mirror of
https://git.libssh.org/projects/libssh.git
synced 2025-07-29 13:01:13 +03:00
Do not accept too long inputs that fill socket buffers
There are long-standing issues with fuzzing, which cause the send() not writing all the provided bytes and causing the fuzzer driver to crash. This can be simply solved by limiting the input size to reasonably large value. https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21967 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
This commit is contained in:
@ -139,6 +139,14 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
|
||||
.channel_open_request_session_function = channel_open,
|
||||
};
|
||||
|
||||
/* This is the maximum that can be handled by the socket buffer before the
|
||||
* other side will read some data. Other option would be feeding the socket
|
||||
* from different thread which would not mind if it would be blocked, but I
|
||||
* believe all the important inputs should fit into this size */
|
||||
if (size > 219264) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* Write SSH RSA host key to disk */
|
||||
rc = write_rsa_hostkey("/tmp/libssh_fuzzer_private_key");
|
||||
assert(rc == 0);
|
||||
|
Reference in New Issue
Block a user