Mercurial > dropbear
diff fuzz/fuzz-common.c @ 1801:4983a6bc1f51
fuzz: fix crash in newtcpdirect(), don't close the channel too early
author | Matt Johnston <matt@ucc.asn.au> |
---|---|
date | Fri, 05 Mar 2021 22:51:11 +0800 |
parents | 8df3d6aa5f23 |
children | 19b28d2fbe30 |
line wrap: on
line diff
--- a/fuzz/fuzz-common.c Fri Mar 05 21:13:20 2021 +0800 +++ b/fuzz/fuzz-common.c Fri Mar 05 22:51:11 2021 +0800 @@ -235,26 +235,6 @@ } -struct dropbear_progress_connection *fuzz_connect_remote(const char* UNUSED(remotehost), const char* UNUSED(remoteport), - connect_callback cb, void* cb_data, - const char* UNUSED(bind_address), const char* UNUSED(bind_port)) { - /* This replacement for connect_remote() has slightly different semantics - to the real thing. It should probably be replaced with something more sophisticated. - It calls the callback cb() immediately rather than - in a future session loop iteration with set_connect_fds()/handle_connect_fds(). - This could cause problems depending on how connect_remote() is used. In particular - the callback can close a channel - that can cause use-after-free. */ - char r; - genrandom((void*)&r, 1); - if (r & 1) { - int sock = wrapfd_new_dummy(); - cb(DROPBEAR_SUCCESS, sock, cb_data, NULL); - } else { - cb(DROPBEAR_FAILURE, -1, cb_data, "errorstring"); - } - return NULL; -} - /* Fake dropbear_listen, always returns failure for now. TODO make it sometimes return success with wrapfd_new_dummy() sockets. Making the listeners fake a new incoming connection will be harder. */