UA_readNumberWithBase: 111| 559|UA_readNumberWithBase(const UA_Byte *buf, size_t buflen, UA_UInt32 *number, UA_Byte base) { 112| 559| UA_assert(buf); ------------------ | | 399| 559|# define UA_assert(ignore) assert(ignore) ------------------ | Branch (112:5): [True: 559, False: 0] ------------------ 113| 559| UA_assert(number); ------------------ | | 399| 559|# define UA_assert(ignore) assert(ignore) ------------------ | Branch (113:5): [True: 559, False: 0] ------------------ 114| 559| u32 n = 0; 115| 559| size_t progress = 0; 116| | /* read numbers until the end or a non-number character appears */ 117| 6.85M| while(progress < buflen) { ------------------ | Branch (117:11): [True: 6.85M, False: 264] ------------------ 118| 6.85M| u8 c = buf[progress]; 119| 6.85M| if(c >= '0' && c <= '9' && c <= '0' + (base-1)) ------------------ | Branch (119:12): [True: 6.85M, False: 200] | Branch (119:24): [True: 6.85M, False: 95] | Branch (119:36): [True: 6.85M, False: 0] ------------------ 120| 6.85M| n = (n * base) + c - '0'; 121| 295| else if(base > 9 && c >= 'a' && c <= 'z' && c <= 'a' + (base-11)) ------------------ | Branch (121:17): [True: 295, False: 0] | Branch (121:29): [True: 63, False: 232] | Branch (121:41): [True: 21, False: 42] | Branch (121:53): [True: 0, False: 21] ------------------ 122| 0| n = (n * base) + c-'a' + 10; 123| 295| else if(base > 9 && c >= 'A' && c <= 'Z' && c <= 'A' + (base-11)) ------------------ | Branch (123:17): [True: 295, False: 0] | Branch (123:29): [True: 75, False: 220] | Branch (123:41): [True: 6, False: 69] | Branch (123:53): [True: 0, False: 6] ------------------ 124| 0| n = (n * base) + c-'A' + 10; 125| 295| else 126| 295| break; 127| 6.85M| ++progress; 128| 6.85M| } 129| 559| *number = n; 130| 559| return progress; 131| 559|} UA_readNumber: 134| 559|UA_readNumber(const UA_Byte *buf, size_t buflen, UA_UInt32 *number) { 135| 559| return UA_readNumberWithBase(buf, buflen, number, 10); 136| 559|} UA_parseEndpointUrl: 148| 505| UA_UInt16 *outPort, UA_String *outPath) { 149| 505| if(!endpointUrl || !endpointUrl->data) ------------------ | Branch (149:8): [True: 0, False: 505] | Branch (149:24): [True: 0, False: 505] ------------------ 150| 0| return UA_STATUSCODE_BADTCPENDPOINTURLINVALID; ------------------ | | 500| 0|#define UA_STATUSCODE_BADTCPENDPOINTURLINVALID ((UA_StatusCode) 0x80830000) ------------------ 151| | 152| | /* Which type of schema is this? */ 153| 505| unsigned schemaType = 0; 154| 505| size_t schemaLen = 0; 155| 3.07k| for(; schemaType < UA_SCHEMAS_SIZE; schemaType++) { ------------------ | | 138| 3.07k|#define UA_SCHEMAS_SIZE 8 ------------------ | Branch (155:11): [True: 2.96k, False: 114] ------------------ 156| 2.96k| schemaLen = strlen(schemas[schemaType]); 157| 2.96k| if(endpointUrl->length >= schemaLen && ------------------ | Branch (157:12): [True: 2.32k, False: 642] ------------------ 158| 2.32k| strncmp((char*)endpointUrl->data, schemas[schemaType], schemaLen) == 0) ------------------ | Branch (158:12): [True: 391, False: 1.93k] ------------------ 159| 391| break; 160| 2.96k| } 161| 505| if(schemaType == UA_SCHEMAS_SIZE) ------------------ | | 138| 505|#define UA_SCHEMAS_SIZE 8 ------------------ | Branch (161:8): [True: 114, False: 391] ------------------ 162| 114| return UA_STATUSCODE_BADTCPENDPOINTURLINVALID; ------------------ | | 500| 114|#define UA_STATUSCODE_BADTCPENDPOINTURLINVALID ((UA_StatusCode) 0x80830000) ------------------ 163| | 164| | /* Forward the current position until the first colon or slash */ 165| 391| size_t start = strlen(schemas[schemaType]); 166| 391| size_t curr = start; 167| 391| UA_Boolean ipv6 = false; 168| 391| if(endpointUrl->length > curr && endpointUrl->data[curr] == '[') { ------------------ | Branch (168:8): [True: 384, False: 7] | Branch (168:38): [True: 123, False: 261] ------------------ 169| | /* IPv6: opc.tcp://[2001:0db8:85a3::8a2e:0370:7334]:1234/path */ 170| 8.99M| for(; curr < endpointUrl->length; ++curr) { ------------------ | Branch (170:15): [True: 8.99M, False: 17] ------------------ 171| 8.99M| if(endpointUrl->data[curr] == ']') ------------------ | Branch (171:16): [True: 106, False: 8.99M] ------------------ 172| 106| break; 173| 8.99M| } 174| 123| if(curr == endpointUrl->length) ------------------ | Branch (174:12): [True: 17, False: 106] ------------------ 175| 17| return UA_STATUSCODE_BADTCPENDPOINTURLINVALID; ------------------ | | 500| 17|#define UA_STATUSCODE_BADTCPENDPOINTURLINVALID ((UA_StatusCode) 0x80830000) ------------------ 176| 106| curr++; 177| 106| ipv6 = true; 178| 268| } else { 179| | /* IPv4 or hostname: opc.tcp://something.something:1234/path */ 180| 1.29M| for(; curr < endpointUrl->length; ++curr) { ------------------ | Branch (180:15): [True: 1.29M, False: 54] ------------------ 181| 1.29M| if(endpointUrl->data[curr] == ':' || endpointUrl->data[curr] == '/') ------------------ | Branch (181:16): [True: 166, False: 1.29M] | Branch (181:50): [True: 48, False: 1.29M] ------------------ 182| 214| break; 183| 1.29M| } 184| 268| } 185| | 186| | /* Set the hostname */ 187| 374| if(ipv6) { ------------------ | Branch (187:8): [True: 106, False: 268] ------------------ 188| | /* Skip the ipv6 '[]' container for getaddrinfo() later */ 189| 106| outHostname->data = &endpointUrl->data[start+1]; 190| 106| outHostname->length = curr - (start+2); 191| 268| } else { 192| 268| outHostname->data = &endpointUrl->data[start]; 193| 268| outHostname->length = curr - start; 194| 268| } 195| | 196| | /* Empty string? */ 197| 374| if(outHostname->length == 0) ------------------ | Branch (197:8): [True: 194, False: 180] ------------------ 198| 194| outHostname->data = NULL; 199| | 200| | /* Already at the end */ 201| 374| if(curr == endpointUrl->length) { ------------------ | Branch (201:8): [True: 95, False: 279] ------------------ 202| 95| if(outHostname->length == 0) ------------------ | Branch (202:12): [True: 8, False: 87] ------------------ 203| 8| return UA_STATUSCODE_BADTCPENDPOINTURLINVALID; ------------------ | | 500| 8|#define UA_STATUSCODE_BADTCPENDPOINTURLINVALID ((UA_StatusCode) 0x80830000) ------------------ 204| 87| return UA_STATUSCODE_GOOD; ------------------ | | 17| 87|#define UA_STATUSCODE_GOOD ((UA_StatusCode) 0x00000000) ------------------ 205| 95| } 206| | 207| | /* Set the port - and for ETH set the VID.PCP postfix in the outpath string. 