_flag(Data, Size, idx)) { ------------------ | Branch (75:7): [True: 8.36k, False: 12.4k] ------------------ 76| 8.36k| addr->s6.sin6_family = AF_INET6; 77| 8.36k| addr->s6.sin6_port = htons(fuzz_u16(Data, Size, idx + 1)); 78| 142k| for (size_t i = 0; i < 16; ++i) { ------------------ | Branch (78:24): [True: 133k, False: 8.36k] ------------------ 79| 133k| addr->s6.sin6_addr.s6_addr[i] = fuzz_byte(Data, Size, idx + 3 + i); 80| 133k| } 81| 8.36k| if (!memcmp(addr->s6.sin6_addr.s6_addr, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 16)) { ------------------ | Branch (81:9): [True: 45, False: 8.32k] ------------------ 82| 45| addr->s6.sin6_addr.s6_addr[15] = 1; 83| 45| } 84| 12.4k| } else { 85| 12.4k| addr->s4.sin_family = AF_INET; 86| 12.4k| addr->s4.sin_port = htons(fuzz_u16(Data, Size, idx + 1)); 87| | addr->s4.sin_addr.s_addr = htonl(fuzz_u32(Data, Size, idx + 3) | 1u); 88| 12.4k| } 89| 20.8k|} FuzzStunClient.c:fuzz_string: 42| 9.88k|static void fuzz_string(const uint8_t *Data, size_t Size, size_t idx, char *out, size_t out_size) { 43| 9.88k| if (!out || !out_size) { ------------------ | Branch (43:7): [True: 0, False: 9.88k] | Branch (43:15): [True: 0, False: 9.88k] ------------------ 44| 0| return; 45| 0| } 46| | 47| 9.88k| const size_t max_len = out_size - 1; 48| 9.88k| const size_t len = max_len ? (size_t)(fuzz_byte(Data, Size, idx) % (max_len + 1)) : 0; ------------------ | Branch (48:22): [True: 9.88k, False: 0] ------------------ 49| | 50| 266k| for (size_t i = 0; i < len; ++i) { ------------------ | Branch (50:22): [True: 257k, False: 9.88k] ------------------ 51| 257k| out[i] = (char)('A' + (fuzz_byte(Data, Size, idx + 1 + i) % 26)); 52| 257k| } 53| | 54| 9.88k| out[len] = '\0'; 55| 9.88k|} FuzzStunClient.c:fuzz_byte: 26| 678k|static uint8_t fuzz_byte(const uint8_t *Data, size_t Size, size_t idx) { return Size ? Data[idx % Size] : 0; } ------------------ | Branch (26:81): [True: 678k, False: 0] ------------------ FuzzStunClient.c:fuzz_u32: 32| 28.9k|static uint32_t fuzz_u32(const uint8_t *Data, size_t Size, size_t idx) { 33| 28.9k| return ((uint32_t)fuzz_u16(Data, Size, idx) << 16) | (uint32_t)fuzz_u16(Data, Size, idx + 2); 34| 28.9k|} FuzzStunClient.c:fuzz_u64: 36| 3.29k|static uint64_t fuzz_u64(const uint8_t *Data, size_t Size, size_t idx) { 37| 3.29k| return ((uint64_t)fuzz_u32(Data, Size, idx) << 32) | (uint64_t)fuzz_u32(Data, Size, idx + 4); 38| 3.29k|} FuzzStunClient.c:fuzz_u16: 28| 85.3k|static uint16_t fuzz_u16(const uint8_t *Data, size_t Size, size_t idx) { 29| 85.3k| return (uint16_t)(((uint16_t)fuzz_byte(Data, Size, idx) << 8) | (uint16_t)fuzz_byte(Data, Size, idx + 1)); 30| 85.3k|} FuzzStunClient.c:fuzz_flag: 40| 37.3k|static bool fuzz_flag(const uint8_t *Data, size_t Size, size_t idx) { return (fuzz_byte(Data, Size, idx) & 1u) != 0; } FuzzStunClient.c:inspect_buffer_message: 91| 41.2k|static void inspect_buffer_message(stun_buffer *msg, uint16_t addr_attr_type, const ioa_addr *default_addr) { 92| 41.2k| if (!msg) { ------------------ | Branch (92:7): [True: 0, False: 41.2k] ------------------ 93| 0| return; 94| 0| } 95| | 96| 41.2k| (void)stun_get_command_message_len(msg); 97| 41.2k| (void)stun_is_command_message(msg); 98| 41.2k| (void)stun_is_request(msg); 99| 41.2k| (void)stun_is_response(msg); 100| 41.2k| (void)stun_is_success_response(msg); 101| 41.2k| (void)stun_is_binding_response(msg); 102| 41.2k| (void)stun_get_method(msg); 103| 41.2k| (void)stun_get_msg_type(msg); 104| | 105| 41.2k| { 106| 41.2k| int err_code = 0; 107| 41.2k| uint8_t err_msg[256] = {0}; 108| 41.2k| (void)stun_is_error_response(msg, &err_code, err_msg, sizeof(err_msg)); 109| 41.2k| } 110| | 111| 41.2k| { 112| 41.2k| ioa_addr parsed = {0}; 113| 41.2k| (void)stun_attr_get_first_addr(msg, addr_attr_type, &parsed, default_addr); 114| 41.2k| } 115| | 116| 41.2k| { 117| 41.2k| stun_attr_ref attr = stun_attr_get_first(msg); 118| 113k| while (attr) { ------------------ | Branch (118:12): [True: 72.1k, False: 41.2k] ------------------ 119| 72.1k| (void)stun_attr_get_type(attr); 120| 72.1k| (void)stun_attr_get_len(attr); 121| 72.1k| if (stun_attr_is_addr(attr)) { ------------------ | Branch (121:11): [True: 23.6k, False: 48.5k] ------------------ 122| 23.6k| ioa_addr parsed = {0}; 123| 23.6k| (void)stun_attr_get_addr(msg, attr, &parsed, default_addr); 124| 23.6k| } 125| 72.1k| attr = stun_attr_get_next(msg, attr); 126| 72.1k| } 127| 41.2k| } 128| | 129| 41.2k| (void)stun_attr_get_first_channel_number(msg); 130| 41.2k|} FuzzStunClient.c:inspect_raw_message: 132| 34.6k|static void inspect_raw_message(const uint8_t *buf, size_t len, uint16_t addr_attr_type, const ioa_addr *default_addr) { 133| 34.6k| if (!buf || !len) { ------------------ | Branch (133:7): [True: 0, False: 34.6k] | Branch (133:15): [True: 0, False: 34.6k] ------------------ 134| 0| return; 135| 0| } 136| | 137| 34.6k| (void)stun_is_command_message_str((uint8_t *)buf, len); 138| 34.6k| (void)stun_is_request_str(buf, len); 139| 34.6k| (void)stun_is_response_str(buf, len); 140| 34.6k| (void)stun_is_success_response_str(buf, len); 141| 34.6k| (void)stun_is_binding_response_str(buf, len); 142| 34.6k| (void)stun_get_method_str(buf, len); 143| 34.6k| (void)stun_get_msg_type_str(buf, len); 144| | 145| 34.6k| { 146| 34.6k| int err_code = 0; 147| 34.6k| uint8_t err_msg[256] = {0}; 148| 34.6k| (void)stun_is_error_response_str(buf, len, &err_code, err_msg, sizeof(err_msg)); 149| 34.6k| } 150| | 151| 34.6k| { 152| 34.6k| ioa_addr parsed = {0}; 153| 34.6k| (void)stun_attr_get_first_addr_str(buf, len, addr_attr_type, &parsed, default_addr); 154| 34.6k| } 155| | 156| 34.6k| { 157| 34.6k| stun_attr_ref attr = stun_attr_get_first_str(buf, len); 158| 91.5k| while (attr) { ------------------ | Branch (158:12): [True: 56.9k, False: 34.6k] ------------------ 159| 56.9k| (void)stun_attr_get_type(attr); 160| 56.9k| (void)stun_attr_get_len(attr); 161| 56.9k| if (stun_attr_is_addr(attr)) { ------------------ | Branch (161:11): [True: 26.6k, False: 30.2k] ------------------ 162| 26.6k| ioa_addr parsed = {0}; 163| 26.6k| (void)stun_attr_get_addr_str(buf, len, attr, &parsed, default_addr); 164| 26.6k| } 165| 56.9k| attr = stun_attr_get_next_str(buf, len, attr); 166| 56.9k| } 167| 34.6k| } 168| | 169| 34.6k| (void)stun_attr_get_first_channel_number_str(buf, len); 170| 34.6k|} FuzzStunClient.c:harness_attr_get_first_addr: 187| 1.78k|static void harness_attr_get_first_addr(const uint8_t *Data, size_t Size) { 188| 1.78k| if (Size < STUN_HEADER_LENGTH || Size > 5120) { ------------------ | | 46| 3.57k|#define STUN_HEADER_LENGTH (20) ------------------ | Branch (188:7): [True: 622, False: 1.16k] | Branch (188:36): [True: 87, False: 1.07k] ------------------ 189| 709| return; 190| 709| } 191| | 192| 1.07k| stun_buffer msg; 193| 1.07k| msg.len = Size; 194| 1.07k| memcpy(msg.buf, Data, Size); 195| | 196| 1.07k| ioa_addr default_addr = {0}; 197| 1.07k| fuzz_addr(Data, Size, 0, &default_addr); 198| | 199| 1.07k| const size_t num_attrs = sizeof(kFirstAddrAttrs) / sizeof(kFirstAddrAttrs[0]); 200| 9.68k| for (size_t i = 0; i < num_attrs; ++i) { ------------------ | Branch (200:22): [True: 8.60k, False: 1.07k] ------------------ 201| 8.60k| ioa_addr parsed = {0}; 202| 8.60k| (void)stun_attr_get_first_addr(&msg, kFirstAddrAttrs[i], &parsed, NULL); 203| | 204| 8.60k| memset(&parsed, 0, sizeof(parsed)); 205| 8.60k| (void)stun_attr_get_first_addr(&msg, kFirstAddrAttrs[i], &parsed, &default_addr); 206| 8.60k| } 207| 1.07k|} FuzzStunClient.c:harness_response_matrix: 477| 1.78k|static void harness_response_matrix(const uint8_t *Data, size_t Size) { 478| 1.78k| if (!Size || Size > 4096) { ------------------ | Branch (478:7): [True: 0, False: 1.78k] | Branch (478:16): [True: 137, False: 1.64k] ------------------ 479| 137| return; 480| 137| } 481| | 482| 1.64k| stun_tid tid = {0}; 483| 1.64k| ioa_addr relay1 = {0}; 484| 1.64k| ioa_addr relay2 = {0}; 485| 1.64k| ioa_addr reflexive = {0}; 486| 1.64k| ioa_addr peer = {0}; 487| 1.64k| ioa_addr default_addr = {0}; 488| 1.64k| char reason[96] = {0}; 489| 1.64k| char mobile_id[96] = {0}; 490| 1.64k| uint8_t raw[MAX_STUN_MESSAGE_SIZE] = {0}; 491| | 492| 1.64k| fuzz_tid(Data, Size, 0, &tid); 493| 1.64k| fuzz_addr(Data, Size, 16, &relay1); 494| 1.64k| fuzz_addr(Data, Size, 40, &relay2); 495| 1.64k| fuzz_addr(Data, Size, 64, &reflexive); 496| 1.64k| fuzz_addr(Data, Size, 88, &peer); 497| 1.64k| fuzz_addr(Data, Size, 112, &default_addr); 498| 1.64k| fuzz_string(Data, Size, 136, reason, sizeof(reason)); 499| 1.64k| fuzz_string(Data, Size, 232, mobile_id, sizeof(mobile_id)); 500| | 501| 1.64k| const uint32_t max_lifetime = fuzz_u32(Data, Size, 328) | 1u; 502| 1.64k| const uint64_t reservation_token = fuzz_u64(Data, Size, 332) | 1ull; 503| 1.64k| const uint16_t channel_number_valid = (uint16_t)(0x4000u + (fuzz_u16(Data, Size, 340) % (0x7FFFu - 0x4000u + 1u))); 504| 1.64k| const uint32_t old_cookie = fuzz_u32(Data, Size, 344); 505| | 506| | /* stun_init_error_response — cover (reason NULL vs set) × (include reason). */ 507| 1.64k| { 508| 1.64k| stun_buffer msg; 509| 1.64k| stun_init_buffer(&msg); 510| 1.64k| stun_init_error_response(STUN_METHOD_ALLOCATE, &msg, 437, NULL, &tid, false); ------------------ | | 82| 1.64k|#define STUN_METHOD_ALLOCATE (0x0003) ------------------ 511| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_MAPPED_ADDRESS, &default_addr); ------------------ | | 95| 1.64k|#define STUN_ATTRIBUTE_MAPPED_ADDRESS (0x0001) ------------------ 512| | 513| 1.64k| stun_init_buffer(&msg); 514| 1.64k| stun_init_error_response(STUN_METHOD_BINDING, &msg, 400, (const uint8_t *)reason, &tid, true); ------------------ | | 81| 1.64k|#define STUN_METHOD_BINDING (0x0001) ------------------ 515| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_MAPPED_ADDRESS, &default_addr); ------------------ | | 95| 1.64k|#define STUN_ATTRIBUTE_MAPPED_ADDRESS (0x0001) ------------------ 516| 1.64k| } 517| | 518| | /* stun_set_allocate_response / _str — cover every optional-field branch and 519| | * the error path independently of the fuzzer selectors. */ 520| 1.64k| { 521| 1.64k| stun_buffer msg; 522| | 523| | /* Minimal success: relay1 only, no reflexive, no reservation, no mobile id, 524| | * lifetime 0 (triggers the <1 default branch). */ 525| 1.64k| stun_init_buffer(&msg); 526| 1.64k| (void)stun_set_allocate_response(&msg, &tid, &relay1, NULL, NULL, 0, max_lifetime, 0, NULL, 0, NULL, false); 527| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS, &default_addr); ------------------ | | 122| 1.64k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ 528| | 529| 1.64k| size_t raw_len = sizeof(raw); 530| 1.64k| (void)stun_set_allocate_response_str(raw, &raw_len, &tid, &relay1, NULL, NULL, 0, max_lifetime, 0, NULL, 0, NULL, 531| 1.64k| false); 532| 1.64k| inspect_raw_message(raw, raw_len, STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS, &default_addr); ------------------ | | 122| 1.64k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ 533| | 534| | /* Full success: both relays + reflexive + reservation + mobile id, 535| | * lifetime > max (triggers clamp branch). */ 536| 1.64k| stun_init_buffer(&msg); 537| 1.64k| (void)stun_set_allocate_response(&msg, &tid, &relay1, &relay2, &reflexive, max_lifetime + 1, max_lifetime, 0, 538| 1.64k| (const uint8_t *)reason, reservation_token, mobile_id, true); 539| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS, &default_addr); ------------------ | | 122| 1.64k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ 540| | 541| 1.64k| raw_len = sizeof(raw); 542| 1.64k| (void)stun_set_allocate_response_str(raw, &raw_len, &tid, &relay1, &relay2, &reflexive, max_lifetime + 1, 543| 1.64k| max_lifetime, 0, (const uint8_t *)reason, reservation_token, mobile_id, true); 544| 1.64k| inspect_raw_message(raw, raw_len, STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS, &default_addr); ------------------ | | 122| 1.64k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ 545| | 546| | /* Error path with and without a reason string. */ 547| 1.64k| stun_init_buffer(&msg); 548| 1.64k| (void)stun_set_allocate_response(&msg, &tid, NULL, NULL, NULL, 0, max_lifetime, 441, NULL, 0, NULL, false); 549| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS, &default_addr); ------------------ | | 122| 1.64k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ 550| | 551| 1.64k| raw_len = sizeof(raw); 552| 1.64k| (void)stun_set_allocate_response_str(raw, &raw_len, &tid, NULL, NULL, NULL, 0, max_lifetime, 508, 553| 1.64k| (const uint8_t *)reason, 0, NULL, true); 554| 1.64k| inspect_raw_message(raw, raw_len, STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS, &default_addr); ------------------ | | 122| 1.64k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ 555| 1.64k| } 556| | 557| | /* stun_set_binding_response / _str — cover success × error × old_stun. */ 558| 1.64k| { 559| 1.64k| stun_buffer msg; 560| | 561| 1.64k| stun_init_buffer(&msg); 562| 1.64k| (void)stun_set_binding_response(&msg, &tid, &reflexive, 0, NULL, false); 563| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS, &default_addr); ------------------ | | 109| 1.64k|#define STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS (0x0020) ------------------ 564| | 565| 1.64k| stun_init_buffer(&msg); 566| 1.64k| (void)stun_set_binding_response(&msg, &tid, NULL, 420, (const uint8_t *)reason, true); 567| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_MAPPED_ADDRESS, &default_addr); ------------------ | | 95| 1.64k|#define STUN_ATTRIBUTE_MAPPED_ADDRESS (0x0001) ------------------ 568| | 569| 1.64k| const bool matrix_old_stun[] = {false, true}; 570| 1.64k| const bool matrix_backcompat[] = {false, true}; 571| 4.94k| for (size_t o = 0; o < sizeof(matrix_old_stun) / sizeof(matrix_old_stun[0]); ++o) { ------------------ | Branch (571:24): [True: 3.29k, False: 1.64k] ------------------ 572| 9.88k| for (size_t b = 0; b < sizeof(matrix_backcompat) / sizeof(matrix_backcompat[0]); ++b) { ------------------ | Branch (572:26): [True: 6.59k, False: 3.29k] ------------------ 573| 6.59k| size_t raw_len = sizeof(raw); 574| 6.59k| (void)stun_set_binding_response_str(raw, &raw_len, &tid, &reflexive, 0, NULL, old_cookie, matrix_old_stun[o], 575| 6.59k| matrix_backcompat[b], false); 576| 6.59k| inspect_raw_message(raw, raw_len, 577| 6.59k| matrix_old_stun[o] ? STUN_ATTRIBUTE_MAPPED_ADDRESS : STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS, ------------------ | | 95| 3.29k|#define STUN_ATTRIBUTE_MAPPED_ADDRESS (0x0001) ------------------ matrix_old_stun[o] ? STUN_ATTRIBUTE_MAPPED_ADDRESS : STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS, ------------------ | | 109| 9.88k|#define STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS (0x0020) ------------------ | Branch (577:29): [True: 3.29k, False: 3.29k] ------------------ 578| 6.59k| &default_addr); 579| | 580| 6.59k| raw_len = sizeof(raw); 581| 6.59k| (void)stun_set_binding_response_str(raw, &raw_len, &tid, NULL, 500, (const uint8_t *)reason, old_cookie, 582| 6.59k| matrix_old_stun[o], matrix_backcompat[b], true); 583| 6.59k| inspect_raw_message(raw, raw_len, STUN_ATTRIBUTE_MAPPED_ADDRESS, &default_addr); ------------------ | | 95| 6.59k|#define STUN_ATTRIBUTE_MAPPED_ADDRESS (0x0001) ------------------ 584| 6.59k| } 585| 3.29k| } 586| 1.64k| } 587| | 588| | /* stun_set_channel_bind_request / _str — cover peer NULL vs set. */ 589| 1.64k| { 590| 1.64k| stun_buffer msg; 591| | 592| 1.64k| stun_init_buffer(&msg); 593| 1.64k| (void)stun_set_channel_bind_request(&msg, NULL, channel_number_valid); 594| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, &default_addr); ------------------ | | 120| 1.64k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ 595| | 596| 1.64k| stun_init_buffer(&msg); 