Skip to content

Commit a7fceda

Browse files
committed
[fuzz] Make peeking through FuzzedSock::Recv fuzzer friendly
FuzzedSock only supports peeking at one byte at a time, which is not fuzzer friendly when trying to receive long data. Fix this by supporting peek data of arbitrary length instead of only one byte.
1 parent 865cdf3 commit a7fceda

File tree

2 files changed

+10
-6
lines changed

2 files changed

+10
-6
lines changed

src/test/fuzz/util/net.cpp

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -193,16 +193,16 @@ ssize_t FuzzedSock::Recv(void* buf, size_t len, int flags) const
193193
bool pad_to_len_bytes{m_fuzzed_data_provider.ConsumeBool()};
194194
if (m_peek_data.has_value()) {
195195
// `MSG_PEEK` was used in the preceding `Recv()` call, return `m_peek_data`.
196-
random_bytes.assign({m_peek_data.value()});
196+
random_bytes = m_peek_data.value();
197197
if ((flags & MSG_PEEK) == 0) {
198198
m_peek_data.reset();
199199
}
200200
pad_to_len_bytes = false;
201201
} else if ((flags & MSG_PEEK) != 0) {
202202
// New call with `MSG_PEEK`.
203-
random_bytes = m_fuzzed_data_provider.ConsumeBytes<uint8_t>(1);
203+
random_bytes = ConsumeRandomLengthByteVector(m_fuzzed_data_provider, len);
204204
if (!random_bytes.empty()) {
205-
m_peek_data = random_bytes[0];
205+
m_peek_data = random_bytes;
206206
pad_to_len_bytes = false;
207207
}
208208
} else {
@@ -215,7 +215,11 @@ ssize_t FuzzedSock::Recv(void* buf, size_t len, int flags) const
215215
}
216216
return r;
217217
}
218-
std::memcpy(buf, random_bytes.data(), random_bytes.size());
218+
// `random_bytes` might exceed the size of `buf` if e.g. Recv is called with
219+
// len=N and MSG_PEEK first and afterwards called with len=M (M < N) and
220+
// without MSG_PEEK.
221+
size_t recv_len{std::min(random_bytes.size(), len)};
222+
std::memcpy(buf, random_bytes.data(), recv_len);
219223
if (pad_to_len_bytes) {
220224
if (len > random_bytes.size()) {
221225
std::memset((char*)buf + random_bytes.size(), 0, len - random_bytes.size());
@@ -225,7 +229,7 @@ ssize_t FuzzedSock::Recv(void* buf, size_t len, int flags) const
225229
if (m_fuzzed_data_provider.ConsumeBool() && std::getenv("FUZZED_SOCKET_FAKE_LATENCY") != nullptr) {
226230
std::this_thread::sleep_for(std::chrono::milliseconds{2});
227231
}
228-
return random_bytes.size();
232+
return recv_len;
229233
}
230234

231235
int FuzzedSock::Connect(const sockaddr*, socklen_t) const

src/test/fuzz/util/net.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ class FuzzedSock : public Sock
4343
* If `MSG_PEEK` is used, then our `Recv()` returns some random data as usual, but on the next
4444
* `Recv()` call we must return the same data, thus we remember it here.
4545
*/
46-
mutable std::optional<uint8_t> m_peek_data;
46+
mutable std::optional<std::vector<uint8_t>> m_peek_data;
4747

4848
/**
4949
* Whether to pretend that the socket is select(2)-able. This is randomly set in the

0 commit comments

Comments
 (0)