From ba585f848ff527f2181f8f2bfd40520563e9e68d Mon Sep 17 00:00:00 2001 From: Olaf Bergmann Date: Wed, 9 Feb 2022 16:34:35 +0100 Subject: [PATCH] [OSS-Fuzz] pdu_parse_target.c: Check result of coap_pdu_parse() When coap_pdu_parse() returns 0, the contents of pdu are undefined and must not be processed. This change proceeds fuzzer tests only if parsing succeeded. Fixes OSS-Fuzz issue 44503 [1] [1] https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44503 --- tests/oss-fuzz/pdu_parse_target.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/tests/oss-fuzz/pdu_parse_target.c b/tests/oss-fuzz/pdu_parse_target.c index 04be491a..f1cea993 100644 --- a/tests/oss-fuzz/pdu_parse_target.c +++ b/tests/oss-fuzz/pdu_parse_target.c @@ -8,14 +8,15 @@ LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { coap_pdu_t *pdu = coap_pdu_init(0, 0, 0, size); if (pdu) { coap_set_log_level(LOG_DEBUG); - coap_pdu_parse(COAP_PROTO_UDP, data, size, pdu); - coap_string_t *query = coap_get_query(pdu); - coap_string_t *uri_path = coap_get_uri_path(pdu); - coap_show_pdu(LOG_DEBUG, pdu); - coap_pdu_encode_header(pdu, COAP_PROTO_UDP); + if (coap_pdu_parse(COAP_PROTO_UDP, data, size, pdu)) { + coap_string_t *query = coap_get_query(pdu); + coap_string_t *uri_path = coap_get_uri_path(pdu); + coap_show_pdu(LOG_DEBUG, pdu); + coap_pdu_encode_header(pdu, COAP_PROTO_UDP); - coap_delete_string(query); - coap_delete_string(uri_path); + coap_delete_string(query); + coap_delete_string(uri_path); + } coap_delete_pdu(pdu); } return 0;