usbi_log: 3048| 22|{ 3049| 22| va_list args; 3050| | 3051| 22| va_start(args, format); 3052| 22| log_v(ctx, level, function, format, args); 3053| | va_end(args); 3054| 22|} core.c:get_env_debug_level: 2570| 22|{ 2571| 22| enum libusb_log_level level = LIBUSB_LOG_LEVEL_NONE; 2572| 22| const char *dbg = getenv("LIBUSB_DEBUG"); 2573| 22| if (dbg) { ------------------ | Branch (2573:6): [True: 0, False: 22] ------------------ 2574| 0| long dbg_level = strtol(dbg, NULL, 10); 2575| 0| dbg_level = CLAMP(dbg_level, LIBUSB_LOG_LEVEL_NONE, LIBUSB_LOG_LEVEL_DEBUG); ------------------ | | 72| 0| ((val) < (min) ? (min) : ((val) > (max) ? (max) : (val))) | | ------------------ | | | Branch (72:3): [True: 0, False: 0] | | | Branch (72:28): [True: 0, False: 0] | | ------------------ ------------------ 2576| 0| level = (enum libusb_log_level)dbg_level; 2577| 0| } 2578| 22| return level; 2579| 22|} core.c:log_v: 2940| 22|{ 2941| 22| const char *prefix = NULL; 2942| 22| char buf[USBI_MAX_LOG_LEN]; 2943| 22| int global_debug, header_len, text_len; 2944| 22| static int has_debug_header_been_displayed = 0; 2945| | 2946| |#ifdef ENABLE_DEBUG_LOGGING 2947| | global_debug = 1; 2948| | UNUSED(ctx); 2949| |#else 2950| 22| enum libusb_log_level ctx_level; 2951| 22| long default_level_value; 2952| | 2953| 22| if (ctx) { ------------------ | Branch (2953:6): [True: 0, False: 22] ------------------ 2954| 0| ctx_level = ctx->debug; 2955| 22| } else { 2956| 22| default_level_value = usbi_atomic_load(&default_debug_level); ------------------ | | 128| 22|#define usbi_atomic_load(a) atomic_load((a)) ------------------ 2957| 22| ctx_level = default_level_value < 0 ? get_env_debug_level() : (enum libusb_log_level)default_level_value; ------------------ | Branch (2957:15): [True: 22, False: 0] ------------------ 2958| 22| } 2959| | 2960| 22| if (ctx_level < level) ------------------ | Branch (2960:6): [True: 22, False: 0] ------------------ 2961| 22| return; 2962| | 2963| 0| global_debug = (ctx_level == LIBUSB_LOG_LEVEL_DEBUG); 2964| 0|#endif 2965| | 2966| 0| switch (level) { 2967| 0| case LIBUSB_LOG_LEVEL_NONE: /* Impossible, but keeps compiler happy */ ------------------ | Branch (2967:2): [True: 0, False: 0] ------------------ 2968| 0| assert(0); ------------------ | Branch (2968:3): [Folded, False: 0] | Branch (2968:3): [Folded, False: 0] ------------------ 2969| 0| return; 2970| 0| case LIBUSB_LOG_LEVEL_ERROR: ------------------ | Branch (2970:2): [True: 0, False: 0] ------------------ 2971| 0| prefix = "error"; 2972| 0| break; 2973| 0| case LIBUSB_LOG_LEVEL_WARNING: ------------------ | Branch (2973:2): [True: 0, False: 0] ------------------ 2974| 0| prefix = "warning"; 2975| 0| break; 2976| 0| case LIBUSB_LOG_LEVEL_INFO: ------------------ | Branch (2976:2): [True: 0, False: 0] ------------------ 2977| 0| prefix = "info"; 2978| 0| break; 2979| 0| case LIBUSB_LOG_LEVEL_DEBUG: ------------------ | Branch (2979:2): [True: 0, False: 0] ------------------ 2980| 0| prefix = "debug"; 2981| 0| break; 2982| 0| default: ------------------ | Branch (2982:2): [True: 0, False: 0] ------------------ 2983| 0| prefix = "unknown"; 2984| 0| break; 2985| 0| } 2986| | 2987| 0| if (global_debug) { ------------------ | Branch (2987:6): [True: 0, False: 0] ------------------ 2988| 0| struct timespec timestamp; 2989| | 2990| 0| if (!has_debug_header_been_displayed) { ------------------ | Branch (2990:7): [True: 0, False: 0] ------------------ 2991| 0| has_debug_header_been_displayed = 1; 2992| 0| log_str(LIBUSB_LOG_LEVEL_DEBUG, "[timestamp] [threadID] facility level [function call] " USBI_LOG_LINE_END); ------------------ | | 169| 0|#define USBI_LOG_LINE_END "\n" ------------------ 2993| 0| log_str(LIBUSB_LOG_LEVEL_DEBUG, "--------------------------------------------------------------------------------" USBI_LOG_LINE_END); ------------------ | | 169| 0|#define USBI_LOG_LINE_END "\n" ------------------ 2994| 0| } 2995| | 2996| 0| usbi_get_monotonic_time(×tamp); 2997| 0| TIMESPEC_SUB(×tamp, ×tamp_origin, ×tamp); ------------------ | | 299| 0| do { \ | | 300| 0| (result)->tv_sec = (a)->tv_sec - (b)->tv_sec; \ | | 301| 0| (result)->tv_nsec = (a)->tv_nsec - (b)->tv_nsec; \ | | 302| 0| if ((result)->tv_nsec < 0L) { \ | | ------------------ | | | Branch (302:7): [True: 0, False: 0] | | ------------------ | | 303| 0| --(result)->tv_sec; \ | | 304| 0| (result)->tv_nsec += NSEC_PER_SEC; \ | | ------------------ | | | | 285| 0|#define NSEC_PER_SEC 1000000000L | | ------------------ | | 305| 0| } \ | | 306| 0| } while (0) | | ------------------ | | | Branch (306:11): [Folded, False: 0] | | ------------------ ------------------ 2998| | 2999| 0| header_len = snprintf(buf, sizeof(buf), 3000| 0| "[%2ld.%06ld] [%08lx] libusb: %s [%s] ", 3001| 0| (long)timestamp.tv_sec, (long)(timestamp.tv_nsec / 1000L), usbi_get_tid(), prefix, function); 3002| 0| } else { 3003| 0| header_len = snprintf(buf, sizeof(buf), 3004| 0| "libusb: %s [%s] ", prefix, function); 3005| 0| } 3006| | 3007| 0| if ((header_len < 0) || (header_len >= (int)sizeof(buf))) ------------------ | Branch (3007:6): [True: 0, False: 0] | Branch (3007:26): [True: 0, False: 0] ------------------ 3008| 0| { 3009| | /* If somehow an error occurred, skip having a header and carry on. 3010| | * If the buffer was too small and the write was truncated, 3011| | * remove the header so something useful is output. */ 3012| 0| header_len = 0; 3013| 0| } 3014| | 3015| | /* starting right after the end of the header, append the rest, but leave room for the terminator. */ 3016| 0| int space = (int)sizeof(buf) - header_len - (int)strlen(USBI_LOG_LINE_END); ------------------ | | 169| 0|#define USBI_LOG_LINE_END "\n" ------------------ 3017| 0| text_len = vsnprintf(buf + header_len, space, format, args); 3018| | 3019| 0| if (text_len < 0) { ------------------ | Branch (3019:6): [True: 0, False: 0] ------------------ 3020| | /* If somehow an error occurred, give up. */ 3021| 0| return; 3022| 0| } 3023| | 3024| 0| if (text_len >= space) { ------------------ | Branch (3024:6): [True: 0, False: 0] ------------------ 3025| | /* The space was too small and the write was truncated. 3026| | * Add our terminator in the space we left at the end. */ 3027| 0| (void)snprintf(buf + sizeof(buf) - 1 - strlen(USBI_LOG_LINE_END), ------------------ | | 169| 0|#define USBI_LOG_LINE_END "\n" ------------------ 3028| 0| 1 + strlen(USBI_LOG_LINE_END), ------------------ | | 169| 0|#define USBI_LOG_LINE_END "\n" ------------------ 3029| 0| "%s", USBI_LOG_LINE_END); ------------------ | | 169| 0|#define USBI_LOG_LINE_END "\n" ------------------ 3030| 0| } else { 3031| | /* Just append the terminator. */ 3032| 