Skip to content

Commit

Permalink
1. replacing magic number when fuzzing the number of transport types
Browse files Browse the repository at this point in the history
2. using different parts of the fuzzed input data for TransportType and for Payload
  • Loading branch information
Alami-Amine committed Sep 18, 2024
1 parent b46ce9f commit a3d0fb7
Showing 1 changed file with 9 additions and 3 deletions.
12 changes: 9 additions & 3 deletions examples/all-clusters-app/linux/fuzzing-main.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -74,12 +74,18 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t * aData, size_t aSize)
// But maybe we should try to separately extract a PeerAddress and data from
// the incoming data?

// dumping payload with random transport types
Transport::Type fuzzedTransportType = static_cast<Transport::Type>(*aData % 5);
// dumping payload with fuzzed transport types
constexpr uint8_t numberOfTypes = static_cast<int>(Transport::Type::kLast) + 1;
Transport::Type fuzzedTransportType = static_cast<Transport::Type>(aData[0] % numberOfTypes);
Transport::PeerAddress peerAddr(fuzzedTransportType);

if (aSize < 1)
{
return 0;
}

System::PacketBufferHandle buf =
System::PacketBufferHandle::NewWithData(aData, aSize, /* aAdditionalSize = */ 0, /* aReservedSize = */ 0);
System::PacketBufferHandle::NewWithData(&aData[1], aSize - 1, /* aAdditionalSize = */ 0, /* aReservedSize = */ 0);
if (buf.IsNull())
{
// Too big; we couldn't represent this as a packetbuffer to start with.
Expand Down

0 comments on commit a3d0fb7

Please sign in to comment.