1 #include "no_warn_host.h"
2 
3 #include "lwip/opt.h"
4 #include "lwip/udp.h"
5 #include "lwip/mem.h"
6 #include "lwip/memp.h"
7 #include "lwip/dns.h"
8 #include "lwip/ip_addr.h"
9 
10 #include <string.h>
11 
12 const ip_addr_t ip_addr_any;
13 const ip_addr_t ip_addr_broadcast;
14 struct ip_globals ip_data;
15 struct netif *netif_list;
16 struct netif mynetif;
17 ip4_addr_t server_ip;
18 
19 //
20 // Dependency injected test functions
21 void dns_test_dns_recv(void *s, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port);
22 void dns_test_inject_port_and_txid(int port, int txid);
23 
24 void dns_test_init_di(void);
25 err_t dns_test_dns_enqueue(const char *name, size_t hostnamelen, dns_found_callback found, void *callback_arg, u8_t dns_addrtype);
26 
27 //
28 // Test starts here
29 //
main(int argc,char ** argv)30 int main(int argc, char** argv)
31 {
32     uint8_t *buf;
33     struct pbuf *p;
34     FILE *file;
35     size_t len = 1460;
36 
37     dns_test_init_di();
38 
39 #ifdef INSTR_IS_OFF
40     p = pbuf_alloc(PBUF_RAW, len, PBUF_POOL);
41     buf = p->payload;
42     memset(buf, 0, 1460);
43     if (argc != 2)
44     {
45         printf("Non-instrumentation mode: please supply a file name created by AFL to reproduce crash\n");
46         return 1;
47     }
48     //
49     // Note: parameter1 is a file (mangled packet) which caused the crash
50     file = fopen(argv[1], "r");
51     if (file) {
52     len = fread(buf, 1, 1460, file);
53     }
54     fclose(file);
55     int i;
56     for (i=0; i<1; i++) {
57 #else
58     while (__AFL_LOOP(1000)) {
59         p = pbuf_alloc(PBUF_RAW, len, PBUF_POOL);
60         buf = p->payload;
61         memset(buf, 0, 1460);
62         size_t len = read(0, buf, 1460);
63 #endif
64         p->len = len;
65         p->tot_len = len;
66         p->next = NULL;
67 
68         // Pretend that the response is from our pending querries
69         IP4_ADDR(&server_ip, 8, 8, 8, 8);
70         dns_setserver(0, &server_ip);
71         dns_test_inject_port_and_txid(1024, (buf[0]<<8) + buf[1]);
72         dns_test_dns_enqueue("test", 4, NULL, NULL, 0);
73 
74         // Process the packet
75         dns_test_dns_recv(NULL, NULL, p, &ip_addr_any, 0);
76     }
77 
78 
79 
80     return 0;
81 }
82