Adicionar primeiro

managed_components/espressif__mdns/tests/test_afl_fuzz_host/CMakeLists.txt

@@ -0,0 +1,7 @@
+# The following four lines of boilerplate have to be in your project's CMakeLists
+# in this exact order for cmake to work correctly
+cmake_minimum_required(VERSION 3.5)
+
+include($ENV{IDF_PATH}/tools/cmake/project.cmake)
+
+project(fuzz_test_update)

managed_components/espressif__mdns/tests/test_afl_fuzz_host/README.md

@@ -0,0 +1,80 @@
+## Introduction
+This test uses [american fuzzy lop](http://lcamtuf.coredump.cx/afl/) to mangle real mdns packets and look for exceptions caused by the parser.
+
+A few actual packets are collected and exported as bins in the `in` folder, which is then passed as input to AFL when testing. The setup procedure for the test includes all possible services and scenarios that could be used with the given input packets.The output of the parser before fuzzing can be found in [input_packets.txt](input_packets.txt)
+
+## Building and running the tests using AFL
+To build and run the tests using AFL(afl-clang-fast) instrumentation
+
+```bash
+cd $IDF_PATH/components/mdns/test_afl_host
+make fuzz
+```
+
+(Please note you have to install AFL instrumentation first, check `Installing AFL` section)
+
+## Building the tests using GCC INSTR(off)
+
+To build the tests without AFL instrumentations and instead of that use GCC compiler(In this case it will only check for compilation issues and will not run AFL tests).
+
+```bash
+cd $IDF_PATH/components/mdns/test_afl_host
+make INSTR=off
+```
+
+Note, that this setup is useful if we want to reproduce issues reported by fuzzer tests executed in the CI, or to simulate how the packet parser treats the input packets on the host machine.
+
+## Installing AFL
+To run the test yourself, you need to download the [latest afl archive](http://lcamtuf.coredump.cx/afl/releases/afl-latest.tgz) and extract it to a folder on your computer.
+
+The rest of the document will refer to that folder as ```PATH_TO_AFL```.
+
+### Preparation
+- On Mac, you will need to install the latest Xcode and llvm support from [Homebrew](https://brew.sh)
+
+    ```bash
+    /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
+    brew install --with-clang --with-lld --HEAD llvm
+    export PATH="/usr/local/opt/llvm/bin:$PATH"
+    ```
+
+- On Ubuntu you need the following packages:
+
+    ```bash
+    sudo apt-get install make clang-4.0(or <=4.0) llvm-4.0(or <=4.0) libbsd-dev
+    ```
+
+Please note that if specified package version can't be installed(due to system is the latest), you can download, build and install it manually.
+
+### Compile AFL
+Compiling AFL is as easy as running make:
+
+```bash
+cd [PATH_TO_AFL]
+make
+cd llvm_mode/
+make
+```
+
+After successful compilation, you can export the following variables to your shell (you can also add them to your profile if you want to use AFL in other projects).
+
+```bash
+export AFL_PATH=[PATH_TO_AFL]
+export PATH="$AFL_PATH:$PATH"
+```
+
+Please note LLVM must be <=4.0.0, otherwise afl does not compile, as there are some limitations with building AFL on MacOS/Linux with the latest LLVM. Also, Windows build on cygwin is not fully supported.
+
+## Additional info
+Apple has a crash reporting service that could interfere with AFLs normal operation. To turn that off, run the following command:
+
+```bash
+launchctl unload -w /System/Library/LaunchAgents/com.apple.ReportCrash.plist
+sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.ReportCrash.Root.plist
+```
+
+Ubuntu has a similar service. To turn that off, run as root:
+
+```bash
+echo core >/proc/sys/kernel/core_pattern
+```

