Api fuzzer overflow bug (#28161)

* fixing overflow error in api fuzzer

* fixing some sanity checks

* fix code style
pull/28171/head
Vignesh Babu 3 years ago committed by GitHub
parent 86d119c8ab
commit 78a4d21f9b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
  1. 21
      test/core/end2end/fuzzers/api_fuzzer.cc

@ -43,13 +43,15 @@
#include "test/core/end2end/fuzzers/api_fuzzer.pb.h"
#include "test/core/util/passthru_endpoint.h"
#define MAX_ADVANCE_TIME_MICROS (24 * 3600 * 365 * 1000000) // 1 year
static constexpr uint64_t kMaxAdvanceTimeMicros =
31536000000000; // 1 year (24 * 365 * 3600 * 1000000)
// Applicable when simulating channel actions. Prevents overflows.
#define MAX_WAIT_MS (24 * 3600 * 365 * 1000) // 1 year
static constexpr uint64_t kMaxWaitMs =
31536000000; // 1 year (24 * 365 * 3600 * 1000)
// Applicable when simulating channel actions. Prevents overflows.
#define MAX_ADD_N_READABLE_BYTES (2 * 1024 * 1024) // 2GB
static constexpr uint64_t kMaxAddNReadableBytes = (2 * 1024 * 1024); // 2GB
// Applicable when simulating channel actions. Prevents overflows.
#define MAX_ADD_N_WRITABLE_BYTES (2 * 1024 * 1024) // 2GB
static constexpr uint64_t kMaxAddNWritableBytes = (2 * 1024 * 1024); // 2GB
////////////////////////////////////////////////////////////////////////////////
// logging
@ -789,7 +791,7 @@ DEFINE_PROTO_FUZZER(const api_fuzzer::Msg& msg) {
g_now = gpr_time_add(
g_now,
gpr_time_from_seconds(
std::max<int64_t>(1, static_cast<int64_t>(MAX_WAIT_MS / 1000)),
std::max<int64_t>(1, static_cast<int64_t>(kMaxWaitMs / 1000)),
GPR_TIMESPAN));
grpc_timer_manager_tick();
GPR_ASSERT(!poll_cq());
@ -820,7 +822,7 @@ DEFINE_PROTO_FUZZER(const api_fuzzer::Msg& msg) {
g_now = gpr_time_add(
g_now, gpr_time_from_micros(
std::min(static_cast<uint64_t>(action.advance_time()),
static_cast<uint64_t>(MAX_ADVANCE_TIME_MICROS)),
kMaxAdvanceTimeMicros),
GPR_TIMESPAN));
break;
}
@ -848,12 +850,11 @@ DEFINE_PROTO_FUZZER(const api_fuzzer::Msg& msg) {
const api_fuzzer::ChannelAction& channel_action =
action.create_channel().channel_actions(i);
g_channel_actions.push_back({
std::min(channel_action.wait_ms(),
static_cast<uint64_t>(MAX_WAIT_MS)),
std::min(channel_action.wait_ms(), kMaxWaitMs),
std::min(channel_action.add_n_bytes_writable(),
static_cast<uint64_t>(MAX_ADD_N_WRITABLE_BYTES)),
kMaxAddNWritableBytes),
std::min(channel_action.add_n_bytes_readable(),
static_cast<uint64_t>(MAX_ADD_N_READABLE_BYTES)),
kMaxAddNReadableBytes),
});
}
GPR_ASSERT(g_channel != nullptr);

Loading…
Cancel
Save