597| 1.64k| (void)stun_set_channel_bind_request(&msg, &peer, channel_number_valid); 598| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, &default_addr); ------------------ | | 120| 1.64k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ 599| | 600| 1.64k| size_t raw_len = sizeof(raw); 601| 1.64k| (void)stun_set_channel_bind_request_str(raw, &raw_len, NULL, channel_number_valid); 602| 1.64k| inspect_raw_message(raw, raw_len, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, &default_addr); ------------------ | | 120| 1.64k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ 603| | 604| 1.64k| raw_len = sizeof(raw); 605| 1.64k| (void)stun_set_channel_bind_request_str(raw, &raw_len, &peer, channel_number_valid); 606| 1.64k| inspect_raw_message(raw, raw_len, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, &default_addr); ------------------ | | 120| 1.64k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ 607| 1.64k| } 608| | 609| | /* stun_set_channel_bind_response / _str — cover success vs error. */ 610| 1.64k| { 611| 1.64k| stun_buffer msg; 612| | 613| 1.64k| stun_init_buffer(&msg); 614| 1.64k| stun_set_channel_bind_response(&msg, &tid, 0, NULL, false); 615| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, &default_addr); ------------------ | | 120| 1.64k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ 616| | 617| 1.64k| stun_init_buffer(&msg); 618| 1.64k| stun_set_channel_bind_response(&msg, &tid, 438, (const uint8_t *)reason, true); 619| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, &default_addr); ------------------ | | 120| 1.64k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ 620| | 621| 1.64k| size_t raw_len = sizeof(raw); 622| 1.64k| stun_set_channel_bind_response_str(raw, &raw_len, &tid, 0, NULL, false); 623| 1.64k| inspect_raw_message(raw, raw_len, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, &default_addr); ------------------ | | 120| 1.64k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ 624| | 625| 1.64k| raw_len = sizeof(raw); 626| 1.64k| stun_set_channel_bind_response_str(raw, &raw_len, &tid, 486, (const uint8_t *)reason, true); 627| 1.64k| inspect_raw_message(raw, raw_len, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, &default_addr); ------------------ | | 120| 1.64k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ 628| 1.64k| } 629| 1.64k|} FuzzStunClient.c:harness_stun_buffer_api: 653| 1.78k|static void harness_stun_buffer_api(const uint8_t *Data, size_t Size) { 654| 1.78k| if (!Size || Size > 4096) { ------------------ | Branch (654:7): [True: 0, False: 1.78k] | Branch (654:16): [True: 137, False: 1.64k] ------------------ 655| 137| return; 656| 137| } 657| | 658| 1.64k| static const uint16_t kMethods[] = { 659| 1.64k| STUN_METHOD_ALLOCATE, STUN_METHOD_BINDING, STUN_METHOD_CHANNEL_BIND, STUN_METHOD_REFRESH, STUN_METHOD_CONNECT, ------------------ | | 82| 1.64k|#define STUN_METHOD_ALLOCATE (0x0003) ------------------ STUN_METHOD_ALLOCATE, STUN_METHOD_BINDING, STUN_METHOD_CHANNEL_BIND, STUN_METHOD_REFRESH, STUN_METHOD_CONNECT, ------------------ | | 81| 1.64k|#define STUN_METHOD_BINDING (0x0001) ------------------ STUN_METHOD_ALLOCATE, STUN_METHOD_BINDING, STUN_METHOD_CHANNEL_BIND, STUN_METHOD_REFRESH, STUN_METHOD_CONNECT, ------------------ | | 87| 1.64k|#define STUN_METHOD_CHANNEL_BIND (0x0009) ------------------ STUN_METHOD_ALLOCATE, STUN_METHOD_BINDING, STUN_METHOD_CHANNEL_BIND, STUN_METHOD_REFRESH, STUN_METHOD_CONNECT, ------------------ | | 83| 1.64k|#define STUN_METHOD_REFRESH (0x0004) ------------------ STUN_METHOD_ALLOCATE, STUN_METHOD_BINDING, STUN_METHOD_CHANNEL_BIND, STUN_METHOD_REFRESH, STUN_METHOD_CONNECT, ------------------ | | 90| 1.64k|#define STUN_METHOD_CONNECT (0x000a) ------------------ 660| 1.64k| }; 661| | 662| 1.64k| stun_tid tid = {0}; 663| 1.64k| ioa_addr peer = {0}; 664| 1.64k| ioa_addr default_addr = {0}; 665| 1.64k| char attr_value[64] = {0}; 666| 1.64k| char rt[8] = {0}; 667| | 668| 1.64k| fuzz_tid(Data, Size, 0, &tid); 669| 1.64k| fuzz_addr(Data, Size, 16, &peer); 670| 1.64k| fuzz_addr(Data, Size, 40, &default_addr); 671| 1.64k| fuzz_string(Data, Size, 64, attr_value, sizeof(attr_value)); 672| 1.64k| fuzz_string(Data, Size, 128, rt, sizeof(rt)); 673| | 674| 1.64k| const uint16_t method = kMethods[fuzz_byte(Data, Size, 200) % (sizeof(kMethods) / sizeof(kMethods[0]))]; 675| 1.64k| const uint32_t lifetime = fuzz_u32(Data, Size, 201); 676| 1.64k| const uint16_t channel_number = (uint16_t)(0x4000u + (fuzz_u16(Data, Size, 205) & 0x3FFFu)); 677| 1.64k| const uint8_t transport = fuzz_byte(Data, Size, 207); 678| 1.64k| const uint8_t even_port_value = fuzz_byte(Data, Size, 208); 679| 1.64k| const bool af4 = fuzz_flag(Data, Size, 209); 680| 1.64k| const bool af6 = fuzz_flag(Data, Size, 210); 681| 1.64k| const bool mobile = fuzz_flag(Data, Size, 211); 682| 1.64k| const bool padding = fuzz_flag(Data, Size, 212); 683| 1.64k| const int chan_payload_len = (int)(fuzz_u16(Data, Size, 213) % 256); 684| 1.64k| const int ep = (int)(int8_t)fuzz_byte(Data, Size, 215); 685| | 686| | /* NULL-guard branches. */ 687| 1.64k| (void)stun_get_size(NULL); 688| 1.64k| (void)stun_init_buffer(NULL); 689| 1.64k| (void)stun_get_msg_type(NULL); 690| 1.64k| { 691| 1.64k| stun_tid scratch = {0}; 692| 1.64k| stun_tid_generate_in_message(NULL, &scratch); 693| 1.64k| } 694| | 695| | /* stun_init_request — also covers stun_get_size (non-NULL), the static 696| | * stun_init_command helper, and stun_attr_add* / stun_attr_get_first_by_type 697| | * over the freshly built message. */ 698| 1.64k| { 699| 1.64k| stun_buffer msg; 700| 1.64k| stun_init_buffer(&msg); 701| 1.64k| stun_init_request(method, &msg); 702| | 703| 1.64k| stun_tid extracted = {0}; 704| 1.64k| stun_tid_from_message(&msg, &extracted); 705| 1.64k| stun_tid_generate_in_message(&msg, &extracted); 706| | 707| 1.64k| const int alen = (int)strlen(attr_value); 708| 1.64k| (void)stun_attr_add(&msg, STUN_ATTRIBUTE_USERNAME, attr_value, alen); ------------------ | | 100| 1.64k|#define STUN_ATTRIBUTE_USERNAME (0x0006) ------------------ 709| 1.64k| (void)stun_attr_add_channel_number(&msg, channel_number); 710| 1.64k| (void)stun_attr_add_addr(&msg, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, &peer); ------------------ | | 120| 1.64k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ 711| 1.64k| (void)stun_attr_add_even_port(&msg, even_port_value); 712| 1.64k| (void)stun_attr_add_even_port(&msg, 0); 713| | 714| 1.64k| (void)stun_attr_get_first_by_type(&msg, STUN_ATTRIBUTE_USERNAME); ------------------ | | 100| 1.64k|#define STUN_ATTRIBUTE_USERNAME (0x0006) ------------------ 715| 1.64k| (void)stun_attr_get_first_by_type(&msg, STUN_ATTRIBUTE_CHANNEL_NUMBER); ------------------ | | 117| 1.64k|#define STUN_ATTRIBUTE_CHANNEL_NUMBER (0x000C) ------------------ 716| 1.64k| (void)stun_attr_get_first_by_type(&msg, STUN_ATTRIBUTE_XOR_PEER_ADDRESS); ------------------ | | 120| 1.64k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ 717| 1.64k| (void)stun_attr_get_first_by_type(&msg, STUN_ATTRIBUTE_EVEN_PORT); ------------------ | | 123| 1.64k|#define STUN_ATTRIBUTE_EVEN_PORT (0x0018) ------------------ 718| | 719| 1.64k| (void)stun_is_indication(&msg); 720| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, &default_addr); ------------------ | | 120| 1.64k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ 721| 1.64k| } 722| | 723| | /* stun_init_indication — drives the IS_STUN_INDICATION branch of 724| | * stun_is_indication. */ 725| 1.64k| { 726| 1.64k| stun_buffer msg; 727| 1.64k| stun_init_buffer(&msg); 728| 1.64k| stun_init_indication(method, &msg); 729| 1.64k| (void)stun_is_indication(&msg); 730| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, &default_addr); ------------------ | | 120| 1.64k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ 731| 1.64k| } 732| | 733| | /* stun_init_success_response. */ 734| 1.64k| { 735| 1.64k| stun_buffer msg; 736| 1.64k| stun_init_buffer(&msg); 737| 1.64k| stun_init_success_response(method, &msg, &tid); 738| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_MAPPED_ADDRESS, &default_addr); ------------------ | | 95| 1.64k|#define STUN_ATTRIBUTE_MAPPED_ADDRESS (0x0001) ------------------ 739| 1.64k| } 740| | 741| | /* stun_set_allocate_request — both rt NULL and rt non-NULL paths. */ 742| 1.64k| { 743| 1.64k| stun_buffer msg; 744| 1.64k| stun_init_buffer(&msg); 745| 1.64k| (void)stun_set_allocate_request(&msg, lifetime, af4, af6, transport, mobile, rt[0] ? rt : NULL, ep); ------------------ | Branch (745:82): [True: 1.00k, False: 640] ------------------ 746| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS, &default_addr); ------------------ | | 122| 1.64k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ 747| | 748| 1.64k| stun_init_buffer(&msg); 749| 1.64k| (void)stun_set_allocate_request(&msg, lifetime, !af4, !af6, transport, !mobile, NULL, ep); 750| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS, &default_addr); ------------------ | | 122| 1.64k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ 751| 1.64k| } 752| | 753| | /* stun_set_binding_request + stun_prepare_binding_request (both currently 754| | * delegate to stun_set_binding_request_str but exercise the wrappers). */ 755| 1.64k| { 756| 1.64k| stun_buffer msg; 757| 1.64k| stun_init_buffer(&msg); 758| 1.64k| stun_set_binding_request(&msg); 759| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_MAPPED_ADDRESS, &default_addr); ------------------ | | 95| 1.64k|#define STUN_ATTRIBUTE_MAPPED_ADDRESS (0x0001) ------------------ 760| | 761| 1.64k| stun_init_buffer(&msg); 762| 1.64k| stun_prepare_binding_request(&msg); 763| 1.64k| inspect_buffer_message(&msg, STUN_ATTRIBUTE_MAPPED_ADDRESS, &default_addr); ------------------ | | 95| 1.64k|#define STUN_ATTRIBUTE_MAPPED_ADDRESS (0x0001) ------------------ 764| 1.64k| } 765| | 766| | /* stun_init_channel_message + stun_is_channel_message wrappers. */ 767| 1.64k| { 768| 1.64k| stun_buffer msg; 769| 1.64k| stun_init_buffer(&msg); 770| 1.64k| if (stun_init_channel_message(channel_number, &msg, chan_payload_len, padding)) { ------------------ | Branch (770:9): [True: 1.64k, False: 0] ------------------ 771| 1.64k| uint16_t parsed_chn = 0; 772| 1.64k| (void)stun_is_channel_message(&msg, &parsed_chn, true); 773| 1.64k| (void)stun_is_channel_message(&msg, &parsed_chn, false); 774| 1.64k| } 775| 1.64k| { 776| 1.64k| uint16_t chn = 0; 777| 1.64k| (void)stun_is_channel_message(NULL, &chn, false); 778| 1.64k| } 779| 1.64k| } 780| | 781| | /* Raw fuzzer bytes through the wrapper-form predicates so they see 782| | * malformed inputs the serializer paths above never produce. */ 783| 1.64k| { 784| 1.64k| stun_buffer msg; 785| 1.64k| msg.len = Size > sizeof(msg.buf) ? sizeof(msg.buf) : Size; ------------------ | Branch (785:15): [True: 0, False: 1.64k] ------------------ 786| 1.64k| memcpy(msg.buf, Data, msg.len); 787| | 788| 1.64k| (void)stun_is_indication(&msg); 789| | 790| 1.64k| stun_tid extracted = {0}; 791| 1.64k| stun_tid_from_message(&msg, &extracted); 792| | 793| 1.64k| { 794| 1.64k| uint16_t chn = 0; 795| 1.64k| const size_t saved_len = msg.len; 796| 1.64k| (void)stun_is_channel_message(&msg, &chn, true); 797| 1.64k| msg.len = saved_len; 798| 1.64k| (void)stun_is_channel_message(&msg, &chn, false); 799| 1.64k| } 800| | 801| 1.64k| (void)stun_attr_get_first_by_type(&msg, STUN_ATTRIBUTE_USERNAME); ------------------ | | 100| 1.64k|#define STUN_ATTRIBUTE_USERNAME (0x0006) ------------------ 802| 1.64k| (void)stun_attr_get_first_by_type(&msg, STUN_ATTRIBUTE_XOR_PEER_ADDRESS); ------------------ | | 120| 1.64k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ 803| 1.64k| (void)stun_attr_get_first_by_type(&msg, STUN_ATTRIBUTE_CHANNEL_NUMBER); ------------------ | | 117| 1.64k|#define STUN_ATTRIBUTE_CHANNEL_NUMBER (0x000C) ------------------ 804| 1.64k| } 805| 1.64k|} turn_malloc_impl: 938| 8|void *turn_malloc_impl(size_t sz, const char *file, int line) { 939| 8| void *ptr = malloc(sz); 940| 8| if (!ptr && sz) { ------------------ | Branch (940:7): [True: 0, False: 8] | Branch (940:15): [True: 0, False: 0] ------------------ 941| 0| turn_out_of_memory(file, line, "malloc", sz); 942| 0| } 943| 8| return ptr; 944| 8|} turn_realloc_impl: 954| 8|void *turn_realloc_impl(void *ptr, size_t sz, const char *file, int line) { 955| 8| void *newptr = realloc(ptr, sz); 956| 8| if (!newptr && sz) { ------------------ | Branch (956:7): [True: 0, False: 8] | Branch (956:18): [True: 0, False: 0] ------------------ 957| 0| turn_out_of_memory(file, line, "realloc", sz); 958| 0| } 959| 8| return newptr; 960| 8|} stun_init_buffer: 41| 44.4k|int stun_init_buffer(stun_buffer *buf) { 42| 44.4k| if (!buf) { ------------------ | Branch (42:7): [True: 1.64k, False: 42.8k] ------------------ 43| 1.64k| return -1; 44| 1.64k| } 45| 42.8k| memset(buf->buf, 0, sizeof(buf->buf)); 46| 42.8k| buf->len = 0; 47| 42.8k| buf->offset = 0; 48| 42.8k| buf->coffset = 0; 49| 42.8k| return 0; 50| 44.4k|} stun_get_size: 52| 11.5k|int stun_get_size(const stun_buffer *buf) { 53| 11.5k| if (!buf) { ------------------ | Branch (53:7): [True: 1.64k, False: 9.88k] ------------------ 54| 1.64k| return 0; 55| 1.64k| } 56| 9.88k| return sizeof(buf->buf); 57| 11.5k|} stun_tid_from_message: 61| 3.29k|void stun_tid_from_message(const stun_buffer *buf, stun_tid *id) { 62| 3.29k| stun_tid_from_message_str(buf->buf, (size_t)(buf->len), id); 63| 3.29k|} stun_tid_generate_in_message: 65| 3.29k|void stun_tid_generate_in_message(stun_buffer *buf, stun_tid *id) { 66| 3.29k| if (buf) { ------------------ | Branch (66:7): [True: 1.64k, False: 1.64k] ------------------ 67| 1.64k| stun_tid_generate_in_message_str(buf->buf, id); 68| 1.64k| } 69| 3.29k|} stun_is_command_message: 80| 42.4k|bool stun_is_command_message(const stun_buffer *buf) { 81| 42.4k| if (!buf || buf->len <= 0) { ------------------ | Branch (81:7): [True: 0, False: 42.4k] | Branch (81:15): [True: 0, False: 42.4k] ------------------ 82| 0| return false; 83| 42.4k| } else { 84| 42.4k| return stun_is_command_message_str(buf->buf, (size_t)(buf->len)); 85| 42.4k| } 86| 42.4k|} stun_is_request: 88| 41.2k|bool stun_is_request(const stun_buffer *buf) { return stun_is_request_str(buf->buf, (size_t)buf->len); } stun_is_success_response: 90| 41.3k|bool stun_is_success_response(const stun_buffer *buf) { 91| 41.3k| return stun_is_success_response_str(buf->buf, (size_t)(buf->len)); 92| 41.3k|} stun_is_error_response: 94| 41.2k|bool stun_is_error_response(const stun_buffer *buf, int *err_code, uint8_t *err_msg, size_t err_msg_size) { 95| 41.2k| return stun_is_error_response_str(buf->buf, (size_t)(buf->len), err_code, err_msg, err_msg_size); 96| 41.2k|} stun_is_response: 98| 41.3k|bool stun_is_response(const stun_buffer *buf) { return stun_is_response_str(buf->buf, (size_t)(buf->len)); } stun_is_indication: 100| 4.94k|bool stun_is_indication(const stun_buffer *buf) { 101| 4.94k| if (is_channel_msg(buf)) { ------------------ | Branch (101:7): [True: 559, False: 4.38k] ------------------ 102| 559| return false; 103| 559| } 104| 4.38k| return IS_STUN_INDICATION(stun_get_msg_type(buf)); ------------------ | | 63| 4.38k|#define IS_STUN_INDICATION(msg_type) (((msg_type)&0x0110) == 0x0010) ------------------ 105| 4.94k|} stun_get_method: 107| 41.2k|uint16_t stun_get_method(const stun_buffer *buf) { return stun_get_method_str(buf->buf, (size_t)(buf->len)); } stun_get_msg_type: 109| 47.2k|uint16_t stun_get_msg_type(const stun_buffer *buf) { 110| 47.2k| if (!buf) { ------------------ | Branch (110:7): [True: 1.64k, False: 45.5k] ------------------ 111| 1.64k| return (uint16_t)-1; 112| 1.64k| } 113| 45.5k| return stun_get_msg_type_str(buf->buf, (size_t)buf->len); 114| 47.2k|} stun_init_request: 123| 