managed_components/espressif__mdns/tests/test_afl_fuzz_host/esp32_mock.c

@@ -0,0 +1,162 @@
+/*
+ * SPDX-FileCopyrightText: 2022-2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Unlicense OR CC0-1.0
+ */
+#include <stdio.h>
+#include <string.h>
+#include <pthread.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include "esp32_mock.h"
+#include "esp_log.h"
+
+void     *g_queue;
+int       g_queue_send_shall_fail = 0;
+int       g_size = 0;
+
+const char *WIFI_EVENT = "wifi_event";
+const char *ETH_EVENT = "eth_event";
+
+esp_err_t esp_event_handler_register(const char *event_base,
+                                     int32_t event_id,
+                                     void *event_handler,
+                                     void *event_handler_arg)
+{
+    return ESP_OK;
+}
+
+esp_err_t esp_event_handler_unregister(const char *event_base, int32_t event_id, void *event_handler)
+{
+    return ESP_OK;
+}
+
+esp_err_t esp_timer_delete(esp_timer_handle_t timer)
+{
+    return ESP_OK;
+}
+
+esp_err_t esp_timer_stop(esp_timer_handle_t timer)
+{
+    return ESP_OK;
+}
+
+esp_err_t esp_timer_start_periodic(esp_timer_handle_t timer, uint64_t period)
+{
+    return ESP_OK;
+}
+
+esp_err_t esp_timer_create(const esp_timer_create_args_t *create_args,
+                           esp_timer_handle_t *out_handle)
+{
+    return ESP_OK;
+}
+
+uint32_t xTaskGetTickCount(void)
+{
+    static uint32_t tick = 0;
+    return tick++;
+}
+
+/// Queue mock
+QueueHandle_t xQueueCreate(uint32_t uxQueueLength, uint32_t uxItemSize)
+{
+    g_size = uxItemSize;
+    g_queue = malloc((uxQueueLength) * (uxItemSize));
+    return g_queue;
+}
+
+
+void vQueueDelete(QueueHandle_t xQueue)
+{
+    free(xQueue);
+}
+
+uint32_t xQueueSend(QueueHandle_t xQueue, const void *pvItemToQueue, TickType_t xTicksToWait)
+{
+    if (g_queue_send_shall_fail) {
+        return pdFALSE;
+    } else {
+        memcpy(xQueue, pvItemToQueue, g_size);
+        return pdPASS;
+    }
+}
+
+
+uint32_t xQueueReceive(QueueHandle_t xQueue, void *pvBuffer, TickType_t xTicksToWait)
+{
+    return pdFALSE;
+}
+
+void GetLastItem(void *pvBuffer)
+{
+    memcpy(pvBuffer, g_queue, g_size);
+}
+
+void ForceTaskDelete(void)
+{
+    g_queue_send_shall_fail = 1;
+}
+
+TaskHandle_t xTaskGetCurrentTaskHandle(void)
+{
+    return NULL;
+}
+
+void xTaskNotifyGive(TaskHandle_t task)
+{
+    return;
+}
+
+BaseType_t xTaskNotifyWait(uint32_t bits_entry_clear, uint32_t bits_exit_clear, uint32_t *value, TickType_t wait_time)
+{
+    return pdTRUE;
+}
+
+void esp_log_write(esp_log_level_t level, const char *tag, const char *format, ...)
+{
+}
+
+void esp_log(esp_log_config_t config, const char *tag, const char *format, ...)
+{
+}
+
+uint32_t esp_log_timestamp(void)
+{
+    return 0;
+}
+
+void *mdns_mem_malloc(size_t size)
+{
+    return malloc(size);
+}
+
+void *mdns_mem_calloc(size_t num, size_t size)
+{
+    return calloc(num, size);
+}
+
+void mdns_mem_free(void *ptr)
+{
+    free(ptr);
+}
+
+char *mdns_mem_strdup(const char *s)
+{
+    return strdup(s);
+}
+
+char *mdns_mem_strndup(const char *s, size_t n)
+{
+    return strndup(s, n);
+}
+
+void *mdns_mem_task_malloc(size_t size)
+{
+    return malloc(size);
+}
+
+void mdns_mem_task_free(void *ptr)
+{
+    free(ptr);
+}

managed_components/espressif__mdns/tests/test_afl_fuzz_host/esp32_mock.h

@@ -0,0 +1,142 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef _ESP32_COMPAT_H_
+#define _ESP32_COMPAT_H_
+
+// Skip these include files
+#define ESP_MDNS_NETWORKING_H_
+#define INC_FREERTOS_H
+#define QUEUE_H
+#define SEMAPHORE_H
+#define _ESP_TASK_H_
+
+#ifdef USE_BSD_STRING
+#include <features.h>
+#include <bsd/string.h>
+#endif
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include <unistd.h>
+#include <signal.h>
+#include <sys/time.h>
+#include "esp_timer.h"
+
+#define ESP_FAIL                    -1
+
+#define ESP_ERR_NO_MEM              0x101
+#define ESP_ERR_INVALID_ARG         0x102
+#define ESP_ERR_INVALID_STATE       0x103
+#define ESP_ERR_INVALID_SIZE        0x104
+#define ESP_ERR_NOT_FOUND           0x105
+#define ESP_ERR_NOT_SUPPORTED       0x106
+#define ESP_ERR_TIMEOUT             0x107
+#define ESP_ERR_INVALID_RESPONSE    0x108
+#define ESP_ERR_INVALID_CRC         0x109
+
+#define MDNS_TASK_MEMORY_LOG        "internal RAM"
+#define MALLOC_CAP_8BIT             (1<<2)
+#define MALLOC_CAP_INTERNAL         (1<<11)
+
+#define pdTRUE                      true
+#define pdFALSE                     false
+#define pdPASS          ( pdTRUE )
+#define pdFAIL          ( pdFALSE )
+
+#define portMAX_DELAY               0xFFFFFFFF
+#define portTICK_PERIOD_MS          1
+#define LWIP_HDR_PBUF_H
+#define __ESP_RANDOM_H__
+#define INC_TASK_H
+
+#define pdMS_TO_TICKS(a) a
+#define xSemaphoreTake(s,d)        true
+#define xTaskDelete(a)
+#define vTaskDelete(a)             free(a)
+#define xSemaphoreGive(s)
+#define xQueueCreateMutex(s)
+#define _mdns_pcb_init(a,b)         true
+#define _mdns_pcb_deinit(a,b)       true
+#define xSemaphoreCreateMutex()     malloc(1)
+#define xSemaphoreCreateBinary()    malloc(1)
+#define vSemaphoreDelete(s)         free(s)
+#define queueQUEUE_TYPE_MUTEX       ( ( uint8_t ) 1U
+#define xTaskCreatePinnedToCore(a,b,c,d,e,f,g)     *(f) = malloc(1)
+#define xTaskCreateStaticPinnedToCore(a,b,c,d,e,f,g,h)     true
+#define vTaskDelay(m)               usleep((m)*0)
+#define esp_random()                (rand()%UINT32_MAX)
+
+
+#define ESP_TASK_PRIO_MAX 25
+#define ESP_TASKD_EVENT_PRIO 5
+#define _mdns_udp_pcb_write(tcpip_if, ip_protocol, ip, port, data, len) len
+#define TaskHandle_t TaskHandle_t
+
+
+typedef int32_t esp_err_t;
+
+typedef void *SemaphoreHandle_t;
+typedef void *QueueHandle_t;
+typedef void *TaskHandle_t;
+typedef int    BaseType_t;
+typedef uint32_t TickType_t;
+typedef void *StackType_t;
+typedef void *StaticTask_t;
+
+struct udp_pcb {
+    uint8_t dummy;
+};
+
+struct ip4_addr {
+    uint32_t addr;
+};
+typedef struct ip4_addr ip4_addr_t;
+
+struct ip6_addr {
+    uint32_t addr[4];
+};
+typedef struct ip6_addr ip6_addr_t;
+
+typedef void *system_event_t;
+
+struct pbuf {
+    struct pbuf *next;
+    void *payload;
+    uint16_t tot_len;
+    uint16_t  len;
+    uint8_t  /*pbuf_type*/ type;
+    uint8_t  flags;
+    uint16_t  ref;
+};
+
+uint32_t xTaskGetTickCount(void);
+typedef void (*esp_timer_cb_t)(void *arg);
+
+// Queue mock
+QueueHandle_t xQueueCreate(uint32_t uxQueueLength,
+                           uint32_t uxItemSize);
+
+void vQueueDelete(QueueHandle_t xQueue);
+
+uint32_t xQueueSend(QueueHandle_t xQueue, const void *pvItemToQueue, TickType_t xTicksToWait);
+
+uint32_t xQueueReceive(QueueHandle_t xQueue, void *pvBuffer, TickType_t xTicksToWait);
+
+void GetLastItem(void *pvBuffer);
+
+void ForceTaskDelete(void);
+
+esp_err_t esp_event_handler_register(const char *event_base, int32_t event_id, void *event_handler, void *event_handler_arg);
+
+esp_err_t esp_event_handler_unregister(const char *event_base, int32_t event_id, void *event_handler);
+
+
+TaskHandle_t xTaskGetCurrentTaskHandle(void);
+void xTaskNotifyGive(TaskHandle_t task);
+BaseType_t xTaskNotifyWait(uint32_t bits_entry_clear, uint32_t bits_exit_clear, uint32_t *value, TickType_t wait_time);
+
+#endif //_ESP32_COMPAT_H_

