More fuzzing related changes

jclehner · Jul 7, 2020 · 55452bb · 55452bb
1 parent c0c951f
commit 55452bb
Show file tree

Hide file tree

Showing 10 changed files with 11 additions and 7 deletions.
diff --git a/Makefile b/Makefile
@@ -36,10 +36,10 @@ fuzz_nmrp: tftp.c util.c nmrp.c fuzz.c
 fuzz_tftp: tftp.c util.c nmrp.c fuzz.c
 	$(AFL) $(CFLAGS) -DNMRPFLASH_FUZZ -DNMRPFLASH_FUZZ_TFTP $^ -o $@
 
-dofuzz_tftp: fuzz
+dofuzz_tftp: fuzz_tftp
 	echo core | sudo tee /proc/sys/kernel/core_pattern
 	echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
-	afl-fuzz -i fuzzin/nmrp -o fuzzout/nmrp -- ./fuzz_tftp
+	afl-fuzz -i fuzzin/tftp -o fuzzout/tftp -- ./fuzz_tftp fuzzin/tftp.bin
 	echo powersave | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
 
 clean:

diff --git a/fuzz.c b/fuzz.c
@@ -2,9 +2,12 @@
 
 int main(int argc, char** argv)
 {
+	verbosity = 2;
+
 	struct nmrpd_args args = {
 		.rx_timeout = 60,
 		.ul_timeout = 60,
+		.ipaddr = "10.10.10.10",
 		.ipmask = "255.255.255.0",
 		.mac = "ff:ff:ff:ff:ff:ff",
 		.op = NMRP_UPLOAD_FW,

diff --git a/fuzzin/nmrp/badorder1.pkts b/fuzzin/nmrp/badorder1.pkts
diff --git a/fuzzin/nmrp/badorder2.pkts b/fuzzin/nmrp/badorder2.pkts
diff --git a/fuzzin/nmrp/badorder3.pkts b/fuzzin/nmrp/badorder3.pkts
diff --git a/fuzzin/nmrp/badorder4.pkts b/fuzzin/nmrp/badorder4.pkts
diff --git a/fuzzin/nmrp/normal.pkts b/fuzzin/nmrp/normal.pkts
diff --git a/fuzzin/tftp/fsize_4096_blksize_1k.bin b/fuzzin/tftp/fsize_4096_blksize_1k.bin
diff --git a/fuzzin/tftp/fsize_4096_default.bin b/fuzzin/tftp/fsize_4096_default.bin
diff --git a/mkfuzz.c b/mkfuzz.c
@@ -1,3 +1,4 @@
+#include <arpa/inet.h>
 #include <unistd.h>
 #include <stdint.h>
 #include <string.h>
@@ -36,7 +37,7 @@ int main(int argc, char** argv)
 
 	const size_t fsize = 4096;
 
-	char pkt[1024];
+	char pkt[1024 + 4];
 	char* p;
 	size_t len = 512;
 
@@ -52,14 +53,14 @@ int main(int argc, char** argv)
 		pkt_mknum(p, 0);
 	}
 
-	write(STDOUT_FILENO, pkt, 512);
+	write(STDOUT_FILENO, pkt, len + 4);
 
 	size_t i = 0;
 
-	for (; i < fsize/len; ++i) {
-		memset(pkt, 0, len);
+	for (; i < (fsize/len + 1); ++i) {
+		memset(pkt, 0, sizeof(pkt));
 		p = pkt_mknum(pkt, ACK);
 		pkt_mknum(p, i + 1);
-		write(STDOUT_FILENO, pkt, len);
+		write(STDOUT_FILENO, pkt, len + 4);
 	}
 }