tests/oss-fuzz/ofp_print_target.c


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

#include <config.h>
#include "fuzzer.h"
#include "dp-packet.h"
#include "openvswitch/ofp-print.h"
#include "openvswitch/ofpbuf.h"
#include "openvswitch/vlog.h"

int
LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
{
    if (size < sizeof(struct ofp_header)) {
        return 0;
    }

    static bool isInit = false;
    if (!isInit) {
        vlog_set_verbosity("off");
        isInit = true;
    }

    struct ofpbuf b;
    ofpbuf_use_const(&b, data, size);
    for (;;) {
        /* Check if ofpbuf contains ofp header. */
        struct ofp_header *oh = ofpbuf_at(&b, 0, sizeof *oh);
        if (!oh) {
            break;
        }

        /* Check if length is geq than lower bound. */
        size_t length = ntohs(oh->length);
        if (length < sizeof *oh) {
            break;
        }

        /* Check if ofpbuf contains payload. */
        size_t tail_len = length - sizeof *oh;
        void *tail = ofpbuf_at(&b, sizeof *oh, tail_len);
        if (!tail) {
            break;
        }

        ofp_print(stdout, ofpbuf_pull(&b, length), length, NULL, NULL, 2);
    }
    ofpbuf_uninit(&b);
    return 0;
}