managed_components/espressif__mdns/tests/test_afl_fuzz_host/esp_attr.h

@@ -0,0 +1,14 @@
+/*
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Unlicense OR CC0-1.0
+ */
+#pragma once
+#define IRAM_ATTR
+#define FLAG_ATTR(TYPE)
+#define QUEUE_H
+#define __ARCH_CC_H__
+#define __XTENSA_API_H__
+#define SSIZE_MAX INT_MAX
+#define LWIP_HDR_IP6_ADDR_H
+#define LWIP_HDR_IP4_ADDR_H

managed_components/espressif__mdns/tests/test_afl_fuzz_host/esp_netif_mock.c

@@ -0,0 +1,55 @@
+/*
+ * SPDX-FileCopyrightText: 2020-2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <pthread.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include "esp32_mock.h"
+
+typedef struct esp_netif_s esp_netif_t;
+typedef struct esp_netif_ip_info esp_netif_ip_info_t;
+typedef struct esp_netif_dhcp_status esp_netif_dhcp_status_t;
+
+
+const char *IP_EVENT = "IP_EVENT";
+
+
+esp_err_t esp_netif_add_to_list(esp_netif_t *netif)
+{
+    return ESP_OK;
+}
+
+esp_err_t esp_netif_remove_from_list(esp_netif_t *netif)
+{
+    return ESP_ERR_NOT_FOUND;
+}
+
+esp_netif_t *esp_netif_next(esp_netif_t *netif)
+{
+    return NULL;
+}
+
+esp_netif_t *esp_netif_next_unsafe(esp_netif_t *netif)
+{
+    return NULL;
+}
+
+esp_netif_t *esp_netif_get_handle_from_ifkey(const char *if_key)
+{
+    return NULL;
+}
+
+esp_err_t esp_netif_get_ip_info(esp_netif_t *esp_netif, esp_netif_ip_info_t *ip_info)
+{
+    return ESP_ERR_NOT_SUPPORTED;
+}
+
+esp_err_t esp_netif_dhcpc_get_status(esp_netif_t *esp_netif, esp_netif_dhcp_status_t *status)
+{
+    return ESP_ERR_NOT_SUPPORTED;
+}

