fuzz: DHCP header parser
This commit is contained in:
parent
5185a105c3
commit
d14d238422
|
@ -28,3 +28,9 @@ name = "tcp_headers"
|
||||||
path = "fuzz_targets/tcp_headers.rs"
|
path = "fuzz_targets/tcp_headers.rs"
|
||||||
test = false
|
test = false
|
||||||
doc = false
|
doc = false
|
||||||
|
|
||||||
|
[[bin]]
|
||||||
|
name = "dhcp_header"
|
||||||
|
path = "fuzz_targets/dhcp_header.rs"
|
||||||
|
test = false
|
||||||
|
doc = false
|
||||||
|
|
|
@ -0,0 +1,19 @@
|
||||||
|
#![no_main]
|
||||||
|
use libfuzzer_sys::fuzz_target;
|
||||||
|
use smoltcp::wire::{DhcpPacket, DhcpRepr};
|
||||||
|
|
||||||
|
fuzz_target!(|data: &[u8]| {
|
||||||
|
let _ = match DhcpPacket::new_checked(data) {
|
||||||
|
Ok(ref packet) => match DhcpRepr::parse(packet) {
|
||||||
|
Ok(dhcp_repr) => {
|
||||||
|
let mut dhcp_payload = vec![0; dhcp_repr.buffer_len()];
|
||||||
|
match DhcpPacket::new_checked(&mut dhcp_payload[..]) {
|
||||||
|
Ok(mut dhcp_packet) => Some(dhcp_repr.emit(&mut dhcp_packet)),
|
||||||
|
Err(_) => None,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
Err(_) => None,
|
||||||
|
},
|
||||||
|
Err(_) => None,
|
||||||
|
};
|
||||||
|
});
|
|
@ -824,7 +824,11 @@ impl<'a> Repr<'a> {
|
||||||
data,
|
data,
|
||||||
} => {
|
} => {
|
||||||
let mut servers = [None; MAX_DNS_SERVER_COUNT];
|
let mut servers = [None; MAX_DNS_SERVER_COUNT];
|
||||||
for (server, chunk) in servers.iter_mut().zip(data.chunks(4)) {
|
let chunk_size = 4;
|
||||||
|
for (server, chunk) in servers.iter_mut().zip(data.chunks(chunk_size)) {
|
||||||
|
if chunk.len() != chunk_size {
|
||||||
|
return Err(Error::Malformed);
|
||||||
|
}
|
||||||
*server = Some(Ipv4Address::from_bytes(chunk));
|
*server = Some(Ipv4Address::from_bytes(chunk));
|
||||||
}
|
}
|
||||||
dns_servers = Some(servers);
|
dns_servers = Some(servers);
|
||||||
|
|
Loading…
Reference in New Issue