fuzz.c:recv_validate_datagram: 583| 384|static bool recv_validate_datagram(const recv_ntb_t *ntb, uint32_t len) { 584| 384| const nth16_t *nth16 = &(ntb->nth); 585| | 586| 384| TU_LOG_DRV("recv_validate_datagram(%p, %d)\n", ntb, (int) len); 587| | 588| | // check header 589| 384| if (nth16->wHeaderLength != sizeof(nth16_t)) { ------------------ | Branch (589:7): [True: 26, False: 358] ------------------ 590| 26| TU_LOG_DRV("(EE) ill nth16 length: %d\n", nth16->wHeaderLength); 591| 26| return false; 592| 26| } 593| 358| if (nth16->dwSignature != NTH16_SIGNATURE) { ------------------ | | 83| 358|#define NTH16_SIGNATURE 0x484D434E ------------------ | Branch (593:7): [True: 53, False: 305] ------------------ 594| 53| TU_LOG_DRV("(EE) ill signature: 0x%08x\n", (unsigned) nth16->dwSignature); 595| 53| return false; 596| 53| } 597| 305| if (len < sizeof(nth16_t) + sizeof(ndp16_t) + 2 * sizeof(ndp16_datagram_t)) { ------------------ | Branch (597:7): [True: 8, False: 297] ------------------ 598| 8| TU_LOG_DRV("(EE) ill min len: %lu\n", len); 599| 8| return false; 600| 8| } 601| 297| if (nth16->wBlockLength > len) { ------------------ | Branch (601:7): [True: 15, False: 282] ------------------ 602| 15| TU_LOG_DRV("(EE) ill block length: %d > %lu\n", nth16->wBlockLength, len); 603| 15| return false; 604| 15| } 605| 282| if (nth16->wBlockLength > CFG_TUD_NCM_OUT_NTB_MAX_SIZE) { ------------------ | | 17| 282| #define CFG_TUD_NCM_OUT_NTB_MAX_SIZE 3200 ------------------ | Branch (605:7): [True: 0, False: 282] ------------------ 606| 0| TU_LOG_DRV("(EE) ill block length2: %d > %d\n", nth16->wBlockLength, CFG_TUD_NCM_OUT_NTB_MAX_SIZE); 607| 0| return false; 608| 0| } 609| 282| if (nth16->wNdpIndex < sizeof(nth16_t) || nth16->wNdpIndex > len - (sizeof(ndp16_t) + 2 * sizeof(ndp16_datagram_t))) { ------------------ | Branch (609:7): [True: 11, False: 271] | Branch (609:45): [True: 26, False: 245] ------------------ 610| 37| TU_LOG_DRV("(EE) ill position of first ndp: %d (%lu)\n", nth16->wNdpIndex, len); 611| 37| return false; 612| 37| } 613| | 614| | // check (first) NDP(16) 615| 245| const ndp16_t *ndp16 = (const ndp16_t *) (ntb->data + nth16->wNdpIndex); 616| | 617| 245| if (ndp16->wLength < sizeof(ndp16_t) + 2 * sizeof(ndp16_datagram_t)) { ------------------ | Branch (617:7): [True: 10, False: 235] ------------------ 618| 10| TU_LOG_DRV("(EE) ill ndp16 length: %d\n", ndp16->wLength); 619| 10| return false; 620| 10| } 621| | // the NDP block (wLength bytes from wNdpIndex) must fit within the received NTB, otherwise the 622| | // datagram pointer array walked below (max_ndx is derived from wLength) runs past ntb->data 623| 235| if ((uint32_t) nth16->wNdpIndex + ndp16->wLength > len) { ------------------ | Branch (623:7): [True: 39, False: 196] ------------------ 624| 39| TU_LOG_DRV("(EE) ill ndp16 length: %d (%lu)\n", ndp16->wLength, len); 625| 39| return false; 626| 39| } 627| 196| if (ndp16->dwSignature != NDP16_SIGNATURE_NCM0 && ndp16->dwSignature != NDP16_SIGNATURE_NCM1) { ------------------ | | 84| 392|#define NDP16_SIGNATURE_NCM0 0x304D434E ------------------ if (ndp16->dwSignature != NDP16_SIGNATURE_NCM0 && ndp16->dwSignature != NDP16_SIGNATURE_NCM1) { ------------------ | | 85| 126|#define NDP16_SIGNATURE_NCM1 0x314D434E ------------------ | Branch (627:7): [True: 126, False: 70] | Branch (627:53): [True: 81, False: 45] ------------------ 628| 81| TU_LOG_DRV("(EE) ill signature: 0x%08x\n", (unsigned) ndp16->dwSignature); 629| 81| return false; 630| 81| } 631| 115| if (ndp16->wNextNdpIndex != 0) { ------------------ | Branch (631:7): [True: 18, False: 97] ------------------ 632| 18| TU_LOG_DRV("(EE) cannot handle wNextNdpIndex!