fuzz: improve fuzzing coverage

Updtae pl7m code (Fix swap-direction mutation)
ntop · Dec 11, 2024 · 5133b0d · 5133b0d
1 parent 8034105
commit 5133b0d
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 1 deletion.
diff --git a/fuzz/fuzz_config.cpp b/fuzz/fuzz_config.cpp
@@ -377,6 +377,16 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
     snprintf(cfg_value, sizeof(cfg_value), "%d", value);
     ndpi_set_config(ndpi_info_mod, NULL, "dpi.guess_ip_before_port", cfg_value);
   }
+  if(fuzzed_data.ConsumeBool()) {
+    value = fuzzed_data.ConsumeIntegralInRange(0, 1 + 1);
+    snprintf(cfg_value, sizeof(cfg_value), "%d", value);
+    ndpi_set_config(ndpi_info_mod, NULL, "dpi.compute_entropy", cfg_value);
+  }
+  if(fuzzed_data.ConsumeBool()) {
+    value = fuzzed_data.ConsumeIntegralInRange(0, 16777215 + 1);
+    snprintf(cfg_value, sizeof(cfg_value), "%d", value);
+    ndpi_set_config(ndpi_info_mod, NULL, "dpi.address_cache_size", cfg_value);
+  }
   if(fuzzed_data.ConsumeBool()) {
     value = fuzzed_data.ConsumeIntegralInRange(0, 1 + 1);
     snprintf(cfg_value, sizeof(cfg_value), "%d", value);

diff --git a/fuzz/fuzz_ndpi_reader.c b/fuzz/fuzz_ndpi_reader.c
@@ -98,6 +98,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
     ndpi_set_config(workflow->ndpi_struct, "tls", "dpi.heuristics", "0x07");
     ndpi_set_config(workflow->ndpi_struct, "tls", "dpi.heuristics.max_packets_extra_dissection", "40");
     ndpi_set_config(workflow->ndpi_struct, "stun", "monitoring", "1");
+    ndpi_set_config(workflow->ndpi_struct, NULL, "dpi.address_cache_size", "8192");
 
     ndpi_finalize_initialization(workflow->ndpi_struct);
 

diff --git a/src/lib/third_party/src/fuzz/pl7m.c b/src/lib/third_party/src/fuzz/pl7m.c
@@ -1085,7 +1085,7 @@ static void swap_direction(struct m_pkt *p)
 	case IPPROTO_UDP:
 		udp_h = (struct udphdr *)(p->raw_data + p->l4_offset);
 		tmp_port = udp_h->source;
-		udp_h->source = udp_h->source;
+		udp_h->source = udp_h->dest;
 		udp_h->dest = tmp_port;
 		break;
 	case IPPROTO_TCP: