fuzz.c:recv_validate_datagram: 579| 382|static bool recv_validate_datagram(const recv_ntb_t *ntb, uint32_t len) { 580| 382| const nth16_t *nth16 = &(ntb->nth); 581| | 582| 382| TU_LOG_DRV("recv_validate_datagram(%p, %d)\n", ntb, (int) len); 583| | 584| | // check header 585| 382| if (nth16->wHeaderLength != sizeof(nth16_t)) { ------------------ | Branch (585:7): [True: 22, False: 360] ------------------ 586| 22| TU_LOG_DRV("(EE) ill nth16 length: %d\n", nth16->wHeaderLength); 587| 22| return false; 588| 22| } 589| 360| if (nth16->dwSignature != NTH16_SIGNATURE) { ------------------ | | 83| 360|#define NTH16_SIGNATURE 0x484D434E ------------------ | Branch (589:7): [True: 54, False: 306] ------------------ 590| 54| TU_LOG_DRV("(EE) ill signature: 0x%08x\n", (unsigned) nth16->dwSignature); 591| 54| return false; 592| 54| } 593| 306| if (len < sizeof(nth16_t) + sizeof(ndp16_t) + 2 * sizeof(ndp16_datagram_t)) { ------------------ | Branch (593:7): [True: 8, False: 298] ------------------ 594| 8| TU_LOG_DRV("(EE) ill min len: %lu\n", len); 595| 8| return false; 596| 8| } 597| 298| if (nth16->wBlockLength > len) { ------------------ | Branch (597:7): [True: 15, False: 283] ------------------ 598| 15| TU_LOG_DRV("(EE) ill block length: %d > %lu\n", nth16->wBlockLength, len); 599| 15| return false; 600| 15| } 601| 283| if (nth16->wBlockLength > CFG_TUD_NCM_OUT_NTB_MAX_SIZE) { ------------------ | | 17| 283| #define CFG_TUD_NCM_OUT_NTB_MAX_SIZE 3200 ------------------ | Branch (601:7): [True: 0, False: 283] ------------------ 602| 0| TU_LOG_DRV("(EE) ill block length2: %d > %d\n", nth16->wBlockLength, CFG_TUD_NCM_OUT_NTB_MAX_SIZE); 603| 0| return false; 604| 0| } 605| 283| if (nth16->wNdpIndex < sizeof(nth16_t) || nth16->wNdpIndex > len - (sizeof(ndp16_t) + 2 * sizeof(ndp16_datagram_t))) { ------------------ | Branch (605:7): [True: 14, False: 269] | Branch (605:45): [True: 28, False: 241] ------------------ 606| 42| TU_LOG_DRV("(EE) ill position of first ndp: %d (%lu)\n", nth16->wNdpIndex, len); 607| 42| return false; 608| 42| } 609| | 610| | // check (first) NDP(16) 611| 241| const ndp16_t *ndp16 = (const ndp16_t *) (ntb->data + nth16->wNdpIndex); 612| | 613| 241| if (ndp16->wLength < sizeof(ndp16_t) + 2 * sizeof(ndp16_datagram_t)) { ------------------ | Branch (613:7): [True: 9, False: 232] ------------------ 614| 9| TU_LOG_DRV("(EE) ill ndp16 length: %d\n", ndp16->wLength); 615| 9| return false; 616| 9| } 617| | // the NDP block (wLength bytes from wNdpIndex) must fit within the received NTB, otherwise the 618| | // datagram pointer array walked below (max_ndx is derived from wLength) runs past ntb->data 619| 232| if ((uint32_t) nth16->wNdpIndex + ndp16->wLength > len) { ------------------ | Branch (619:7): [True: 38, False: 194] ------------------ 620| 38| TU_LOG_DRV("(EE) ill ndp16 length: %d (%lu)\n", ndp16->wLength, len); 621| 38| return false; 622| 38| } 623| 194| if (ndp16->dwSignature != NDP16_SIGNATURE_NCM0 && ndp16->dwSignature != NDP16_SIGNATURE_NCM1) { ------------------ | | 84| 388|#define NDP16_SIGNATURE_NCM0 0x304D434E ------------------ if (ndp16->dwSignature != NDP16_SIGNATURE_NCM0 && ndp16->dwSignature != NDP16_SIGNATURE_NCM1) { ------------------ | | 85| 128|#define NDP16_SIGNATURE_NCM1 0x314D434E ------------------ | Branch (623:7): [True: 128, False: 66] | Branch (623:53): [True: 84, False: 44] ------------------ 624| 84| TU_LOG_DRV("(EE) ill signature: 0x%08x\n", (unsigned) ndp16->dwSignature); 625| 84| return false; 626| 84| } 627| 110| if (ndp16->wNextNdpIndex != 0) { ------------------ | Branch (627:7): [True: 16, False: 94] ------------------ 628| 16| TU_LOG_DRV("(EE) cannot handle wNextNdpIndex!