diff fuzz/fuzz-common.c @ 1801:4983a6bc1f51

fuzz: fix crash in newtcpdirect(), don't close the channel too early
author Matt Johnston <matt@ucc.asn.au>
date Fri, 05 Mar 2021 22:51:11 +0800
parents 8df3d6aa5f23
children 19b28d2fbe30
line wrap: on
line diff
--- a/fuzz/fuzz-common.c	Fri Mar 05 21:13:20 2021 +0800
+++ b/fuzz/fuzz-common.c	Fri Mar 05 22:51:11 2021 +0800
@@ -235,26 +235,6 @@
 }
 
 
-struct dropbear_progress_connection *fuzz_connect_remote(const char* UNUSED(remotehost), const char* UNUSED(remoteport),
-    connect_callback cb, void* cb_data, 
-    const char* UNUSED(bind_address), const char* UNUSED(bind_port)) {
-    /* This replacement for connect_remote() has slightly different semantics
-    to the real thing. It should probably be replaced with something more sophisticated.
-    It calls the callback cb() immediately rather than
-    in a future session loop iteration with set_connect_fds()/handle_connect_fds().
-    This could cause problems depending on how connect_remote() is used. In particular
-    the callback can close a channel - that can cause use-after-free. */
-    char r;
-    genrandom((void*)&r, 1);
-    if (r & 1) {
-        int sock = wrapfd_new_dummy();
-        cb(DROPBEAR_SUCCESS, sock, cb_data, NULL);
-    } else {
-        cb(DROPBEAR_FAILURE, -1, cb_data, "errorstring");
-    }
-    return NULL;
-}
-
 /* Fake dropbear_listen, always returns failure for now.
 TODO make it sometimes return success with wrapfd_new_dummy() sockets.
 Making the listeners fake a new incoming connection will be harder. */