1.64k|void stun_init_request(uint16_t method, stun_buffer *buf) { stun_init_command(stun_make_request(method), buf); } stun_init_indication: 125| 1.64k|void stun_init_indication(uint16_t method, stun_buffer *buf) { stun_init_command(stun_make_indication(method), buf); } stun_init_success_response: 127| 1.64k|void stun_init_success_response(uint16_t method, stun_buffer *buf, stun_tid *id) { 128| 1.64k| buf->len = stun_get_size(buf); 129| 1.64k| stun_init_success_response_str(method, buf->buf, &(buf->len), id); 130| 1.64k|} stun_init_error_response: 133| 4.94k| stun_tid *id, bool include_reason_string) { 134| 4.94k| buf->len = stun_get_size(buf); 135| 4.94k| stun_init_error_response_str(method, buf->buf, &(buf->len), error_code, reason, id, include_reason_string); 136| 4.94k|} stun_get_command_message_len: 140| 41.2k|int stun_get_command_message_len(const stun_buffer *buf) { 141| 41.2k| return stun_get_command_message_len_str(buf->buf, buf->len); 142| 41.2k|} stun_init_channel_message: 146| 1.64k|bool stun_init_channel_message(uint16_t chnumber, stun_buffer *buf, int length, bool do_padding) { 147| 1.64k| return stun_init_channel_message_str(chnumber, buf->buf, &(buf->len), length, do_padding); 148| 1.64k|} stun_is_channel_message: 150| 8.24k|bool stun_is_channel_message(stun_buffer *buf, uint16_t *chnumber, bool is_padding_mandatory) { 151| 8.24k| if (!buf) { ------------------ | Branch (151:7): [True: 1.64k, False: 6.59k] ------------------ 152| 1.64k| return false; 153| 1.64k| } 154| 6.59k| size_t blen = buf->len; 155| 6.59k| const bool ret = stun_is_channel_message_str(buf->buf, &blen, chnumber, is_padding_mandatory); 156| 6.59k| if (ret) { ------------------ | Branch (156:7): [True: 3.50k, False: 3.09k] ------------------ 157| 3.50k| buf->len = blen; 158| 3.50k| } 159| 6.59k| return ret; 160| 8.24k|} stun_set_allocate_request: 165| 3.29k| const char *rt, int ep) { 166| 3.29k| return stun_set_allocate_request_str(buf->buf, &(buf->len), lifetime, af4, af6, transport, mobile, rt, ep); 167| 3.29k|} stun_set_allocate_response: 172| 8.24k| uint64_t reservation_token, char *mobile_id, bool include_reason_string) { 173| | 174| 8.24k| return stun_set_allocate_response_str(buf->buf, &(buf->len), tid, relayed_addr1, relayed_addr2, reflexive_addr, 175| 8.24k| lifetime, max_lifetime, error_code, reason, reservation_token, mobile_id, 176| 8.24k| include_reason_string); 177| 8.24k|} stun_set_channel_bind_request: 181| 4.94k|uint16_t stun_set_channel_bind_request(stun_buffer *buf, const ioa_addr *peer_addr, uint16_t channel_number) { 182| | 183| 4.94k| return stun_set_channel_bind_request_str(buf->buf, &(buf->len), peer_addr, channel_number); 184| 4.94k|} stun_set_channel_bind_response: 187| 4.94k| bool include_reason_string) { 188| 4.94k| stun_set_channel_bind_response_str(buf->buf, &(buf->len), tid, error_code, reason, include_reason_string); 189| 4.94k|} stun_attr_get_first: 193| 41.2k|stun_attr_ref stun_attr_get_first(const stun_buffer *buf) { return stun_attr_get_first_str(buf->buf, buf->len); } stun_attr_get_next: 195| 72.1k|stun_attr_ref stun_attr_get_next(const stun_buffer *buf, stun_attr_ref prev) { 196| 72.1k| return stun_attr_get_next_str(buf->buf, buf->len, prev); 197| 72.1k|} stun_attr_add: 203| 4.94k|bool stun_attr_add(stun_buffer *buf, uint16_t attr, const char *avalue, int alen) { 204| 4.94k| return stun_attr_add_str(buf->buf, &(buf->len), attr, (const uint8_t *)avalue, alen); 205| 4.94k|} stun_attr_add_channel_number: 207| 1.64k|bool stun_attr_add_channel_number(stun_buffer *buf, uint16_t chnumber) { 208| 1.64k| return stun_attr_add_channel_number_str(buf->buf, &(buf->len), chnumber); 209| 1.64k|} stun_attr_add_addr: 211| 1.64k|bool stun_attr_add_addr(stun_buffer *buf, uint16_t attr_type, const ioa_addr *ca) { 212| 1.64k| return stun_attr_add_addr_str(buf->buf, &(buf->len), attr_type, ca); 213| 1.64k|} stun_attr_get_addr: 215| 23.6k|bool stun_attr_get_addr(const stun_buffer *buf, stun_attr_ref attr, ioa_addr *ca, const ioa_addr *default_addr) { 216| 23.6k| return stun_attr_get_addr_str(buf->buf, buf->len, attr, ca, default_addr); 217| 23.6k|} stun_attr_get_first_addr: 219| 58.4k|bool stun_attr_get_first_addr(const stun_buffer *buf, uint16_t attr_type, ioa_addr *ca, const ioa_addr *default_addr) { 220| 58.4k| return stun_attr_get_first_addr_str(buf->buf, buf->len, attr_type, ca, default_addr); 221| 58.4k|} stun_attr_add_even_port: 223| 3.29k|bool stun_attr_add_even_port(stun_buffer *buf, uint8_t value) { 224| 3.29k| if (value) { ------------------ | Branch (224:7): [True: 1.19k, False: 2.10k] ------------------ 225| 1.19k| value = 0x80; 226| 1.19k| } 227| 3.29k| return stun_attr_add(buf, STUN_ATTRIBUTE_EVEN_PORT, (const char *)&value, 1); ------------------ | | 123| 3.29k|#define STUN_ATTRIBUTE_EVEN_PORT (0x0018) ------------------ 228| 3.29k|} stun_attr_get_first_channel_number: 230| 41.2k|uint16_t stun_attr_get_first_channel_number(const stun_buffer *buf) { 231| 41.2k| return stun_attr_get_first_channel_number_str(buf->buf, buf->len); 232| 41.2k|} stun_attr_get_first_by_type: 234| 11.5k|stun_attr_ref stun_attr_get_first_by_type(const stun_buffer *buf, uint16_t attr_type) { 235| 11.5k| return stun_attr_get_first_by_type_str(buf->buf, buf->len, attr_type); 236| 11.5k|} stun_set_binding_request: 240| 1.64k|void stun_set_binding_request(stun_buffer *buf) { stun_set_binding_request_str(buf->buf, (size_t *)(&(buf->len))); } stun_set_binding_response: 243| 6.59k| const uint8_t *reason, bool include_reason_string) { 244| 6.59k| return stun_set_binding_response_str(buf->buf, &(buf->len), tid, reflexive_addr, error_code, reason, 0, false, true, 245| 6.59k| include_reason_string); 246| 6.59k|} stun_prepare_binding_request: 248| 1.64k|void stun_prepare_binding_request(stun_buffer *buf) { stun_set_binding_request_str(buf->buf, (size_t *)(&(buf->len))); } stun_is_binding_response: 250| 41.2k|bool stun_is_binding_response(const stun_buffer *buf) { return stun_is_binding_response_str(buf->buf, buf->len); } stun_buffer.c:is_channel_msg: 73| 4.94k|static inline bool is_channel_msg(const stun_buffer *buf) { 74| 4.94k| if (buf && buf->len > 0) { ------------------ | Branch (74:7): [True: 4.94k, False: 0] | Branch (74:14): [True: 4.94k, False: 0] ------------------ 75| 4.94k| return is_channel_msg_str(buf->buf, (size_t)(buf->len)); 76| 4.94k| } 77| 0| return false; 78| 4.94k|} stun_buffer.c:stun_init_command: 118| 3.29k|static void stun_init_command(uint16_t message_type, stun_buffer *buf) { 119| 3.29k| buf->len = stun_get_size(buf); 120| 3.29k| stun_init_command_str(message_type, buf->buf, &(buf->len)); 121| 3.29k|} addr_set_any: 48| 191k|void addr_set_any(ioa_addr *addr) { 49| 191k| if (addr) { ------------------ | Branch (49:7): [True: 191k, False: 0] ------------------ 50| 191k| memset(addr, 0, sizeof(ioa_addr)); 51| 191k| } 52| 191k|} addr_any_no_port: 78| 94.4k|int addr_any_no_port(const ioa_addr *addr) { 79| 94.4k| if (!addr) { ------------------ | Branch (79:7): [True: 0, False: 94.4k] ------------------ 80| 0| return 1; 81| 0| } 82| | 83| 94.4k| if (addr->ss.sa_family == AF_INET) { ------------------ | Branch (83:7): [True: 61.0k, False: 33.3k] ------------------ 84| 61.0k| return (addr->s4.sin_addr.s_addr == 0); 85| 61.0k| } else if (addr->ss.sa_family == AF_INET6) { ------------------ | Branch (85:14): [True: 33.3k, False: 0] ------------------ 86| 33.3k| size_t i; 87| 56.3k| for (i = 0; i < sizeof(addr->s6.sin6_addr); i++) { ------------------ | Branch (87:17): [True: 56.3k, False: 16] ------------------ 88| 56.3k| if (((const char *)(&(addr->s6.sin6_addr)))[i]) { ------------------ | Branch (88:11): [True: 33.3k, False: 22.9k] ------------------ 89| 33.3k| return 0; 90| 33.3k| } 91| 56.3k| } 92| 33.3k| } 93| | 94| 16| return 1; 95| 94.4k|} addr_eq_no_port: 180| 268k|int addr_eq_no_port(const ioa_addr *a1, const ioa_addr *a2) { 181| | 182| 268k| if (!a1) { ------------------ | Branch (182:7): [True: 0, False: 268k] ------------------ 183| 0| return (!a2); 184| 268k| } else if (!a2) { ------------------ | Branch (184:14): [True: 0, False: 268k] ------------------ 185| 0| return (!a1); 186| 0| } 187| | 188| 268k| if (a1->ss.sa_family == a2->ss.sa_family) { ------------------ | Branch (188:7): [True: 128k, False: 139k] ------------------ 189| 128k| if (a1->ss.sa_family == AF_INET) { ------------------ | Branch (189:9): [True: 80.8k, False: 48.0k] ------------------ 190| 80.8k| if ((int)a1->s4.sin_addr.s_addr == (int)a2->s4.sin_addr.s_addr) { ------------------ | Branch (190:11): [True: 405, False: 80.4k] ------------------ 191| 405| return 1; 192| 405| } 193| 80.8k| } else if (a1->ss.sa_family == AF_INET6) { ------------------ | Branch (193:16): [True: 48.0k, False: 0] ------------------ 194| 48.0k| if (memcmp(&(a1->s6.sin6_addr), &(a2->s6.sin6_addr), sizeof(struct in6_addr)) == 0) { ------------------ | Branch (194:11): [True: 203, False: 47.8k] ------------------ 195| 203| return 1; 196| 203| } 197| 48.0k| } 198| 128k| } 199| 267k| return 0; 200| 268k|} make_ioa_addr: 202| 8|int make_ioa_addr(const uint8_t *saddr0, uint16_t port, ioa_addr *addr) { 203| | 204| 8| if (!saddr0 || !addr) { ------------------ | Branch (204:7): [True: 0, False: 8] | Branch (204:18): [True: 0, False: 8] ------------------ 205| 0| return -1; 206| 0| } 207| | 208| 8| char ssaddr[257]; 209| 8| STRCPY(ssaddr, saddr0); ------------------ | | 240| 8| do { \ | | 241| 8| if ((const char *)(dst) != (const char *)(src)) { \ | | ------------------ | | | Branch (241:9): [True: 8, False: 0] | | ------------------ | | 242| 8| if (sizeof(dst) == sizeof(char *)) \ | | ------------------ | | | Branch (242:11): [Folded, False: 8] | | ------------------ | | 243| 8| strcpy(((char *)(dst)), (const char *)(src)); \ | | 244| 8| else { \ | | 245| 8| size_t szdst = sizeof((dst)); \ | | 246| 8| strncpy((char *)(dst), (const char *)(src), szdst); \ | | 247| 8| ((char *)(dst))[szdst - 1] = 0; \ | | 248| 8| } \ | | 249| 8| } \ | | 250| 8| } while (0) | | ------------------ | | | Branch (250:12): [Folded, False: 8] | | ------------------ ------------------ 210| | 211| 8| char *saddr = ssaddr; 212| 8| while (*saddr == ' ') { ------------------ | Branch (212:10): [True: 0, False: 8] ------------------ 213| 0| ++saddr; 214| 0| } 215| | 216| 8| size_t len = strlen(saddr); 217| 8| while (len > 0) { ------------------ | Branch (217:10): [True: 8, False: 0] ------------------ 218| 8| if (saddr[len - 1] == ' ') { ------------------ | Branch (218:9): [True: 0, False: 8] ------------------ 219| 0| saddr[len - 1] = 0; 220| 0| --len; 221| 8| } else { 222| 8| break; 223| 8| } 224| 8| } 225| | 226| 8| memset(addr, 0, sizeof(ioa_addr)); 227| 8| if ((len == 0) || (inet_pton(AF_INET, saddr, &addr->s4.sin_addr) == 1)) { ------------------ | Branch (227:7): [True: 0, False: 8] | Branch (227:21): [True: 4, False: 4] ------------------ 228| 4| addr->s4.sin_family = AF_INET; 229| |#if defined(TURN_HAS_SIN_LEN) /* tested when configured */ 230| | addr->s4.sin_len = sizeof(struct sockaddr_in); 231| |#endif 232| 4| addr->s4.sin_port = nswap16(port); ------------------ | | 86| 4|#define nswap16(s) ntohs(s) ------------------ 233| 4| } else if (inet_pton(AF_INET6, saddr, &addr->s6.sin6_addr) == 1) { ------------------ | Branch (233:14): [True: 4, False: 0] ------------------ 234| 4| addr->s6.sin6_family = AF_INET6; 235| |#if defined(SIN6_LEN) /* this define is required by IPv6 if used */ 236| | addr->s6.sin6_len = sizeof(struct sockaddr_in6); 237| |#endif 238| 4| addr->s6.sin6_port = nswap16(port); ------------------ | | 86| 4|#define nswap16(s) ntohs(s) ------------------ 239| 4| } else { 240| 0| struct addrinfo addr_hints; 241| 0| struct addrinfo *addr_result = NULL; 242| 0| int err; 243| | 244| 0| memset(&addr_hints, 0, sizeof(struct addrinfo)); 245| 0| addr_hints.ai_family = AF_UNSPEC; /* Allow IPv4 or IPv6 */ 246| 0| addr_hints.ai_socktype = SOCK_DGRAM; /* Datagram socket */ 247| 0| addr_hints.ai_flags = AI_PASSIVE; /* For wildcard IP address */ 248| 0| addr_hints.ai_protocol = 0; /* Any protocol */ 249| 0| addr_hints.ai_canonname = NULL; 250| 0| addr_hints.ai_addr = NULL; 251| 0| addr_hints.ai_next = NULL; 252| | 253| 0| err = getaddrinfo(saddr, NULL, &addr_hints, &addr_result); 254| 0| if ((err != 0) || (!addr_result)) { ------------------ | Branch (254:9): [True: 0, False: 0] | Branch (254:23): [True: 0, False: 0] ------------------ 255| 0| fprintf(stderr, "error resolving '%s' hostname: %s\n", saddr, gai_strerror(err)); 256| 0| return -1; 257| 0| } 258| | 259| 0| int family = AF_INET; 260| 0| struct addrinfo *addr_result_orig = addr_result; 261| 0| int found = 0; 262| | 263| 0| beg_af: 264| | 265| 0| while (addr_result) { ------------------ | Branch (265:12): [True: 0, False: 0] ------------------ 266| | 267| 0| if (addr_result->ai_family == family) { ------------------ | Branch (267:11): [True: 0, False: 0] ------------------ 268| 0| if (addr_result->ai_family == AF_INET) { ------------------ | Branch (268:13): [True: 0, False: 0] ------------------ 269| 0| memcpy(addr, addr_result->ai_addr, addr_result->ai_addrlen); 270| 0| addr->s4.sin_port = nswap16(port); ------------------ | | 86| 0|#define nswap16(s) ntohs(s) ------------------ 271| |#if defined(TURN_HAS_SIN_LEN) /* tested when configured */ 272| | addr->s4.sin_len = sizeof(struct sockaddr_in); 273| |#endif 274| 0| found = 1; 275| 0| break; 276| 0| } else if (addr_result->ai_family == AF_INET6) { ------------------ | Branch (276:20): [True: 0, False: 0] ------------------ 277| 0| memcpy(addr, addr_result->ai_addr, addr_result->ai_addrlen); 278| 0| addr->s6.sin6_port = nswap16(port); ------------------ | | 86| 0|#define nswap16(s) ntohs(s) ------------------ 279| |#if defined(SIN6_LEN) /* this define is required by IPv6 if used */ 280| | addr->s6.sin6_len = sizeof(struct sockaddr_in6); 281| |#endif 282| 0| found = 1; 283| 0| break; 284| 0| } 285| 0| } 286| | 287| 0| addr_result = addr_result->ai_next; 288| 0| } 289| | 290| 0| if (!found && family == AF_INET) { ------------------ | Branch (290:9): [True: 0, False: 0] | Branch (290:19): [True: 0, False: 0] ------------------ 291| 0| family = AF_INET6; 292| 0| addr_result = addr_result_orig; 293| 0| goto beg_af; 294| 0| } 295| | 296| 0| freeaddrinfo(addr_result_orig); 297| 0| } 298| | 299| 8| return 0; 300| 8|} addr_set_port: 407| 11.4k|void addr_set_port(ioa_addr *addr, uint16_t port) { 408| 11.4k| if (addr) { ------------------ | Branch (408:7): [True: 11.4k, False: 0] ------------------ 409| 11.4k| if (addr->s4.sin_family == AF_INET) { ------------------ | Branch (409:9): [True: 7.33k, False: 4.08k] ------------------ 410| 7.33k| addr->s4.sin_port = nswap16(port); ------------------ | | 86| 7.33k|#define nswap16(s) ntohs(s) ------------------ 411| 7.33k| } else if (addr->s6.sin6_family == AF_INET6) { ------------------ | Branch (411:16): [True: 4.08k, False: 0] ------------------ 412| | addr->s6.sin6_port = nswap16(port); ------------------ | | 86| 4.08k|#define nswap16(s) ntohs(s) ------------------ 413| 4.08k| } 414| 11.4k| } 415| 11.4k|} addr_get_port: 417| 11.4k|uint16_t addr_get_port(const ioa_addr *addr) { 418| 11.4k| if (!addr) { ------------------ | Branch (418:7): [True: 0, False: 11.4k] ------------------ 419| 0| return 0; 420| 0| } 421| | 422| 11.4k| if (addr->s4.sin_family == AF_INET) { ------------------ | Branch (422:7): [True: 11.2k, False: 219] ------------------ 423| 11.2k| return nswap16(addr->s4.sin_port); ------------------ | | 86| 11.2k|#define nswap16(s) ntohs(s) ------------------ 424| 11.2k| } else if (addr->s6.sin6_family == AF_INET6) { ------------------ | Branch (424:14): [True: 219, False: 0] ------------------ 425| 219| return nswap16(addr->s6.sin6_port); ------------------ | | 86| 219|#define nswap16(s) ntohs(s) ------------------ 