From b4563a24904e823497552f6e4ef77e8041f2cc5d Mon Sep 17 00:00:00 2001 From: Douglas Bagnall Date: Wed, 20 Dec 2023 14:26:00 +1300 Subject: [PATCH] fuzz: allow max size conditional ACE round-trip failure The encoder, being cautious not to overstep the arbitrary 10000 byte boundary, might not encode an exactly 10000 byte condition. This is an off-by-one, but in the safe direction. Credit to OSS-Fuzz. REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65118 Signed-off-by: Douglas Bagnall Reviewed-by: Andrew Bartlett Autobuild-User(master): Andrew Bartlett Autobuild-Date(master): Fri Dec 22 00:51:13 UTC 2023 on atb-devel-224 --- lib/fuzzing/fuzz_conditional_ace_blob.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/lib/fuzzing/fuzz_conditional_ace_blob.c b/lib/fuzzing/fuzz_conditional_ace_blob.c index ed0bbd536bc..ebbd90883aa 100644 --- a/lib/fuzzing/fuzz_conditional_ace_blob.c +++ b/lib/fuzzing/fuzz_conditional_ace_blob.c @@ -73,6 +73,17 @@ int LLVMFuzzerTestOneInput(const uint8_t *input, size_t len) /* back to blob form */ ok = conditional_ace_encode_binary(mem_ctx, s1, &e2); if (! ok) { + if (e1.length == CONDITIONAL_ACE_MAX_LENGTH) { + /* + * This is an edge case where the encoder and + * decoder treat the boundary slightly + * differently, and the encoder refuses to + * encode to the maximum length. This is not + * an issue in the real world. + */ + TALLOC_FREE(mem_ctx); + return 0; + } abort(); } -- 2.47.3