0| (void)snprintf(buf + header_len + text_len, 3033| 0| sizeof(buf) - (size_t)header_len - (size_t)text_len, 3034| 0| "%s", USBI_LOG_LINE_END); ------------------ | | 169| 0|#define USBI_LOG_LINE_END "\n" ------------------ 3035| 0| } 3036| | 3037| 0| log_str(level, buf); 3038| | 3039| | /* Per-context log handler */ 3040| 0|#ifndef ENABLE_DEBUG_LOGGING 3041| 0| if (ctx && ctx->log_handler) ------------------ | Branch (3041:6): [True: 0, False: 0] | Branch (3041:13): [True: 0, False: 0] ------------------ 3042| 0| ctx->log_handler(ctx, level, buf); 3043| 0|#endif 3044| 0|} libusb_get_usb_2_0_extension_descriptor: 958| 50|{ 959| 50| struct libusb_usb_2_0_extension_descriptor *_usb_2_0_extension; 960| | 961| 50| if (dev_cap->bDevCapabilityType != LIBUSB_BT_USB_2_0_EXTENSION) { ------------------ | Branch (961:6): [True: 0, False: 50] ------------------ 962| 0| usbi_err(ctx, "unexpected bDevCapabilityType 0x%x (expected 0x%x)", ------------------ | | 339| 0|#define usbi_err(ctx, ...) _usbi_log(ctx, LIBUSB_LOG_LEVEL_ERROR, __VA_ARGS__) | | ------------------ | | | | 337| 0|#define _usbi_log(ctx, level, ...) usbi_log(ctx, level, __func__, __VA_ARGS__) | | ------------------ ------------------ 963| 0| dev_cap->bDevCapabilityType, 964| 0| LIBUSB_BT_USB_2_0_EXTENSION); 965| 0| return LIBUSB_ERROR_INVALID_PARAM; 966| 50| } else if (dev_cap->bLength < LIBUSB_BT_USB_2_0_EXTENSION_SIZE) { ------------------ | | 366| 50|#define LIBUSB_BT_USB_2_0_EXTENSION_SIZE 7 ------------------ | Branch (966:13): [True: 3, False: 47] ------------------ 967| 3| usbi_err(ctx, "short dev-cap descriptor read %u/%d", ------------------ | | 339| 3|#define usbi_err(ctx, ...) _usbi_log(ctx, LIBUSB_LOG_LEVEL_ERROR, __VA_ARGS__) | | ------------------ | | | | 337| 3|#define _usbi_log(ctx, level, ...) usbi_log(ctx, level, __func__, __VA_ARGS__) | | ------------------ ------------------ 968| 3| dev_cap->bLength, LIBUSB_BT_USB_2_0_EXTENSION_SIZE); 969| 3| return LIBUSB_ERROR_IO; 970| 3| } 971| | 972| 47| _usb_2_0_extension = (struct libusb_usb_2_0_extension_descriptor *)malloc(sizeof(*_usb_2_0_extension)); 973| 47| if (!_usb_2_0_extension) ------------------ | Branch (973:6): [True: 0, False: 47] ------------------ 974| 0| return LIBUSB_ERROR_NO_MEM; 975| | 976| 47| _usb_2_0_extension->bLength = dev_cap->bLength; 977| 47| _usb_2_0_extension->bDescriptorType = dev_cap->bDescriptorType; 978| 47| _usb_2_0_extension->bDevCapabilityType = dev_cap->bDevCapabilityType; 979| 47| _usb_2_0_extension->bmAttributes = ReadLittleEndian32(dev_cap->dev_capability_data); 980| | 981| 47| *usb_2_0_extension = _usb_2_0_extension; 982| 47| return LIBUSB_SUCCESS; 983| 47|} libusb_free_usb_2_0_extension_descriptor: 995| 50|{ 996| 50| free(usb_2_0_extension); 997| 50|} libusb_get_ss_usb_device_capability_descriptor: 1016| 50|{ 1017| 50| struct libusb_ss_usb_device_capability_descriptor *_ss_usb_device_cap; 1018| | 1019| 50| if (dev_cap->bDevCapabilityType != LIBUSB_BT_SS_USB_DEVICE_CAPABILITY) { ------------------ | Branch (1019:6): [True: 0, False: 50] ------------------ 1020| 0| usbi_err(ctx, "unexpected bDevCapabilityType 0x%x (expected 0x%x)", ------------------ | | 339| 0|#define usbi_err(ctx, ...) _usbi_log(ctx, LIBUSB_LOG_LEVEL_ERROR, __VA_ARGS__) | | ------------------ | | | | 337| 0|#define _usbi_log(ctx, level, ...) usbi_log(ctx, level, __func__, __VA_ARGS__) | | ------------------ ------------------ 1021| 0| dev_cap->bDevCapabilityType, 1022| 0| LIBUSB_BT_SS_USB_DEVICE_CAPABILITY); 1023| 0| return LIBUSB_ERROR_INVALID_PARAM; 1024| 50| } else if (dev_cap->bLength < LIBUSB_BT_SS_USB_DEVICE_CAPABILITY_SIZE) { ------------------ | | 367| 50|#define LIBUSB_BT_SS_USB_DEVICE_CAPABILITY_SIZE 10 ------------------ | Branch (1024:13): [True: 6, False: 44] ------------------ 1025| 6| usbi_err(ctx, "short dev-cap descriptor read %u/%d", ------------------ | | 339| 6|#define usbi_err(ctx, ...) _usbi_log(ctx, LIBUSB_LOG_LEVEL_ERROR, __VA_ARGS__) | | ------------------ | | | | 337| 6|#define _usbi_log(ctx, level, ...) usbi_log(ctx, level, __func__, __VA_ARGS__) | | ------------------ ------------------ 1026| 6| dev_cap->bLength, LIBUSB_BT_SS_USB_DEVICE_CAPABILITY_SIZE); 1027| 6| return LIBUSB_ERROR_IO; 1028| 6| } 1029| | 1030| 44| _ss_usb_device_cap = (struct libusb_ss_usb_device_capability_descriptor *)malloc(sizeof(*_ss_usb_device_cap)); 1031| 44| if (!_ss_usb_device_cap) ------------------ | Branch (1031:6): [True: 0, False: 44] ------------------ 1032| 0| return LIBUSB_ERROR_NO_MEM; 1033| | 1034| 44| _ss_usb_device_cap->bLength = dev_cap->bLength; 1035| 44| _ss_usb_device_cap->bDescriptorType = dev_cap->bDescriptorType; 1036| 44| _ss_usb_device_cap->bDevCapabilityType = dev_cap->bDevCapabilityType; 1037| 44| _ss_usb_device_cap->bmAttributes = dev_cap->dev_capability_data[0]; 1038| 44| _ss_usb_device_cap->wSpeedSupported = ReadLittleEndian16(&dev_cap->dev_capability_data[1]); 1039| 44| _ss_usb_device_cap->bFunctionalitySupport = dev_cap->dev_capability_data[3]; 1040| 44| _ss_usb_device_cap->bU1DevExitLat = dev_cap->dev_capability_data[4]; 1041| 44| _ss_usb_device_cap->bU2DevExitLat = ReadLittleEndian16(&dev_cap->dev_capability_data[5]); 1042| | 1043| 44| *ss_usb_device_cap = _ss_usb_device_cap; 1044| 44| return LIBUSB_SUCCESS; 1045| 44|} libusb_free_ss_usb_device_capability_descriptor: 1190| 50|{ 1191| 50| free(ss_usb_device_cap); 1192| 50|} libusb_get_container_id_descriptor: 1210| 50|{ 1211| 50| struct libusb_container_id_descriptor *_container_id; 1212| | 1213| 50| if (dev_cap->bDevCapabilityType != LIBUSB_BT_CONTAINER_ID) { ------------------ | Branch (1213:6): [True: 0, False: 50] ------------------ 1214| 0| usbi_err(ctx, "unexpected bDevCapabilityType 0x%x (expected 0x%x)", ------------------ | | 339| 0|#define usbi_err(ctx, ...) _usbi_log(ctx, LIBUSB_LOG_LEVEL_ERROR, __VA_ARGS__) | | ------------------ | | | | 337| 0|#define _usbi_log(ctx, level, ...) usbi_log(ctx, level, __func__, __VA_ARGS__) | | ------------------ ------------------ 1215| 0| dev_cap->bDevCapabilityType, 1216| 0| LIBUSB_BT_CONTAINER_ID); 1217| 0| return LIBUSB_ERROR_INVALID_PARAM; 1218| 50| } else if (dev_cap->bLength < LIBUSB_BT_CONTAINER_ID_SIZE) { ------------------ | | 369| 50|#define LIBUSB_BT_CONTAINER_ID_SIZE 20 ------------------ | Branch (1218:13): [True: 13, False: 37] ------------------ 1219| 13| usbi_err(ctx, "short dev-cap descriptor read %u/%d", ------------------ | | 339| 13|#define usbi_err(ctx, ...) _usbi_log(ctx, LIBUSB_LOG_LEVEL_ERROR, __VA_ARGS__) | | ------------------ | | | | 337| 13|#define _usbi_log(ctx, level, ...) usbi_log(ctx, level, __func__, __VA_ARGS__) | | ------------------ ------------------ 1220| 13| dev_cap->bLength, LIBUSB_BT_CONTAINER_ID_SIZE); 1221| 13| return LIBUSB_ERROR_IO; 1222| 13| } 1223| | 1224| 37| _container_id = (struct libusb_container_id_descriptor *)malloc(sizeof(*_container_id)); 1225| 37| if (!