208| | * We have to parse that externally. */ 209| 279| if(endpointUrl->data[curr] == ':') { ------------------ | Branch (209:8): [True: 199, False: 80] ------------------ 210| 199| if(++curr == endpointUrl->length) ------------------ | Branch (210:12): [True: 1, False: 198] ------------------ 211| 1| return UA_STATUSCODE_BADTCPENDPOINTURLINVALID; ------------------ | | 500| 1|#define UA_STATUSCODE_BADTCPENDPOINTURLINVALID ((UA_StatusCode) 0x80830000) ------------------ 212| | 213| | /* ETH schema */ 214| 198| if(schemaType == UA_ETH_SCHEMA_INDEX) { ------------------ | | 139| 198|#define UA_ETH_SCHEMA_INDEX 2 ------------------ | Branch (214:12): [True: 1, False: 197] ------------------ 215| 1| if(outPath != NULL) { ------------------ | Branch (215:16): [True: 1, False: 0] ------------------ 216| 1| outPath->data = &endpointUrl->data[curr]; 217| 1| outPath->length = endpointUrl->length - curr; 218| 1| } 219| 1| return UA_STATUSCODE_GOOD; ------------------ | | 17| 1|#define UA_STATUSCODE_GOOD ((UA_StatusCode) 0x00000000) ------------------ 220| 1| } 221| | 222| 197| u32 largeNum; 223| 197| size_t progress = UA_readNumber(&endpointUrl->data[curr], 224| 197| endpointUrl->length - curr, &largeNum); 225| 197| if(progress == 0 || largeNum > 65535) ------------------ | Branch (225:12): [True: 53, False: 144] | Branch (225:29): [True: 43, False: 101] ------------------ 226| 96| return UA_STATUSCODE_BADTCPENDPOINTURLINVALID; ------------------ | | 500| 96|#define UA_STATUSCODE_BADTCPENDPOINTURLINVALID ((UA_StatusCode) 0x80830000) ------------------ 227| | /* Test if the end of a valid port was reached */ 228| 101| curr += progress; 229| 101| if(curr == endpointUrl->length || endpointUrl->data[curr] == '/') ------------------ | Branch (229:12): [True: 51, False: 50] | Branch (229:43): [True: 15, False: 35] ------------------ 230| 66| *outPort = (u16)largeNum; 231| 101| if(curr == endpointUrl->length) ------------------ | Branch (231:12): [True: 51, False: 50] ------------------ 232| 51| return UA_STATUSCODE_GOOD; ------------------ | | 17| 51|#define UA_STATUSCODE_GOOD ((UA_StatusCode) 0x00000000) ------------------ 233| 101| } 234| | 235| | /* Set the path */ 236| 130| UA_assert(curr < endpointUrl->length); ------------------ | | 399| 130|# define UA_assert(ignore) assert(ignore) ------------------ | Branch (236:5): [True: 130, False: 0] ------------------ 237| 130| if(endpointUrl->data[curr] != '/') ------------------ | Branch (237:8): [True: 66, False: 64] ------------------ 238| 66| return UA_STATUSCODE_BADTCPENDPOINTURLINVALID; ------------------ | | 500| 66|#define UA_STATUSCODE_BADTCPENDPOINTURLINVALID ((UA_StatusCode) 0x80830000) ------------------ 239| 64| if(++curr == endpointUrl->length) ------------------ | Branch (239:8): [True: 5, False: 59] ------------------ 240| 5| return UA_STATUSCODE_GOOD; ------------------ | | 17| 5|#define UA_STATUSCODE_GOOD ((UA_StatusCode) 0x00000000) ------------------ 241| 59| if(outPath != NULL) { ------------------ | Branch (241:8): [True: 59, False: 0] ------------------ 242| 59| outPath->data = &endpointUrl->data[curr]; 243| 59| outPath->length = endpointUrl->length - curr; 244| | 245| | /* Remove trailing slash from the path */ 246| 59| if(endpointUrl->data[endpointUrl->length - 1] == '/') ------------------ | Branch (246:12): [True: 14, False: 45] ------------------ 247| 14| outPath->length--; 248| | 249| | /* Empty string? */ 250| 59| if(outPath->length == 0) ------------------ | Branch (250:12): [True: 14, False: 45] ------------------ 251| 14| outPath->data = NULL; 252| 59| } 253| | 254| 59| return