Skip to content

Commit 1695c8a

Browse files
darosiormarcofleon
andcommitted
fuzz: in FuzzedSock::GetSockName(), return a random-length name
ConsumeData() will always try to return a name as long as the requested size. It is more useful, and closer to how `getsockname` would actually behave in reality, to return a random length name instead. This was hindering coverage in the PCP fuzz target as the addr len was set to the size of the sockaddr_in struct and would exhaust all the provided data from the fuzzer. Thanks to Marco Fleon for suggesting this. Co-Authored-by: marcofleon <[email protected]>
1 parent 0d472c1 commit 1695c8a

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

src/test/fuzz/util/net.cpp

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -358,8 +358,10 @@ int FuzzedSock::GetSockName(sockaddr* name, socklen_t* name_len) const
358358
return -1;
359359
}
360360
assert(name_len);
361-
*name_len = m_fuzzed_data_provider.ConsumeData(name, *name_len);
362-
if (*name_len < (int)sizeof(sockaddr)) return -1;
361+
const auto bytes{ConsumeRandomLengthByteVector(m_fuzzed_data_provider, *name_len)};
362+
if (bytes.size() < (int)sizeof(sockaddr)) return -1;
363+
std::memcpy(name, bytes.data(), bytes.size());
364+
*name_len = bytes.size();
363365
return 0;
364366
}
365367

0 commit comments

Comments
 (0)