1
0

fuzzEXTRATES.c 5.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198
  1. /*
  2. Fuzzes extended supported rates Information element
  3. */
  4. #include <stdio.h>
  5. #include <stdlib.h>
  6. #include <stdint.h>
  7. #include <string.h>
  8. #include "../frameDefinitions.h"
  9. //Indecates whether the extratesFuzzer is running
  10. int extratesRunningState = 0;
  11. //Number of fuzzing states
  12. const int extratesStates = 5;
  13. //Steps of fuzzers for each fuzzing state
  14. const int extratesSteps[] = {1, 4, 32, 32, 1};
  15. //Current state and step of the extratesFuzzer
  16. int fuzzState;
  17. int fuzzStep;
  18. void extratesPrintCurrentState()
  19. {
  20. switch (fuzzState)
  21. {
  22. case 0:
  23. {
  24. printf("\e[33mFuzzing extended rates IE\e[39m\n");
  25. printf("Trying extrates with zero length or no element\n");
  26. break;
  27. }
  28. case 1:
  29. {
  30. printf("Fuzzing duplicate ext rates\n");
  31. break;
  32. }
  33. case 2:
  34. {
  35. printf("Fuzzing all possible ext rates\n");
  36. break;
  37. }
  38. case 3:
  39. {
  40. printf("Fuzzing large number of ext rates\n");
  41. break;
  42. }
  43. case 4:
  44. {
  45. printf("Trying 255*0xFF data\n");
  46. break;
  47. }
  48. case 5:
  49. {
  50. printf("\e[33mDone with fuzzing extended rates IE\e[39m\n");
  51. break;
  52. }
  53. }
  54. }
  55. //Updates extratesFuzzer
  56. //Status 0 indicates start
  57. //Status 1 indicates increaseStep
  58. //Status 2 indicates stop
  59. //Returns -1 if done with fuzzing
  60. int extratesFuzzUpdate(int status)
  61. {
  62. switch (status)
  63. {
  64. case 0: //start fuzzer
  65. {
  66. extratesRunningState = 1;
  67. fuzzState = 0;
  68. fuzzStep = 0;
  69. extratesPrintCurrentState();
  70. break;
  71. }
  72. case 1: //update fuzzer
  73. {
  74. if (extratesRunningState == 1) //sanity check
  75. {
  76. //increase steps until all steps are done
  77. if (fuzzStep < extratesSteps[fuzzState]-1)
  78. fuzzStep = fuzzStep + 1;
  79. //then increase state and notify
  80. else
  81. {
  82. fuzzStep = 0;
  83. fuzzState = fuzzState + 1;
  84. extratesPrintCurrentState();
  85. }
  86. //when all states are done, stop
  87. if (fuzzState == extratesStates)
  88. {
  89. extratesRunningState = 0;
  90. return -1;
  91. }
  92. }
  93. break;
  94. }
  95. case 2: //stop fuzzer
  96. {
  97. extratesRunningState = 0;
  98. break;
  99. }
  100. }
  101. return 0;
  102. }
  103. //Returns an extrates information element
  104. infoElem extratesFuzz()
  105. {
  106. infoElem extrates;
  107. //What to return when not fuzzed
  108. if (extratesRunningState == 0)
  109. {
  110. extrates.id = 0;
  111. extrates.len = 0;
  112. extrates.len_data = -1;
  113. extrates.data = "";
  114. }
  115. else
  116. {
  117. switch (fuzzState)
  118. {
  119. case 0: //no data
  120. {
  121. if (fuzzStep == 0)
  122. {
  123. extrates.id = 50;
  124. extrates.len = 0;
  125. extrates.len_data = 0;
  126. extrates.data = "";
  127. }
  128. break;
  129. }
  130. case 1: //duplicate extrates
  131. {
  132. extrates.id = 50;
  133. extrates.len = 8;
  134. extrates.len_data = 8;
  135. extrates.data = "";
  136. switch (fuzzStep)
  137. {
  138. case 0: extrates.data = "\x96\x96\x96\x30\x30\x30\x30\x96"; break;
  139. case 1: extrates.data = "\x16\x16\x16\xB0\xB0\xB0\xB0\x16"; break;
  140. case 2: extrates.data = "\x02\x82\x02\x30\xB0\x30\xB0\x82"; break;
  141. case 3: extrates.data = "\x00\x00\x80\x80\xff\x7f\xff\x7f"; break;
  142. }
  143. break;
  144. }
  145. case 2: //all possible extrates
  146. {
  147. extrates.id = 50;
  148. extrates.len = 8;
  149. extrates.len_data = 8;
  150. u_char *data = malloc(8);
  151. data[0]= fuzzStep*8+0;
  152. data[1]= fuzzStep*8+1;
  153. data[2]= fuzzStep*8+2;
  154. data[3]= fuzzStep*8+3;
  155. data[4]= fuzzStep*8+4;
  156. data[5]= fuzzStep*8+5;
  157. data[6]= fuzzStep*8+6;
  158. data[7]= fuzzStep*8+7;
  159. extrates.data = data;
  160. break;
  161. }
  162. case 3: //many rates
  163. {
  164. int dataSize = 255 - fuzzStep;
  165. extrates.id = 50;
  166. extrates.len = dataSize;
  167. extrates.len_data = dataSize;
  168. //create data of datasize times 0x96
  169. u_char *data = malloc(dataSize);
  170. memset(data, 0x96, dataSize);
  171. extrates.data = data;
  172. break;
  173. }
  174. case 4: //255*0xff
  175. {
  176. extrates.id = 50;
  177. extrates.len = 255;
  178. extrates.len_data = 255;
  179. //create data of 255 times 0xff
  180. u_char *data = malloc(255);
  181. memset(data, 0xff, 255);
  182. extrates.data = data;
  183. break;
  184. }
  185. }
  186. }
  187. return extrates;
  188. }