Fuzzing MIP

test/driver_mock.c

@@ -0,0 +1,25 @@
+static bool my_random(void) {
+  return mg_millis() & 1;
+}
+
+static bool mock_init(uint8_t *mac, void *data) {
+  (void) mac, (void) data;
+  return my_random();
+}
+
+static size_t mock_tx(const void *buf, size_t len, void *data) {
+  (void) buf, (void) len, (void) data;
+  return len;
+}
+
+static size_t mock_rx(void *buf, size_t len, void *data) {
+  (void) buf, (void) len, (void) data;
+  return len;
+}
+
+static bool mock_up(void *data) {
+  (void) data;
+  return my_random();
+}
+
+struct mip_driver mip_driver_mock = {mock_init, mock_tx, mock_rx, mock_up, 0};

test/fuzz.c

@@ -1,4 +1,11 @@
-#include "mongoose.h"
+#define MG_ENABLE_SOCKET 0
+#define MG_ENABLE_LOG 0
+#define MG_ENABLE_LINES 1
+#define MG_ENABLE_MIP 1
+
+#include "mongoose.c"
+
+#include "driver_mock.c"
 
 #ifdef __cplusplus
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *, size_t);
@@ -47,6 +54,19 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 
   int n;
   mg_json_get(mg_str_n((char *) data, size), "$", &n);
+  mg_json_get(mg_str_n((char *) data, size), "$.a.b", &n);
+  mg_json_get(mg_str_n((char *) data, size), "$[0]", &n);
+
+  struct mip_cfg cfg = {};
+  size_t pktlen = 1540;
+  char t[sizeof(struct mip_if) + pktlen * 2 + 0 /* qlen */];
+  struct mip_if *ifp = (struct mip_if *) t;
+  struct mg_mgr mgr;
+  mg_mgr_init(&mgr);
+  if_init(ifp, &mgr, &cfg, &mip_driver_mock, NULL, pktlen, 0);
+  mip_rx(ifp, (void *) data, size);
+  mgr.priv = NULL;  // Don't let Mongoose free() ifp
+  mg_mgr_free(&mgr);
 
   return 0;
 }

test/mip_test.c

@@ -1,8 +1,15 @@
+#define MG_ENABLE_SOCKET 0
+#define MG_ENABLE_MIP 1
+#define MG_ENABLE_PACKED_FS 0
+
 #include <assert.h>
 #include "mongoose.c"
 
+#include "driver_mock.c"
+
 static void test_queue(void) {
-  static uint8_t buf[sizeof(size_t) + sizeof(uint16_t) + 3 ]; // fit 1 element but not 2
+  static uint8_t
+      buf[sizeof(size_t) + sizeof(uint16_t) + 3];  // fit 1 element but not 2
   uint16_t val = 1234;
   static struct queue q = {buf, sizeof(buf), 0, 0};
 
@@ -30,8 +37,20 @@ static void test_queue(void) {
   assert(q_avail(&q) == 0);
 }
 
+static void test_statechange(void) {
+  uint8_t tx[1540];
+  struct mip_if iface;
+  memset(&iface, 0, sizeof(iface));
+  iface.ip = mg_htonl(0x01020304);
+  iface.state = MIP_STATE_READY;
+  iface.tx.buf = tx, iface.tx.len = sizeof(tx);
+  iface.driver = &mip_driver_mock;
+  onstatechange(&iface);
+}
+
 int main(void) {
   test_queue();
+  test_statechange();
   printf("SUCCESS\n");
   return 0;
 }