coturn

Commit Graph

Author	SHA1	Message	Date
Pavel Punsky	8952415609	Seed address-mapping table in fuzz initializer (#1885 ) map_addr_from_public_to_private and map_addr_from_private_to_public in src/client/ns_turn_ioaddr.c walk a static public_addrs[] table of size mcount. Without an explicit ioa_addr_add_mapping call mcount stays 0 for the entire fuzz process, so the loop body — including the addr_eq_no_port call it gates — is dead code in every fuzz iteration. OSS-Fuzz introspector flags this as 19 unreached callsites under map_addr_from_public_to_private and 4+4 under addr_eq_no_port. Extend the existing shared LLVMFuzzerInitialize in FuzzOpenSSLInit.c (linked into both FuzzStun and FuzzStunClient via FUZZ_COMMON_SOURCES) to register two synthetic public<->private mapping pairs — one v4 (192.0.2.1 <-> 10.0.0.1) and one v6 (2001:db8::1 <-> fd00::1) — once at startup. The header comment for ioa_addr_add_mapping requires single-threaded init before fuzzing begins, which matches exactly when LLVMFuzzerInitialize runs. Verified by stand-alone harness: after init, stun_attr_get_first_addr_str on a XOR-MAPPED-ADDRESS attribute holding 192.0.2.1:443 returns 10.0.0.1:443, and the v6 equivalent returns [fd00::1]:8080 — confirming addr_eq_no_port is now called inside the loop body in both helpers.	2 weeks ago
Pavel Punsky	2342119db0	Add more fuzzing scenarios (#1857 )	4 weeks ago

Author

SHA1

Message

Date

Pavel Punsky

8952415609

Seed address-mapping table in fuzz initializer (#1885 )

map_addr_from_public_to_private and map_addr_from_private_to_public in
src/client/ns_turn_ioaddr.c walk a static public_addrs[] table of size
mcount. Without an explicit ioa_addr_add_mapping call mcount stays 0 for
the entire fuzz process, so the loop body — including the
addr_eq_no_port call it gates — is dead code in every fuzz iteration.
OSS-Fuzz introspector flags this as 19 unreached callsites under
map_addr_from_public_to_private and 4+4 under addr_eq_no_port.

Extend the existing shared LLVMFuzzerInitialize in FuzzOpenSSLInit.c
(linked into both FuzzStun and FuzzStunClient via FUZZ_COMMON_SOURCES)
to register two synthetic public<->private mapping pairs — one v4
(192.0.2.1 <-> 10.0.0.1) and one v6 (2001:db8::1 <-> fd00::1) — once at
startup. The header comment for ioa_addr_add_mapping requires
single-threaded init before fuzzing begins, which matches exactly when
LLVMFuzzerInitialize runs.

Verified by stand-alone harness: after init,
stun_attr_get_first_addr_str on a XOR-MAPPED-ADDRESS attribute holding
192.0.2.1:443 returns 10.0.0.1:443, and the v6 equivalent returns
[fd00::1]:8080 — confirming addr_eq_no_port is now called inside the
loop body in both helpers.

2 weeks ago

Pavel Punsky

2342119db0

Add more fuzzing scenarios (#1857 )

4 weeks ago

2 Commits (4.11.0)