managed_components/espressif__mdns/tests/test_afl_fuzz_host/input_packets.txt

@@ -0,0 +1,166 @@
+Input: in/test-14.bin
+Packet Length: 568
+Questions: 18
+  Q: _airport._tcp.local. PTR IN
+  Q: _http._tcp.local. PTR IN
+  Q: _printer._tcp.local. PTR IN
+  Q: _sub._http._tcp.local. PTR IN
+  Q: _airplay._tcp.local. PTR IN
+  Q: _raop._tcp.local. PTR IN
+  Q: _uscan._tcp.local. PTR IN
+  Q: _uscans._tcp.local. PTR IN
+  Q: _ippusb._tcp.local. PTR IN
+  Q: _scanner._tcp.local. PTR IN
+  Q: _ipp._tcp.local. PTR IN
+  Q: _ipps._tcp.local. PTR IN
+  Q: _pdl-datastream._tcp.local. PTR IN
+  Q: _ptp._tcp.local. PTR IN
+  Q: _sleep-proxy._udp.local. PTR IN
+  Q: 9801A7E58FA1@Hristo's AirPort Express._raop._tcp.local. TXT IN
+  Q: Hristo's AirPort Express._airport._tcp.local. TXT IN
+  Q: Hristo's Time Capsule._airport._tcp.local. TXT IN
+Answers: 7 + 0
+  A: _airport._tcp.local. PTR IN 2272 [2] Hristo's AirPort Express._airport._tcp.local.
+  A: _airport._tcp.local. PTR IN 2272 [2] Hristo's Time Capsule._airport._tcp.local.
+  A: _http._tcp.local. PTR IN 2535 [23] HP LaserJet CP1025nw._http._tcp.local.
+  A: _printer._tcp.local. PTR IN 2535 [23] HP LaserJet CP1025nw._printer._tcp.local.
+  A: _ipp._tcp.local. PTR IN 2535 [23] HP LaserJet CP1025nw._ipp._tcp.local.
+  A: _pdl-datastream._tcp.local. PTR IN 2535 [23] HP LaserJet CP1025nw._pdl-datastream._tcp.local.
+  A: _sleep-proxy._udp.local. PTR IN 2535 [38] 50-34-10-70.1 Hristo's Time Capsule._sleep-proxy._udp.local.
+
+Input: in/test-15.bin
+Packet Length: 524
+Answers: 3 + 3
+  A: Hristo's AirPort Express._airport._tcp.local. TXT IN FLUSH 4500 [166] waMA=98-01-A7-E5-8F-A1,raMA=98-01-A7-E8-C2-2E,raM2=98-01-A7-E8-C2-2F,raNm=your-ssid,raCh=1,rCh2=52,raSt=0,raNA=1,syFl=0x8A0C,syAP=115,syVs=7.6.8,srcv=76800.1,bjSd=23
+  A: 9801A7E58FA1@Hristo's AirPort Express._raop._tcp.local. TXT IN FLUSH 4500 [134] txtvers=1; ch=2; cn=0,1; et=0,4; sv=false; da=true; sr=44100; ss=16; pw=false; vn=65537; tp=TCP,UDP; vs=105.1; am=AirPort10,115; fv=76800.1; sf=0x1
+  A: _raop._tcp.local. PTR IN 4500 [2] 9801A7E58FA1@Hristo's AirPort Express._raop._tcp.local.
+  A: 9801A7E58FA1@Hristo's AirPort Express._raop._tcp.local. SRV IN FLUSH 120 [32] 5000 Hristos-AirPort-Express.local.
+  A: Hristo's AirPort Express.local. NSEC IN FLUSH 4500 [9] Hristo's AirPort Express._airport._tcp.local.  00 05 00 00 80 00 40
+  A: 9801A7E58FA1@Hristo's AirPort Express.local. NSEC IN FLUSH 4500 [9] 9801A7E58FA1@Hristo's AirPort Express._raop._tcp.local.  00 05 00 00 80 00 40
+
+Input: in/test-16.bin
+Packet Length: 254
+Answers: 1 + 1
+  A: Hristo's Time Capsule._airport._tcp.local. TXT IN FLUSH 4500 [168] waMA=70-73-CB-B4-C9-B3,raMA=70-73-CB-BB-04-E7,raM2=70-73-CB-BB-04-E8,raNm=nbis-test,raCh=11,rCh2=132,raSt=0,raNA=0,syFl=0x820C,syAP=116,syVs=7.6.8,srcv=76800.1,bjSd=30
+  A: Hristo's Time Capsule.local. NSEC IN FLUSH 4500 [9] Hristo's Time Capsule._airport._tcp.local.  00 05 00 00 80 00 40
+
+Input: in/test-28.bin
+Packet Length: 62
+Questions: 1
+  Q: Hristo's Time Capsule._afpovertcp._tcp.local. SRV IN FLUSH
+
+Input: in/test-29.bin
+Packet Length: 39
+Questions: 2
+  Q: minifritz.local. A IN FLUSH
+  Q: minifritz.local. AAAA IN FLUSH
+
+Input: in/test-31.bin
+Packet Length: 91
+Answers: 2 + 1
+  A: minifritz.local. AAAA IN FLUSH 120 [16] fe80:0000:0000:0000:142e:54ff:b8c4:fd09
+  A: minifritz.local. A IN FLUSH 120 [4] 192.168.254.16
+  A: minifritz.local. NSEC IN FLUSH 120 [8] minifritz...local.  00 04 40 00 00 08
+
+Input: in/test-53.bin
+Packet Length: 140
+Questions: 2
+  Q: _smb._tcp.local. PTR IN
+  Q: Sofiya-Ivanovas-MacBook.local. A IN
+Answers: 2 + 0
+  A: _smb._tcp.local. PTR IN 3061 [29] Sofiya Ivanova’s MacBook._smb._tcp.local.
+  A: _smb._tcp.local. PTR IN 3062 [24] Hristo's Time Capsule._smb._tcp.local.
+
+Input: in/test-56.bin
+Packet Length: 262
+Answers: 2 + 6
+  A: Hristo’s Mac mini._device-info._tcp.local. TXT IN 4500 [28] model=Macmini6,2; osxvers=16
+  A: _smb._tcp.local. PTR IN 4500 [22] Hristo’s Mac mini._smb._tcp.local.
+  A: Hristo’s Mac mini._smb._tcp.local. TXT IN FLUSH 4500 [1]
+  A: Hristo’s Mac mini._smb._tcp.local. SRV IN FLUSH 120 [18] 445 minifritz.local.
+  A: minifritz.local. AAAA IN FLUSH 120 [16] fe80:0000:0000:0000:142e:54ff:b8c4:fd09
+  A: minifritz.local. A IN FLUSH 120 [4] 192.168.254.16
+  A: Hristo’s Mac mini.local. NSEC IN FLUSH 4500 [9] Hristo’s Mac mini._smb._tcp.local.  00 05 00 00 80 00 40
+  A: minifritz.local. NSEC IN FLUSH 120 [8] minifritz...local.  00 04 40 00 00 08
+
+Input: in/test-63.bin
+Packet Length: 147
+Questions: 2
+  Q: _afpovertcp._tcp.local. PTR IN
+  Q: Sofiya-Ivanovas-MacBook.local. A IN