=0 (%d)\n", ndp16->wNextNdpIndex); 633| 18| return false; 634| 18| } 635| | 636| 97| const ndp16_datagram_t *ndp16_datagram = (const ndp16_datagram_t *) (ntb->data + nth16->wNdpIndex + sizeof(ndp16_t)); 637| 97| int ndx = 0; 638| 97| uint16_t max_ndx = (uint16_t) ((ndp16->wLength - sizeof(ndp16_t)) / sizeof(ndp16_datagram_t)); 639| | 640| 97| if (max_ndx > 2) { // number of datagrams in NTB > 1 ------------------ | Branch (640:7): [True: 24, False: 73] ------------------ 641| 24| TU_LOG_DRV("<< %d (%d)\n", max_ndx - 1, ntb->nth.wBlockLength); 642| 24| } 643| 97| if (ndp16_datagram[max_ndx - 1].wDatagramIndex != 0 || ndp16_datagram[max_ndx - 1].wDatagramLength != 0) { ------------------ | Branch (643:7): [True: 22, False: 75] | Branch (643:58): [True: 17, False: 58] ------------------ 644| 39| TU_LOG_DRV(" max_ndx != 0\n"); 645| 39| return false; 646| 39| } 647| 403| while (ndp16_datagram[ndx].wDatagramIndex != 0 && ndp16_datagram[ndx].wDatagramLength != 0) { ------------------ | Branch (647:10): [True: 392, False: 11] | Branch (647:53): [True: 388, False: 4] ------------------ 648| 388| TU_LOG_DRV(" << %d %d\n", ndp16_datagram[ndx].wDatagramIndex, ndp16_datagram[ndx].wDatagramLength); 649| 388| if (ndp16_datagram[ndx].wDatagramIndex > len) { ------------------ | Branch (649:9): [True: 25, False: 363] ------------------ 650| 25| TU_LOG_DRV("(EE) ill start of datagram[%d]: %d (%lu)\n", ndx, ndp16_datagram[ndx].wDatagramIndex, len); 651| 25| return false; 652| 25| } 653| 363| if (ndp16_datagram[ndx].wDatagramIndex + ndp16_datagram[ndx].wDatagramLength > len) { ------------------ | Branch (653:9): [True: 18, False: 345] ------------------ 654| 18| TU_LOG_DRV("(EE) ill end of datagram[%d]: %d (%lu)\n", ndx, ndp16_datagram[ndx].wDatagramIndex + ndp16_datagram[ndx].wDatagramLength, len); 655| 18| return false; 656| 18| } 657| 345| ++ndx; 658| 345| } 659| 15| if (ndx == 0) { ------------------ | Branch (659:7): [True: 2, False: 13] ------------------ 660| 2| TU_LOG_DRV("(EE) no datagram in ndp16\n"); 661| 2| return false; 662| 2| } 663| | 664| | #if CFG_TUD_NCM_LOG_LEVEL >= 3 665| | TU_LOG_BUF(3, ntb->data[i], len); 666| | #endif 667| | 668| | // -> ntb contains a valid packet structure 669| | // ok... I did not check for garbage within the datagram indices... 670| 13| return true; 671| 15|} // recv_validate_datagram LLVMFuzzerTestOneInput: 76| 384|int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { 77| | // Give the NTB a heap allocation of the exact receive-buffer size so any read 78| | // past ntb->data is caught by AddressSanitizer. 79| 384| recv_ntb_t *ntb = (recv_ntb_t *) malloc(sizeof(recv_ntb_t)); 80| 384| if (ntb == NULL) { ------------------ | Branch (80:7): [True: 0, False: 384] ------------------ 81| 0| return 0; 82| 0| } 83| 384| size_t n = size < sizeof(ntb->data) ? size : sizeof(ntb->data); ------------------ | Branch (83:14): [True: 374, False: 10] ------------------ 84| 384| memset(ntb->data, 0, sizeof(ntb->data)); 85| 384| memcpy(ntb->data, data, n); 86| 384| recv_validate_datagram(ntb, (uint32_t) n); 87| 384| free(ntb); 88| 384| return 0; 89| 384|}