#include #include #include #include #include "common.h" #include "mbedtls/ssl.h" #if defined(MBEDTLS_SSL_PROTO_DTLS) #include "mbedtls/entropy.h" #include "mbedtls/ctr_drbg.h" #include "mbedtls/certs.h" #include "mbedtls/timing.h" #include "mbedtls/ssl_cookie.h" const char *pers = "fuzz_dtlsserver"; const unsigned char client_ip[4] = {0x7F, 0, 0, 1}; static bool initialized = 0; #if defined(MBEDTLS_X509_CRT_PARSE_C) static mbedtls_x509_crt srvcert; static mbedtls_pk_context pkey; #endif typedef struct fuzzBufferOffset { const uint8_t *Data; size_t Size; size_t Offset; } fuzzBufferOffset_t; static int dummy_send( void *ctx, const unsigned char *buf, size_t len ) { //silence warning about unused parameter (void) ctx; (void) buf; //pretends we wrote everything ok return( len ); } static int fuzz_recv( void *ctx, unsigned char *buf, size_t len ) { //reads from the buffer from fuzzer fuzzBufferOffset_t * biomemfuzz = (fuzzBufferOffset_t *) ctx; if (biomemfuzz->Offset == biomemfuzz->Size) { //EOF return (0); } if (len + biomemfuzz->Offset > biomemfuzz->Size) { //do not overflow len = biomemfuzz->Size - biomemfuzz->Offset; } memcpy(buf, biomemfuzz->Data + biomemfuzz->Offset, len); biomemfuzz->Offset += len; return( len ); } static int fuzz_recv_timeout( void *ctx, unsigned char *buf, size_t len, uint32_t timeout ) { (void) timeout; return fuzz_recv(ctx, buf, len); } static int dummy_random( void *p_rng, unsigned char *output, size_t output_len ) { int ret; size_t i; //use mbedtls_ctr_drbg_random to find bugs in it ret = mbedtls_ctr_drbg_random(p_rng, output, output_len); for (i=0; i