fuzz: do not use timestamps at the end of times

so as not to have integer overflows
pull/8251/head
Philippe Antoine 3 years ago committed by Victor Julien
parent 190c945e67
commit a58ffe5b3e

@ -117,6 +117,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
// loop over packets // loop over packets
r = FPC_next(&pkts, &header, &pkt); r = FPC_next(&pkts, &header, &pkt);
p = PacketGetFromAlloc(); p = PacketGetFromAlloc();
if (header.ts.tv_sec >= INT_MAX - 3600) {
goto bail;
}
p->ts.tv_sec = header.ts.tv_sec; p->ts.tv_sec = header.ts.tv_sec;
p->ts.tv_usec = header.ts.tv_usec % 1000000; p->ts.tv_usec = header.ts.tv_usec % 1000000;
p->datalink = pkts.datalink; p->datalink = pkts.datalink;
@ -140,6 +143,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
} }
} }
r = FPC_next(&pkts, &header, &pkt); r = FPC_next(&pkts, &header, &pkt);
if (header.ts.tv_sec >= INT_MAX - 3600) {
goto bail;
}
PacketRecycle(p); PacketRecycle(p);
p->ts.tv_sec = header.ts.tv_sec; p->ts.tv_sec = header.ts.tv_sec;
p->ts.tv_usec = header.ts.tv_usec % 1000000; p->ts.tv_usec = header.ts.tv_usec % 1000000;
@ -147,6 +153,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
pcap_cnt++; pcap_cnt++;
p->pcap_cnt = pcap_cnt; p->pcap_cnt = pcap_cnt;
} }
bail:
PacketFree(p); PacketFree(p);
FlowReset(); FlowReset();

@ -160,6 +160,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
//loop over packets //loop over packets
r = pcap_next_ex(pkts, &header, &pkt); r = pcap_next_ex(pkts, &header, &pkt);
p = PacketGetFromAlloc(); p = PacketGetFromAlloc();
if (header->ts.tv_sec >= INT_MAX - 3600) {
goto bail;
}
p->ts.tv_sec = header->ts.tv_sec; p->ts.tv_sec = header->ts.tv_sec;
p->ts.tv_usec = header->ts.tv_usec % 1000000; p->ts.tv_usec = header->ts.tv_usec % 1000000;
p->datalink = pcap_datalink(pkts); p->datalink = pcap_datalink(pkts);
@ -184,6 +187,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
} }
} }
r = pcap_next_ex(pkts, &header, &pkt); r = pcap_next_ex(pkts, &header, &pkt);
if (header->ts.tv_sec >= INT_MAX - 3600) {
goto bail;
}
PacketRecycle(p); PacketRecycle(p);
p->ts.tv_sec = header->ts.tv_sec; p->ts.tv_sec = header->ts.tv_sec;
p->ts.tv_usec = header->ts.tv_usec % 1000000; p->ts.tv_usec = header->ts.tv_usec % 1000000;
@ -192,6 +198,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
pcap_cnt++; pcap_cnt++;
p->pcap_cnt = pcap_cnt; p->pcap_cnt = pcap_cnt;
} }
bail:
//close structure //close structure
pcap_close(pkts); pcap_close(pkts);
PacketFree(p); PacketFree(p);

@ -157,6 +157,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
// loop over packets // loop over packets
r = FPC_next(&pkts, &header, &pkt); r = FPC_next(&pkts, &header, &pkt);
p = PacketGetFromAlloc(); p = PacketGetFromAlloc();
if (header.ts.tv_sec >= INT_MAX - 3600) {
goto bail;
}
p->pkt_src = PKT_SRC_WIRE; p->pkt_src = PKT_SRC_WIRE;
p->ts.tv_sec = header.ts.tv_sec; p->ts.tv_sec = header.ts.tv_sec;
p->ts.tv_usec = header.ts.tv_usec % 1000000; p->ts.tv_usec = header.ts.tv_usec % 1000000;
@ -181,6 +184,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
} }
} }
r = FPC_next(&pkts, &header, &pkt); r = FPC_next(&pkts, &header, &pkt);
if (header.ts.tv_sec >= INT_MAX - 3600) {
goto bail;
}
PacketRecycle(p); PacketRecycle(p);
p->pkt_src = PKT_SRC_WIRE; p->pkt_src = PKT_SRC_WIRE;
p->ts.tv_sec = header.ts.tv_sec; p->ts.tv_sec = header.ts.tv_sec;
@ -189,6 +195,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
pcap_cnt++; pcap_cnt++;
p->pcap_cnt = pcap_cnt; p->pcap_cnt = pcap_cnt;
} }
bail:
PacketFree(p); PacketFree(p);
FlowReset(); FlowReset();

Loading…
Cancel
Save