]> git.puffer.fish Git - matthieu/frr.git/commitdiff
bgpd: reset fuzzer stream
authorQuentin Young <qlyoung@cumulusnetworks.com>
Tue, 3 Mar 2020 05:03:50 +0000 (00:03 -0500)
committerQuentin Young <qlyoung@nvidia.com>
Mon, 15 Nov 2021 22:12:33 +0000 (17:12 -0500)
Not resetting this results in random cov

Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
bgpd/bgp_main.c

index 96d7006a268c2de387542843cc93e8cffb452a4c..f0b3a4c45a950134d79f10423b69df1e7f965ad6 100644 (file)
@@ -509,8 +509,13 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
        p = FuzzingPeer;
 #endif /* FUZZING_LIBFUZZER */
 
+       ringbuf_reset(p->ibuf_work);
        ringbuf_put(p->ibuf_work, data, size);
 
+       int result = 0;
+       unsigned char pktbuf[BGP_MAX_PACKET_SIZE];
+       uint16_t pktsize = 0;
+
        /*
         * Simulate the read process done by bgp_process_reads().
         *
@@ -527,10 +532,6 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
        fprintf(stderr, "good header\n");
 
 
-       int result = 0;
-       unsigned char pktbuf[BGP_MAX_PACKET_SIZE];
-       uint16_t pktsize = 0;
-
        ringbuf_peek(p->ibuf_work, BGP_MARKER_SIZE, &pktsize, sizeof(pktsize));
        pktsize = ntohs(pktsize);