_container_id) ------------------ | Branch (1225:6): [True: 0, False: 37] ------------------ 1226| 0| return LIBUSB_ERROR_NO_MEM; 1227| | 1228| 37| _container_id->bLength = dev_cap->bLength; 1229| 37| _container_id->bDescriptorType = dev_cap->bDescriptorType; 1230| 37| _container_id->bDevCapabilityType = dev_cap->bDevCapabilityType; 1231| 37| _container_id->bReserved = dev_cap->dev_capability_data[0]; 1232| 37| memcpy(_container_id->ContainerID, &dev_cap->dev_capability_data[1], 16); 1233| | 1234| 37| *container_id = _container_id; 1235| 37| return LIBUSB_SUCCESS; 1236| 37|} libusb_free_container_id_descriptor: 1248| 50|{ 1249| 50| free(container_id); 1250| 50|} descriptor.c:ReadLittleEndian16: 36| 88|{ 37| 88| return (uint16_t)((uint16_t)p[1] << 8 | 38| 88| (uint16_t)p[0]); 39| 88|} descriptor.c:ReadLittleEndian32: 42| 47|{ 43| 47| return ((uint32_t)p[3] << 24 | 44| 47| (uint32_t)p[2] << 16 | 45| 47| (uint32_t)p[1] << 8 | 46| 47| (uint32_t)p[0]); 47| 47|} LLVMFuzzerTestOneInput: 17| 50|int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { 18| 50| if (!data) return 0; ------------------ | Branch (18:7): [True: 0, False: 50] ------------------ 19| | 20| | /* bLength is 3 (header) + payload; must fit in one byte. */ 21| 50| uint8_t payload_len = (size > 252) ? 252 : (uint8_t)size; /* 255 - 3 = 252 */ ------------------ | Branch (21:25): [True: 12, False: 38] ------------------ 22| 50| size_t total_len = 3u + (size_t)payload_len; 23| | 24| | /* Allocate header + payload for the flexible array member. */ 25| 50| struct libusb_bos_dev_capability_descriptor *devcap = 26| 50| (struct libusb_bos_dev_capability_descriptor*) 27| 50| malloc(sizeof(*devcap) + payload_len); 28| 50| if (!devcap) return 0; ------------------ | Branch (28:7): [True: 0, False: 50] ------------------ 29| | 30| 50| devcap->bLength = (uint8_t)total_len; 31| 50| devcap->bDescriptorType = LIBUSB_DT_DEVICE_CAPABILITY; /* 0x10 */ 32| | /* Copy fuzz bytes into the variable-length payload. */ 33| 50| if (payload_len) memcpy(devcap->dev_capability_data, data, payload_len); ------------------ | Branch (33:7): [True: 50, False: 0] ------------------ 34| | 35| | /* 1) USB 2.0 Extension dev-cap */ 36| 50| devcap->bDevCapabilityType = LIBUSB_BT_USB_2_0_EXTENSION; 37| 50| struct libusb_usb_2_0_extension_descriptor *d20 = NULL; 38| 50| (void)libusb_get_usb_2_0_extension_descriptor(NULL, devcap, &d20); 39| 50| libusb_free_usb_2_0_extension_descriptor(d20); 40| | 41| | /* 2) SuperSpeed USB Device Capability dev-cap */ 42| 50| devcap->bDevCapabilityType = LIBUSB_BT_SS_USB_DEVICE_CAPABILITY; 43| 50| struct libusb_ss_usb_device_capability_descriptor *dss = NULL; 44| 50| (void)libusb_get_ss_usb_device_capability_descriptor(NULL, devcap, &dss); 45| 50| libusb_free_ss_usb_device_capability_descriptor(dss); 46| | 47| | /* 3) Container ID dev-cap */ 48| 50| devcap->bDevCapabilityType = LIBUSB_BT_CONTAINER_ID; 49| 50| struct libusb_container_id_descriptor *dcid = NULL; 50| 50| (void)libusb_get_container_id_descriptor(NULL, devcap, &dcid); 51| 50| libusb_free_container_id_descriptor(dcid); 52| | 53| 50| free(devcap); 54| 50| return 0; 55| 50|}