diff options
author | Max Dymond <cmeister2@gmail.com> | 2017-09-11 20:51:58 +0100 |
---|---|---|
committer | Daniel Stenberg <daniel@haxx.se> | 2017-09-18 23:23:13 +0200 |
commit | c73ebb85374164515eb9df6d619a5822b6568599 (patch) | |
tree | 12de79815f33cece38fd77ce9ed6443cdf247afa /tests/fuzz/curl_fuzzer.cc | |
parent | bec50cc285995b18d57e5e5caf17e33100795f09 (diff) |
ossfuzz: changes before merging the generated corpora
Before merging in the oss-fuzz corpora from Google, there are some changes
to the fuzzer.
- Add a read corpus script, to display corpus files nicely.
- Change the behaviour of the fuzzer so that TLV parse failures all now
go down the same execution paths, which should reduce the size of the
corpora.
- Make unknown TLVs a failure to parse, which should decrease the size
of the corpora as well.
Closes #1881
Diffstat (limited to 'tests/fuzz/curl_fuzzer.cc')
-rw-r--r-- | tests/fuzz/curl_fuzzer.cc | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/tests/fuzz/curl_fuzzer.cc b/tests/fuzz/curl_fuzzer.cc index fadb3231b..dd0298f36 100644 --- a/tests/fuzz/curl_fuzzer.cc +++ b/tests/fuzz/curl_fuzzer.cc @@ -53,8 +53,14 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) for(tlv_rc = fuzz_get_first_tlv(&fuzz, &tlv); tlv_rc == 0; tlv_rc = fuzz_get_next_tlv(&fuzz, &tlv)) { + /* Have the TLV in hand. Parse the TLV. */ - fuzz_parse_tlv(&fuzz, &tlv); + rc = fuzz_parse_tlv(&fuzz, &tlv); + + if(rc != 0) { + /* Failed to parse the TLV. Can't continue. */ + goto EXIT_LABEL; + } } if(tlv_rc != TLV_RC_NO_MORE_TLVS) { @@ -408,8 +414,10 @@ int fuzz_parse_tlv(FUZZ_DATA *fuzz, TLV *tlv) FSINGLETONTLV(TLV_TYPE_MAIL_FROM, mail_from, CURLOPT_MAIL_FROM); default: - /* The fuzzer generates lots of unknown TLVs, so don't do anything if - the TLV isn't known. */ + /* The fuzzer generates lots of unknown TLVs - we don't want these in the + corpus so we reject any unknown TLVs. */ + rc = 255; + goto EXIT_LABEL; break; } |