nicolabs/mosquitto
1
0
Fork 0
mirror of https://github.com/eclipse-mosquitto/mosquitto.git synced 2026-05-21 12:24:29 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Experimental fuzz memory checking

Browse source
This commit is contained in:
Roger A. Light 2026-04-24 13:46:30 +01:00
parent b1a2be20c3
commit 1f5d33b1e7
No known key found for this signature in database
GPG key ID: 779B22DFB3E717B7
3 changed files with 22 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
fuzzing/libcommon/libcommon_fuzz_property.cpp
View file

@ -3,11 +3,17 @@
#include "libcommon_fuzz_property.pb.h"
#include "mosquitto.h"
extern int32_t fuzz_memory_check_limit;
extern int32_t fuzz_memory_check_count;
DEFINE_PROTO_FUZZER(const fuzz_property::FuzzerInput& fuzzer_input)
{
mosquitto_property *prop_list = nullptr;
mosquitto_property *prop_copy = nullptr;
fuzz_memory_check_count = 0;
fuzz_memory_check_limit = fuzzer_input.memory_check_limit();
for(const fuzz_property::Property& property : fuzzer_input.properties()){
int identifier = property.identifier();
switch(property.data_case()){

1
fuzzing/libcommon/libcommon_fuzz_property.proto
View file

@ -22,4 +22,5 @@ message Property {
message FuzzerInput {
repeated Property properties = 1;
required int32 memory_check_limit = 2;
}

15
libcommon/memory_common.c
View file

@ -41,6 +41,19 @@ Contributors:
# endif
#endif
#ifdef WITH_FUZZING
int32_t fuzz_memory_check_count = 0;
int32_t fuzz_memory_check_limit = -1;
bool fuzz_memory_check(void)
{
fuzz_memory_check_count++;
return (fuzz_memory_check_limit > 0 && fuzz_memory_check_count >= fuzz_memory_check_limit);
}
# define FUZZ_MEMORY_CHECK() if(fuzz_memory_check()){ return NULL; }
#else
# define FUZZ_MEMORY_CHECK()
#endif
static unsigned long memcount = 0;
static unsigned long max_memcount = 0;
@ -182,6 +195,8 @@ BROKER_EXPORT void *mosquitto_realloc(void *ptr, size_t size)
bool alloc_mismatch = free_size > 0 && !check_alloc_marker(ptr, free_size);
#endif
FUZZ_MEMORY_CHECK();
/* Avoid counter underflow due to mismatched memory allocation function usage */
if(free_size > memcount){
free_size = memcount;