libusb_alloc_transfer: 1293| 258|{ 1294| 258| assert(iso_packets >= 0); ------------------ | Branch (1294:2): [True: 0, False: 258] | Branch (1294:2): [True: 258, False: 0] ------------------ 1295| 258| if (iso_packets < 0) ------------------ | Branch (1295:6): [True: 0, False: 258] ------------------ 1296| 0| return NULL; 1297| | 1298| 258| size_t priv_size = PTR_ALIGN(usbi_backend.transfer_priv_size); ------------------ | | 91| 258| (((v) + (sizeof(void *) - 1)) & ~(sizeof(void *) - 1)) ------------------ 1299| 258| size_t usbi_transfer_size = PTR_ALIGN(sizeof(struct usbi_transfer)); ------------------ | | 91| 258| (((v) + (sizeof(void *) - 1)) & ~(sizeof(void *) - 1)) ------------------ 1300| 258| size_t libusb_transfer_size = PTR_ALIGN(sizeof(struct libusb_transfer)); ------------------ | | 91| 258| (((v) + (sizeof(void *) - 1)) & ~(sizeof(void *) - 1)) ------------------ 1301| 258| size_t iso_packets_size = sizeof(struct libusb_iso_packet_descriptor) * (size_t)iso_packets; 1302| 258| size_t alloc_size = priv_size + usbi_transfer_size + libusb_transfer_size + iso_packets_size; 1303| 258| unsigned char *ptr = (unsigned char *)calloc(1, alloc_size); 1304| 258| if (!ptr) ------------------ | Branch (1304:6): [True: 0, False: 258] ------------------ 1305| 0| return NULL; 1306| | 1307| 258| struct usbi_transfer *itransfer = (struct usbi_transfer *)(ptr + priv_size); 1308| 258| itransfer->priv = ptr; 1309| 258| usbi_mutex_init(&itransfer->lock); 1310| 258| struct libusb_transfer *transfer = USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer); ------------------ | | 656| 258| ((struct libusb_transfer *) \ | | 657| 258| ((unsigned char *)(itransfer) \ | | 658| 258| + PTR_ALIGN(sizeof(struct usbi_transfer)))) | | ------------------ | | | | 91| 258| (((v) + (sizeof(void *) - 1)) & ~(sizeof(void *) - 1)) | | ------------------ ------------------ 1311| | 1312| 258| return transfer; 1313| 258|} libusb_fuzzer.cc:_ZL25libusb_fill_control_setupPhhhttt: 1951| 258|{ 1952| 258| struct libusb_control_setup *setup = (struct libusb_control_setup *)(void *)buffer; 1953| 258| setup->bmRequestType = bmRequestType; 1954| 258| setup->bRequest = bRequest; 1955| 258| setup->wValue = libusb_cpu_to_le16(wValue); 1956| 258| setup->wIndex = libusb_cpu_to_le16(wIndex); 1957| 258| setup->wLength = libusb_cpu_to_le16(wLength); 1958| 258|} libusb_fuzzer.cc:_ZL18libusb_cpu_to_le16t: 201| 774|{ 202| 774| union { 203| 774| uint8_t b8[2]; 204| 774| uint16_t b16; 205| 774| } _tmp; 206| 774| _tmp.b8[1] = (uint8_t) (x >> 8); 207| 774| _tmp.b8[0] = (uint8_t) (x & 0xff); 208| 774| return _tmp.b16; 209| 774|} libusb_fuzzer.cc:_ZL18usbi_mutex_destroyP15pthread_mutex_t: 61| 258|{ 62| | PTHREAD_CHECK(pthread_mutex_destroy(mutex)); ------------------ | | 29| 258|#define PTHREAD_CHECK(expression) ASSERT_EQ(expression, 0) | | ------------------ | | | | 58| 258|#define ASSERT_EQ(expression, value) assert(expression == value) | | ------------------ ------------------ | Branch (62:2): [True: 258, False: 0] ------------------ 63| 258|} io.c:usbi_mutex_init: 44| 258|{ 45| | PTHREAD_CHECK(pthread_mutex_init(mutex, NULL)); ------------------ | | 29| 258|#define PTHREAD_CHECK(expression) ASSERT_EQ(expression, 0) | | ------------------ | | | | 58| 258|#define ASSERT_EQ(expression, value) assert(expression == value) | | ------------------ ------------------ | Branch (45:2): [True: 0, False: 258] | Branch (45:2): [True: 258, False: 0] ------------------ 46| 258|} LLVMFuzzerTestOneInput: 23| 258|extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { 24| 258| struct libusb_transfer *transfer = NULL; 25| 258| FuzzedDataProvider stream(data, size); 26| 258| uint8_t bmRequestType = stream.ConsumeIntegral(); 27| 258| uint8_t bRequest = stream.ConsumeIntegral(); 28| 258| uint16_t wValue = stream.ConsumeIntegral(); 29| 258| uint16_t wIndex = stream.ConsumeIntegral(); 30| 258| uint16_t wLength = stream.ConsumeIntegral(); 31| 258| std::string input = stream.ConsumeRandomLengthString(); 32| 258| const char *d = input.c_str(); 33| | 34| 258| transfer = libusb_alloc_transfer(0); 35| 258| if (!transfer) { ------------------ | Branch (35:7): [True: 0, False: 258] ------------------ 36| 0| return LIBUSB_ERROR_NO_MEM; 37| 0| } 38| | 39| 258| libusb_fill_control_setup((unsigned char *)d, bmRequestType, bRequest, wValue, wIndex, wLength); 40| | 41| | // Cleanup. 42| | // We cannot call libusb_free_transfer as no callbacks has occurred. Calling 43| | // libusb_free_transfer without this will trigger false positive errors. 44| 258| struct usbi_transfer *itransfer = LIBUSB_TRANSFER_TO_USBI_TRANSFER(transfer); ------------------ | | 661| 258| ((struct usbi_transfer *) \ | | 662| 258| ((unsigned char *)(transfer) \ | | 663| 258| - PTR_ALIGN(sizeof(struct usbi_transfer)))) | | ------------------ | | | | 91| 258| (((v) + (sizeof(void *) - 1)) & ~(sizeof(void *) - 1)) | | ------------------ ------------------ 45| 258| usbi_mutex_destroy(&itransfer->lock); 46| 258| size_t priv_size = PTR_ALIGN(usbi_backend.transfer_priv_size); ------------------ | | 91| 258| (((v) + (sizeof(void *) - 1)) & ~(sizeof(void *) - 1)) ------------------ 47| 258| unsigned char *ptr = (unsigned char *)itransfer - priv_size; 48| 258| free(ptr); 49| | 50| 258| return 0; 51| 258|}