+Answers: 2 + 0
+  A: _afpovertcp._tcp.local. PTR IN 2881 [29] Sofiya Ivanova’s MacBook._afpovertcp._tcp.local.
+  A: _afpovertcp._tcp.local. PTR IN 2881 [24] Hristo's Time Capsule._afpovertcp._tcp.local.
+
+Input: in/test-66.bin
+Packet Length: 269
+Answers: 2 + 6
+  A: Hristo’s Mac mini._device-info._tcp.local. TXT IN 4500 [28] model=Macmini6,2; osxvers=16
+  A: _afpovertcp._tcp.local. PTR IN 4500 [22] Hristo’s Mac mini._afpovertcp._tcp.local.
+  A: Hristo’s Mac mini._afpovertcp._tcp.local. TXT IN FLUSH 4500 [1]
+  A: Hristo’s Mac mini._afpovertcp._tcp.local. SRV IN FLUSH 120 [18] 548 minifritz.local.
+  A: minifritz.local. AAAA IN FLUSH 120 [16] fe80:0000:0000:0000:142e:54ff:b8c4:fd09
+  A: minifritz.local. A IN FLUSH 120 [4] 192.168.254.16
+  A: Hristo’s Mac mini.local. NSEC IN FLUSH 4500 [9] Hristo’s Mac mini._afpovertcp._tcp.local.  00 05 00 00 80 00 40
+  A: minifritz.local. NSEC IN FLUSH 120 [8] minifritz...local.  00 04 40 00 00 08
+
+Input: in/test-83.bin
+Packet Length: 105
+Answers: 1 + 2
+  A: Sofiya-Ivanovas-MacBook.local. A IN FLUSH 120 [4] 192.168.254.20
+  A: Sofiya-Ivanovas-MacBook.local. AAAA IN FLUSH 120 [16] fe80:0000:0000:0000:021c:b3ff:feb2:72a3
+  A: Sofiya-Ivanovas-MacBook.local. NSEC IN FLUSH 120 [8] Sofiya-Ivanovas-MacBook...local.  00 04 40 00 00 08
+
+Input: in/test-88.bin
+Packet Length: 48
+Questions: 2
+  Q: _rfb._tcp.local. PTR IN
+  Q: _airport._tcp.local. PTR IN
+
+Input: in/test-89.bin
+Packet Length: 459
+Answers: 2 + 7
+  A: _airport._tcp.local. PTR IN 4500 [24] Hristo's Time Capsule._airport._tcp.local.
+  A: Hristo's Time Capsule._device-info._tcp.local. TXT IN 4500 [23] model=TimeCapsule6,116
+  A: Hristos-Time-Capsule.local. A IN FLUSH 120 [4] 192.168.254.49
+  A: Hristo's Time Capsule._airport._tcp.local. TXT IN FLUSH 4500 [168] waMA=70-73-CB-B4-C9-B3,raMA=70-73-CB-BB-04-E7,raM2=70-73-CB-BB-04-E8,raNm=nbis-test,raCh=11,rCh2=132,raSt=0,raNA=0,syFl=0x820C,syAP=116,syVs=7.6.8,srcv=76800.1,bjSd=30
+  A: Hristos-Time-Capsule.local. AAAA IN FLUSH 120 [16] fe80:0000:0000:0000:7273:cbff:feb4:c9b3
+  A: Hristo's Time Capsule._airport._tcp.local. SRV IN FLUSH 120 [8] 5009 Hristos-Time-Capsule.local.
+  A: Hristos-Time-Capsule.local. A IN FLUSH 120 [4] 169.254.23.40
+  A: Hristos-Time-Capsule.local. NSEC IN FLUSH 120 [8] Hristos-Time-Capsule...local.  00 04 40 00 00 08
+  A: Hristo's Time Capsule.local. NSEC IN FLUSH 4500 [9] Hristo's Time Capsule._airport._tcp.local.  00 05 00 00 80 00 40
+
+Input: in/test-91.bin
+Packet Length: 279
+Answers: 2 + 6
+  A: Sofiya Ivanova’s MacBook._device-info._tcp.local. TXT IN 4500 [17] model=Macmini2,1
+  A: _rfb._tcp.local. PTR IN 4500 [29] Sofiya Ivanova’s MacBook._rfb._tcp.local.
+  A: Sofiya Ivanova’s MacBook._rfb._tcp.local. TXT IN FLUSH 4500 [1]
+  A: Sofiya Ivanova’s MacBook._rfb._tcp.local. SRV IN FLUSH 120 [32] 5900 Sofiya-Ivanovas-MacBook.local.
+  A: Sofiya-Ivanovas-MacBook.local. AAAA IN FLUSH 120 [16] fe80:0000:0000:0000:021c:b3ff:feb2:72a3
+  A: Sofiya-Ivanovas-MacBook.local. A IN FLUSH 120 [4] 192.168.254.20
+  A: Sofiya Ivanova’s MacBook.local. NSEC IN FLUSH 4500 [9] Sofiya Ivanova’s MacBook._rfb._tcp.local.  00 05 00 00 80 00 40
+  A: Sofiya-Ivanovas-MacBook.local. NSEC IN FLUSH 120 [8] Sofiya-Ivanovas-MacBook...local.  00 04 40 00 00 08
+
+Input: in/test-95.bin
+Packet Length: 286
+Questions: 3
+  Q: _afpovertcp._tcp.local. PTR IN
+  Q: _smb._tcp.local. PTR IN
+  Q: _adisk._tcp.local. PTR IN
+Answers: 6 + 0
+  A: _afpovertcp._tcp.local. PTR IN 2353 [29] Sofiya Ivanova’s MacBook._afpovertcp._tcp.local.
+  A: _afpovertcp._tcp.local. PTR IN 3973 [22] Hristo’s Mac mini._afpovertcp._tcp.local.
+  A: _afpovertcp._tcp.local. PTR IN 2353 [24] Hristo's Time Capsule._afpovertcp._tcp.local.
+  A: _smb._tcp.local. PTR IN 2353 [29] Sofiya Ivanova’s MacBook._smb._tcp.local.
+  A: _smb._tcp.local. PTR IN 3792 [22] Hristo’s Mac mini._smb._tcp.local.
+  A: _smb._tcp.local. PTR IN 2353 [24] Hristo's Time Capsule._smb._tcp.local.
+
+Input: in/test-96.bin
+Packet Length: 319
+Answers: 2 + 3
+  A: Hristo's Time Capsule._device-info._tcp.local. TXT IN 4500 [23] model=TimeCapsule6,116
+  A: _adisk._tcp.local. PTR IN 4500 [24] Hristo's Time Capsule._adisk._tcp.local.
+  A: Hristo's Time Capsule._adisk._tcp.local. TXT IN FLUSH 4500 [110] sys=waMA=70:73:CB:B4:C9:B3,adVF=0x1000; dk2=adVF=0x1083,adVN=Capsule,adVU=55fabb8b-a63b-5441-9874-6edb504eb30a
+  A: Hristo's Time Capsule._adisk._tcp.local. SRV IN FLUSH 120 [29] 9 Hristos-Time-Capsule.local.
+  A: Hristo's Time Capsule.local. NSEC IN FLUSH 4500 [9] Hristo's Time Capsule._adisk._tcp.local.  00 05 00 00 80 00 40