UA_STATUSCODE_GOOD; ------------------ | | 17| 59|#define UA_STATUSCODE_GOOD ((UA_StatusCode) 0x00000000) ------------------ 255| 64|} UA_parseEndpointUrlEthernet: 259| 370| UA_UInt16 *vid, UA_Byte *pcp) { 260| | /* Url must begin with "opc.eth://" */ 261| 370| if(endpointUrl->length < 11) { ------------------ | Branch (261:8): [True: 8, False: 362] ------------------ 262| 8| return UA_STATUSCODE_BADINTERNALERROR; ------------------ | | 29| 8|#define UA_STATUSCODE_BADINTERNALERROR ((UA_StatusCode) 0x80020000) ------------------ 263| 8| } 264| 362| if(strncmp((char*) endpointUrl->data, "opc.eth://", 10) != 0) { ------------------ | Branch (264:8): [True: 93, False: 269] ------------------ 265| 93| return UA_STATUSCODE_BADINTERNALERROR; ------------------ | | 29| 93|#define UA_STATUSCODE_BADINTERNALERROR ((UA_StatusCode) 0x80020000) ------------------ 266| 93| } 267| | 268| | /* Where does the host address end? */ 269| 269| size_t curr = 10; 270| 1.11M| for(; curr < endpointUrl->length; ++curr) { ------------------ | Branch (270:11): [True: 1.11M, False: 15] ------------------ 271| 1.11M| if(endpointUrl->data[curr] == ':') { ------------------ | Branch (271:12): [True: 254, False: 1.11M] ------------------ 272| 254| break; 273| 254| } 274| 1.11M| } 275| | 276| | /* set host address */ 277| 269| target->data = &endpointUrl->data[10]; 278| 269| target->length = curr - 10; 279| 269| if(curr == endpointUrl->length) { ------------------ | Branch (279:8): [True: 15, False: 254] ------------------ 280| 15| return UA_STATUSCODE_GOOD; ------------------ | | 17| 15|#define UA_STATUSCODE_GOOD ((UA_StatusCode) 0x00000000) ------------------ 281| 15| } 282| | 283| | /* Set VLAN */ 284| 254| u32 value = 0; 285| 254| curr++; /* skip ':' */ 286| 254| size_t progress = UA_readNumber(&endpointUrl->data[curr], 287| 254| endpointUrl->length - curr, &value); 288| 254| if(progress == 0 || value > 4096) { ------------------ | Branch (288:8): [True: 28, False: 226] | Branch (288:25): [True: 53, False: 173] ------------------ 289| 81| return UA_STATUSCODE_BADINTERNALERROR; ------------------ | | 29| 81|#define UA_STATUSCODE_BADINTERNALERROR ((UA_StatusCode) 0x80020000) ------------------ 290| 81| } 291| 173| curr += progress; 292| 173| if(curr == endpointUrl->length || endpointUrl->data[curr] == '.') { ------------------ | Branch (292:8): [True: 34, False: 139] | Branch (292:39): [True: 108, False: 31] ------------------ 293| 142| *vid = (UA_UInt16) value; 294| 142| } 295| 173| if(curr == endpointUrl->length) { ------------------ | Branch (295:8): [True: 34, False: 139] ------------------ 296| 34| return UA_STATUSCODE_GOOD; ------------------ | | 17| 34|#define UA_STATUSCODE_GOOD ((UA_StatusCode) 0x00000000) ------------------ 297| 34| } 298| | 299| | /* Set priority */ 300| 139| if(endpointUrl->data[curr] != '.') { ------------------ | Branch (300:8): [True: 31, False: 108] ------------------ 301| 31| return UA_STATUSCODE_BADINTERNALERROR; ------------------ | | 29| 31|#define UA_STATUSCODE_BADINTERNALERROR ((UA_StatusCode) 0x80020000) ------------------ 302| 31| } 303| 108| curr++; /* skip '.' */ 304| 108| progress = UA_readNumber(&endpointUrl->data[curr], 305| 108| endpointUrl->length - curr, &value); 306| 108| if(progress == 0 || value > 7) { ------------------ | Branch (306:8): [True: 5, False: 