Skip to content

Commit a9481c6

Browse files
cujomalaineylgirdwood
authored andcommitted
fuzz: fix size type
Fix silent overflow in the fuzzer. 255 is clearly << 65536 so that means we are not able to exercise the full buffer. But upon further inspection its clear that numbers are a minimum truncated if not rolling over based on the code in the size_t to uint8_t conversions. This was validated by converting the type temporarily to signed and observing the fuzzer using a negative index. Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
1 parent 0ba94ef commit a9481c6

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

src/platform/posix/ipc.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ extern uint8_t *posix_fuzz_buf, posix_fuzz_sz;
3030
// thinking/experimentation about how much fuzzing we want to do at a
3131
// time...
3232
static uint8_t fuzz_in[65536];
33-
static uint8_t fuzz_in_sz;
33+
static size_t fuzz_in_sz;
3434

3535
// The protocol here is super simple: the first byte is a message size
3636
// in units of 16 bits (the buffer maximum defaults to 384 bytes, and

0 commit comments

Comments
 (0)