426| 219| } 427| 0| return 0; 428| 11.4k|} ioa_addr_add_mapping: 676| 4|void ioa_addr_add_mapping(ioa_addr *apub, ioa_addr *apriv) { 677| 4| const size_t new_size = msz + sizeof(ioa_addr *); 678| 4| public_addrs = (ioa_addr **)turn_realloc(public_addrs, new_size); ------------------ | | 121| 4|#define turn_realloc(ptr, sz) turn_realloc_impl((ptr), (sz), __FILE__, __LINE__) ------------------ 679| 4| private_addrs = (ioa_addr **)turn_realloc(private_addrs, new_size); ------------------ | | 121| 4|#define turn_realloc(ptr, sz) turn_realloc_impl((ptr), (sz), __FILE__, __LINE__) ------------------ 680| 4| public_addrs[mcount] = (ioa_addr *)turn_malloc(sizeof(ioa_addr)); ------------------ | | 119| 4|#define turn_malloc(sz) turn_malloc_impl((sz), __FILE__, __LINE__) ------------------ 681| 4| private_addrs[mcount] = (ioa_addr *)turn_malloc(sizeof(ioa_addr)); ------------------ | | 119| 4|#define turn_malloc(sz) turn_malloc_impl((sz), __FILE__, __LINE__) ------------------ 682| 4| addr_cpy(public_addrs[mcount], apub); 683| 4| addr_cpy(private_addrs[mcount], apriv); 684| 4| ++mcount; 685| 4| msz += sizeof(ioa_addr *); 686| 4|} map_addr_from_public_to_private: 688| 83.8k|void map_addr_from_public_to_private(const ioa_addr *public_addr, ioa_addr *private_addr) { 689| 83.8k| size_t i; 690| 251k| for (i = 0; i < mcount; ++i) { ------------------ | Branch (690:15): [True: 167k, False: 83.4k] ------------------ 691| 167k| if (addr_eq_no_port(public_addr, public_addrs[i])) { ------------------ | Branch (691:9): [True: 407, False: 167k] ------------------ 692| 407| addr_cpy(private_addr, private_addrs[i]); 693| 407| addr_set_port(private_addr, addr_get_port(public_addr)); 694| 407| return; 695| 407| } 696| 167k| } 697| 83.4k| addr_cpy(private_addr, public_addr); 698| 83.4k|} map_addr_from_private_to_public: 700| 50.3k|void map_addr_from_private_to_public(const ioa_addr *private_addr, ioa_addr *public_addr) { 701| 50.3k| size_t i; 702| 150k| for (i = 0; i < mcount; ++i) { ------------------ | Branch (702:15): [True: 100k, False: 50.1k] ------------------ 703| 100k| if (addr_eq_no_port(private_addr, private_addrs[i])) { ------------------ | Branch (703:9): [True: 201, False: 100k] ------------------ 704| 201| addr_cpy(public_addr, public_addrs[i]); 705| 201| addr_set_port(public_addr, addr_get_port(private_addr)); 706| 201| return; 707| 201| } 708| 100k| } 709| 50.1k| addr_cpy(public_addr, private_addr); 710| 50.1k|} ns_turn_ioaddr.c:addr_cpy: 87| 134k|static inline void addr_cpy(ioa_addr *dst, const ioa_addr *src) { 88| 134k| if (dst && src) { ------------------ | Branch (88:7): [True: 134k, False: 0] | Branch (88:14): [True: 134k, False: 0] ------------------ 89| 134k| memcpy(dst, src, sizeof(ioa_addr)); 90| 134k| } 91| 134k|} ns_turn_msg.c:addr_cpy: 87| 10.8k|static inline void addr_cpy(ioa_addr *dst, const ioa_addr *src) { 88| 10.8k| if (dst && src) { ------------------ | Branch (88:7): [True: 10.8k, False: 0] | Branch (88:14): [True: 10.8k, False: 0] ------------------ 89| 10.8k| memcpy(dst, src, sizeof(ioa_addr)); 90| 10.8k| } 91| 10.8k|} turn_random_number: 123| 239k|long turn_random_number(void) { 124| 239k| long ret = 0; 125| 239k|#if defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION) 126| 239k| ret = (long)fuzz_prng_next(); 127| |#else 128| | if (!RAND_bytes((unsigned char *)&ret, sizeof(ret))) 129| |#if defined(WINDOWS) 130| | ret = rand(); 131| |#else 132| | ret = random(); 133| |#endif 134| |#endif 135| 239k| return ret; 136| 239k|} stun_get_command_message_len_str: 523| 926k|int stun_get_command_message_len_str(const uint8_t *buf, size_t len) { 524| 926k| if (len < STUN_HEADER_LENGTH) { ------------------ | | 46| 926k|#define STUN_HEADER_LENGTH (20) ------------------ | Branch (524:7): [True: 1.91k, False: 924k] ------------------ 525| 1.91k| return -1; 526| 1.91k| } 527| | 528| | /* Validate the size the buffer claims to be */ 529| 924k| const size_t bufLen = (size_t)(turn_read_u16(buf + 2) + STUN_HEADER_LENGTH); ------------------ | | 46| 924k|#define STUN_HEADER_LENGTH (20) ------------------ 530| 924k| if (bufLen > len) { ------------------ | Branch (530:7): [True: 9.12k, False: 915k] ------------------ 531| 9.12k| return -1; 532| 9.12k| } 533| | 534| 915k| return bufLen; 535| 924k|} stun_make_type: 547| 75.8k|uint16_t stun_make_type(uint16_t method) { 548| 75.8k| method = method & 0x0FFF; 549| 75.8k| return ((method & 0x000F) | ((method & 0x0070) << 1) | ((method & 0x0380) << 2) | ((method & 0x0C00) << 2)); 550| 75.8k|} stun_get_method_str: 552| 144k|uint16_t stun_get_method_str(const uint8_t *buf, size_t len) { 553| 144k| if (!buf || len < 2) { ------------------ | Branch (553:7): [True: 0, False: 144k] | Branch (553:15): [True: 0, False: 144k] ------------------ 554| 0| return (uint16_t)-1; 555| 0| } 556| | 557| 144k| const uint16_t tt = turn_read_u16(buf); 558| | 559| 144k| return (tt & 0x000F) | ((tt & 0x00E0) >> 1) | ((tt & 0x0E00) >> 2) | ((tt & 0x3000) >> 2); 560| 144k|} stun_get_msg_type_str: 562| 466k|uint16_t stun_get_msg_type_str(const uint8_t *buf, size_t len) { 563| 466k| if (!buf || len < 2) { ------------------ | Branch (563:7): [True: 0, False: 466k] | Branch (563:15): [True: 74, False: 466k] ------------------ 564| 74| return (uint16_t)-1; 565| 74| } 566| 466k| return (turn_read_u16(buf) & 0x3FFF); 567| 466k|} is_channel_msg_str: 569| 329k|bool is_channel_msg_str(const uint8_t *buf, size_t blen) { 570| 329k| return (buf && blen >= 4 && STUN_VALID_CHANNEL(turn_read_u16(buf))); ------------------ | | 163| 329k|#define STUN_VALID_CHANNEL(chn) ((chn) >= 0x4000 && (chn) <= 0x7FFF) | | ------------------ | | | Branch (163:34): [True: 728, False: 328k] | | | Branch (163:53): [True: 559, False: 169] | | ------------------ ------------------ | Branch (570:11): [True: 329k, False: 0] | Branch (570:18): [True: 329k, False: 275] ------------------ 571| 329k|} stun_is_command_message_str: 575| 152k|bool stun_is_command_message_str(const uint8_t *buf, size_t blen) { 576| 152k| if (buf && blen >= STUN_HEADER_LENGTH) { ------------------ | | 46| 152k|#define STUN_HEADER_LENGTH (20) ------------------ | Branch (576:7): [True: 152k, False: 0] | Branch (576:14): [True: 152k, False: 140] ------------------ 577| 152k| if (!STUN_VALID_CHANNEL(turn_read_u16(buf))) { ------------------ | | 163| 152k|#define STUN_VALID_CHANNEL(chn) ((chn) >= 0x4000 && (chn) <= 0x7FFF) | | ------------------ | | | Branch (163:34): [True: 535, False: 152k] | | | Branch (163:53): [True: 465, False: 70] | | ------------------ ------------------ 578| 152k| if ((((uint8_t)buf[0]) & ((uint8_t)(0xC0))) == 0) { ------------------ | Branch (578:11): [True: 152k, False: 70] ------------------ 579| 152k| if (turn_read_u32(buf + 4) == STUN_MAGIC_COOKIE) { ------------------ | | 60| 152k|#define STUN_MAGIC_COOKIE (0x2112A442) ------------------ | Branch (579:13): [True: 136k, False: 15.7k] ------------------ 580| 136k| const uint16_t len = turn_read_u16(buf + 2); 581| 136k| if ((len & 0x0003) == 0) { ------------------ | Branch (581:15): [True: 136k, False: 13] ------------------ 582| 136k| if ((size_t)(len + STUN_HEADER_LENGTH) == blen) { ------------------ | | 46| 136k|#define STUN_HEADER_LENGTH (20) ------------------ | Branch (582:17): [True: 136k, False: 52] ------------------ 583| 136k| return true; 584| 136k| } 585| 136k| } 586| 136k| } 587| 152k| } 588| 152k| } 589| 152k| } 590| 16.4k| return false; 591| 152k|} stun_is_request_str: 643| 75.8k|bool stun_is_request_str(const uint8_t *buf, size_t len) { 644| 75.8k| if (is_channel_msg_str(buf, len)) { ------------------ | Branch (644:7): [True: 0, False: 75.8k] ------------------ 645| 0| return false; 646| 0| } 647| 75.8k| return IS_STUN_REQUEST(stun_get_msg_type_str(buf, len)); ------------------ | | 62| 75.8k|#define IS_STUN_REQUEST(msg_type) (((msg_type)&0x0110) == 0x0000) ------------------ 648| 75.8k|} stun_is_success_response_str: 650| 75.9k|bool stun_is_success_response_str(const uint8_t *buf, size_t len) { 651| 75.9k| if (is_channel_msg_str(buf, len)) { ------------------ | Branch (651:7): [True: 0, False: 75.9k] ------------------ 652| 0| return false; 653| 0| } 654| 75.9k| return IS_STUN_SUCCESS_RESP(stun_get_msg_type_str(buf, len)); ------------------ | | 64| 75.9k|#define IS_STUN_SUCCESS_RESP(msg_type) (((msg_type)&0x0110) == 0x0100) ------------------ 655| 75.9k|} stun_is_error_response_str: 657| 75.9k|bool stun_is_error_response_str(const uint8_t *buf, size_t len, int *err_code, uint8_t *err_msg, size_t err_msg_size) { 658| 75.9k| if (is_channel_msg_str(buf, len)) { ------------------ | Branch (658:7): [True: 0, False: 75.9k] ------------------ 659| 0| return false; 660| 0| } 661| 75.9k| if (IS_STUN_ERR_RESP(stun_get_msg_type_str(buf, len))) { ------------------ | | 65| 75.9k|#define IS_STUN_ERR_RESP(msg_type) (((msg_type)&0x0110) == 0x0110) | | ------------------ | | | Branch (65:36): [True: 28.0k, False: 47.8k] | | ------------------ ------------------ 662| 28.0k| if (err_code) { ------------------ | Branch (662:9): [True: 28.0k, False: 0] ------------------ 663| 28.0k| stun_attr_ref sar = stun_attr_get_first_by_type_str(buf, len, STUN_ATTRIBUTE_ERROR_CODE); ------------------ | | 103| 28.0k|#define STUN_ATTRIBUTE_ERROR_CODE (0x0009) ------------------ 664| 28.0k| if (sar) { ------------------ | Branch (664:11): [True: 28.0k, False: 60] ------------------ 665| 28.0k| if (stun_attr_get_len(sar) >= 4) { ------------------ | Branch (665:13): [True: 28.0k, False: 6] ------------------ 666| 28.0k| const uint8_t *val = (const uint8_t *)stun_attr_get_value(sar); 667| 28.0k| *err_code = (int)(val[2] * 100 + val[3]); 668| 28.0k| if (err_msg && err_msg_size > 0) { ------------------ | Branch (668:15): [True: 28.0k, False: 0] | Branch (668:26): [True: 28.0k, False: 0] ------------------ 669| 28.0k| err_msg[0] = 0; 670| 28.0k| if (stun_attr_get_len(sar) > 4) { ------------------ | Branch (670:17): [True: 13.8k, False: 14.1k] ------------------ 671| 13.8k| size_t msg_len = stun_attr_get_len(sar) - 4; 672| 13.8k| if (msg_len > (err_msg_size - 1)) { ------------------ | Branch (672:19): [True: 5, False: 13.8k] ------------------ 673| 5| msg_len = err_msg_size - 1; 674| 5| } 675| 13.8k| memcpy(err_msg, val + 4, msg_len); 676| 13.8k| err_msg[msg_len] = 0; 677| 13.8k| } 678| 28.0k| } 679| 28.0k| } 680| 28.0k| } 681| 28.0k| } 682| 28.0k| return true; 683| 28.0k| } 684| 47.8k| return false; 685| 75.9k|} stun_is_response_str: 748| 97.0k|bool stun_is_response_str(const uint8_t *buf, size_t len) { 749| 97.0k| if (is_channel_msg_str(buf, len)) { ------------------ | Branch (749:7): [True: 0, False: 97.0k] ------------------ 750| 0| return false; 751| 0| } 752| 97.0k| if (IS_STUN_SUCCESS_RESP(stun_get_msg_type_str(buf, len))) { ------------------ | | 64| 97.0k|#define IS_STUN_SUCCESS_RESP(msg_type) (((msg_type)&0x0110) == 0x0100) | | ------------------ | | | Branch (64:40): [True: 35.9k, False: 61.1k] | | ------------------ ------------------ 753| 35.9k| return true; 754| 35.9k| } 755| 61.1k| if (IS_STUN_ERR_RESP(stun_get_msg_type_str(buf, len))) { ------------------ | | 65| 61.1k|#define IS_STUN_ERR_RESP(msg_type) (((msg_type)&0x0110) == 0x0110) | | ------------------ | | | Branch (65:36): [True: 37.6k, False: 23.4k] | | ------------------ ------------------ 756| 37.6k| return true; 757| 37.6k| } 758| 23.4k| return false; 759| 61.1k|} stun_is_indication_str: 761| 146|bool stun_is_indication_str(const uint8_t *buf, size_t len) { 762| 146| if (is_channel_msg_str(buf, len)) { ------------------ | Branch (762:7): [True: 0, False: 146] ------------------ 763| 0| return false; 764| 0| } 765| 146| return IS_STUN_INDICATION(stun_get_msg_type_str(buf, len)); ------------------ | | 63| 146|#define IS_STUN_INDICATION(msg_type) (((msg_type)&0x0110) == 0x0010) ------------------ 766| 146|} stun_make_request: 768| 18.1k|uint16_t stun_make_request(uint16_t method) { return GET_STUN_REQUEST(stun_make_type(method)); } ------------------ | | 67| 18.1k|#define GET_STUN_REQUEST(msg_type) (msg_type & 0xFEEF) ------------------ stun_make_indication: 770| 1.64k|uint16_t stun_make_indication(uint16_t method) { return GET_STUN_INDICATION(stun_make_type(method)); } ------------------ | | 68| 1.64k|#define GET_STUN_INDICATION(msg_type) ((msg_type & 0xFEEF) | 0x0010) ------------------ stun_make_success_response: 772| 28.0k|uint16_t stun_make_success_response(uint16_t method) { return GET_STUN_SUCCESS_RESP(stun_make_type(method)); } ------------------ | | 69| 28.0k|#define GET_STUN_SUCCESS_RESP(msg_type) ((msg_type & 0xFEEF) | 0x0100) ------------------ stun_make_error_response: 774| 28.0k|uint16_t stun_make_error_response(uint16_t method) { return GET_STUN_ERR_RESP(stun_make_type(method)); } ------------------ | | 70| 28.0k|#define GET_STUN_ERR_RESP(msg_type) (msg_type | 0x0110) ------------------ stun_init_buffer_str: 778| 75.8k|void stun_init_buffer_str(uint8_t *buf, size_t *len) { 779| 75.8k| *len = STUN_HEADER_LENGTH; ------------------ | | 46| 75.8k|#define STUN_HEADER_LENGTH (20) ------------------ 780| 75.8k| memset(buf, 0, *len); 781| 75.8k|} stun_init_command_str: 783| 67.8k|void stun_init_command_str(uint16_t message_type, uint8_t *buf, size_t *len) { 784| 67.8k| stun_init_buffer_str(buf, len); 785| 67.8k| message_type &= (uint16_t)(0x3FFF); 786| 67.8k| turn_write_u16(buf, message_type); 787| 67.8k| turn_write_u16(buf + 2, 0); 788| 67.8k| turn_write_u32(buf + 4, STUN_MAGIC_COOKIE); ------------------ | | 60| 67.8k|#define STUN_MAGIC_COOKIE (0x2112A442) ------------------ 789| | stun_tid_generate_in_message_str(buf, NULL); 790| 67.8k|} old_stun_init_command_str: 792| 7.94k|void old_stun_init_command_str(uint16_t message_type, uint8_t *buf, size_t *len, uint32_t cookie) { 793| 7.94k| stun_init_buffer_str(buf, len); 794| 7.94k| message_type &= (uint16_t)(0x3FFF); 795| 7.94k| turn_write_u16(buf, message_type); 796| 7.94k| turn_write_u16(buf + 2, 0); 797| 7.94k| turn_write_u32(buf + 4, cookie); 798| | stun_tid_generate_in_message_str(buf, NULL); 799| 7.94k|} stun_init_request_str: 801| 16.4k|void stun_init_request_str(uint16_t method, uint8_t *buf, size_t *len) { 802| 16.4k| stun_init_command_str(stun_make_request(method), buf, len); 803| 16.4k|} stun_init_success_response_str: 809| 24.0k|void stun_init_success_response_str(uint16_t method, uint8_t *buf, size_t *len, stun_tid *id) { 810| 24.0k| stun_init_command_str(stun_make_success_response(method), buf, len); 811| 24.0k| if (id) { ------------------ | Branch (811:7): [True: 24.0k, False: 0] ------------------ 812| 24.0k| stun_tid_message_cpy(buf, id); 813| 24.0k| } 814| 24.0k|} old_stun_init_success_response_str: 816| 3.97k|void old_stun_init_success_response_str(uint16_t method, uint8_t *buf, size_t *len, stun_tid *id, uint32_t cookie) { 817| 3.97k| old_stun_init_command_str(stun_make_success_response(method), buf, len, cookie); 818| 3.97k| if (id) { ------------------ | Branch (818:7): [True: 3.97k, False: 0] ------------------ 819| 3.97k| stun_tid_message_cpy(buf, id); 820| 3.97k| } 821| 3.97k|} get_default_reason: 823| 804|const uint8_t *get_default_reason(int error_code) { 824| 804| const char *reason = "Unknown error"; 825| | 826| 804| switch (error_code) { 827| 312| case 300: ------------------ | Branch (827:3): [True: 312, False: 492] ------------------ 828| 312| reason = "Try Alternate"; 829| 312| break; 830| 42| case 400: ------------------ | Branch (830:3): [True: 42, False: 762] ------------------ 831| 42| reason = "Bad Request"; 832| 42| break; 833| 24| case 401: ------------------ | Branch (833:3): [True: 24, False: 780] ------------------ 834| 24| reason = "Unauthorized"; 835| 24| break; 836| 84| case 403: ------------------ | Branch (836:3): [True: 84, False: 720] ------------------ 837| 