managed_components/espressif__mdns/tests/test_afl_fuzz_host/mdns_di.h

@@ -0,0 +1,61 @@
+/*
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Unlicense OR CC0-1.0
+ */
+/*
+ * MDNS Dependecy injection -- preincluded to inject interface test functions into static variables
+ *
+ */
+
+#include "mdns.h"
+#include "mdns_private.h"
+
+void              (*mdns_test_static_execute_action)(mdns_action_t *) = NULL;
+mdns_srv_item_t *(*mdns_test_static_mdns_get_service_item)(const char *service, const char *proto, const char *hostname) = NULL;
+mdns_search_once_t *(*mdns_test_static_search_init)(const char *name, const char *service, const char *proto, uint16_t type, bool unicast,
+        uint32_t timeout, uint8_t max_results,
+        mdns_query_notify_t notifier) = NULL;
+esp_err_t         (*mdns_test_static_send_search_action)(mdns_action_type_t type, mdns_search_once_t *search) = NULL;
+void              (*mdns_test_static_search_free)(mdns_search_once_t *search) = NULL;
+
+static void _mdns_execute_action(mdns_action_t *action);
+static mdns_srv_item_t *_mdns_get_service_item(const char *service, const char *proto, const char *hostname);
+static mdns_search_once_t *_mdns_search_init(const char *name, const char *service, const char *proto, uint16_t type, bool unicast,
+        uint32_t timeout, uint8_t max_results, mdns_query_notify_t notifier);
+static esp_err_t _mdns_send_search_action(mdns_action_type_t type, mdns_search_once_t *search);
+static void _mdns_search_free(mdns_search_once_t *search);
+
+void mdns_test_init_di(void)
+{
+    mdns_test_static_execute_action = _mdns_execute_action;
+    mdns_test_static_mdns_get_service_item = _mdns_get_service_item;
+    mdns_test_static_search_init = _mdns_search_init;
+    mdns_test_static_send_search_action = _mdns_send_search_action;
+    mdns_test_static_search_free = _mdns_search_free;
+}
+
+void mdns_test_execute_action(void *action)
+{
+    mdns_test_static_execute_action((mdns_action_t *)action);
+}
+
+void mdns_test_search_free(mdns_search_once_t *search)
+{
+    return mdns_test_static_search_free(search);
+}
+
+esp_err_t mdns_test_send_search_action(mdns_action_type_t type, mdns_search_once_t *search)
+{
+    return mdns_test_static_send_search_action(type, search);
+}
+
+mdns_search_once_t *mdns_test_search_init(const char *name, const char *service, const char *proto, uint16_t type, uint32_t timeout, uint8_t max_results)
+{
+    return mdns_test_static_search_init(name, service, proto, type, timeout, type != MDNS_TYPE_PTR, max_results, NULL);
+}
+
+mdns_srv_item_t *mdns_test_mdns_get_service_item(const char *service, const char *proto)
+{
+    return mdns_test_static_mdns_get_service_item(service, proto, NULL);
+}

