Merge branch 'alanxz:master' into main

.github/workflows/cifuzz.yml

@@ -0,0 +1,32 @@
+name: CIFuzz
+on: [pull_request]
+jobs:
+  Fuzzing:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer: [address, undefined, memory]
+    steps:
+    - name: Build Fuzzers (${{ matrix.sanitizer }})
+      id: build
+      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
+      with:
+        oss-fuzz-project-name: 'rabbitmq-c'
+        dry-run: false
+        language: c
+        sanitizer: ${{ matrix.sanitizer }}
+    - name: Run Fuzzers (${{ matrix.sanitizer }})
+      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+      with:
+        oss-fuzz-project-name: 'rabbitmq-c'
+        dry-run: false
+        language: c
+        fuzz-seconds: 300
+        sanitizer: ${{ matrix.sanitizer }}
+    - name: Upload Crash
+      uses: actions/upload-artifact@v1
+      if: failure() && steps.build.outcome == 'success'
+      with:
+        name: ${{ matrix.sanitizer }}-artifacts
+        path: ./out/artifacts

fuzz/fuzz_server.c

@@ -26,7 +26,7 @@ struct Fuzzer {
 typedef struct Fuzzer Fuzzer;
 
 #define PORT 5672
-#define kMinInputLength 9
+#define kMinInputLength 8
 #define kMaxInputLength 1024
 
 void client(Fuzzer *fuzzer);
@@ -93,6 +93,7 @@ void *Server(void *args) {
 void clean(Fuzzer *fuzzer) {
   shutdown(fuzzer->socket, SHUT_RDWR);
   close(fuzzer->socket);
+  free(fuzzer->buffer);
   free(fuzzer);
 }
 
@@ -105,6 +106,10 @@ extern int LLVMFuzzerTestOneInput(const char *data, size_t size) {
   Fuzzer *fuzzer = (Fuzzer *)malloc(sizeof(Fuzzer));
   fuzzer->port = PORT;
 
+  fuzzer->size = size;
+  fuzzer->buffer = malloc(fuzzer->size);
+  memcpy(fuzzer->buffer, data, size);
+
   fuzzinit(fuzzer);
 
   pthread_create(&fuzzer->thread, NULL, Server, fuzzer);
@@ -145,4 +150,3 @@ void client(Fuzzer *fuzzer) {
 
   amqp_destroy_connection(conn);
 }
-