84| reason = "Forbidden"; 838| 84| break; 839| 0| case 404: ------------------ | Branch (839:3): [True: 0, False: 804] ------------------ 840| 0| reason = "Not Found"; 841| 0| break; 842| 36| case 420: ------------------ | Branch (842:3): [True: 36, False: 768] ------------------ 843| 36| reason = "Unknown Attribute"; 844| 36| break; 845| 18| case 437: ------------------ | Branch (845:3): [True: 18, False: 786] ------------------ 846| 18| reason = "Allocation Mismatch"; 847| 18| break; 848| 12| case 438: ------------------ | Branch (848:3): [True: 12, False: 792] ------------------ 849| 12| reason = "Stale Nonce"; 850| 12| break; 851| 18| case 440: ------------------ | Branch (851:3): [True: 18, False: 786] ------------------ 852| 18| reason = "Address Family not Supported"; 853| 18| break; 854| 30| case 441: ------------------ | Branch (854:3): [True: 30, False: 774] ------------------ 855| 30| reason = "Wrong Credentials"; 856| 30| break; 857| 36| case 442: ------------------ | Branch (857:3): [True: 36, False: 768] ------------------ 858| 36| reason = "Unsupported Transport Protocol"; 859| 36| break; 860| 30| case 443: ------------------ | Branch (860:3): [True: 30, False: 774] ------------------ 861| 30| reason = "Peer Address Family Mismatch"; 862| 30| break; 863| 30| case 446: ------------------ | Branch (863:3): [True: 30, False: 774] ------------------ 864| 30| reason = "Connection Already Exists"; 865| 30| break; 866| 18| case 447: ------------------ | Branch (866:3): [True: 18, False: 786] ------------------ 867| 18| reason = "Connection Timeout or Failure"; 868| 18| break; 869| 24| case 486: ------------------ | Branch (869:3): [True: 24, False: 780] ------------------ 870| 24| reason = "Allocation Quota Reached"; 871| 24| break; 872| 36| case 487: ------------------ | Branch (872:3): [True: 36, False: 768] ------------------ 873| 36| reason = "Role Conflict"; 874| 36| break; 875| 12| case 500: ------------------ | Branch (875:3): [True: 12, False: 792] ------------------ 876| 12| reason = "Server Error"; 877| 12| break; 878| 12| case 508: ------------------ | Branch (878:3): [True: 12, False: 792] ------------------ 879| 12| reason = "Insufficient Capacity"; 880| 12| break; 881| 30| default:; ------------------ | Branch (881:3): [True: 30, False: 774] ------------------ 882| 804| }; 883| | 884| 804| return (const uint8_t *)reason; 885| 804|} old_stun_init_error_response_str: 923| 3.97k| bool include_reason_string) { 924| | 925| 3.97k| old_stun_init_command_str(stun_make_error_response(method), buf, len, cookie); 926| | 927| | stun_init_error_response_common_str(buf, len, error_code, reason, id, include_reason_string, true); 928| 3.97k|} stun_init_error_response_str: 931| 24.0k| const uint8_t *reason, stun_tid *id, bool include_reason_string) { 932| | 933| 24.0k| stun_init_command_str(stun_make_error_response(method), buf, len); 934| | 935| | stun_init_error_response_common_str(buf, len, error_code, reason, id, include_reason_string, false); 936| 24.0k|} stun_init_channel_message_str: 940| 1.64k|bool stun_init_channel_message_str(uint16_t chnumber, uint8_t *buf, size_t *len, int length, bool do_padding) { 941| 1.64k| uint16_t rlen = (uint16_t)length; 942| | 943| 1.64k| if (length < 0 || (MAX_STUN_MESSAGE_SIZE < (4 + length))) { ------------------ | | 221| 1.64k|#define MAX_STUN_MESSAGE_SIZE (65507) ------------------ | Branch (943:7): [True: 0, False: 1.64k] | Branch (943:21): [True: 0, False: 1.64k] ------------------ 944| 0| return false; 945| 0| } 946| 1.64k| turn_write_u16(buf, chnumber); 947| 1.64k| turn_write_u16(buf + 2, (uint16_t)length); 948| | 949| 1.64k| if (do_padding && (rlen & 0x0003)) { ------------------ | Branch (949:7): [True: 635, False: 1.01k] | Branch (949:21): [True: 426, False: 209] ------------------ 950| 426| const uint16_t padded = ((rlen >> 2) + 1) << 2; 951| | // Zero the pad bytes so stale buffer contents are not leaked on the wire 952| | // (matches the padding handling in stun_attr_add_str). 953| 426| memset(buf + 4 + rlen, 0, (size_t)(padded - rlen)); 954| 426| rlen = padded; 955| 426| } 956| | 957| 1.64k| *len = 4 + rlen; 958| | 959| | return true; 960| 1.64k|} stun_is_channel_message_str: 962| 9.48k|bool stun_is_channel_message_str(const uint8_t *buf, size_t *blen, uint16_t *chnumber, bool mandatory_padding) { 963| 9.48k| uint16_t datalen_header; 964| 9.48k| uint16_t datalen_actual; 965| | 966| 9.48k| if (!blen || (*blen < 4)) { ------------------ | Branch (966:7): [True: 0, False: 9.48k] | Branch (966:16): [True: 550, False: 8.93k] ------------------ 967| 550| return false; 968| 550| } 969| | 970| 8.93k| const uint16_t chn = turn_read_u16(buf); 971| 8.93k| if (!STUN_VALID_CHANNEL(chn)) { ------------------ | | 163| 8.93k|#define STUN_VALID_CHANNEL(chn) ((chn) >= 0x4000 && (chn) <= 0x7FFF) | | ------------------ | | | Branch (163:34): [True: 6.31k, False: 2.62k] | | | Branch (163:53): [True: 5.62k, False: 690] | | ------------------ ------------------ 972| 3.31k| return false; 973| 3.31k| } 974| | 975| | /* Clamp to uint16_t range for comparison without mutating the caller's 976| | * *blen — the modification to *blen at the end of this function is 977| | * intentional (it reports actual message length consumed), but clamping 978| | * during validation must not alter the caller's view of the buffer size 979| | * if the function later returns false (issue #1837). */ 980| 5.62k| const uint16_t blen16 = (*blen > (uint16_t)-1) ? (uint16_t)-1 : (uint16_t)*blen; ------------------ | Branch (980:27): [True: 0, False: 5.62k] ------------------ 981| 5.62k| datalen_actual = blen16 - 4; 982| 5.62k| datalen_header = turn_read_u16(buf + 2); 983| | 984| 5.62k| if (datalen_header > datalen_actual) { ------------------ | Branch (984:7): [True: 1.68k, False: 3.94k] ------------------ 985| 1.68k| return false; 986| 1.68k| } 987| | 988| 3.94k| if (datalen_header != datalen_actual) { ------------------ | Branch (988:7): [True: 1.01k, False: 2.92k] ------------------ 989| | 990| | /* maybe there are padding bytes for 32-bit alignment. Mandatory for TCP. Optional for UDP */ 991| | 992| 1.01k| if (datalen_actual & 0x0003) { ------------------ | Branch (992:9): [True: 244, False: 772] ------------------ 993| | 994| 244| if (mandatory_padding) { ------------------ | Branch (994:11): [True: 122, False: 122] ------------------ 995| 122| return false; 996| 122| } else if (datalen_header == 0) { ------------------ | Branch (996:18): [True: 23, False: 99] ------------------ 997| 23| return false; 998| 99| } else { 999| 99| const uint16_t diff = datalen_actual - datalen_header; 1000| 99| if (diff > 3) { ------------------ | Branch (1000:13): [True: 71, False: 28] ------------------ 1001| 71| return false; 1002| 71| } 1003| 99| } 1004| 244| } 1005| 1.01k| } 1006| | 1007| 3.72k| *blen = datalen_header + 4; 1008| | 1009| 3.72k| if (chnumber) { ------------------ | Branch (1009:7): [True: 3.72k, False: 0] ------------------ 1010| 3.72k| *chnumber = chn; 1011| 3.72k| } 1012| | 1013| | return true; 1014| 3.94k|} is_http: 1062| 2.51k|int is_http(const char *s, size_t blen) { 1063| 2.51k| if (s && blen >= 12) { ------------------ | Branch (1063:7): [True: 2.51k, False: 0] | Branch (1063:12): [True: 2.06k, False: 456] ------------------ 1064| 2.06k| if (has_prefix(s, blen, "GET ", false) || has_prefix(s, blen, "POST ", false) || ------------------ | Branch (1064:9): [True: 58, False: 2.00k] | Branch (1064:47): [True: 246, False: 1.75k] ------------------ 1065| 1.75k| has_prefix(s, blen, "DELETE ", false) || has_prefix(s, blen, "PUT ", false)) { ------------------ | Branch (1065:9): [True: 4, False: 1.75k] | Branch (1065:50): [True: 448, False: 1.30k] ------------------ 1066| 756| const char *sp = findstr(s + 4, blen - 4, " HTTP/", false); 1067| 756| if (sp) { ------------------ | Branch (1067:11): [True: 712, False: 44] ------------------ 1068| 712| sp += 6; 1069| 712| const size_t diff_blen = sp - s; 1070| 712| if (diff_blen + 4 <= blen) { ------------------ | Branch (1070:13): [True: 678, False: 34] ------------------ 1071| 678| sp = findstr(sp, blen - diff_blen, "\r\n\r\n", false); 1072| 678| if (sp) { ------------------ | Branch (1072:15): [True: 610, False: 68] ------------------ 1073| 610| int ret_len = (int)(sp - s + 4); 1074| 610| const char *clheader = "content-length: "; 1075| 610| const char *cl = findstr(s, sp - s, clheader, true); 1076| 610| if (cl) { ------------------ | Branch (1076:17): [True: 430, False: 180] ------------------ 1077| 430| const unsigned long clen = strtoul(cl + strlen(clheader), NULL, 10); 1078| 430| if (clen > 0 && clen < (0x0FFFFFFF)) { ------------------ | Branch (1078:19): [True: 418, False: 12] | Branch (1078:31): [True: 176, False: 242] ------------------ 1079| 176| ret_len += (int)clen; 1080| 176| } 1081| 430| } 1082| 610| return ret_len; 1083| 610| } 1084| 678| } 1085| 712| } 1086| 756| } 1087| 2.06k| } 1088| 1.90k| return 0; 1089| 2.51k|} stun_get_message_len_str: 1091| 2.89k|int stun_get_message_len_str(uint8_t *buf, size_t blen, int padding, size_t *app_len) { 1092| 2.89k| if (buf && blen) { ------------------ | Branch (1092:7): [True: 2.89k, False: 0] | Branch (1092:14): [True: 2.89k, False: 0] ------------------ 1093| | /* STUN request/response ? */ 1094| 2.89k| if (buf && blen >= STUN_HEADER_LENGTH) { ------------------ | | 46| 2.89k|#define STUN_HEADER_LENGTH (20) ------------------ | Branch (1094:9): [True: 2.89k, False: 0] | Branch (1094:16): [True: 2.19k, False: 694] ------------------ 1095| 2.19k| if (!STUN_VALID_CHANNEL(turn_read_u16(buf))) { ------------------ | | 163| 2.19k|#define STUN_VALID_CHANNEL(chn) ((chn) >= 0x4000 && (chn) <= 0x7FFF) | | ------------------ | | | Branch (163:34): [True: 1.11k, False: 1.08k] | | | Branch (163:53): [True: 966, False: 148] | | ------------------ ------------------ 1096| 1.23k| if ((((uint8_t)buf[0]) & ((uint8_t)(0xC0))) == 0) { ------------------ | Branch (1096:13): [True: 1.08k, False: 148] ------------------ 1097| 1.08k| if (turn_read_u32(buf + 4) == STUN_MAGIC_COOKIE) { ------------------ | | 60| 1.08k|#define STUN_MAGIC_COOKIE (0x2112A442) ------------------ | Branch (1097:15): [True: 446, False: 638] ------------------ 1098| | /* Use uint32_t to avoid uint16_t truncation overflow when the body 1099| | * length is near 0xFFFF: e.g. 65532 + STUN_HEADER_LENGTH (20) = 1100| | * 65552, which wraps to 16 in uint16_t and lets the truncated value 1101| | * pass the bounds check, desynchronizing TCP/TLS framing. Mirrors 1102| | * the channel-data path below. */ 1103| 446| uint32_t len = (uint32_t)turn_read_u16(buf + 2); 1104| 446| if ((len & 0x0003u) == 0) { ------------------ | Branch (1104:17): [True: 420, False: 26] ------------------ 1105| 420| len += STUN_HEADER_LENGTH; ------------------ | | 46| 420|#define STUN_HEADER_LENGTH (20) ------------------ 1106| 420| if (len <= blen) { ------------------ | Branch (1106:19): [True: 376, False: 44] ------------------ 1107| 376| *app_len = len; 1108| 376| return (int)len; 1109| 376| } 1110| 420| } 1111| 446| } 1112| 1.08k| } 1113| 1.23k| } 1114| 2.19k| } 1115| | 1116| | // HTTP request ? 1117| 2.51k| { 1118| 2.51k| const int http_len = is_http(((char *)buf), blen); 1119| 2.51k| if ((http_len > 0) && ((size_t)http_len <= blen)) { ------------------ | Branch (1119:11): [True: 610, False: 1.90k] | Branch (1119:29): [True: 434, False: 176] ------------------ 1120| 434| *app_len = (size_t)http_len; 1121| 434| return http_len; 1122| 434| } 1123| 2.51k| } 1124| | 1125| | /* STUN channel ? */ 1126| 2.08k| if (blen >= 4) { ------------------ | Branch (1126:9): [True: 2.08k, False: 0] ------------------ 1127| 2.08k| const uint16_t chn = turn_read_u16(buf); 1128| 2.08k| if (STUN_VALID_CHANNEL(chn)) { ------------------ | | 163| 2.08k|#define STUN_VALID_CHANNEL(chn) ((chn) >= 0x4000 && (chn) <= 0x7FFF) | | ------------------ | | | Branch (163:34): [True: 1.12k, False: 958] | | | Branch (163:53): [True: 772, False: 352] | | ------------------ ------------------ 1129| | 1130| | /* Use uint32_t to avoid uint16_t truncation overflow when data_len is 1131| | * near 0xFFFF: 4 + 0xFFFF = 65539, which wraps to 3 in uint16_t and 1132| | * causes TCP framing bypass (CVE candidate, issue #1837). */ 1133| 772| uint32_t bret = 4u + (uint32_t)turn_read_u16(buf + 2); 1134| | 1135| 772| *app_len = bret; 1136| | 1137| 772| if (padding && (bret & 0x0003u)) { ------------------ | Branch (1137:13): [True: 386, False: 386] | Branch (1137:24): [True: 134, False: 252] ------------------ 1138| 134| bret = ((bret >> 2) + 1u) << 2; 1139| 134| } 1140| | 1141| 772| if (bret <= blen) { ------------------ | Branch (1141:13): [True: 331, False: 441] ------------------ 1142| 331| return (int)bret; 1143| 331| } 1144| 772| } 1145| 2.08k| } 1146| 2.08k| } 1147| | 1148| 1.75k| return -1; 1149| 2.89k|} stun_set_allocate_request_str: 1154| 3.29k| bool mobile, const char *rt, int ep) { 1155| | 1156| 3.29k| stun_init_request_str(STUN_METHOD_ALLOCATE, buf, len); ------------------ | | 82| 3.29k|#define STUN_METHOD_ALLOCATE (0x0003) ------------------ 1157| | 1158| | // REQUESTED-TRANSPORT 1159| 3.29k| { 1160| 3.29k| uint8_t field[4]; 1161| 3.29k| field[0] = transport; 1162| 3.29k| field[1] = 0; 1163| 3.29k| field[2] = 0; 1164| 3.29k| field[3] = 0; 1165| 3.29k| if (!stun_attr_add_str(buf, len, STUN_ATTRIBUTE_REQUESTED_TRANSPORT, field, sizeof(field))) { ------------------ | | 124| 3.29k|#define STUN_ATTRIBUTE_REQUESTED_TRANSPORT (0x0019) ------------------ | Branch (1165:9): [True: 0, False: 3.29k] ------------------ 1166| 0| return false; 1167| 0| } 1168| 3.29k| } 1169| | 1170| | // LIFETIME 1171| 3.29k| { 1172| 3.29k| if (lifetime < 1) { ------------------ | Branch (1172:9): [True: 278, False: 3.01k] ------------------ 1173| 278| lifetime = STUN_DEFAULT_ALLOCATE_LIFETIME; ------------------ | | 73| 278|#define STUN_DEFAULT_ALLOCATE_LIFETIME (600) ------------------ 1174| 278| } 1175| 3.29k| uint32_t field = nswap32(lifetime); ------------------ | | 87| 3.29k|#define nswap32(ul) ntohl(ul) ------------------ 1176| 3.29k| if (!stun_attr_add_str(buf, len, STUN_ATTRIBUTE_LIFETIME, (uint8_t *)(&field), sizeof(field))) { ------------------ | | 118| 3.29k|#define STUN_ATTRIBUTE_LIFETIME (0x000D) ------------------ | Branch (1176:9): [True: 0, False: 3.29k] ------------------ 1177| 0| return false; 1178| 0| } 1179| 3.29k| } 1180| | 1181| | // MICE 1182| 3.29k| if (mobile) { ------------------ | Branch (1182:7): [True: 1.64k, False: 1.64k] ------------------ 1183| 1.64k| if (!stun_attr_add_str(buf, len, STUN_ATTRIBUTE_MOBILITY_TICKET, (const uint8_t *)"", 0)) { ------------------ | | 47| 1.64k|#define STUN_ATTRIBUTE_MOBILITY_TICKET (0x8030) ------------------ | Branch (1183:9): [True: 0, False: 1.64k] ------------------ 1184| 0| return false; 1185| 0| } 1186| 1.64k| } 1187| | 1188| 3.29k| if (ep > -1) { ------------------ | Branch (1188:7): [True: 2.50k, False: 792] ------------------ 1189| 2.50k| uint8_t value = ep ? 