Merge pull request #842 from thvdveld/fuzzing

Fix fuzzer
smoltcp-rs · Sep 20, 2023 · 9a5724c · 9a5724c
2 parents 280c938 + ddeb22b
commit 9a5724c
Show file tree

Hide file tree

Showing 3 changed files with 26 additions and 10 deletions.
diff --git a/fuzz/fuzz_targets/sixlowpan_packet.rs b/fuzz/fuzz_targets/sixlowpan_packet.rs
@@ -94,6 +94,7 @@ fuzz_target!(|fuzz: SixlowpanPacketFuzzer| {
                                                     &iphc_repr.dst_addr,
                                                     frame.payload().len(),
                                                     |b| b.copy_from_slice(frame.payload()),
+                                                    &ChecksumCapabilities::ignored(),
                                                 );
                                             }
                                         }
@@ -181,7 +182,7 @@ fuzz_target!(|fuzz: SixlowpanPacketFuzzer| {
                                 if let Ok(frame) = Ipv6RoutingHeader::new_checked(payload) {
                                     if let Ok(repr) = Ipv6RoutingRepr::parse(&frame) {
                                         let mut buffer = vec![0; repr.buffer_len()];
-                                        let mut packet = Ipv6RoutingHeader::new(&mut buffer[..]);
+                                        let mut packet = Ipv6RoutingHeader::new_unchecked(&mut buffer[..]);
                                         repr.emit(&mut packet);
                                     }
                                 }

diff --git a/src/wire/ipv6routing.rs b/src/wire/ipv6routing.rs
@@ -269,8 +269,8 @@ impl<T: AsRef<[u8]> + AsMut<[u8]>> Header<T> {
             Type::Rpl => {
                 // Retain the higher order 4 bits of the padding field
                 data[field::PAD] &= 0xF0;
-                data[6] = 0;
-                data[7] = 0;
+                data[4] = 0;
+                data[5] = 0;
             }
 
             _ => panic!("Unrecognized routing type when clearing reserved fields."),

diff --git a/src/wire/sixlowpan/nhc.rs b/src/wire/sixlowpan/nhc.rs
@@ -146,7 +146,7 @@ impl<T: AsRef<[u8]>> ExtHeaderPacket<T> {
             return Err(Error);
         }
 
-        let mut len = 1;
+        let mut len = 2;
         len += self.next_header_size();
 
         if len <= buffer.len() {
@@ -190,11 +190,7 @@ impl<T: AsRef<[u8]>> ExtHeaderPacket<T> {
             NextHeader::Compressed
         } else {
             // The full 8 bits for Next Header are carried in-line.
-            let start = 1;
-
-            let data = self.buffer.as_ref();
-            let nh = data[start];
-            NextHeader::Uncompressed(IpProtocol::from(nh))
+            NextHeader::Uncompressed(IpProtocol::from(self.buffer.as_ref()[1]))
         }
     }
 
@@ -803,13 +799,32 @@ mod test {
     use super::*;
 
     #[test]
-    fn ext_header_nhc_fields() {
+    fn ext_header_nh_inlined() {
+        let bytes = [0xe2, 0x3a, 0x6, 0x3, 0x0, 0xff, 0x0, 0x0, 0x0];
+
+        let packet = ExtHeaderPacket::new_checked(&bytes[..]).unwrap();
+        assert_eq!(packet.next_header_size(), 1);
+        assert_eq!(packet.length(), 6);
+        assert_eq!(packet.dispatch_field(), DISPATCH_EXT_HEADER);
+        assert_eq!(packet.extension_header_id(), ExtHeaderId::RoutingHeader);
+        assert_eq!(
+            packet.next_header(),
+            NextHeader::Uncompressed(IpProtocol::Icmpv6)
+        );
+
+        assert_eq!(packet.payload(), [0x03, 0x00, 0xff, 0x00, 0x00, 0x00]);
+    }
+
+    #[test]
+    fn ext_header_nh_elided() {
         let bytes = [0xe3, 0x06, 0x03, 0x00, 0xff, 0x00, 0x00, 0x00];
 
         let packet = ExtHeaderPacket::new_checked(&bytes[..]).unwrap();
         assert_eq!(packet.next_header_size(), 0);
+        assert_eq!(packet.length(), 6);
         assert_eq!(packet.dispatch_field(), DISPATCH_EXT_HEADER);
         assert_eq!(packet.extension_header_id(), ExtHeaderId::RoutingHeader);
+        assert_eq!(packet.next_header(), NextHeader::Compressed);
 
         assert_eq!(packet.payload(), [0x03, 0x00, 0xff, 0x00, 0x00, 0x00]);
     }