upstream/openvpn
1
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn.git synced 2026-06-08 16:35:26 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix bug in fuzzer-forward.c

Browse source 
Instead of adding the same item over and over,
allocate and fill a new struct client_nat_entry for each call
to client_nat_add_entry().
This commit is contained in:
Guido Vranken 2017-08-11 02:37:49 +02:00
parent 1e20cc2e99
commit 81b89af43b
1 changed files with 11 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
src/openvpn/fuzzer-forward.c
View file

@ -14,7 +14,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
struct gc_arena gc;
struct buffer buf;
struct client_nat_entry cne;
struct client_nat_entry* cne[MAX_CLIENT_NAT];
ssize_t num_loops, generic_ssizet;
unsigned int generic_uint, flags;
size_t n;
@ -25,6 +25,8 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
struct link_socket link_socket;
struct link_socket_actual to_link_addr;
memset(cne, 0, sizeof(cne));
fuzzer_set_input((unsigned char*)data, size);
gc = gc_new();
memset(&buf, 0, sizeof(buf));
@ -76,8 +78,11 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
FUZZER_GET_INTEGER(num_loops, MAX_CLIENT_NAT);
for (n = 0; n < num_loops; n++) {
FUZZER_GET_DATA(&cne, sizeof(cne));
client_nat_add_entry(ctx.options.client_nat, &cne);
struct client_nat_entry* _cne;
cne[n] = malloc(sizeof(struct client_nat_entry));
_cne = cne[n];
FUZZER_GET_DATA(_cne, sizeof(struct client_nat_entry));
client_nat_add_entry(ctx.options.client_nat, _cne);
}
FUZZER_GET_INTEGER(generic_ssizet, 1);
@ -151,6 +156,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
process_incoming_tun(&ctx);
cleanup:
for (n = 0; n < MAX_CLIENT_NAT; n++) {
free(cne[n]);
}
free_buf(&buf);
gc_free(&gc);