]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
fuzz: check PacketCopyData return value before processing packet
authorPhilippe Antoine <contact@catenacyber.fr>
Thu, 19 Nov 2020 13:10:08 +0000 (14:10 +0100)
committerVictor Julien <victor@inliniac.net>
Tue, 1 Dec 2020 04:33:07 +0000 (05:33 +0100)
src/tests/fuzz/fuzz_sigpcap.c

index f3e8ae1f21e69b99574b7ce719b859aa3a102b32..d2c2f30f3da6e565865b438b53b57c790b4d71d6 100644 (file)
@@ -143,22 +143,23 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
     p->ts.tv_usec = header->ts.tv_usec;
     p->datalink = pcap_datalink(pkts);
     while (r > 0) {
-        PacketCopyData(p, pkt, header->caplen);
-        //DecodePcapFile
-        TmEcode ecode = tmm_modules[TMM_DECODEPCAPFILE].Func(&tv, p, dtv);
-        if (ecode == TM_ECODE_FAILED) {
-            break;
-        }
-        Packet *extra_p = PacketDequeueNoLock(&tv.decode_pq);
-        while (extra_p != NULL) {
-            PacketFree(extra_p);
-            extra_p = PacketDequeueNoLock(&tv.decode_pq);
-        }
-        tmm_modules[TMM_FLOWWORKER].Func(&tv, p, fwd);
-        extra_p = PacketDequeueNoLock(&tv.decode_pq);
-        while (extra_p != NULL) {
-            PacketFree(extra_p);
+        if (PacketCopyData(p, pkt, header->caplen) == 0) {
+            // DecodePcapFile
+            TmEcode ecode = tmm_modules[TMM_DECODEPCAPFILE].Func(&tv, p, dtv);
+            if (ecode == TM_ECODE_FAILED) {
+                break;
+            }
+            Packet *extra_p = PacketDequeueNoLock(&tv.decode_pq);
+            while (extra_p != NULL) {
+                PacketFree(extra_p);
+                extra_p = PacketDequeueNoLock(&tv.decode_pq);
+            }
+            tmm_modules[TMM_FLOWWORKER].Func(&tv, p, fwd);
             extra_p = PacketDequeueNoLock(&tv.decode_pq);
+            while (extra_p != NULL) {
+                PacketFree(extra_p);
+                extra_p = PacketDequeueNoLock(&tv.decode_pq);
+            }
         }
         r = pcap_next_ex(pkts, &header, &pkt);
         PACKET_RECYCLE(p);