Files
online/fuzzer/ClientSession.cpp
Miklos Vajna 1016de956a fuzzer: fix OOM with an ever-growing SocketPoll::_newCallbacks
Admin::instance().dumpState(std::cerr) at the end of a run shows:
 Poll [0] - wakeup r: 11 w: 12
        callbacks: 103
        fd      events  rsize   wsize

This is more a problem in the fuzzer itself than in the code, the
unprocessed callbacks reached the intentionally set 2GB limit in about
20 mins, so process them at the end of each run.

Change-Id: Ic12d3e8555417371f4ca44228fc1ff515d704592
Reviewed-on: https://gerrit.libreoffice.org/c/online/+/89632
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
2020-02-27 15:11:31 +01:00

44 lines
1.2 KiB
C++

#include <iostream>
#include "ClientSession.hpp"
bool DoInitialization()
{
LOOLWSD::ChildRoot = "/fuzz/child-root";
return true;
}
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
{
static bool initialized = DoInitialization();
(void)initialized;
std::string uri;
Poco::URI uriPublic;
std::string docKey = "/fuzz/fuzz.odt";
auto docBroker = std::make_shared<DocumentBroker>(uri, uriPublic, docKey);
std::string id;
bool isReadOnly = false;
const std::string hostNoTrust;
auto session
= std::make_shared<ClientSession>(id, docBroker, uriPublic, isReadOnly, hostNoTrust);
bool fin = false;
WSOpCode code = WSOpCode::Text;
std::string input(reinterpret_cast<const char*>(data), size);
std::stringstream ss(input);
std::string line;
while (std::getline(ss, line, '\n'))
{
std::vector<char> lineVector(line.data(), line.data() + line.size());
session->handleMessage(fin, code, lineVector);
}
// Make sure SocketPoll::_newCallbacks does not grow forever, leading to OOM.
Admin::instance().poll(SocketPoll::DefaultPollTimeoutMs);
return 0;
}
/* vim:set shiftwidth=4 softtabstop=4 expandtab: */