103] | Branch (306:25): [True: 59, False: 44] ------------------ 307| 64| return UA_STATUSCODE_BADINTERNALERROR; ------------------ | | 29| 64|#define UA_STATUSCODE_BADINTERNALERROR ((UA_StatusCode) 0x80020000) ------------------ 308| 64| } 309| 44| curr += progress; 310| 44| if(curr != endpointUrl->length) { ------------------ | Branch (310:8): [True: 30, False: 14] ------------------ 311| 30| return UA_STATUSCODE_BADINTERNALERROR; ------------------ | | 29| 30|#define UA_STATUSCODE_BADINTERNALERROR ((UA_StatusCode) 0x80020000) ------------------ 312| 30| } 313| 14| *pcp = (UA_Byte) value; 314| | 315| 14| return UA_STATUSCODE_GOOD; ------------------ | | 17| 14|#define UA_STATUSCODE_GOOD ((UA_StatusCode) 0x00000000) ------------------ 316| 44|} UA_memoryManager_setLimitFromLast4Bytes: 161| 880|int UA_memoryManager_setLimitFromLast4Bytes(const uint8_t *data, size_t size) { 162| 880| UA_mallocSingleton = UA_memoryManager_malloc; 163| 880| UA_freeSingleton = UA_memoryManager_free; 164| 880| UA_callocSingleton = UA_memoryManager_calloc; 165| 880| UA_reallocSingleton = UA_memoryManager_realloc; 166| 880| if(size <4) ------------------ | Branch (166:8): [True: 2, False: 878] ------------------ 167| 2| return 0; 168| | // just cast the last 4 bytes to uint32 169| 878| uint32_t limit; 170| 878| memcpy(&limit, &data[size-4], sizeof(uint32_t)); 171| 878| memoryLimit = limit; 172| 878| return 1; 173| 880|} LLVMFuzzerTestOneInput: 42| 880|extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { 43| | 44| 880| if (!UA_memoryManager_setLimitFromLast4Bytes(data, size)) ------------------ | Branch (44:9): [True: 2, False: 878] ------------------ 45| 2| return 0; 46| 878| size -= 4; 47| | 48| 878| if (size == 0) ------------------ | Branch (48:9): [True: 1, False: 877] ------------------ 49| 1| return 0; 50| | 51| | // use first byte to decide which function should be fuzzed 52| | 53| 877| const uint8_t select = data[0]; 54| | 55| 877| const uint8_t *newData = &data[1]; 56| 877| size_t newSize = size-1; 57| | 58| 877| switch(select) { 59| 505| case 0: ------------------ | Branch (59:9): [True: 505, False: 372] ------------------ 60| 505| return tortureParseEndpointUrl(newData, newSize); 61| 370| case 1: ------------------ | Branch (61:9): [True: 370, False: 507] ------------------ 62| 370| return tortureParseEndpointUrlEthernet(newData, newSize); 63| 2| default: ------------------ | Branch (63:9): [True: 2, False: 875] ------------------ 64| 2| return 0; 65| 877| } 66| | 67| 877|} fuzz_src_ua_util.cc:_ZL23tortureParseEndpointUrlPKhm: 14| 505|static int tortureParseEndpointUrl(const uint8_t *data, size_t size) { 15| 505| const UA_String endpointUrl = { 16| 505| size, (UA_Byte* )(void*)data 17| 505| }; 18| | 19| 505| UA_String hostname; 20| 505| UA_UInt16 port; 21| 505| UA_String path; 22| 505| UA_parseEndpointUrl(&endpointUrl, &hostname, &port, &path); 23| 505| return 0; 24| 505|} fuzz_src_ua_util.cc:_ZL31tortureParseEndpointUrlEthernetPKhm: 26| 370|static int tortureParseEndpointUrlEthernet(const uint8_t *data, size_t size) { 27| 370| const UA_String endpointUrl = { 28| 370| size, (UA_Byte* )(void*)data 29| 370| }; 30| | 31| 370| UA_String target; 32| 370| UA_UInt16 vid; 33| 370| UA_Byte prid; 34| 370| UA_parseEndpointUrlEthernet(&endpointUrl, &target, &vid, &prid); 35| 370| return 0; 36| 370|}