mirror of
https://github.com/smoltcp-rs/smoltcp.git
synced 2025-10-02 15:15:05 +00:00
d9f114a2ab
Because IEEE802.15.4 uses a lot of compression in its frame, fuzzing it is maybe a good idea. Adding this fuzz target showed that some frame methods were panicking. `check_len` now checks if accessors will panic or not. I ran the fuzzer for about 15 minutes and nothing showed up.
20 lines
852 B
Rust
20 lines
852 B
Rust
#![no_main]
|
|
use libfuzzer_sys::fuzz_target;
|
|
use smoltcp::wire::{Ieee802154Frame, Ieee802154Repr};
|
|
|
|
fuzz_target!(|data: &[u8]| {
|
|
if let Ok(ref frame) = Ieee802154Frame::new_checked(data) {
|
|
if let Ok(repr) = Ieee802154Repr::parse(frame) {
|
|
// The buffer len returns only the lenght required for emitting the header
|
|
// and does not take into account the length of the payload.
|
|
let mut buffer = vec![0; repr.buffer_len()];
|
|
|
|
// NOTE: unchecked because the checked version checks if the addressing mode field
|
|
// is valid or not. The addressing mode field is required for calculating the length of
|
|
// the header, which is used in `check_len`.
|
|
let mut frame = Ieee802154Frame::new_unchecked(&mut buffer[..]);
|
|
repr.emit(&mut frame);
|
|
}
|
|
};
|
|
});
|