From: Neil Horman <nhorman@openssl.org>
Date: Wed, 1 Oct 2025 21:34:38 +0000 (-0400)
Subject: Reduce Max number of commands handled per fuzzer pass in quic-lcidm.
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=01c7958f2359e951a95350affb6b178fb50fed03;p=thirdparty%2Fopenssl.git

Reduce Max number of commands handled per fuzzer pass in quic-lcidm.

We've gotten a few recent reports of a hang in the quic-lcidm fuzzer:

https://issues.oss-fuzz.com/issues/448510502

It looks pretty straightforward (I think).  The fuzzer input buffer is
used in this particular case to randomly issue commands to the lcidm
hash table (add/delete/query/flush/etc).

The loop for the command processing (based on the input buffer), is
limited to 10k commands.  However the fuzzer will on occasion provide
very large buffers (500k) which easily saturate that limit.  If the
input buffer happens to do something like get biased toward mostly
additions, we wind up with a huge hashtable that has to constantly grow
and rehash, which we've seen leads to timeouts in the past.

Most direct fix I think here, given that this is something of an
artificial failure in the fuzzer, is to simply clamp the command limit
more.

Fixes openssl/project#1664

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28724)
---

diff --git a/fuzz/quic-lcidm.c b/fuzz/quic-lcidm.c
index 4c206e631f..221bc09501 100644
--- a/fuzz/quic-lcidm.c
+++ b/fuzz/quic-lcidm.c
@@ -48,7 +48,7 @@ enum {
     CMD_LOOKUP
 };
 
-#define MAX_CMDS    10000
+#define MAX_CMDS    5000
 
 static int get_cid(PACKET *pkt, QUIC_CONN_ID *cid)
 {