managed_components/espressif__mdns/tests/test_afl_fuzz_host/mdns_mock.h

@@ -0,0 +1,31 @@
+/*
+ * SPDX-FileCopyrightText: 2022-2023 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Unlicense OR CC0-1.0
+ */
+#pragma once
+#include "esp32_mock.h"
+#include "mdns.h"
+#include "mdns_private.h"
+
+
+static inline void *_mdns_get_packet_data(mdns_rx_packet_t *packet)
+{
+    return packet->pb->payload;
+}
+
+static inline size_t _mdns_get_packet_len(mdns_rx_packet_t *packet)
+{
+    return packet->pb->len;
+}
+
+static inline void _mdns_packet_free(mdns_rx_packet_t *packet)
+{
+    free(packet->pb);
+    free(packet);
+}
+
+static inline bool mdns_is_netif_ready(mdns_if_t tcpip_if, mdns_ip_protocol_t ip_protocol)
+{
+    return true;
+}

managed_components/espressif__mdns/tests/test_afl_fuzz_host/test.c

@@ -0,0 +1,276 @@
+/*
+ * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <signal.h>
+#include <string.h>
+
+#include "esp32_mock.h"
+#include "mdns.h"
+#include "mdns_private.h"
+
+//
+// Global stuctures containing packet payload, search
+mdns_rx_packet_t g_packet;
+struct pbuf mypbuf;
+mdns_search_once_t *search = NULL;
+
+//
+// Dependency injected test functions
+void mdns_test_execute_action(void *action);
+mdns_srv_item_t *mdns_test_mdns_get_service_item(const char *service, const char *proto);
+mdns_search_once_t *mdns_test_search_init(const char *name, const char *service, const char *proto, uint16_t type, uint32_t timeout, uint8_t max_results);
+esp_err_t mdns_test_send_search_action(mdns_action_type_t type, mdns_search_once_t *search);
+void mdns_test_search_free(mdns_search_once_t *search);
+void mdns_test_init_di(void);
+extern mdns_server_t *_mdns_server;
+
+//
+// mdns function wrappers for mdns setup in test mode
+static int mdns_test_hostname_set(const char *mdns_hostname)
+{
+    for (int i = 0; i < MDNS_MAX_INTERFACES; i++) {
+        _mdns_server->interfaces[i].pcbs[MDNS_IP_PROTOCOL_V4].state = PCB_RUNNING;    // mark the PCB running to exercise mdns in fully operational mode
+        _mdns_server->interfaces[i].pcbs[MDNS_IP_PROTOCOL_V6].state = PCB_RUNNING;
+    }
+    int ret = mdns_hostname_set(mdns_hostname);
+    mdns_action_t *a = NULL;
+    GetLastItem(&a);
+    mdns_test_execute_action(a);
+    return ret;
+}
+
+static int mdns_test_add_delegated_host(const char *mdns_hostname)
+{
+    mdns_ip_addr_t addr = { .addr = { .u_addr = ESP_IPADDR_TYPE_V4 } };
+    addr.addr.u_addr.ip4.addr = 0x11111111;
+    int ret = mdns_delegate_hostname_add(mdns_hostname, &addr);
+    mdns_action_t *a = NULL;
+    GetLastItem(&a);
+    mdns_test_execute_action(a);
+    return ret;
+}
+
+
+static int mdns_test_service_instance_name_set(const char *service, const char *proto, const char *instance)
+{
+    int ret = mdns_service_instance_name_set(service, proto, instance);
+    mdns_action_t *a = NULL;
+    GetLastItem(&a);
+    mdns_test_execute_action(a);
+    return ret;
+}
+
+static int mdns_test_service_txt_set(const char *service, const char *proto,  uint8_t num_items, mdns_txt_item_t txt[])
+{
+    int ret = mdns_service_txt_set(service, proto, txt, num_items);
+    mdns_action_t *a = NULL;
+    GetLastItem(&a);
+    mdns_test_execute_action(a);
+    return ret;
+}
+
+static int mdns_test_sub_service_add(const char *sub_name, const char *service_name, const char *proto, uint32_t port)
+{
+    if (mdns_service_add(NULL, service_name, proto, port, NULL, 0)) {
+        // This is expected failure as the service thread is not running
+    }
+    mdns_action_t *a = NULL;
+    GetLastItem(&a);
+    mdns_test_execute_action(a);
+
+    if (mdns_test_mdns_get_service_item(service_name, proto) == NULL) {
+        return ESP_FAIL;
+    }
+    int ret = mdns_service_subtype_add_for_host(NULL, service_name, proto, NULL, sub_name);
+    a = NULL;
+    GetLastItem(&a);
+    mdns_test_execute_action(a);
+    return ret;
+}
+
+static int mdns_test_service_add(const char *service_name, const char *proto, uint32_t port)
+{
+    if (mdns_service_add(NULL, service_name, proto, port, NULL, 0)) {
+        // This is expected failure as the service thread is not running
+    }
+    mdns_action_t *a = NULL;
+    GetLastItem(&a);
+    mdns_test_execute_action(a);
+
+    if (mdns_test_mdns_get_service_item(service_name, proto) == NULL) {
+        return ESP_FAIL;
+    }
+    return ESP_OK;
+}
+
+static mdns_result_t *mdns_test_query(const char *name, const char *service, const char *proto, uint16_t type)
+{
+    search = mdns_test_search_init(name, service, proto, type, 3000, 20);
+    if (!search) {
