Commit graph

7 commits

Author SHA1 Message Date
Jouni Malinen
bc4d7dfc5a tests: Fix ap-mgmt-fuzzer build configuration to match libap.a
Missing CONFIG_AIRTIME_POLICY=y made the offset of struct
hostapd_iface::prev_wmm different between libap.a and ap-mgmt-fuzzer.o
which resulted in odd fuzzing failures due to a memcpy to
ctx.iface->prev_wmm ending up writing on top of the ctx.hapd and in
particular, on top of ctx.hapd.iface pointer.

Credit to OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15013
Credit to OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15014
Credit to OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15015
Credit to OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15017
Credit to OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15019
Credit to OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15020
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-05-29 13:59:39 +03:00
Jouni Malinen
27486bc5ab tests: Fix ap-mgmt-fuzzer exit to free memory
This fuzzing wrapper does not go through full hostapd_clean_iface() call
to free memory, so call ap_list_deinit() to avoid reporting memory leaks
from added AP list entries. This case could not be hit with
hostapd/wpa_supplicant since they perform full interface deinit on
interface removal.

Credit to OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14928
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-05-25 01:34:58 +03:00
Johannes Berg
6f6a3a03c1 ap-mgmt-fuzzer: Add .gitignore
Ignore the binary created here.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-03-07 12:12:20 +02:00
Jouni Malinen
7d3f18d72c tests: Allow multiple management frames to be used with ap-mgmt-fuzzer
The optional "-m <multi.dat>" command line option can now be used to
specify a data file that can include multiple management frames with
each one prefixed with a 16-bit big endian length field. This allows a
single fuzzer run to be used to go through multi-frame exchanges. The
multi.dat file shows an example of this with Probe Request frame,
Authentication frame, Association Request frame, and an Action frame.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-11-16 18:17:08 +02:00
Jouni Malinen
f79a5fa006 tests: Add a STA entry for ap-mgmt-fuzzer
This increases the coverage for AP mode management frame fuzzing by
allowing number of additional Action frame code paths to be executed.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-03 18:26:50 +03:00
Mikael Kanstrup
8b423edbd3 Declare all read only data structures as const
By analysing objdump output some read only structures were found in
.data section. To help compiler further optimize code declare these
as const.

Signed-off-by: Mikael Kanstrup <mikael.kanstrup@sonymobile.com>
2015-04-25 17:33:06 +03:00
Jouni Malinen
26b3f64428 tests: Add ap-mgmt-fuzzer
This program can be used to run fuzzing tests for areas related to AP
management frame parsing and processing.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-04-22 11:44:19 +03:00