=0 (%d)\n", ndp16->wNextNdpIndex); 629| 16| return false; 630| 16| } 631| | 632| 94| const ndp16_datagram_t *ndp16_datagram = (const ndp16_datagram_t *) (ntb->data + nth16->wNdpIndex + sizeof(ndp16_t)); 633| 94| int ndx = 0; 634| 94| uint16_t max_ndx = (uint16_t) ((ndp16->wLength - sizeof(ndp16_t)) / sizeof(ndp16_datagram_t)); 635| | 636| 94| if (max_ndx > 2) { // number of datagrams in NTB > 1 ------------------ | Branch (636:7): [True: 21, False: 73] ------------------ 637| 21| TU_LOG_DRV("<< %d (%d)\n", max_ndx - 1, ntb->nth.wBlockLength); 638| 21| } 639| 94| if (ndp16_datagram[max_ndx - 1].wDatagramIndex != 0 || ndp16_datagram[max_ndx - 1].wDatagramLength != 0) { ------------------ | Branch (639:7): [True: 20, False: 74] | Branch (639:58): [True: 16, False: 58] ------------------ 640| 36| TU_LOG_DRV(" max_ndx != 0\n"); 641| 36| return false; 642| 36| } 643| 318| while (ndp16_datagram[ndx].wDatagramIndex != 0 && ndp16_datagram[ndx].wDatagramLength != 0) { ------------------ | Branch (643:10): [True: 305, False: 13] | Branch (643:53): [True: 303, False: 2] ------------------ 644| 303| TU_LOG_DRV(" << %d %d\n", ndp16_datagram[ndx].wDatagramIndex, ndp16_datagram[ndx].wDatagramLength); 645| 303| if (ndp16_datagram[ndx].wDatagramIndex > len) { ------------------ | Branch (645:9): [True: 26, False: 277] ------------------ 646| 26| TU_LOG_DRV("(EE) ill start of datagram[%d]: %d (%lu)\n", ndx, ndp16_datagram[ndx].wDatagramIndex, len); 647| 26| return false; 648| 26| } 649| 277| if (ndp16_datagram[ndx].wDatagramIndex + ndp16_datagram[ndx].wDatagramLength > len) { ------------------ | Branch (649:9): [True: 17, False: 260] ------------------ 650| 17| TU_LOG_DRV("(EE) ill end of datagram[%d]: %d (%lu)\n", ndx, ndp16_datagram[ndx].wDatagramIndex + ndp16_datagram[ndx].wDatagramLength, len); 651| 17| return false; 652| 17| } 653| 260| ++ndx; 654| 260| } 655| | 656| | #if CFG_TUD_NCM_LOG_LEVEL >= 3 657| | TU_LOG_BUF(3, ntb->data[i], len); 658| | #endif 659| | 660| | // -> ntb contains a valid packet structure 661| | // ok... I did not check for garbage within the datagram indices... 662| 15| return true; 663| 58|} // recv_validate_datagram LLVMFuzzerTestOneInput: 77| 382|int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { 78| | // Give the NTB a heap allocation of the exact receive-buffer size so any read 79| | // past ntb->data is caught by AddressSanitizer. 80| 382| recv_ntb_t *ntb = (recv_ntb_t *) malloc(sizeof(recv_ntb_t)); 81| 382| if (ntb == NULL) { ------------------ | Branch (81:7): [True: 0, False: 382] ------------------ 82| 0| return 0; 83| 0| } 84| 382| size_t n = size < sizeof(ntb->data) ? size : sizeof(ntb->data); ------------------ | Branch (84:14): [True: 372, False: 10] ------------------ 85| 382| memset(ntb->data, 0, sizeof(ntb->data)); 86| 382| memcpy(ntb->data, data, n); 87| 382| recv_validate_datagram(ntb, (uint32_t) n); 88| 382| free(ntb); 89| 382| return 0; 90| 382|}