0x80 : 0x00; ------------------ | Branch (1189:21): [True: 1.48k, False: 1.01k] ------------------ 1190| 2.50k| if (!stun_attr_add_str(buf, len, STUN_ATTRIBUTE_EVEN_PORT, (const uint8_t *)&value, 1)) { ------------------ | | 123| 2.50k|#define STUN_ATTRIBUTE_EVEN_PORT (0x0018) ------------------ | Branch (1190:9): [True: 0, False: 2.50k] ------------------ 1191| 0| return false; 1192| 0| } 1193| 2.50k| } 1194| | 1195| | // RESERVATION-TOKEN, EVEN-PORT and DUAL-ALLOCATION are mutually exclusive: 1196| 3.29k| if (rt) { ------------------ | Branch (1196:7): [True: 1.00k, False: 2.28k] ------------------ 1197| | 1198| 1.00k| stun_attr_add_str(buf, len, STUN_ATTRIBUTE_RESERVATION_TOKEN, (const uint8_t *)rt, 8); ------------------ | | 127| 1.00k|#define STUN_ATTRIBUTE_RESERVATION_TOKEN (0x0022) ------------------ 1199| | 1200| 2.28k| } else { 1201| | 1202| | // ADRESS-FAMILY 1203| 2.28k| if (af4 && !af6) { ------------------ | Branch (1203:9): [True: 1.15k, False: 1.13k] | Branch (1203:16): [True: 347, False: 809] ------------------ 1204| 347| uint8_t field[4]; 1205| 347| field[0] = (uint8_t)STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY_VALUE_IPV4; ------------------ | | 168| 347|#define STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY_VALUE_IPV4 (0x01) ------------------ 1206| 347| field[1] = 0; 1207| 347| field[2] = 0; 1208| 347| field[3] = 0; 1209| 347| if (!stun_attr_add_str(buf, len, STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY, field, sizeof(field))) { ------------------ | | 108| 347|#define STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY (0x0017) ------------------ | Branch (1209:11): [True: 0, False: 347] ------------------ 1210| 0| return false; 1211| 0| } 1212| 347| } 1213| | 1214| 2.28k| if (af6 && !af4) { ------------------ | Branch (1214:9): [True: 1.20k, False: 1.08k] | Branch (1214:16): [True: 395, False: 809] ------------------ 1215| 395| uint8_t field[4]; 1216| 395| field[0] = (uint8_t)STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY_VALUE_IPV6; ------------------ | | 169| 395|#define STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY_VALUE_IPV6 (0x02) ------------------ 1217| 395| field[1] = 0; 1218| 395| field[2] = 0; 1219| 395| field[3] = 0; 1220| 395| if (!stun_attr_add_str(buf, len, STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY, field, sizeof(field))) { ------------------ | | 108| 395|#define STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY (0x0017) ------------------ | Branch (1220:11): [True: 0, False: 395] ------------------ 1221| 0| return false; 1222| 0| } 1223| 395| } 1224| | 1225| 2.28k| if (af4 && af6) { ------------------ | Branch (1225:9): [True: 1.15k, False: 1.13k] | Branch (1225:16): [True: 809, False: 347] ------------------ 1226| 809| uint8_t field[4]; 1227| 809| field[0] = (uint8_t)STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY_VALUE_IPV6; ------------------ | | 169| 809|#define STUN_ATTRIBUTE_REQUESTED_ADDRESS_FAMILY_VALUE_IPV6 (0x02) ------------------ 1228| 809| field[1] = 0; 1229| 809| field[2] = 0; 1230| 809| field[3] = 0; 1231| 809| if (!stun_attr_add_str(buf, len, STUN_ATTRIBUTE_ADDITIONAL_ADDRESS_FAMILY, field, sizeof(field))) { ------------------ | | 144| 809|#define STUN_ATTRIBUTE_ADDITIONAL_ADDRESS_FAMILY (0x8000) ------------------ | Branch (1231:11): [True: 0, False: 809] ------------------ 1232| 0| return false; 1233| 0| } 1234| 809| } 1235| 2.28k| } 1236| | 1237| 3.29k| return true; 1238| 3.29k|} stun_set_allocate_response_str: 1243| 16.4k| uint64_t reservation_token, char *mobile_id, bool include_reason_string) { 1244| | 1245| 16.4k| if (!error_code) { ------------------ | Branch (1245:7): [True: 9.88k, False: 6.59k] ------------------ 1246| | 1247| 9.88k| stun_init_success_response_str(STUN_METHOD_ALLOCATE, buf, len, tid); ------------------ | | 82| 9.88k|#define STUN_METHOD_ALLOCATE (0x0003) ------------------ 1248| | 1249| 9.88k| if (relayed_addr1) { ------------------ | Branch (1249:9): [True: 9.88k, False: 0] ------------------ 1250| 9.88k| if (!stun_attr_add_addr_str(buf, len, STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS, relayed_addr1)) { ------------------ | | 122| 9.88k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ | Branch (1250:11): [True: 0, False: 9.88k] ------------------ 1251| 0| return false; 1252| 0| } 1253| 9.88k| } 1254| | 1255| 9.88k| if (relayed_addr2) { ------------------ | Branch (1255:9): [True: 5.54k, False: 4.34k] ------------------ 1256| 5.54k| if (!stun_attr_add_addr_str(buf, len, STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS, relayed_addr2)) { ------------------ | | 122| 5.54k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ | Branch (1256:11): [True: 0, False: 5.54k] ------------------ 1257| 0| return false; 1258| 0| } 1259| 5.54k| } 1260| | 1261| 9.88k| if (reflexive_addr) { ------------------ | Branch (1261:9): [True: 6.59k, False: 3.29k] ------------------ 1262| 6.59k| if (!stun_attr_add_addr_str(buf, len, STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS, reflexive_addr)) { ------------------ | | 109| 6.59k|#define STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS (0x0020) ------------------ | Branch (1262:11): [True: 0, False: 6.59k] ------------------ 1263| 0| return false; 1264| 0| } 1265| 6.59k| } 1266| | 1267| 9.88k| if (reservation_token) { ------------------ | Branch (1267:9): [True: 6.49k, False: 3.39k] ------------------ 1268| 6.49k| reservation_token = nswap64(reservation_token); ------------------ | | 88| 6.49k|#define nswap64(ull) ioa_ntoh64(ull) | | ------------------ | | | | 115| 6.49k|#define ioa_ntoh64 _ioa_ntoh64 | | ------------------ ------------------ 1269| 6.49k| stun_attr_add_str(buf, len, STUN_ATTRIBUTE_RESERVATION_TOKEN, (uint8_t *)(&reservation_token), 8); ------------------ | | 127| 6.49k|#define STUN_ATTRIBUTE_RESERVATION_TOKEN (0x0022) ------------------ 1270| 6.49k| } 1271| | 1272| 9.88k| { 1273| 9.88k| if (lifetime < 1) { ------------------ | Branch (1273:11): [True: 3.62k, False: 6.26k] ------------------ 1274| 3.62k| lifetime = STUN_DEFAULT_ALLOCATE_LIFETIME; ------------------ | | 73| 3.62k|#define STUN_DEFAULT_ALLOCATE_LIFETIME (600) ------------------ 1275| 6.26k| } else if (lifetime > max_lifetime) { ------------------ | Branch (1275:18): [True: 4.49k, False: 1.76k] ------------------ 1276| 4.49k| lifetime = max_lifetime; 1277| 4.49k| } 1278| | 1279| 9.88k| uint32_t field = nswap32(lifetime); ------------------ | | 87| 9.88k|#define nswap32(ul) ntohl(ul) ------------------ 1280| 9.88k| if (!stun_attr_add_str(buf, len, STUN_ATTRIBUTE_LIFETIME, (uint8_t *)(&field), sizeof(field))) { ------------------ | | 118| 9.88k|#define STUN_ATTRIBUTE_LIFETIME (0x000D) ------------------ | Branch (1280:11): [True: 0, False: 9.88k] ------------------ 1281| 0| return false; 1282| 0| } 1283| 9.88k| } 1284| | 1285| 9.88k| if (mobile_id && *mobile_id) { ------------------ | Branch (1285:9): [True: 6.59k, False: 3.29k] | Branch (1285:22): [True: 4.62k, False: 1.96k] ------------------ 1286| 4.62k| if (!stun_attr_add_str(buf, len, STUN_ATTRIBUTE_MOBILITY_TICKET, (uint8_t *)mobile_id, (int)strlen(mobile_id))) { ------------------ | | 47| 4.62k|#define STUN_ATTRIBUTE_MOBILITY_TICKET (0x8030) ------------------ | Branch (1286:11): [True: 0, False: 4.62k] ------------------ 1287| 0| return false; 1288| 0| } 1289| 4.62k| } 1290| | 1291| 9.88k| } else { 1292| 6.59k| stun_init_error_response_str(STUN_METHOD_ALLOCATE, buf, len, error_code, reason, tid, include_reason_string); ------------------ | | 82| 6.59k|#define STUN_METHOD_ALLOCATE (0x0003) ------------------ 1293| 6.59k| } 1294| | 1295| 16.4k| return true; 1296| 16.4k|} stun_set_channel_bind_request_str: 1301| 9.88k| uint16_t channel_number) { 1302| | 1303| 9.88k| if (!STUN_VALID_CHANNEL_BIND(channel_number)) { ------------------ | | 162| 9.88k|#define STUN_VALID_CHANNEL_BIND(chn) ((chn) >= 0x4000 && (chn) <= 0x4FFF) | | ------------------ | | | Branch (162:39): [True: 8.03k, False: 1.85k] | | | Branch (162:58): [True: 2.96k, False: 5.07k] | | ------------------ ------------------ 1304| 6.92k| channel_number = 0x4000 + ((uint16_t)(((uint32_t)turn_random_number()) % (0x4FFF - 0x4000 + 1))); 1305| 6.92k| } 1306| | 1307| 9.88k| stun_init_request_str(STUN_METHOD_CHANNEL_BIND, buf, len); ------------------ | | 87| 9.88k|#define STUN_METHOD_CHANNEL_BIND (0x0009) ------------------ 1308| | 1309| 9.88k| if (!stun_attr_add_channel_number_str(buf, len, channel_number)) { ------------------ | Branch (1309:7): [True: 0, False: 9.88k] ------------------ 1310| 0| return 0; 1311| 0| } 1312| | 1313| 9.88k| if (!peer_addr) { ------------------ | Branch (1313:7): [True: 5.36k, False: 4.52k] ------------------ 1314| 5.36k| ioa_addr ca; 1315| 5.36k| memset(&ca, 0, sizeof(ioa_addr)); 1316| | 1317| 5.36k| if (!stun_attr_add_addr_str(buf, len, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, &ca)) { ------------------ | | 120| 5.36k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ | Branch (1317:9): [True: 0, False: 5.36k] ------------------ 1318| 0| return 0; 1319| 0| } 1320| 5.36k| } else { 1321| 4.52k| if (!stun_attr_add_addr_str(buf, len, STUN_ATTRIBUTE_XOR_PEER_ADDRESS, peer_addr)) { ------------------ | | 120| 4.52k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ | Branch (1321:9): [True: 0, False: 4.52k] ------------------ 1322| 0| return 0; 1323| 0| } 1324| 4.52k| } 1325| | 1326| 9.88k| return channel_number; 1327| 9.88k|} stun_set_channel_bind_response_str: 1330| 9.88k| bool include_reason_string) { 1331| 9.88k| if (!error_code) { ------------------ | Branch (1331:7): [True: 4.94k, False: 4.94k] ------------------ 1332| 4.94k| stun_init_success_response_str(STUN_METHOD_CHANNEL_BIND, buf, len, tid); ------------------ | | 87| 4.94k|#define STUN_METHOD_CHANNEL_BIND (0x0009) ------------------ 1333| 4.94k| } else { 1334| 4.94k| stun_init_error_response_str(STUN_METHOD_CHANNEL_BIND, buf, len, error_code, reason, tid, include_reason_string); ------------------ | | 87| 4.94k|#define STUN_METHOD_CHANNEL_BIND (0x0009) ------------------ 1335| 4.94k| } 1336| 9.88k|} stun_set_binding_request_str: 1340| 3.29k|void stun_set_binding_request_str(uint8_t *buf, size_t *len) { stun_init_request_str(STUN_METHOD_BINDING, buf, len); } ------------------ | | 81| 3.29k|#define STUN_METHOD_BINDING (0x0001) ------------------ stun_set_binding_response_str: 1346| 23.0k|{ 1347| 23.0k| if (!error_code) { ------------------ | Branch (1347:7): [True: 11.5k, False: 11.5k] ------------------ 1348| 11.5k| if (!old_stun) { ------------------ | Branch (1348:9): [True: 7.56k, False: 3.97k] ------------------ 1349| 7.56k| stun_init_success_response_str(STUN_METHOD_BINDING, buf, len, tid); ------------------ | | 81| 7.56k|#define STUN_METHOD_BINDING (0x0001) ------------------ 1350| 7.56k| } else { 1351| 3.97k| old_stun_init_success_response_str(STUN_METHOD_BINDING, buf, len, tid, cookie); ------------------ | | 81| 3.97k|#define STUN_METHOD_BINDING (0x0001) ------------------ 1352| 3.97k| } 1353| 11.5k| if (!old_stun && reflexive_addr) { ------------------ | Branch (1353:9): [True: 7.56k, False: 3.97k] | Branch (1353:22): [True: 7.56k, False: 0] ------------------ 1354| 7.56k| if (!stun_attr_add_addr_str(buf, len, STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS, reflexive_addr)) { ------------------ | | 109| 7.56k|#define STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS (0x0020) ------------------ | Branch (1354:11): [True: 0, False: 7.56k] ------------------ 1355| 0| return false; 1356| 0| } 1357| 7.56k| } 1358| | /* MAPPED-ADDRESS is the only address attribute RFC 3489 defines, so the old-STUN 1359| | * path always needs it. On the modern path it is purely a backward-compatibility 1360| | * courtesy for clients that cannot parse XOR-MAPPED-ADDRESS, and it widens the 1361| | * response, so it stays opt-in there. */ 1362| 11.5k| if (reflexive_addr) { ------------------ | Branch (1362:9): [True: 11.5k, False: 0] ------------------ 1363| 11.5k| if ((old_stun || stun_backward_compatibility) && ------------------ | Branch (1363:12): [True: 3.97k, False: 7.56k] | Branch (1363:24): [True: 5.24k, False: 2.31k] ------------------ 1364| 9.21k| !stun_attr_add_addr_str(buf, len, STUN_ATTRIBUTE_MAPPED_ADDRESS, reflexive_addr)) { ------------------ | | 95| 9.21k|#define STUN_ATTRIBUTE_MAPPED_ADDRESS (0x0001) ------------------ | Branch (1364:11): [True: 0, False: 9.21k] ------------------ 1365| 0| return false; 1366| 0| } 1367| 11.5k| } 1368| 11.5k| } else if (!old_stun) { ------------------ | Branch (1368:14): [True: 7.56k, False: 3.97k] ------------------ 1369| 7.56k| stun_init_error_response_str(STUN_METHOD_BINDING, buf, len, error_code, reason, tid, include_reason_string); ------------------ | | 81| 7.56k|#define STUN_METHOD_BINDING (0x0001) ------------------ 1370| 7.56k| } else { 1371| 3.97k| old_stun_init_error_response_str(STUN_METHOD_BINDING, buf, len, error_code, reason, tid, cookie, ------------------ | | 81| 3.97k|#define STUN_METHOD_BINDING (0x0001) ------------------ 1372| 3.97k| include_reason_string); 1373| 3.97k| } 1374| | 1375| 23.0k| return true; 1376| 23.0k|} stun_is_binding_response_str: 1391| 75.8k|bool stun_is_binding_response_str(const uint8_t *buf, size_t len) { 1392| 75.8k| if (stun_is_command_message_str(buf, len) && (stun_get_method_str(buf, len) == STUN_METHOD_BINDING)) { ------------------ | | 81| 68.1k|#define STUN_METHOD_BINDING (0x0001) ------------------ | Branch (1392:7): [True: 68.1k, False: 7.71k] | Branch (1392:48): [True: 21.1k, False: 47.0k] ------------------ 1393| 21.1k| if (stun_is_response_str(buf, len)) { ------------------ | Branch (1393:9): [True: 17.4k, False: 3.67k] ------------------ 1394| 17.4k| return true; 1395| 17.4k| } 1396| 21.1k| } 1397| 58.4k| return false; 1398| 75.8k|} stun_tid_from_message_str: 1436| 149k|void stun_tid_from_message_str(const uint8_t *buf, size_t len, stun_tid *id) { 1437| 149k| UNUSED_ARG(len); ------------------ | | 216| 149k| do { \ | | 217| 149k| A = A; \ | | 218| 149k| } while (0) | | ------------------ | | | Branch (218:12): [Folded, False: 149k] | | ------------------ ------------------ 1438| 149k| stun_tid_from_string(buf + 8, id); 1439| 149k|} stun_tid_message_cpy: 1441| 133k|void stun_tid_message_cpy(uint8_t *buf, const stun_tid *id) { 1442| 133k| if (buf && id) { ------------------ | Branch (1442:7): [True: 133k, False: 0] | Branch (1442:14): [True: 133k, False: 0] ------------------ 1443| 133k| stun_tid_string_cpy(buf + 8, id); 1444| 133k| } 1445| 133k|} stun_tid_generate: 1447| 77.4k|void stun_tid_generate(stun_tid *id) { 1448| 77.4k| if (id) { ------------------ | Branch (1448:7): [True: 77.4k, False: 0] ------------------ 1449| 77.4k| turn_random_tid_size(id->tsx_id); 1450| 77.4k| } 1451| 77.4k|} stun_tid_generate_in_message_str: 1453| 77.4k|void stun_tid_generate_in_message_str(uint8_t *buf, stun_tid *id) { 1454| 77.4k| stun_tid tmp; 1455| 77.4k| if (!id) { ------------------ | Branch (1455:7): [True: 75.8k, False: 1.64k] ------------------ 1456| 75.8k| id = &tmp; 1457| 75.8k| } 1458| 77.4k| stun_tid_generate(id); 1459| 77.4k| stun_tid_message_cpy(buf, id); 1460| 77.4k|} stun_attr_get_type: 1484| 914k|int stun_attr_get_type(stun_attr_ref attr) { 1485| 914k| if (attr) { ------------------ | Branch (1485:7): [True: 914k, False: 0] ------------------ 1486| 914k| return (int)turn_read_u16(attr); 1487| 914k| } 1488| 0| return -1; 1489| 914k|} stun_attr_get_len: 1491| 1.32M|int stun_attr_get_len(stun_attr_ref attr) { 1492| 1.32M| if (attr) { ------------------ | Branch (1492:7): [True: 1.32M, False: 0] ------------------ 1493| 1.32M| return (int)turn_read_u16((const uint8_t *)attr + 2); 1494| 1.32M| } 1495| 0| return -1; 1496| 1.32M|} stun_attr_get_value: 1498| 135k|const uint8_t *stun_attr_get_value(stun_attr_ref attr) { 1499| 135k| if (attr) { ------------------ | Branch (1499:7): [True: 135k, False: 0] ------------------ 1500| 135k| const int len = (int)turn_read_u16((const uint8_t *)attr + 2); 1501| 135k| if (len < 1) { ------------------ | Branch (1501:9): [True: 5.80k, False: 129k] ------------------ 1502| 5.80k| return NULL; 1503| 5.80k| } 1504| 129k| return ((const uint8_t *)attr) + 4; 1505| 135k| } 1506| 0| return NULL; 1507| 135k|} stun_attr_get_channel_number: 1527| 11.5k|uint16_t stun_attr_get_channel_number(stun_attr_ref attr) { 1528| 11.5k| if (attr) { ------------------ | Branch (1528:7): [True: 11.5k, False: 0] ------------------ 1529| 11.5k| const uint8_t *value = stun_attr_get_value(attr); 1530| 11.5k| if (value && (stun_attr_get_len(attr) >= 2)) { ------------------ | Branch (1530:9): [True: 11.5k, False: 0] | Branch (1530:18): [True: 11.5k, False: 0] ------------------ 1531| 11.5k| const uint16_t cn = turn_read_u16(value); 1532| 11.5k| if (STUN_VALID_CHANNEL(cn)) { ------------------ | | 163| 11.5k|#define STUN_VALID_CHANNEL(chn) ((chn) >= 0x4000 && (chn) <= 0x7FFF) | | ------------------ | | | Branch (163:34): [True: 11.5k, False: 0] | | | Branch (163:53): [True: 11.5k, False: 0] | | ------------------ ------------------ 1533| 11.5k| return cn; 1534| 11.5k| } 1535| 11.5k| } 1536| 11.5k| } 1537| 0| return 0; 1538| 11.5k|} stun_attr_is_addr: 1561| 373k|bool stun_attr_is_addr(stun_attr_ref attr) { 1562| | 1563| 373k| if (attr) { ------------------ | Branch (1563:7): [True: 373k, False: 0] ------------------ 1564| 373k| switch (stun_attr_get_type(attr)) { 1565| 33.2k| case STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS: ------------------ | | 109| 33.2k|#define STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS (0x0020) ------------------ | Branch (1565:5): [True: 33.2k, False: 339k] ------------------ 1566| 82.0k| case STUN_ATTRIBUTE_XOR_PEER_ADDRESS: ------------------ | | 120| 82.0k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ | Branch (1566:5): [True: 48.8k, False: 324k] ------------------ 1567| 137k| case STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS: ------------------ | | 122| 137k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ | Branch (1567:5): [True: 55.5k, False: 317k] ------------------ 1568| 175k| case STUN_ATTRIBUTE_MAPPED_ADDRESS: ------------------ | | 95| 175k|#define STUN_ATTRIBUTE_MAPPED_ADDRESS (0x0001) ------------------ | Branch (1568:5): [True: 38.0k, False: 335k] ------------------ 1569| 179k| case STUN_ATTRIBUTE_ALTERNATE_SERVER: ------------------ | | 114| 179k|#define STUN_ATTRIBUTE_ALTERNATE_SERVER (0x8023) ------------------ | Branch (1569:5): [True: 3.93k, False: 369k] ------------------ 1570| 180k| case OLD_STUN_ATTRIBUTE_RESPONSE_ADDRESS: ------------------ | | 96| 180k|#define OLD_STUN_ATTRIBUTE_RESPONSE_ADDRESS (0x0002) ------------------ | Branch (1570:5): [True: 852, False: 372k] ------------------ 1571| 182k| case OLD_STUN_ATTRIBUTE_SOURCE_ADDRESS: ------------------ | | 98| 182k|#define OLD_STUN_ATTRIBUTE_SOURCE_ADDRESS (0x0004) ------------------ | Branch (1571:5): [True: 1.93k, False: 371k] ------------------ 1572| 183k| case OLD_STUN_ATTRIBUTE_CHANGED_ADDRESS: ------------------ | | 99| 183k|#define OLD_STUN_ATTRIBUTE_CHANGED_ADDRESS (0x0005) ------------------ | Branch (1572:5): [True: 1.23k, False: 371k] ------------------ 1573| 184k| case OLD_STUN_ATTRIBUTE_REFLECTED_FROM: ------------------ | | 105| 184k|#define OLD_STUN_ATTRIBUTE_REFLECTED_FROM (0x000B) ------------------ | Branch (1573:5): [True: 920, False: 372k] ------------------ 1574| 186k| case STUN_ATTRIBUTE_RESPONSE_ORIGIN: ------------------ | | 136| 186k|#define STUN_ATTRIBUTE_RESPONSE_ORIGIN (0x802B) ------------------ | Branch (1574:5): [True: 2.43k, False: 370k] ------------------ 1575| 187k| case STUN_ATTRIBUTE_OTHER_ADDRESS: ------------------ | | 137| 187k|#define STUN_ATTRIBUTE_OTHER_ADDRESS (0x802C) ------------------ | Branch (1575:5): [True: 962, False: 372k] ------------------ 1576| 187k| return true; 1577| 0| break; 1578| 185k| default:; ------------------ | Branch (1578:5): [True: 185k, False: 187k] ------------------ 1579| 373k| }; 1580| 185k| } 1581| 185k| return false; 1582| 373k|} stun_attr_get_first_by_type_str: 1604| 39.6k|stun_attr_ref stun_attr_get_first_by_type_str(const uint8_t *buf, size_t len, uint16_t attr_type) { 1605| 39.6k| stun_attr_ref attr = stun_attr_get_first_str(buf, len); 1606| 69.2k| while (attr) { ------------------ | Branch (1606:10): [True: 64.3k, False: 4.92k] ------------------ 1607| 64.3k| if (stun_attr_get_type(attr) == attr_type) { ------------------ | Branch (1607:9): [True: 34.7k, False: 29.6k] ------------------ 1608| 34.7k| return attr; 1609| 34.7k| } 1610| 29.6k| attr = stun_attr_get_next_str(buf, len, attr); 1611| 29.6k| } 1612| | 1613| 4.92k| return NULL; 1614| 39.6k|} stun_attr_get_first_str: 1637| 284k|stun_attr_ref stun_attr_get_first_str(const uint8_t *buf, size_t len) { 1638| 284k| const int bufLen = stun_get_command_message_len_str(buf, len); 1639| 284k| if (bufLen > STUN_HEADER_LENGTH) { ------------------ | | 46| 284k|#define STUN_HEADER_LENGTH (20) ------------------ | Branch (1639:7): [True: 237k, False: 47.1k] ------------------ 1640| 237k| stun_attr_ref attr = (stun_attr_ref)(buf + STUN_HEADER_LENGTH); ------------------ | | 46| 237k|#define STUN_HEADER_LENGTH (20) ------------------ 1641| 237k| return stun_attr_check_valid(attr, bufLen - STUN_HEADER_LENGTH); ------------------ | | 46| 237k|#define STUN_HEADER_LENGTH (20) ------------------ 1642| 237k| } 1643| | 1644| 47.1k| return NULL; 1645| 284k|} stun_attr_get_next_str: 1647| 471k|stun_attr_ref stun_attr_get_next_str(const uint8_t *buf, size_t len, stun_attr_ref prev) { 1648| 471k| if (!prev) { ------------------ | Branch (1648:7): [True: 0, False: 471k] ------------------ 1649| 0| return stun_attr_get_first_str(buf, len); 1650| 471k| } else { 1651| 471k| const uint8_t *end = buf + stun_get_command_message_len_str(buf, len); 1652| 471k| int attrlen = stun_attr_get_len(prev); 1653| 471k| const uint16_t rem4 = ((uint16_t)attrlen) & 0x0003; 1654| 471k| if (rem4) { ------------------ | Branch (1654:9): [True: 96.6k, False: 375k] ------------------ 1655| 96.6k| attrlen = attrlen + 4 - (int)rem4; 1656| 96.6k| } 1657| | /* Note the order here: operations on attrlen are untrusted as they may overflow */ 1658| 471k| if (attrlen < end - (const uint8_t *)prev - 4) { ------------------ | Branch (1658:9): [True: 319k, False: 152k] ------------------ 1659| 319k| const uint8_t *attr_end = (const uint8_t *)prev + 4 + attrlen; 1660| 319k| return stun_attr_check_valid(attr_end, end - attr_end); 1661| 319k| } 1662| 152k| return NULL; 1663| 471k| } 1664| 471k|} stun_attr_add_str: 1666| 129k|bool stun_attr_add_str(uint8_t *buf, size_t *len, uint16_t attr, const uint8_t *avalue, int alen) { 1667| 129k| if (alen < 0) { ------------------ | Branch (1667:7): [True: 0, False: 129k] ------------------ 1668| 0| alen = 0; 1669| 0| } 1670| 129k| uint8_t tmp[1]; 1671| 129k| if (!avalue) { ------------------ | Branch (1671:7): [True: 0, False: 129k] ------------------ 1672| 0| alen = 0; 1673| 0| avalue = tmp; 1674| 0| } 1675| 129k| const int clen = stun_get_command_message_len_str(buf, *len); 1676| 129k| int newlen = clen + 4 + alen; 1677| 129k| const int newlenrem4 = newlen & 0x00000003; 1678| 129k| int paddinglen = 0; 1679| 129k| if (newlenrem4) { ------------------ | Branch (1679:7): [True: 18.5k, False: 110k] ------------------ 1680| 18.5k| paddinglen = 4 - newlenrem4; 1681| 18.5k| newlen = newlen + paddinglen; 1682| 18.5k| } 1683| | 1684| 129k| if (newlen >= MAX_STUN_MESSAGE_SIZE) { ------------------ | | 221| 129k|#define MAX_STUN_MESSAGE_SIZE (65507) ------------------ | Branch (1684:7): [True: 0, False: 129k] ------------------ 1685| 0| return false; 1686| 0| } 1687| | 1688| 129k| uint8_t *attr_start = buf + clen; 1689| | 1690| 129k| stun_set_command_message_len_str(buf, newlen); 1691| 129k| *len = newlen; 1692| | 1693| 129k| turn_write_u16(attr_start, attr); 1694| 129k| turn_write_u16(attr_start + 2, (uint16_t)alen); 1695| 129k| if (alen > 0) { ------------------ | Branch (1695:7): [True: 127k, False: 2.06k] ------------------ 1696| 127k| memcpy(attr_start + 4, avalue, alen); 1697| 127k| } 1698| | 1699| | // Write 0 padding to not leak data 1700| 129k| memset(attr_start + 4 + alen, 0, paddinglen); 1701| | 1702| | return true; 1703| 129k|} stun_attr_add_addr_str: 1705| 50.3k|bool stun_attr_add_addr_str(uint8_t *buf, size_t *len, uint16_t attr_type, const ioa_addr *ca) { 1706| | 1707| 50.3k| stun_tid tid; 1708| 50.3k| stun_tid_from_message_str(buf, *len, &tid); 1709| | 1710| 50.3k| int xor_ed = 0; 1711| 50.3k| switch (attr_type) { 1712| 14.1k| case STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS: ------------------ | | 109| 14.1k|#define STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS (0x0020) ------------------ | Branch (1712:3): [True: 14.1k, False: 36.1k] ------------------ 1713| 25.6k| case STUN_ATTRIBUTE_XOR_PEER_ADDRESS: ------------------ | | 120| 25.6k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ | Branch (1713:3): [True: 11.5k, False: 38.8k] ------------------ 1714| 41.1k| case STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS: ------------------ | | 122| 41.1k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ | Branch (1714:3): [True: 15.4k, False: 34.9k] ------------------ 1715| 41.1k| xor_ed = 1; 1716| 41.1k| break; 1717| 9.21k| default:; ------------------ | Branch (1717:3): [True: 9.21k, False: 41.1k] ------------------ 1718| 50.3k| }; 1719| | 1720| 50.3k| ioa_addr public_addr; 1721| 50.3k| map_addr_from_private_to_public(ca, &public_addr); 1722| | 1723| 50.3k| uint8_t cfield[64]; 1724| 50.3k| int clen = 0; 1725| 50.3k| if (stun_addr_encode(&public_addr, cfield, &clen, xor_ed, STUN_MAGIC_COOKIE, tid.tsx_id) < 0) { ------------------ | | 60| 50.3k|#define STUN_MAGIC_COOKIE (0x2112A442) ------------------ | Branch (1725:7): [True: 0, False: 50.3k] ------------------ 1726| 0| return false; 1727| 0| } 1728| | 1729| 50.3k| if (!stun_attr_add_str(buf, len, attr_type, (uint8_t *)(&cfield), clen)) { ------------------ | Branch (1729:7): [True: 0, False: 50.3k] ------------------ 1730| 0| return false; 1731| 0| } 1732| | 1733| 50.3k| return true; 1734| 50.3k|} stun_attr_get_addr_str: 1737| 95.7k| const ioa_addr *default_addr) { 1738| 95.7k| stun_tid tid; 1739| 95.7k| stun_tid_from_message_str(buf, len, &tid); 1740| 95.7k| ioa_addr public_addr; 1741| | 1742| 95.7k| addr_set_any(ca); 1743| 95.7k| addr_set_any(&public_addr); 1744| | 1745| 95.7k| const int attr_type = stun_attr_get_type(attr); 1746| 95.7k| if (attr_type < 0) { ------------------ | Branch (1746:7): [True: 0, False: 95.7k] ------------------ 1747| 0| return false; 1748| 0| } 1749| | 1750| 95.7k| int xor_ed = 0; 1751| 95.7k| switch (attr_type) { 1752| 23.1k| case STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS: ------------------ | | 109| 23.1k|#define STUN_ATTRIBUTE_XOR_MAPPED_ADDRESS (0x0020) ------------------ | Branch (1752:3): [True: 23.1k, False: 72.5k] ------------------ 1753| 49.5k| case STUN_ATTRIBUTE_XOR_PEER_ADDRESS: ------------------ | | 120| 49.5k|#define STUN_ATTRIBUTE_XOR_PEER_ADDRESS (0x0012) ------------------ | Branch (1753:3): [True: 26.3k, False: 69.3k] ------------------ 1754| 78.6k| case STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS: ------------------ | | 122| 78.6k|#define STUN_ATTRIBUTE_XOR_RELAYED_ADDRESS (0x0016) ------------------ | Branch (1754:3): [True: 29.1k, False: 66.6k] ------------------ 1755| 78.6k| xor_ed = 1; 1756| 78.6k| break; 1757| 17.0k| default:; ------------------ | Branch (1757:3): [True: 17.0k, False: 78.6k] ------------------ 1758| 95.7k| }; 1759| | 1760| 95.7k| const uint8_t *cfield = stun_attr_get_value(attr); 1761| 95.7k| if (!cfield) { ------------------ | Branch (1761:7): [True: 5.80k, False: 89.9k] ------------------ 1762| 5.80k| return false; 1763| 5.80k| } 1764| | 1765| 89.9k| if (stun_addr_decode(&public_addr, cfield, stun_attr_get_len(attr), xor_ed, STUN_MAGIC_COOKIE, tid.tsx_id) < 0) { ------------------ | | 60| 89.9k|#define STUN_MAGIC_COOKIE (0x2112A442) ------------------ | Branch (1765:7): [True: 6.02k, False: 83.8k] ------------------ 1766| 6.02k| return false; 1767| 6.02k| } 1768| | 1769| 83.8k| map_addr_from_public_to_private(&public_addr, ca); 1770| | 1771| 83.8k| if (default_addr && addr_any_no_port(ca) && !addr_any_no_port(default_addr)) { ------------------ | Branch (1771:7): [True: 83.6k, False: 299] | Branch (1771:23): [True: 10.8k, False: 72.7k] | Branch (1771:47): [True: 10.8k, False: 0] ------------------ 1772| 10.8k| const uint16_t port = addr_get_port(ca); 1773| 10.8k| addr_cpy(ca, default_addr); 1774| 10.8k| addr_set_port(ca, port); 1775| 10.8k| } 1776| | 1777| | return true; 1778| 89.9k|} stun_attr_get_first_addr_str: 1781| 93.0k| const ioa_addr *default_addr) { 1782| 93.0k| stun_attr_ref attr = stun_attr_get_first_str(buf, len); 1783| | 1784| 303k| while (attr) { ------------------ | Branch (1784:10): [True: 243k, False: 59.4k] ------------------ 1785| 243k| if (stun_attr_is_addr(attr) && (attr_type == stun_attr_get_type(attr))) { ------------------ | Branch (1785:9): [True: 137k, False: 106k] | Branch (1785:36): [True: 45.3k, False: 92.1k] ------------------ 1786| 45.3k| if (stun_attr_get_addr_str(buf, len, attr, ca, default_addr)) { ------------------ | Branch (1786:11): [True: 33.5k, False: 11.8k] ------------------ 1787| 33.5k| return true; 1788| 33.5k| } 1789| 45.3k| } 1790| 210k| attr = stun_attr_get_next_str(buf, len, attr); 1791| 210k| } 1792| | 1793| 59.4k| return false; 1794| 93.0k|} stun_attr_add_channel_number_str: 1796| 11.5k|bool stun_attr_add_channel_number_str(uint8_t *buf, size_t *len, uint16_t chnumber) { 1797| | 1798| 11.5k| uint16_t field[2]; 1799| 11.5k| field[0] = nswap16(chnumber); ------------------ | | 86| 11.5k|#define nswap16(s) ntohs(s) ------------------ 1800| 11.5k| field[1] = 0; 1801| | 1802| 11.5k| return stun_attr_add_str(buf, len, STUN_ATTRIBUTE_CHANNEL_NUMBER, (uint8_t *)(field), sizeof(field)); ------------------ | | 117| 11.5k|#define STUN_ATTRIBUTE_CHANNEL_NUMBER (0x000C) ------------------ 1803| 11.5k|} stun_attr_get_first_channel_number_str: 1831| 75.8k|uint16_t stun_attr_get_first_channel_number_str(const uint8_t *buf, size_t len) { 1832| | 1833| 75.8k| stun_attr_ref attr = stun_attr_get_first_str(buf, len); 1834| 178k| while (attr) { ------------------ | Branch (1834:10): [True: 114k, False: 64.2k] ------------------ 1835| 114k| if (stun_attr_get_type(attr) == STUN_ATTRIBUTE_CHANNEL_NUMBER) { ------------------ | | 117| 114k|#define STUN_ATTRIBUTE_CHANNEL_NUMBER (0x000C) ------------------ | Branch (1835:9): [True: 11.5k, False: 102k] ------------------ 1836| 11.5k| const uint16_t ret = stun_attr_get_channel_number(attr); 1837| 11.5k| if (STUN_VALID_CHANNEL(ret)) { ------------------ | | 163| 11.5k|#define STUN_VALID_CHANNEL(chn) ((chn) >= 0x4000 && (chn) <= 0x7FFF) | | ------------------ | | | Branch (163:34): [True: 11.5k, False: 0] | | | Branch (163:53): [True: 11.5k, False: 0] | | ------------------ ------------------ 1838| 11.5k| return ret; 1839| 11.5k| } 1840| 11.5k| } 1841| 102k| attr = stun_attr_get_next_str(buf, len, attr); 1842| 102k| } 1843| | 1844| 64.2k| return 0; 1845| 75.8k|} ns_turn_msg.c:fuzz_prng_next: 112| 239k|static uint64_t fuzz_prng_next(void) { 113| 239k| static uint64_t state = UINT64_C(0x9e3779b97f4a7c15); 114| | 115| 239k| state += UINT64_C(0x9e3779b97f4a7c15); 116| 239k| uint64_t z = state; 117| 239k| z = (z ^ (z >> 30)) * UINT64_C(0xbf58476d1ce4e5b9); 118| | z = (z ^ (z >> 27)) * UINT64_C(0x94d049bb133111eb); 119| 239k| return z ^ (z >> 31); 120| 239k|} ns_turn_msg.c:stun_init_error_response_common_str: 888| 28.0k| stun_tid *id, bool include_reason_string, bool pad_reason_phrase) { 889| | 890| 28.0k| if (include_reason_string && (!reason || !strcmp((const char *)reason, "Unknown error"))) { ------------------ | Branch (890:7): [True: 18.5k, False: 9.42k] | Branch (890:33): [True: 804, False: 17.7k] | Branch (890:44): [True: 0, False: 17.7k] ------------------ 891| 804| reason = get_default_reason(error_code); 892| 804| } 893| | 894| 28.0k| uint8_t avalue[513]; 895| 28.0k| memset(avalue, 0, sizeof(avalue)); 896| 28.0k| avalue[0] = 0; 897| 28.0k| avalue[1] = 0; 898| 28.0k| avalue[2] = (uint8_t)(error_code / 100); 899| 28.0k| avalue[3] = (uint8_t)(error_code % 100); 900| 28.0k| if (include_reason_string) { ------------------ | Branch (900:7): [True: 18.5k, False: 9.42k] ------------------ 901| 18.5k| strncpy((char *)(avalue + 4), (const char *)reason, sizeof(avalue) - 4); 902| 18.5k| } 903| 28.0k| avalue[sizeof(avalue) - 1] = 0; 904| 28.0k| int alen = 4 + (int)strlen((const char *)(avalue + 4)); 905| | 906| | /* RFC 3489 Section 11.2.9 requires a reason phrase length that is a multiple of 4; 907| | * RFC 8489 Section 14 requires the declared length to exclude padding. */ 908| 28.0k| if (pad_reason_phrase) { ------------------ | Branch (908:7): [True: 3.97k, False: 24.0k] ------------------ 909| 3.97k| const int rem = alen % 4; 910| 3.97k| if (rem) { ------------------ | Branch (910:9): [True: 1.86k, False: 2.10k] ------------------ 911| 1.86k| alen += (4 - rem); 912| 1.86k| } 913| 3.97k| } 914| | 915| 28.0k| stun_attr_add_str(buf, len, STUN_ATTRIBUTE_ERROR_CODE, (uint8_t *)avalue, alen); ------------------ | | 103| 28.0k|#define STUN_ATTRIBUTE_ERROR_CODE (0x0009) ------------------ 916| 28.0k| if (id) { ------------------ | Branch (916:7): [True: 28.0k, False: 0] ------------------ 917| 28.0k| stun_tid_message_cpy(buf, id); 918| 28.0k| } 919| 28.0k|} ns_turn_msg.c:has_prefix: 1053| 7.57k|static inline bool has_prefix(const char *buf, size_t blen, const char *prefix, bool ignore_case) { 1054| 7.57k| if (!buf || !prefix) { ------------------ | Branch (1054:7): [True: 0, False: 7.57k] | Branch (1054:15): [True: 0, False: 7.57k] ------------------ 1055| 0| return false; 1056| 0| } 1057| | 1058| 7.57k| const size_t prefix_len = strlen(prefix); 1059| 7.57k| return (prefix_len <= blen) && sheadof(prefix, buf, ignore_case); ------------------ | Branch (1059:10): [True: 7.57k, False: 0] | Branch (1059:34): [True: 756, False: 6.81k] ------------------ 1060| 7.57k|} ns_turn_msg.c:sheadof: 1018| 562k|static inline bool sheadof(const char *head, const char *full, bool ignore_case) { 1019| 600k| while (*head) { ------------------ | Branch (1019:10): [True: 598k, False: 2.50k] ------------------ 1020| 598k| if (*head != *full) { ------------------ | Branch (1020:9): [True: 562k, False: 35.4k] ------------------ 1021| 562k| if (ignore_case && (tolower((unsigned char)*head) == tolower((unsigned char)*full))) { ------------------ | Branch (1021:11): [True: 208k, False: 354k] | Branch (1021:26): [True: 3.37k, False: 204k] | Branch (1021:27): [True: 0, False: 0] | Branch (1021:27): [True: 0, False: 0] | Branch (1021:27): [Folded, False: 208k] | Branch (1021:60): [True: 0, False: 0] | Branch (1021:60): [True: 0, False: 0] | Branch (1021:60): [Folded, False: 208k] ------------------ 1022| | // OK 1023| 559k| } else { 1024| 559k| return false; 1025| 559k| } 1026| 562k| } 1027| 38.8k| ++head; 1028| 38.8k| ++full; 1029| 38.8k| } 1030| 2.50k| return true; 1031| 562k|} ns_turn_msg.c:findstr: 1033| 2.04k|static inline const char *findstr(const char *hay, size_t slen, const char *needle, bool ignore_case) { 1034| 2.04k| const char *ret = NULL; 1035| | 1036| 2.04k| if (hay && slen && needle) { ------------------ | Branch (1036:7): [True: 2.04k, False: 0] | Branch (1036:14): [True: 2.04k, False: 0] | Branch (1036:22): [True: 2.04k, False: 0] ------------------ 1037| 2.04k| const size_t nlen = strlen(needle); 1038| 2.04k| if (nlen <= slen) { ------------------ | Branch (1038:9): [True: 2.00k, False: 44] ------------------ 1039| 2.00k| const size_t smax = slen - nlen + 1; 1040| 2.00k| const char *sp = hay; 1041| 554k| for (size_t i = 0; i < smax; ++i) { ------------------ | Branch (1041:26): [True: 554k, False: 248] ------------------ 1042| 554k| if (sheadof(needle, sp + i, ignore_case)) { ------------------ | Branch (1042:13): [True: 1.75k, False: 552k] ------------------ 1043| 1.75k| ret = sp + i; 1044| 1.75k| break; 1045| 1.75k| } 1046| 554k| } 1047| 2.00k| } 1048| 2.04k| } 1049| | 1050| 2.04k| return ret; 1051| 2.04k|} ns_turn_msg.c:stun_tid_from_string: 1430| 149k|static void stun_tid_from_string(const uint8_t *s, stun_tid *id) { 1431| 149k| if (s && id) { ------------------ | Branch (1431:7): [True: 149k, False: 0] | Branch (1431:12): [True: 149k, False: 0] ------------------ 1432| 149k| memcpy(id->tsx_id, s, STUN_TID_SIZE); ------------------ | | 53| 149k|#define STUN_TID_SIZE (12) ------------------ 1433| 149k| } 1434| 149k|} ns_turn_msg.c:stun_tid_string_cpy: 1424| 133k|static void stun_tid_string_cpy(uint8_t *s, const stun_tid *id) { 1425| 133k| if (s && id) { ------------------ | Branch (1425:7): [True: 133k, False: 0] | Branch (1425:12): [True: 133k, False: 0] ------------------ 1426| 133k| memcpy(s, id->tsx_id, STUN_TID_SIZE); ------------------ | | 53| 133k|#define STUN_TID_SIZE (12) ------------------ 1427| 133k| } 1428| 133k|} ns_turn_msg.c:turn_random_tid_size: 154| 77.4k|static void turn_random_tid_size(void *id) { 155| 77.4k| uint8_t *ar = (uint8_t *)id; 156| 77.4k|#if defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION) 157| 77.4k| if (ar) { ------------------ | Branch (157:7): [True: 77.4k, False: 0] ------------------ 158| 309k| for (size_t i = 0; i < 3; ++i) { ------------------ | Branch (158:24): [True: 232k, False: 77.4k] ------------------ 159| 232k| const uint32_t r = (uint32_t)turn_random_number(); 160| 232k| memcpy(ar + i * sizeof(r), &r, sizeof(r)); 161| 232k| } 162| 77.4k| } 163| |#else 164| | if (!RAND_bytes((unsigned char *)ar, 12)) { 165| | for (size_t i = 0; i < 3; ++i) { 166| | const uint32_t r = (uint32_t)turn_random_number(); 167| | memcpy(ar + i * sizeof(r), &r, sizeof(r)); 168| | } 169| | } 170| |#endif 171| 77.4k|} ns_turn_msg.c:stun_attr_check_valid: 1616| 556k|static stun_attr_ref stun_attr_check_valid(stun_attr_ref attr, size_t remaining) { 1617| 556k| if (remaining >= 4) { ------------------ | Branch (1617:7): [True: 555k, False: 901] ------------------ 1618| | /* Read the size of the attribute */ 1619| 555k| size_t attrlen = stun_attr_get_len(attr); 1620| 555k| remaining -= 4; 1621| | 1622| | /* Round to boundary */ 1623| 555k| const uint16_t rem4 = ((uint16_t)attrlen) & 0x0003; 1624| 555k| if (rem4) { ------------------ | Branch (1624:9): [True: 109k, False: 445k] ------------------ 1625| 109k| attrlen = attrlen + 4 - (int)rem4; 1626| 109k| } 1627| | 1628| | /* Check that there's enough space remaining */ 1629| 555k| if (attrlen <= remaining) { ------------------ | Branch (1629:9): [True: 551k, False: 3.75k] ------------------ 1630| 551k| return attr; 1631| 551k| } 1632| 555k| } 1633| | 1634| 4.65k| return NULL; 1635| 556k|} ns_turn_msg.c:stun_set_command_message_len_str: 537| 129k|static bool stun_set_command_message_len_str(uint8_t *buf, int len) { 538| 129k| if (len < STUN_HEADER_LENGTH) { ------------------ | | 46| 129k|#define STUN_HEADER_LENGTH (20) ------------------ | Branch (538:7): [True: 0, False: 129k] ------------------ 539| 0| return false; 540| 0| } 541| 129k| turn_write_u16(buf + 2, (uint16_t)(len - STUN_HEADER_LENGTH)); ------------------ | | 46| 129k|#define STUN_HEADER_LENGTH (20) ------------------ 542| | return true; 543| 129k|} stun_addr_encode: 42| 50.3k|int stun_addr_encode(const ioa_addr *ca, uint8_t *cfield, int *clen, int xor_ed, uint32_t mc, const uint8_t *tsx_id) { 43| | 44| 50.3k| if (!cfield || !clen || !ca || !tsx_id) { ------------------ | Branch (44:7): [True: 0, False: 50.3k] | Branch (44:18): [True: 0, False: 50.3k] | Branch (44:27): [True: 0, False: 50.3k] | Branch (44:34): [True: 0, False: 50.3k] ------------------ 45| 0| return -1; 46| 0| } 47| | 48| 50.3k| if (ca->ss.sa_family == AF_INET || ca->ss.sa_family == 0) { ------------------ | Branch (48:7): [True: 26.4k, False: 23.8k] | Branch (48:38): [True: 5.36k, False: 18.5k] ------------------ 49| | 50| | /* IPv4 address */ 51| | 52| 31.8k| *clen = 8; 53| | 54| 31.8k| cfield[0] = 0; 55| 31.8k| cfield[1] = 1; // IPv4 family 56| | 57| 31.8k| if (xor_ed) { ------------------ | Branch (57:9): [True: 26.6k, False: 5.14k] ------------------ 58| | 59| | /* Port */ 60| 26.6k| const uint16_t port = (ca->s4.sin_port) ^ nswap16(mc >> 16); ------------------ | | 86| 26.6k|#define nswap16(s) ntohs(s) ------------------ 61| 26.6k| memcpy(cfield + 2, &port, sizeof(port)); 62| | 63| | /* Address */ 64| 26.6k| const uint32_t addr = (ca->s4.sin_addr.s_addr) ^ nswap32(mc); ------------------ | | 87| 26.6k|#define nswap32(ul) ntohl(ul) ------------------ 65| 26.6k| memcpy(cfield + 4, &addr, sizeof(addr)); 66| | 67| 26.6k| } else { 68| | 69| | /* Port */ 70| 5.14k| const uint16_t port = ca->s4.sin_port; 71| 5.14k| memcpy(cfield + 2, &port, sizeof(port)); 72| | 73| | /* Address */ 74| 5.14k| const uint32_t addr = ca->s4.sin_addr.s_addr; 75| 5.14k| memcpy(cfield + 4, &addr, sizeof(addr)); 76| 5.14k| } 77| | 78| 31.8k| } else if (ca->ss.sa_family == AF_INET6) { ------------------ | Branch (78:14): [True: 18.5k, False: 0] ------------------ 79| | 80| | /* IPv6 address */ 81| | 82| 18.5k| *clen = 20; 83| | 84| 18.5k| cfield[0] = 0; 85| 18.5k| cfield[1] = 2; // IPv6 family 86| | 87| 18.5k| if (xor_ed) { ------------------ | Branch (87:9): [True: 14.4k, False: 4.07k] ------------------ 88| | 89| 14.4k| unsigned int i; 90| 14.4k| uint8_t *dst = ((uint8_t *)cfield) + 4; 91| 14.4k| const uint8_t *src = (const uint8_t *)&(ca->s6.sin6_addr); 92| 14.4k| uint32_t magic = nswap32(mc); ------------------ | | 87| 14.4k|#define nswap32(ul) ntohl(ul) ------------------ 93| | 94| | /* Port */ 95| 14.4k| const uint16_t port = ca->s6.sin6_port ^ nswap16(mc >> 16); ------------------ | | 86| 14.4k|#define nswap16(s) ntohs(s) ------------------ 96| 14.4k| memcpy(cfield + 2, &port, sizeof(port)); 97| | 98| | /* Address */ 99| | 100| 72.2k| for (i = 0; i < 4; ++i) { ------------------ | Branch (100:19): [True: 57.8k, False: 14.4k] ------------------ 101| 57.8k| dst[i] = (uint8_t)(src[i] ^ ((const uint8_t *)&magic)[i]); 102| 57.8k| } 103| 187k| for (i = 0; i < 12; ++i) { ------------------ | Branch (103:19): [True: 173k, False: 14.4k] ------------------ 104| 173k| dst[i + 4] = (uint8_t)(src[i + 4] ^ tsx_id[i]); 105| 173k| } 106| | 107| 14.4k| } else { 108| | 109| | /* Port */ 110| 4.07k| const uint16_t port = ca->s6.sin6_port; 111| 4.07k| memcpy(cfield + 2, &port, sizeof(port)); 112| | 113| | /* Address */ 114| 4.07k| memcpy(((uint8_t *)cfield) + 4, &ca->s6.sin6_addr, 16); 115| 4.07k| } 116| | 117| 18.5k| } else { 118| 0| return -1; 119| 0| } 120| | 121| 50.3k| return 0; 122| 50.3k|} stun_addr_decode: 124| 93.5k|int stun_addr_decode(ioa_addr *ca, const uint8_t *cfield, int len, int xor_ed, uint32_t mc, const uint8_t *tsx_id) { 125| | 126| 93.5k| if (!cfield || !len || !ca || !tsx_id || (len < 8)) { ------------------ | Branch (126:7): [True: 0, False: 93.5k] | Branch (126:18): [True: 0, False: 93.5k] | Branch (126:26): [True: 0, False: 93.5k] | Branch (126:33): [True: 0, False: 93.5k] | Branch (126:44): [True: 4.88k, False: 88.6k] ------------------ 127| 4.88k| return -1; 128| 4.88k| } 129| | 130| 88.6k| if (cfield[0] != 0) { ------------------ | Branch (130:7): [True: 2.00k, False: 86.6k] ------------------ 131| 2.00k| return -1; 132| 2.00k| } 133| | 134| 86.6k| int sa_family; 135| | 136| 86.6k| if (cfield[1] == 1) { ------------------ | Branch (136:7): [True: 55.4k, False: 31.1k] ------------------ 137| 55.4k| sa_family = AF_INET; 138| 55.4k| } else if (cfield[1] == 2) { ------------------ | Branch (138:14): [True: 30.0k, False: 1.12k] ------------------ 139| 30.0k| sa_family = AF_INET6; 140| 30.0k| } else { 141| 1.12k| return -1; 142| 1.12k| } 143| | 144| 85.5k| ca->ss.sa_family = sa_family; 145| | 146| 85.5k| if (sa_family == AF_INET) { ------------------ | Branch (146:7): [True: 55.4k, False: 30.0k] ------------------ 147| | 148| 55.4k| if (len != 8) { ------------------ | Branch (148:9): [True: 1.08k, False: 54.3k] ------------------ 149| 1.08k| return -1; 150| 1.08k| } 151| | 152| | /* IPv4 address */ 153| | 154| | /* Port */ 155| 54.3k| memcpy(&ca->s4.sin_port, cfield + 2, sizeof(ca->s4.sin_port)); 156| | 157| | /* Address */ 158| 54.3k| memcpy(&ca->s4.sin_addr.s_addr, cfield + 4, sizeof(ca->s4.sin_addr.s_addr)); 159| | 160| 54.3k| if (xor_ed) { ------------------ | Branch (160:9): [True: 46.7k, False: 7.66k] ------------------ 161| 46.7k| ca->s4.sin_port ^= nswap16(mc >> 16); ------------------ | | 86| 46.7k|#define nswap16(s) ntohs(s) ------------------ 162| 46.7k| ca->s4.sin_addr.s_addr ^= nswap32(mc); ------------------ | | 87| 46.7k|#define nswap32(ul) ntohl(ul) ------------------ 163| 46.7k| } 164| | 165| 54.3k| } else if (sa_family == AF_INET6) { ------------------ | Branch (165:14): [True: 30.0k, False: 0] ------------------ 166| | 167| | /* IPv6 address */ 168| | 169| 30.0k| if (len != 20) { ------------------ | Branch (169:9): [True: 538, False: 29.5k] ------------------ 170| 538| return -1; 171| 538| } 172| | 173| | /* Port */ 174| 29.5k| memcpy(&ca->s6.sin6_port, cfield + 2, sizeof(ca->s6.sin6_port)); 175| | 176| | /* Address */ 177| 29.5k| memcpy(&ca->s6.sin6_addr, ((const uint8_t *)cfield) + 4, 16); 178| | 179| 29.5k| if (xor_ed) { ------------------ | Branch (179:9): [True: 23.6k, False: 5.93k] ------------------ 180| | 181| 23.6k| unsigned int i; 182| 23.6k| uint8_t *dst; 183| 23.6k| const uint8_t *src; 184| 23.6k| uint32_t magic = nswap32(mc); ------------------ | | 87| 23.6k|#define nswap32(ul) ntohl(ul) ------------------ 185| | 186| | /* Port */ 187| 23.6k| ca->s6.sin6_port ^= nswap16(mc >> 16); ------------------ | | 86| 23.6k|#define nswap16(s) ntohs(s) ------------------ 188| | 189| | /* Address */ 190| 23.6k| src = ((const uint8_t *)cfield) + 4; 191| 23.6k| dst = (uint8_t *)&ca->s6.sin6_addr; 192| 118k| for (i = 0; i < 4; ++i) { ------------------ | Branch (192:19): [True: 94.4k, False: 23.6k] ------------------ 193| 94.4k| dst[i] = (uint8_t)(src[i] ^ ((const uint8_t *)&magic)[i]); 194| 94.4k| } 195| 306k| for (i = 0; i < 12; ++i) { ------------------ | Branch (195:19): [True: 283k, False: 23.6k] ------------------ 196| 283k| dst[i + 4] = (uint8_t)(src[i + 4] ^ tsx_id[i]); 197| 283k| } 198| 23.6k| } 199| | 200| 29.5k| } else { 201| 0| return -1; 202| 0| } 203| | 204| 83.9k| return 0; 205| 85.5k|} ns_turn_msg.c:turn_read_u16: 127| 4.56M|static inline uint16_t turn_read_u16(const void *field) { 128| 4.56M| uint16_t v; 129| 4.56M| memcpy(&v, field, sizeof(v)); 130| | return nswap16(v); ------------------ | | 86| 4.56M|#define nswap16(s) ntohs(s) ------------------ 131| 4.56M|} ns_turn_msg.c:turn_read_u32: 133| 153k|static inline uint32_t turn_read_u32(const void *field) { 134| 153k| uint32_t v; 135| 153k| memcpy(&v, field, sizeof(v)); 136| | return nswap32(v); ------------------ | | 87| 153k|#define nswap32(ul) ntohl(ul) ------------------ 137| 153k|} ns_turn_msg.c:turn_write_u16: 145| 542k|static inline void turn_write_u16(void *field, uint16_t v) { 146| | const uint16_t raw = nswap16(v); ------------------ | | 86| 542k|#define nswap16(s) ntohs(s) ------------------ 147| 542k| memcpy(field, &raw, sizeof(raw)); 148| 542k|} ns_turn_msg.c:turn_write_u32: 150| 75.8k|static inline void turn_write_u32(void *field, uint32_t v) { 151| | const uint32_t raw = nswap32(v); ------------------ | | 87| 75.8k|#define nswap32(ul) ntohl(ul) ------------------ 152| 75.8k| memcpy(field, &raw, sizeof(raw)); 153| 75.8k|} ns_turn_msg.c:_ioa_ntoh64: 90| 6.49k|static inline uint64_t _ioa_ntoh64(uint64_t v) { 91| 6.49k|#if BYTE_ORDER == LITTLE_ENDIAN 92| 6.49k| uint8_t *src = (uint8_t *)&v; 93| 6.49k| uint8_t *dst = src + 7; 94| 32.4k| while (src < dst) { ------------------ | Branch (94:10): [True: 25.9k, False: 6.49k] ------------------ 95| 25.9k| uint8_t vdst = *dst; 96| 25.9k| *(dst--) = *src; 97| 25.9k| *(src++) = vdst; 98| 25.9k| } 99| |#elif BYTE_ORDER == BIG_ENDIAN 100| | /* OK */ 101| |#else 102| |#error WRONG BYTE_ORDER SETTING 103| |#endif 104| 6.49k| return v; 105| 6.49k|}