+        abort();
+    }
+
+    if (mdns_test_send_search_action(ACTION_SEARCH_ADD, search)) {
+        mdns_test_search_free(search);
+        abort();
+    }
+
+    mdns_action_t *a = NULL;
+    GetLastItem(&a);
+    mdns_test_execute_action(a);
+    return NULL;
+}
+
+static void mdns_test_query_free(void)
+{
+    mdns_test_search_free(search);
+}
+
+//
+// function "under test" where afl-mangled packets passed
+//
+void mdns_parse_packet(mdns_rx_packet_t *packet);
+
+//
+// Test starts here
+//
+int main(int argc, char **argv)
+{
+    int i;
+    const char *mdns_hostname = "minifritz";
+    const char *mdns_instance = "Hristo's Time Capsule";
+    mdns_txt_item_t arduTxtData[4] = {
+        {"board", "esp32"},
+        {"tcp_check", "no"},
+        {"ssh_upload", "no"},
+        {"auth_upload", "no"}
+    };
+
+    const uint8_t mac[6] = {0xDE, 0xAD, 0xBE, 0xEF, 0x00, 0x32};
+
+    uint8_t buf[1460];
+    char winstance[21 + strlen(mdns_hostname)];
+
+    sprintf(winstance, "%s [%02x:%02x:%02x:%02x:%02x:%02x]", mdns_hostname, mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
+
+    // Init depencency injected methods
+    mdns_test_init_di();
+
+    if (mdns_init()) {
+        abort();
+    }
+
+    if (mdns_test_hostname_set(mdns_hostname)) {
+        abort();
+    }
+
+    if (mdns_test_add_delegated_host(mdns_hostname) || mdns_test_add_delegated_host("megafritz")) {
+        abort();
+    }
+
+#ifndef MDNS_NO_SERVICES
+
+    if (mdns_test_sub_service_add("_server", "_fritz", "_tcp", 22)) {
+        abort();
+    }
+
+    if (mdns_test_service_add("_telnet", "_tcp", 22)) {
+        abort();
+    }
+
+    if (mdns_test_service_add("_workstation", "_tcp", 9)) {
+        abort();
+    }
+    if (mdns_test_service_instance_name_set("_workstation", "_tcp", winstance)) {
+        abort();
+    }
+
+    if (mdns_test_service_add("_arduino", "_tcp", 3232)) {
+        abort();
+    }
+
+    if (mdns_test_service_txt_set("_arduino", "_tcp", 4, arduTxtData)) {
+        abort();
+    }
+
+    if (mdns_test_service_add("_http", "_tcp", 80)) {
+        abort();
+    }
+
+    if (mdns_test_service_instance_name_set("_http", "_tcp", "ESP WebServer")) {
+        abort();
+    }
+
+    if (
+        mdns_test_service_add("_afpovertcp", "_tcp", 548)
+        || mdns_test_service_add("_rfb", "_tcp", 885)
+        || mdns_test_service_add("_smb", "_tcp", 885)
+        || mdns_test_service_add("_adisk", "_tcp", 885)
+        || mdns_test_service_add("_airport", "_tcp", 885)
+        || mdns_test_service_add("_printer", "_tcp", 885)
+        || mdns_test_service_add("_airplay", "_tcp", 885)
+        || mdns_test_service_add("_raop", "_tcp", 885)
+        || mdns_test_service_add("_uscan", "_tcp", 885)
+        || mdns_test_service_add("_uscans", "_tcp", 885)
+        || mdns_test_service_add("_ippusb", "_tcp", 885)
+        || mdns_test_service_add("_scanner", "_tcp", 885)
+        || mdns_test_service_add("_ipp", "_tcp", 885)
+        || mdns_test_service_add("_ipps", "_tcp", 885)
+        || mdns_test_service_add("_pdl-datastream", "_tcp", 885)
+        || mdns_test_service_add("_ptp", "_tcp", 885)
+        || mdns_test_service_add("_sleep-proxy", "_udp", 885)) {
+        abort();
+    }
+#endif
+    mdns_result_t *results = NULL;
+    FILE *file;
+    size_t nread;
+
+#ifdef INSTR_IS_OFF
+    size_t len = 1460;
+    memset(buf, 0, 1460);
+
+    if (argc != 2) {
+        printf("Non-instrumentation mode: please supply a file name created by AFL to reproduce crash\n");
+        return 1;
+    } else {
+        //
+        // Note: parameter1 is a file (mangled packet) which caused the crash
+        file = fopen(argv[1], "r");
+        assert(file >= 0);
+        len = fread(buf, 1, 1460, file);
+        fclose(file);
+    }
+
+    for (i = 0; i < 1; i++) {
+#else
+    while (__AFL_LOOP(1000)) {
+        memset(buf, 0, 1460);
+        size_t len = read(0, buf, 1460);
+#endif
+        mypbuf.payload = malloc(len);
+        memcpy(mypbuf.payload, buf, len);
+        mypbuf.len = len;
+        g_packet.pb = &mypbuf;
+        mdns_test_query("minifritz", "_fritz", "_tcp", MDNS_TYPE_ANY);
+        mdns_test_query(NULL, "_fritz", "_tcp", MDNS_TYPE_PTR);
+        mdns_test_query(NULL, "_afpovertcp", "_tcp", MDNS_TYPE_PTR);
+        mdns_parse_packet(&g_packet);
+        free(mypbuf.payload);
+    }
+#ifndef MDNS_NO_SERVICES
+    mdns_service_remove_all();
+    mdns_action_t *a = NULL;
+    GetLastItem(&a);
+    mdns_test_execute_action(a);
+#endif
+    ForceTaskDelete();
+    mdns_free();
+    return 0;
+}